Description

SUSE has issued an update for the kernel. This fixes some vulnerabilities, which can be exploited by malicious, local users to cause a DoS (Denial of Service) and disclose potentially sensitive information, and by malicious people to cause a DoS.

For more information:
SA27908
SA31366
SA35265
SA37590
SA38601

1) An error while copying memory from userspace can be exploited to disclose potentially sensitive information.

2) A use-after-free error exists within the "tcp_rcv_state_process()" function, which can be exploited to cause a kernel crash by e.g. sending a specially crafted IPv6 packet to a listening socket with the IPV6_RECVPKTINFO option enabled.

3) Errors within the implementation of the External Data Representation (XDR) for NFSv4 can be exploited to cause a kernel crash by sending specially crafted compound requests to the NFSv4 server.

Solution
Apply updated packages.
Further details available in Customer Area

Original Advisory
SUSE-SA:2010:036:
http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00001.html

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area