2.6.26.6 : Security Vulnerabilities (Overflow)

Cpe Name:cpe:/o:linux:linux_kernel:2.6.26.6

CVSS Scores Greater Than: 0 1 2 3 4 5 6 7 8 9

Sort Results By : Cve Number Descending Cve Number Ascending CVSS Score Descending Number Of Exploits Descending

Copy Results Download Results Select Table

#	CVE ID	CWE ID	Vulnerability Type(s)	Publish Date	Update Date	Score	Gained Access Level	Access	Complexity	Authentication	Conf.	Integ.	Avail.
1	CVE-2011-4611	189	DoS Overflow	2012-05-17	2012-05-17	4.9	None	Local	Low	Not required	None	None	Complete
Integer overflow in the perf_event_interrupt function in arch/powerpc/kernel/perf_event.c in the Linux kernel before 2.6.39 on powerpc platforms allows local users to cause a denial of service (unhandled performance monitor exception) via vectors that trigger certain outcomes of performance events.
2	CVE-2011-3359	119	DoS Overflow	2012-05-24	2012-05-29	5.4	None	Remote	High	Not required	None	None	Complete
The dma_rx function in drivers/net/wireless/b43/dma.c in the Linux kernel before 2.6.39 does not properly allocate receive buffers, which allows remote attackers to cause a denial of service (system crash) via a crafted frame.
3	CVE-2011-2700	119	DoS Overflow	2011-09-06	2012-03-19	2.1	None	Local	Low	Not required	None	None	Partial
Multiple buffer overflows in the si4713_write_econtrol_string function in drivers/media/radio/si4713-i2c.c in the Linux kernel before 2.6.39.4 on the N900 platform might allow local users to cause a denial of service or have unspecified other impact via a crafted s_ext_ctrls operation with a (1) V4L2_CID_RDS_TX_PS_NAME or (2) V4L2_CID_RDS_TX_RADIO_TEXT control ID.
4	CVE-2011-2534	119	DoS Overflow	2011-06-22	2012-03-19	4.0	None	Local	High	Not required	None	None	Complete
Buffer overflow in the clusterip_proc_write function in net/ipv4/netfilter/ipt_CLUSTERIP.c in the Linux kernel before 2.6.39 might allow local users to cause a denial of service or have unspecified other impact via a crafted write operation, related to string data that lacks a terminating '\0' character.
5	CVE-2011-2517	119	Overflow +Priv	2012-05-24	2012-05-25	7.2	None	Local	Low	Not required	Complete	Complete	Complete
Multiple buffer overflows in net/wireless/nl80211.c in the Linux kernel before 2.6.39.2 allow local users to gain privileges by leveraging the CAP_NET_ADMIN capability during scan operations with a long SSID value.
6	CVE-2011-2497	189	DoS Overflow Mem. Corr.	2011-08-29	2012-03-19	8.3	None	Local Network	Low	Not required	Complete	Complete	Complete
Integer underflow in the l2cap_config_req function in net/bluetooth/l2cap_core.c in the Linux kernel before 3.0 allows remote attackers to cause a denial of service (heap memory corruption) or possibly have unspecified other impact via a small command-size value within the command header of a Logical Link Control and Adaptation Protocol (L2CAP) configuration request, leading to a buffer overflow.
7	CVE-2011-1776	119	DoS Overflow +Info	2011-09-06	2012-05-17	5.6	None	Local	Low	Not required	Partial	None	Complete
The is_gpt_valid function in fs/partitions/efi.c in the Linux kernel before 2.6.39 does not check the size of an Extensible Firmware Interface (EFI) GUID Partition Table (GPT) entry, which allows physically proximate attackers to cause a denial of service (heap-based buffer overflow and OOPS) or obtain sensitive information from kernel heap memory by connecting a crafted GPT storage device, a different vulnerability than CVE-2011-1577.
