[ GLSA 200804-05 ] NX: User-assisted execution of arbitrary code

Gentoo Linux Security Advisory GLSA 200804-05:02 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -...

Apache Tomcat 'allowLinking' URI中接收NULL字节信息泄漏漏洞

Tomcat是一款由Apache软件基金会下属的Jakarta项目开发的一个Servlet容器。 当配置'allowlingk'时Apache Tomcat HTTP/1.0 connector不正确处理URI中的NULL字节，远程攻击者可以利用漏洞获得JSP源代码敏感信息。 目前没有详细漏洞细节提供。 Apache Software Foundation Tomcat 4.1.37 Apache Software Foundation Tomcat 4.1.36 Apache Software Foundation Tomcat 4.1.36 Apache Software...

Firebird关系数据库'protocol.cpp' XDR协议远程内存破坏漏洞

BUGTRAQ ID: 28403 CVE ID:CVE-2008-0387 CNCVE ID:CNCVE-20080387 Firebird Relational Database是一款关系型数据库。 Firebird Relational Database管理器处理XDR协议上部分标签时存在整数溢出，远程攻击者可以利用漏洞以应用程序进程权限执行任意指令。 当src/remote/protocol.cpp解析器接收到如下非法数据的操作时： opreceive opstart opstartandreceive opsend opstartandsend...

Gentoo ssl-cert eclass信息泄露漏洞

BUGTRAQ ID: 28350 CVECAN ID: CVE-2008-1383 Gentoo Linux是一套通用的、快捷的、完全免费的Linux版本，面向开发人员和专业网络人员。 Gentoo Linux的ssl-cert.eclass实现上存在漏洞，本地攻击者可能利用此漏洞非授权获取信息。...

[ GLSA 200803-29 ] ViewVC: Multiple vulnerabilities

Gentoo Linux Security Advisory GLSA 200803-29 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity:...

[ GLSA 200803-30 ] ssl-cert eclass: Certificate disclosure

Gentoo Linux Security Advisory GLSA 200803-30 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity:...

libarchive does not properly terminate loop

Overview libarchive contains a vulnerability that may allow an attacker to cause a denial of service. Description The libarchive library provides an interface for reading and writing archive files.There is a vulnerability in libarchive that occurs when it parses the pax interchange format. If an...

Gentoo Linux multiple packages incalid SSL certificates generation

Certificate may be leaked to public file due to invalid ssl-cert eclass implementation...

X.Org PCF font parser buffer overflow

Overview A vulnerability in the X.Org server could allow a remote attacker to execute arbitrary code on an affected system. Description The X.Org project provides an open source implementation of the X Window System. The server supports bitmapped fonts in various formats, including Portable...

CVE-2008-1383

The docert function in ssl-cert.eclass, when used by srccompile or srcinstall on Gentoo Linux, stores the SSL key in a binpkg, which allows local users to extract the key from the binpkg, and causes multiple systems that use this binpkg to have the same SSL key and certificate...

Design/Logic Flaw

The docert function in ssl-cert.eclass, when used by srccompile or srcinstall on Gentoo Linux, stores the SSL key in a binpkg, which allows local users to extract the key from the binpkg, and causes multiple systems that use this binpkg to have the same SSL key and certificate...

CVE-2008-1383

CVE-2008-1383 describes a local-privilege disclosure in Gentoo’s ssl-cert.eclass: the docert() function, when invoked during src_compile/src_install, can cause the generated SSL private key to be stored inside pre-built binary packages (binpkgs). This allows a local user to extract the key from b...

CVE-2008-1383

The docert function in ssl-cert.eclass, when used by srccompile or srcinstall on Gentoo Linux, stores the SSL key in a binpkg, which allows local users to extract the key from the binpkg, and causes multiple systems that use this binpkg to have the same SSL key and certificate...

[ GLSA 200803-23 ] Website META Language: Insecure temporary file usage

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200803-23 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - -...

[ GLSA 200803-18 ] Cacti: Multiple vulnerabilities

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200803-18 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - -...

[ GLSA 200803-15 ] phpMyAdmin: SQL injection vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200803-15 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - -...

[ GLSA 200803-11 ] Vobcopy: Insecure temporary file creation

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200803-11 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - -...

[ GLSA 200802-10 ] Python: PCRE Integer overflow

Gentoo Linux Security Advisory GLSA 200802-10 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity:...

libmodplug 's3m' Remote Buffer Overflow Vulnerability

No description provided by source. /The libmodplug library is prone to a remote buffer-overflow vulnerability because the software fails to perform adequate boundary checks on user-supplied data. An attacker can exploit this issue to execute arbitrary code with the privileges of the user running ...

[ GLSA 200801-21 ] Xdg-Utils: Arbitrary command execution

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200801-21 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - -...