CVE-2009-0269


Published: 26-01-2009
Updated: 29-01-2009

Product:
linux: kernel 2.2.27
linux: kernel 2.4.36
linux: kernel 2.4.36.1
linux: kernel 2.4.36.2
linux: kernel 2.4.36.3
linux: kernel 2.4.36.4
linux: kernel 2.4.36.5
linux: kernel 2.4.36.6
linux: kernel 2.6
linux: kernel 2.6.18
linux: kernel 2.6.18
linux: kernel 2.6.18
linux: kernel 2.6.18
linux: kernel 2.6.18
linux: kernel 2.6.18
linux: kernel 2.6.18
linux: kernel 2.6.19.4
linux: kernel 2.6.19.5
linux: kernel 2.6.19.6
linux: kernel 2.6.19.7
linux: kernel 2.6.20.16
linux: kernel 2.6.20.17
linux: kernel 2.6.20.18
linux: kernel 2.6.20.19
linux: kernel 2.6.20.20
linux: kernel 2.6.20.21
linux: kernel 2.6.21.5
linux: kernel 2.6.21.6
linux: kernel 2.6.21.7
linux: kernel 2.6.22
linux: kernel 2.6.22.1
linux: kernel 2.6.22.10
linux: kernel 2.6.22.11
linux: kernel 2.6.22.12
linux: kernel 2.6.22.13
linux: kernel 2.6.22.14
linux: kernel 2.6.22.15
linux: kernel 2.6.22.17
linux: kernel 2.6.22.18
linux: kernel 2.6.22.19
linux: kernel 2.6.22.2
linux: kernel 2.6.22.20
linux: kernel 2.6.22.21
linux: kernel 2.6.22.22
linux: kernel 2.6.22.8
linux: kernel 2.6.22.9
linux: kernel 2.6.22_rc1
linux: kernel 2.6.22_rc7
linux: kernel 2.6.23
linux: kernel 2.6.23.10
linux: kernel 2.6.23.11
linux: kernel 2.6.23.12
linux: kernel 2.6.23.13
linux: kernel 2.6.23.15
linux: kernel 2.6.23.16
linux: kernel 2.6.23.17
linux: kernel 2.6.23.8
linux: kernel 2.6.23.9
linux: kernel 2.6.23_rc1
linux: kernel 2.6.24
linux: kernel 2.6.24.1
linux: kernel 2.6.24.2
linux: kernel 2.6.24.3
linux: kernel 2.6.24.4
linux: kernel 2.6.24.5
linux: kernel 2.6.24.6
linux: kernel 2.6.24.7
linux: kernel 2.6.24_rc1
linux: kernel 2.6.24_rc4
linux: kernel 2.6.24_rc5
linux: kernel 2.6.25
linux: kernel 2.6.25
linux: kernel 2.6.25.1
linux: kernel 2.6.25.1
linux: kernel 2.6.25.10
linux: kernel 2.6.25.10
linux: kernel 2.6.25.11
linux: kernel 2.6.25.11
linux: kernel 2.6.25.12
linux: kernel 2.6.25.12
linux: kernel 2.6.25.13
linux: kernel 2.6.25.14
linux: kernel 2.6.25.15
linux: kernel 2.6.25.16
linux: kernel 2.6.25.17
linux: kernel 2.6.25.2
linux: kernel 2.6.25.2
linux: kernel 2.6.25.3
linux: kernel 2.6.25.3
linux: kernel 2.6.25.4
linux: kernel 2.6.25.4
linux: kernel 2.6.25.5
linux: kernel 2.6.25.5
linux: kernel 2.6.25.6
linux: kernel 2.6.25.6
linux: kernel 2.6.25.7
linux: kernel 2.6.25.7
linux: kernel 2.6.25.8
linux: kernel 2.6.25.8
linux: kernel 2.6.25.9
linux: kernel 2.6.25.9
linux: kernel 2.6.26
linux: kernel 2.6.26.1
linux: kernel 2.6.26.2
linux: kernel 2.6.26.3
linux: kernel 2.6.26.4
linux: kernel 2.6.26.5
linux: kernel 2.6.27
linux: kernel 2.6.28

Severity: Medium (4.9)

CVSS vector: (AV:L/AC:L/Au:N/C:N/I:N/A:C)

Attack`s vector: Localy exploitable

Potential loss type: Availability

Vulnerability description:
fs/ecryptfs/inode.c in the eCryptfs subsystem in the Linux kernel before 2.6.28.1 allows local users to cause a denial of service (fault or memory corruption), or possibly have unspecified other impact, via a readlink call that results in an error, leading to use of a -1 return value as an array index.

