Debian DSA-347-1 : teapop - SQL injection

teapop, a POP-3 server, includes modules for authenticating users against a PostgreSQL or MySQL database. These modules do not properly escape user-supplied strings before using them in SQL queries. This vulnerability could be exploited to execute arbitrary SQL code under the privileges of the...

Debian DSA-457-1 : wu-ftpd - several vulnerabilities

Two vulnerabilities were discovered in wu-ftpd : - CAN-2004-0148 Glenn Stewart discovered that users could bypass the directory access restrictions imposed by the restricted-gid option by changing the permissions on their home directory. On a subsequent login, when access to the user's home...

Debian DSA-387-1 : gopher - buffer overflows

gopherd, a gopher server from the University of Minnesota, contains a number of buffer overflows which could be exploited by a remote attacker to execute arbitrary code with the privileges of the gopherd process the 'gopher' user by default. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. Th...

Debian DSA-116-1 : cfs - buffer overflow

Zorgon found several buffer overflows in cfsd, a daemon that pushes encryption services into the Unixtm file system. We are not yet sure if these overflows can successfully be exploited to gain root access to the machine running the CFS daemon. However, since cfsd can easily be forced to die, a...

Debian DSA-257-1 : sendmail - remote exploit

Mark Dowd of ISS X-Force found a bug in the header parsing routines of sendmail: it could overflow a buffer overflow when encountering addresses with very long comments. Since sendmail also parses headers when forwarding emails this vulnerability can hit mail-servers which do not deliver the emai...

Debian DSA-096-2 : mutt - buffer overflow

Joost Pol found a buffer overflow in the address handling code of mutt a popular mail user agent. Even though this is a one byte overflow this is exploitable. This has been fixed upstream in version 1.2.5.1 and 1.3.25. The relevant patch has been added to version 1.2.5-5 of the Debian package...

Debian DSA-273-1 : krb4 - Cryptographic weakness

A cryptographic weakness in version 4 of the Kerberos protocol allows an attacker to use a chosen-plaintext attack to impersonate any principal in a realm. Additional cryptographic weaknesses in the krb4 implementation permit the use of cut-and-paste attacks to fabricate krb4 tickets for...

Debian DSA-505-1 : cvs - heap overflow

Stefan Esser discovered a heap overflow in the CVS server, which serves the popular Concurrent Versions System. Malformed 'Entry' Lines in combination with Is-modified and Unchanged can be used to overflow malloced memory. This was proven to be exploitable. %NASLMINLEVEL 70300 C Tenable Network...

Debian DSA-159-1 : python - insecure temporary files

Zack Weinberg discovered an insecure use of a temporary file in os.execvpe from os.py. It uses a predictable name which could lead execution of arbitrary code. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian...

Debian DSA-478-1 : tcpdump - denial of service

tcpdump, a tool for network monitoring and data acquisition, was found to contain two vulnerabilities whereby tcpdump could be caused to crash through attempts to read from invalid memory locations. This bug is triggered by certain invalid ISAKMP packets. %NASLMINLEVEL 70300 C Tenable Network...

Debian DSA-050-1 : sendfile - broken privileges dropping, broken tempfile

Colin Phipps and Daniel Kobras discovered and fixed several serious bugs in the saft daemon sendfiled' which caused it to drop privileges incorrectly. Exploiting this a local user can easily make it execute arbitrary code under root privileges. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

Debian DSA-325-1 : eldav - insecure temporary file

eldav, a WebDAV client for Emacs, creates temporary files without taking appropriate security precautions. This vulnerability could be exploited by a local user to create or overwrite files with the privileges of the user running emacs and eldav. %NASLMINLEVEL 70300 C Tenable Network Security, In...

Debian DSA-277-1 : apcupsd - buffer overflows, format string

The controlling and management daemon apcupsd for APC's Unbreakable Power Supplies is vulnerable to several buffer overflows and format string attacks. These bugs can be exploited remotely by an attacker to gain root access to the machine apcupsd is running on. %NASLMINLEVEL 70300 C Tenable Netwo...

Debian DSA-139-1 : super - format string vulnerability

GOBBLES found an insecure use of format strings in the super package. The included program super is intended to provide access to certain system users for particular users and programs, similar to the program sudo. Exploiting this format string vulnerability a local user can gain unauthorized roo...

Debian DSA-326-1 : orville-write - buffer overflows

Orville Write, a replacement for the standard write1 command, contains a number of buffer overflows. These could be exploited to gain either gid tty or root privileges, depending on the configuration selected when the package is installed. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

Debian DSA-493-1 : xchat - buffer overflow

A buffer overflow has been discovered in the Socks-5 proxy code of XChat, an IRC client for X similar to AmIRC. This allows an attacker to execute arbitrary code on the users' machine. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were...

Debian DSA-248-1 : hypermail - buffer overflows

Ulf Harnhammar discovered two problems in hypermail, a program to create HTML archives of mailing lists. An attacker could craft a long filename for an attachment that would overflow two buffers when a certain option for interactive use was given, opening the possibility to inject arbitrary code...

Debian DSA-528-1 : ethereal - denial of service

Several denial of service vulnerabilities were discovered in ethereal, a network traffic analyzer. These vulnerabilities are described in the ethereal advisory 'enpa-sa-00015'. Of these, only one CAN-2004-0635 affects the version of ethereal in Debian woody. This vulnerability could be exploited ...

Debian DSA-441-1 : linux-kernel-2.4.17-mips+mipsel - missing function return value check

Paul Starzetz and Wojciech Purczynski of isec.pl discovered a critical security vulnerability in the memory management code of Linux inside the mremap2 system call. Due to missing function return value check of internal functions a local attacker can gain root privileges. %NASLMINLEVEL 70300 C...

Debian DSA-439-1 : linux-kernel-2.4.16-arm - several vulnerabilities

Several local root exploits have been discovered recently in the Linux kernel. This security advisory updates the ARM kernel for Debian GNU/Linux. The Common Vulnerabilities and Exposures project identifies the following problems that are fixed with this update : - CAN-2003-0961 : An integer...