This kernel update for the SUSE Linux Enterprise 10 SP3 kernel fixes several security issues and bugs.

The following security issues were fixed :

  - A memory leak in the ethtool ioctl was fixed that could     disclose kernel memory to local attackers with     CAP_NET_ADMIN privileges. (CVE-2010-4655)

  - The dvb_ca_ioctl function in     drivers/media/dvb/ttpci/av7110_ca.c in the Linux kernel     did not check the sign of a certain integer field, which     allowed local users to cause a denial of service (memory     corruption) or possibly have unspecified other impact     via a negative value. (CVE-2011-0521)

  - The ax25_getname function in net/ax25/af_ax25.c in the     Linux kernel did not initialize a certain structure,     which allowed local users to obtain potentially     sensitive information from kernel stack memory by     reading a copy of this structure. (CVE-2010-3875)

  - net/packet/af_packet.c in the Linux kernel did not     properly initialize certain structure members, which     allowed local users to obtain potentially sensitive     information from kernel stack memory by leveraging the     CAP_NET_RAW capability to read copies of the applicable     structures. (CVE-2010-3876)

  - The get_name function in net/tipc/socket.c in the Linux     kernel did not initialize a certain structure, which     allowed local users to obtain potentially sensitive     information from kernel stack memory by reading a copy     of this structure. (CVE-2010-3877)

  - A stack memory information leak in the xfs FSGEOMETRY_V1     ioctl was fixed. (CVE-2011-0711)

  - The task_show_regs function in arch/s390/kernel/traps.c     in the Linux kernel on the s390 platform allowed local     users to obtain the values of the registers of an     arbitrary process by reading a status file under /proc/.
    (CVE-2011-0710)

  - The sctp_process_unk_param function in     net/sctp/sm_make_chunk.c in the Linux kernel, when SCTP     is enabled, allowed remote attackers to cause a denial     of service (system crash) via an SCTPChunkInit packet     containing multiple invalid parameters that require a     large amount of error data. (CVE-2010-1173)

  - The uart_get_count function in     drivers/serial/serial_core.c in the Linux kernel did not     properly initialize a certain structure member, which     allowed local users to obtain potentially sensitive     information from kernel stack memory via a TIOCGICOUNT     ioctl call. (CVE-2010-4075)

  - The rs_ioctl function in drivers/char/amiserial.c in the     Linux kernel did not properly initialize a certain     structure member, which allowed local users to obtain     potentially sensitive information from kernel stack     memory via a TIOCGICOUNT ioctl call. (CVE-2010-4076)

  - The ntty_ioctl_tiocgicount function in     drivers/char/nozomi.c in the Linux kernel did not     properly initialize a certain structure member, which     allowed local users to obtain potentially sensitive     information from kernel stack memory via a TIOCGICOUNT     ioctl call. (CVE-2010-4077)

  - The load_mixer_volumes function in sound/oss/soundcard.c     in the OSS sound subsystem in the Linux kernel     incorrectly expected that a certain name field ends with     a '0' character, which allowed local users to conduct     buffer overflow attacks and gain privileges, or possibly     obtain sensitive information from kernel memory, via a     SOUND_MIXER_SETLEVELS ioctl call. (CVE-2010-4527)

  - Race condition in the __exit_signal function in     kernel/exit.c in the Linux kernel allowed local users to     cause a denial of service via vectors related to     multithreaded exec, the use of a thread group leader in     kernel/posix-cpu-timers.c, and the selection of a new     thread group leader in the de_thread function in     fs/exec.c. (CVE-2010-4248)

  - The blk_rq_map_user_iov function in block/blk-map.c in     the Linux kernel allowed local users to cause a denial     of service (panic) via a zero-length I/O request in a     device ioctl to a SCSI device, related to an unaligned     map. NOTE: this vulnerability exists because of an     incomplete fix for CVE-2010-4163. (CVE-2010-4668)

  - The hci_uart_tty_open function in the HCI UART driver     (drivers/bluetooth/hci_ldisc.c) in the Linux kernel did     not verify whether the tty has a write operation, which     allowed local users to cause a denial of service (NULL     pointer dereference) via vectors related to the     Bluetooth driver. (CVE-2010-4242)

  - Integer underflow in the irda_getsockopt function in     net/irda/af_irda.c in the Linux kernel on platforms     other than x86 allowed local users to obtain potentially     sensitive information from kernel heap memory via an     IRLMP_ENUMDEVICES getsockopt call. (CVE-2010-4529)

  - The aun_incoming function in net/econet/af_econet.c in     the Linux kernel, when Econet is enabled, allowed remote     attackers to cause a denial of service (NULL pointer     dereference and OOPS) by sending an Acorn Universal     Networking (AUN) packet over UDP. (CVE-2010-4342)

  - Race condition in the sctp_icmp_proto_unreachable     function in net/sctp/input.c in Linux kernel allowed     remote attackers to cause a denial of service (panic)     via an ICMP unreachable message to a socket that is     already locked by a user, which causes the socket to be     freed and triggers list corruption, related to the     sctp_wait_for_connect function. (CVE-2010-4526)

This SUSE Linux Enterprise 11 Service Pack 1 kernel update brings the Linux kernel to version 2.6.32.13. It also contains a fix for the following security issue :

  - If SCTP is enabled, the sctp_process_unk_param function     in net/sctp/sm_make_chunk.c allows remote attackers to     cause a denial of service (system crash) via an     SCTPChunkInit packet containing multiple invalid     parameters that require a large amount of error data.
    (CVE-2010-1173)

Additionally, the update fixes various minor bugs as documented in the kernel RPM package changelog.

The remote VMware ESX / ESXi host is missing a security-related patch.
It is, therefore, affected by multiple vulnerabilities, including remote code execution vulnerabilities, in several third-party components and libraries :

  - Apache Tomcat 
  - Apache Tomcat Manager
  - cURL 
  - Java Runtime Environment (JRE)
  - Kernel 
  - Microsoft SQL Express
  - OpenSSL
  - pam_krb5

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2013-0039 for details.

