Debian DSA-496-1 : eterm - missing input sanitising

H.D. Moore discovered several terminal emulator security issues. One of them covers escape codes that are interpreted by the terminal emulator. This could be exploited by an attacker to insert malicious commands hidden for the user, who has to hit enter to continue, which would also execute the...

Debian DSA-341-1 : liece - insecure temporary file

liece, an IRC client for Emacs, does not take appropriate security precautions when creating temporary files. This bug could potentially be exploited to overwrite arbitrary files with the privileges of the user running Emacs and liece, potentially with contents supplied by the attacker...

Debian DSA-349-1 : nfs-utils - buffer overflow

The logging code in nfs-utils contains an off-by-one buffer overrun when adding a newline to the string being logged. This vulnerability may allow an attacker to execute arbitrary code or cause a denial of service condition by sending certain RPC requests. %NASLMINLEVEL 70300 C Tenable Network...

Debian DSA-231-1 : dhcp3 - stack overflows

The Internet Software Consortium discovered several vulnerabilities during an audit of the ISC DHCP Daemon. The vulnerabilities exist in error handling routines within the minires library and may be exploitable as stack overflows. This could allow a remote attacker to execute arbitrary code under...

Debian DSA-413-2 : linux-kernel-2.4.18 - missing boundary check

Paul Starzetz discovered a flaw in bounds checking in mremap in the Linux kernel present in version 2.4.x and 2.6.x which may allow a local attacker to gain root privileges. Version 2.2 is not affected by this bug, since it doesn't support the MREMAPFIXED flag as clarified later. %NASLMINLEVEL...

Debian DSA-319-1 : webmin - session ID spoofing

miniserv.pl in the webmin package does not properly handle metacharacters, such as line feeds and carriage returns, in Base64-encoded strings used in Basic authentication. This vulnerability allows remote attackers to spoof a session ID, and thereby gain root privileges. %NASLMINLEVEL 70300 C...

Debian DSA-330-1 : tcptraceroute - failure to drop root privileges

tcptraceroute is a setuid-root program which drops root privileges after obtaining a file descriptor used for raw packet capture. However, it did not fully relinquish all privileges, and in the event of an exploitable vulnerability, root privileges could be regained. No current exploit is known,...

CVE-2003-1049

IBM DB2 Universal Database 7 before FixPak 12 creates certain DMS directories with insecure permissions 777, which allows local users to modify or delete certain DB2 files...

CVE-2003-0105

ServerMask 2.2 and earlier does not obfuscate 1 ETag, 2 HTTP Status Message, or 3 Allow HTTP responses, which could tell remote attackers that the web server is an IIS server...

CVE-2003-0928

Clearswift MAILsweeper before 4.3.15 does not properly detect and filter RAR 3.20 encoded files, which allows remote attackers to bypass intended policy...

CVE-2003-0929

Clearswift MAILsweeper before 4.3.15 does not properly detect and filter ZIP 6.0 encoded files, which allows remote attackers to bypass intended policy...

CVE-2003-0930

Clearswift MAILsweeper before 4.3.15 does not properly detect filenames in BinHex HQX encoded files, which allows remote attackers to bypass intended policy...

CVE-2003-1051

Multiple format string vulnerabilities in IBM DB2 Universal Database 8.1 may allow local users to execute arbitrary code via certain command line arguments to 1 db2start, 2 db2stop, or 3 db2govd...

CVE-2003-1052

IBM DB2 7.1 and 8.1 allow the bin user to gain root privileges by modifying the shared libraries that are used in setuid root programs...

CVE-2004-0573

Buffer overflow in the converter for Microsoft WordPerfect 5.x on Office 2000, Office XP, Office 2003, and Works Suites 2001 through 2004 allows remote attackers to execute arbitrary code via a malicious document or website...

os-x/PPC reboot 28 bytes

os-x/PPC reboot 28 bytes. Shellcode exploit for osxppc platform / PPC OSX/Darwin Shellcode by B-r00t. 2003. Does sync reboot; See ASM below. 28 Bytes. / char shellcode = "\x7c\x63\x1a\x79" "\x39\x40\x01\x70" "\x38\x0a\xfe\xb4" "\x44\xff\xff\x02" "\x60\x60\x60\x60" "\x38\x0a\xfe\xc7"...

os-x/PPC Add user r00t 219 bytes

Exploit for os-x/ppc platform in category shellcode ================================ os-x/PPC Add user r00t 219 bytes ================================ / PPC OS X / Darwin Shellcode by B-r00t. 2003. open; write; close; execve; exit; See ASM below. 219 Bytes! / char shellcode =...

CVE-2003-1015

CVE-2003-1015: Affects multiple content security gateway and antivirus products. Issue: MIME messages that use whitespace in an unusual fashion may be interpreted differently by mail clients, allowing bypass of content restrictions (vulnerability in how MIME is parsed). Impact: potential bypass o...

CVE-2003-1016

Multiple content security gateway and antivirus products allow remote attackers to bypass content restrictions via MIME messages that use malformed quoting in MIME headers, parameters, and values, including 1 fields that should not be quoted, 2 duplicate quotes, or 3 missing leading or trailing...

CVE-2003-1015

Multiple content security gateway and antivirus products allow remote attackers to bypass content restrictions via MIME messages that use whitespace in an unusual fashion, which may be interpreted differently by mail clients...