2.6.37.3 : Security Vulnerabilities

Cpe Name:cpe:/o:linux:linux_kernel:2.6.37.3

CVSS Scores Greater Than: 0 1 2 3 4 5 6 7 8 9

Sort Results By : Cve Number Descending Cve Number Ascending CVSS Score Descending Number Of Exploits Descending

Copy Results Download Results Select Table

#	CVE ID	CWE ID	Vulnerability Type(s)	Publish Date	Update Date	Score	Gained Access Level	Access	Complexity	Authentication	Conf.	Integ.	Avail.
1	CVE-2012-3552	362	DoS	2012-10-03	2013-01-23	5.4	None	Remote	High	Not required	None	None	Complete
Race condition in the IP implementation in the Linux kernel before 3.0 might allow remote attackers to cause a denial of service (slab corruption and system crash) by sending packets to an application that sets socket options during the handling of network traffic.
2	CVE-2011-4087	399	DoS	2013-06-08	2013-06-10	4.3	None	Remote	Medium	Not required	None	None	Partial
The br_parse_ip_options function in net/bridge/br_netfilter.c in the Linux kernel before 2.6.39 does not properly initialize a certain data structure, which allows remote attackers to cause a denial of service by leveraging connectivity to a network interface that uses an Ethernet bridge device.
3	CVE-2011-3638		DoS	2013-03-01	2013-03-04	4.0	None	Local	High	Not required	None	None	Complete
fs/ext4/extents.c in the Linux kernel before 3.0 does not mark a modified extent as dirty in certain cases of extent splitting, which allows local users to cause a denial of service (system crash) via vectors involving ext4 umount and mount operations.
4	CVE-2011-2928	20	DoS	2011-08-29	2012-03-22	4.9	None	Local	Low	Not required	None	None	Complete
The befs_follow_link function in fs/befs/linuxvfs.c in the Linux kernel before 3.1-rc3 does not validate the length attribute of long symlinks, which allows local users to cause a denial of service (incorrect pointer dereference and OOPS) by accessing a long symlink on a malformed Be filesystem.
5	CVE-2011-2723	399	DoS	2011-09-06	2012-03-19	5.7	None	Local Network	Medium	Not required	None	None	Complete
The skb_gro_header_slow function in include/linux/netdevice.h in the Linux kernel before 2.6.39.4, when Generic Receive Offload (GRO) is enabled, resets certain fields in incorrect situations, which allows remote attackers to cause a denial of service (system crash) via crafted network traffic.
6	CVE-2011-2700	119	DoS Overflow	2011-09-06	2012-03-19	2.1	None	Local	Low	Not required	None	None	Partial
Multiple buffer overflows in the si4713_write_econtrol_string function in drivers/media/radio/si4713-i2c.c in the Linux kernel before 2.6.39.4 on the N900 platform might allow local users to cause a denial of service or have unspecified other impact via a crafted s_ext_ctrls operation with a (1) V4L2_CID_RDS_TX_PS_NAME or (2) V4L2_CID_RDS_TX_RADIO_TEXT control ID.
7	CVE-2011-2695	189	DoS	2011-07-28	2012-03-19	4.9	None	Local	Low	Not required	None	None	Complete
Multiple off-by-one errors in the ext4 subsystem in the Linux kernel before 3.0-rc5 allow local users to cause a denial of service (BUG_ON and system crash) by accessing a sparse file in extent format with a write operation involving a block number corresponding to the largest possible 32-bit unsigned integer.
8	CVE-2011-2689	399	DoS	2011-07-28	2012-03-22	4.9	None	Local	Low	Not required	None	None	Complete
The gfs2_fallocate function in fs/gfs2/file.c in the Linux kernel before 3.0-rc1 does not ensure that the size of a chunk allocation is a multiple of the block size, which allows local users to cause a denial of service (BUG and system crash) by arranging for all resource groups to have too little free space.
9	CVE-2011-2534	119	DoS Overflow	2011-06-22	2012-03-19	4.0	None	Local	High	Not required	None	None	Complete
Buffer overflow in the clusterip_proc_write function in net/ipv4/netfilter/ipt_CLUSTERIP.c in the Linux kernel before 2.6.39 might allow local users to cause a denial of service or have unspecified other impact via a crafted write operation, related to string data that lacks a terminating '\0' character.
