CVE-2000-0723

Helix GNOME Updater helix-update 0.5 and earlier does not properly create /tmp directories, which allows local users to create empty system configuration files such as /etc/config.d/bashrc, /etc/config.d/csh.cshrc, and /etc/rc.config...

GNOME esound 0.2.19 - Unix Domain Socket Race Condition

GNOME esound 0.2.19 - Unix Domain Socket Race Condition source: https://www.securityfocus.com/bid/1659/info EsounD, part of the GNOME desktop environment, is a server process allowing several applications to share the same sound hardware. Versions of esound up to and including 0.2.19 create a...

GNOME esound 0.2.19 - Unix Domain Socket Race Condition

source: https://www.securityfocus.com/bid/1659/info EsounD, part of the GNOME desktop environment, is a server process allowing several applications to share the same sound hardware. Versions of esound up to and including 0.2.19 create a world-writable directory /tmp/.esd which is also used to...

Linux 2.2.17pre20 Вышла новая pre-версия следующего стабильного ядра Linux: 2.2.17pre20. Список изменений пока не попался мне на глаза. Подробнее: ftp://ftp.kernel.org/pub/linux/kernel/people/alan/2.2.17pre/ Linux-2.4.0-test7 Вышло новое "нестабильное" ядро Linux: Linux-2.4.0-test7. Подробнее:...

дырка в Helix GNOME Updater

Некорректная работа с временными файлами помещаются во временную директорию, не проверяется принадлежность директории...

Проблема в Gnome lokkit

В конфигурации, при которой никакие сервисы не должны быть доступны все равно есть возможность получить доступ к нескольким портам...

Multiple Local Vulnerabilities in Helix Gnome Installer

Multiple Vulnerabilities In Helix Gnome Installer 0.2 VULNERABILITIES: The Helix installer contains multiple locally exploitable vulnerabilities. 1. Several of the gdmify functions are vulnerable to attack because they use system and /tmp in unsafe manners SuSE and Caldera A mkdir of the right pa...

Helix Code Security Advisory - Helix GNOME Update

HELIX CODE, INC. SECURITY ADVISORY [email protected] Issue Date: 20 Aug 2000 PACKAGES AFFECTED: Helix GNOME Updater helix-update, versions 0.1 through 0.5 SYNOPSIS: A vulnerability in Helix GNOME Update allow non-root users to exploit world-writable permissions on /tmp, permitting arbitraril...

Security update for Gnome-Lokkit

A bug has been found in the Gnome lokkit firewall package that could leave a few ports exposed when the user answered no to making any services visible to the outside world. Gnome-Lokkit 0.41 fixes this problem. Users should upgrade and regenerate their firewall rules...

Linux News 21.08.00

Linux 2.2.17pre19 Вышла новая pre-версия следующего стабильного ядра Linux: 2.2.17pre19. Подробнее: http://linuxtoday.com/newsstory.php3?ltsn=2000-08-18-012-04-NW-KN FreeAmp 2.1beta6 Вышла новая beta версия популярного mp3 проигрывателя FreeAmp - FreeAmp 2.1beta6. В этой версии пофиксено некоторо...

XFree86: libICE DoS

Hi, I've been sitting on this one for a while. SUMMARY ======= Due to inadequate bounds checking in libICE, a denial of service exists with any application using inet listening libICE for network services. Unfortunately, there is a fairly prominent user of libICE, namely gnome-session. The...

Gnome 1.01.1 Group X 11.0 XFree86 X11R6 3.3.x4.0 - Denial of Service

Gnome 1.01.1 Group X 11.0 XFree86 X11R6 3.3.x4.0 - Denial of Service // source: https://www.securityfocus.com/bid/1369/info A denial of service vulnerability exists in libICE, part of the X11 windowing system. Any libICE application which creates inet listening sockets can be remotely crashed. Th...

Gnome 1.0/1.1 / Group X 11.0 / XFree86 X11R6 3.3.x/4.0 - Denial of Service

// source: https://www.securityfocus.com/bid/1369/info A denial of service vulnerability exists in libICE, part of the X11 windowing system. Any libICE application which creates inet listening sockets can be remotely crashed. This is due to a bug in the handling of the SKIPSTRING macro. By...

Проблемы в нескольких утилитах из дистрибутива Mandrake

Переполнения буфера в xcdroast suidroot, gatos, xkobo, xbill, Gnome iagno,...

Linux news 30.05.00

Linux 2.4.0test1-ac4 Alan Cox выпустил четвертую модификацию ядра Linux 2.4.0test1. Подробнее: .kernel.org:/pub/linux/krernel/v2.4.0 Ошибка в PGP5.0 Найдена ошибка в комплекте программ PGP 5.0. Следует отметить, что эта ошибка работает только на утилитах, вызываемых из командной строки и только н...

CVE-2000-0358

ORBit and gnome-session in Red Hat Linux 6.1 allows remote attackers to crash a program...

CVE-2000-0491

Buffer overflow in the XDMCP parsing code of GNOME gdm, KDE kdm, and wdm allows remote attackers to execute arbitrary commands or cause a denial of service via a long FORWARDQUERY request...

CVE-2000-0358

CVE-2000-0358 affects ORBit and gnome-session in Red Hat Linux 6.1, where remote attackers can cause a crash in a program. The available descriptions consistently state vulnerability to crash without detailing exploit vectors, affected versions beyond Red Hat Linux 6.1, or concrete remediation st...

Удаленная дырка в gdm (Gnome)

Классическое переполнение буфера, позволяет получить привелегии root если gdm прослушивает порт UDP/177 по-умолчанию выключено в большинстве систем...

gdm 1.0.x2.0.x BETA2.2.0 - XDMCP Buffer Overflow (2)

gdm 1.0.x2.0.x BETA2.2.0 - XDMCP Buffer Overflow 2 // source: https://www.securityfocus.com/bid/1233/info A buffer overrun exists in the XDMCP handling code used in 'gdm', an xdm replacement, shipped as part of the GNOME desktop. By sending a maliciously crafted XDMCP message, it is possible for ...