Debian DSA-263-1 : netpbm-free - math overflow errors

Al Viro and Alan Cox discovered several maths overflow errors in NetPBM, a set of graphics conversion tools. These programs are not installed setuid root but are often installed to prepare data for processing. These vulnerabilities may allow remote attackers to cause a denial of service or execut...

Debian DSA-190-1 : wmaker - buffer overflow

Al Viro found a problem in the image handling code use in Window Maker, a popular NEXTSTEP like window manager. When creating an image it would allocate a buffer by multiplying the image width and height, but did not check for an overflow. This makes it possible to overflow the buffer. This could...

Debian DSA-233-1 : cvs - doubly freed memory

Stefan Esser discovered a problem in cvs, a concurrent versions system, which is used for many Free Software projects. The current version contains a flaw that can be used by a remote attacker to execute arbitrary code on the CVS server under the user id the CVS server runs as. Anonymous read-onl...

Debian DSA-095-1 : gpm - local root vulnerability

The package 'gpm' contains the gpm-root program, which can be used to create mouse-activated menus on the console. Among other problems, the gpm-root program contains a format string vulnerability, which allows an attacker to gain root privileges. %NASLMINLEVEL 70300 C Tenable Network Security,...

Debian DSA-132-1 : apache-ssl - remote DoS / exploit

Mark Litchfield found a denial of service attack in the Apache web-server. While investigating the problem the Apache Software Foundation discovered that the code for handling invalid requests which use chunked encoding also might allow arbitrary code execution on 64 bit architectures...

Debian DSA-162-1 : ethereal - buffer overflow

Ethereal developers discovered a buffer overflow in the ISIS protocol dissector. It may be possible to make Ethereal crash or hang by injecting a purposefully malformed packet onto the wire, or by convincing someone to read a malformed packet trace file. It may be possible to make Ethereal run...

Debian DSA-314-1 : atftp - buffer overflow

Rick Patel discovered that atftpd is vulnerable to a buffer overflow when a long filename is sent to the server. An attacker could exploit this bug remotely to execute arbitrary code on the server. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in thi...

Debian DSA-426-1 : netpbm-free - insecure temporary files

netpbm is a graphics conversion toolkit made up of a large number of single-purpose programs. Many of these programs were found to create temporary files in an insecure manner, which could allow a local attacker to overwrite files with the privileges of the user invoking a vulnerable netpbm tool...

Debian DSA-349-1 : nfs-utils - buffer overflow

The logging code in nfs-utils contains an off-by-one buffer overrun when adding a newline to the string being logged. This vulnerability may allow an attacker to execute arbitrary code or cause a denial of service condition by sending certain RPC requests. %NASLMINLEVEL 70300 C Tenable Network...

Debian DSA-511-1 : ethereal - buffer overflows

Several buffer overflow vulnerabilities were discovered in ethereal, a network traffic analyzer. These vulnerabilities are described in the ethereal advisory 'enpa-sa-00013'. Of these, only some parts of CAN-2004-0176 affect the version of ethereal in Debian woody. CAN-2004-0367 and CAN-2004-0365...

Debian DSA-186-1 : log2mail - buffer overflow

Enrico Zini discovered a buffer overflow in log2mail, a daemon for watching logfiles and sending lines with matching patterns via mail. The log2mail daemon is started upon system boot and runs as root. A specially crafted remote log message could overflow a static buffer, potentially leaving...

Debian DSA-189-1 : luxman - local root exploit

iDEFENSE reported about a vulnerability in LuxMan, a maze game for GNU/Linux, similar to the PacMan arcade game. When successfully exploited a local attacker gains read-write access to the memory, leading to a local root compromise in many ways, examples of which include scanning the file for...

Debian DSA-180-1 : nis - information leak

Thorsten Kukuck discovered a problem in the ypserv program which is part of the Network Information Services NIS. A memory leak in all versions of ypserv prior to 2.5 is remotely exploitable. When a malicious user could request a non-existing map the server will leak parts of an old domainname an...

Debian DSA-086-1 : ssh-nonfree - remote root exploit

We have received reports that the 'SSH CRC-32 compensation attack detector vulnerability' is being actively exploited. This is the same integer type error previously corrected for OpenSSH in DSA-027-1. OpenSSH the Debian ssh package was fixed at that time, but ssh-nonfree and ssh-socks were not...

Debian DSA-422-1 : cvs - remote vulnerability

The account management of the CVS pserver which is used to give remote access to CVS repositories uses a CVSROOT/passwd file in each repository which contains the accounts and their authentication information as well as the name of the local unix account to use when a pserver account is used. Sin...

Debian DSA-074-1 : wmaker - buffer overflow

Alban Hertroys found a buffer overflow in Window Maker a popular window manager for X. The code that handles titles in the window list menu did not check the length of the title when copying it to a buffer. Since applications will set the title using data that can't be trusted for example, most w...

Debian DSA-516-1 : postgresql - buffer overflow

A buffer overflow has been discovered in the ODBC driver of PostgreSQL, an object-relational SQL database, descended from POSTGRES. It is possible to exploit this problem and crash the surrounding application. Hence, a PHP script using php4-odbc can be utilised to crash the surrounding Apache...

Debian DSA-040-1 : slrn - buffer overflow

Bill Nottingham reported a problem in the wrapping/unwrapping functions of the slrn newsreader. A long header in a message might overflow a buffer, which could result in executing arbitrary code encoded in the message. The default configuration does not have wrapping enable, but it can easily be...

Debian DSA-179-1 : gnome-gv - buffer overflow

Zen-parse discovered a buffer overflow in gv, a PostScript and PDF viewer for X11. The same code is present in gnome-gv. This problem is triggered by scanning the PostScript file and can be exploited by an attacker sending a malformed PostScript or PDF file. The attacker is able to cause arbitrar...

Debian DSA-059-1 : man-db - symlink attack

Luki R. reported a bug in man-db: it did not handle nested calls ofdropeffectiveprivs and regaineffectiveprivs correctly which would cause it to regain privileges too early. This could be abused to make man create files as user man. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...