10	CVE-2011-2497	189	DoS Overflow Mem. Corr.	2011-08-29	2012-03-19	8.3	None	Local Network	Low	Not required	Complete	Complete	Complete
Integer underflow in the l2cap_config_req function in net/bluetooth/l2cap_core.c in the Linux kernel before 3.0 allows remote attackers to cause a denial of service (heap memory corruption) or possibly have unspecified other impact via a small command-size value within the command header of a Logical Link Control and Adaptation Protocol (L2CAP) configuration request, leading to a buffer overflow.
11	CVE-2011-2492	200	+Info	2011-07-28	2012-03-19	1.9	None	Local	Medium	Not required	Partial	None	None
The bluetooth subsystem in the Linux kernel before 3.0-rc4 does not properly initialize certain data structures, which allows local users to obtain potentially sensitive information from kernel memory via a crafted getsockopt system call, related to (1) the l2cap_sock_getsockopt_old function in net/bluetooth/l2cap_sock.c and (2) the rfcomm_sock_getsockopt_old function in net/bluetooth/rfcomm/sock.c.
12	CVE-2011-2491	399	DoS	2013-03-01	2013-03-04	4.9	None	Local	Low	Not required	None	None	Complete
The Network Lock Manager (NLM) protocol implementation in the NFS client functionality in the Linux kernel before 3.0 allows local users to cause a denial of service (system hang) via a LOCK_UN flock system call.
13	CVE-2011-2484	399	DoS Bypass	2011-06-24	2012-03-19	4.9	None	Local	Low	Not required	None	None	Complete
The add_del_listener function in kernel/taskstats.c in the Linux kernel 2.6.39.1 and earlier does not prevent multiple registrations of exit handlers, which allows local users to cause a denial of service (memory and CPU consumption), and bypass the OOM Killer, via a crafted application.
14	CVE-2011-2482		DoS	2013-06-08	2013-06-10	7.8	None	Remote	Low	Not required	None	None	Complete
A certain Red Hat patch to the sctp_sock_migrate function in net/sctp/socket.c in the Linux kernel before 2.6.21, as used in Red Hat Enterprise Linux (RHEL) 5, allows remote attackers to cause a denial of service (NULL pointer dereference and OOPS) via a crafted SCTP packet.
15	CVE-2011-2479	399	DoS	2013-03-01	2013-03-04	4.9	None	Local	Low	Not required	None	None	Complete
The Linux kernel before 2.6.39 does not properly create transparent huge pages in response to a MAP_PRIVATE mmap system call on /dev/zero, which allows local users to cause a denial of service (system crash) via a crafted application.
16	CVE-2011-2213	399	DoS	2011-08-29	2012-03-19	4.9	None	Local	Low	Not required	None	None	Complete
The inet_diag_bc_audit function in net/ipv4/inet_diag.c in the Linux kernel before 2.6.39.3 does not properly audit INET_DIAG bytecode, which allows local users to cause a denial of service (kernel infinite loop) via crafted INET_DIAG_REQ_BYTECODE instructions in a netlink message, as demonstrated by an INET_DIAG_BC_JMP instruction with a zero yes value, a different vulnerability than CVE-2010-3880.
17	CVE-2011-2184		DoS	2011-09-06	2012-03-19	7.2	None	Local	Low	Not required	Complete	Complete	Complete
The key_replace_session_keyring function in security/keys/process_keys.c in the Linux kernel before 2.6.39.1 does not initialize a certain structure member, which allows local users to cause a denial of service (NULL pointer dereference and OOPS) or possibly have unspecified other impact via a KEYCTL_SESSION_TO_PARENT argument to the keyctl function, a different vulnerability than CVE-2010-2960.
18	CVE-2011-2022	20	DoS +Priv	2011-05-09	2012-03-19	6.9	None	Local	Medium	Not required	Complete	Complete	Complete
The agp_generic_remove_memory function in drivers/char/agp/generic.c in the Linux kernel before 2.6.38.5 does not validate a certain start parameter, which allows local users to gain privileges or cause a denial of service (system crash) via a crafted AGPIOC_UNBIND agp_ioctl ioctl call, a different vulnerability than CVE-2011-1745.
19	CVE-2011-1776	119	DoS Overflow +Info	2011-09-06	2012-05-17	5.6	None	Local	Low	Not required	Partial	None	Complete
The is_gpt_valid function in fs/partitions/efi.c in the Linux kernel before 2.6.39 does not check the size of an Extensible Firmware Interface (EFI) GUID Partition Table (GPT) entry, which allows physically proximate attackers to cause a denial of service (heap-based buffer overflow and OOPS) or obtain sensitive information from kernel heap memory by connecting a crafted GPT storage device, a different vulnerability than CVE-2011-1577.
