Debian DSA-424-1 : mc - buffer overflow

A vulnerability was discovered in Midnight Commander, a file manager, whereby a malicious archive such as a .tar file could cause arbitrary code to be executed if opened by Midnight Commander. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this...

Debian DSA-085-1 : nvi - Format string vulnerability

Takeshi Uno found a very stupid format string vulnerability in all versions of nvi in both, the plain and the multilingualized version. When a filename is saved, it ought to get displayed on the screen. The routine handling this didn't escape format strings. %NASLMINLEVEL 70300 C Tenable Network...

Debian DSA-070-1 : netkit-telnet - remote exploit

The netkit-telnet daemon contained in the telnetd package version 0.16-4potato1, which is shipped with the 'stable' 2.2, potato distribution of Debian GNU/Linux, is vulnerable to an exploitable overflow in its output handling. The original bug was found by , and announced to bugtraq on Jul 18 200...

Debian DSA-464-1 : gdk-pixbuf - broken image handling

Thomas Kristensen discovered a vulnerability in gdk-pixbuf binary package libgdk-pixbuf2, the GdkPixBuf image library for Gtk, that can cause the surrounding application to crash. To exploit this problem, a remote attacker could send a carefully-crafted BMP file via mail, which would cause e.g...

Debian DSA-285-1 : lprng - insecure temporary file

Karol Lewandowski discovered that psbanner, a printer filter that creates a PostScript format banner and is part of LPRng, insecurely creates a temporary file for debugging purpose when it is configured as filter. The program does not check whether this file already exists or is linked to another...

Debian DSA-233-1 : cvs - doubly freed memory

Stefan Esser discovered a problem in cvs, a concurrent versions system, which is used for many Free Software projects. The current version contains a flaw that can be used by a remote attacker to execute arbitrary code on the CVS server under the user id the CVS server runs as. Anonymous read-onl...

Debian DSA-375-1 : node - buffer overflow, format string

Morgan alias SM6TKY discovered and fixed several security related problems in LinuxNode, an Amateur Packet Radio Node program. The buffer overflow he discovered can be used to gain unauthorised root access and can be remotely triggered. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

Debian DSA-176-1 : gv - buffer overflow

Zen-parse discovered a buffer overflow in gv, a PostScript and PDF viewer for X11. This problem is triggered by scanning the PostScript file and can be exploited by an attacker sending a malformed PostScript or PDF file. The attacker is able to cause arbitrary code to be run with the privileges o...

Debian DSA-180-1 : nis - information leak

Thorsten Kukuck discovered a problem in the ypserv program which is part of the Network Information Services NIS. A memory leak in all versions of ypserv prior to 2.5 is remotely exploitable. When a malicious user could request a non-existing map the server will leak parts of an old domainname an...

Debian DSA-189-1 : luxman - local root exploit

iDEFENSE reported about a vulnerability in LuxMan, a maze game for GNU/Linux, similar to the PacMan arcade game. When successfully exploited a local attacker gains read-write access to the memory, leading to a local root compromise in many ways, examples of which include scanning the file for...

Debian DSA-522-1 : super - format string vulnerability

Max Vozeler discovered a format string vulnerability in super, a program to allow specified users to execute commands with root privileges. This vulnerability could potentially be exploited by a local user to execute arbitrary code with root privileges. %NASLMINLEVEL 70300 C Tenable Network...

Debian DSA-263-1 : netpbm-free - math overflow errors

Al Viro and Alan Cox discovered several maths overflow errors in NetPBM, a set of graphics conversion tools. These programs are not installed setuid root but are often installed to prepare data for processing. These vulnerabilities may allow remote attackers to cause a denial of service or execut...

Debian DSA-047-1 : kernel

The kernels used in Debian GNU/Linux 2.2 have been found to have multiple security problems. This is a list of problems based on the 2.2.19 release notes as found on http://www.linux.org.uk/ : - binfmtmisc used user pages directly - the CPIA driver had an off-by-one error in the buffer code which...

Debian DSA-526-1 : webmin - several vulnerabilities

Two vulnerabilities were discovered in webmin : CAN-2004-0582: Unknown vulnerability in Webmin 1.140 allows remote attackers to bypass access control rules and gain read access to configuration information for a module. CAN-2004-0583: The account lockout functionality in 1 Webmin 1.140 and 2...

Debian DSA-215-1 : cyrus-imapd - buffer overflow

Timo Sirainen discovered a buffer overflow in the Cyrus IMAP server, which could be exploited by a remote attacker prior to logging in. A malicious user could craft a request to run commands on the server under the UID and GID of the cyrus server. %NASLMINLEVEL 70300 C Tenable Network Security,...

Debian DSA-313-1 : ethereal - buffer overflows, integer overflows

Timo Sirainen discovered several vulnerabilities in ethereal, a network traffic analyzer. These include one-byte buffer overflows in the AIM, GIOP Gryphon, OSPF, PPTP, Quake, Quake2, Quake3, Rsync, SMB, SMPP, and TSP dissectors, and integer overflows in the Mount and PPP dissectors. %NASLMINLEVEL...

Debian DSA-132-1 : apache-ssl - remote DoS / exploit

Mark Litchfield found a denial of service attack in the Apache web-server. While investigating the problem the Apache Software Foundation discovered that the code for handling invalid requests which use chunked encoding also might allow arbitrary code execution on 64 bit architectures...

Debian DSA-444-1 : linux-kernel-2.4.17-ia64 - missing function return value check

Paul Starzetz and Wojciech Purczynski of isec.pl discovered a critical security vulnerability in the memory management code of Linux inside the mremap2 system call. Due to missing function return value check of internal functions a local attacker can gain root privileges. %NASLMINLEVEL 70300 C...

Debian DSA-049-1 : cfingerd

Megyer Laszlo report on Bugtraq that the cfingerd daemon as distributed with Debian GNU/Linux 2.2 was not careful in its logging code. By combining this with an off-by-one error in the code that copied the username from an ident response cfingerd could be exploited by a remote user. Since cfinger...

Debian DSA-015-1 : sash - broken maintainer script

Versions of the sash package prior to 3.4-4 did not clone /etc/shadow properly, causing it to be made world-readable. This package only exists in stable, so if you are running unstable you won't see a bugfix unless you use the resources from the bottom of this message to the proper configuration...