Linux Kernel 2.6.12

Multiple buffer overflows in fs/nfsd/nfs4xdr.c in the XDR implementation in the NFS server in the Linux kernel before 2.6.34-rc6 allow remote attackers to cause a denial of service (panic) or possibly execute arbitrary code via a crafted NFSv4 compound WRITE request, related to the read_buf and nfsd4_decode_compound functions.

The asn1 implementation in (a) the Linux kernel 2.4 before 2.4.36.6 and 2.6 before 2.6.25.5, as used in the cifs and ip_nat_snmp_basic modules; and (b) the gxsnmp package; does not properly validate length values during decoding of ASN.1 BER data, which allows remote attackers to cause a denial of service (crash) or execute arbitrary code via (1) a length greater than the working buffer, which can lead to an unspecified overflow; (2) an oid length of zero, which can lead to an off-by-one error; or (3) an indefinite length for a primitive encoding.

Buffer overflow in the lbs_process_bss function in drivers/net/wireless/libertas/scan.c in the libertas subsystem in the Linux kernel before 2.6.27.5 allows remote attackers to have an unknown impact via an "invalid beacon/probe response."

net/x25: Fix potential double free of skb

media: dvb-net: fix OOB access in ULE extension header tables

net: usb: rtl8150: fix use-after-free in rtl8150_start_xmit()

sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing

nfsd: fix heap overflow in NFSv4.0 LOCK replay cache

tcp: fix potential race in tcp_v6_syn_recv_sock()

netfilter: ip6t_eui64: reject invalid MAC header for all packets

netfilter: require Ethernet MAC header before using eth_hdr()

sctp: validate embedded INIT chunk and address list lengths in cookie

inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP

Buffer overflow in SCTP in Linux kernel before 2.6.16.17 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a malformed HB-ACK chunk.

xfs: fix freemap adjustments when adding xattrs to leaf blocks

xfs: delete attr leaf freemap entries when empty

Bluetooth: bnep: Fix UAF read of dev->name

Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold

Bluetooth: serialize accept_q access

netfilter: bridge: confirm multicast packets before passing them up the stack

rose: fix dangling neighbour pointers in rose_rt_device_down()

ax25: properly unshare skbs in ax25_kiss_rcv()

net: rose: include node references in rose_neigh refcount

net: rose: convert 'use' field to refcount_t

netrom: fix double-free in nr_route_frame()

pptp: ensure minimal skb length in pptp_xmit()

udf: reject descriptors with oversized CRC length

netfilter: xt_tcpmss: check remaining length before reading optlen

slip: bound decode() reads against the compressed packet length

net: ppp: Add bound checking for skb data on ppp_sync_txmung

Bluetooth: RFCOMM: validate skb length in MCC handlers

Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind()

The snmp_trap_decode function in the SNMP NAT helper for Linux kernel before 2.6.16.18 allows remote attackers to cause a denial of service (crash) via unspecified remote attack vectors that cause failures in snmp_trap_decode that trigger (1) frees of random memory or (2) frees of previously-freed memory (double-free) by snmp_trap_decode as well as its calling function, as demonstrated via certain test cases of the PROTOS SNMP test suite.

Linux kernel 2.6.x, when using both NFS and EXT3, allows remote attackers to cause a denial of service (file system panic) via a crafted UDP packet with a V2 lookup procedure that specifies a bad file handle (inode number), which triggers an error and causes an exported directory to be remounted read-only.

The swiotlb functionality in the r8169 driver in drivers/net/r8169.c in the Linux kernel before 2.6.27.22 allows remote attackers to cause a denial of service (IOMMU space exhaustion and system crash) by using jumbo frames for a large amount of network traffic, as demonstrated by a flood ping.

The ip6_dst_lookup_tail function in net/ipv6/ip6_output.c in the Linux kernel before 2.6.27 does not properly handle certain circumstances involving an IPv6 TUN network interface and a large number of neighbors, which allows attackers to cause a denial of service (NULL pointer dereference and OOPS) or possibly have unspecified other impact via unknown vectors.

The nfs4_proc_lock function in fs/nfs/nfs4proc.c in the NFSv4 client in the Linux kernel before 2.6.31-rc4 allows remote NFS servers to cause a denial of service (NULL pointer dereference and panic) by sending a certain response containing incorrect file attributes, which trigger attempted use of an open file that lacks NFSv4 state.

The eisa_eeprom_read function in the parisc isa-eeprom component (drivers/parisc/eisa_eeprom.c) in the Linux kernel before 2.6.31-rc6 allows local users to access restricted memory via a negative ppos argument, which bypasses a check that assumes that ppos is positive and causes an out-of-bounds read in the readb function.

SCTP in Linux kernel before 2.6.16.17 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a chunk length that is inconsistent with the actual length of provided parameters.

Buffer overflow in the RTL8169 NIC driver (drivers/net/r8169.c) in the Linux kernel before 2.6.30 allows remote attackers to cause a denial of service (kernel memory corruption and crash) via a long packet.