8	CVE-2011-1746	189	DoS Overflow	2011-05-09	2012-03-19	6.9	None	Local	Medium	Not required	Complete	Complete	Complete
Multiple integer overflows in the (1) agp_allocate_memory and (2) agp_create_user_memory functions in drivers/char/agp/generic.c in the Linux kernel before 2.6.38.5 allow local users to trigger buffer overflows, and consequently cause a denial of service (system crash) or possibly have unspecified other impact, via vectors related to calls that specify a large number of memory pages.
9	CVE-2011-1745	189	DoS Overflow +Priv	2011-05-09	2012-03-19	6.9	None	Local	Medium	Not required	Complete	Complete	Complete
Integer overflow in the agp_generic_insert_memory function in drivers/char/agp/generic.c in the Linux kernel before 2.6.38.5 allows local users to gain privileges or cause a denial of service (system crash) via a crafted AGPIOC_BIND agp_ioctl ioctl call.
10	CVE-2011-1593	189	DoS Overflow	2011-05-03	2012-03-19	4.9	None	Local	Low	Not required	None	None	Complete
Multiple integer overflows in the next_pidmap function in kernel/pid.c in the Linux kernel before 2.6.38.4 allow local users to cause a denial of service (system crash) via a crafted (1) getdents or (2) readdir system call.
11	CVE-2011-1577	119	DoS Overflow	2011-05-03	2012-04-27	4.9	None	Local	Low	Not required	None	None	Complete
Heap-based buffer overflow in the is_gpt_valid function in fs/partitions/efi.c in the Linux kernel 2.6.38 and earlier allows physically proximate attackers to cause a denial of service (OOPS) or possibly have unspecified other impact via a crafted size of the EFI GUID partition-table header on removable media.
12	CVE-2011-1494	189	DoS Overflow +Priv Mem. Corr.	2011-05-03	2012-04-27	6.9	None	Local	Medium	Not required	Complete	Complete	Complete
Integer overflow in the _ctl_do_mpt_command function in drivers/scsi/mpt2sas/mpt2sas_ctl.c in the Linux kernel 2.6.38 and earlier might allow local users to gain privileges or cause a denial of service (memory corruption) via an ioctl call specifying a crafted value that triggers a heap-based buffer overflow.
13	CVE-2011-1044	119	Overflow +Info	2011-02-18	2013-01-21	1.9	None	Local	Medium	Not required	Partial	None	None
The ib_uverbs_poll_cq function in drivers/infiniband/core/uverbs_cmd.c in the Linux kernel before 2.6.37 does not initialize a certain response buffer, which allows local users to obtain potentially sensitive information from kernel memory via vectors that cause this buffer to be only partially filled, a different vulnerability than CVE-2010-4649.
14	CVE-2011-1017	119	Overflow +Priv +Info	2011-03-01	2012-03-19	7.2	None	Local	Low	Not required	Complete	Complete	Complete
Heap-based buffer overflow in the ldm_frag_add function in fs/partitions/ldm.c in the Linux kernel 2.6.37.2 and earlier might allow local users to gain privileges or obtain sensitive information via a crafted LDM partition table.
15	CVE-2011-1010	119	DoS Overflow	2011-03-01	2013-01-21	4.9	None	Local	Low	Not required	None	None	Complete
Buffer overflow in the mac_partition function in fs/partitions/mac.c in the Linux kernel before 2.6.37.2 allows local users to cause a denial of service (panic) or possibly have unspecified other impact via a malformed Mac OS partition table.
16	CVE-2011-0712	119	DoS Overflow	2011-02-18	2012-03-19	6.2	None	Local	High	Not required	Complete	Complete	Complete
Multiple buffer overflows in the caiaq Native Instruments USB audio functionality in the Linux kernel before 2.6.38-rc4-next-20110215 might allow attackers to cause a denial of service or possibly have unspecified other impact via a long USB device name, related to (1) the snd_usb_caiaq_audio_init function in sound/usb/caiaq/audio.c and (2) the snd_usb_caiaq_midi_init function in sound/usb/caiaq/midi.c.
