195 matches found
[SECURITY] [DSA 728-1] New qpopper packages fix arbitrary file overwriting
-------------------------------------------------------------------------- Debian Security Advisory DSA 728-1 [email protected] http://www.debian.org/security/ Martin Schulze May 25th, 2005 http://www.debian.org/security/faq -...
CVE-2005-1152
popauth.c in qpopper 4.0.5 and earlier does not properly set the umask, which may cause qpopper to create files with group or world-writable permissions...
CVE-2005-1152
CVE-2005-1152 affects qpopper 4.0.5 and earlier. The root cause is popauth.c not setting the umask, which may cause files to be created with group- or world-writable permissions. The provided references align with a low-severity issue (CVSS v2 base score 2.1). No patched version or remediation de...
CVE-2005-1151
qpopper 4.0.5 and earlier does not properly drop privileges before processing certain user-supplied files, which allows local users to overwrite or create arbitrary files as root...
CVE-2005-1151
qpopper 4.0.5 and earlier does not properly drop privileges before processing certain user-supplied files, which allows local users to overwrite or create arbitrary files as root...
CVE-2005-1152
popauth.c in qpopper 4.0.5 and earlier does not properly set the umask, which may cause qpopper to create files with group or world-writable permissions...
CVE-2005-1151
qpopper 4.0.5 and earlier does not properly drop privileges before processing certain user-supplied files, which allows local users to overwrite or create arbitrary files as root...
CVE-2005-1152
popauth.c in qpopper 4.0.5 and earlier does not properly set the umask, which may cause qpopper to create files with group or world-writable permissions...
CVE-2005-1151
CVE-2005-1151 affects qpopper 4.0.5 and earlier. The vulnerability arises because the process does not drop privileges before processing certain user-supplied files, allowing local users to overwrite or create arbitrary files with root privileges. Open vulnerability references show advisories acr...
DSA-728-1 qpopper - missing privilege release
Bulletin has no description...
[Full-disclosure] [ GLSA 200505-17 ] Qpopper: Multiple Vulnerabilities
Gentoo Linux Security Advisory GLSA 200505-17 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity:...
Multiple Qualcomm qpopper POP3 server vulnerabilities
Elevated privileges are not dropped during file access, directory traversal...
Qpopper < 4.0.6 Multiple Insecure File Handling Local Privilege Escalation
According to its banner, the remote host is running a version of the Qpopper POP3 server that suffers from two local, insecure file handling vulnerabilities. First, it fails to properly drop root privileges when processing certain local files, which could lead to overwriting or creation of...
Qualcomm Qpopper < 4.0.5 Multiple Local Privilege Escalation
Binary data 2935.prm...
Qpopper: Multiple Vulnerabilities
Background Qpopper is a widely used server for the POP3 protocol. Description Jens Steube discovered that Qpopper doesn't drop privileges to process local files from normal users CAN-2005-1151. The upstream developers discovered that Qpopper can be forced to create group or world writeable files...
Debian DSA-259-1 : qpopper - mail user privilege escalation
Florian Heinz posted to the Bugtraq mailing list an exploit for qpopper based on a bug in the included vsnprintf implementation. The sample exploit requires a valid user account and password, and overflows a string in the popmsg function to give the user 'mail' group privileges and a shell on the...
CVE-2003-0143
The popmsg function in qpopper 4.0.x before 4.0.5fc2 does not null terminate a message buffer after a call to Qvsnprintf, which could allow authenticated users to execute arbitrary code via a buffer overflow in a mdef command with a long macro name...
CVE-2003-0143
CVE-2003-0143 affects qpopper 4.0.x prior to 4.0.5fc2. The pop_msg function fails to null-terminate the message buffer after Qvsnprintf, enabling an authenticated user to trigger a buffer overflow in a mdef command with a long macro name and execute arbitrary code. The CVE is associated with remo...