20	CVE-2011-1771		DoS	2011-09-06	2012-03-19	4.7	None	Local	Medium	Not required	None	None	Complete
The cifs_close function in fs/cifs/file.c in the Linux kernel before 2.6.39 allows local users to cause a denial of service (NULL pointer dereference and BUG) or possibly have unspecified other impact by setting the O_DIRECT flag during an attempt to open a file on a CIFS filesystem.
21	CVE-2011-1748	20	DoS	2011-05-09	2012-04-16	4.9	None	Local	Low	Not required	None	None	Complete
The raw_release function in net/can/raw.c in the Linux kernel before 2.6.39-rc6 does not properly validate a socket data structure, which allows local users to cause a denial of service (NULL pointer dereference) or possibly have unspecified other impact via a crafted release operation.
22	CVE-2011-1747	399	DoS	2011-05-09	2012-03-19	4.7	None	Local	Medium	Not required	None	None	Complete
The agp subsystem in the Linux kernel 2.6.38.5 and earlier does not properly restrict memory allocation by the (1) AGPIOC_RESERVE and (2) AGPIOC_ALLOCATE ioctls, which allows local users to cause a denial of service (memory consumption) by making many calls to these ioctls.
23	CVE-2011-1746	189	DoS Overflow	2011-05-09	2012-03-19	6.9	None	Local	Medium	Not required	Complete	Complete	Complete
Multiple integer overflows in the (1) agp_allocate_memory and (2) agp_create_user_memory functions in drivers/char/agp/generic.c in the Linux kernel before 2.6.38.5 allow local users to trigger buffer overflows, and consequently cause a denial of service (system crash) or possibly have unspecified other impact, via vectors related to calls that specify a large number of memory pages.
24	CVE-2011-1745	189	DoS Overflow +Priv	2011-05-09	2012-03-19	6.9	None	Local	Medium	Not required	Complete	Complete	Complete
Integer overflow in the agp_generic_insert_memory function in drivers/char/agp/generic.c in the Linux kernel before 2.6.38.5 allows local users to gain privileges or cause a denial of service (system crash) via a crafted AGPIOC_BIND agp_ioctl ioctl call.
25	CVE-2011-1598	20	DoS	2011-05-09	2012-03-19	4.9	None	Local	Low	Not required	None	None	Complete
The bcm_release function in net/can/bcm.c in the Linux kernel before 2.6.39-rc6 does not properly validate a socket data structure, which allows local users to cause a denial of service (NULL pointer dereference) or possibly have unspecified other impact via a crafted release operation.
26	CVE-2011-1593	189	DoS Overflow	2011-05-03	2012-03-19	4.9	None	Local	Low	Not required	None	None	Complete
Multiple integer overflows in the next_pidmap function in kernel/pid.c in the Linux kernel before 2.6.38.4 allow local users to cause a denial of service (system crash) via a crafted (1) getdents or (2) readdir system call.
27	CVE-2011-1581	20	DoS	2011-05-26	2012-03-19	4.6	None	Local Network	High	Not required	None	None	Complete
The bond_select_queue function in drivers/net/bonding/bond_main.c in the Linux kernel before 2.6.39, when a network device with a large number of receive queues is installed but the default tx_queues setting is used, does not properly restrict queue indexes, which allows remote attackers to cause a denial of service (BUG and system crash) or possibly have unspecified other impact by sending network traffic.
28	CVE-2011-1577	119	DoS Overflow	2011-05-03	2012-04-27	4.9	None	Local	Low	Not required	None	None	Complete
Heap-based buffer overflow in the is_gpt_valid function in fs/partitions/efi.c in the Linux kernel 2.6.38 and earlier allows physically proximate attackers to cause a denial of service (OOPS) or possibly have unspecified other impact via a crafted size of the EFI GUID partition-table header on removable media.
29	CVE-2011-1495	20	DoS +Priv Mem. Corr. +Info	2011-05-03	2012-04-27	7.2	Admin	Local	Low	Not required	Complete	Complete	Complete
drivers/scsi/mpt2sas/mpt2sas_ctl.c in the Linux kernel 2.6.38 and earlier does not validate (1) length and (2) offset values before performing memory copy operations, which might allow local users to gain privileges, cause a denial of service (memory corruption), or obtain sensitive information from kernel memory via a crafted ioctl call, related to the _ctl_do_mpt_command and _ctl_diag_read_buffer functions.
30	CVE-2011-1494	189	DoS Overflow +Priv Mem. Corr.	2011-05-03	2012-04-27	6.9	None	Local	Medium	Not required	Complete	Complete	Complete
Integer overflow in the _ctl_do_mpt_command function in drivers/scsi/mpt2sas/mpt2sas_ctl.c in the Linux kernel 2.6.38 and earlier might allow local users to gain privileges or cause a denial of service (memory corruption) via an ioctl call specifying a crafted value that triggers a heap-based buffer overflow.