17	CVE-2010-4656	119	DoS Overflow +Priv	2011-07-18	2012-03-19	6.2	None	Local	High	Not required	Complete	Complete	Complete
The iowarrior_write function in drivers/usb/misc/iowarrior.c in the Linux kernel before 2.6.37 does not properly allocate memory, which might allow local users to trigger a heap-based buffer overflow, and consequently cause a denial of service or gain privileges, via a long report.
18	CVE-2010-4649	189	DoS Overflow Mem. Corr.	2011-02-18	2012-03-19	6.9	None	Local	Medium	Not required	Complete	Complete	Complete
Integer overflow in the ib_uverbs_poll_cq function in drivers/infiniband/core/uverbs_cmd.c in the Linux kernel before 2.6.37 allows local users to cause a denial of service (memory corruption) or possibly have unspecified other impact via a large value of a certain structure member.
19	CVE-2010-4527	119	Overflow +Priv +Info	2011-01-13	2012-03-19	6.9	None	Local	Medium	Not required	Complete	Complete	Complete
The load_mixer_volumes function in sound/oss/soundcard.c in the OSS sound subsystem in the Linux kernel before 2.6.37 incorrectly expects that a certain name field ends with a '\0' character, which allows local users to conduct buffer overflow attacks and gain privileges, or possibly obtain sensitive information from kernel memory, via a SOUND_MIXER_SETLEVELS ioctl call.
20	CVE-2010-4162	189	DoS Overflow	2011-01-03	2012-03-19	4.7	None	Local	Medium	Not required	None	None	Complete
Multiple integer overflows in fs/bio.c in the Linux kernel before 2.6.36.2 allow local users to cause a denial of service (system crash) via a crafted device ioctl to a SCSI device.
21	CVE-2010-4160	189	DoS Overflow +Priv Mem. Corr.	2011-01-07	2013-01-21	6.9	None	Local	Medium	Not required	Complete	Complete	Complete
Multiple integer overflows in the (1) pppol2tp_sendmsg function in net/l2tp/l2tp_ppp.c, and the (2) l2tp_ip_sendmsg function in net/l2tp/l2tp_ip.c, in the PPPoL2TP and IPoL2TP implementations in the Linux kernel before 2.6.36.2 allow local users to cause a denial of service (heap memory corruption and panic) or possibly gain privileges via a crafted sendto call.
22	CVE-2010-4157	189	DoS Overflow Mem. Corr.	2010-12-10	2012-03-19	6.0	None	Local	High	Single system	Complete	Complete	Complete
Integer overflow in the ioc_general function in drivers/scsi/gdth.c in the Linux kernel before 2.6.36.1 on 64-bit platforms allows local users to cause a denial of service (memory corruption) or possibly have unspecified other impact via a large argument in an ioctl call.
23	CVE-2010-3874	119	DoS Overflow Mem. Corr.	2010-12-29	2012-03-19	4.0	None	Local	High	Not required	None	None	Complete
Heap-based buffer overflow in the bcm_connect function in net/can/bcm.c (aka the Broadcast Manager) in the Controller Area Network (CAN) implementation in the Linux kernel before 2.6.36.2 on 64-bit platforms might allow local users to cause a denial of service (memory corruption) via a connect operation.
24	CVE-2010-3859	189	Overflow +Priv	2010-12-29	2012-03-19	6.9	None	Local	Medium	Not required	Complete	Complete	Complete
Multiple integer signedness errors in the TIPC implementation in the Linux kernel before 2.6.36.2 allow local users to gain privileges via a crafted sendmsg call that triggers a heap-based buffer overflow, related to the tipc_msg_build function in net/tipc/msg.c and the verify_iovec function in net/core/iovec.c.
