SB2015022511 - Ubuntu update for linux-source-2.6.15

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2015022511

SB2015022511 - Ubuntu update for linux-source-2.6.15

Published: February 25, 2015 Updated: October 31, 2026

Security Bulletin ID SB2015022511
CSH Severity
High
Patch available
YES
Number of vulnerabilities 12
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 8% Medium 8% Low 83%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 12 vulnerabilities.


1) Input validation error (CVE-ID: CVE-2010-3086)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

include/asm-x86/futex.h in the Linux kernel before 2.6.25 does not properly implement exception fixup, which allows local users to cause a denial of service (panic) via an invalid application that triggers a page fault.


2) Out-of-bounds write (CVE-ID: CVE-2010-3859)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to out-of-bounds write error. A local user can execute arbitrary code.


3) Memory corruption (CVE-ID: CVE-2010-3873)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote non-authenticated attacker to perform service disruption.

The vulnerability exists due to memory corruption error. A remote non-authenticated attacker can perform service disruption.


4) Information exposure (CVE-ID: CVE-2010-3875)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to information exposure error. A local user can gain access to sensitive information.


5) Missing initialization of resource (CVE-ID: CVE-2010-3876)

CWE-ID: CWE-909 - Missing initialization of resource

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to missing initialization of resource error. A local user can gain access to sensitive information.


6) Infinite loop (CVE-ID: CVE-2010-3880)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite loop in net/ipv4/inet_diag.c. A local user can consume all available system resources and cause denial of service conditions.


7) Missing initialization of resource (CVE-ID: CVE-2010-4078)

CWE-ID: CWE-909 - Missing initialization of resource

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to missing initialization of resource error within the int sisfb_ioctl() function in drivers/video/sis/sis_main.c. A local user can gain access to sensitive information.


8) Information exposure (CVE-ID: CVE-2010-4080)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to information exposure error within the snd_hdspm_hwdep_ioctl() function in sound/pci/rme9652/hdspm.c, within the snd_hdsp_hwdep_ioctl() function in sound/pci/rme9652/hdsp.c. A local user can gain access to sensitive information.


9) Missing initialization of resource (CVE-ID: CVE-2010-4081)

CWE-ID: CWE-909 - Missing initialization of resource

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to missing initialization of resource error within the snd_hdspm_hwdep_ioctl() function in sound/pci/rme9652/hdspm.c, within the snd_hdsp_hwdep_ioctl() function in sound/pci/rme9652/hdsp.c. A local user can gain access to sensitive information.


10) Missing initialization of resource (CVE-ID: CVE-2010-4083)

CWE-ID: CWE-909 - Missing initialization of resource

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to missing initialization of resource error within the copy_semid_to_user() function in ipc/sem.c. A local user can gain access to sensitive information.


11) Integer overflow (CVE-ID: CVE-2010-4157)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to integer overflow error. A local user can execute arbitrary code.


12) Input validation error (CVE-ID: CVE-2010-4160)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

Multiple integer overflows in the (1) pppol2tp_sendmsg function in net/l2tp/l2tp_ppp.c, and the (2) l2tp_ip_sendmsg function in net/l2tp/l2tp_ip.c, in the PPPoL2TP and IPoL2TP implementations in the Linux kernel before 2.6.36.2 allow local users to cause a denial of service (heap memory corruption and panic) or possibly gain privileges via a crafted sendto call.


Remediation

Install update from vendor's website.

References