Updated kernel packages that fix multiple security issues and several bugs are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

This update fixes the following security issues :

* multiple flaws were found in the mmap and mremap implementations. A local user could use these flaws to cause a local denial of service or escalate their privileges. (CVE-2010-0291, Important)

* a NULL pointer dereference flaw was found in the Fast Userspace Mutexes (futexes) implementation. The unlock code path did not check if the futex value associated with pi_state->owner had been modified.
A local user could use this flaw to modify the futex value, possibly leading to a denial of service or privilege escalation when the pi_state->owner pointer is dereferenced. (CVE-2010-0622, Important)

* a NULL pointer dereference flaw was found in the Linux kernel Network File System (NFS) implementation. A local user on a system that has an NFS-mounted file system could use this flaw to cause a denial of service or escalate their privileges on that system.
(CVE-2010-1087, Important)

* a flaw was found in the sctp_process_unk_param() function in the Linux kernel Stream Control Transmission Protocol (SCTP) implementation. A remote attacker could send a specially crafted SCTP packet to an SCTP listening port on a target system, causing a kernel panic (denial of service). (CVE-2010-1173, Important)

* a flaw was found in the Linux kernel Transparent Inter-Process Communication protocol (TIPC) implementation. If a client application, on a local system where the tipc module is not yet in network mode, attempted to send a message to a remote TIPC node, it would dereference a NULL pointer on the local system, causing a kernel panic (denial of service). (CVE-2010-1187, Important)

* a buffer overflow flaw was found in the Linux kernel Global File System 2 (GFS2) implementation. In certain cases, a quota could be written past the end of a memory page, causing memory corruption, leaving the quota stored on disk in an invalid state. A user with write access to a GFS2 file system could trigger this flaw to cause a kernel crash (denial of service) or escalate their privileges on the GFS2 server. This issue can only be triggered if the GFS2 file system is mounted with the 'quota=on' or 'quota=account' mount option.
(CVE-2010-1436, Important)

* a race condition between finding a keyring by name and destroying a freed keyring was found in the Linux kernel key management facility. A local user could use this flaw to cause a kernel panic (denial of service) or escalate their privileges. (CVE-2010-1437, Important)

* a flaw was found in the link_path_walk() function in the Linux kernel. Using the file descriptor returned by the open() function with the O_NOFOLLOW flag on a subordinate NFS-mounted file system, could result in a NULL pointer dereference, causing a denial of service or privilege escalation. (CVE-2010-1088, Moderate)

* a missing permission check was found in the gfs2_set_flags() function in the Linux kernel GFS2 implementation. A local user could use this flaw to change certain file attributes of files, on a GFS2 file system, that they do not own. (CVE-2010-1641, Low)

Red Hat would like to thank Jukka Taimisto and Olli Jarva of Codenomicon Ltd, Nokia Siemens Networks, and Wind River on behalf of their customer, for responsibly reporting CVE-2010-1173; Mario Mikocevic for responsibly reporting CVE-2010-1436; and Dan Rosenberg for responsibly reporting CVE-2010-1641.

This update also fixes several bugs. Documentation for these bug fixes will be available shortly from http://www.redhat.com/docs/en-US/errata/RHSA-2010-0504/Kernel_Security
_Update/ index.html

Users should upgrade to these updated packages, which contain backported patches to correct these issues. The system must be rebooted for this update to take effect.

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2010-0504 advisory.

    - [fs] gfs2: fix permissions checking for setflags ioctl (Steven Whitehouse) [595580 595399]     {CVE-2010-1641}
    - [misc] keys: do not find already freed keyrings (Vitaly Mayatskikh) [585099 585100] {CVE-2010-1437}
    - [misc] futex: handle futex value corruption gracefully (Jerome Marchand) [563093 480396] {CVE-2010-0622}
    - [misc] futex: handle user space corruption gracefully (Jerome Marchand) [563093 480396] {CVE-2010-0622}
    - [misc] futex: fix fault handling in futex_lock_pi (Jerome Marchand) [563093 480396] {CVE-2010-0622}
    - [net] sctp: fix skb_over_panic w/too many unknown params (Neil Horman) [584657 584658] {CVE-2010-1173}
    - [mm] keep get_unmapped_area_prot functional (Danny Feng) [556709 556710] {CVE-2010-0291}
    - [mm] switch do_brk to get_unmapped_area (Danny Feng) [556709 556710] {CVE-2010-0291}
    - [mm] take arch_mmap_check into get_unmapped_area (Danny Feng) [556709 556710] {CVE-2010-0291}
    - [mm] get rid of open-coding in ia64_brk (Danny Feng) [556709 556710] {CVE-2010-0291}
    - [mm] unify sys_mmap* functions (Danny Feng) [556709 556710] {CVE-2010-0291}
    - [mm] kill ancient cruft in s390 compat mmap (Danny Feng) [556709 556710] {CVE-2010-0291}
    - [mm] fix pgoff in have to relocate case of mremap (Danny Feng) [556709 556710] {CVE-2010-0291}
    - [mm] fix the arch checks in MREMAP_FIXED case (Danny Feng) [556709 556710] {CVE-2010-0291}
    - [mm] fix checks for expand-in-place mremap (Danny Feng) [556709 556710] {CVE-2010-0291}
    - [mm] add new vma_expandable helper function (Danny Feng) [556709 556710] {CVE-2010-0291}
    - [mm] move MREMAP_FIXED into its own header (Danny Feng) [556709 556710] {CVE-2010-0291}
    - [mm] move locating vma code and checks on it (Danny Feng) [556709 556710] {CVE-2010-0291}
    - [net] tipc: fix various oopses in uninitialized code (Neil Horman) [578058 558693] {CVE-2010-1187}
    - [fs] vfs: fix LOOKUP_FOLLOW on automount symlinks (Jeff Layton) [567815 567816] {CVE-2010-1088}
    - [nfs] fix an oops when truncating a file (Jeff Layton) [567194 567195] {CVE-2010-1087}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update fixes the following security issues :

  - multiple flaws were found in the mmap and mremap     implementations. A local user could use these flaws to     cause a local denial of service or escalate their     privileges. (CVE-2010-0291, Important)

  - a NULL pointer dereference flaw was found in the Fast     Userspace Mutexes (futexes) implementation. The unlock     code path did not check if the futex value associated     with pi_state->owner had been modified. A local user     could use this flaw to modify the futex value, possibly     leading to a denial of service or privilege escalation     when the pi_state->owner pointer is dereferenced.
    (CVE-2010-0622, Important)

