huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2013-1480: OpenJDK: image parser insufficient raster parameter checks (AWT, 8002325)
Component: OpenJDK
Severity: Critical
Public date: 2013-02-01T00:00:00+00:00

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to AWT.  NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to "insufficient validation of raster parameters" in awt_parseImage.c, which triggers memory corruption.


Affected upstream versions: n/a
Upstream repository: https://icedtea.classpath.org/hg/release/icedtea7-forest-2.3/jdk
Upstream fix commit: 50e268c1fb1f
CVE-2013-1488: OpenJDK: JDBC driver manager improper toString calls (CanSecWest 2013, Libraries, 8009814)
Component: OpenJDK
Severity: Critical
Public date: 2013-04-16T00:00:00+00:00

The Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and OpenJDK 6 and 7, allows remote attackers to execute arbitrary code via unspecified vectors involving reflection, Libraries, "improper toString calls," and the JDBC driver manager, as demonstrated by James Forshaw during a Pwn2Own competition at CanSecWest 2013.


Affected upstream versions: n/a
Upstream repository: https://hg.openjdk.java.net/jdk7u/jdk7u-dev/jdk
Upstream fix commit: a19614a3dabb
CVE-2013-1500: OpenJDK: Insecure shared memory permissions (2D, 8001034)
Component: OpenJDK
Severity: Low
Public date: 2013-06-18T00:00:00+00:00

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows local users to affect confidentiality and integrity via unknown vectors related to 2D.  NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to weak permissions for shared memory.


Affected upstream versions: n/a
Upstream repository: https://hg.openjdk.java.net/jdk7u/jdk7u-dev/jdk
Upstream fix commit: 1111f9acb96b
CVE-2013-1518: OpenJDK: JAXP missing security restrictions (JAXP, 6657673)
Component: OpenJDK
Severity: Critical
Public date: 2013-04-16T00:00:00+00:00

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, and 5.0 Update 41 and earlier; and OpenJDK 6 and 7; allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JAXP.  NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to "missing security restrictions."


Affected upstream versions: n/a
Upstream repository: https://hg.openjdk.java.net/jdk7u/jdk7u-dev/jaxp
Upstream fix commit: 38d4d23d167c
CVE-2013-1537: OpenJDK: remote code loading enabled by default (RMI, 8001040)
Component: OpenJDK
Severity: Critical
Public date: 2013-04-16T00:00:00+00:00

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, and 5.0 Update 41 and earlier; and OpenJDK 6 and 7; allows remote attackers to affect confidentiality, integrity, and availability via vectors related to RMI.  NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to the default java.rmi.server.useCodebaseOnly setting of false, which allows remote attackers to perform "dynamic class downloading" and execute arbitrary code.


Affected upstream versions: n/a
Upstream repository: https://icedtea.classpath.org/hg/release/icedtea7-forest-2.3/jdk
Upstream fix commit: 096ed306159f
CVE-2013-1557: OpenJDK: LogStream.setDefaultStream() missing security restrictions (RMI, 8001329)
Component: OpenJDK
Severity: Critical
Public date: 2013-04-16T00:00:00+00:00

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, and 5.0 Update 41 and earlier; and OpenJDK 6 and 7; allows remote attackers to affect confidentiality, integrity, and availability via vectors related to RMI.  NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to "missing security restrictions" in the LogStream.setDefaultStream method.


Affected upstream versions: n/a
Upstream repository: https://hg.openjdk.java.net/jdk7u/jdk7u-dev/jdk
Upstream fix commit: 76eb3fb80740
CVE-2013-1569: ICU: Layout Engine font layout and glyph table errors (JDK 2D, 8004994)
Component: ICU
Severity: Critical
Public date: 2013-04-16T00:00:00+00:00

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, and 5.0 Update 41 and earlier; and OpenJDK 6 and 7; allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D.  NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to "checking of [a] glyph table" in the International Components for Unicode (ICU) Layout Engine before 51.2.


Affected upstream versions: n/a
Upstream repository: https://hg.openjdk.java.net/jdk7u/jdk7u-dev/jdk
Upstream fix commit: 6784c9903db7
CVE-2013-1571: OpenJDK: Frame injection in generated HTML (Javadoc, 8012375)
Component: OpenJDK
Severity: Moderate
Public date: 2013-06-18T00:00:00+00:00

Unspecified vulnerability in the Javadoc component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier; JavaFX 2.2.21 and earlier; and OpenJDK 7 allows remote attackers to affect integrity via unknown vectors related to Javadoc. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to frame injection in HTML that is generated by Javadoc.


