Debian Security Advisory
DSA-2917-1 super -- security update
- Date Reported:
- 28 Apr 2014
- Affected Packages:
- Security database references:
- In Mitre's CVE dictionary: CVE-2014-0470.
- More information:
John Lightsey of the Debian Security Audit project discovered that the super package did not check for setuid failures, allowing local users to increase the privileges on kernel versions which do not guard against RLIMIT_NPROC attacks.
For the oldstable distribution (squeeze), this problem has been fixed in version 3.30.0-3+squeeze2.
For the stable distribution (wheezy), this problem has been fixed in version 3.30.0-6+deb7u1.
We recommend that you upgrade your super packages.