CVE-2010-0730

xen: emulator instruction decoding inconsistency

The MMIO instruction decoder in the Xen hypervisor in the Linux kernel 2.6.18 in Red Hat Enterprise Linux (RHEL) 5 allows guest OS users to cause a denial of service (32-bit guest OS crash) via vectors that trigger an unspecified instruction emulation.

CVSS 2.0 · 2.6 Low EPSS 2.4% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux Enterprise Linux Desktop

CVE-2010-0727

kernel: bug in GFS/GFS2 locking code leads to dos

The gfs2_lock function in the Linux kernel before 2.6.34-rc1-next-20100312, and the gfs_lock function in the Linux kernel on Red Hat Enterprise Linux (RHEL) 5 and 6, does not properly remove POSIX locks on files that are setgid without group-execute permission, which allows local users to cause a denial of service (BUG and system crash) by locking a file on a (1) GFS or (2) GFS2 filesystem, and then changing this file's permissions.

CVSS 2.0 · 4.9 Medium EPSS < 1% KEV · Not listed

Vendors

Debian Linux Redhat

Products

Debian Linux Linux Kernel Enterprise Linux and 2 more

CVE-2010-1086

kernel: dvb-core: DoS bug in ULE decapsulation code

The ULE decapsulation functionality in drivers/media/dvb/dvb-core/dvb_net.c in dvb-core in Linux kernel 2.6.33 and earlier allows attackers to cause a denial of service (infinite loop) via a crafted MPEG2-TS frame, related to an invalid Payload Pointer ULE.

CVSS 2.0 · 7.8 High EPSS 3.6% KEV · Not listed

Vendors

Debian Linux Redhat

Products

Debian Linux Linux Kernel Enterprise Linux and 1 more

CVE-2009-4895

kernel: tty->pgrp races

Race condition in the tty_fasync function in drivers/char/tty_io.c in the Linux kernel before 2.6.32.6 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via unknown vectors, related to the put_tty_queue and __f_setown functions. NOTE: the vulnerability was addressed in a different way in 2.6.32.9.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Canonical Debian Linux and 1 more

Products

Ubuntu Linux Debian Linux Linux Kernel and 1 more

CVE-2010-0205

libpng: excessive memory consumption due to highly compressed huge ancillary chunk

The png_decompress_chunk function in pngrutil.c in libpng 1.0.x before 1.0.53, 1.2.x before 1.2.43, and 1.4.x before 1.4.1 does not properly handle compressed ancillary-chunk data that has a disproportionately large uncompressed representation, which allows remote attackers to cause a denial of service (memory and CPU consumption, and application hang) via a crafted PNG file, as demonstrated by use of the deflate compression method on data composed of many occurrences of the same character, related to a "decompression bomb" attack.

CVSS 2.0 · 4.3 Medium EPSS 4.5% KEV · Not listed

Vendors

Apple Canonical Debian and 5 more

Products

Mac Os X Ubuntu Linux Debian Linux and 5 more

CVE-2010-2962

kernel: arbitrary kernel memory write via i915 GEM ioctl

drivers/gpu/drm/i915/i915_gem.c in the Graphics Execution Manager (GEM) in the Intel i915 driver in the Direct Rendering Manager (DRM) subsystem in the Linux kernel before 2.6.36 does not properly validate pointers to blocks of memory, which allows local users to write to arbitrary kernel memory locations, and consequently gain privileges, via crafted use of the ioctl interface, related to (1) pwrite and (2) pread operations.

CVSS 2.0 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Canonical Fedoraproject Linux and 3 more

Products

Ubuntu Linux Fedora Linux Kernel and 6 more

CVE-2010-2997

HelixPlayer multiple flaws (CVE-2010-2997, CVE-2010-4375, CVE-2010-4378, CVE-2010-4379, CVE-2010-4382, CVE-2010-4383, CVE-2010-4385, CVE-2010-4386, CVE-2010-4392, CVE-2010-4376)

Use-after-free vulnerability in RealNetworks RealPlayer 11.0 through 11.1, RealPlayer SP 1.0 through 1.0.1, Mac RealPlayer 11.0 through 11.1, Linux RealPlayer 11.0.2.1744, and possibly HelixPlayer 1.0.6 and other versions, allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via a crafted StreamTitle tag in an ICY SHOUTcast stream, related to the SMIL file format.

CVSS 2.0 · 9.3 Critical EPSS 5.7% KEV · Not listed

Vendors

Apple Linux Realnetworks and 1 more

Products

Mac Os X Linux Kernel Realplayer and 2 more

CVE-2010-3015

kernel: integer overflow in ext4_ext_get_blocks()

Integer overflow in the ext4_ext_get_blocks function in fs/ext4/extents.c in the Linux kernel before 2.6.34 allows local users to cause a denial of service (BUG and system crash) via a write operation on the last block of a large file, followed by a sync operation.

CVSS 2.0 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux

CVE-2010-3066

kernel: io_submit_one() NULL ptr deref

The io_submit_one function in fs/aio.c in the Linux kernel before 2.6.23 allows local users to cause a denial of service (NULL pointer dereference) via a crafted io_submit system call with an IOCB_FLAG_RESFD flag.

CVSS 2.0 · 4.9 Medium EPSS < 1% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux

CVE-2010-3067

kernel: do_io_submit() infoleak

Integer overflow in the do_io_submit function in fs/aio.c in the Linux kernel before 2.6.36-rc4-next-20100915 allows local users to cause a denial of service or possibly have unspecified other impact via crafted use of the io_submit system call.

