Ramon De Carvalho Valle

**Name of the Vulnerable Software and Affected Versions** AIX versions 5.2.0, 5.3.0, 5.3.7 through 5.3.10, and 6.1.0 through 6.1.3 **Description** The issue is a stack-based buffer overflow in the tt internal realpath function in the ToolTalk library. This occurs when the rpc.ttdbserver daemon is enabled in /etc/inetd.conf, allowing remote attackers to execute arbitrary code via a long XDR-encoded ASCII string to remote procedure 15. **Recommendations** For AIX versions 5.2.0, 5.3.0, 5.3.7 through 5.3.10, and 6.1.0 through 6.1.3, consider disabling the rpc.ttdbserver daemon in /etc/inetd.conf as a temporary workaround to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Firebird LI versions 2.0.0.12748 through 2.0.1.12855 Firebird WI versions 2.0.0.12748 through 2.0.1.12855 Description: The issue allows remote attackers to execute arbitrary code via a long attach request on TCP port 3050 to the `isc attach database` function or a long create request on TCP port 3050 to the `isc create database` function. This is due to multiple stack-based buffer overflows. Recommendations: For Firebird LI versions 2.0.0.12748 through 2.0.1.12855, consider restricting access to TCP port 3050 until a patch is available. For Firebird WI versions 2.0.0.12748 through 2.0.1.12855, consider restricting access to TCP port 3050 until a patch is available. As a temporary workaround, consider disabling the `isc attach database` and `isc create database` functions until a patch is available.

**Name of the Vulnerable Software and Affected Versions** SUSE Linux Enterprise kernel-default-base (affected versions not specified) openSUSE kernel-pseries64 (affected versions not specified) openSUSE kernel-s390-debug (affected versions not specified) openSUSE kernel-smp-debuginfo (affected versions not specified) SUSE Linux Enterprise kernel-default-debugsource (affected versions not specified) SUSE Linux Enterprise kernel-pae (affected versions not specified) openSUSE kernel-pmac64 (affected versions not specified) SUSE Linux Enterprise cluster-network-kmp-pae (affected versions not specified) openSUSE kexec-tools (affected versions not specified) openSUSE appleir-kmp-debug (affected versions not specified) SUSE Linux Enterprise kernel-pae-extra (affected versions not specified) openSUSE kernel-xenpae (affected versions not specified) SUSE Linux Enterprise kernel-pae-base (affected versions not specified) openSUSE kernel-s390x (affected versions not specified) openSUSE kernel-s390x-debug (affected versions not specified) openSUSE kernel-64k-pagesize (affected versions not specified) openSUSE acx-kmp-debug (affected versions not specified) openSUSE pcc-acpi-kmp-debug (affected versions not specified) openSUSE kexec-tools-debuginfo (affected versions not specified) SUSE Linux Enterprise kernel-ec2-base (affected versions not specified) openSUSE um-host-install-initrd (affected versions not specified) openSUSE kernel-vmipae (affected versions not specified) SUSE Linux Enterprise ext4dev-kmp-default (affected versions not specified) openSUSE kernel-iseries64-debuginfo (affected versions not specified) openSUSE um-host-kernel (affected versions not specified) openSUSE kernel-smp (affected versions not specified) SUSE Linux Enterprise ocfs2-kmp-xen (affected versions not specified) SUSE Linux Enterprise kernel-ec2 (affected versions not specified) SUSE Linux Enterprise ocfs2-kmp-default (affected versions not specified) SUSE Linux Enterprise cluster-network-kmp-xen (affected versions not specified) openSUSE kernel-um (affected versions not specified) openSUSE uvcvideo-kmp-debug (affected versions not specified) SUSE Linux Enterprise ext4dev-kmp-ppc64 (affected versions not specified) openSUSE kernel-iseries64 (affected versions not specified) SUSE Linux Enterprise kernel-default-extra (affected versions not specified) openSUSE acerhk-kmp-debug (affected versions not specified) openSUSE kernel-sn2 (affected versions not specified) openSUSE kernel-s390 (affected versions not specified) SUSE Linux Enterprise kernel-xen-base (affected versions not specified) openSUSE wlan-ng-kmp-debug (affected versions not specified) SUSE Linux Enterprise kexec-tools-debuginfo (affected versions not specified) SUSE Linux Enterprise kernel-ppc64-debugsource (affected versions not specified) openSUSE kernel-xenpae-debuginfo (affected versions not specified) SUSE Linux Enterprise kernel-xen-extra (affected versions not specified) SUSE Linux Enterprise kernel-kdump-debugsource (affected versions not specified) openSUSE tpctl-kmp-debug (affected versions not specified) SUSE Linux Enterprise cluster-network-kmp-default (affected versions not specified) openSUSE kernel-bigsmp (affected versions not specified) openSUSE gspcav-kmp-debug (affected versions not specified) SUSE Linux Enterprise ocfs2-kmp-pae (affected versions not specified) openSUSE nouveau-kmp-debug (affected versions not specified) openSUSE kernel-bigsmp-debuginfo (affected versions not specified) SUSE Linux Enterprise kernel-ppc64-base (affected versions not specified) openSUSE at76 usb-kmp-debug (affected versions not specified) openSUSE atl2-kmp-debug (affected versions not specified) **Description** The issue involves multiple vulnerabilities in various kernel packages of SUSE Linux Enterprise and openSUSE operating systems. These vulnerabilities can be exploited remotely, potentially leading to a denial of service (system crash) or possibly gaining privileges. The vulnerabilities are related to the eCryptfs subsystem in the Linux kernel, specifically a stack-based buffer overflow in the parse tag 11 packet function. This can be caused by crafted eCryptfs files, allowing local users to exploit the vulnerability. