CVE-2009-0269


Published: 26-01-2009
Updated: 29-01-2009

Product:
linux: kernel 2.2.27
linux: kernel 2.4.36
linux: kernel 2.4.36.1
linux: kernel 2.4.36.2
linux: kernel 2.4.36.3
linux: kernel 2.4.36.4
linux: kernel 2.4.36.5
linux: kernel 2.4.36.6
linux: kernel 2.6
linux: kernel 2.6.18
linux: kernel 2.6.18
linux: kernel 2.6.18
linux: kernel 2.6.18
linux: kernel 2.6.18
linux: kernel 2.6.18
linux: kernel 2.6.18
linux: kernel 2.6.19.4
linux: kernel 2.6.19.5
linux: kernel 2.6.19.6
linux: kernel 2.6.19.7
linux: kernel 2.6.20.16
linux: kernel 2.6.20.17
linux: kernel 2.6.20.18
linux: kernel 2.6.20.19
linux: kernel 2.6.20.20
linux: kernel 2.6.20.21
linux: kernel 2.6.21.5
linux: kernel 2.6.21.6
linux: kernel 2.6.21.7
linux: kernel 2.6.22
linux: kernel 2.6.22.1
linux: kernel 2.6.22.10
linux: kernel 2.6.22.11
linux: kernel 2.6.22.12
linux: kernel 2.6.22.13
linux: kernel 2.6.22.14
linux: kernel 2.6.22.15
linux: kernel 2.6.22.17
linux: kernel 2.6.22.18
linux: kernel 2.6.22.19
linux: kernel 2.6.22.2
linux: kernel 2.6.22.20
linux: kernel 2.6.22.21
linux: kernel 2.6.22.22
linux: kernel 2.6.22.8
linux: kernel 2.6.22.9
linux: kernel 2.6.22_rc1
linux: kernel 2.6.22_rc7
linux: kernel 2.6.23
linux: kernel 2.6.23.10
linux: kernel 2.6.23.11
linux: kernel 2.6.23.12
linux: kernel 2.6.23.13
linux: kernel 2.6.23.15
linux: kernel 2.6.23.16
linux: kernel 2.6.23.17
linux: kernel 2.6.23.8
linux: kernel 2.6.23.9
linux: kernel 2.6.23_rc1
linux: kernel 2.6.24
linux: kernel 2.6.24.1
linux: kernel 2.6.24.2
linux: kernel 2.6.24.3
linux: kernel 2.6.24.4
linux: kernel 2.6.24.5
linux: kernel 2.6.24.6
linux: kernel 2.6.24.7
linux: kernel 2.6.24_rc1
linux: kernel 2.6.24_rc4
linux: kernel 2.6.24_rc5
linux: kernel 2.6.25
linux: kernel 2.6.25
linux: kernel 2.6.25.1
linux: kernel 2.6.25.1
linux: kernel 2.6.25.10
linux: kernel 2.6.25.10
linux: kernel 2.6.25.11
linux: kernel 2.6.25.11
linux: kernel 2.6.25.12
linux: kernel 2.6.25.12
linux: kernel 2.6.25.13
linux: kernel 2.6.25.14
linux: kernel 2.6.25.15
linux: kernel 2.6.25.16
linux: kernel 2.6.25.17
linux: kernel 2.6.25.2
linux: kernel 2.6.25.2
linux: kernel 2.6.25.3
linux: kernel 2.6.25.3
linux: kernel 2.6.25.4
linux: kernel 2.6.25.4
linux: kernel 2.6.25.5
linux: kernel 2.6.25.5
linux: kernel 2.6.25.6
linux: kernel 2.6.25.6
linux: kernel 2.6.25.7
linux: kernel 2.6.25.7
linux: kernel 2.6.25.8
linux: kernel 2.6.25.8
linux: kernel 2.6.25.9
linux: kernel 2.6.25.9
linux: kernel 2.6.26
linux: kernel 2.6.26.1
linux: kernel 2.6.26.2
linux: kernel 2.6.26.3
linux: kernel 2.6.26.4
linux: kernel 2.6.26.5
linux: kernel 2.6.27
linux: kernel 2.6.28

Severity: Medium (4.9)

CVSS vector: (AV:L/AC:L/Au:N/C:N/I:N/A:C)

Attack`s vector: Localy exploitable

Potential loss type: Availability

Vulnerability description:
fs/ecryptfs/inode.c in the eCryptfs subsystem in the Linux kernel before 2.6.28.1 allows local users to cause a denial of service (fault or memory corruption), or possibly have unspecified other impact, via a readlink call that results in an error, leading to use of a -1 return value as an array index.