25	CVE-2010-3848	119	Overflow +Priv	2010-12-30	2012-03-19	6.9	None	Local	Medium	Not required	Complete	Complete	Complete
Stack-based buffer overflow in the econet_sendmsg function in net/econet/af_econet.c in the Linux kernel before 2.6.36.2, when an econet address is configured, allows local users to gain privileges by providing a large number of iovec structures.
26	CVE-2010-3442	189	DoS Overflow Mem. Corr.	2010-10-04	2012-03-19	4.7	None	Local	Medium	Not required	None	None	Complete
Multiple integer overflows in the snd_ctl_new function in sound/core/control.c in the Linux kernel before 2.6.36-rc5-next-20100929 allow local users to cause a denial of service (heap memory corruption) or possibly have unspecified other impact via a crafted (1) SNDRV_CTL_IOCTL_ELEM_ADD or (2) SNDRV_CTL_IOCTL_ELEM_REPLACE ioctl call.
27	CVE-2010-3084	119	DoS Overflow	2010-09-29	2012-03-19	7.2	None	Local	Low	Not required	Complete	Complete	Complete
Buffer overflow in the niu_get_ethtool_tcam_all function in drivers/net/niu.c in the Linux kernel before 2.6.36-rc4 allows local users to cause a denial of service or possibly have unspecified other impact via the ETHTOOL_GRXCLSRLALL ethtool command.
28	CVE-2010-3081	119	Overflow +Priv	2010-09-24	2012-03-19	7.2	None	Local	Low	Not required	Complete	Complete	Complete
The compat_alloc_user_space functions in include/asm/compat.h files in the Linux kernel before 2.6.36-rc4-git2 on 64-bit platforms do not properly allocate the userspace memory required for the 32-bit compatibility layer, which allows local users to gain privileges by leveraging the ability of the compat_mc_getsockopt function (aka the MCAST_MSFILTER getsockopt support) to control a certain length value, related to a "stack pointer underflow" issue, as exploited in the wild in September 2010.
29	CVE-2010-3067	189	DoS Overflow	2010-09-21	2012-03-19	4.9	None	Local	Low	Not required	None	None	Complete
Integer overflow in the do_io_submit function in fs/aio.c in the Linux kernel before 2.6.36-rc4-next-20100915 allows local users to cause a denial of service or possibly have unspecified other impact via crafted use of the io_submit system call.
30	CVE-2010-3015	189	DoS Overflow	2010-08-20	2012-03-19	4.7	None	Local	Medium	Not required	None	None	Complete
Integer overflow in the ext4_ext_get_blocks function in fs/ext4/extents.c in the Linux kernel before 2.6.34 allows local users to cause a denial of service (BUG and system crash) via a write operation on the last block of a large file, followed by a sync operation.
31	CVE-2010-2959	189	DoS Exec Code Overflow	2010-09-08	2012-03-19	7.2	None	Local	Low	Not required	Complete	Complete	Complete
Integer overflow in net/can/bcm.c in the Controller Area Network (CAN) implementation in the Linux kernel before 2.6.27.53, 2.6.32.x before 2.6.32.21, 2.6.34.x before 2.6.34.6, and 2.6.35.x before 2.6.35.4 allows attackers to execute arbitrary code or cause a denial of service (system crash) via crafted CAN traffic.
32	CVE-2010-2538	189	Overflow +Info	2010-09-30	2012-03-19	4.7	None	Local	Medium	Not required	Complete	None	None
Integer overflow in the btrfs_ioctl_clone function in fs/btrfs/ioctl.c in the Linux kernel before 2.6.35 might allow local users to obtain sensitive information via a BTRFS_IOC_CLONE_RANGE ioctl call.
33	CVE-2010-2492	119	DoS Overflow +Priv	2010-09-08	2012-03-19	7.2	None	Local	Low	Not required	Complete	Complete	Complete
Buffer overflow in the ecryptfs_uid_hash macro in fs/ecryptfs/messaging.c in the eCryptfs subsystem in the Linux kernel before 2.6.35 might allow local users to gain privileges or cause a denial of service (system crash) via unspecified vectors.
