Mandrake Linux Security Advisory : imap (MDKSA-2001:054)

Several buffer overflow vulnerabilities have been found in the UW-IMAP package by the authors and independent groups. These vulnerabilities can be exploited only once a user has authenticated which limits the extent of the vulnerability to a remote shell with that user's permissions. On systems...

SoX: Multiple buffer overflows

Background SoX is a command line utility that can convert various formats of computer audio files in to other formats. Description Ulf Harnhammar discovered two buffer overflows in the sox and play commands when handling WAV files with specially crafted header fields. Impact By enticing a user to...

libpng: Buffer overflow on row buffers

Background libpng is a standard library used to process PNG Portable Network Graphics images. It is used by several other programs, including web browsers and potentially server processes. Description Due to a wrong calculation of loop offset values, libpng contains a buffer overflow vulnerabilit...

Linux Virtual Server procfs DoS

Virtual machine users can change /proc permissions...

[Full-Disclosure] Centre 1.0 PHP injection, bypass authentication + possible SQL injection.

Summary: The Miller Group, Inc. www.miller-group.net announces the release of Centre, a free student information system for public and non-public schools. Centre is a web-based, open source, student management product with features that include scheduling, grade book, attendance, eligibility,...

tripwire: Format string vulnerability

Background tripwire is an open source file integrity checker. Description The code that generates email reports contains a format string vulnerability in pipedmailmessage.cpp. Impact With a carefully crafted filename on a local filesystem an attacker could cause execution of arbitrary code with...

Opera telnet URI handler file creation/truncation vulnerability

Background Opera is a multi-platform web browser. Description The telnet URI handler in Opera does not check for leading '-' characters in the host name. Consequently, a maliciously-crafted telnet:// link may be able to pass options to the telnet program itself. One example would be the following...

SuSEs YaST Online Update - possible symlink attack

author:l0om - l0omatexcluded.org - www.excluded.org date:05.04.2004 product:SuSE 9.0 maybe lower possible symlink attack in SuSEs YOU YaST Online Update in SuSE linux you can use YOU to auto update your system. you can do this by YaST or by hand with the command "onlineupdate". as a normal user y...

mysql -- GRANT access restriction problem

When a user is granted access to a database with a name containing an underscore and the underscore is not escaped then that user might also be able to access other, similarly named, databases on the affected system. The problem is that the underscore is seen as a wildcard by MySQL and therefore ...

ALLO ALLO WS_FTP Server

Advisory Name: ALLO ALLO WSFTP Server Impact : Arbitrary code execution as SYSTEM Discovered by: Hugh Mann [email protected] Tested progs : Ipswitch WSFTP Server 4.0.2.EVAL Description A user who can upload files, and also has a max number of files limit or max total file size limit, can read...

Microsoft MSN Messenger Information Disclosure Vulnerability

Description Microsoft MSN Messenger is prone to an information disclosure vulnerability. When a malformed file transfer request is initiated by a remote user, they may be able to view the contents of files on the remote system. Technologies Affected Microsoft MSN Messenger Service 6.0 Microsoft M...

RealPlayer 9 *nix - Local Privilege Escalation

RealPlayer 9 nix - Local Privilege Escalation / rp9-priv-esc.c A local privilege escalation attack against the community supported version of Real.com's Realplayer, version 9. Written by: Jon Hart warchild spoofed.org By default, configuration files are stored in $USER/.realnetworks/, but all the...

cscope -- symlink attack vulnerability

cscope is vulnerable to a symlink attack which could lead to an attacker overwriting arbitrary files with the permissions of the user running cscope...

CVE-2002-2401

NT Virtual DOS Machine NTVDM.EXE in Windows 2000, NT and XP does not verify user execution permissions for 16-bit executable files, which allows local users to bypass the loader and execute arbitrary programs...

CVE-2002-2027

Database of Our Owlish Wisdom DOOW 0.1 through 0.2.1 does not properly verify user permissions, which allows remote attackers to perform unauthorized activities...

[SECURITY] [DSA 161-1] New Mantis package fixes privilege escalation

-------------------------------------------------------------------------- Debian Security Advisory DSA 161-1 [email protected] http://www.debian.org/security/ Martin Schulze September 4th, 2002 http://www.debian.org/security/faq -...

[SECURITY] [DSA 154-1] New fam packages fix privilege escalation

-------------------------------------------------------------------------- Debian Security Advisory DSA 154-1 [email protected] http://www.debian.org/security/ Martin Schulze August 15th, 2002 http://www.debian.org/security/faq -...

codeblue.txt

TITLE: Pontential remote root in CodeBlue log scanner NAME: DEMI SEX GOD FROM HELL ADV 00001 DATE: YES, PLEASE MAIL ME IF YOU ARE FEMALE send pictures CRAZY TRACKING NUMBER THAT MAKES IT LOOK LIKE I HAVE SOME MASSIVE DATABASE OF JUAREZ: 7363A64B02 Props to dme@! Information ----------- you may...

[CERT-intexxia] mmftpd FTP Daemon Format String Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SECURITY ADVISORY INTEXXIAc 04 06 2002 ID 1053-040602 TITLE : mmftpd FTP Daemon Format String Vulnerability CREDITS : Guillaume Pelat / INTEXXIA SYSTEM AFFECTED =============== mmftpd = 0.0.7 DESCRIPTION =========== "mmftpd is a secure FTP server that...

FreeBSD 4.x - Process Concealment Bypass

source: https://www.securityfocus.com/bid/4768/info In FreeBSD, setting kern.psshowallprocs=0 via the sysctl call is meant to disable normal users from seeing any running processes that are not owned by them. The current implementation of this feature fails to protest system process information. ...