Debian DSA-075-1 : netkit-telnet-ssl - remote exploit

The telnet daemon contained in the netkit-telnet-ssl0.16.3-1 package in the 'stable' potato distribution of Debian GNU/Linux is vulnerable to an exploitable overflow in its output handling. The original bug was found by , and announced to bugtraq on Jul 18 2001. At that time, netkit-telnet versio...

Debian DSA-437-1 : cgiemail - open mail relay

A vulnerability was discovered in cgiemail, a CGI program used to email the contents of an HTML form, whereby it could be used to send email to arbitrary addresses. This type of vulnerability is commonly exploited to send unsolicited commercial email spam. %NASLMINLEVEL 70300 C Tenable Network...

Debian DSA-512-1 : gallery - unauthenticated access

A vulnerability was discovered in gallery, a web-based photo album written in php, whereby a remote attacker could gain access to the gallery 'admin' user without proper authentication. No CVE candidate was available for this vulnerability at the time of release. %NASLMINLEVEL 70300 C Tenable...

Debian DSA-149-1 : glibc - integer overflow

An integer overflow bug has been discovered in the RPC library used by GNU libc, which is derived from the SunRPC library. This bug could be exploited to gain unauthorized root access to software linking to this code. The packages below also fix integer overflows in the malloc code. They also...

Debian DSA-247-1 : courier-ssl - missing input sanitizing

The developers of courier, an integrated user side mail server, discovered a problem in the PostgreSQL auth module. Not all potentially malicious characters were sanitized before the username was passed to the PostgreSQL engine. An attacker could inject arbitrary SQL commands and queries exploiti...

Debian DSA-521-1 : sup - format string vulnerability

discovered a format string vulnerability in sup, a set of programs to synchronize collections of files across a number of machines, whereby a remote attacker could potentially cause arbitrary code to be executed with the privileges of the supfilesrv process this process does not run automatically...

Debian DSA-387-1 : gopher - buffer overflows

gopherd, a gopher server from the University of Minnesota, contains a number of buffer overflows which could be exploited by a remote attacker to execute arbitrary code with the privileges of the gopherd process the 'gopher' user by default. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. Th...

[SECURITY] [DSA 552-1] New imlib2 packages fix potential arbitrary code execution

-------------------------------------------------------------------------- Debian Security Advisory DSA 552-1 [email protected] http://www.debian.org/security/ Martin Schulze September 22nd, 2004 http://www.debian.org/security/faq -...

[SECURITY] [DSA 548-1] New imlib packages fix arbitrary code execution

-------------------------------------------------------------------------- Debian Security Advisory DSA 548-1 [email protected] http://www.debian.org/security/ Martin Schulze September 16th, 2004 http://www.debian.org/security/faq -...

MDKSA-2004:097 - Updated cups packages fix DoS vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandrakelinux Security Update Advisory Package name: cups Advisory ID: MDKSA-2004:097 Date: September 15th, 2004 Affected versions: 10.0, 9.2, Corporate Server 2.1 Problem Description: Alvaro Martinez Echevarria discovered a vulnerability in the CUPS...

Mandrake Linux Security Advisory : squid (MDKSA-2004:093)

A vulnerability in the NTLM helpers in squid 2.5 could allow for malformed NTLMSSP packets to crash squid, resulting in a DoS. The provided packages have been patched to prevent this problem. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plug...

Mandrake Linux Security Advisory : gdk-pixbuf/gtk+2 (MDKSA-2004:095-1)

A vulnerability was found in the gdk-pixbug bmp loader where a bad BMP image could send the bmp loader into an infinite loop CVE-2004-0753. Chris Evans found a heap-based overflow and a stack-based overflow in the xpm loader of gdk-pixbuf CVE-2004-0782 and CVE-2004-0783. Chris Evans also discover...

RHEL 2.1 / 3 : imlib (RHSA-2004:465)

An updated imlib package that fixes several heap overflows is now available. Imlib is an image loading and rendering library. Several heap overflow flaws were found in the imlib BMP image handler. An attacker could create a carefully crafted BMP file in such a way that it could cause an applicati...

[SECURITY] [DSA 544-1] New webmin packages fix insecure temporary directory

-------------------------------------------------------------------------- Debian Security Advisory DSA 544-1 [email protected] http://www.debian.org/security/ Martin Schulze September 14th, 2004 http://www.debian.org/security/faq -...

RHEL 2.1 : mod_ssl (RHSA-2004:408)

An updated modssl package for Apache that fixes a format string vulnerability is now available. The modssl module provides strong cryptography for the Apache Web server via the Secure Sockets Layer SSL and Transport Layer Security TLS protocols. A format string issue was discovered in modssl for...

Mandrake Linux Security Advisory : imlib2 (MDKSA-2004:089)

Marcus Meissner discovered that the imlib and imlib2 libraries are also affected with a similar BMP-related vulnerability as the recent QT updates. The updated imlib and imlib2 packages are patched to protect against this problem. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descripti...

Fedora Core 2 : samba-3.0.6-2.fc2 (2004-285)

Tue Aug 31 2004 Jay Fenlason 3.0.6-2.fc2 - Upgrade to 3.0.6 Include the same patchset as rawhide and fc1 - Update BuildRequires Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean...

DSA-458-3 python2.2 - buffer overflow

Bulletin has no description...

[SECURITY] [DSA 542-1] New Qt packages fix arbitrary code execution and denial of service

-------------------------------------------------------------------------- Debian Security Advisory DSA 542-1 [email protected] http://www.debian.org/security/ Martin Schulze August 30th, 2004 http://www.debian.org/security/faq -...

[Full-Disclosure] SUSE Security Announcement: gaim (SUSE-SA:2004:025)

-----BEGIN PGP SIGNED MESSAGE----- SUSE Security Announcement Package: gaim Announcement-ID: SUSE-SA:2004:025 Date: Thursday, Aug 12th 2004 12:00 MEST Affected products: 9.1 Vulnerability Type: remote code execution Severity 1-10: 6 SUSE default package: No Cross References: CAN-2004-0500 Content...