Debian DSA-175-1 : syslog-ng - buffer overflow

Balazs Scheidler discovered a problem in the way syslog-ng handles macro expansion. When a macro is expanded a static length buffer is used accompanied by a counter. However, when constant characters are appended, the counter is not updated properly, leading to incorrect boundary checking. An...

Debian DSA-205-1 : gtetrinet - buffer overflow

Steve Kemp and James Antill found several buffer overflows in the gtetrinet a multiplayer tetris-like game package as shipped in Debian GNU/Linux 3.0, which could be abused by a malicious server. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this...

Debian DSA-101-1 : sudo - Local root exploit

Sebastian Krahmer from SuSE found a vulnerability in sudo which could easily lead into a local root exploit. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Security Advisory DSA-101. The text itself is copyrig...

Debian DSA-198-1 : nullmailer - denial of service

A problem has been discovered in nullmailer, a simple relay-only mail transport agent for hosts that relay mail to a fixed set of smart relays. When a mail is to be delivered locally to a user that doesn't exist, nullmailer tries to deliver it, discovers a user unknown error and stops delivering...

Debian DSA-206-1 : tcpdump - denial of service

The BGP decoding routines for tcpdump used incorrect bounds checking when copying data. This could be abused by introducing malicious traffic on a sniffed network for a denial of service attack against tcpdump, or possibly even remote code execution. %NASLMINLEVEL 70300 C Tenable Network Security...

Debian DSA-183-1 : krb5 - buffer overflow

Tom Yu and Sam Hartman of MIT discovered another stack-based buffer overflow in the kadmserwrapin function in the Kerberos v4 administration server. This kadmind bug has a working exploit code circulating, hence it is considered serious. The MIT krb5 implementation includes support for version 4,...

Debian DSA-223-1 : geneweb - information exposure

A security issue has been discovered by Daniel de Rauglaudre, upstream author of geneweb, a genealogical software with web interface. It runs as a daemon on port 2317 by default. Paths are not properly sanitized, so a carefully crafted URL lead geneweb to read and display arbitrary files of the...

Debian DSA-490-1 : zope - arbitrary code execution

A vulnerability has been discovered in the index support of the ZCatalog plug-in in Zope, an open source web application server. A flaw in the security settings of ZCatalog allows anonymous users to call arbitrary methods of catalog indexes. The vulnerability also allows untrusted code to do the...

Debian DSA-169-1 : htcheck - XSS

Ulf Harnhammar discovered a problem in ht://Check's PHP interface. The PHP interface displays information unchecked which was gathered from crawled external web servers. This could lead into a cross site scripting attack if somebody has control over the server responses of a remote web server whi...

Debian DSA-203-1 : smb2www - arbitrary command execution

Robert Luberda found a security problem in smb2www, a Windows Network client that is accessible through a web browser. This could lead a remote attacker to execute arbitrary programs under the user id www-data on the host where smb2www is running. %NASLMINLEVEL 70300 C Tenable Network Security,...

Debian DSA-177-1 : pam -- serious security violation

A serious security violation in PAM was discovered. Disabled passwords i.e. those with '' in the password file were classified as empty password and access to such accounts is granted through the regular login procedure getty, telnet, ssh. This works for all such accounts whose shell field in the...

Debian DSA-159-1 : python - insecure temporary files

Zack Weinberg discovered an insecure use of a temporary file in os.execvpe from os.py. It uses a predictable name which could lead execution of arbitrary code. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian...

Debian DSA-096-2 : mutt - buffer overflow

Joost Pol found a buffer overflow in the address handling code of mutt a popular mail user agent. Even though this is a one byte overflow this is exploitable. This has been fixed upstream in version 1.2.5.1 and 1.3.25. The relevant patch has been added to version 1.2.5-5 of the Debian package...

Debian DSA-213-1 : libpng - buffer overflow

Glenn Randers-Pehrson discovered a problem in connection with 16-bit samples from libpng, an interface for reading and writing PNG Portable Network Graphics format files. The starting offsets for the loops are calculated incorrectly which causes a buffer overrun beyond the beginning of the row...

Debian DSA-386-1 : libmailtools-perl - input validation bug

The SuSE security team discovered during an audit a bug in Mail::Mailer, a Perl module used for sending email, whereby potentially untrusted input is passed to a program such as mailx, which may interpret certain escape sequences as commands to be executed. This bug has been fixed by removing...

Debian DSA-128-1 : sudo - buffer overflow

fc found a buffer overflow in the variable expansion code used by sudo for its prompt. Since sudo is necessarily installed suid root a local user can use this to gain root access. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were...

Debian DSA-220-1 : squirrelmail - XSS

A cross site scripting vulnerability has been discovered in squirrelmail, a feature-rich webmail package written in PHP4. Squirrelmail doesn't sanitize user provided variables in all places, leaving it vulnerable to a cross site scripting attack. %NASLMINLEVEL 70300 C Tenable Network Security, In...

Debian DSA-110-1 : cups - buffer overflow

The authors of CUPS, the Common UNIX Printing System, have found a potential buffer overflow bug in the code of the CUPS daemon where it reads the names of attributes. This affects all versions of CUPS. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks i...

Debian DSA-157-1 : irssi-text - denial of service

The IRC client irssi is vulnerable to a denial of service condition. The problem occurs when a user attempts to join a channel that has an overly long topic description. When a certain string is appended to the topic, irssi will crash. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

Debian DSA-216-1 : fetchmail - buffer overflow

Stefan Esser of e-matters discovered a buffer overflow in fetchmail, an SSL enabled POP3, APOP and IMAP mail gatherer/forwarder. When fetchmail retrieves a mail all headers that contain addresses are searched for local addresses. If a hostname is missing, fetchmail appends it but doesn't reserve...