Debian DSA-070-1 : netkit-telnet - remote exploit

The netkit-telnet daemon contained in the telnetd package version 0.16-4potato1, which is shipped with the 'stable' 2.2, potato distribution of Debian GNU/Linux, is vulnerable to an exploitable overflow in its output handling. The original bug was found by , and announced to bugtraq on Jul 18 200...

Debian DSA-085-1 : nvi - Format string vulnerability

Takeshi Uno found a very stupid format string vulnerability in all versions of nvi in both, the plain and the multilingualized version. When a filename is saved, it ought to get displayed on the screen. The routine handling this didn't escape format strings. %NASLMINLEVEL 70300 C Tenable Network...

Debian DSA-189-1 : luxman - local root exploit

iDEFENSE reported about a vulnerability in LuxMan, a maze game for GNU/Linux, similar to the PacMan arcade game. When successfully exploited a local attacker gains read-write access to the memory, leading to a local root compromise in many ways, examples of which include scanning the file for...

Debian DSA-180-1 : nis - information leak

Thorsten Kukuck discovered a problem in the ypserv program which is part of the Network Information Services NIS. A memory leak in all versions of ypserv prior to 2.5 is remotely exploitable. When a malicious user could request a non-existing map the server will leak parts of an old domainname an...

Debian DSA-253-1 : openssl - information leak

A vulnerability has been discovered in OpenSSL, a Secure Socket Layer SSL implementation. In an upcoming paper, Brice Canvel EPFL, Alain Hiltgen UBS, Serge Vaudenay EPFL, and Martin Vuagnoux EPFL, Ilion describe and demonstrate a timing-based attack on CBC cipher suites used in SSL and TLS. OpenS...

Debian DSA-176-1 : gv - buffer overflow

Zen-parse discovered a buffer overflow in gv, a PostScript and PDF viewer for X11. This problem is triggered by scanning the PostScript file and can be exploited by an attacker sending a malformed PostScript or PDF file. The attacker is able to cause arbitrary code to be run with the privileges o...

Debian DSA-343-1 : skk, ddskk - insecure temporary file

skk Simple Kana to Kanji conversion program, does not take appropriate security precautions when creating temporary files. This bug could potentially be exploited to overwrite arbitrary files with the privileges of the user running Emacs and skk. ddskk is derived from the same code, and contains...

Debian DSA-323-1 : noweb - insecure temporary files

Jakob Lell discovered a bug in the 'noroff' script included in noweb whereby a temporary file was created insecurely. During a review, several other instances of this problem were found and fixed. Any of these bugs could be exploited by a local user to overwrite arbitrary files owned by the user...

Debian DSA-534-1 : mailreader - directory traversal

A directory traversal vulnerability was discovered in mailreader whereby remote attackers could view arbitrary files with the privileges of the nph-mr.cgi process by default, www-data via relative paths and a null byte in the configLanguage parameter. %NASLMINLEVEL 70300 C Tenable Network Securit...

Debian DSA-061-1 : gnupg - printf format attack

The version of GnuPG GNU Privacy Guard, an OpenPGP implementation as distributed in Debian GNU/Linux 2.2 suffers from two problems : - fish stiqz reported on bugtraq that there was a printf format problem in the doget function: it printed a prompt which included the filename that was being...

Debian DSA-397-1 : postgresql - buffer overflow

Tom Lane discovered a buffer overflow in the toascii function in PostgreSQL. This allows remote attackers to execute arbitrary code on the host running the database. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from...

Debian DSA-036-1 : Midnight Commander - arbitrary program execution

It has been reported that a local user could tweak Midnight Commander of another user into executing an arbitrary program under the user id of the person running Midnight Commander. This behaviour has been fixed by Andrew V. Samoilov. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

Debian DSA-250-1 : w3mmee-ssl - missing HTML quoting

Hironori Sakamoto, one of the w3m developers, found two security vulnerabilities in w3m and associated programs. The w3m browser does not properly escape HTML tags in frame contents and img alt attributes. A malicious HTML frame or img alt attribute may deceive a user to send their local cookies...

Debian DSA-037-1 : Athena Widget replacement libraries - insecure tempfile handling

It has been reported that the AsciiSrc and MultiSrc widget in the Athena widget library handle temporary files insecurely. Joey Hess has ported the bugfix from XFree86 to these Xaw replacements libraries. The fixes are available in nextaw 0.5.1-34potato1, xaw3d 1.3-6.9potato1, and xaw95...

Debian DSA-252-1 : slocate - buffer overflow

A problem has been discovered in slocate, a secure locate replacement. A buffer overflow in the setgid program slocate can be used to execute arbitrary code as group slocate. This can be used to alter the slocate database. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text...

Debian DSA-149-1 : glibc - integer overflow

An integer overflow bug has been discovered in the RPC library used by GNU libc, which is derived from the SunRPC library. This bug could be exploited to gain unauthorized root access to software linking to this code. The packages below also fix integer overflows in the malloc code. They also...

Debian DSA-438-1 : linux-kernel-2.4.18-alpha+i386+powerpc - missing function return value check

Paul Starzetz and Wojciech Purczynski of isec.pl discovered a critical security vulnerability in the memory management code of Linux inside the mremap2 system call. Due to missing function return value check of internal functions a local attacker can gain root privileges. %NASLMINLEVEL 70300 C...

Debian DSA-427-1 : linux-kernel-2.4.17-mips+mipsel - missing boundary check

Paul Starzetz discovered a flaw in bounds checking in mremap in the Linux kernel present in version 2.4.x and 2.6.x which may allow a local attacker to gain root privileges. Version 2.2 is not affected by this bug. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and...

Debian DSA-271-1 : ecartis - unauthorized password change

A problem has been discovered in ecartis, a mailing list manager, formerly known as listar. This vulnerability enables an attacker to reset the password of any user defined on the list server, including the list admins. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and...

Debian DSA-263-1 : netpbm-free - math overflow errors

Al Viro and Alan Cox discovered several maths overflow errors in NetPBM, a set of graphics conversion tools. These programs are not installed setuid root but are often installed to prepare data for processing. These vulnerabilities may allow remote attackers to cause a denial of service or execut...