31	CVE-2011-1478		DoS	2011-10-23	2012-05-13	5.7	None	Local Network	Medium	Not required	None	None	Complete
The napi_reuse_skb function in net/core/dev.c in the Generic Receive Offload (GRO) implementation in the Linux kernel before 2.6.38 does not reset the values of certain structure members, which might allow remote attackers to cause a denial of service (NULL pointer dereference) via a malformed VLAN frame.
32	CVE-2011-1182			2013-03-01	2013-03-04	3.6	None	Local	Low	Not required	None	Partial	Partial
kernel/signal.c in the Linux kernel before 2.6.39 allows local users to spoof the uid and pid of a signal sender via a sigqueueinfo system call.
33	CVE-2011-1180	119	DoS Overflow Mem. Corr.	2013-06-08	2013-06-10	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Multiple stack-based buffer overflows in the iriap_getvaluebyclass_indication function in net/irda/iriap.c in the Linux kernel before 2.6.39 allow remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact by leveraging connectivity to an IrDA infrared network and sending a large integer value for a (1) name length or (2) attribute length.
34	CVE-2011-1173	200	+Info	2011-06-22	2012-03-22	5.0	None	Remote	Low	Not required	Partial	None	None
The econet_sendmsg function in net/econet/af_econet.c in the Linux kernel before 2.6.39 on the x86_64 platform allows remote attackers to obtain potentially sensitive information from kernel stack memory by reading uninitialized data in the ah field of an Acorn Universal Networking (AUN) packet.
35	CVE-2011-1172	200	+Info	2011-06-22	2012-03-19	2.1	None	Local	Low	Not required	Partial	None	None
net/ipv6/netfilter/ip6_tables.c in the IPv6 implementation in the Linux kernel before 2.6.39 does not place the expected '\0' character at the end of string data in the values of certain structure members, which allows local users to obtain potentially sensitive information from kernel memory by leveraging the CAP_NET_ADMIN capability to issue a crafted request, and then reading the argument to the resulting modprobe process.
36	CVE-2011-1171	200	+Info	2011-06-22	2012-03-19	2.1	None	Local	Low	Not required	Partial	None	None
net/ipv4/netfilter/ip_tables.c in the IPv4 implementation in the Linux kernel before 2.6.39 does not place the expected '\0' character at the end of string data in the values of certain structure members, which allows local users to obtain potentially sensitive information from kernel memory by leveraging the CAP_NET_ADMIN capability to issue a crafted request, and then reading the argument to the resulting modprobe process.
37	CVE-2011-1170	200	+Info	2011-06-22	2012-03-19	2.1	None	Local	Low	Not required	Partial	None	None
net/ipv4/netfilter/arp_tables.c in the IPv4 implementation in the Linux kernel before 2.6.39 does not place the expected '\0' character at the end of string data in the values of certain structure members, which allows local users to obtain potentially sensitive information from kernel memory by leveraging the CAP_NET_ADMIN capability to issue a crafted request, and then reading the argument to the resulting modprobe process.
38	CVE-2011-1169	20	DoS +Priv Mem. Corr.	2011-05-03	2012-04-27	6.9	None	Local	Medium	Not required	Complete	Complete	Complete
Array index error in the asihpi_hpi_ioctl function in sound/pci/asihpi/hpioctl.c in the AudioScience HPI driver in the Linux kernel before 2.6.38.1 might allow local users to cause a denial of service (memory corruption) or possibly gain privileges via a crafted adapter index value that triggers access to an invalid kernel pointer.
39	CVE-2011-1163	20	+Info	2011-04-09	2013-01-15	2.1	None	Local	Low	Not required	Partial	None	None
The osf_partition function in fs/partitions/osf.c in the Linux kernel before 2.6.38 does not properly handle an invalid number of partitions, which might allow local users to obtain potentially sensitive information from kernel heap memory via vectors related to partition-table parsing.
40	CVE-2011-1093		DoS	2011-07-18	2012-03-19	7.8	None	Remote	Low	Not required	None	None	Complete
The dccp_rcv_state_process function in net/dccp/input.c in the Datagram Congestion Control Protocol (DCCP) implementation in the Linux kernel before 2.6.38 does not properly handle packets for a CLOSED endpoint, which allows remote attackers to cause a denial of service (NULL pointer dereference and OOPS) by sending a DCCP-Close packet followed by a DCCP-Reset packet.