Patch available: Yes

References:
BID: http://www.securityfocus.com/bid/33412
MLIST: https://lists.launchpad.net/ecryptfs-devel/msg00011.html
MLIST: https://lists.launchpad.net/ecryptfs-devel/msg00010.html
XF: http://xforce.iss.net/xforce/xfdb/48188
CONFIRM: http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.28.1
CONFIRM: http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.6.27.y.git;a=...

Cisco IOS Software Resource Reservation Protocol Interface Queue Wedge Vulnerability

A vulnerability in the Resource Reservation Protocol (RSVP) feature of Cisco IOS Software an...

30 september, 2013

Cisco IOS Software Internet Key Exchange Memory Leak Vulnerability

A vulnerability in the Internet Key Exchange (IKE) protocol of Cisco IOS Software and Cisco ...

30 september, 2013

Cisco IOS Software Multicast Network Time Protocol Denial of Service Vulnerability

A vulnerability in the implementation of the Network Time Protocol (NTP) feature in Cisco IO...

30 september, 2013

MS14-035: Cumulative Security Update for Internet Explorer (2969262)

This security update resolves two publicly disclosed vulnerabilities and fifty-seven privately repor...

11 june, 2014

MS14-036: Vulnerabilities in Microsoft Graphics Component Could Allow Remote Code Execution (2967487)

This security update resolves two privately reported vulnerabilities in Microsoft Windows, Microsoft...

11 june, 2014

MS14-034: Vulnerability in Microsoft Word Could Allow Remote Code Execution (2969261)

This security update resolves one privately reported vulnerability in Microsoft Office.

10 june, 2014

CVE-2015-1044

vmware-authd (aka the Authorization process) in VMware Workstation 10.x before 10.0.5, VMware Player 6.x before 6.0.5, and VMware ESXi 5.0 through 5.5 allows attackers to cause a host OS denial of service via unspecified vectors.

CVE-2015-1043

The Host Guest File System (HGFS) in VMware Workstation 10.x before 10.0.5, VMware Player 6.x before 6.0.5, and VMware Fusion 6.x before 6.0.5 and 7.x before 7.0.1 allows guest OS users to cause a guest OS denial of service via unspecified vectors.

CVE-2015-0236

libvirt before 1.2.12 allow remote authenticated users to obtain the VNC password by using the VIR_DOMAIN_XML_SECURE flag with a crafted (1) snapshot to the virDomainSnapshotGetXMLDesc interface or (2) image to the virDomainSaveImageGetXMLDesc interface.

CVE-2014-8370

VMware Workstation 10.x before 10.0.5, VMware Player 6.x before 6.0.5, VMware Fusion 6.x before 6.0.5, and VMware ESXi 5.0 through 5.5 allow host OS users to gain host OS privileges or cause a denial of service (arbitrary write to a file) by modifying a configuration file.

CVE-2015-1424

Cross-site request forgery (CSRF) vulnerability in Gecko CMS 2.2 and 2.3 allows remote attackers to hijack the authentication of administrators for requests that add an administrator user via a newuser request to admin/index.php.

CVE-2015-1423

Multiple SQL injection vulnerabilities in Gecko CMS 2.2 and 2.3 allow remote administrators to execute arbitrary SQL commands via the (1) jak_delete_log[] or (2) ssp parameter to admin/index.php.

