FreeBSD : perl -- vulnerabilities in PERLIO_DEBUG handling (a5eb760a-753c-11d9-a36f-000a95bc6fae)

Kevin Finisterre discovered bugs in perl's I/O debug support : - The environmental variable PERLIODEBUG is honored even by the set-user-ID perl command usually named sperl or suidperl. As a result, a local attacker may be able to gain elevated privileges. CVE-2005-0155 - A buffer overflow may occ...

FreeBSD : xli -- integer overflows in image size calculations (bfbbd505-3bd6-409c-8c67-445d3635cf4b)

Tavis Ormandy discovered several integer overflows in xli's image size handling. A maliciously crafted image may be able to cause a heap buffer overflow and execute arbitrary code. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were...

FreeBSD : xloadimage -- arbitrary command execution when handling compressed files (310d0087-0fde-4929-a41f-96f17c5adffe)

Tavis Ormandy discovered that xli and xloadimage attempt to decompress images by piping them through gunzip or similar decompression tools. Unfortunately, the unsanitized file name is included as part of the command. This is dangerous, as in some situations, such as mailcap processing, an attacke...

FreeBSD : fswiki -- XSS problem in file upload form (84479a62-ca5f-11d9-b772-000c29b00e99)

A Secunia security advisory reports : A vulnerability has been reported in FreeStyle Wiki and FSWikiLite, which can be exploited by malicious people to conduct script insertion attacks. Input passed in uploaded attachments is not properly sanitised before being used. This can be exploited to inje...

[Full-disclosure] APPLE Darwin Streaming Server Web Admin Remote Denial of Serivce

APPLE Darwin Streaming Server Web Admin Remote Denial of Serivce By Sowhat 2005.07.13 http://secway.org/Advisory/AD20050713.txt Vendor Apple Inc. Product Affected Darwin Streaming Server 5.5 and below for Win32 CVE-ID: CAN-2005-2195 OverView: Darwin Streaming Server is server technology allowing...

Slackware 10.0 / 10.1 / 8.1 / 9.0 / 9.1 / current : CVS (SSA:2005-111-01)

New CVS packages are available for Slackware 8.1, 9.0, 9.1, 10.0, 10.1, and -current to fix security issues. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Slackware Security Advisory 2005-111-01. The text itself is...

FreeBSD : jdk -- jar directory traversal vulnerability (18e5428f-ae7c-11d9-837d-000e0c2e438a)

Pluf has discovered a vulnerability in Sun Java JDK/SDK, which potentially can be exploited by malicious people to compromise a user's system. The jar tool does not check properly if the files to be extracted have the string '../' on its names, so it's possible for an attacker to create a malicio...

RHEL 2.1 / 3 : krb5 (RHSA-2005:562)

Updated krb5 packages which fix multiple security issues are now available for Red Hat Enterprise Linux 2.1 and 3. This update has been rated as having critical security impact by the Red Hat Security Response Team. Updated 26 Sep 2005 krb5-server packages have been added to this advisory for Red...

FreeBSD : ngircd -- format string vulnerability (bc4a7efa-7d9a-11d9-a9e7-0001020eed82)

A No System Group security advisory reports that ngircd is vulnerable to a format string vulnerability in the LogResolver function of log.c, if IDENT support is enabled. This could allow a remote attacker to execute arbitrary code with the permissions of the ngircd daemon, which is root by defaul...

FreeBSD : mozilla -- javascript 'lambda' replace exposes memory contents (45b75152-ae5f-11d9-a788-0001020eed82)

A Mozilla Foundation Security Advisory reports : A bug in JavaScript's regular expression string replacement when using an anonymous function as the replacement argument allows a malicious script to capture blocks of memory allocated to the browser. A web site could capture data and transmit it t...

FreeBSD : ruby -- arbitrary command execution on XMLRPC server (594eb447-e398-11d9-a8bd-000cf18bbe54)

Nobuhiro IMAI reports : the default value modification on Modulepublicinstancemethods from false to true breaks s.addhandlerXMLRPC::iPIMethods'sample', MyHandler.new style security protection. This problem could allow a remote attacker to execute arbitrary commands on XMLRPC server of libruby...

FreeBSD : kdelibs -- kimgio input validation errors (06404241-b306-11d9-a788-0001020eed82)

A KDE Security Advisory reports : kimgio contains a PCX image file format reader that does not properly perform input validation. A source code audit performed by the KDE security team discovered several vulnerabilities in the PCX and other image file format readers, some of them exploitable to...

FreeBSD : mozilla -- privilege escalation via non-DOM property overrides (a6427195-c2c7-11d9-89f7-02061b08fc24)

A Mozilla Foundation Security Advisory reports : Additional checks were added to make sure JavaScript eval and Script objects are run with the privileges of the context that created them, not the potentially elevated privilege of the context calling them in order to protect against an additional...

FreeBSD : emacs -- movemail format string vulnerability (3e3c860d-7dae-11d9-a9e7-0001020eed82)

Max Vozeler discovered several format string vulnerabilities in the movemail utility of Emacs. They can be exploited when connecting to a malicious POP server and can allow an attacker can execute arbitrary code under the privileges of the user running Emacs. %NASLMINLEVEL 70300 C Tenable Network...

WebEOC is vulnerable to a denial-of-service condition via uploading large files

Overview WebEOC does not properly impose size limits on files that a user can upload. This may allow a authorized attacker to exhaust system resources leading to a denial-of-service condition. Description WebEOC is a web-based crisis information management application that provides functions to...

Debian DSA-755-1 : tiff - buffer overflow

Frank Warmerdam discovered a stack-based buffer overflow in libtiff, the Tag Image File Format library for processing TIFF graphics files that can lead to the execution of arbitrary code via malformed TIFF files. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and packag...

FreeBSD : xshisen -- local buffer overflows (56971fa6-641c-11d9-a097-000854d03344)

Steve Kemp has found buffer overflows in the handling of the command line flag -KCONV and the XSHISENLIB environment variable. Ulf Harnhammer has detected an unbounded copy from the GECOS field to a char array. All overflows can be exploited to gain group games privileges. %NASLMINLEVEL 70300 C...

WebEOC is vulnerable to cross-site scripting attacks

Overview WebEOC contains multiple cross-site scripting vulnerabilities that may allow a remote attacker to inject and execute arbitrary script using a vulnerable WebEOC site. Description WebEOC is a web-based crisis information management application that provides functions to gather, coordinate,...

krb5 security update

CentOS Errata and Security Advisory CESA-2005:562 Updated krb5 packages which fix multiple security issues are now available for Red Hat Enterprise Linux 2.1 and 3. This update has been rated as having critical security impact by the Red Hat Security Response Team. Updated 26 Sep 2005 krb5-server...

[SECURITY] [DSA 753-1] New gedit packages fix denial of service

-------------------------------------------------------------------------- Debian Security Advisory DSA 753-1 [email protected] http://www.debian.org/security/ Martin Schulze July 12th, 2005 http://www.debian.org/security/faq -...