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** SUSE Linux Enterprise kernel-default-base (affected versions not specified) openSUSE kernel-pseries64 (affected versions not specified) openSUSE kernel-s390-debug (affected versions not specified) openSUSE kernel-smp-debuginfo (affected versions not specified) SUSE Linux Enterprise kernel-pae (affected versions not specified) SUSE Linux Enterprise kernel-default-debugsource (affected versions not specified) openSUSE kernel-pmac64 (affected versions not specified) Linux kernel versions prior to 2.6.30.4 openSUSE kexec-tools (affected versions not specified) SUSE Linux Enterprise cluster-network-kmp-pae (affected versions not specified) openSUSE appleir-kmp-debug (affected versions not specified) SUSE Linux Enterprise kernel-pae-extra (affected versions not specified) openSUSE kernel-xenpae (affected versions not specified) SUSE Linux Enterprise kernel-pae-base (affected versions not specified) openSUSE kernel-s390x (affected versions not specified) openSUSE kernel-s390x-debug (affected versions not specified) openSUSE kernel-64k-pagesize (affected versions not specified) openSUSE acx-kmp-debug (affected versions not specified) openSUSE pcc-acpi-kmp-debug (affected versions not specified) openSUSE kexec-tools-debuginfo (affected versions not specified) SUSE Linux Enterprise kernel-ec2-base (affected versions not specified) openSUSE um-host-install-initrd (affected versions not specified) openSUSE kernel-vmipae (affected versions not specified) SUSE Linux Enterprise ext4dev-kmp-default (affected versions not specified) openSUSE kernel-iseries64-debuginfo (affected versions not specified) openSUSE um-host-kernel (affected versions not specified) openSUSE kernel-smp (affected versions not specified) SUSE Linux Enterprise kernel-ec2 (affected versions not specified) SUSE Linux Enterprise ocfs2-kmp-xen (affected versions not specified) SUSE Linux Enterprise ocfs2-kmp-default (affected versions not specified) SUSE Linux Enterprise cluster-network-kmp-xen (affected versions not specified) openSUSE kernel-um (affected versions not specified) openSUSE uvcvideo-kmp-debug (affected versions not specified) SUSE Linux Enterprise ext4dev-kmp-ppc64 (affected versions not specified) openSUSE kernel-iseries64 (affected versions not specified) SUSE Linux Enterprise kernel-default-extra (affected versions not specified) openSUSE acerhk-kmp-debug (affected versions not specified) openSUSE kernel-sn2 (affected versions not specified) openSUSE kernel-s390 (affected versions not specified) SUSE Linux Enterprise kernel-xen-base (affected versions not specified) openSUSE wlan-ng-kmp-debug (affected versions not specified) SUSE Linux Enterprise kexec-tools-debuginfo (affected versions not specified) openSUSE kernel-xenpae-debuginfo (affected versions not specified) SUSE Linux Enterprise kernel-ppc64-debugsource (affected versions not specified) SUSE Linux Enterprise kernel-xen-extra (affected versions not specified) SUSE Linux Enterprise kernel-kdump-debugsource (affected versions not specified) openSUSE tpctl-kmp-debug (affected versions not specified) SUSE Linux Enterprise cluster-network-kmp-default (affected versions not specified) openSUSE gspcav-kmp-debug (affected versions not specified) openSUSE kernel-bigsmp (affected versions not specified) SUSE Linux Enterprise ocfs2-kmp-pae (affected versions not specified) openSUSE kernel-bigsmp-debuginfo (affected versions not specified) openSUSE nouveau-kmp-debug (affected versions not specified) SUSE Linux Enterprise kernel-ppc64-base (affected versions not specified) openSUSE at76 usb-kmp-debug (affected versions not specified) openSUSE atl2-kmp-debug (affected versions not specified) **Description** The issue involves multiple vulnerabilities in various kernel packages of SUSE Linux Enterprise and openSUSE operating systems. These vulnerabilities can be exploited remotely, potentially leading to a denial of service or disruption of protected information. The vulnerabilities are related to a heap-based buffer overflow in the parse tag 3 packet function in the eCryptfs subsystem of the Linux kernel. This can cause a system crash or possibly allow local users to gain privileges via crafted eCryptfs files. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.