Scientific Linux: SLSA-2023:0045-2 Critical: Kernel Security Patch

Date: Tue, 9 Sep 2014 10:56:27 -0500
Reply-To: Pat Riehecky 
Sender: Security Errata for Scientific Linux
 
From: Pat Riehecky 
Subject: Re: Important: jakarta-commons-httpclient on SL5.x,
 SL6.x i386/x86_64
Comments: cc: scientific-linux-users@, This email address is being protected from spambots. You need JavaScript enabled to view it.
In-Reply-To: <20140909095009.7929992c@chukar.lan>
MIME-Version: 1.0

Sorry for the error.

You are correct, the Synopsis line should have read:

Synopsis: Important: jakarta-commons-httpclient security update

Thank you for the report.

Pat

On 09/09/2014 10:50 AM, Jake Edge wrote:
> This advisory looks different than usual, and in fact looks wrong (the
> subject is about jakarta-commons-httpclient but the synopsis mentions
> thunderbird...
>
> is this some new format for advisories? or is this just a mistake that
> will be corrected soon?
>
> thanks!
>
> jake
>
> On Mon, 8 Sep 2014 19:16:30 +0000 Pat Riehecky wrote:
>> Synopsis: Important: thunderbird security update
>> Advisory ID: SLSA-2014:1166-1
>> Issue Date: 2014-09-08
>> CVE Numbers: CVE-2014-3577
>> --
>>
>> It was discovered that the HTTPClient incorrectly extracted host name from
>> an X.509 certificate subject's Common Name (CN) field. A man-in-the-middle
>> attacker could use this flaw to spoof an SSL server using a specially
>> crafted X.509 certificate. (CVE-2014-3577)
>> --
>>
>> SL5
>> x86_64
>> jakarta-commons-httpclient-debuginfo-3.0-7jpp.4.el5_10.x86_64.rpm
>> jakarta-commons-httpclient-demo-3.0-7jpp.4.el5_10.x86_64.rpm
>> jakarta-commons-httpclient-javadoc-3.0-7jpp.4.el5_10.x86_64.rpm
>> jakarta-commons-httpclient-manual-3.0-7jpp.4.el5_10.x86_64.rpm
>> i386
>> jakarta-commons-httpclient-3.0-7jpp.4.el5_10.i386.rpm
>> jakarta-commons-httpclient-debuginfo-3.0-7jpp.4.el5_10.i386.rpm
>> jakarta-commons-httpclient-demo-3.0-7jpp.4.el5_10.i386.rpm
>> jakarta-commons-httpclient-javadoc-3.0-7jpp.4.el5_10.i386.rpm
>> jakarta-commons-httpclient-manual-3.0-7jpp.4.el5_10.i386.rpm
>> SL6
>> x86_64
>> jakarta-commons-httpclient-3.1-0.9.el6_5.x86_64.rpm
>> jakarta-commons-httpclient-debuginfo-3.1-0.9.el6_5.x86_64.rpm
>> jakarta-commons-httpclient-demo-3.1-0.9.el6_5.x86_64.rpm
>> jakarta-commons-httpclient-javadoc-3.1-0.9.el6_5.x86_64.rpm
>> jakarta-commons-httpclient-manual-3.1-0.9.el6_5.x86_64.rpm
>> i386
>> jakarta-commons-httpclient-3.1-0.9.el6_5.i686.rpm
>> jakarta-commons-httpclient-debuginfo-3.1-0.9.el6_5.i686.rpm
>> jakarta-commons-httpclient-demo-3.1-0.9.el6_5.i686.rpm
>> jakarta-commons-httpclient-javadoc-3.1-0.9.el6_5.i686.rpm
>> jakarta-commons-httpclient-manual-3.1-0.9.el6_5.i686.rpm
>>
>> - Scientific Linux Development Team
>>
>

--
Pat Riehecky

Scientific Linux developer
Date: Tue, 9 Sep 2014 21:00:45 +0000
Reply-To: scientific-linux-users@
Sender: Security Errata for Scientific Linux
 
