Debian DSA-375-1 : node - buffer overflow, format string

Morgan alias SM6TKY discovered and fixed several security related problems in LinuxNode, an Amateur Packet Radio Node program. The buffer overflow he discovered can be used to gain unauthorised root access and can be remotely triggered. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

Debian DSA-522-1 : super - format string vulnerability

Max Vozeler discovered a format string vulnerability in super, a program to allow specified users to execute commands with root privileges. This vulnerability could potentially be exploited by a local user to execute arbitrary code with root privileges. %NASLMINLEVEL 70300 C Tenable Network...

Debian DSA-415-1 : zebra - denial of service

Two vulnerabilities were discovered in zebra, an IP routing daemon : - CAN-2003-0795 - a bug in the telnet CLI could allow a remote attacker to cause a zebra process to crash, resulting in a denial of service. - CAN-2003-0858 - netlink messages sent by other users rather than the kernel would be...

Debian DSA-464-1 : gdk-pixbuf - broken image handling

Thomas Kristensen discovered a vulnerability in gdk-pixbuf binary package libgdk-pixbuf2, the GdkPixBuf image library for Gtk, that can cause the surrounding application to crash. To exploit this problem, a remote attacker could send a carefully-crafted BMP file via mail, which would cause e.g...

Debian DSA-119-1 : ssh -- local root exploit, remote client exploit

Joost Pol reports that OpenSSH versions 2.0 through 3.0.2 have an off-by-one bug in the channel allocation code. This vulnerability can be exploited by authenticated users to gain root privilege or by a malicious server exploiting a client with this bug. %NASLMINLEVEL 999999 @DEPRECATED@ This...

Debian DSA-490-1 : zope - arbitrary code execution

A vulnerability has been discovered in the index support of the ZCatalog plug-in in Zope, an open source web application server. A flaw in the security settings of ZCatalog allows anonymous users to call arbitrary methods of catalog indexes. The vulnerability also allows untrusted code to do the...

Debian DSA-055-1 : zope - remote unauthorized access

A new Zope hotfix has been released which fixes a problem in ZClasses. The README for the 2001-05-01 hotfix describes the problem as any user can visit a ZClass declaration and change the ZClass permission mappings for methods and other objects defined within the ZClass, possibly allowing for...

Debian DSA-198-1 : nullmailer - denial of service

A problem has been discovered in nullmailer, a simple relay-only mail transport agent for hosts that relay mail to a fixed set of smart relays. When a mail is to be delivered locally to a user that doesn't exist, nullmailer tries to deliver it, discovers a user unknown error and stops delivering...

Debian DSA-274-1 : mutt - buffer overflow

Byrial Jensen discovered a couple of off-by-one buffer overflow in the IMAP code of Mutt, a text-oriented mail reader supporting IMAP, MIME, GPG, PGP and threading. This problem could potentially allow a remote malicious IMAP server to cause a denial of service crash and possibly execute arbitrar...

Debian DSA-127-1 : xpilot-server - remote buffer overflow

An internal audit by the xpilot a multi-player tactical manoeuvring game for X maintainers revealed a buffer overflow in xpilot server. This overflow can be abused by remote attackers to gain access to the server under which the xpilot server is running. %NASLMINLEVEL 70300 C Tenable Network...

Debian DSA-071-1 : fetchmail - memory corruption

Salvatore Sanfilippo found two remotely exploitable problems infetchmail while doing a security audit. In both the IMAP code and the POP3 code, the input isn't verified even though it's used to store a number in an array. Since no bounds checking is done this can be used by an attacker to write...

Debian DSA-152-1 : l2tpd - missing random seed

Current versions of l2tpd, a layer 2 tunneling client/server program, forgot to initialize the random generator which made it vulnerable since all generated random number were 100% guessable. When dealing with the size of the value in an attribute value pair, too many bytes were able to be copied...

Debian DSA-356-1 : xtokkaetama - buffer overflows

Steve Kemp discovered two buffer overflows in xtokkaetama, a puzzle game, when processing the -display command line option and the XTOKKAETAMADIR environment variable. These vulnerabilities could be exploited by a local attacker to gain gid 'games'. %NASLMINLEVEL 70300 C Tenable Network Security,...

Debian DSA-249-1 : w3mmee - missing HTML quoting

Hironori Sakamoto, one of the w3m developers, found two security vulnerabilities in w3m and associated programs. The w3m browser does not properly escape HTML tags in frame contents and img alt attributes. A malicious HTML frame or img alt attribute may deceive a user to send their local cookies...

Debian DSA-369-1 : zblast - buffer overflow

Steve Kemp discovered a buffer overflow in zblast-svgalib, when saving the high score file. This vulnerability could be exploited by a local user to gain gid 'games', if they can achieve a high score. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in...

Debian DSA-430-1 : trr19 - missing privilege release

Steve Kemp discovered a problem in trr19, a type trainer application for GNU Emacs, which is written as a pair of setgid binaries and wrapper programs which execute commands for GNU Emacs. However, the binaries don't drop privileges before executing a command, allowing an attacker to gain access ...

Debian DSA-308-1 : gzip - insecure temporary files

Paul Szabo discovered that znew, a script included in the gzip package, creates its temporary files without taking precautions to avoid a symlink attack CAN-2003-0367. The gzexe script has a similar vulnerability which was patched in an earlier release but inadvertently reverted. %NASLMINLEVEL...

Debian DSA-300-1 : balsa - buffer overflow

Byrial Jensen discovered a couple of off-by-one buffer overflow in the IMAP code of Mutt, a text-oriented mail reader supporting IMAP, MIME, GPG, PGP and threading. This code is imported in the Balsa package. This problem could potentially allow a remote malicious IMAP server to cause a denial of...

Debian DSA-103-1 : glibc - buffer overflow

A buffer overflow has been found in the globbing code for glibc. This is the code which is used to glob patterns for filenames and is commonly used in applications like shells and FTP servers. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this...

Debian DSA-298-1 : epic4 - buffer overflows

Timo Sirainen discovered several problems in EPIC4, a popular client for Internet Relay Chat IRC. A malicious server could craft special reply strings, triggering the client to write beyond buffer boundaries. This could lead to a denial of service if the client only crashes, but may also lead to...