Debian DSA-333-1 : acm - integer overflow

acm, a multi-player aerial combat simulation, uses a network protocol based on the same RPC implementation used in many C libraries. This implementation was found to contain an integer overflow vulnerability which could be exploited to execute arbitrary code. %NASLMINLEVEL 70300 C Tenable Network...

Debian DSA-429-1 : gnupg - cryptographic weakness

Phong Nguyen identified a severe bug in the way GnuPG creates and uses ElGamal keys for signing. This is a significant security failure which can lead to a compromise of almost all ElGamal keys used for signing. This update disables the use of this type of key. %NASLMINLEVEL 70300 C Tenable Netwo...

Debian DSA-474-1 : squid - ACL bypass

A vulnerability was discovered in squid, an Internet object cache, whereby access control lists based on URLs could be bypassed CAN-2004-0189. Two other bugs were also fixed with patches squid-2.4.STABLE7-urlescape.patch a buffer overrun which does not appear to be exploitable and...

Debian DSA-207-1 : tetex-bin - arbitrary command execution

The SuSE security team discovered a vulnerability in kpathsea library libkpathsea which is used by xdvi and dvips. Both programs call the system function insecurely, which allows a remote attacker to execute arbitrary commands via cleverly crafted DVI files. If dvips is used in a print filter, th...

Debian DSA-247-1 : courier-ssl - missing input sanitizing

The developers of courier, an integrated user side mail server, discovered a problem in the PostgreSQL auth module. Not all potentially malicious characters were sanitized before the username was passed to the PostgreSQL engine. An attacker could inject arbitrary SQL commands and queries exploiti...

Debian DSA-417-1 : linux-kernel-2.4.18-powerpc+alpha - missing boundary check

Paul Starzetz discovered a flaw in bounds checking in mremap in the Linux kernel present in version 2.4.x and 2.6.x which may allow a local attacker to gain root privileges. Version 2.2 is not affected by this bug. Andrew Morton discovered a missing boundary check for the brk system call which ca...

Debian DSA-455-1 : libxml - buffer overflows

libxml2 is a library for manipulating XML files. Yuuichi Teranishi Si Xi Yu ? discovered a flaw in libxml, the GNOME XML library. When fetching a remote resource via FTP or HTTP, the library uses special parsing routines which can overflow a buffer if passed a very long URL. If an attacker is abl...

Debian DSA-501-1 : exim - buffer overflow

Georgi Guninski discovered two stack-based buffer overflows. They can not be exploited with the default configuration from the Debian system, though. The Common Vulnerabilities and Exposures project identifies the following problems that are fixed with this update : - CAN-2004-0399 When...

Debian DSA-021-1 : apache - insecure tempfile bug, broken mod_rewrite

WireX have found some occurrences of insecure opening of temporary files in htdigest and htpasswd. Both programs are not installed setuid or setgid and thus the impact should be minimal. The Apache group has released another security bugfix which fixes a vulnerability in modrewrite which may resu...

Debian DSA-017-1 : jazip - buffer overflow

With older versions of jazip a user could gain root access for members of the floppy group to the local machine. The interface doesn't run as root anymore and this very exploit was prevented. The program now also truncates DISPLAY to 256 characters if it is bigger, which closes the buffer overflo...

Debian DSA-376-2 : exim - buffer overflow

A buffer overflow exists in exim, which is the standard mail transport agent in Debian. By supplying a specially crafted HELO or EHLO command, an attacker could cause a constant string to be written past the end of a buffer allocated on the heap. This vulnerability is not believed at this time to...

Debian DSA-060-1 : fetchmail - buffer overflow

Wolfram Kleff found a problem in fetchmail: it would crash when processing emails with extremely long headers. The problem was a buffer overflow in the header parser which could be exploited. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plug...

Debian DSA-110-1 : cups - buffer overflow

The authors of CUPS, the Common UNIX Printing System, have found a potential buffer overflow bug in the code of the CUPS daemon where it reads the names of attributes. This affects all versions of CUPS. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks i...

Debian DSA-046-2 : exuberant-ctags

Colin Phipps discovered that the exuberant-ctags packages as distributed with Debian GNU/Linux 2.2 creates temporary files insecurely. This has been fixed in version 1:3.2.4-0.1 of the Debian package, and upstream version 3.5. Note: DSA-046-1 included an incorrectly compiled sparc package, which...

Debian DSA-219-1 : dhcpcd - remote command execution

Simon Kelly discovered a vulnerability in dhcpcd, an RFC2131 and RFC1541 compliant DHCP client daemon, that runs with root privileges on client machines. A malicious administrator of the regular or an untrusted DHCP server may execute any command with root privileges on the DHCP client machine by...

Debian DSA-104-1 : cipe - DoS attack

Larry McVoy found a bug in the packet handling code for the CIPE VPN package: it did not check if a received packet was too short and could crash. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Security Adviso...

Debian DSA-398-1 : conquest - buffer overflow

Steve Kemp discovered a buffer overflow in the environment variable handling of conquest, a curses based, real-time, multi-player space warfare game, which could lead a local attacker to gain unauthorised access to the group conquest. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

Debian DSA-418-1 : vbox3 - privilege leak

A bug was discovered in vbox3, a voice response system for isdn4linux, whereby root privileges were not properly relinquished before executing a user-supplied tcl script. By exploiting this vulnerability, a local user could gain root privileges. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

Debian DSA-527-1 : pavuk - buffer overflow

Ulf Harnhammar discovered a vulnerability in pavuk, a file retrieval program, whereby an oversized HTTP 305 response sent by a malicious server could cause arbitrary code to be executed with the privileges of the pavuk process. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive...

Debian DSA-102-2 : at - daemon exploit

zen-parse found a bug in the current implementation of at which leads into a heap corruption vulnerability which in turn could potentially lead into an exploit of the daemon user. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were...