[Ksplice][Debian 5.0 Updates] New updates available via Ksplice (Debian 5.0.6)

[Tim Abbott]

Synopsis: Debian 5.0.6 can now be patched using Ksplice
CVEs: CVE-2010-2942 CVE-2010-2946

Systems running Debian 5.0 Lenny can now use Ksplice to patch against the 
latest Debian update, Debian 5.0.6.

INSTALLING THE UPDATES

We recommend that all Ksplice Uptrack Debian 5.0 Lenny users install these 
updates.  You can install these updates by running:

# uptrack-upgrade -y

DESCRIPTION

* CVE-2010-2942: Information leaks in traffic control dump structures.

Incorrectly initialized structures in the traffic control dump code may 
allow the disclosure of 32 bits of kernel memory to userspace 
applications.  (CVE-2010-2942)


* CVE-2010-2946: Access control bypass in JFS filesystem

Extended attribute namespace access rules may be bypassed by using the 
legacy-format os2 namespace.  (CVE-2010-2946)


* Additional CVE-2010-2240 update: Fix stack guard with mlock/mprotect.

The stack guard page code in the original upstream patch for CVE-2010-2240 
failed when the stack memory area had been split by certain calls to mlock 
or mprotect.

SUPPORT

Ksplice support is available at support at ksplice.com or +1 765-577-5423.