  - a NULL pointer dereference flaw was found in the Linux     kernel Network File System (NFS) implementation. A local     user on a system that has an NFS-mounted file system     could use this flaw to cause a denial of service or     escalate their privileges on that system.
    (CVE-2010-1087, Important)

  - a flaw was found in the sctp_process_unk_param()     function in the Linux kernel Stream Control Transmission     Protocol (SCTP) implementation. A remote attacker could     send a specially crafted SCTP packet to an SCTP     listening port on a target system, causing a kernel     panic (denial of service). (CVE-2010-1173, Important)

  - a flaw was found in the Linux kernel Transparent     Inter-Process Communication protocol (TIPC)     implementation. If a client application, on a local     system where the tipc module is not yet in network mode,     attempted to send a message to a remote TIPC node, it     would dereference a NULL pointer on the local system,     causing a kernel panic (denial of service).
    (CVE-2010-1187, Important)

  - a buffer overflow flaw was found in the Linux kernel     Global File System 2 (GFS2) implementation. In certain     cases, a quota could be written past the end of a memory     page, causing memory corruption, leaving the quota     stored on disk in an invalid state. A user with write     access to a GFS2 file system could trigger this flaw to     cause a kernel crash (denial of service) or escalate     their privileges on the GFS2 server. This issue can only     be triggered if the GFS2 file system is mounted with the     'quota=on' or 'quota=account' mount option.
    (CVE-2010-1436, Important)

  - a race condition between finding a keyring by name and     destroying a freed keyring was found in the Linux kernel     key management facility. A local user could use this     flaw to cause a kernel panic (denial of service) or     escalate their privileges. (CVE-2010-1437, Important)

  - a flaw was found in the link_path_walk() function in the     Linux kernel. Using the file descriptor returned by the     open() function with the O_NOFOLLOW flag on a     subordinate NFS-mounted file system, could result in a     NULL pointer dereference, causing a denial of service or     privilege escalation. (CVE-2010-1088, Moderate)

  - a missing permission check was found in the     gfs2_set_flags() function in the Linux kernel GFS2     implementation. A local user could use this flaw to     change certain file attributes of files, on a GFS2 file     system, that they do not own. (CVE-2010-1641, Low)

Red Hat would like to thank Jukka Taimisto and Olli Jarva of Codenomicon Ltd, Nokia Siemens Networks, and Wind River on behalf of their customer, for responsibly reporting CVE-2010-1173; Mario Mikocevic for responsibly reporting CVE-2010-1436; and Dan Rosenberg for responsibly reporting CVE-2010-1641.

This update also fixes several bugs.

The system must be rebooted for this update to take effect.

This update of the openSUSE 11.2 kernel fixes lots of security issues.

Following security issues were fixed: CVE-2011-1493: In the rose networking stack, when parsing the FAC_NATIONAL_DIGIS facilities field, it was possible for a remote host to provide more digipeaters than expected, resulting in heap corruption. Check against ROSE_MAX_DIGIS to prevent overflows, and abort facilities parsing on failure.

CVE-2011-1182: Local attackers could send signals to their programs that looked like coming from the kernel, potentially gaining privileges in the context of setuid programs.

CVE-2011-1082: The epoll subsystem in Linux did not prevent users from creating circular epoll file structures, potentially leading to a denial of service (kernel deadlock).

CVE-2011-1163: The code for evaluating OSF partitions (in fs/partitions/osf.c) contained a bug that leaks data from kernel heap memory to userspace for certain corrupted OSF partitions.

CVE-2011-1012: The code for evaluating LDM partitions (in fs/partitions/ldm.c) contained a bug that could crash the kernel for certain corrupted LDM partitions.

CVE-2011-1010: The code for evaluating Mac partitions (in fs/partitions/mac.c) contained a bug that could crash the kernel for certain corrupted Mac partitions.

CVE-2011-1476: Specially crafted requests may be written to /dev/sequencer resulting in an underflow when calculating a size for a copy_from_user() operation in the driver for MIDI interfaces. On x86, this just returns an error, but it could have caused memory corruption on other architectures. Other malformed requests could have resulted in the use of uninitialized variables.

CVE-2011-1477: Due to a failure to validate user-supplied indexes in the driver for Yamaha YM3812 and OPL-3 chips, a specially crafted ioctl request could have been sent to /dev/sequencer, resulting in reading and writing beyond the bounds of heap buffers, and potentially allowing privilege escalation.

CVE-2011-1090: A page allocator issue in NFS v4 ACL handling that could lead to a denial of service (crash) was fixed.

CVE-2010-3880: net/ipv4/inet_diag.c in the Linux kernel did not properly audit INET_DIAG bytecode, which allowed local users to cause a denial of service (kernel infinite loop) via crafted INET_DIAG_REQ_BYTECODE instructions in a netlink message that contains multiple attribute elements, as demonstrated by INET_DIAG_BC_JMP instructions.

CVE-2011-0521: The dvb_ca_ioctl function in drivers/media/dvb/ttpci/av7110_ca.c in the Linux kernel did not check the sign of a certain integer field, which allowed local users to cause a denial of service (memory corruption) or possibly have unspecified other impact via a negative value.

CVE-2010-3875: The ax25_getname function in net/ax25/af_ax25.c in the Linux kernel did not initialize a certain structure, which allowed local users to obtain potentially sensitive information from kernel stack memory by reading a copy of this structure.

CVE-2010-3876: net/packet/af_packet.c in the Linux kernel did not properly initialize certain structure members, which allowed local users to obtain potentially sensitive information from kernel stack memory by leveraging the CAP_NET_RAW capability to read copies of the applicable structures.

CVE-2010-3877: The get_name function in net/tipc/socket.c in the Linux kernel did not initialize a certain structure, which allowed local users to obtain potentially sensitive information from kernel stack memory by reading a copy of this structure.

CVE-2010-3705: The sctp_auth_asoc_get_hmac function in net/sctp/auth.c in the Linux kernel did not properly validate the hmac_ids array of an SCTP peer, which allowed remote attackers to cause a denial of service (memory corruption and panic) via a crafted value in the last element of this array.

CVE-2011-0711: A stack memory information leak in the xfs FSGEOMETRY_V1 ioctl was fixed.