41	CVE-2011-1090	399	DoS	2011-05-09	2012-03-19	4.9	None	Local	Low	Not required	None	None	Complete
The __nfs4_proc_set_acl function in fs/nfs/nfs4proc.c in the Linux kernel before 2.6.38 stores NFSv4 ACL data in memory that is allocated by kmalloc but not properly freed, which allows local users to cause a denial of service (panic) via a crafted attempt to set an ACL.
42	CVE-2011-1082	399	DoS	2011-04-04	2012-03-19	4.9	None	Local	Low	Not required	None	None	Complete
fs/eventpoll.c in the Linux kernel before 2.6.38 places epoll file descriptors within other epoll data structures without properly checking for (1) closed loops or (2) deep chains, which allows local users to cause a denial of service (deadlock or stack memory consumption) via a crafted application that makes epoll_create and epoll_ctl system calls.
43	CVE-2011-1076		DoS	2011-10-04	2012-05-14	7.8	None	Remote	Low	Not required	None	None	Complete
net/dns_resolver/dns_key.c in the Linux kernel before 2.6.38 allows remote DNS servers to cause a denial of service (NULL pointer dereference and OOPS) by not providing a valid response to a DNS query, as demonstrated by an erroneous grand.centrall.org query, which triggers improper handling of error data within a DNS resolver key.
44	CVE-2011-1023		DoS	2012-06-21	2012-06-22	4.9	None	Local	Low	Not required	None	None	Complete
The Reliable Datagram Sockets (RDS) subsystem in the Linux kernel before 2.6.38 does not properly handle congestion map updates, which allows local users to cause a denial of service (BUG_ON and system crash) via vectors involving (1) a loopback (aka loop) transmit operation or (2) an InfiniBand (aka ib) transmit operation.
45	CVE-2011-1019	264	Bypass	2013-03-01	2013-03-04	1.9	None	Local	Medium	Not required	None	Partial	None
The dev_load function in net/core/dev.c in the Linux kernel before 2.6.38 allows local users to bypass an intended CAP_SYS_MODULE capability requirement and load arbitrary modules by leveraging the CAP_NET_ADMIN capability.
46	CVE-2011-1016	20		2011-02-28	2012-03-19	6.9	None	Local	Medium	Not required	Complete	Complete	Complete
The Radeon GPU drivers in the Linux kernel before 2.6.38-rc5 do not properly validate data related to the AA resolve registers, which allows local users to write to arbitrary memory locations associated with (1) Video RAM (aka VRAM) or (2) the Graphics Translation Table (GTT) via crafted values.
47	CVE-2011-1013	189	DoS	2011-05-09	2012-03-19	7.2	None	Local	Low	Not required	Complete	Complete	Complete
Integer signedness error in the drm_modeset_ctl function in (1) drivers/gpu/drm/drm_irq.c in the Direct Rendering Manager (DRM) subsystem in the Linux kernel before 2.6.38 and (2) sys/dev/pci/drm/drm_irq.c in the kernel in OpenBSD before 4.9 allows local users to trigger out-of-bounds write operations, and consequently cause a denial of service (system crash) or possibly have unspecified other impact, via a crafted num_crtcs (aka vb_num) structure member in an ioctl argument.
48	CVE-2011-1012	20	DoS	2011-03-01	2012-03-19	4.9	None	Local	Low	Not required	None	None	Complete
The ldm_parse_vmdb function in fs/partitions/ldm.c in the Linux kernel before 2.6.38-rc6-git6 does not validate the VBLK size value in the VMDB structure in an LDM partition table, which allows local users to cause a denial of service (divide-by-zero error and OOPS) via a crafted partition table.
49	CVE-2011-0999	399	DoS	2011-02-23	2012-03-19	4.9	None	Local	Low	Not required	None	None	Complete
mm/huge_memory.c in the Linux kernel before 2.6.38-rc5 does not prevent creation of a transparent huge page (THP) during the existence of a temporary stack for an exec system call, which allows local users to cause a denial of service (memory consumption) or possibly have unspecified other impact via a crafted application.
50	CVE-2011-0726	20		2011-07-18	2012-03-19	2.1	None	Local	Low	Not required	Partial	None	None
The do_task_stat function in fs/proc/array.c in the Linux kernel before 2.6.39-rc1 does not perform an expected uid check, which makes it easier for local users to defeat the ASLR protection mechanism by reading the start_code and end_code fields in the /proc/#####/stat file for a process executing a PIE binary.

Total number of vulnerabilities : 56 Page : 1 (This Page)2