Debian DSA-035-1 : man2html - remote denial of service

It has been reported that one can tweak man2html remotely into consuming all available memory. This has been fixed by Nicolas Lichtmaier with help of Stephan Kulow. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debi...

Debian DSA-220-1 : squirrelmail - XSS

A cross site scripting vulnerability has been discovered in squirrelmail, a feature-rich webmail package written in PHP4. Squirrelmail doesn't sanitize user provided variables in all places, leaving it vulnerable to a cross site scripting attack. %NASLMINLEVEL 70300 C Tenable Network Security, In...

RHEL 2.1 : mc (RHSA-2004:464)

An updated mc package that resolves several shell escape security issues is now available. Updated 5 January 2005 Packages have been updated to include the gmc and mcserv packages which were left out of the initial errata. Midnight Commander mc is a visual shell much like a file manager. Shell...

RHEL 2.1 / 3 : rsync (RHSA-2004:436)

An updated rsync package that fixes a path sanitizing bug is now available. The rsync program synchronizes files over a network. Versions of rsync up to and including version 2.6.2 contain a path sanitization issue. This issue could allow an attacker to read or write files outside of the rsync...

Fedora Core 1 : cvs-1.11.17-1 (2004-169)

While investigating a previously fixed vulnerability, Derek Price discovered a flaw relating to malformed 'Entry' lines which lead to a missing NULL terminator. The Common Vulnerabilities and Exposures project cve.mitre.org has assigned the name CVE-2004-0414 to this issue. Stefan Esser and...

cvs security update

CVS is a client/server version control system. As a server, it is used to host source code repositories. As a client, it is used to access such repositories. This advisory affects both uses of CVS. A security problem which could allow a server to create arbitrary files on a client machine, and...

Multiple Vulnerabilities in pwlib

Background pwlib is a multi-platform library designed for OpenH323. Description Multiple vulnerabilities have been found in the implimentation of protocol H.323 contained in pwlib. Most of the vulnerabilies are in the parsing of ASN.1 elements which would allow an attacker to use a maliciously...

Buffer overflow in Midnight Commander

Background Midnight Commander is a visual file manager. Description A stack-based buffer overflow has been found in Midnight Commander's virtual filesystem. Impact This overflow allows an attacker to run arbitrary code on the user's computer during the symlink conversion process. Workaround While...

DSA-404 rsync - heap overflow

Bulletin has no description...

DSA-277 apcupsd - buffer overflows, format string

Bulletin has no description...

DSA-164 cacti - arbitrary code execution

Bulletin has no description...

[SECURITY] [DSA-092-1] local root in wmtv

Package : wmtv Problem type : local root exploit Debian-specific: no Nicolas Boullis found a nasty security problem in the wmtv a dockable video4linux tv player for windowmaker package as distributed in Debian GNU/Linux 2.2. wmtv can optionally run a command if you double-click on the tv window...

Perl root exploit in Slackware 7.1 & -current

A root exploit was found in the /usr/bin/suidperl5.6.0 program that shipped with the Slackware 7.1 perl.tgz package. It is recommended that all users of Slackware 7.1 and -current upgrade to the perl.tgz package available in the Slackware -current branch. ==================================== perl...

WSUS 3.0 SP2 Applicable Platform Detectoid

This detectoid will evaluate to TRUE only if there is a previous WSUS version on the machine and it is on WSUS 3 SP2 supported platforms. WSUS 3 SP2 upgrade package uses this detectoid as pre-req...

Windows Server Update Services (WSUS) 3.0 SP2 Server Hotfix Applicable Platform Detectoid

This detectoid will evaluate to TRUE only if there is a previous WSUS version on the machine and it is on WSUS 3 SP2 supported platforms. WSUS 3 SP2 upgrade package uses this detectoid as pre-req...