34	CVE-2010-2478	189	DoS Overflow	2010-09-29	2012-03-19	7.2	None	Local	Low	Not required	Complete	Complete	Complete
Integer overflow in the ethtool_get_rxnfc function in net/core/ethtool.c in the Linux kernel before 2.6.33.7 on 32-bit platforms allows local users to cause a denial of service or possibly have unspecified other impact via an ETHTOOL_GRXCLSRLALL ethtool command with a large info.rule_cnt value that triggers a buffer overflow, a different vulnerability than CVE-2010-3084.
35	CVE-2010-1451	119	Overflow	2010-05-07	2012-03-19	5.0	None	Remote	Low	Not required	None	Partial	None
The TSB I-TLB load implementation in arch/sparc/kernel/tsb.S in the Linux kernel before 2.6.33 on the SPARC platform does not properly obtain the value of a certain _PAGE_EXEC_4U bit and consequently does not properly implement a non-executable stack, which makes it easier for context-dependent attackers to exploit stack-based buffer overflows via a crafted application.
36	CVE-2010-1084	119	DoS Overflow Mem. Corr.	2010-04-06	2012-03-19	7.1	None	Remote	Medium	Not required	None	None	Complete
Linux kernel 2.6.18 through 2.6.33, and possibly other versions, allows remote attackers to cause a denial of service (memory corruption) via a large number of Bluetooth sockets, related to the size of sysfs files in (1) net/bluetooth/l2cap.c, (2) net/bluetooth/rfcomm/core.c, (3) net/bluetooth/rfcomm/sock.c, and (4) net/bluetooth/sco.c.
37	CVE-2009-4005	119	Overflow	2009-11-19	2012-03-19	7.2	None	Local	Low	Not required	Complete	Complete	Complete
The collect_rx_frame function in drivers/isdn/hisax/hfc_usb.c in the Linux kernel before 2.6.32-rc7 allows attackers to have an unspecified impact via a crafted HDLC packet that arrives over ISDN and triggers a buffer under-read.
38	CVE-2009-4004	119	DoS Overflow +Priv Mem. Corr.	2009-11-19	2012-03-19	7.2	None	Local	Low	Not required	Complete	Complete	Complete
Buffer overflow in the kvm_vcpu_ioctl_x86_setup_mce function in arch/x86/kvm/x86.c in the KVM subsystem in the Linux kernel before 2.6.32-rc7 allows local users to cause a denial of service (memory corruption) or possibly gain privileges via a KVM_X86_SETUP_MCE IOCTL request that specifies a large number of Machine Check Exception (MCE) banks.
39	CVE-2009-3638	189	Overflow	2009-10-29	2012-03-19	7.2	None	Local	Low	Not required	Complete	Complete	Complete
Integer overflow in the kvm_dev_ioctl_get_supported_cpuid function in arch/x86/kvm/x86.c in the KVM subsystem in the Linux kernel before 2.6.31.4 allows local users to have an unspecified impact via a KVM_GET_SUPPORTED_CPUID request to the kvm_arch_dev_ioctl function.
40	CVE-2009-3280	119	DoS Overflow	2009-09-21	2012-03-19	7.8	None	Remote	Low	Not required	None	None	Complete
Integer signedness error in the find_ie function in net/wireless/scan.c in the cfg80211 subsystem in the Linux kernel before 2.6.31.1-rc1 allows remote attackers to cause a denial of service (soft lockup) via malformed packets.
41	CVE-2009-2768	119	DoS Overflow	2009-08-14	2012-03-19	7.2	None	Local	Low	Not required	Complete	Complete	Complete
The load_flat_shared_library function in fs/binfmt_flat.c in the flat subsystem in the Linux kernel before 2.6.31-rc6 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by executing a shared flat binary, which triggers an access of an "uninitialized cred pointer."
