Debian DSA-305-1 : sendmail - insecure temporary files

Paul Szabo discovered bugs in three scripts included in the sendmail package where temporary files were created insecurely expn, checksendmail and doublebounce.pl. These bugs could allow an attacker to gain the privileges of a user invoking the script including root. %NASLMINLEVEL 70300 C Tenable...

Debian DSA-309-1 : eterm - buffer overflow

'bazarr' discovered that eterm is vulnerable to a buffer overflow of the ETERMPATH environment variable. This bug can be exploited to gain the privileges of the group 'utmp' on a system where eterm is installed. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package...

Debian DSA-285-1 : lprng - insecure temporary file

Karol Lewandowski discovered that psbanner, a printer filter that creates a PostScript format banner and is part of LPRng, insecurely creates a temporary file for debugging purpose when it is configured as filter. The program does not check whether this file already exists or is linked to another...

Debian DSA-270-1 : linux-kernel-mips - local privilege escalation

The kernel module loader in Linux 2.2 and Linux 2.4 kernels has a flaw in ptrace. This hole allows local users to obtain root privileges by using ptrace to attach to a child process that is spawned by the kernel. Remote exploitation of this hole is not possible. This advisory only covers kernel...

Debian DSA-318-1 : lyskom-server - denial of service

Calle Dybedahl discovered a bug in lyskom-server which could result in a denial of service where an unauthenticated user could cause the server to become unresponsive as it processes a large query. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in thi...

Debian DSA-402-1 : minimalist - unsanitised input

A security-related problem has been discovered in minimalist, a mailing list manager, which allows a remote attacker to execute arbitrary commands. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Security...

Debian DSA-459-1 : kdelibs - cookie path traversal

A vulnerability was discovered in KDE where the path restrictions on cookies could be bypassed using encoded relative path components e.g., '/../'. This means that a cookie which should only be sent by the browser to an application running at /app1, the browser could inadvertently include it with...

Debian DSA-352-1 : fdclone - insecure temporary directory

fdclone creates a temporary directory in /tmp as a workspace. However, if this directory already exists, the existing directory is used instead, regardless of its ownership or permissions. This would allow an attacker to gain access to fdclone's temporary files and their contents, or replace them...

Debian DSA-253-1 : openssl - information leak

A vulnerability has been discovered in OpenSSL, a Secure Socket Layer SSL implementation. In an upcoming paper, Brice Canvel EPFL, Alain Hiltgen UBS, Serge Vaudenay EPFL, and Martin Vuagnoux EPFL, Ilion describe and demonstrate a timing-based attack on CBC cipher suites used in SSL and TLS. OpenS...

Debian DSA-368-1 : xpcd - buffer overflow

Steve Kemp discovered a buffer overflow in xpcd-svga which can be triggered by a long HOME environment variable. This vulnerability could be exploited by a local attacker to gain root privileges. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this...

Debian DSA-429-1 : gnupg - cryptographic weakness

Phong Nguyen identified a severe bug in the way GnuPG creates and uses ElGamal keys for signing. This is a significant security failure which can lead to a compromise of almost all ElGamal keys used for signing. This update disables the use of this type of key. %NASLMINLEVEL 70300 C Tenable Netwo...

Debian DSA-317-1 : cupsys - denial of service

The CUPS print server in Debian is vulnerable to a denial of service when an HTTP request is received without being properly terminated. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Security Advisory DSA-317...

Debian DSA-376-2 : exim - buffer overflow

A buffer overflow exists in exim, which is the standard mail transport agent in Debian. By supplying a specially crafted HELO or EHLO command, an attacker could cause a constant string to be written past the end of a buffer allocated on the heap. This vulnerability is not believed at this time to...

Debian DSA-373-1 : autorespond - buffer overflow

Christian Jaeger discovered a buffer overflow in autorespond, an email autoresponder used with qmail. This vulnerability could potentially be exploited by a remote attacker to gain the privileges of a user who has configured qmail to forward messages to autorespond. This vulnerability is currentl...

Debian DSA-362-1 : mindi - insecure temporary file

mindi, a program for creating boot/root disks, does not take appropriate security precautions when creating temporary files. This bug could potentially be exploited to overwrite arbitrary files with the privileges of the user running mindi. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

Debian DSA-350-1 : falconseye - buffer overflow

The falconseye package is vulnerable to a buffer overflow exploited via a long -s command line option. This vulnerability could be used by an attacker to gain gid 'games' on a system where falconseye is installed. Note that falconseye does not contain the file permission error CAN-2003-0359 which...

Debian DSA-278-1 : sendmail - char-to-int conversion

Michal Zalewski discovered a buffer overflow, triggered by a char to int conversion, in the address parsing code in sendmail, a widely used powerful, efficient, and scalable mail transport agent. This problem is potentially remotely exploitable. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

Debian DSA-374-1 : libpam-smb - buffer overflow

libpam-smb is a PAM authentication module which makes it possible to authenticate users against a password database managed by Samba or a Microsoft Windows server. If a long password is supplied, this can cause a buffer overflow which could be exploited to execute arbitrary code with the privileg...

Debian DSA-258-1 : ethereal - format string vulnerability

Georgi Guninski discovered a problem in ethereal, a network traffic analyzer. The program contains a format string vulnerability that could probably lead to execution of arbitrary code. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin wer...

Debian DSA-409-1 : bind - denial of service

A vulnerability was discovered in BIND, a domain name server, whereby a malicious name server could return authoritative negative responses with a large TTL time-to-live value, thereby rendering a domain name unreachable. A successful attack would require that a vulnerable BIND instance submit a...