GLSA-200804-09 : am-utils: Insecure temporary file creation

The remote host is affected by the vulnerability described in GLSA-200804-09 am-utils: Insecure temporary file creation Tavis Ormandy discovered that, when creating temporary files, the 'expn' utility does not check whether the file already exists. Impact : A local attacker could exploit the...

[ GLSA 200804-12 ] gnome-screensaver: Privilege escalation

Gentoo Linux Security Advisory GLSA 200804-12 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity:...

GLSA-200804-05 : NX: User-assisted execution of arbitrary code

The remote host is affected by the vulnerability described in GLSA-200804-05 NX: User-assisted execution of arbitrary code Multiple integer overflow and buffer overflow vulnerabilities have been discovered in the X.Org X server as shipped by NX and NX Node vulnerabilities 1-4 in GLSA 200801-09...

GLSA-200804-07 : PECL APC: Buffer Overflow

The remote host is affected by the vulnerability described in GLSA-200804-07 PECL APC: Buffer Overflow Daniel Papasian discovered a stack-based buffer overflow in the apcsearchpaths function in the file apc.c when processing long filenames. Impact : A remote attacker could exploit this...

GLSA-200803-18 : Cacti: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-200803-18 Cacti: Multiple vulnerabilities The following inputs are not properly sanitized before being processed: 'viewtype' parameter in the file graph.php, 'filter' parameter in the file graphview.php, 'action' and 'loginusernam...

GLSA-200803-17 : PDFlib: Multiple buffer overflows

The remote host is affected by the vulnerability described in GLSA-200803-17 PDFlib: Multiple buffer overflows poplix reported multiple boundary errors in the pdcfsearchfopen function when processing overly long filenames. Impact : A remote attacker could send specially crafted content to a...

GLSA-200803-12 : Evolution: Format string vulnerability

The remote host is affected by the vulnerability described in GLSA-200803-12 Evolution: Format string vulnerability Ulf Harnhammar from Secunia Research discovered a format string error in the emfmultipartencrypted function in the file mail/em-format.c when reading certain data e.g. the 'Version:...

GLSA-200802-06 : scponly: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-200802-06 scponly: Multiple vulnerabilities Joachim Breitner reported that Subversion and rsync support invokes subcommands in an insecure manner CVE-2007-6350. It has also been discovered that scponly does not filter the -o and -...

GLSA-200802-03 : Horde IMP: Security bypass

The remote host is affected by the vulnerability described in GLSA-200802-03 Horde IMP: Security bypass Ulf Harnhammar, Secunia Research discovered that the 'frame' and 'frameset' HTML tags are not properly filtered out. He also reported that certain HTTP requests are executed without being...

GLSA-200801-21 : Xdg-Utils: Arbitrary command execution

The remote host is affected by the vulnerability described in GLSA-200801-21 Xdg-Utils: Arbitrary command execution Miroslav Lichvar discovered that the 'xdg-open' and 'xdg-email' shell scripts do not properly sanitize their input before processing it. Impact : A remote attacker could entice a us...

GLSA-200801-22 : PeerCast: Buffer overflow

The remote host is affected by the vulnerability described in GLSA-200801-22 PeerCast: Buffer overflow Luigi Auriemma reported a heap-based buffer overflow within the 'handshakeHTTP' function when processing HTTP requests. Impact : A remote attacker could send a specially crafted request to the...

GLSA-200801-16 : MaraDNS: CNAME Denial of Service

The remote host is affected by the vulnerability described in GLSA-200801-16 MaraDNS: CNAME Denial of Service Michael Krieger reported that a specially crafted DNS could prevent an authoritative canonical name CNAME record from being resolved because of an 'improper rotation of resource records'...

GLSA-200801-01 : unp: Arbitrary command execution

The remote host is affected by the vulnerability described in GLSA-200801-01 unp: Arbitrary command execution Erich Schubert from Debian discovered that unp does not escape file names properly before passing them to calls of the shell. Impact : A remote attacker could entice a user or automated...

unp文件名远程任意Shell命令注入漏洞

BUGTRAQ ID: 27182 CVECAN ID: CVE-2007-6610 unp是用于在Debian平台下使用的压缩解压文档的perl脚本。 unp处理文件名时存在漏洞，本地攻击者可能利用此漏洞通过诱使用户执行特定操作来提升权限。 unp没有正确地转义文件名，如果执行以下操作的话： touch empty zip \ls.zip empty unp \ls.zip 就会给出目录列表。这意味着任何使用unp进行解压的应用程序都受基于文件名的命令注入攻击的影响。 DebianHelp unp 1.0.14 厂商补丁： Gentoo ------...

GLSA-200801-03 : Claws Mail: Insecure temporary file creation

The remote host is affected by the vulnerability described in GLSA-200801-03 Claws Mail: Insecure temporary file creation Nico Golde from Debian reported that the sylprint.pl script that is part of the Claws Mail tools creates temporary files in an insecure manner. Impact : A local attacker could...

GLSA-200712-18 : Multi-Threaded DAAP Daemon: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-200712-18 Multi-Threaded DAAP Daemon: Multiple vulnerabilities nnp discovered multiple vulnerabilities in the XML-RPC handler in the file webserver.c. The wsaddarg function contains a format string vulnerability, as it does not...

GLSA-200712-12 : IRC Services: Denial of Service

The remote host is affected by the vulnerability described in GLSA-200712-12 IRC Services: Denial of Service loverboy reported that the 'defaultencrypt' function in file encrypt.c does not properly handle overly long passwords. Impact : A remote attacker could provide an overly long password to t...

GLSA-200712-05 : PEAR::MDB2: Information disclosure

The remote host is affected by the vulnerability described in GLSA-200712-05 PEAR::MDB2: Information disclosure priyadi discovered that the request to store a URL string as a LOB is treated as a request to retrieve and store the contents of the URL. Impact : If an application using PEAR::MDB2...

AMD64 x86 emulation Qt library: Multiple vulnerabilities

Background Qt is a cross-platform GUI framework, which is used e.g. by KDE. The AMD64 x86 emulation Qt library packages Qt libraries for 32bit x86 emulation on AMD64. Description The Qt versions used by the AMD64 x86 emulation Qt libraries were vulnerable to several flaws GLSA 200708-16, GLSA...

GLSA-200711-25 : MySQL: Denial of Service

The remote host is affected by the vulnerability described in GLSA-200711-25 MySQL: Denial of Service Joe Gallo and Artem Russakovskii reported an error in the convertsearchmodetoinnobase function in hainnodb.cc in the InnoDB engine that is leading to a failed assertion when handling CONTAINS...