CVSS 2.0 · 4.9 Medium EPSS < 1% KEV · Not listed

Vendors

Canonical Debian Linux and 3 more

Products

Ubuntu Linux Debian Linux Linux Kernel and 7 more

CVE-2010-3078

kernel: xfs: XFS_IOC_FSGETXATTR ioctl memory leak

The xfs_ioc_fsgetxattr function in fs/xfs/linux-2.6/xfs_ioctl.c in the Linux kernel before 2.6.36-rc4 does not initialize a certain structure member, which allows local users to obtain potentially sensitive information from kernel stack memory via an ioctl call.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Canonical Linux Opensuse and 3 more

Products

Ubuntu Linux Linux Kernel Opensuse and 4 more

CVE-2010-3079

kernel: ftrace NULL ptr deref

kernel/trace/ftrace.c in the Linux kernel before 2.6.35.5, when debugfs is enabled, does not properly handle interaction between mutex possession and llseek operations, which allows local users to cause a denial of service (NULL pointer dereference and outage of all function tracing files) via an lseek call on a file descriptor associated with the set_ftrace_filter file.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Canonical Linux Redhat and 1 more

Products

Ubuntu Linux Linux Kernel Enterprise Linux and 3 more

CVE-2010-3080

kernel: /dev/sequencer open failure is not handled correctly

Double free vulnerability in the snd_seq_oss_open function in sound/core/seq/oss/seq_oss_init.c in the Linux kernel before 2.6.36-rc4 might allow local users to cause a denial of service or possibly have unspecified other impact via an unsuccessful attempt to open the /dev/sequencer device.

CVSS 2.0 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Canonical Linux Opensuse and 2 more

Products

Ubuntu Linux Linux Kernel Opensuse and 4 more

CVE-2010-3081

kernel: 64-bit Compatibility Mode Stack Pointer Underflow

The compat_alloc_user_space functions in include/asm/compat.h files in the Linux kernel before 2.6.36-rc4-git2 on 64-bit platforms do not properly allocate the userspace memory required for the 32-bit compatibility layer, which allows local users to gain privileges by leveraging the ability of the compat_mc_getsockopt function (aka the MCAST_MSFILTER getsockopt support) to control a certain length value, related to a "stack pointer underflow" issue, as exploited in the wild in September 2010.

CVSS 3.1 · 7.8 High EPSS 3.5% KEV · Not listed

Vendors

Linux Redhat Suse and 1 more

Products

Linux Kernel Enterprise Linux Enterprise Mrg and 5 more

CVE-2010-3084

kernel: niu: buffer overflow for ETHTOOL_GRXCLSRLALL

Buffer overflow in the niu_get_ethtool_tcam_all function in drivers/net/niu.c in the Linux kernel before 2.6.36-rc4 allows local users to cause a denial of service or possibly have unspecified other impact via the ETHTOOL_GRXCLSRLALL ethtool command.

CVSS 2.0 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Canonical Linux Redhat

Products

Ubuntu Linux Linux Kernel Enterprise Linux

CVE-2010-3086

kernel panic via futex

include/asm-x86/futex.h in the Linux kernel before 2.6.25 does not properly implement exception fixup, which allows local users to cause a denial of service (panic) via an invalid application that triggers a page fault.

CVSS 2.0 · 4.9 Medium EPSS < 1% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux

CVE-2010-3296

kernel: drivers/net/cxgb3/cxgb3_main.c reading uninitialized stack memory

The cxgb_extension_ioctl function in drivers/net/cxgb3/cxgb3_main.c in the Linux kernel before 2.6.36-rc5 does not properly initialize a certain structure member, which allows local users to obtain potentially sensitive information from kernel stack memory via a CHELSIO_GET_QSET_NUM ioctl call.

CVSS 2.0 · 2.1 Low EPSS < 1% KEV · Not listed

Vendors

Canonical Debian Linux and 3 more

Products

Ubuntu Linux Debian Linux Linux Kernel and 6 more

CVE-2010-3297

kernel: drivers/net/eql.c: reading uninitialized stack memory

The eql_g_master_cfg function in drivers/net/eql.c in the Linux kernel before 2.6.36-rc5 does not properly initialize a certain structure member, which allows local users to obtain potentially sensitive information from kernel stack memory via an EQL_GETMASTRCFG ioctl call.

CVSS 2.0 · 2.1 Low EPSS < 1% KEV · Not listed

Vendors

Canonical Debian Linux and 3 more

Products

Ubuntu Linux Debian Linux Linux Kernel and 5 more

CVE-2010-3298

kernel: drivers/net/usb/hso.c: prevent reading uninitialized memory

The hso_get_count function in drivers/net/usb/hso.c in the Linux kernel before 2.6.36-rc5 does not properly initialize a certain structure member, which allows local users to obtain potentially sensitive information from kernel stack memory via a TIOCGICOUNT ioctl call.

CVSS 2.0 · 2.1 Low EPSS < 1% KEV · Not listed

Vendors

Canonical Debian Linux and 3 more

Products

Ubuntu Linux Debian Linux Linux Kernel and 5 more

CVE-2010-3301

kernel: IA32 System Call Entry Point Vulnerability

The IA32 system call emulation functionality in arch/x86/ia32/ia32entry.S in the Linux kernel before 2.6.36-rc4-git2 on the x86_64 platform does not zero extend the %eax register after the 32-bit entry path to ptrace is used, which allows local users to gain privileges by triggering an out-of-bounds access to the system call table using the %rax register. NOTE: this vulnerability exists because of a CVE-2007-4573 regression.

CVSS 2.0 · 7.2 High EPSS 3.7% KEV · Not listed

Vendors

Canonical Linux Redhat and 1 more

Products

Ubuntu Linux Linux Kernel Enterprise Linux and 1 more