CVE-2011-0712: Multiple buffer overflows in the caiaq Native Instruments USB audio functionality in the Linux kernel might have allowed attackers to cause a denial of service or possibly have unspecified other impact via a long USB device name, related to (1) the snd_usb_caiaq_audio_init function in sound/usb/caiaq/audio.c and (2) the snd_usb_caiaq_midi_init function in sound/usb/caiaq/midi.c.

CVE-2010-1173: The sctp_process_unk_param function in net/sctp/sm_make_chunk.c in the Linux kernel, when SCTP is enabled, allowed remote attackers to cause a denial of service (system crash) via an SCTPChunkInit packet containing multiple invalid parameters that require a large amount of error data.

CVE-2010-4075: The uart_get_count function in drivers/serial/serial_core.c in the Linux kernel did not properly initialize a certain structure member, which allowed local users to obtain potentially sensitive information from kernel stack memory via a TIOCGICOUNT ioctl call.

CVE-2010-4076: The rs_ioctl function in drivers/char/amiserial.c in the Linux kernel did not properly initialize a certain structure member, which allowed local users to obtain potentially sensitive information from kernel stack memory via a TIOCGICOUNT ioctl call.

CVE-2010-4077: The ntty_ioctl_tiocgicount function in drivers/char/nozomi.c in the Linux kernel did not properly initialize a certain structure member, which allowed local users to obtain potentially sensitive information from kernel stack memory via a TIOCGICOUNT ioctl call.

CVE-2010-4248: Race condition in the __exit_signal function in kernel/exit.c in the Linux kernel allowed local users to cause a denial of service via vectors related to multithreaded exec, the use of a thread group leader in kernel/posix-cpu-timers.c, and the selection of a new thread group leader in the de_thread function in fs/exec.c.

CVE-2010-4243: fs/exec.c in the Linux kernel did not enable the OOM Killer to assess use of stack memory by arrays representing the (1) arguments and (2) environment, which allows local users to cause a denial of service (memory consumption) via a crafted exec system call, aka an 'OOM dodging issue,' a related issue to CVE-2010-3858.

CVE-2010-4648: Fixed cryptographic weakness potentially leaking information to remote (but physically nearby) users in the orinoco wireless driver.

CVE-2010-4527: The load_mixer_volumes function in sound/oss/soundcard.c in the OSS sound subsystem in the Linux kernel incorrectly expected that a certain name field ends with a '\0' character, which allowed local users to conduct buffer overflow attacks and gain privileges, or possibly obtain sensitive information from kernel memory, via a SOUND_MIXER_SETLEVELS ioctl call.

CVE-2010-4668: The blk_rq_map_user_iov function in block/blk-map.c in the Linux kernel allowed local users to cause a denial of service (panic) via a zero-length I/O request in a device ioctl to a SCSI device, related to an unaligned map. NOTE: this vulnerability exists because of an incomplete fix for CVE-2010-4163.

CVE-2010-4650: A kernel buffer overflow in the cuse server module was fixed, which might have allowed local privilege escalation. However only CUSE servers could exploit it and /dev/cuse is normally restricted to root.

CVE-2010-4649: Integer overflow in the ib_uverbs_poll_cq function in drivers/infiniband/core/uverbs_cmd.c in the Linux kernel allowed local users to cause a denial of service (memory corruption) or possibly have unspecified other impact via a large value of a certain structure member.

CVE-2010-4346: The install_special_mapping function in mm/mmap.c in the Linux kernel did not make an expected security_file_mmap function call, which allowed local users to bypass intended mmap_min_addr restrictions and possibly conduct NULL pointer dereference attacks via a crafted assembly-language application.

CVE-2010-4529: Integer underflow in the irda_getsockopt function in net/irda/af_irda.c in the Linux kernel on platforms other than x86 allowed local users to obtain potentially sensitive information from kernel heap memory via an IRLMP_ENUMDEVICES getsockopt call.

CVE-2010-4342: The aun_incoming function in net/econet/af_econet.c in the Linux kernel, when Econet is enabled, allowed remote attackers to cause a denial of service (NULL pointer dereference and OOPS) by sending an Acorn Universal Networking (AUN) packet over UDP.

CVE-2010-3849: The econet_sendmsg function in net/econet/af_econet.c in the Linux kernel, when an econet address is configured, allowed local users to cause a denial of service (NULL pointer dereference and OOPS) via a sendmsg call that specifies a NULL value for the remote address field.

CVE-2010-3848: Stack-based buffer overflow in the econet_sendmsg function in net/econet/af_econet.c in the Linux kernel when an econet address is configured, allowed local users to gain privileges by providing a large number of iovec structures.

CVE-2010-3850: The ec_dev_ioctl function in net/econet/af_econet.c in the Linux kernel did not require the CAP_NET_ADMIN capability, which allowed local users to bypass intended access restrictions and configure econet addresses via an SIOCSIFADDR ioctl call.

CVE-2010-3699: The backend driver in Xen 3.x allows guest OS users to cause a denial of service via a kernel thread leak, which prevents the device and guest OS from being shut down or create a zombie domain, causes a hang in zenwatch, or prevents unspecified xm commands from working properly, related to (1) netback, (2) blkback, or (3) blktap.

CVE-2010-4073: The ipc subsystem in the Linux kernel did not initialize certain structures, which allowed local users to obtain potentially sensitive information from kernel stack memory via vectors related to the (1) compat_sys_semctl, (2) compat_sys_msgctl, and (3) compat_sys_shmctl functions in ipc/compat.c; and the (4) compat_sys_mq_open and (5) compat_sys_mq_getsetattr functions in ipc/compat_mq.c.

CVE-2010-4072: The copy_shmid_to_user function in ipc/shm.c in the Linux kernel did not initialize a certain structure, which allowed local users to obtain potentially sensitive information from kernel stack memory via vectors related to the shmctl system call and the 'old shm interface.'

CVE-2010-4083: The copy_semid_to_user function in ipc/sem.c in the Linux kernel did not initialize a certain structure, which allowed local users to obtain potentially sensitive information from kernel stack memory via a (1) IPC_INFO, (2) SEM_INFO, (3) IPC_STAT, or (4) SEM_STAT command in a semctl system call.

