CVE-2006-2935

Published: Jul 5, 2006Modified: Apr 16, 2026

4.6

Vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Exploitability: 3.9 / Impact: 6.4

Source: NVD

Description

The dvd_read_bca function in the DVD handling code in drivers/cdrom/cdrom.c in Linux kernel 2.2.16, and later versions, assigns the wrong value to a length variable, which allows local users to execute arbitrary code via a crafted USB Storage device that triggers a buffer overflow.

Affected (5)

Products: Linux: Linux Kernel · Debian: Debian Linux · Canonical: Ubuntu Linux

1 product

1 product

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Linux Linux Kernel	From 2.2.16 to 2.16.16

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 3.1

Configuration C

3 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 5.04
Canonical Ubuntu Linux	Version 5.10
Canonical Ubuntu Linux	Version 6.06

Related CWEs

CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.

References (80)

http://bugzilla.kernel.org/show_bug.cgi?id=2966

Source: secalert@redhat.com

Issue TrackingVendor Advisory

http://secunia.com/advisories/21179

Source: secalert@redhat.com

Broken Link

http://secunia.com/advisories/21298

Source: secalert@redhat.com

Broken Link

http://secunia.com/advisories/21498

Source: secalert@redhat.com

Broken Link

http://secunia.com/advisories/21605

Source: secalert@redhat.com

Broken Link

http://secunia.com/advisories/21614

Source: secalert@redhat.com

Broken Link

http://secunia.com/advisories/21695

Source: secalert@redhat.com

Broken Link

http://secunia.com/advisories/21934

Source: secalert@redhat.com

Broken Link

http://secunia.com/advisories/22082

Source: secalert@redhat.com

Broken Link

http://secunia.com/advisories/22093

Source: secalert@redhat.com

Broken Link

http://secunia.com/advisories/22174

Source: secalert@redhat.com

Broken Link

http://secunia.com/advisories/22497

Source: secalert@redhat.com

Broken Link

http://secunia.com/advisories/22822

Source: secalert@redhat.com

Broken Link

http://secunia.com/advisories/23064

Source: secalert@redhat.com

Broken Link

http://secunia.com/advisories/23788

Source: secalert@redhat.com

Broken Link

http://secunia.com/advisories/24288

Source: secalert@redhat.com

Broken Link

http://support.avaya.com/elmodocs2/security/ASA-2006-203.htm

Source: secalert@redhat.com

Third Party Advisory

http://support.avaya.com/elmodocs2/security/ASA-2006-254.htm

Source: secalert@redhat.com

Third Party Advisory

http://support.avaya.com/elmodocs2/security/ASA-2007-078.htm

Source: secalert@redhat.com

Third Party Advisory

http://www.debian.org/security/2006/dsa-1183

Source: secalert@redhat.com

Third Party Advisory

http://www.debian.org/security/2006/dsa-1184

Source: secalert@redhat.com

Third Party Advisory

http://www.mandriva.com/security/advisories?name=MDKSA-2006:150

Source: secalert@redhat.com

Broken Link

http://www.mandriva.com/security/advisories?name=MDKSA-2006:151

Source: secalert@redhat.com

Broken Link

http://www.novell.com/linux/security/advisories/2006_42_kernel.html

Source: secalert@redhat.com

Broken Link

http://www.novell.com/linux/security/advisories/2006_47_kernel.html

Source: secalert@redhat.com

Broken Link

http://www.novell.com/linux/security/advisories/2006_49_kernel.html

Source: secalert@redhat.com

Broken Link

http://www.novell.com/linux/security/advisories/2006_64_kernel.html

Source: secalert@redhat.com

Broken Link

http://www.redhat.com/support/errata/RHSA-2006-0617.html

Source: secalert@redhat.com

Broken Link

http://www.redhat.com/support/errata/RHSA-2006-0710.html

Source: secalert@redhat.com

Broken Link

http://www.redhat.com/support/errata/RHSA-2007-0012.html

Source: secalert@redhat.com

Broken Link

http://www.redhat.com/support/errata/RHSA-2007-0013.html

Source: secalert@redhat.com

Broken Link

http://www.securityfocus.com/archive/1/444887/100/0/threaded

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

http://www.securityfocus.com/bid/18847

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

http://www.ubuntu.com/usn/usn-331-1

Source: secalert@redhat.com

Third Party Advisory

http://www.ubuntu.com/usn/usn-346-1

Source: secalert@redhat.com

Third Party Advisory

http://www.vupen.com/english/advisories/2006/2680

Source: secalert@redhat.com

Broken Link

https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=197670

Source: secalert@redhat.com

Issue TrackingThird Party Advisory

https://exchange.xforce.ibmcloud.com/vulnerabilities/27579

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

https://issues.rpath.com/browse/RPL-611

Source: secalert@redhat.com

Broken Link

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10886

Source: secalert@redhat.com

Third Party Advisory

http://bugzilla.kernel.org/show_bug.cgi?id=2966