Debian DSA-455-1 : libxml - buffer overflows

libxml2 is a library for manipulating XML files. Yuuichi Teranishi Si Xi Yu ? discovered a flaw in libxml, the GNOME XML library. When fetching a remote resource via FTP or HTTP, the library uses special parsing routines which can overflow a buffer if passed a very long URL. If an attacker is abl...

Debian DSA-444-1 : linux-kernel-2.4.17-ia64 - missing function return value check

Paul Starzetz and Wojciech Purczynski of isec.pl discovered a critical security vulnerability in the memory management code of Linux inside the mremap2 system call. Due to missing function return value check of internal functions a local attacker can gain root privileges. %NASLMINLEVEL 70300 C...

Debian DSA-378-1 : mah-jong - buffer overflows, denial of service

Nicolas Boullis discovered two vulnerabilities in mah-jong, a network-enabled game. - CAN-2003-0705 buffer overflow This vulnerability could be exploited by a remote attacker to execute arbitrary code with the privileges of the user running the mah-jong server. - CAN-2003-0706 denial of service...

Debian DSA-354-1 : xconq - buffer overflows

Steve Kemp discovered a buffer overflow in xconq, in processing the USER environment variable. In the process of fixing this bug, a similar problem was discovered with the DISPLAY environment variable. This vulnerability could be exploited by a local attacker to gain gid 'games'. %NASLMINLEVEL...

Debian DSA-353-1 : sup - insecure temporary file

sup, a package used to maintain collections of files in identical versions across machines, fails to take appropriate security precautions when creating temporary files. A local attacker could exploit this vulnerability to overwrite arbitrary files with the privileges of the user running sup...

Debian DSA-451-1 : xboing - buffer overflows

Steve Kemp discovered a number of buffer overflow vulnerabilities in xboing, a game, which could be exploited by a local attacker to gain gid 'games'. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Security...

Debian DSA-160-1 : scrollkeeper - insecure temporary file creation

Spybreak discovered a problem in scrollkeeper, a free electronic cataloging system for documentation. The scrollkeeper-get-cl program creates temporary files in an insecure manner in /tmp using guessable filenames. Since scrollkeeper is called automatically when a user logs into a Gnome session, ...

Debian DSA-412-1 : nd - buffer overflows

Multiple vulnerabilities were discovered in nd, a command-line WebDAV interface, whereby long strings received from the remote server could overflow fixed-length buffers. This vulnerability could be exploited by a remote attacker in control of a malicious WebDAV server to execute arbitrary code i...

Debian DSA-025-2 : openssh - Missing PAM support

A former security upload of OpenSSH lacked support for PAM which lead to people not being able to log onto their server. This wasonly a problem on the sparc architecture. We recommend you upgrade your ssh packages on sparc. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text...

Debian DSA-090-1 : xtel - symlink attack

The xtel an X emulator for minitel package as distributed with Debian GNU/Linux 2.2 has two possible symlink attacks : - xteld creates a temporary file /tmp/.xtel- without checking for symlinks. - when printing a hardcopy xtel would create a temporary file without protecting itself against symlin...

Debian DSA-497-1 : mc - several vulnerabilities

Jacub Jelinek discovered several vulnerabilities in the Midnight Commander, a powerful file manager for GNU/Linux systems. The problems were classified as follows : CAN-2004-0226 Buffer overflows CAN-2004-0231 Insecure temporary file and directory creations CAN-2004-0232 Format string problems...

Debian DSA-177-1 : pam -- serious security violation

A serious security violation in PAM was discovered. Disabled passwords i.e. those with '' in the password file were classified as empty password and access to such accounts is granted through the regular login procedure getty, telnet, ssh. This works for all such accounts whose shell field in the...

Debian DSA-182-1 : kdegraphics - buffer overflow

Zen-parse discovered a buffer overflow in gv, a PostScript and PDF viewer for X11. The same code is present in kghostview which is part of the KDE-Graphics package. This problem is triggered by scanning the PostScript file and can be exploited by an attacker sending a malformed PostScript or PDF...

Debian DSA-118-1 : xsane - insecure temporary files

Tim Waugh found several insecure uses of temporary files in the xsane program, which is used for scanning. This was fixed for Debian/stable by moving those files into a securely created directory within the /tmp directory. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text...

Debian DSA-102-2 : at - daemon exploit

zen-parse found a bug in the current implementation of at which leads into a heap corruption vulnerability which in turn could potentially lead into an exploit of the daemon user. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were...

Debian DSA-123-1 : listar - remote exploit

Janusz Niewiadomski and Wojciech Purczynski reported a buffer overflow in the addressmatch of listar a listserv style mailing-list manager. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Security Advisory...

Debian DSA-138-1 : gallery - remote exploit

A problem was found in gallery a web-based photo album toolkit: it was possible to pass in the GALLERYBASEDIR variable remotely. This made it possible to execute commands under the uid of web-server. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in...

Debian DSA-275-1 : lpr-ppd - buffer overflow

A buffer overflow has been discovered in lpr, a BSD lpr/lpd line printer spooling system. This problem can be exploited by a local user to gain root privileges, even if the printer system is set up properly. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package...

Debian DSA-076-1 : most - buffer overflow

Pavel Machek has found a buffer overflow in the most' pager program. The problem is part of most's tab expansion where the program would write beyond the bounds two array variables when viewing a malicious file. This could lead into other data structures being overwritten which in turn could enab...

gnutls -- certificate chain verification DoS

Patric Hornik reports on a problem in the certificate chain verification procedures of GnuTLS that may result in a denial-of-service vulnerability: The certificate chain should be verified from last root certificate to the first certificate. Otherwise a lot of unauthorized CPU processing can be...