blob: 49751f59d88b6f86ce6136fc30dc7b82b9379170 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
|
Candidate: CVE-2006-2275
References:
http://git.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=7c3ceb4fb9667f34f1599a062efecf4cdc4a4ce5
Description:
Linux SCTP (lksctp) before 2.6.17 allows remote attackers to cause a
denial of service (deadlock) via a large number of small messages
to a receiver application that cannot process the messages quickly
enough, which leads to "spillover of the receive buffer."
Notes:
jmm> Seems like an ABI-breaker, the sctp_chunk struct is changed in the
jmm> upstream fix, this issue alone is not worth an ABI bump, a fix will
jmm> be postponed for now
jmm> For Sarge we'll ignore it, as it was only available under CONFIG_EXPERIMENTAL
jmm> and not suitable for production use anyway
Bugs:
upstream: released (2.6.16.15)
linux-2.6: released (2.6.16-13)
2.6.8-sarge-security: ignored
2.4.27-sarge-security: ignored
2.6.18-etch-security: N/A
|