42	CVE-2009-2695	119	Overflow +Priv	2009-08-28	2012-03-19	7.2	Admin	Local	Low	Not required	Complete	Complete	Complete
The Linux kernel before 2.6.31-rc7 does not properly prevent mmap operations that target page zero and other low memory addresses, which allows local users to gain privileges by exploiting NULL pointer dereference vulnerabilities, related to (1) the default configuration of the allow_unconfined_mmap_low boolean in SELinux on Red Hat Enterprise Linux (RHEL) 5, (2) an error that causes allow_unconfined_mmap_low to be ignored in the unconfined_t domain, (3) lack of a requirement for the CAP_SYS_RAWIO capability for these mmap operations, and (4) interaction between the mmap_min_addr protection mechanism and certain application programs.
43	CVE-2009-2584	189	Overflow +Priv	2009-07-23	2012-03-19	7.2	None	Local	Low	Not required	Complete	Complete	Complete
Off-by-one error in the options_write function in drivers/misc/sgi-gru/gruprocfs.c in the SGI GRU driver in the Linux kernel 2.6.30.2 and earlier on ia64 and x86 platforms might allow local users to overwrite arbitrary memory locations and gain privileges via a crafted count argument, which triggers a stack-based buffer overflow.
44	CVE-2009-2407	119	DoS Overflow +Priv	2009-07-31	2012-03-19	6.9	Admin	Local	Medium	Not required	Complete	Complete	Complete
Heap-based buffer overflow in the parse_tag_3_packet function in fs/ecryptfs/keystore.c in the eCryptfs subsystem in the Linux kernel before 2.6.30.4 allows local users to cause a denial of service (system crash) or possibly gain privileges via vectors involving a crafted eCryptfs file, related to a large encrypted key size in a Tag 3 packet.
45	CVE-2009-1633	119	DoS Overflow Mem. Corr.	2009-05-28	2012-03-23	7.1	None	Remote	Medium	Not required	None	None	Complete
Multiple buffer overflows in the cifs subsystem in the Linux kernel before 2.6.29.4 allow remote CIFS servers to cause a denial of service (memory corruption) and possibly have unspecified other impact via (1) a malformed Unicode string, related to Unicode string area alignment in fs/cifs/sess.c; or (2) long Unicode characters, related to fs/cifs/cifssmb.c and the cifs_readdir function in fs/cifs/readdir.c.
46	CVE-2009-1439	119	DoS Overflow	2009-04-27	2012-03-19	7.8	None	Remote	Low	Not required	None	None	Complete
Buffer overflow in fs/cifs/connect.c in CIFS in the Linux kernel 2.6.29 and earlier allows remote attackers to cause a denial of service (crash) via a long nativeFileSystem field in a Tree Connect response to an SMB mount request.
47	CVE-2009-1265	189	Overflow +Info	2009-04-07	2012-03-23	5.0	None	Remote	Low	Not required	Partial	None	None
Integer overflow in rose_sendmsg (sys/net/af_rose.c) in the Linux kernel 2.6.24.4, and other versions before 2.6.30-rc1, might allow remote attackers to obtain sensitive information via a large length value, which causes "garbage" memory to be sent.
48	CVE-2009-0605	119	DoS Overflow +Priv Mem. Corr.	2009-02-17	2012-03-19	4.9	None	Local	Low	Not required	None	None	Complete
Stack consumption vulnerability in the do_page_fault function in arch/x86/mm/fault.c in the Linux kernel before 2.6.28.5 allows local users to cause a denial of service (memory corruption) or possibly gain privileges via unspecified vectors that trigger page faults on a machine that has a registered Kprobes probe.
49	CVE-2008-5134	119	Overflow	2008-11-18	2012-03-19	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
Buffer overflow in the lbs_process_bss function in drivers/net/wireless/libertas/scan.c in the libertas subsystem in the Linux kernel before 2.6.27.5 allows remote attackers to have an unknown impact via an "invalid beacon/probe response."

Total number of vulnerabilities : 49 Page : 1 (This Page)