Gentoo Linux Acme Thttpd文件访问信息泄露漏洞

Gentoo Linux是一个基于源码包的Linux系统。 Gentoo的www-servers/thttpd软件包实现上存在漏洞，远程攻击者可能利用此漏洞非授权获取敏感信息。 如果在新的Gentoo baselayout中使用start-stop-daemon命令的话，就会导致thttpd在启动时将文档根设置为系统的根目录“/”，这允许非授权用户远程访问thttpd进程可读的所有系统文件。 Gentoo Linux 1.12.6 临时解决方法：...

GLSA-200701-14 : Mod_auth_kerb: Denial of Service

The remote host is affected by the vulnerability described in GLSA-200701-14 Modauthkerb: Denial of Service Modauthkerb improperly handles component byte encoding in the dergetoid function, allowing for a buffer overflow to occur if there are no components which require more than one byte for...

GLSA-200701-20 : Centericq: Remote buffer overflow in LiveJournal handling

The remote host is affected by the vulnerability described in GLSA-200701-20 Centericq: Remote buffer overflow in LiveJournal handling When interfacing with the LiveJournal service, Centericq does not appropriately allocate memory for incoming data, in some cases creating a buffer overflow. Impac...

GLSA-200701-06 : w3m: Format string vulnerability

The remote host is affected by the vulnerability described in GLSA-200701-06 w3m: Format string vulnerability w3m in -dump or -backend mode does not correctly handle printf format string specifiers in the Common Name CN field of an X.509 SSL certificate. Impact : An attacker could entice a user t...

GLSA-200612-21 : Ruby: Denial of Service vulnerability

The remote host is affected by the vulnerability described in GLSA-200612-21 Ruby: Denial of Service vulnerability The readmultipart function of the CGI library shipped with Ruby cgi.rb does not properly check boundaries in MIME multipart content. This is a different issue than GLSA 200611-12...

GLSA-200612-17 : GNU Radius: Format string vulnerability

The remote host is affected by the vulnerability described in GLSA-200612-17 GNU Radius: Format string vulnerability A format string vulnerability was found in the sqllog function from the SQL accounting code for radiusd. That function is only used if one or more of the 'postgresql', 'mysql' or...

GLSA-200612-16 : Links: Arbitrary Samba command execution

The remote host is affected by the vulnerability described in GLSA-200612-16 Links: Arbitrary Samba command execution Teemu Salmela discovered that Links does not properly validate 'smb://' URLs when it runs smbclient commands. Impact : A remote attacker could entice a user to browse to a special...

GLSA-200612-10 : Tar: Directory traversal vulnerability

The remote host is affected by the vulnerability described in GLSA-200612-10 Tar: Directory traversal vulnerability Tar does not properly extract archive elements using the GNUTYPENAMES record name, allowing files to be created at arbitrary locations using symlinks. Once a symlink is extracted,...

GLSA-200612-09 : MadWifi: Kernel driver buffer overflow

The remote host is affected by the vulnerability described in GLSA-200612-09 MadWifi: Kernel driver buffer overflow Laurent Butti, Jerome Raznieski and Julien Tinnes reported a buffer overflow in the encodeie and the giwscancb functions from ieee80211wireless.c. Impact : A remote attacker could...

GLSA-200612-01 : wv library: Multiple integer overflows

The remote host is affected by the vulnerability described in GLSA-200612-01 wv library: Multiple integer overflows The wv library fails to do proper arithmetic checks in multiple places, possibly leading to integer overflows. Impact : An attacker could craft a malicious file that, when handled...

GLSA-200612-02 : xine-lib: Buffer overflow

The remote host is affected by the vulnerability described in GLSA-200612-02 xine-lib: Buffer overflow A possible buffer overflow has been reported in the Real Media input plugin. Impact : An attacker could exploit this vulnerability by enticing a user into loading a specially crafted stream with...

GLSA-200611-26 : ProFTPD: Remote execution of arbitrary code

The remote host is affected by the vulnerability described in GLSA-200611-26 ProFTPD: Remote execution of arbitrary code Evgeny Legerov discovered a stack-based buffer overflow in the sreplace function in support.c, as well as a buffer overflow in in the modtls module. Additionally, an off-by-two...

GLSA-200611-23 : Mono: Insecure temporary file creation

The remote host is affected by the vulnerability described in GLSA-200611-23 Mono: Insecure temporary file creation Sebastian Krahmer of the SuSE Security Team discovered that the System.CodeDom.Compiler classes of Mono create temporary files with insecure permissions. Impact : A local attacker...

GLSA-200611-18 : TIN: Multiple buffer overflows

The remote host is affected by the vulnerability described in GLSA-200611-18 TIN: Multiple buffer overflows Urs Janssen and Aleksey Salow have reported multiple buffer overflows in TIN. Additionally, the OpenPKG project has reported an allocation off-by-one flaw which can lead to a buffer overflo...

GLSA-200611-17 : fvwm: fvwm-menu-directory fvwm command injection

The remote host is affected by the vulnerability described in GLSA-200611-17 fvwm: fvwm-menu-directory fvwm command injection Tavis Ormandy of the Gentoo Linux Security Audit Team discovered that fvwm-menu-directory does not sufficiently sanitise directory names prior to generating menus. Impact ...

GLSA-200611-05 : Netkit FTP Server: Privilege escalation

The remote host is affected by the vulnerability described in GLSA-200611-05 Netkit FTP Server: Privilege escalation Paul Szabo reported that an incorrect seteuid call after the chdir function can allow an attacker to access a normally forbidden directory, in some very particular circumstances, f...

GLSA-200611-03 : NVIDIA binary graphics driver: Privilege escalation vulnerability

The remote host is affected by the vulnerability described in GLSA-200611-03 NVIDIA binary graphics driver: Privilege escalation vulnerability Rapid7 reported a boundary error in the NVIDIA binary graphics driver that leads to a buffer overflow in the accelerated rendering functionality. Impact :...

GLSA-200611-02 : Qt: Integer overflow

The remote host is affected by the vulnerability described in GLSA-200611-02 Qt: Integer overflow An integer overflow flaw has been found in the pixmap handling of Qt. Impact : By enticing a user to open a specially crafted pixmap image in an application using Qt, e.g. Konqueror, a remote attacke...

GLSA-200611-01 : Screen: UTF-8 character handling vulnerability

The remote host is affected by the vulnerability described in GLSA-200611-01 Screen: UTF-8 character handling vulnerability cstone and Richard Felker discovered a flaw in Screen's UTF-8 combining character handling. Impact : The vulnerability can be exploited by writing a special string of...

GLSA-200610-13 : Cheese Tracker: Buffer Overflow

The remote host is affected by the vulnerability described in GLSA-200610-13 Cheese Tracker: Buffer Overflow Luigi Auriemma reported that the XM loader of Cheese Tracker contains a buffer overflow vulnerability in the loaderXM::loadintrumentinternal function from loaders/loaderxm.cpp. Impact : An...