Debian DSA-198-1 : nullmailer - denial of service

A problem has been discovered in nullmailer, a simple relay-only mail transport agent for hosts that relay mail to a fixed set of smart relays. When a mail is to be delivered locally to a user that doesn't exist, nullmailer tries to deliver it, discovers a user unknown error and stops delivering...

Debian DSA-274-1 : mutt - buffer overflow

Byrial Jensen discovered a couple of off-by-one buffer overflow in the IMAP code of Mutt, a text-oriented mail reader supporting IMAP, MIME, GPG, PGP and threading. This problem could potentially allow a remote malicious IMAP server to cause a denial of service crash and possibly execute arbitrar...

Debian DSA-127-1 : xpilot-server - remote buffer overflow

An internal audit by the xpilot a multi-player tactical manoeuvring game for X maintainers revealed a buffer overflow in xpilot server. This overflow can be abused by remote attackers to gain access to the server under which the xpilot server is running. %NASLMINLEVEL 70300 C Tenable Network...

Debian DSA-071-1 : fetchmail - memory corruption

Salvatore Sanfilippo found two remotely exploitable problems infetchmail while doing a security audit. In both the IMAP code and the POP3 code, the input isn't verified even though it's used to store a number in an array. Since no bounds checking is done this can be used by an attacker to write...

Debian DSA-152-1 : l2tpd - missing random seed

Current versions of l2tpd, a layer 2 tunneling client/server program, forgot to initialize the random generator which made it vulnerable since all generated random number were 100% guessable. When dealing with the size of the value in an attribute value pair, too many bytes were able to be copied...

Debian DSA-356-1 : xtokkaetama - buffer overflows

Steve Kemp discovered two buffer overflows in xtokkaetama, a puzzle game, when processing the -display command line option and the XTOKKAETAMADIR environment variable. These vulnerabilities could be exploited by a local attacker to gain gid 'games'. %NASLMINLEVEL 70300 C Tenable Network Security,...

Debian DSA-249-1 : w3mmee - missing HTML quoting

Hironori Sakamoto, one of the w3m developers, found two security vulnerabilities in w3m and associated programs. The w3m browser does not properly escape HTML tags in frame contents and img alt attributes. A malicious HTML frame or img alt attribute may deceive a user to send their local cookies...

Debian DSA-369-1 : zblast - buffer overflow

Steve Kemp discovered a buffer overflow in zblast-svgalib, when saving the high score file. This vulnerability could be exploited by a local user to gain gid 'games', if they can achieve a high score. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in...

Debian DSA-430-1 : trr19 - missing privilege release

Steve Kemp discovered a problem in trr19, a type trainer application for GNU Emacs, which is written as a pair of setgid binaries and wrapper programs which execute commands for GNU Emacs. However, the binaries don't drop privileges before executing a command, allowing an attacker to gain access ...

Debian DSA-308-1 : gzip - insecure temporary files

Paul Szabo discovered that znew, a script included in the gzip package, creates its temporary files without taking precautions to avoid a symlink attack CAN-2003-0367. The gzexe script has a similar vulnerability which was patched in an earlier release but inadvertently reverted. %NASLMINLEVEL...

Debian DSA-300-1 : balsa - buffer overflow

Byrial Jensen discovered a couple of off-by-one buffer overflow in the IMAP code of Mutt, a text-oriented mail reader supporting IMAP, MIME, GPG, PGP and threading. This code is imported in the Balsa package. This problem could potentially allow a remote malicious IMAP server to cause a denial of...

Debian DSA-103-1 : glibc - buffer overflow

A buffer overflow has been found in the globbing code for glibc. This is the code which is used to glob patterns for filenames and is commonly used in applications like shells and FTP servers. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this...

Debian DSA-298-1 : epic4 - buffer overflows

Timo Sirainen discovered several problems in EPIC4, a popular client for Internet Relay Chat IRC. A malicious server could craft special reply strings, triggering the client to write beyond buffer boundaries. This could lead to a denial of service if the client only crashes, but may also lead to...

Debian DSA-429-1 : gnupg - cryptographic weakness

Phong Nguyen identified a severe bug in the way GnuPG creates and uses ElGamal keys for signing. This is a significant security failure which can lead to a compromise of almost all ElGamal keys used for signing. This update disables the use of this type of key. %NASLMINLEVEL 70300 C Tenable Netwo...

Debian DSA-371-1 : perl - XSS

A cross-site scripting vulnerability exists in the startform function in CGI.pm. This function outputs user-controlled data into the action attribute of a form element without sanitizing it, allowing a remote user to execute arbitrary web script within the context of the generated page. Any progr...

Debian DSA-206-1 : tcpdump - denial of service

The BGP decoding routines for tcpdump used incorrect bounds checking when copying data. This could be abused by introducing malicious traffic on a sniffed network for a denial of service attack against tcpdump, or possibly even remote code execution. %NASLMINLEVEL 70300 C Tenable Network Security...

Debian DSA-437-1 : cgiemail - open mail relay

A vulnerability was discovered in cgiemail, a CGI program used to email the contents of an HTML form, whereby it could be used to send email to arbitrary addresses. This type of vulnerability is commonly exploited to send unsolicited commercial email spam. %NASLMINLEVEL 70300 C Tenable Network...

Debian DSA-517-1 : cvs - buffer overflow

Derek Robert Price discovered a potential buffer overflow vulnerability in the CVS server, based on a malformed Entry, which serves the popular Concurrent Versions System. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted fr...

Debian DSA-159-1 : python - insecure temporary files

Zack Weinberg discovered an insecure use of a temporary file in os.execvpe from os.py. It uses a predictable name which could lead execution of arbitrary code. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian...

Debian DSA-505-1 : cvs - heap overflow

Stefan Esser discovered a heap overflow in the CVS server, which serves the popular Concurrent Versions System. Malformed 'Entry' Lines in combination with Is-modified and Unchanged can be used to overflow malloced memory. This was proven to be exploitable. %NASLMINLEVEL 70300 C Tenable Network...