Affected upstream versions: n/a
Upstream repository: https://hg.openjdk.java.net/jdk7u/jdk7u-dev/langtools
Upstream fix commit: 17ee569d0c01
CVE-2013-1591: pixman: stack-based buffer overflow
Component: pixman
Severity: Moderate
CWE: CWE-121 (Stack-based Buffer Overflow)
Public date: 2012-09-15T00:00:00+00:00

Stack-based buffer overflow in libpixman, as used in Pale Moon before 15.4 and possibly other products, has unspecified impact and context-dependent attack vectors.  NOTE: this issue might be resultant from an integer overflow in the fast_composite_scaled_bilinear function in pixman-inlines.h, which triggers an infinite loop.

Statement: This issue did not affect the versions of pixman as shipped with Red Hat Enterprise Linux 5 as it did not contain the vulnerable code.

Affected upstream versions: n/a
Upstream repository: https://cgit.freedesktop.org/pixman
Upstream fix commit: de60e2e0e3eb6084f8f14b63f25b3cbfb012943f
CVE-2013-1619: gnutls: TLS CBC padding timing attack (lucky-13)
Component: gnutls
Severity: Moderate
Public date: 2013-02-04T00:00:00+00:00

The TLS implementation in GnuTLS before 2.12.23, 3.0.x before 3.0.28, and 3.1.x before 3.1.7 does not properly consider timing side-channel attacks on a noncompliant MAC check operation during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, a related issue to CVE-2013-0169.


Affected upstream versions: n/a
Upstream repository: https://gitorious.org/gnutls/gnutls
Upstream fix commit: 328ee22c1b3951e060c7124c7cb1cee592c59bc0
CVE-2013-1643: php: Ability to read arbitrary files due use of external entities while parsing SOAP WSDL files
Component: php
Severity: Low
Public date: 2013-02-20T00:00:00+00:00

The SOAP parser in PHP before 5.3.23 and 5.4.x before 5.4.13 allows remote attackers to read arbitrary files via a SOAP WSDL file containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue in the soap_xmlParseFile and soap_xmlParseMemory functions.  NOTE: this vulnerability exists because of an incorrect fix for CVE-2013-1824.


Affected upstream versions: n/a
Fixed upstream versions: php-5.3.23
Upstream repository: https://git.php.net/php-src.git
Upstream fix commit: 8e76d0404b7f664ee6719fd98f0483f0ac4669d6
CVE-2013-1763: kernel: sock_diag: out-of-bounds access to sock_diag_handlers[]
Component: kernel
Severity: Important
CWE: CWE-787 (Out-of-bounds Write)
Public date: 2013-02-24T00:00:00+00:00

Array index error in the __sock_diag_rcv_msg function in net/core/sock_diag.c in the Linux kernel before 3.7.10 allows local users to gain privileges via a large family value in a Netlink message.

Statement: This issue did not affect the versions of the kernel package as shipped with Red Hat Enterprise Linux 5 and 6.

This issue was addressed in Red Hat Enterprise MRG 2 via RHSA-2013:0622 https://rhn.redhat.com/errata/RHSA-2013-0622.html

Affected upstream versions: n/a
Fixed upstream versions: v3.9
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 6e601a53566d84e1ffd25e7b6fe0b6894ffd79c0
CVE-2013-1767: Kernel: tmpfs: fix use-after-free of mempolicy object
Component: Kernel
Severity: Low
CWE: CWE-416 (Use After Free)
Public date: 2013-02-24T00:00:00+00:00

Use-after-free vulnerability in the shmem_remount_fs function in mm/shmem.c in the Linux kernel before 3.7.10 allows local users to gain privileges or cause a denial of service (system crash) by remounting a tmpfs filesystem without specifying a required mpol (aka mempolicy) mount option.

Statement: This issue does not affect the versions of the kernel package as shipped with Red Hat Enterprise Linux 5.

This issue affects the version of Linux kernel as shipped with Red Hat Enterprise Linux 6 and Red Hat Enterprise MRG 2.