From: Pat Riehecky 
Subject: Security ERRATA Important: kernel on SL6.x i386/x86_64
MIME-Version: 1.0

Synopsis: Important: kernel security and bug fix update
Advisory ID: SLSA-2014:1167-1
Issue Date: 2014-09-09
CVE Numbers: CVE-2014-3917
 CVE-2014-4667
 CVE-2014-0205
 CVE-2014-3535
--

* A flaw was found in the way the Linux kernel's futex subsystem handled
reference counting when requeuing futexes during futex_wait(). A local,
unprivileged user could use this flaw to zero out the reference counter of
an inode or an mm struct that backs up the memory area of the futex, which
could lead to a use-after-free flaw, resulting in a system crash or,
potentially, privilege escalation. (CVE-2014-0205, Important)

* A NULL pointer dereference flaw was found in the way the Linux kernel's
networking implementation handled logging while processing certain invalid
packets coming in via a VxLAN interface. A remote attacker could use this
flaw to crash the system by sending a specially crafted packet to such an
interface. (CVE-2014-3535, Important)

* An out-of-bounds memory access flaw was found in the Linux kernel's
system call auditing implementation. On a system with existing audit rules
defined, a local, unprivileged user could use this flaw to leak kernel
memory to user space or, potentially, crash the system. (CVE-2014-3917,
Moderate)

* An integer underflow flaw was found in the way the Linux kernel's Stream
Control Transmission Protocol (SCTP) implementation processed certain
COOKIE_ECHO packets. By sending a specially crafted SCTP packet, a remote
attacker could use this flaw to prevent legitimate connections to a
particular SCTP server socket to be made. (CVE-2014-4667, Moderate)

The system must be rebooted for this update to take effect.
--

SL6
 x86_64
 kernel-2.6.32-431.29.2.el6.x86_64.rpm
 kernel-debug-2.6.32-431.29.2.el6.x86_64.rpm
 kernel-debug-debuginfo-2.6.32-431.29.2.el6.x86_64.rpm
 kernel-debug-devel-2.6.32-431.29.2.el6.x86_64.rpm
 kernel-debuginfo-2.6.32-431.29.2.el6.x86_64.rpm
 kernel-debuginfo-common-x86_64-2.6.32-431.29.2.el6.x86_64.rpm
 kernel-devel-2.6.32-431.29.2.el6.x86_64.rpm
 kernel-headers-2.6.32-431.29.2.el6.x86_64.rpm
 perf-2.6.32-431.29.2.el6.x86_64.rpm
 perf-debuginfo-2.6.32-431.29.2.el6.x86_64.rpm
 python-perf-debuginfo-2.6.32-431.29.2.el6.x86_64.rpm
 python-perf-2.6.32-431.29.2.el6.x86_64.rpm
 i386
 kernel-2.6.32-431.29.2.el6.i686.rpm
 kernel-debug-2.6.32-431.29.2.el6.i686.rpm
 kernel-debug-debuginfo-2.6.32-431.29.2.el6.i686.rpm
 kernel-debug-devel-2.6.32-431.29.2.el6.i686.rpm
 kernel-debuginfo-2.6.32-431.29.2.el6.i686.rpm
 kernel-debuginfo-common-i686-2.6.32-431.29.2.el6.i686.rpm
 kernel-devel-2.6.32-431.29.2.el6.i686.rpm
 kernel-headers-2.6.32-431.29.2.el6.i686.rpm
 perf-2.6.32-431.29.2.el6.i686.rpm
 perf-debuginfo-2.6.32-431.29.2.el6.i686.rpm
 python-perf-debuginfo-2.6.32-431.29.2.el6.i686.rpm
 python-perf-2.6.32-431.29.2.el6.i686.rpm
 noarch
 kernel-abi-whitelists-2.6.32-431.29.2.el6.noarch.rpm
 kernel-doc-2.6.32-431.29.2.el6.noarch.rpm
 kernel-firmware-2.6.32-431.29.2.el6.noarch.rpm

- Scientific Linux Development Team