Debian DSA-296-1 : kdebase - insecure execution

The KDE team discovered a vulnerability in the way KDE uses Ghostscript software for processing of PostScript PS and PDF files. An attacker could provide a malicious PostScript or PDF file via mail or websites that could lead to executing arbitrary commands under the privileges of the user viewin...

Debian DSA-149-1 : glibc - integer overflow

An integer overflow bug has been discovered in the RPC library used by GNU libc, which is derived from the SunRPC library. This bug could be exploited to gain unauthorized root access to software linking to this code. The packages below also fix integer overflows in the malloc code. They also...

Debian DSA-371-1 : perl - XSS

A cross-site scripting vulnerability exists in the startform function in CGI.pm. This function outputs user-controlled data into the action attribute of a form element without sanitizing it, allowing a remote user to execute arbitrary web script within the context of the generated page. Any progr...

Debian DSA-338-1 : proftpd - SQL injection

runlevel [email protected] reported that ProFTPD's PostgreSQL authentication module is vulnerable to a SQL injection attack. This vulnerability could be exploited by a remote, unauthenticated attacker to execute arbitrary SQL statements, potentially exposing the passwords of other users, or t...

Debian DSA-018-1 : tinyproxy - remote nobody exploit

PkC have found a heap overflow in tinyproxy that could be remotely exploited. An attacker could gain a shell user nobody remotely. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Security Advisory DSA-018. The...

Debian DSA-435-1 : mpg123 - heap overflow

A vulnerability was discovered in mpg123, a command-line mp3 player, whereby a response from a remote HTTP server could overflow a buffer allocated on the heap, potentially permitting execution of arbitrary code with the privileges of the user invoking mpg123. In order for this vulnerability to b...

Debian DSA-347-1 : teapop - SQL injection

teapop, a POP-3 server, includes modules for authenticating users against a PostgreSQL or MySQL database. These modules do not properly escape user-supplied strings before using them in SQL queries. This vulnerability could be exploited to execute arbitrary SQL code under the privileges of the...

Debian DSA-267-1 : lpr - buffer overflow

A buffer overflow has been discovered in lpr, a BSD lpr/lpd line printer spooling system. This problem can be exploited by a local user to gain root privileges, even if the printer system is set up properly. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package...

Debian DSA-420-1 : jitterbug - improperly sanitised input

Steve Kemp discovered a security related problem in jitterbug, a simple CGI based bug tracking and reporting tool. Unfortunately the program executions do not properly sanitize input, which allows an attacker to execute arbitrary commands on the server hosting the bug database. As mitigating...

Debian DSA-126-1 : imp - XSS

A cross-site scripting CSS problem was discovered in Horde and IMP a web-based IMAP mail package. This was fixed upstream in Horde version 1.2.8 and IMP version 2.2.8. The relevant patches have been back-ported to version 1.2.6-0.potato.5 of the horde package and version 2.2.6-0.potato.5 of the i...

Debian DSA-517-1 : cvs - buffer overflow

Derek Robert Price discovered a potential buffer overflow vulnerability in the CVS server, based on a malformed Entry, which serves the popular Concurrent Versions System. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted fr...

Debian DSA-169-1 : htcheck - XSS

Ulf Harnhammar discovered a problem in ht://Check's PHP interface. The PHP interface displays information unchecked which was gathered from crawled external web servers. This could lead into a cross site scripting attack if somebody has control over the server responses of a remote web server whi...

Debian DSA-257-1 : sendmail - remote exploit

Mark Dowd of ISS X-Force found a bug in the header parsing routines of sendmail: it could overflow a buffer overflow when encountering addresses with very long comments. Since sendmail also parses headers when forwarding emails this vulnerability can hit mail-servers which do not deliver the emai...

Debian DSA-427-1 : linux-kernel-2.4.17-mips+mipsel - missing boundary check

Paul Starzetz discovered a flaw in bounds checking in mremap in the Linux kernel present in version 2.4.x and 2.6.x which may allow a local attacker to gain root privileges. Version 2.2 is not affected by this bug. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and...

Debian DSA-259-1 : qpopper - mail user privilege escalation

Florian Heinz posted to the Bugtraq mailing list an exploit for qpopper based on a bug in the included vsnprintf implementation. The sample exploit requires a valid user account and password, and overflows a string in the popmsg function to give the user 'mail' group privileges and a shell on the...

Debian DSA-116-1 : cfs - buffer overflow

Zorgon found several buffer overflows in cfsd, a daemon that pushes encryption services into the Unixtm file system. We are not yet sure if these overflows can successfully be exploited to gain root access to the machine running the CFS daemon. However, since cfsd can easily be forced to die, a...

Debian DSA-096-2 : mutt - buffer overflow

Joost Pol found a buffer overflow in the address handling code of mutt a popular mail user agent. Even though this is a one byte overflow this is exploitable. This has been fixed upstream in version 1.2.5.1 and 1.3.25. The relevant patch has been added to version 1.2.5-5 of the Debian package...

Debian DSA-539-1 : kdelibs - temporary directory vulnerability

The SUSE security team was alerted that in some cases the integrity of symlinks used by KDE are not ensured and that these symlinks can be pointing to stale locations. This can be abused by a local attacker to create or truncate arbitrary files or to prevent KDE applications from functioning...

Debian DSA-258-1 : ethereal - format string vulnerability

Georgi Guninski discovered a problem in ethereal, a network traffic analyzer. The program contains a format string vulnerability that could probably lead to execution of arbitrary code. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin wer...

Debian DSA-251-1 : w3m - missing HTML quoting

Hironori Sakamoto, one of the w3m developers, found two security vulnerabilities in w3m and associated programs. The w3m browser does not properly escape HTML tags in frame contents and img alt attributes. A malicious HTML frame or img alt attribute may deceive a user to send their local cookies...