CVE-2015-1422

Multiple cross-site scripting (XSS) vulnerabilities in Gecko CMS 2.2 and 2.3 allow remote attackers to inject arbitrary web script or HTML via the (1) horder[], (2) jak_catid, (3) jak_content, (4) jak_css, (5) jak_delete_log[], (6) jak_email, (7) jak_extfile, (8) jak_file, (9) jak_hookshow[], (10) jak_img, (11) jak_javascript, (12) jak_lcontent, (13) jak_name, (14) jak_password, (15) jak_showcontact, (16) jak_tags, (17) jak_title, (18) jak_url, (19) jak_username, (20) real_hook_id[], (21) sp, (22) sreal_plugin_id[], (23) ssp, or (24) sssp parameter to admin/index.php or the (25) editor, (26) field_id, (27) fldr, (28) lang, (29) popup, (30) subfolder, or (31) type parameter to js/editor/plugins/filemanager/dialog.php.

CVE-2014-8895

IBM TRIRIGA Application Platform 3.2.1.x, 3.3.2 before 3.3.2.3, and 3.4.1 before 3.4.1.1 allows remote attackers to bypass intended access restrictions and read the image files of arbitrary users via a crafted URL.

CVE-2014-8894

Open redirect vulnerability in IBM TRIRIGA Application Platform 3.2.1.x, 3.3.2 before 3.3.2.3, and 3.4.1 before 3.4.1.1 allows remote authenticated users to redirect users to arbitrary web sites and conduct phishing attacks via the out parameter.

CVE-2014-8893

Multiple cross-site scripting (XSS) vulnerabilities in (1) mainpage.jsp and (2) GetImageServlet.img in IBM TRIRIGA Application Platform 3.2.1.x, 3.3.2 before 3.3.2.3, and 3.4.1 before 3.4.1.1 allow remote authenticated users to inject arbitrary web script or HTML via a crafted URL.

CVE-2015-0586

The Network-Based Application Recognition (NBAR) protocol implementation in Cisco IOS 15.3(100)M and earlier on Cisco 2900 Integrated Services Router (aka Cisco Internet Router) devices allows remote attackers to cause a denial of service (NBAR process hang) via IPv4 packets, aka Bug ID CSCuo73682.

CVE-2015-0581

The XML parser in Cisco Prime Service Catalog before 10.1 allows remote authenticated users to read arbitrary files or cause a denial of service (CPU and memory consumption) via an external entity declaration in conjunction with an entity reference, as demonstrated by reading private keys, related to an XML External Entity (XXE) issue, aka Bug ID CSCup92880.

CVE-2015-0312

Double free vulnerability in Adobe Flash Player before 13.0.0.264 and 14.x through 16.x before 16.0.0.296 on Windows and OS X and before 11.2.202.440 on Linux allows attackers to execute arbitrary code via unspecified vectors.

CVE-2015-0235

Heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc 2.2, and other 2.x versions before 2.18, allows context-dependent attackers to execute arbitrary code via vectors related to the (1) gethostbyname or (2) gethostbyname2 function, aka "GHOST."

CVE-2014-8920

Buffer overflow in the Data Transfer Program in IBM i Access 5770-XE1 5R4, 6.1, and 7.1 on Windows allows local users to gain privileges via unspecified vectors.

This Alert covers CVE-2010-0896 for the mail component of the Sun Convergence product

This Sun Alert covers CVE-2010-0896 for the mail component of the Sun Convergence product.

14 april, 2010

This Alert Covers CVE-2010-0893 for the Mail Component of the Sun Convergence Product

This Alert covers CVE-2010-0893 for the mail component of the Sun Convergence product.

14 april, 2010

SunOS 5.10_x86: ucode driver patch

6905530 processor microcode code can panic when retrieving microcode revision.

02 february, 2010

[RHSA-2010:1003-01] Moderate: git security update

Red Hat Security Advisory - Moderate: git security update

21 december, 2010

[RHSA-2010:1002-01] Moderate: mod_auth_mysql security update

Red Hat Security Advisory - Moderate: mod_auth_mysql security update

21 december, 2010

[RHSA-2010:1000-01] Important: bind security update

Red Hat Security Advisory - Important: bind security update

20 december, 2010