Some vulnerabilities were discovered and corrected in the Linux 2.6 kernel :

fs/namei.c in Linux kernel 2.6.18 through 2.6.34 does not always follow NFS automount symlinks, which allows attackers to have an unknown impact, related to LOOKUP_FOLLOW. (CVE-2010-1088)

The tc_fill_tclass function in net/sched/sch_api.c in the tc subsystem in the Linux kernel 2.4.x before 2.4.37.6 and 2.6.x before 2.6.31-rc9 does not initialize certain (1) tcm__pad1 and (2) tcm__pad2 structure members, which might allow local users to obtain sensitive information from kernel memory via unspecified vectors. (CVE-2009-3228)

The do_pages_move function in mm/migrate.c in the Linux kernel before 2.6.33-rc7 does not validate node values, which allows local users to read arbitrary kernel memory locations, cause a denial of service (OOPS), and possibly have unspecified other impact by specifying a node that is not part of the kernel node set. (CVE-2010-0415)

The ATI Rage 128 (aka r128) driver in the Linux kernel before 2.6.31-git11 does not properly verify Concurrent Command Engine (CCE) state initialization, which allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly gain privileges via unspecified ioctl calls. (CVE-2009-3620)

The wake_futex_pi function in kernel/futex.c in the Linux kernel before 2.6.33-rc7 does not properly handle certain unlock operations for a Priority Inheritance (PI) futex, which allows local users to cause a denial of service (OOPS) and possibly have unspecified other impact via vectors involving modification of the futex value from user space. (CVE-2010-0622)

The kvm_arch_vcpu_ioctl_set_sregs function in the KVM in Linux kernel 2.6 before 2.6.30, when running on x86 systems, does not validate the page table root in a KVM_SET_SREGS call, which allows local users to cause a denial of service (crash or hang) via a crafted cr3 value, which triggers a NULL pointer dereference in the gfn_to_rmap function.
(CVE-2009-2287)

The handle_dr function in arch/x86/kvm/vmx.c in the KVM subsystem in the Linux kernel before 2.6.31.1 does not properly verify the Current Privilege Level (CPL) before accessing a debug register, which allows guest OS users to cause a denial of service (trap) on the host OS via a crafted application. (CVE-2009-3722)

The ext4_decode_error function in fs/ext4/super.c in the ext4 filesystem in the Linux kernel before 2.6.32 allows user-assisted remote attackers to cause a denial of service (NULL pointer dereference), and possibly have unspecified other impact, via a crafted read-only filesystem that lacks a journal. (CVE-2009-4308)

The eisa_eeprom_read function in the parisc isa-eeprom component (drivers/parisc/eisa_eeprom.c) in the Linux kernel before 2.6.31-rc6 allows local users to access restricted memory via a negative ppos argument, which bypasses a check that assumes that ppos is positive and causes an out-of-bounds read in the readb function.
(CVE-2009-2846)

Multiple buffer overflows in fs/nfsd/nfs4xdr.c in the XDR implementation in the NFS server in the Linux kernel before 2.6.34-rc6 allow remote attackers to cause a denial of service (panic) or possibly execute arbitrary code via a crafted NFSv4 compound WRITE request, related to the read_buf and nfsd4_decode_compound functions.
(CVE-2010-2521)

mm/shmem.c in the Linux kernel before 2.6.28-rc8, when strict overcommit is enabled and CONFIG_SECURITY is disabled, does not properly handle the export of shmemfs objects by knfsd, which allows attackers to cause a denial of service (NULL pointer dereference and knfsd crash) or possibly have unspecified other impact via unknown vectors. NOTE: this vulnerability exists because of an incomplete fix for CVE-2010-1643. (CVE-2008-7256)

The release_one_tty function in drivers/char/tty_io.c in the Linux kernel before 2.6.34-rc4 omits certain required calls to the put_pid function, which has unspecified impact and local attack vectors.
(CVE-2010-1162)

mm/shmem.c in the Linux kernel before 2.6.28-rc3, when strict overcommit is enabled, does not properly handle the export of shmemfs objects by knfsd, which allows attackers to cause a denial of service (NULL pointer dereference and knfsd crash) or possibly have unspecified other impact via unknown vectors. (CVE-2010-1643)

The sctp_process_unk_param function in net/sctp/sm_make_chunk.c in the Linux kernel 2.6.33.3 and earlier, when SCTP is enabled, allows remote attackers to cause a denial of service (system crash) via an SCTPChunkInit packet containing multiple invalid parameters that require a large amount of error data. (CVE-2010-1173)

The Transparent Inter-Process Communication (TIPC) functionality in Linux kernel 2.6.16-rc1 through 2.6.33, and possibly other versions, allows local users to cause a denial of service (kernel OOPS) by sending datagrams through AF_TIPC before entering network mode, which triggers a NULL pointer dereference. (CVE-2010-1187)

The sctp_process_unk_param function in net/sctp/sm_make_chunk.c in the Linux kernel 2.6.33.3 and earlier, when SCTP is enabled, allows remote attackers to cause a denial of service (system crash) via an SCTPChunkInit packet containing multiple invalid parameters that require a large amount of error data. (CVE-2010-1173)

fs/cifs/cifssmb.c in the CIFS implementation in the Linux kernel before 2.6.34-rc4 allows remote attackers to cause a denial of service (panic) via an SMB response packet with an invalid CountHigh value, as demonstrated by a response from an OS/2 server, related to the CIFSSMBWrite and CIFSSMBWrite2 functions. (CVE-2010-2248)

Buffer overflow in the ecryptfs_uid_hash macro in fs/ecryptfs/messaging.c in the eCryptfs subsystem in the Linux kernel before 2.6.35 might allow local users to gain privileges or cause a denial of service (system crash) via unspecified vectors.
(CVE-2010-2492)

The xfs_swapext function in fs/xfs/xfs_dfrag.c in the Linux kernel before 2.6.35 does not properly check the file descriptors passed to the SWAPEXT ioctl, which allows local users to leverage write access and obtain read access by swapping one file into another file.
(CVE-2010-2226)

The gfs2_dirent_find_space function in fs/gfs2/dir.c in the Linux kernel before 2.6.35 uses an incorrect size value in calculations associated with sentinel directory entries, which allows local users to cause a denial of service (NULL pointer dereference and panic) and possibly have unspecified other impact by renaming a file in a GFS2 filesystem, related to the gfs2_rename function in fs/gfs2/ops_inode.c. (CVE-2010-2798)

