Debian DSA-534-1 : mailreader - directory traversal

A directory traversal vulnerability was discovered in mailreader whereby remote attackers could view arbitrary files with the privileges of the nph-mr.cgi process by default, www-data via relative paths and a null byte in the configLanguage parameter. %NASLMINLEVEL 70300 C Tenable Network Securit...

Debian DSA-431-1 : perl - information leak

Paul Szabo discovered a number of similar bugs in suidperl, a helper program to run perl scripts with setuid privileges. By exploiting these bugs, an attacker could abuse suidperl to discover information about files such as testing for their existence and some of their permissions that should not...

Debian DSA-261-1 : tcpdump - infinite loop

A problem has been discovered in tcpdump, a powerful tool for network monitoring and data acquisition. An attacker is able to send a specially crafted RADIUS network packet which causes tcpdump to enter an infinite loop. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text an...

Debian DSA-271-1 : ecartis - unauthorized password change

A problem has been discovered in ecartis, a mailing list manager, formerly known as listar. This vulnerability enables an attacker to reset the password of any user defined on the list server, including the list admins. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and...

Debian DSA-210-1 : lynx - CRLF injection

lynx a text-only web browser did not properly check for illegal characters in all places, including processing of command line options, which could be used to insert extra HTTP headers in a request. For Debian GNU/Linux 2.2/potato this has been fixed in version 2.8.3-1.1 of the lynx package and...

Debian DSA-087-1 : wu-ftpd - remote root exploit

CORE ST reports that an exploit has been found for a bug in the wu-ftpd glob code this is the code that handles filename wildcard expansion. Any logged in user including anonymous FTP users can exploit the bug to gain root privileges on the server. %NASLMINLEVEL 70300 C Tenable Network Security,...

Debian DSA-061-1 : gnupg - printf format attack

The version of GnuPG GNU Privacy Guard, an OpenPGP implementation as distributed in Debian GNU/Linux 2.2 suffers from two problems : - fish stiqz reported on bugtraq that there was a printf format problem in the doget function: it printed a prompt which included the filename that was being...

Debian DSA-323-1 : noweb - insecure temporary files

Jakob Lell discovered a bug in the 'noroff' script included in noweb whereby a temporary file was created insecurely. During a review, several other instances of this problem were found and fixed. Any of these bugs could be exploited by a local user to overwrite arbitrary files owned by the user...

Debian DSA-250-1 : w3mmee-ssl - missing HTML quoting

Hironori Sakamoto, one of the w3m developers, found two security vulnerabilities in w3m and associated programs. The w3m browser does not properly escape HTML tags in frame contents and img alt attributes. A malicious HTML frame or img alt attribute may deceive a user to send their local cookies...

Debian DSA-149-1 : glibc - integer overflow

An integer overflow bug has been discovered in the RPC library used by GNU libc, which is derived from the SunRPC library. This bug could be exploited to gain unauthorized root access to software linking to this code. The packages below also fix integer overflows in the malloc code. They also...

Debian DSA-397-1 : postgresql - buffer overflow

Tom Lane discovered a buffer overflow in the toascii function in PostgreSQL. This allows remote attackers to execute arbitrary code on the host running the database. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from...

Debian DSA-036-1 : Midnight Commander - arbitrary program execution

It has been reported that a local user could tweak Midnight Commander of another user into executing an arbitrary program under the user id of the person running Midnight Commander. This behaviour has been fixed by Andrew V. Samoilov. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

Debian DSA-037-1 : Athena Widget replacement libraries - insecure tempfile handling

It has been reported that the AsciiSrc and MultiSrc widget in the Athena widget library handle temporary files insecurely. Joey Hess has ported the bugfix from XFree86 to these Xaw replacements libraries. The fixes are available in nextaw 0.5.1-34potato1, xaw3d 1.3-6.9potato1, and xaw95...

Debian DSA-343-1 : skk, ddskk - insecure temporary file

skk Simple Kana to Kanji conversion program, does not take appropriate security precautions when creating temporary files. This bug could potentially be exploited to overwrite arbitrary files with the privileges of the user running Emacs and skk. ddskk is derived from the same code, and contains...

Debian DSA-427-1 : linux-kernel-2.4.17-mips+mipsel - missing boundary check

Paul Starzetz discovered a flaw in bounds checking in mremap in the Linux kernel present in version 2.4.x and 2.6.x which may allow a local attacker to gain root privileges. Version 2.2 is not affected by this bug. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and...

Debian DSA-438-1 : linux-kernel-2.4.18-alpha+i386+powerpc - missing function return value check

Paul Starzetz and Wojciech Purczynski of isec.pl discovered a critical security vulnerability in the memory management code of Linux inside the mremap2 system call. Due to missing function return value check of internal functions a local attacker can gain root privileges. %NASLMINLEVEL 70300 C...

Debian DSA-422-1 : cvs - remote vulnerability

The account management of the CVS pserver which is used to give remote access to CVS repositories uses a CVSROOT/passwd file in each repository which contains the accounts and their authentication information as well as the name of the local unix account to use when a pserver account is used. Sin...

Debian DSA-059-1 : man-db - symlink attack

Luki R. reported a bug in man-db: it did not handle nested calls ofdropeffectiveprivs and regaineffectiveprivs correctly which would cause it to regain privileges too early. This could be abused to make man create files as user man. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

Debian DSA-074-1 : wmaker - buffer overflow

Alban Hertroys found a buffer overflow in Window Maker a popular window manager for X. The code that handles titles in the window list menu did not check the length of the title when copying it to a buffer. Since applications will set the title using data that can't be trusted for example, most w...

Debian DSA-244-1 : noffle - buffer overflows

Dan Jacobson noticed a problem in noffle, an offline news server, that leads to a segmentation fault. It is not yet clear whether this problem is exploitable. However, if it is, a remote attacker could trigger arbitrary code execution under the user that calls noffle, probably news. %NASLMINLEVEL...