Description of problem: When transmitting L2TP frames, we derive the outgoing interface's UDP checksum hardware assist capabilities from the tunnel dst dev. This can sometimes be NULL, especially when routing protocols are used and routing changes occur. This patch just checks for NULL dst or dev pointers when checking for netdev hardware assist features. BUG: unable to handle kernel NULL pointer dereference at 0000000c IP: [<f89d074c>] pppol2tpxmit+0x341/0x4da [pppol2tp] pde = 00000000 Oops: 0000 [#1] SMP last sysfs file: /sys/class/net/lo/operstate Modules linked in: pppol2tp pppox pppgeneric slhc ipv6 dummy loop sndhdacodecatihdmi sndhdaintel sndhdacodec snd [...] Code: 8d 45 08 f0 ff 45 08 89 6b 08 c7 43 68 7e fb 9c f8 8a 45 24 83 e0 0c 3c 04 75 09 80 63 64 f3 e9 b4 00 00 00 8b 43 1 EIP: [<f89d074c>] pppol2tpxmit+0x341/0x4da [pppol2tp] SS:ESP 0068:f70a9cac CR2: 000000000000000c

Introduced in ffcebb16 (v2.6.29-rc1~581), fixed in 3feec909 (fixed in v2.6.34-rc2).

Upstream commit: http://git.kernel.org/linus/ffcebb16 http://git.kernel.org/linus/3feec909

Unspecified vulnerability in Sun JDK and Java Runtime Environment (JRE) 6 Update 4 and earlier and 5.0 Update 14 and earlier; and SDK and JRE 1.4.216 and earlier; allows remote attackers to access arbitrary network services on the local host via unspecified vectors related to JavaScript and Java APIs.

Sign extension error in the ReadDIBImage function in ImageMagick before 6.3.5-9 allows context-dependent attackers to execute arbitrary code via a crafted width value in an image file, which triggers an integer overflow and a heap-based buffer overflow.

Heap-based buffer overflow in pcrecompile.c in the Perl-Compatible Regular Expression (PCRE) library 7.7 allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a regular expression that begins with an option and contains multiple branches.

The connector layer in the Linux kernel before 2.6.31.5 does not require the CAPSYSADMIN capability for certain interaction with the (1) uvesafb, (2) pohmelfs, (3) dst, or (4) dm subsystem, which allows local users to bypass intended access restrictions and gain privileges via calls to functions in these subsystems.

Buffer overflow in ftmulti.c in the ftmulti demo program in FreeType before 2.4.2 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted font file.

Integer overflow in the seektoandunpackpixeldata function in the psd.c plugin in Gimp 2.2.15 allows remote attackers to execute arbitrary code via a crafted PSD file that contains a large (1) width or (2) height value.

The DNS protocol, as implemented in (1) BIND 8 and 9 before 9.5.0-P1, 9.4.2-P1, and 9.3.5-P1; (2) Microsoft DNS in Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP1 and SP2; and other implementations allow remote attackers to spoof DNS traffic via a birthday attack that uses in-bailiwick referrals to conduct cache poisoning against recursive resolvers, related to insufficient randomness of DNS transaction IDs and source ports, aka "DNS Insufficient Socket Entropy Vulnerability" or "the Kaminsky bug."

The WDDX deserializer in the wddx extension in PHP 5 before 5.2.1 and PHP 4 before 4.4.5 does not properly initialize the keylength variable for a numerical key, which allows context-dependent attackers to read stack memory via a wddxPacket element that contains a variable with a string name before a numerical variable.

The Linux kernel before 2.6.31-rc7 does not initialize certain data structures within getname functions, which allows local users to read the contents of some kernel memory locations by calling getsockname on (1) an AFAPPLETALK socket, related to the atalkgetname function in net/appletalk/ddp.c; (2) an AFIRDA socket, related to the irdagetname function in net/irda/afirda.c; (3) an AFECONET socket, related to the econetgetname function in net/econet/afeconet.c; (4) an AFNETROM socket, related to the nrgetname function in net/netrom/afnetrom.c; (5) an AFROSE socket, related to the rosegetname function in net/rose/afrose.c; or (6) a raw CAN socket, related to the rawgetname function in net/can/raw.c.

Description of problem: 1) NET: llc, zero sockaddrllc struct sllcarphrd member of sockaddrllc might not be changed. Zero sllc before copying to the above layer's structure.

http://git.kernel.org/linus/3480c63bdf008e9289aab94418f43b9592978fff http://git.kernel.org/linus/28e9fc592cb8c7a43e4d3147b38be6032a0e81bc http://milw0rm.com/exploits/9513

Note that LLC sockets are restricted to root since v2.6.25-rc9 (see commit 3480c63b).

2) can: Fix rawgetname() leak rawgetname() can leak 10 bytes of kernel memory to user

http://git.kernel.org/linus/e84b90ae5eb3c112d1f208964df1d8156a538289

Note that this was introduced in v2.6.25-rc1.

3) irda: Fix irdagetname() leak irdagetname() can leak kernel memory to user.

http://git.kernel.org/linus/09384dfc76e526c3993c09c42e016372dc9dd22c

4) appletalk: fix atalkgetname() leak atalkgetname() can leak 8 bytes of kernel memory to user

http://git.kernel.org/linus/3d392475c873c10c10d6d96b94d092a34ebd4791 http://milw0rm.com/exploits/9521

5) netrom: Fix nrgetname() leak nrgetname() can leak kernel memory to user.

http://git.kernel.org/linus/f6b97b29513950bfbf621a83d85b6f86b39ec8db

6) econet: Fix econetgetname() leak econetgetname() can leak kernel memory to user.

http://git.kernel.org/linus/80922bbb12a105f858a8f0abb879cb4302d0ecaa

7) rose: Fix rosegetname() leak rosegetname() can leak kernel memory to user.

http://git.kernel.org/linus/17ac2e9c58b69a1e25460a568eae1b0dc0188c25

CVE request: http://article.gmane.org/gmane.comp.security.oss.general/2029 http://article.gmane.org/gmane.comp.security.oss.general/2033

Mozilla Firefox before 2.0.0.17 and 3.x before 3.0.2, Thunderbird before 2.0.0.17, and SeaMonkey before 1.1.12 allow remote attackers to bypass cross-site scripting (XSS) protection mechanisms and conduct XSS attacks via byte order mark (BOM) characters that are removed from JavaScript code before execution, aka "Stripped BOM characters bug."