medium4.6
CVE-2006-2935
The dvd_read_bca function in the DVD handling code in drivers/cdrom/cdrom.c in Linux kernel 2.2.16, and later versions, assigns the wrong value to a length var…
Impact
The dvd_read_bca function in the DVD handling code in drivers/cdrom/cdrom.c in Linux kernel 2.2.16, and later versions, assigns the wrong value to a length variable, which allows local users to execute arbitrary code via a crafted USB Storage device that triggers a buffer overflow.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Linux | Linux Kernel | from 2.2.16 through 2.16.16 |
| Debian | Debian Linux | Version 3.1 |
| Canonical | Ubuntu Linux | Versions 5.04, 5.10, 6.06 |
Weakness classification
References
- NVD record
- CVE.org record
- http://bugzilla.kernel.org/show_bug.cgi?id=2966
- http://secunia.com/advisories/21179
- http://secunia.com/advisories/21298
- http://secunia.com/advisories/21498
- http://secunia.com/advisories/21605
- http://secunia.com/advisories/21614
- http://secunia.com/advisories/21695
- http://secunia.com/advisories/21934
- http://secunia.com/advisories/22082
- http://secunia.com/advisories/22093
- http://secunia.com/advisories/22174
- http://secunia.com/advisories/22497
- http://secunia.com/advisories/22822
- http://secunia.com/advisories/23064
- http://secunia.com/advisories/23788
- http://secunia.com/advisories/24288
- http://support.avaya.com/elmodocs2/security/ASA-2006-203.htm
- http://support.avaya.com/elmodocs2/security/ASA-2006-254.htm
- http://support.avaya.com/elmodocs2/security/ASA-2007-078.htm
- http://www.debian.org/security/2006/dsa-1183
- http://www.debian.org/security/2006/dsa-1184
- http://www.mandriva.com/security/advisories?name=MDKSA-2006:150
- http://www.mandriva.com/security/advisories?name=MDKSA-2006:151
- http://www.novell.com/linux/security/advisories/2006_42_kernel.html
- http://www.novell.com/linux/security/advisories/2006_47_kernel.html