Debian DSA-597-1 : cyrus-imapd - buffer overflow

Stefan Esser discovered several security related problems in the Cyrus IMAP daemon. Due to a bug in the command parser it is possible to access memory beyond the allocated buffer in two places which could lead to the execution of arbitrary code. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

Debian DSA-595-1 : bnc - buffer overflow

Leon Juranic discovered that BNC, an IRC session bouncing proxy, does not always protect buffers from being overwritten. This could exploited by a malicious IRC server to overflow a buffer of limited size and execute arbitrary code on the client host. %NASLMINLEVEL 70300 C Tenable Network Securit...

Debian DSA-593-1 : imagemagick - buffer overflow

A vulnerability has been reported for ImageMagick, a commonly used image manipulation library. Due to a boundary error within the EXIF parsing routine, a specially crafted graphic image could lead to the execution of arbitrary code. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

Debian DSA-581-1 : xpdf - integer overflows

Chris Evans discovered several integer overflows in xpdf, a viewer for PDF files, which can be exploited remotely by a specially crafted PDF document and lead to the execution of arbitrary code. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this...

Debian DSA-590-1 : gnats - format string vulnerability

Khan Shirani discovered a format string vulnerability in gnats, the GNU problem report management system. This problem may be exploited to execute arbitrary code. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian...

Debian DSA-556-2 : netkit-telnet - invalid free(3)

Michal Zalewski discovered a bug in the netkit-telnet server telnetd whereby a remote attacker could cause the telnetd process to free an invalid pointer. This causes the telnet server process to crash, leading to a straightforward denial of service inetd will disable the service if telnetd is...

Debian DSA-588-1 : gzip - insecure temporary files

Trustix developers discovered insecure temporary file creation in supplemental scripts in the gzip package which may allow local users to overwrite files via a symlink attack. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracte...

Debian DSA-424-1 : mc - buffer overflow

A vulnerability was discovered in Midnight Commander, a file manager, whereby a malicious archive such as a .tar file could cause arbitrary code to be executed if opened by Midnight Commander. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this...

Debian DSA-076-1 : most - buffer overflow

Pavel Machek has found a buffer overflow in the most' pager program. The problem is part of most's tab expansion where the program would write beyond the bounds two array variables when viewing a malicious file. This could lead into other data structures being overwritten which in turn could enab...

Debian DSA-406-1 : lftp - buffer overflow

Ulf Harnhammar discovered a buffer overflow in lftp, a set of sophisticated command-line FTP/HTTP client programs. An attacker could create a carefully crafted directory on a website so that the execution of an 'ls' or 'rels' command would lead to the execution of arbitrary code on the client...

Debian DSA-412-1 : nd - buffer overflows

Multiple vulnerabilities were discovered in nd, a command-line WebDAV interface, whereby long strings received from the remote server could overflow fixed-length buffers. This vulnerability could be exploited by a remote attacker in control of a malicious WebDAV server to execute arbitrary code i...

Debian DSA-357-1 : wu-ftpd - remote root exploit

iSEC Security Research reports that wu-ftpd contains an off-by-one bug in the fbrealpath function which could be exploited by a logged-in user local or anonymous to gain root privileges. A demonstration exploit is reportedly available. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

Debian DSA-471-1 : interchange - missing input sanitising

A vulnerability was discovered recently in Interchange, an e-commerce and general HTTP database display system. This vulnerability can be exploited by an attacker to expose the content of arbitrary variables. An attacker may learn SQL access information for your Interchange application and use th...

Debian DSA-123-1 : listar - remote exploit

Janusz Niewiadomski and Wojciech Purczynski reported a buffer overflow in the addressmatch of listar a listserv style mailing-list manager. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Security Advisory...

Debian DSA-107-1 : jgroff - format print vulnerability

Basically, this is the same Security Advisory as DSA 072-1, but for jgroff instead of groff. The package jgroff contains a version derived from groff that has Japanese character sets enabled. This package is available only in the stable release of Debian, patches for Japanese support have been...

Debian DSA-459-1 : kdelibs - cookie path traversal

A vulnerability was discovered in KDE where the path restrictions on cookies could be bypassed using encoded relative path components e.g., '/../'. This means that a cookie which should only be sent by the browser to an application running at /app1, the browser could inadvertently include it with...

Debian DSA-025-2 : openssh - Missing PAM support

A former security upload of OpenSSH lacked support for PAM which lead to people not being able to log onto their server. This wasonly a problem on the sparc architecture. We recommend you upgrade your ssh packages on sparc. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text...

Debian DSA-354-1 : xconq - buffer overflows

Steve Kemp discovered a buffer overflow in xconq, in processing the USER environment variable. In the process of fixing this bug, a similar problem was discovered with the DISPLAY environment variable. This vulnerability could be exploited by a local attacker to gain gid 'games'. %NASLMINLEVEL...

Debian DSA-497-1 : mc - several vulnerabilities

Jacub Jelinek discovered several vulnerabilities in the Midnight Commander, a powerful file manager for GNU/Linux systems. The problems were classified as follows : CAN-2004-0226 Buffer overflows CAN-2004-0231 Insecure temporary file and directory creations CAN-2004-0232 Format string problems...

Debian DSA-353-1 : sup - insecure temporary file

sup, a package used to maintain collections of files in identical versions across machines, fails to take appropriate security precautions when creating temporary files. A local attacker could exploit this vulnerability to overwrite arbitrary files with the privileges of the user running sup...