[DLA 246-1/2] linux-2.6 update

Package : linux-2.6
Version : 2.6.32-48squeeze13
CVE ID : CVE-2011-5321 CVE-2012-6689 CVE-2014-3184 CVE-2014-8159
CVE-2014-9683 CVE-2014-9728 CVE-2014-9729 CVE-2014-9730
CVE-2014-9731 CVE-2015-1805 CVE-2015-2041 CVE-2015-2042
CVE-2015-2830 CVE-2015-2922 CVE-2015-3339 CVE-2015-4167
Debian Bug : 789037

The linux-2.6 update issued as DLA-246-1 caused regressions. This
update corrects the defective patches applied in that update causing
these problems.

This update fixes the CVEs described below.

CVE-2011-5321

Jiri Slaby discovered that tty_driver_lookup_tty() may leak a
reference to the tty driver. A local user could use this flaw
to crash the system.

CVE-2012-6689

Pablo Neira Ayuso discovered that non-root user-space processes
can send forged Netlink notifications to other processes. A local
user could use this flaw for denial of service or privilege
escalation.

CVE-2014-3184

Ben Hawkes discovered that various HID drivers may over-read the
report descriptor buffer, possibly resulting in a crash if a HID
with a crafted descriptor is plugged in.

CVE-2014-8159

It was found that the Linux kernel's InfiniBand/RDMA subsystem did
not properly sanitize input parameters while registering memory
regions from user space via the (u)verbs API. A local user with
access to a /dev/infiniband/uverbsX device could use this flaw to
crash the system or, potentially, escalate their privileges on the
system.

CVE-2014-9683

Dmitry Chernenkov discovered that eCryptfs writes past the end of
the allocated buffer during encrypted filename decoding, resulting
in local denial of service.

CVE-2014-9728 / CVE-2014-9729 / CVE-2014-9730 / CVE-2014-9731 / CVE-2015-4167

Carl Henrik Lunde discovered that the UDF implementation is
missing several necessary length checks. A local user that can
mount devices could use these various flaws to crash the system,
to leak information from the kernel, or possibly for privilege
escalation.

CVE-2015-1805

Red Hat discovered that the pipe iovec read and write
implementations may iterate over the iovec twice but will modify
the iovec such that the second iteration accesses the wrong
memory. A local user could use this flaw to crash the system or
possibly for privilege escalation. This may also result in data
corruption and information leaks in pipes between non-malicious
processes.

CVE-2015-2041

Sasha Levin discovered that the LLC subsystem exposed some
variables as sysctls with the wrong type. On a 64-bit kernel, this
possibly allows privilege escalation from a process with
CAP_NET_ADMIN capability; it also results in a trivial information
leak.

CVE-2015-2042

Sasha Levin discovered that the RDS subsystem exposed some
variables as sysctls with the wrong type. On a 64-bit kernel, this
results in a trivial information leak.

CVE-2015-2830

Andrew Lutomirski discovered that when a 64-bit task on an amd64
kernel makes a fork(2) or clone(2) system call using int $0x80,
the 32-bit compatibility flag is set (correctly) but is not
cleared on return. As a result, both seccomp and audit will
misinterpret the following system call by the task(s), possibly
leading to a violation of security policy.

CVE-2015-2922

Modio AB discovered that the IPv6 subsystem would process a router
advertisement that specifies no route but only a hop limit, which
would then be applied to the interface that received it. This can
result in loss of IPv6 connectivity beyond the local network.

This may be mitigated by disabling processing of IPv6 router
advertisements if they are not needed:
sysctl net.ipv6.conf.default.accept_ra=0
sysctl net.ipv6.conf..accept_ra=0

CVE-2015-3339

It was found that the execve(2) system call can race with inode
attribute changes made by chown(2). Although chown(2) clears the
setuid/setgid bits of a file if it changes the respective owner ID,
this race condition could result in execve(2) setting effective
uid/gid to the new owner ID, a privilege escalation.

For the oldoldstable distribution (squeeze), these problems have been
fixed in version 2.6.32-48squeeze12.

For the oldstable distribution (wheezy), these problems were fixed in
linux version 3.2.68-1+deb7u1 or earlier, except for CVE-2015-1805 and
CVE-2015-4167 which will be fixed soon.

For the stable distribution (jessie), these problems were fixed in
linux version 3.16.7-ckt11-1 or earlier, except for CVE-2015-4167 which
will be fixed later.

We recommend that you upgrade your linux-2.6 packages.

[DLA 247-1] openssl security update

Package : openssl
Version : 0.9.8o-4squeeze21
CVE ID : CVE-2014-8176 CVE-2015-1789 CVE-2015-1790 CVE-2015-1791
CVE-2015-1792 CVE-2015-4000

Multiple vulnerabilities were discovered in OpenSSL, a Secure Sockets
Layer toolkit.

CVE-2014-8176

Praveen Kariyanahalli, Ivan Fratric and Felix Groebert discovered
that an invalid memory free could be triggered when buffering DTLS
data. This could allow remote attackers to cause a denial of service
(crash) or potentially execute arbitrary code. This issue only
affected the oldstable distribution (wheezy).

CVE-2015-1789

Robert Swiecki and Hanno B??ck discovered that the X509_cmp_time
function could read a few bytes out of bounds. This could allow remote
attackers to cause a denial of service (crash) via crafted
certificates and CRLs.

CVE-2015-1790

Michal Zalewski discovered that the PKCS#7 parsing code did not
properly handle missing content which could lead to a NULL pointer
dereference. This could allow remote attackers to cause a denial of
service (crash) via crafted ASN.1-encoded PKCS#7 blobs.

CVE-2015-1791

Emilia K??sper discovered that a race condition could occur due to
incorrect handling of NewSessionTicket in a multi-threaded client,
leading to a double free. This could allow remote attackers to cause
a denial of service (crash).

CVE-2015-1792

Johannes Bauer discovered that the CMS code could enter an infinite
loop when verifying a signedData message, if presented with an
unknown hash function OID. This could allow remote attackers to cause
a denial of service.

Additionally OpenSSL will now reject handshakes using DH parameters
shorter than 768 bits as a countermeasure against the Logjam attack
(CVE-2015-4000).