Contents of /retired/CVE-2006-2275

Candidate: CVE-2006-2275
References: 
 http://git.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=7c3ceb4fb9667f34f1599a062efecf4cdc4a4ce5 
Description: 
 Linux SCTP (lksctp) before 2.6.17 allows remote attackers to cause a
 denial of service (deadlock) via a large number of small messages
 to a receiver application that cannot process the messages quickly
 enough, which leads to "spillover of the receive buffer."
Notes: 
 jmm> Seems like an ABI-breaker, the sctp_chunk struct is changed in the
 jmm> upstream fix, this issue alone is not worth an ABI bump, a fix will
 jmm> be postponed for now
 jmm> For Sarge we'll ignore it, as it was only available under CONFIG_EXPERIMENTAL
 jmm> and not suitable for production use anyway
Bugs: 
upstream: released (2.6.16.15)
linux-2.6: released (2.6.16-13)
2.6.8-sarge-security: ignored
2.4.27-sarge-security: ignored
2.6.18-etch-security: N/A

1	Candidate: CVE-2006-2275
2	References:
3	http://git.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=7c3ceb4fb9667f34f1599a062efecf4cdc4a4ce5
4	Description:
5	Linux SCTP (lksctp) before 2.6.17 allows remote attackers to cause a
6	denial of service (deadlock) via a large number of small messages
7	to a receiver application that cannot process the messages quickly
8	enough, which leads to "spillover of the receive buffer."
9	Notes:
10	jmm> Seems like an ABI-breaker, the sctp_chunk struct is changed in the
11	jmm> upstream fix, this issue alone is not worth an ABI bump, a fix will
12	jmm> be postponed for now
13	jmm> For Sarge we'll ignore it, as it was only available under CONFIG_EXPERIMENTAL
14	jmm> and not suitable for production use anyway
15	Bugs:
16	upstream: released (2.6.16.15)
17	linux-2.6: released (2.6.16-13)
18	2.6.8-sarge-security: ignored
19	2.4.27-sarge-security: ignored
20	2.6.18-etch-security: N/A
21