[Security Announce] [ MDKSA-2007:040 ] - Updated kernel packages fix multiple vulnerabilities and bugs
Posted on: 02/07/2007 10:10 PM

The Mandriva Security Team published a new security update for Mandriva Linux. Here the announcement:

Hash: SHA1


Mandriva Linux Security Advisory MDKSA-2007:040

Package : kernel
Date : February 7, 2007
Affected: 2007.0

Problem Description:

Some vulnerabilities were discovered and corrected in the Linux 2.6

The isdn_ppp_ccp_reset_alloc_state function in drivers/isdn/isdn_ppp.c
in the Linux 2.4 kernel before 2.4.34-rc4, as well as the 2.6 kernel,
does not call the init_timer function for the ISDN PPP CCP reset state
timer, which has unknown attack vectors and results in a system crash.

The listxattr syscall can corrupt user space under certain
circumstances. The problem seems to be related to signed/unsigned
conversion during size promotion. (CVE-2006-5753)

The ext3fs_dirhash function in Linux kernel 2.6.x allows local users to
cause a denial of service (crash) via an ext3 stream with malformed
data structures. (CVE-2006-6053)

The mincore function in the Linux kernel before, as well as
the 2.6 kernel, does not properly lock access to user space, which has
unspecified impact and attack vectors, possibly related to a deadlock.

The provided packages are patched to fix these vulnerabilities. All
users are encouraged to upgrade to these updated kernels immediately
and reboot to effect the fixes.

In addition to these security fixes, other fixes have been included
such as:

- Add Ralink RT2571W/RT2671 WLAN USB support (rt73 module) - Fix
sys_msync() to report -ENOMEM as before when an unmapped area falls
within its range, and not to overshoot (LSB regression) - Avoid disk
sector_t overflow for gt;2TB ext3 filesystem - USB: workaround to fix HP
scanners detection (#26728) - USB: unusual_devs.h for Sony floppy
(#28378) - Add preliminary ICH9 support - Add TI sd card reader
support - Add RT61 driver - KVM update - Fix bttv vbi offset

To update your kernel, please follow the directions located at:




Updated Packages:

Mandriva Linux 2007.0:
ad34fe5a73feafdd8e69b504ebf93946 2007.0/i586/kernel-
d9e55a7e4f1008da15c67d1287956969 2007.0/i586/kernel-doc-
a9c50df979df9e3689873978436bd16f 2007.0/i586/kernel-enterprise-
f533abc7ea70bd3faaa9e6b28a99ab28 2007.0/i586/kernel-legacy-
b8ff79d0ab16056f2d254e9d679984f7 2007.0/i586/kernel-source-
850dbb1496700b2f93ef37e4540164cc 2007.0/i586/kernel-source-stripped-
6e5109401747d368e768bb7ccce1c6e3 2007.0/i586/kernel-xen0-
0982fc7135735d78b4805c2af67ffe19 2007.0/i586/kernel-xenU-
2cfb0d90ab5aea99bacf8a721552554b 2007.0/SRPMS/kernel-

Mandriva Linux 2007.0/X86_64:
8228636d0969cdb0de42baeab61ece09 2007.0/x86_64/kernel-
935eb44188aa2784386dd8bcc93dfd78 2007.0/x86_64/kernel-doc-
9abb549acacc17385051ceebcb3331fe 2007.0/x86_64/kernel-source-
7e3667b9f28f3214669f831955ef059d 2007.0/x86_64/kernel-source-stripped-
648ae5f919580ce2df42f6a522aba7c9 2007.0/x86_64/kernel-xen0-
0ad1d27a9232f5f7cf8ae218bef5a618 2007.0/x86_64/kernel-xenU-
2cfb0d90ab5aea99bacf8a721552554b 2007.0/SRPMS/kernel-

To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:

gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:


If you want to report vulnerabilities, please contact


Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
Version: GnuPG v1.4.6 (GNU/Linux)


Printed from Linux Compatible (http://www.linuxcompatible.org/news/story/security_announce_mdksa_2007040__updated_kernel_packages_fix_multiple_vulnerabilities_and_bugs.html)