The do_anonymous_page function in mm/memory.c in the Linux kernel before 2.6.27.52, 2.6.32.x before 2.6.32.19, 2.6.34.x before 2.6.34.4, and 2.6.35.x before 2.6.35.2 does not properly separate the stack and the heap, which allows context-dependent attackers to execute arbitrary code by writing to the bottom page of a shared memory segment, as demonstrated by a memory-exhaustion attack against the X.Org X server. (CVE-2010-2240)

The drm_ioctl function in drivers/gpu/drm/drm_drv.c in the Direct Rendering Manager (DRM) subsystem in the Linux kernel before 2.6.27.53, 2.6.32.x before 2.6.32.21, 2.6.34.x before 2.6.34.6, and 2.6.35.x before 2.6.35.4 allows local users to obtain potentially sensitive information from kernel memory by requesting a large memory-allocation amount. (CVE-2010-2803)

Integer overflow in net/can/bcm.c in the Controller Area Network (CAN) implementation in the Linux kernel before 2.6.27.53, 2.6.32.x before 2.6.32.21, 2.6.34.x before 2.6.34.6, and 2.6.35.x before 2.6.35.4 allows attackers to execute arbitrary code or cause a denial of service (system crash) via crafted CAN traffic. (CVE-2010-2959)

Double free vulnerability in the snd_seq_oss_open function in sound/core/seq/oss/seq_oss_init.c in the Linux kernel before 2.6.36-rc4 might allow local users to cause a denial of service or possibly have unspecified other impact via an unsuccessful attempt to open the /dev/sequencer device. (CVE-2010-3080)

A vulnerability in Linux kernel caused by insecure allocation of user space memory when translating system call inputs to 64-bit. A stack pointer underflow can occur when using the compat_alloc_user_space method with an arbitrary length input. (CVE-2010-3081)

The IA32 system call emulation functionality in arch/x86/ia32/ia32entry.S in the Linux kernel before 2.6.36-rc4-git2 on the x86_64 platform does not zero extend the %eax register after the 32-bit entry path to ptrace is used, which allows local users to gain privileges by triggering an out-of-bounds access to the system call table using the %rax register. NOTE: this vulnerability exists because of a CVE-2007-4573 regression. (CVE-2010-3301)

To update your kernel, please follow the directions located at :

http://www.mandriva.com/en/security/kernelupdate

The remote MiracleLinux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2010-377:12 advisory.

    The kernel package contains the Linux kernel (vmlinuz), the core of any Linux operating system. The kernel     handles the basic functions of the operating system: memory allocation, process allocation, device input     and output, etc.
    Security issues fixed with this release:
    CVE-2010-0291     The Linux kernel before 2.6.32.4 allows local users to gain privileges or cause a denial of service     (panic) by calling the (1) mmap or (2) mremap function, aka the 'do_mremap() mess' or 'mremap/mmap mess.'     CVE-2010-0622     The wake_futex_pi function in kernel/futex.c in the Linux kernel before 2.6.33-rc7 does not properly     handle certain unlock operations for a Priority Inheritance (PI) futex, which allows local users to cause     a denial of service (OOPS) and possibly have unspecified other impact via vectors involving modification     of the futex value from user space.
    CVE-2010-1087     The nfs_wait_on_request function in fs/nfs/pagelist.c in Linux kernel 2.6.x through 2.6.33-rc5 allows     attackers to cause a denial of service (Oops) via unknown vectors related to truncating a file and an     operation that is not interruptible.
    CVE-2010-1088     fs/namei.c in Linux kernel 2.6.18 through 2.6.34 does not always follow NFS automount 'symlinks,' which     allows attackers to have an unknown impact, related to LOOKUP_FOLLOW.
    CVE-2010-1173     The sctp_process_unk_param function in net/sctp/sm_make_chunk.c in the Linux kernel 2.6.33.3 and earlier,     when SCTP is enabled, allows remote attackers to cause a denial of service (system crash) via an     SCTPChunkInit packet containing multiple invalid parameters that require a large amount of error data.
    CVE-2010-1187     The Transparent Inter-Process Communication (TIPC) functionality in Linux kernel 2.6.16-rc1 through     2.6.33, and possibly other versions, allows local users to cause a denial of service (kernel OOPS) by     sending datagrams through AF_TIPC before entering network mode, which triggers a NULL pointer dereference.
    CVE-2010-1436     gfs2 in the Linux kernel 2.6.18, and possibly other versions, does not properly handle when the gfs2_quota     struct occupies two separate pages, which allows local users to cause a denial of service (kernel panic)     via certain manipulations that cause an out-of-bounds write, as demonstrated by writing from an ext3 file     system to a gfs2 file system.
    CVE-2010-1437     Race condition in the find_keyring_by_name function in security/keys/keyring.c in the Linux kernel     2.6.34-rc5 and earlier allows local users to cause a denial of service (memory corruption and system     crash) or possibly have unspecified other impact via keyctl session commands that trigger access to a dead     keyring that is undergoing deletion by the key_cleanup function.
    CVE-2010-1641     The do_gfs2_set_flags function in fs/gfs2/file.c in the Linux kernel before 2.6.34-git10 does not verify     the ownership of a file, which allows local users to bypass intended access restrictions via a SETFLAGS     ioctl request.
    Fixed bugs:
    acpi
    - warn on hot-add of memory exceeding 4G boundary
    - fix WARN on unregister in power meter driver     block
    - cfq-iosched: fix IOPRIO_CLASS_IDLE accounting
    - cfq-iosched: async queue allocation per priority
    - cfq-iosched: fix async queue behaviour
    - cfq-iosched: propagate down request sync flag
    - introduce the rq_is_sync macro     fs
    - remove unneccessary f_ep_lock from fasync_helper     misc
    - add atomic64_cmpxcgh to x86_64 include files     mm
    - fix hugepage corruption using vm.drop_caches
    - clear page errors when issuing a fresh read of page     net
    - e1000: fix WoL init when WoL disabled in EEPROM
    - tg3: fix INTx fallback when MSI fails
    - sched: fix SFQ qdisc crash w/limit of 2 packets
    - bonding: fix broken multicast with round-robin mode
    - cnic: Fix crash during bnx2x MTU change
    - bxn2x: add dynamic lro disable support
    - sctp: file must be valid before setting timeout
    - e1000/e1000e: implement simple interrupt moderation
    - neigh: fix state transitions via Netlink request
    - tg3: fix panic in tg3_interrupt
    - cnic: fix bnx2x panic w/multiple interfaces enabled     nfs
    - revert retcode check in nfs_revalidate_mapping()
    - don't unhash dentry in nfs_lookup_revalidate     virt
    - don't compute pvclock adjustments if we trust tsc
    - add a global synchronization point for pvclock
    - enable pvclock flags in vcpu_time_info structure     virtio
    - fix GFP flags passed by virtio balloon driver     x86
    - grab atomic64 types from upstream     x86_64
    - fix time drift due to faulty lost tick tracking     xen
    - set hypervisor present CPUID bit

