X.Org X server and Xfont library: Multiple vulnerabilities

Background The X Window System is a graphical windowing system based on a client/server model. Description regenrecht reported multiple vulnerabilities in various X server extension via iDefense: The XFree86-Misc extension does not properly sanitize a parameter within a PassMessage request,...

unp: Arbitrary command execution

Background unp is a script for unpacking various file formats. Description Erich Schubert from Debian discovered that unp does not escape file names properly before passing them to calls of the shell. Impact A remote attacker could entice a user or automated system to unpack a compressed archive...

OpenOffice.org: User-assisted arbitrary code execution

Background OpenOffice.org is an open source office productivity suite, including word processing, spreadsheet, presentation, drawing, data charting, formula editing, and file conversion facilities. Description The HSQLDB engine, as used in Openoffice.org, does not properly enforce restrictions to...

AMD64 x86 emulation Qt library: Multiple vulnerabilities

Background Qt is a cross-platform GUI framework, which is used e.g. by KDE. The AMD64 x86 emulation Qt library packages Qt libraries for 32bit x86 emulation on AMD64. Description The Qt versions used by the AMD64 x86 emulation Qt libraries were vulnerable to several flaws GLSA 200708-16, GLSA...

PEAR::MDB2: Information disclosure

Background PEAR::MDB2 is a database abstraction layer for PHP aimed to provide a common API for all supported relational database management systems. A LOB "large object" is a database field holding binary data. Description priyadi discovered that the request to store a URL string as a LOB is...

Cpio: Buffer overflow

Background GNU cpio copies files into or out of a cpio or tar archive. Description A buffer overflow vulnerability in the safernamesuffix function in GNU cpio has been discovered. Impact A remote attacker could entice a user to open a specially crafted archive file resulting in a stack-based buff...

TikiWiki: Multiple vulnerabilities

Background TikiWiki is an open source content management system written in PHP. Description Stefan Esser reported that a previous vulnerability CVE-2007-5423, GLSA 200710-21 was not properly fixed in TikiWiki 1.9.8.1 CVE-2007-5682. The TikiWiki development team also added several checks to avoid...

OpenOffice.org: Heap-based buffer overflow

Background OpenOffice.org is an open source office productivity suite, including word processing, spreadsheet, presentation, drawing, data charting, formula editing, and file conversion facilities. Description iDefense Labs reported that the TIFF parsing code uses untrusted values to calculate...

TikiWiki: Arbitrary command execution

Background TikiWiki is an open source content management system written in PHP. Description ShAnKaR reported that input passed to the "f" array parameter in tiki-graphformula.php is not properly verified before being used to execute PHP functions. Impact An attacker could execute arbitrary code...

Balsa: Buffer overflow

Background Balsa is a highly configurable email client for GNOME. Description Evil Ninja Squirrel discovered a stack-based buffer overflow in the irfetchseq function when receiving a long response to a FETCH command CVE-2007-5007. Impact A remote attacker could entice a user to connect to a...

X.Org X server: Composite local privilege escalation

Background The X Window System is a graphical windowing system based on a client/server model. Description Aaron Plattner discovered a buffer overflow in the compNewPixmap function when copying data from a large pixel depth pixmap into a smaller pixel depth pixmap. Impact A local attacker could...

teTeX: Multiple buffer overflows

Background teTeX is a complete TeX distribution for editing documents. Description Mark Richters discovered a buffer overflow in the opensty function in file mkind.c. Other vulnerabilities have also been discovered in the same file but might not be exploitable CVE-2007-0650. Tetex also includes...

rsync: Two buffer overflows

Background rsync is a file transfer program to keep remote directories synchronized. Description Sebastian Krahmer from the SUSE Security Team discovered two off-by-one errors in the function "fname" in file sender.c when processing overly long directory names. Impact A remote attacker could enti...

RealPlayer: Buffer overflow

Background RealPlayer is a multimedia player capable of handling multiple multimedia file formats. Description A stack-based buffer overflow vulnerability has been reported in the SmilTimeValue::parseWallClockValue function in smlprstime.cpp when handling HH:mm:ss.f type time formats. Impact By...

Xvid: Array indexing vulnerabilities

Background Xvid is a popular open source video codec licensed under the GPL. Description Trixter Jack discovered an array indexing error in the getintrablock function in the file src/bitstream/mbcoding.c. The getinterblockh263 and getinterblockmpeg functions in the same file were also reported as...

Fail2ban: Denial of service

Background Fail2ban is a tool for parsing log files and banning IP addresses which make too many password failures. Description A vulnerability has been discovered in Fail2ban when parsing log files. Impact A remote attacker could send specially crafted SSH login banners to the vulnerable host,...

ELinks: User-assisted execution of arbitrary code

Background ELinks is a text-mode web browser. Description Arnaud Giersch discovered that the "addfilenametostring" function in file intl/gettext/loadmsgcat.c uses an untrusted relative path, allowing for a format string attack with a malicious .po file. Impact A local attacker could entice a user...

PhpWiki: Remote execution of arbitrary code

Background PhpWiki is an open source content management system written in PHP. Description Harold Hallikainen has reported that the Upload page fails to properly check the extension of a file. Impact A remote attacker could upload a specially crafted PHP file to the vulnerable server, resulting i...

MySQL IF查询处理远程拒绝服务漏洞

MySQL是一款使用非常广泛的开放源代码关系数据库系统，拥有各种平台的运行版本。 MySQL处理IF请求时存在漏洞，如果向MySQL数据库提交了恶意的IF查询请求的话，就可能触发空指针引用，导致服务器崩溃。 MySQL AB MySQL 5.0.40-debug MySQL AB MySQL 5.0.34 MySQL AB MySQL 5.0.26 MySQL AB -------- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://dev.mysql.com/downloads/mysql/5.0.html Gentoo ------...

3proxy: Buffer overflow

Background 3proxy is a multi-protocol proxy, including HTTP/HTTPS/FTP and SOCKS support. Description The 3proxy development team reported a buffer overflow in the logurl function when processing overly long requests. Impact A remote attacker could send a specially crafted transparent request to t...