Affected upstream versions: n/a
Fixed upstream versions: v3.9
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: 5f00110f7273f9ff04ac69a5f85bb535a4fd0987
CVE-2013-1772: kernel: call_console_drivers() function log prefix stripping DoS
Component: kernel
Severity: Low
Public date: 2013-02-22T00:00:00+00:00

The log_prefix function in kernel/printk.c in the Linux kernel 3.x before 3.4.33 does not properly remove a prefix string from a syslog header, which allows local users to cause a denial of service (buffer overflow and system crash) by leveraging /dev/kmsg write access and triggering a call_console_drivers function call.

Statement: This issue did not affect the versions of kernel package as shipped with Red Hat Enterprise Linux 5 and 6. Future kernel updates for Red Hat Enterprise MRG 2 may address this flaw.

Affected upstream versions: n/a
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: ce0030c00f95cf9110d9cdcd41e901e1fb814417
CVE-2013-1773: kernel: VFAT slab-based buffer overflow
Component: kernel
Severity: Important
Public date: 2012-12-09T00:00:00+00:00

Buffer overflow in the VFAT filesystem implementation in the Linux kernel before 3.3 allows local users to gain privileges or cause a denial of service (system crash) via a VFAT write operation on a filesystem with the utf8 mount option, which is not properly handled during UTF-8 to UTF-16 conversion.

Statement: This issue does not affect the version of Linux kernel as shipped with Red Hat Enterprise Linux 5.

This issue did affect the version of Linux kernel as shipped with Red Hat Enterprise Linux 6 and Red Hat Enterprise MRG 2.

Affected upstream versions: n/a
Fixed upstream versions: v3.3
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 0720a06a7518c9d0c0125bd5d1f3b6264c55c3dd
CVE-2013-1774: Kernel: USB io_ti driver NULL pointer dereference in routine chase_port
Component: Kernel
Severity: Low
CWE: CWE-476 (NULL Pointer Dereference)
Public date: 2013-01-18T00:00:00+00:00

The chase_port function in drivers/usb/serial/io_ti.c in the Linux kernel before 3.7.4 allows local users to cause a denial of service (NULL pointer dereference and system crash) via an attempted /dev/ttyUSB read or write operation on a disconnected Edgeport USB serial converter.

Statement: This issue does not affect the versions of the kernel package as shipped with Red Hat Enterprise Linux 5.

This issue affects the version of Linux kernel as shipped with Red Hat Enterprise Linux 6 and Red Hat Enterprise MRG 2. Future kernel updates for Red Hat Enterprise MRG 2 may address this issue.

Affected upstream versions: n/a
Fixed upstream versions: v3.8
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: 1ee0a224bc9aad1de496c795f96bc6ba2c394811
CVE-2013-1775: sudo: authentication bypass via reset system clock
Component: sudo
Severity: Low
Public date: 2013-02-27T00:00:00+00:00

sudo 1.6.0 through 1.7.10p6 and sudo 1.8.0 through 1.8.6p6 allows local users or physically proximate attackers to bypass intended time restrictions and retain privileges without re-authenticating by setting the system clock and sudo user timestamp to the epoch.


Affected upstream versions: n/a
Upstream repository: https://www.sudo.ws/repos/sudo
Upstream fix commit: ddf399e3e306
CVE-2013-1776: sudo: bypass of tty_tickets constraints
Component: sudo
Severity: Low
Public date: 2013-02-27T00:00:00+00:00

sudo 1.3.5 through 1.7.10 and 1.8.0 through 1.8.5, when the tty_tickets option is enabled, does not properly validate the controlling terminal device, which allows local users with sudo permissions to hijack the authorization of another terminal via vectors related to connecting to the standard input, output, and error file descriptors of another terminal.  NOTE: this is one of three closely-related vulnerabilities that were originally assigned CVE-2013-1776, but they have been SPLIT because of different affected versions.


Affected upstream versions: n/a
Upstream repository: https://www.sudo.ws/repos/sudo
Upstream fix commit: 6b22be4d09f0
CVE-2013-1792: Kernel: keys: race condition in install_user_keyrings()
Component: Kernel
Severity: Moderate
Public date: 2013-03-06T00:00:00+00:00

Race condition in the install_user_keyrings function in security/keys/process_keys.c in the Linux kernel before 3.8.3 allows local users to cause a denial of service (NULL pointer dereference and system crash) via crafted keyctl system calls that trigger keyring operations in simultaneous threads.

Statement: This issue does not affect the versions of the kernel package as shipped with Red Hat Enterprise Linux 5.

This issue affects the version of Linux kernel as shipped with Red Hat Enterprise Linux 6 and Red Hat Enterprise MRG 2. Future kernel updates for Red Hat Enterprise MRG 2 may address this issue.

