[ALAS-2014-368] Amazon Linux AMI 2012.09 - ALAS-2014-368: medium priority package update for kernel

Package updates are available for Amazon Linux AMI that fix the following vulnerabilities:
CVE-2014-4608:
1113899:
CVE-2014-4608 kernel: lzo1x_decompress_safe() integer overflow
** DISPUTED ** Multiple integer overflows in the lzo1x_decompress_safe function in lib/lzo/lzo1x_decompress_safe.c in the LZO decompressor in the Linux kernel before 3.15.2 allow context-dependent attackers to cause a denial of service (memory corruption) via a crafted Literal Run. NOTE: the author of the LZO algorithms says "the Linux kernel is not affected; media hype."

CVE-2014-4508:
arch/x86/kernel/entry_32.S in the Linux kernel through 3.15.1 on 32-bit x86 platforms, when syscall auditing is enabled and the sep CPU feature flag is set, allows local users to cause a denial of service (OOPS and system crash) via an invalid syscall number, as demonstrated by number 1000.
1111590:
CVE-2014-4508 Kernel: x86_32: BUG in syscall auditing

CVE-2014-4014:
The capabilities implementation in the Linux kernel before 3.14.8 does not properly consider that namespaces are inapplicable to inodes, which allows local users to bypass intended chmod restrictions by first creating a user namespace, as demonstrated by setting the setgid bit on a file with group ownership of root.
1107966:
CVE-2014-4014 Kernel: possible privilege escalation in user namespace

CVE-2014-0206:
Array index error in the aio_read_events_ring function in fs/aio.c in the Linux kernel through 3.15.1 allows local users to obtain sensitive information from kernel memory via a large head value.
1094602:
CVE-2014-0206 kernel: aio: insufficient sanitization of head in aio_read_events_ring()