Patch available: Yes

References:
BID: http://www.securityfocus.com/bid/33412
MLIST: https://lists.launchpad.net/ecryptfs-devel/msg00011.html
MLIST: https://lists.launchpad.net/ecryptfs-devel/msg00010.html
XF: http://xforce.iss.net/xforce/xfdb/48188
CONFIRM: http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.28.1
CONFIRM: http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.6.27.y.git;a=...

Cisco IOS Software Resource Reservation Protocol Interface Queue Wedge Vulnerability

A vulnerability in the Resource Reservation Protocol (RSVP) feature of Cisco IOS Software an...

30 september, 2013

Cisco IOS Software Internet Key Exchange Memory Leak Vulnerability

A vulnerability in the Internet Key Exchange (IKE) protocol of Cisco IOS Software and Cisco ...

30 september, 2013

Cisco IOS Software Multicast Network Time Protocol Denial of Service Vulnerability

A vulnerability in the implementation of the Network Time Protocol (NTP) feature in Cisco IO...

30 september, 2013

MS14-035: Cumulative Security Update for Internet Explorer (2969262)

This security update resolves two publicly disclosed vulnerabilities and fifty-seven privately repor...

11 june, 2014

MS14-036: Vulnerabilities in Microsoft Graphics Component Could Allow Remote Code Execution (2967487)

This security update resolves two privately reported vulnerabilities in Microsoft Windows, Microsoft...

11 june, 2014

MS14-034: Vulnerability in Microsoft Word Could Allow Remote Code Execution (2969261)

This security update resolves one privately reported vulnerability in Microsoft Office.

10 june, 2014

CVE-2014-6850

The SED Account (aka com.starkville.smartapps) application 1.153.0034 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

CVE-2014-6848

The DS file (aka com.synology.DSfile) application 4.1.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

CVE-2014-6847

The Horoscopes and Dreams (aka com.horoscopesanddreams) application 1.0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

CVE-2014-6846

The Four Seasons Beverly Hills (aka com.intelitycorp.FourSeasons.android.ice) application @7F050007 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

CVE-2014-6845

The MediaFire (aka com.mediafire.android) application 1.1.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

CVE-2014-6844

The ABC Song (aka com.tabtale.abcsingalong) application 1.0.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

CVE-2014-6843

The Sweatshop (aka com.orderingapps.sweatshop) application 2.96 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

CVE-2014-6842

The Daily Advertiser Print (aka com.lafayettedailyadv.android.prod) application 6.7 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

CVE-2014-6841

The RTI INDIA (aka com.vbulletin.build_890) application 3.8.21 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

CVE-2014-6840

The My Wedding Planner (aka app.wedding) application 1.5 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

CVE-2014-6839

The Alma Corinthiana (aka com.alma.corinthiana) application 1.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

CVE-2014-6838

The Groupama toujours la (aka com.groupama.toujoursla) application 1.3.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

CVE-2014-6837

The Hillside (aka com.hillside.hermanus) application 1.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

CVE-2014-6836

The DS photo+ (aka com.synology.dsphoto) application 3.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

CVE-2014-6835

The Herbal Guide (aka com.pocket.herbal.guide) application 1.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

This Alert covers CVE-2010-0896 for the mail component of the Sun Convergence product

This Sun Alert covers CVE-2010-0896 for the mail component of the Sun Convergence product.

14 april, 2010

This Alert Covers CVE-2010-0893 for the Mail Component of the Sun Convergence Product

This Alert covers CVE-2010-0893 for the mail component of the Sun Convergence product.

14 april, 2010

SunOS 5.10_x86: ucode driver patch

6905530 processor microcode code can panic when retrieving microcode revision.

02 february, 2010

[RHSA-2010:1003-01] Moderate: git security update

Red Hat Security Advisory - Moderate: git security update

21 december, 2010

[RHSA-2010:1002-01] Moderate: mod_auth_mysql security update

Red Hat Security Advisory - Moderate: mod_auth_mysql security update

21 december, 2010

[RHSA-2010:1000-01] Important: bind security update

Red Hat Security Advisory - Important: bind security update

20 december, 2010