Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 485890 - <sys-kernel/openvz-sources-2.6.32.81.3: multiple vulnerabilities (CVE-2012-6544,CVE-2013-{2146,2206,2224,2232,2237})
Summary: <sys-kernel/openvz-sources-2.6.32.81.3: multiple vulnerabilities (CVE-2012-65...
Status: RESOLVED FIXED
Alias: None
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal major (vote)
Assignee: Gentoo Security
URL: https://secunia.com/advisories/54900/
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2013-09-24 19:39 UTC by Agostino Sarubbo
Modified: 2013-09-29 16:01 UTC (History)
4 users (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Agostino Sarubbo gentoo-dev 2013-09-24 19:39:16 UTC
From ${URL} :

Description

OpenVZ has issued an update for kernel. This fixes two vulnerabilities, which can be exploited by 
malicious, local users in a guest virtual machine to cause a DoS (Denial of Service) and by 
malicious, local users to potentially gain escalated privileges.

For more information:
SA54618


Solution:
Update kernel branch RHEL6 to version 042stab081.3.

Original Advisory:
OpenVZ:
http://wiki.openvz.org/Download/kernel/rhel6/042stab081.3




@maintainer(s): after the bump, in case we need to stabilize the package, please say explicitly if it is ready for the stabilization or not.
Comment 1 Sergey Popov gentoo-dev 2013-09-25 08:19:08 UTC
+*openvz-sources-2.6.32.81.3 (25 Sep 2013)
+
+  25 Sep 2013; Sergey Popov <pinkbyte@gentoo.org>
+  +openvz-sources-2.6.32.81.3.ebuild:
+  Version bump, wrt bug #485890

Arches, please test and mark stable =sys-kernel/openvz-sources-2.6.32.81.3

Target keywords: amd64 x86

CCing @pva, as he is permitted to do stabilization of this package on his own
Comment 2 Agostino Sarubbo gentoo-dev 2013-09-28 17:15:35 UTC
Peter is already in charge to do the stabilization because noone of us have the openvz container to test it. We don't need to have the arches here.
Comment 3 Peter Volkov (RETIRED) gentoo-dev 2013-09-28 18:13:45 UTC
+  28 Sep 2013; Peter Volkov <pva@gentoo.org> -openvz-sources-2.6.32.79.5.ebuild,
+  -openvz-sources-2.6.32.79.6.ebuild, openvz-sources-2.6.32.81.3.ebuild:
+  x86/amd64 stable, security bug #485890. Drop old.
Comment 4 Sean Amoss (RETIRED) gentoo-dev Security 2013-09-29 16:01:43 UTC
Kernel source -> noglsa.