Debian DSA-375-1 : node - buffer overflow, format string

Morgan alias SM6TKY discovered and fixed several security related problems in LinuxNode, an Amateur Packet Radio Node program. The buffer overflow he discovered can be used to gain unauthorised root access and can be remotely triggered. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

Debian DSA-036-1 : Midnight Commander - arbitrary program execution

It has been reported that a local user could tweak Midnight Commander of another user into executing an arbitrary program under the user id of the person running Midnight Commander. This behaviour has been fixed by Andrew V. Samoilov. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

Debian DSA-397-1 : postgresql - buffer overflow

Tom Lane discovered a buffer overflow in the toascii function in PostgreSQL. This allows remote attackers to execute arbitrary code on the host running the database. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from...

Debian DSA-534-1 : mailreader - directory traversal

A directory traversal vulnerability was discovered in mailreader whereby remote attackers could view arbitrary files with the privileges of the nph-mr.cgi process by default, www-data via relative paths and a null byte in the configLanguage parameter. %NASLMINLEVEL 70300 C Tenable Network Securit...

Debian DSA-210-1 : lynx - CRLF injection

lynx a text-only web browser did not properly check for illegal characters in all places, including processing of command line options, which could be used to insert extra HTTP headers in a request. For Debian GNU/Linux 2.2/potato this has been fixed in version 2.8.3-1.1 of the lynx package and...

Debian DSA-271-1 : ecartis - unauthorized password change

A problem has been discovered in ecartis, a mailing list manager, formerly known as listar. This vulnerability enables an attacker to reset the password of any user defined on the list server, including the list admins. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and...

Debian DSA-244-1 : noffle - buffer overflows

Dan Jacobson noticed a problem in noffle, an offline news server, that leads to a segmentation fault. It is not yet clear whether this problem is exploitable. However, if it is, a remote attacker could trigger arbitrary code execution under the user that calls noffle, probably news. %NASLMINLEVEL...

Debian DSA-261-1 : tcpdump - infinite loop

A problem has been discovered in tcpdump, a powerful tool for network monitoring and data acquisition. An attacker is able to send a specially crafted RADIUS network packet which causes tcpdump to enter an infinite loop. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text an...

Debian DSA-087-1 : wu-ftpd - remote root exploit

CORE ST reports that an exploit has been found for a bug in the wu-ftpd glob code this is the code that handles filename wildcard expansion. Any logged in user including anonymous FTP users can exploit the bug to gain root privileges on the server. %NASLMINLEVEL 70300 C Tenable Network Security,...

Debian DSA-149-1 : glibc - integer overflow

An integer overflow bug has been discovered in the RPC library used by GNU libc, which is derived from the SunRPC library. This bug could be exploited to gain unauthorized root access to software linking to this code. The packages below also fix integer overflows in the malloc code. They also...

Debian DSA-462-1 : xitalk - missing privilege release

Steve Kemp from the Debian Security Audit Project discovered a problem in xitalk, a talk intercept utility for the X Window System. A local user can exploit this problem and execute arbitrary commands under the GID utmp. This could be used by an attacker to remove traces from the utmp file...

Debian DSA-431-1 : perl - information leak

Paul Szabo discovered a number of similar bugs in suidperl, a helper program to run perl scripts with setuid privileges. By exploiting these bugs, an attacker could abuse suidperl to discover information about files such as testing for their existence and some of their permissions that should not...

Debian DSA-444-1 : linux-kernel-2.4.17-ia64 - missing function return value check

Paul Starzetz and Wojciech Purczynski of isec.pl discovered a critical security vulnerability in the memory management code of Linux inside the mremap2 system call. Due to missing function return value check of internal functions a local attacker can gain root privileges. %NASLMINLEVEL 70300 C...

Debian DSA-343-1 : skk, ddskk - insecure temporary file

skk Simple Kana to Kanji conversion program, does not take appropriate security precautions when creating temporary files. This bug could potentially be exploited to overwrite arbitrary files with the privileges of the user running Emacs and skk. ddskk is derived from the same code, and contains...

Debian DSA-323-1 : noweb - insecure temporary files

Jakob Lell discovered a bug in the 'noroff' script included in noweb whereby a temporary file was created insecurely. During a review, several other instances of this problem were found and fixed. Any of these bugs could be exploited by a local user to overwrite arbitrary files owned by the user...

Debian DSA-526-1 : webmin - several vulnerabilities

Two vulnerabilities were discovered in webmin : CAN-2004-0582: Unknown vulnerability in Webmin 1.140 allows remote attackers to bypass access control rules and gain read access to configuration information for a module. CAN-2004-0583: The account lockout functionality in 1 Webmin 1.140 and 2...

Debian DSA-180-1 : nis - information leak

Thorsten Kukuck discovered a problem in the ypserv program which is part of the Network Information Services NIS. A memory leak in all versions of ypserv prior to 2.5 is remotely exploitable. When a malicious user could request a non-existing map the server will leak parts of an old domainname an...

Debian DSA-252-1 : slocate - buffer overflow

A problem has been discovered in slocate, a secure locate replacement. A buffer overflow in the setgid program slocate can be used to execute arbitrary code as group slocate. This can be used to alter the slocate database. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text...

Debian DSA-285-1 : lprng - insecure temporary file

Karol Lewandowski discovered that psbanner, a printer filter that creates a PostScript format banner and is part of LPRng, insecurely creates a temporary file for debugging purpose when it is configured as filter. The program does not check whether this file already exists or is linked to another...

Debian DSA-522-1 : super - format string vulnerability

Max Vozeler discovered a format string vulnerability in super, a program to allow specified users to execute commands with root privileges. This vulnerability could potentially be exploited by a local user to execute arbitrary code with root privileges. %NASLMINLEVEL 70300 C Tenable Network...