Affected upstream versions: n/a
Fixed upstream versions: v3.9
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 0da9dfdd2cd9889201bc6f6f43580c99165cd087
CVE-2013-1796: kernel: kvm: buffer overflow in handling of MSR_KVM_SYSTEM_TIME
Component: kernel
Severity: Important
Public date: 2013-03-20T00:00:00+00:00

The kvm_set_msr_common function in arch/x86/kvm/x86.c in the Linux kernel through 3.8.4 does not ensure a required time_page alignment during an MSR_KVM_SYSTEM_TIME operation, which allows guest OS users to cause a denial of service (buffer overflow and host OS memory corruption) or possibly have unspecified other impact via a crafted application.

Statement: This issue did not affect the versions of Linux kernel as shipped with Red Hat
Enterprise Linux 5 and Red Hat Enterprise MRG as they did not provide support
for the KVM subsystem.

Affected upstream versions: n/a
Fixed upstream versions: v3.9
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: c300aa64ddf57d9c5d9c898a64b36877345dd4a9
CVE-2013-1797: kernel: kvm: after free issue with the handling of MSR_KVM_SYSTEM_TIME
Component: kernel
Severity: Important
CWE: CWE-416 (Use After Free)
Public date: 2013-03-20T00:00:00+00:00

Use-after-free vulnerability in arch/x86/kvm/x86.c in the Linux kernel through 3.8.4 allows guest OS users to cause a denial of service (host OS memory corruption) or possibly have unspecified other impact via a crafted application that triggers use of a guest physical address (GPA) in (1) movable or (2) removable memory during an MSR_KVM_SYSTEM_TIME kvm_set_msr_common operation.

Statement: This issue did not affect the versions of Linux kernel as shipped with Red Hat
Enterprise Linux 5 and Red Hat Enterprise MRG as they did not provide support
for the KVM subsystem.

Affected upstream versions: n/a
Fixed upstream versions: v3.9
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: 0b79459b482e85cb7426aa7da683a9f2c97aeae1
CVE-2013-1798: kernel: kvm: out-of-bounds access in ioapic indirect register reads
Component: kernel
Severity: Important
Public date: 2013-03-20T00:00:00+00:00

The ioapic_read_indirect function in virt/kvm/ioapic.c in the Linux kernel through 3.8.4 does not properly handle a certain combination of invalid IOAPIC_REG_SELECT and IOAPIC_REG_WINDOW operations, which allows guest OS users to obtain sensitive information from host OS memory or cause a denial of service (host OS OOPS) via a crafted application.

Statement: This issue did not affect the versions of Linux kernel as shipped with Red Hat
Enterprise Linux 5 and Red Hat Enterprise MRG as they did not provide support
for the KVM subsystem.

Affected upstream versions: n/a
Fixed upstream versions: v3.9
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: a2c118bfab8bc6b8bb213abfc35201e441693d55
CVE-2013-1808: stapler-adjunct-zeroclipboard: XSS via copying XSS payload into buffer
Component: stapler-adjunct-zeroclipboard
Severity: Moderate
CWE: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'))
Public date: 2013-02-18T00:00:00+00:00

Cross-site scripting (XSS) vulnerability in ZeroClipboard.swf and ZeroClipboard10.swf in ZeroClipboard before 1.0.8, as used in em-shorty, RepRapCalculator, Fulcrum, Django, aCMS, and other products, allows remote attackers to inject arbitrary web script or HTML via the id parameter.  NOTE: this is might be the same vulnerability as CVE-2013-1463. If so, it is likely that CVE-2013-1463 will be REJECTed.


Affected upstream versions: n/a
Fixed upstream versions: v1.0.7
Upstream repository: https://github.com/jonrohan/ZeroClipboard
Upstream fix commit: a0e02933f5f7ce5f364fbad36a005f0a349f0696
CVE-2013-1813: busybox: insecure directory permissions in /dev
Component: busybox
Severity: Low
Public date: 2013-03-01T00:00:00+00:00

util-linux/mdev.c in BusyBox before 1.21.0 uses 0777 permissions for parent directories when creating nested directories under /dev/, which allows local users to have unknown impact and attack vectors.