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Security fixes :

  - a NULL pointer dereference flaw was found in the Linux     kernel NFSv4 implementation. Several of the NFSv4 file     locking functions failed to check whether a file had     been opened on the server before performing locking     operations on it. A local, unprivileged user on a system     with an NFSv4 share mounted could possibly use this flaw     to cause a kernel panic (denial of service) or escalate     their privileges. (CVE-2009-3726, Important)

  - a flaw was found in the sctp_process_unk_param()     function in the Linux kernel Stream Control Transmission     Protocol (SCTP) implementation. A remote attacker could     send a specially crafted SCTP packet to an SCTP     listening port on a target system, causing a kernel     panic (denial of service). (CVE-2010-1173, Important)

  - a race condition between finding a keyring by name and     destroying a freed keyring was found in the Linux kernel     key management facility. A local, unprivileged user     could use this flaw to cause a kernel panic (denial of     service) or escalate their privileges. (CVE-2010-1437,     Important)

Red Hat would like to thank Simon Vallet for responsibly reporting CVE-2009-3726; and Jukka Taimisto and Olli Jarva of Codenomicon Ltd, Nokia Siemens Networks, and Wind River on behalf of their customer, for responsibly reporting CVE-2010-1173.

Bug fixes :

  - RHBA-2007:0791 introduced a regression in the Journaling     Block Device (JBD). Under certain circumstances,     removing a large file (such as 300 MB or more) did not     result in inactive memory being freed, leading to the     system having a large amount of inactive memory. Now,     the memory is correctly freed. (BZ#589155)

  - the timer_interrupt() routine did not scale lost real     ticks to logical ticks correctly, possibly causing time     drift for 64-bit Scientific Linux 4 KVM (Kernel-based     Virtual Machine) guests that were booted with the     'divider=x' kernel parameter set to a value greater than     1. 'warning: many lost ticks' messages may have been     logged on the affected guest systems. (BZ#590551)

  - a bug could have prevented NFSv3 clients from having the     most up-to-date file attributes for files on a given     NFSv3 file system. In cases where a file type changed,     such as if a file was removed and replaced with a     directory of the same name, the NFSv3 client may not     have noticed this change until stat(2) was called (for     example, by running 'ls -l'). (BZ#596372)

  - RHBA-2007:0791 introduced bugs in the Linux kernel PCI-X     subsystem. These could have caused a system deadlock on     some systems where the BIOS set the default Maximum     Memory Read Byte Count (MMRBC) to 4096, and that also     use the Intel PRO/1000 Linux driver, e1000. Errors such     as 'e1000: eth[x]: e1000_clean_tx_irq: Detected Tx Unit     Hang' were logged. (BZ#596374)

  - an out of memory condition in a KVM guest, using the     virtio-net network driver and also under heavy network     stress, could have resulted in that guest being unable     to receive network traffic. Users had to manually remove     and re-add the virtio_net module and restart the network     service before networking worked as expected. Such     memory conditions no longer prevent KVM guests receiving     network traffic. (BZ#597310)

  - when an SFQ qdisc that limited the queue size to two     packets was added to a network interface, sending     traffic through that interface resulted in a kernel     crash. Such a qdisc no longer results in a kernel crash.
    (BZ#597312)

  - when an NFS client opened a file with the O_TRUNC flag     set, it received a valid stateid, but did not use that     stateid to perform the SETATTR call. Such cases were     rejected by Red Hat Enterprise Linux 4 NFS servers with     an 'NFS4ERR_BAD_STATEID' error, possibly preventing some     NFS clients from writing files to an NFS file system.
    (BZ#597314)

The system must be rebooted for this update to take effect.

a. vCenter Server and vCenter Update Manager update Microsoft    SQL Server 2005 Express Edition to Service Pack 3

   Microsoft SQL Server 2005 Express Edition (SQL Express)    distributed with vCenter Server 4.1 Update 1 and vCenter Update    Manager 4.1 Update 1 is upgraded from  SQL Express Service Pack 2    to SQL Express Service Pack 3, to address multiple security    issues that exist in the earlier releases of Microsoft SQL Express.

   Customers using other database solutions need not update for    these issues.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the names CVE-2008-5416, CVE-2008-0085, CVE-2008-0086,    CVE-2008-0107 and CVE-2008-0106 to the issues addressed in MS SQL    Express Service Pack 3.

b. vCenter Apache Tomcat Management Application Credential Disclosure

   The Apache Tomcat Manager application configuration file contains    logon credentials that can be read by unprivileged local users.

   The issue is resolved by removing the Manager application in    vCenter 4.1 Update 1.

   If vCenter 4.1 is updated to vCenter 4.1 Update 1 the logon    credentials are not present in the configuration file after the    update.

   VMware would like to thank Claudio Criscione of Secure Networking    for reporting this issue to us.

