3467 matches found
Debian DSA-082-1 : xvt - Buffer Overflow
Christophe Bailleux reported on bugtraq that Xvt is vulnerable to a buffer overflow in its argument handling. Since Xvt is installed setuid root, it was possible for a normal user to pass carefully-crafted arguments to xvt so that xvt executed a root shell. This problem has been fixed by the...
Debian DSA-092-1 : wmtv - local root exploit
Nicolas Boullis found a nasty security problem in the wmtv a dockable video4linux TV player for windowmaker package as distributed in Debian GNU/Linux 2.2. wmtv can optionally run a command if you double-click on the TV window. This command can be specified using the -e command line option...
Debian DSA-087-1 : wu-ftpd - remote root exploit
CORE ST reports that an exploit has been found for a bug in the wu-ftpd glob code this is the code that handles filename wildcard expansion. Any logged in user including anonymous FTP users can exploit the bug to gain root privileges on the server. %NASLMINLEVEL 70300 C Tenable Network Security,...
Debian DSA-069-1 : xloadimage - buffer overflow
The version of xloadimage a graphics files viewer for X that was shipped in Debian GNU/Linux 2.2 has a buffer overflow in the code that handles FACES format images. This could be exploited by an attacker by tricking someone into viewing a specially crafted image using xloadimagewhich would allow...
Debian DSA-024-1 : cron - local insecure crontab handling
The FreeBSD team has found a bug in the way new crontabs were handled which allowed malicious users to display arbitrary crontab files on the local system. This only affects valid crontab files so it can't be used to get access to /etc/shadow or something. crontab files are not especially secure...
Debian DSA-035-1 : man2html - remote denial of service
It has been reported that one can tweak man2html remotely into consuming all available memory. This has been fixed by Nicolas Lichtmaier with help of Stephan Kulow. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debi...
Debian DSA-057-1 : gftp - printf format attack
The gftp package as distributed with Debian GNU/Linux 2.2 has a problem in its logging code: it logged data received from the network but it did not protect itself from printf format attacks. An attacker can use this by making an FTP server return special responses that exploit this. %NASLMINLEVE...
Debian DSA-052-1 : sendfile - broken dropping of privileges
Daniel Kobras has discovered and fixed a problem in sendfiled which caused the daemon not to drop privileges as expected when sending notification mails. Exploiting this, a local user can easily make it execute arbitrary code under root privileges. %NASLMINLEVEL 70300 C Tenable Network Security,...
Debian DSA-068-1 : openldap - remote DoS
The CERT advisory lists a number of vulnerabilities in various LDAP implementations, based on the results of the PROTOS LDAPv3 test suite. These tests found one problem in OpenLDAP, a free LDAP implementation which is shipped as part of Debian GNU/Linux 2.2. The problem is that slapd did not hand...
Debian DSA-072-1 : groff - printf format attack
Zenith Parse found a security problem in groff the GNU version oftroff. The pic command was vulnerable to a printf format attack which made it possible to circumvent the -S' option and execute arbitrary code. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package...
Debian DSA-064-1 : w3m - buffer overflow
SecureNet Service reported that w3m a console web browser has a buffer overflow in its MIME header parsing code. This could be exploited by an attacker if by making a web-server a user visits return carefully crafted MIME headers. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descripti...
Debian DSA-091-1 : ssh - influencing login
If the UseLogin feature is enabled in ssh local users could pass environment variables including variables like LDPRELOAD to the login process. This has been fixed by not copying the environment if UseLogin is enabled. Please note that the default configuration for Debian does not have UseLogin...
Debian DSA-038-1 : sgml-tools - insecure tempfiles
Former versions of sgml-tools created temporary files directly in /tmp in an insecure fashion. Version 1.0.9-15 and higher create a subdirectory first and open temporary files within that directory. This has been fixed in sgml-tools 1.0.9-15 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. Th...
Debian DSA-055-1 : zope - remote unauthorized access
A new Zope hotfix has been released which fixes a problem in ZClasses. The README for the 2001-05-01 hotfix describes the problem as any user can visit a ZClass declaration and change the ZClass permission mappings for methods and other objects defined within the ZClass, possibly allowing for...
Debian DSA-103-1 : glibc - buffer overflow
A buffer overflow has been found in the globbing code for glibc. This is the code which is used to glob patterns for filenames and is commonly used in applications like shells and FTP servers. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this...
Debian DSA-031-2 : sudo - buffer overflow
Todd Miller announced a new version of sudo which corrects a buffer overflow that could potentially be used to gain root privileges on the local system. The fix from sudo 1.6.3p6 is available in sudo 1.6.2p2-1potato1 for Debian 2.2 potato. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...
Debian DSA-040-1 : slrn - buffer overflow
Bill Nottingham reported a problem in the wrapping/unwrapping functions of the slrn newsreader. A long header in a message might overflow a buffer, which could result in executing arbitrary code encoded in the message. The default configuration does not have wrapping enable, but it can easily be...
Debian DSA-018-1 : tinyproxy - remote nobody exploit
PkC have found a heap overflow in tinyproxy that could be remotely exploited. An attacker could gain a shell user nobody remotely. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Security Advisory DSA-018. The...
CVE-2004-0573
CVE-2004-0573 describes a buffer overflow in the Microsoft WordPerfect 5.x Converter used by Office 2000, Office XP, Office 2003, and Works Suite 2001–2004. The overflow occurs when reading an overly long WordPerfect 5.x document, allowing a remote attacker to execute arbitrary code with the priv...