Affected upstream versions: n/a
Fixed upstream versions: 1_21_0
Upstream repository: https://git.busybox.net/busybox
Upstream fix commit: 4609f477c7e043a4f6147dfe6e86b775da2ef784
CVE-2013-1819: kernel: xfs: _xfs_buf_find oops on blocks beyond the filesystem end
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
Public date: 2013-01-21T00:00:00+00:00

The _xfs_buf_find function in fs/xfs/xfs_buf.c in the Linux kernel before 3.7.6 does not validate block numbers, which allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by leveraging the ability to mount an XFS filesystem containing a metadata inode with an invalid extent map.

Statement: This issue does not affect the versions of the Linux kernel as shipped with Red Hat Enterprise Linux 5.

This issue affects the version of Linux kernel as shipped with Red Hat Enterprise Linux 6 and Red Hat Enterprise MRG 2. Due to it's limited impact, this issue is not currently planned to be addressed in Red Hat Enterprise Linux 6.

Affected upstream versions: n/a
Fixed upstream versions: v3.8
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: eb178619f930fa2ba2348de332a1ff1c66a31424
CVE-2013-1826: Kernel: xfrm_user: return error pointer instead of NULL
Component: Kernel
Severity: Moderate
Public date: 2012-09-13T00:00:00+00:00

The xfrm_state_netlink function in net/xfrm/xfrm_user.c in the Linux kernel before 3.5.7 does not properly handle error conditions in dump_one_state function calls, which allows local users to gain privileges or cause a denial of service (NULL pointer dereference and system crash) by leveraging the CAP_NET_ADMIN capability.

Statement: This issue does not affect the versions of the kernel package as shipped with Red Hat Enterprise MRG 2.

This issue did affect the version of the Linux kernel as shipped with Red Hat Enterprise Linux 5 and Red Hat Enterprise Linux 6.

Affected upstream versions: n/a
Fixed upstream versions: v3.6
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 864745d291b5ba80ea0bd0edcbe67273de368836
CVE-2013-1827: Kernel: dccp: check ccid before NULL poiter dereference
Component: Kernel
Severity: Moderate
Public date: 2012-08-15T00:00:00+00:00

net/dccp/ccid.h in the Linux kernel before 3.5.4 allows local users to gain privileges or cause a denial of service (NULL pointer dereference and system crash) by leveraging the CAP_NET_ADMIN capability for a certain (1) sender or (2) receiver getsockopt call.

Statement: This issue does not affect the versions of the kernel package as shipped with Red Hat Enterprise Linux 5 and Red Hat Enterprise MRG 2.

This issue affects the version of Linux kernel as shipped with Red Hat Enterprise Linux 6.

Affected upstream versions: n/a
Fixed upstream versions: v3.6
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 276bdb82dedb290511467a5a4fdbe9f0b52dce6f
CVE-2013-1848: kernel: ext3: format string issues
Component: kernel
Severity: Low
Public date: 2013-03-18T00:00:00+00:00

fs/ext3/super.c in the Linux kernel before 3.8.4 uses incorrect arguments to functions in certain circumstances related to printk input, which allows local users to conduct format-string attacks and possibly gain privileges via a crafted application.

Statement: This issue did not affect the versions of the kernel package as shipped with Red Hat Enterprise Linux 5 because it did not backport the commit 4cf46b67eb that introduced this issue.

This issue affects the version of Linux kernel as shipped with Red Hat Enterprise Linux 6 and Red Hat Enterprise MRG 2. Future kernel updates for Red Hat Enterprise Linux 6 and Red Hat Enterprise MRG 2 may address this issue.

Affected upstream versions: n/a
Fixed upstream versions: v3.9
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 8d0c2d10dd72c5292eda7a06231056a4c972e4cc
CVE-2013-1860: kernel: usb: cdc-wdm buffer overflow triggered by device
Component: kernel
Severity: Low
Public date: 2013-03-12T00:00:00+00:00

Heap-based buffer overflow in the wdm_in_callback function in drivers/usb/class/cdc-wdm.c in the Linux kernel before 3.8.4 allows physically proximate attackers to cause a denial of service (system crash) or possibly execute arbitrary code via a crafted cdc-wdm USB device.

Statement: This issue does not affect the version of the kernel package as shipped with
Red Hat Enterprise Linux 5.

This issue affects the versions of Linux kernel as shipped with
Red Hat Enterprise Linux 6 and Red Hat Enterprise MRG 2. Future kernel updates
for Red Hat Enterprise Linux 6 and Red Hat Enterprise MRG 2 may address this
issue.

Affected upstream versions: n/a
Fixed upstream versions: v3.9
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: c0f5ecee4e741667b2493c742b60b6218d40b3aa