   The Common Vulnerabilities and Exposures Project (cve.mitre.org)    has assigned the name CVE-2010-2928 to this issue.

c. vCenter Server and ESX, Oracle (Sun) JRE is updated to version    1.6.0_21

   Oracle (Sun) JRE update to version 1.6.0_21, which addresses    multiple security issues that existed in earlier releases of    Oracle (Sun) JRE.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the following names to the security issues fixed in    Oracle (Sun) JRE 1.6.0_19: CVE-2009-3555, CVE-2010-0082,    CVE-2010-0084, CVE-2010-0085, CVE-2010-0087, CVE-2010-0088,    CVE-2010-0089, CVE-2010-0090, CVE-2010-0091, CVE-2010-0092,    CVE-2010-0093, CVE-2010-0094, CVE-2010-0095, CVE-2010-0837,    CVE-2010-0838, CVE-2010-0839, CVE-2010-0840, CVE-2010-0841,    CVE-2010-0842, CVE-2010-0843, CVE-2010-0844, CVE-2010-0845,    CVE-2010-0846, CVE-2010-0847, CVE-2010-0848, CVE-2010-0849,    CVE-2010-0850.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the following name to the security issue fixed in    Oracle (Sun) JRE 1.6.0_20: CVE-2010-0886.

d. vCenter Update Manager Oracle (Sun) JRE is updated to version   1.5.0_26

   Oracle (Sun) JRE update to version 1.5.0_26, which addresses    multiple security issues that existed in earlier releases of    Oracle (Sun) JRE.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the following names to the security issues fixed in    Oracle (Sun) JRE 1.5.0_26: CVE-2010-3556, CVE-2010-3566,    CVE-2010-3567, CVE-2010-3550, CVE-2010-3561, CVE-2010-3573,    CVE-2010-3565,CVE-2010-3568, CVE-2010-3569,  CVE-2009-3555,    CVE-2010-1321, CVE-2010-3548, CVE-2010-3551, CVE-2010-3562,    CVE-2010-3571, CVE-2010-3554, CVE-2010-3559, CVE-2010-3572,    CVE-2010-3553, CVE-2010-3549, CVE-2010-3557, CVE-2010-3541,    CVE-2010-3574.

e. vCenter Server and ESX Apache Tomcat updated to version 6.0.28

   Apache Tomcat updated to version 6.0.28, which addresses multiple    security issues that existed in earlier releases of Apache Tomcat

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the following names to the security issues fixed in    Apache Tomcat 6.0.24: CVE-2009-2693, CVE-2009-2901, CVE-2009-2902,i    and CVE-2009-3548.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the following names to the security issues fixed in    Apache Tomcat 6.0.28: CVE-2010-2227, CVE-2010-1157.

f. vCenter Server third-party component OpenSSL updated to version    0.9.8n

   The version of the OpenSSL library in vCenter Server is updated to    0.9.8n.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the names CVE-2010-0740 and CVE-2010-0433 to the    issues addressed in this version of OpenSSL.

g. ESX third-party component OpenSSL updated to version 0.9.8p

   The version of the ESX OpenSSL library is updated to 0.9.8p.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the names CVE-2010-3864 and CVE-2010-2939 to the    issues addressed in this update.

h. ESXi third-party component cURL updated

   The version of cURL library in ESXi is updated.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the name CVE-2010-0734 to the issues addressed in    this update.

i. ESX third-party component pam_krb5 updated

   The version of pam_krb5 library is updated.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the names CVE-2008-3825 and CVE-2009-1384 to the    issues addressed in the update.

j. ESX third-party update for Service Console kernel

   The Service Console kernel is updated to include kernel version    2.6.18-194.11.1.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the names CVE-2010-1084, CVE-2010-2066, CVE-2010-2070,    CVE-2010-2226, CVE-2010-2248, CVE-2010-2521, CVE-2010-2524,    CVE-2010-0008, CVE-2010-0415, CVE-2010-0437, CVE-2009-4308,    CVE-2010-0003, CVE-2010-0007, CVE-2010-0307, CVE-2010-1086,    CVE-2010-0410, CVE-2010-0730, CVE-2010-1085, CVE-2010-0291,    CVE-2010-0622, CVE-2010-1087, CVE-2010-1173, CVE-2010-1437,    CVE-2010-1088, CVE-2010-1187, CVE-2010-1436, CVE-2010-1641, and    CVE-2010-3081 to the issues addressed in the update.

   Notes :
   - The update also addresses the 64-bit compatibility mode    stack pointer underflow issue identified by CVE-2010-3081. This    issue was patched in an ESX 4.1 patch prior to the release of    ESX 4.1 Update 1 and in a previous ESX 4.0 patch release.
   - The update also addresses CVE-2010-2240 for ESX 4.0.

ID	名稱	產品	系列	已發布	已更新	嚴重性
52971	SuSE 10 Security Update : Linux kernel (ZYPP Patch Number 7381)	Nessus	SuSE Local Security Checks	2011/3/25	2021/1/19	high
51608	SuSE 11.1 Security Update : Linux kernel (SAT Patch Numbers 2568 / 2569 / 2570)	Nessus	SuSE Local Security Checks	2011/1/21	2021/1/14	high
89674	VMware ESX / ESXi Third-Party Libraries Multiple Vulnerabilities (VMSA-2011-0003) (remote check)	Nessus	Misc.	2016/3/4	2022/5/25	high
79507	OracleVM 2.2 : kernel (OVMSA-2013-0039)	Nessus	OracleVM Local Security Checks	2014/11/26	2021/1/4	high
59155	SuSE 10 Security Update : Linux kernel (ZYPP Patch Number 7384)	Nessus	SuSE Local Security Checks	2012/5/17	2021/1/19	high
47702	CentOS 5 : kernel (CESA-2010:0504)	Nessus	CentOS Local Security Checks	2010/7/13	2021/1/4	high
47870	RHEL 5 : kernel (RHSA-2010:0504)	Nessus	Red Hat Local Security Checks	2010/7/28	2021/1/14	high
68056	Oracle Linux 5 : kernel (ELSA-2010-0504)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2026/2/9	high
60810	Scientific Linux Security Update : kernel on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	2012/8/1	2021/1/14	high
53740	openSUSE Security Update : kernel (openSUSE-SU-2011:0346-1)	Nessus	SuSE Local Security Checks	2011/5/5	2021/1/14	high
49795	Mandriva Linux Security Advisory : kernel (MDVSA-2010:198)	Nessus	Mandriva Local Security Checks	2010/10/8	2021/1/6	critical
291412	MiracleLinux 3 : kernel-2.6.18-194.3.AXS3 (AXSA:2010-377:12)	Nessus	Miracle Linux Local Security Checks	2026/1/19	2026/2/5	high
60802	Scientific Linux Security Update : kernel on SL4.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	2012/8/1	2021/1/14	high
51971	VMSA-2011-0003 : Third-party component updates for VMware vCenter Server, vCenter Update Manager, ESXi and ESX	Nessus	VMware ESX Local Security Checks	2011/2/14	2022/5/25	high

偵測

搜尋 Plugin

high

high

high

high

high

high

high

high

high

high

critical

high

high

high