CVE-2010-4338: Improper Link Resolution Before File Access

ocrodjvu 0.4.6-1 on Debian GNU/Linux allows local users to modify arbitrary files via a symlink attack on temporary files that are generated when Cuneiform is invoked as the OCR engine...

Design/Logic Flaw

A certain Fedora patch for gif2png.c in gif2png 2.5.1 and 2.5.2, as distributed in gif2png-2.5.1-1200.fc12 on Fedora 12 and gif2png2.5.2-1 on Debian GNU/Linux, truncates a GIF pathname specified on the command line, which might allow remote attackers to create PNG files in unintended directories...

CVE-2010-4695

Removed by vendor...

CVE-2010-4695: Improper Restriction of Operations within the Bounds of a Memory Buffer

A certain Fedora patch for gif2png.c in gif2png 2.5.1 and 2.5.2, as distributed in gif2png-2.5.1-1200.fc12 on Fedora 12 and gif2png2.5.2-1 on Debian GNU/Linux, truncates a GIF pathname specified on the command line, which might allow remote attackers to create PNG files in unintended directories...

MantisBT <=1.2.3 (db_type) Cross-Site Scripting & Path Disclosure

Exploit for php platform in category web applications Vendor: MantisBT Group Product web page: http://www.mantisbt.org Version affected: 1.2.4 Summary: MantisBT is a free popular web-based bugtracking system. It is written in the PHP scripting language and works with MySQL, MS SQL, and PostgreSQL...

[SECURITY] [DSA 2132-1] New xulrunner packages fix several vulnerabilities

------------------------------------------------------------------------ Debian Security Advisory DSA-2132-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff December 11, 2010 http://www.debian.org/security/faq -...

[SECURITY] [DSA-2131-1] New exim4 packages fix remote code execution

------------------------------------------------------------------------ Debian Security Advisory DSA-2131-1 [email protected] http://www.debian.org/security/ Stefan Fritsch December 10, 2010 http://www.debian.org/security/faq -...

[SECURITY] [DSA-2125-1] New openssl packages fix buffer overflow

------------------------------------------------------------------------ Debian Security Advisory DSA-2125-1 [email protected] http://www.debian.org/security/ Stefan Fritsch November 22, 2010 http://www.debian.org/security/faq -...

GNU C library dynamic linker expands $ORIGIN in setuid library search path

Overview Certain versions of glibc unsafely handle the $ORIGIN ELF substitution sequence which can be exploited to gain local privilege escalation. Description Tavis Ormandy's advisory states:"$ORIGIN is an ELF substitution sequence representing the location of the executable being loaded in the...

Linux kernel RDS protocol vulnerability

Overview The RDS protocol implementation of Linux kernels 2.6.30 through 2.6.38-rc8 contain a local privilege escalation vulnerability. Description Kernel functions fail to properly check if a user supplied address exists in the user segment of memory. By providing a kernel address to a socket ca...

[SECURITY] [DSA-2114-1] New git-core packages fix regression

------------------------------------------------------------------------ Debian Security Advisory DSA-2114-1 [email protected] http://www.debian.org/security/ Stefan Fritsch September 26, 2010 http://www.debian.org/security/faq -...

[SECURITY] [DSA 2111-1] New squid3 packages fix denial of service

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------ Debian Security Advisory DSA-2111-1 [email protected] http://www.debian.org/security/ Steffen Joeris September 19, 2010 http://www.debian.org/security/faq -...

[SECURITY] [DSA 2111-1] New squid3 packages fix denial of service

------------------------------------------------------------------------ Debian Security Advisory DSA-2111-1 [email protected] http://www.debian.org/security/ Steffen Joeris September 19, 2010 http://www.debian.org/security/faq -...

[SECURITY] [DSA 2108-1] New cvsnt package fixes arbitrary code execution

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - - ------------------------------------------------------------------------ Debian Security Advisory DSA-2108-1 [email protected] http://www.debian.org/security/ Sebastien Delafond Sep 14, 2010 http://www.debian.org/security/faq - -...

CVE-2010-2953

Technical details about CVE-2010-2953 (affected products, root cause, and fixes) are not publicly provided in the supplied documents; monitor for updates from vendors and security advisories.

[SECURITY] [DSA 2108-1] New cvsnt package fixes arbitrary code execution

------------------------------------------------------------------------ Debian Security Advisory DSA-2108-1 [email protected] http://www.debian.org/security/ Sébastien Delafond Sep 14, 2010 http://www.debian.org/security/faq - -...

CVE-2010-2953: Undefined Security Weakness

Untrusted search path vulnerability in a certain Debian GNU/Linux patch for the couchdb script in CouchDB 0.8.0 allows local users to gain privileges via a crafted shared library in the current working directory...

[SECURITY] [DSA 2097-2] New phpmyadmin packages fix several vulnerabilities

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------ Debian Security Advisory DSA-2097-2 [email protected] http://www.debian.org/security/ Thijs Kinkhorst September 11, 2010 http://www.debian.org/security/faq -...

[SECURITY] [DSA-2104-1] New quagga packages fix denial of service

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------ Debian Security Advisory DSA-2104-1 [email protected] http://www.debian.org/security/ Florian Weimer September 06, 2010 http://www.debian.org/security/faq -...

[SECURITY] [DSA-2102-1] New barnowl packages fix arbitrary code execution

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - - ------------------------------------------------------------------------ Debian Security Advisory DSA-2102-1 [email protected] http://www.debian.org/security/ Sebastien Delafond Sep 3, 2010 http://www.debian.org/security/faq - -...