Debian DSA-593-1 : imagemagick - buffer overflow

A vulnerability has been reported for ImageMagick, a commonly used image manipulation library. Due to a boundary error within the EXIF parsing routine, a specially crafted graphic image could lead to the execution of arbitrary code. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

Debian DSA-581-1 : xpdf - integer overflows

Chris Evans discovered several integer overflows in xpdf, a viewer for PDF files, which can be exploited remotely by a specially crafted PDF document and lead to the execution of arbitrary code. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this...

Debian DSA-590-1 : gnats - format string vulnerability

Khan Shirani discovered a format string vulnerability in gnats, the GNU problem report management system. This problem may be exploited to execute arbitrary code. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian...

Debian DSA-556-2 : netkit-telnet - invalid free(3)

Michal Zalewski discovered a bug in the netkit-telnet server telnetd whereby a remote attacker could cause the telnetd process to free an invalid pointer. This causes the telnet server process to crash, leading to a straightforward denial of service inetd will disable the service if telnetd is...

Debian DSA-588-1 : gzip - insecure temporary files

Trustix developers discovered insecure temporary file creation in supplemental scripts in the gzip package which may allow local users to overwrite files via a symlink attack. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracte...

Debian DSA-282-1 : glibc - integer overflow

eEye Digital Security discovered an integer overflow in the xdrmemgetbytes function which is also present in GNU libc. This function is part of the XDR external data representation encoder/decoder derived from Sun's RPC implementation. Depending upon the application, this vulnerability can cause...

Debian DSA-076-1 : most - buffer overflow

Pavel Machek has found a buffer overflow in the most' pager program. The problem is part of most's tab expansion where the program would write beyond the bounds two array variables when viewing a malicious file. This could lead into other data structures being overwritten which in turn could enab...

Debian DSA-529-1 : netkit-telnet-ssl - format string

'b0f' discovered a format string vulnerability in netkit-telnet-ssl which could potentially allow a remote attacker to cause the execution of arbitrary code with the privileges of the telnet daemon the 'telnetd' user by default. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive...

Debian DSA-424-1 : mc - buffer overflow

A vulnerability was discovered in Midnight Commander, a file manager, whereby a malicious archive such as a .tar file could cause arbitrary code to be executed if opened by Midnight Commander. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this...

Debian DSA-084-1 : gftp - Information Retrieval

Stephane Gaudreault told us that version 2.0.6a of gftp displays the password in plain text on the screen within the log window when it is logging into an ftp server. A malicious colleague who is watching the screen could gain access to the users shell on the remote machine. This problem has been...

Debian DSA-309-1 : eterm - buffer overflow

'bazarr' discovered that eterm is vulnerable to a buffer overflow of the ETERMPATH environment variable. This bug can be exploited to gain the privileges of the group 'utmp' on a system where eterm is installed. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package...

Debian DSA-305-1 : sendmail - insecure temporary files

Paul Szabo discovered bugs in three scripts included in the sendmail package where temporary files were created insecurely expn, checksendmail and doublebounce.pl. These bugs could allow an attacker to gain the privileges of a user invoking the script including root. %NASLMINLEVEL 70300 C Tenable...

Debian DSA-117-1 : cvs - improper variable initialization

Kim Nielsen recently found an internal problem with the CVS server and reported it to the vuln-dev mailing list. The problem is triggered by an improperly initialized global variable. A user exploiting this can crash the CVS server, which may be accessed through the pserver service and running...

Debian DSA-107-1 : jgroff - format print vulnerability

Basically, this is the same Security Advisory as DSA 072-1, but for jgroff instead of groff. The package jgroff contains a version derived from groff that has Japanese character sets enabled. This package is available only in the stable release of Debian, patches for Japanese support have been...

Debian DSA-497-1 : mc - several vulnerabilities

Jacub Jelinek discovered several vulnerabilities in the Midnight Commander, a powerful file manager for GNU/Linux systems. The problems were classified as follows : CAN-2004-0226 Buffer overflows CAN-2004-0231 Insecure temporary file and directory creations CAN-2004-0232 Format string problems...

Debian DSA-123-1 : listar - remote exploit

Janusz Niewiadomski and Wojciech Purczynski reported a buffer overflow in the addressmatch of listar a listserv style mailing-list manager. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Security Advisory...

Debian DSA-412-1 : nd - buffer overflows

Multiple vulnerabilities were discovered in nd, a command-line WebDAV interface, whereby long strings received from the remote server could overflow fixed-length buffers. This vulnerability could be exploited by a remote attacker in control of a malicious WebDAV server to execute arbitrary code i...

Debian DSA-400-1 : omega-rpg - buffer overflow

Steve Kemp discovered a buffer overflow in the commandline and environment variable handling of omega-rpg, a text-based rogue-style game of dungeon exploration, which could lead a local attacker to gain unauthorised access to the group games. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. T...

Debian DSA-459-1 : kdelibs - cookie path traversal

A vulnerability was discovered in KDE where the path restrictions on cookies could be bypassed using encoded relative path components e.g., '/../'. This means that a cookie which should only be sent by the browser to an application running at /app1, the browser could inadvertently include it with...

Debian DSA-444-1 : linux-kernel-2.4.17-ia64 - missing function return value check

Paul Starzetz and Wojciech Purczynski of isec.pl discovered a critical security vulnerability in the memory management code of Linux inside the mremap2 system call. Due to missing function return value check of internal functions a local attacker can gain root privileges. %NASLMINLEVEL 70300 C...