Mandrake 6.1/7.0/7.1 /perl http Directory Disclosure Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/1678/info The default configuration files for versions of modperl shipped with Mandrake Linux 6.1 through 7.1 contain a misconfiguration that can be a security concern in some situations. The /perl directory is part of th...

Mandrake Linux Security Advisory : wu-ftpd (MDKSA-2000:014)

Wu-ftpd is vulnerable to a very serious remote attack in the SITE EXEC implementation. Because of user input going directly into a format string for a printf function, it is possible to overwrite important data, such as a return address, on the stack. When this is accomplished, the function can...

Mandrake Linux Security Advisory : slrn (MDKSA-2001:028)

A buffer overflow exists in versions of the slrn news reader prior to 0.9.6.3pl4 as reported by Bill Nottingham. This problem exists in the wrapping/unwrapping functions and a long header in a message might overflow a buffer which could result in execution of arbitrary code encoded in the message...

Mandrake Linux Security Advisory : mgetty (MDKSA-2001:009)

WireX discovered a potential temporary file race condition in the mgetty program. All versions of mgetty prior to 1.1.24 are vulnerable. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Mandrake Linux Security Advisory...

Mandrake Linux Security Advisory : mod_php3 (MDKSA-2000:062)

PHP version 3 which ships with Linux-Mandrake are vulnerable to format string attacks due to logging functions that make improper use of the syslog and vsnprintf functions. This renders PHP3-enabled servers vulnerable to compromise by remote attackers. This attack is only effective on PHP...

Mandrake Linux Security Advisory : xlockmore (MDKSA-2000:038)

A bug exists in previous versions of xlockmore with display name passing '%d' as the display name. This bug is corrected in this version. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Mandrake Linux Security Advisor...

Mandrake Linux Security Advisory : xpdf (MDKSA-2005:043)

Previous updates to correct integer overflow issues affecting xpdf overlooked certain conditions when built for a 64 bit platform. formerly CVE-2004-0888. This also affects applications that use embedded versions of xpdf. The updated packages are patched to deal with these issues. %NASLMINLEVEL...

Mandrake Linux Security Advisory : squid (MDKSA-2001:003)

WireX discovered a potential temporary file race condition in the way that squid sends out email messages notifying the administrator about updating the program. Usually this will only happen if you are running a development version of squid or if the clock on your system is incorrect. This probl...

Mandrake Linux Security Advisory : nss_ldap (MDKSA-2000:066-1)

A race condition exists in versions of nssldap prior to version 121. On a system running nscd, a malicious user can cause the system to hang. Update : Due to a new packaging scheme, the updates have been re-released with the appropriate revision number. %NASLMINLEVEL 70300 C Tenable Network...

Mandrake Linux Security Advisory : bind (MDKSA-2002:043)

A buffer overflow vulnerability exists in different implementations of the DNS resolver libraries. A remote attacker able to sent malicious DNS responses could potentially exploit this vulnerability to execute arbitrary code or cause a DoS Denial of Service on a vulnerable system. The named daemo...

Mandrake Linux Security Advisory : tmpwatch (MDKSA-2000:056)

Previous versions of tmpwatch contained a local denial of service and root exploits. This is due to using the fork command to recursively process subdirectories which would allow a local user to perform a denial of service attack. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descripti...

Mandrake Linux Security Advisory : xchat (MDKSA-2000:039-1)

XChat 1.3.9 and later allow users to right-click on a URL appearing in an IRC discussion and select the 'Open in Browser' option. To open the URL in a browser, XChat passes the command to /bin/sh. This allows a malicious URL the ability to execute arbitrary shell commands as the user that is...

Mandrake Linux Security Advisory : kon2 (MDKSA-2000:028)

There is a vulnerable suid program called fld. This program accepts option input from a text file and it is possible to input arbitrary code into the stack, thus spawning a root shell. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were...

Mandrake Linux Security Advisory : timed (MDKSA-2001:034)

The time server daemon, timed, tries to synchronize the local host time with the time of other machines on a local area network. A bug in timed, as reported by the FreeBSD Security Officer, that could be triggered remotely can crash the time server daemon. %NASLMINLEVEL 70300 C Tenable Network...

Mandrake Linux Security Advisory : xinetd (MDKSA-2002:053)

A vulnerability was discovered by Solar Designer in xinetd. File descriptors for the signal pipe that were introduced in version 2.3.4 are leaked into services started by xinetd, which can then be used to talk to xinetd, resulting in a crash of xinetd. %NASLMINLEVEL 70300 C Tenable Network...

Mandrake Linux Security Advisory : inn (MDKSA-2000:023)

A vulnerability exists when verifycancels is enabled in /etc/news/inn.conf. This vulnerability could be used to gain root access on any system with inn installed. This new version also does not install inews as setgid news or rnews as setuid root. Many other security paranoia fixes have been made...

Mandrake Linux Security Advisory : openldap (MDKSA-2000:003)

OpenLDAP follows symbolic links when creating files. The default location for these files is /usr/tmp, which is a symlink to /tmp, which in turn is a world-writable directory. Local users can destroy the contents of any file on any mounted filesystem. %NASLMINLEVEL 70300 C Tenable Network Securit...

Mandrake Linux Security Advisory : ghostscript (MDKSA-2000:074)

The ghostscript package uses mktemp instead of mkstemp to create temporary files. It also uses improper LDRUNPATH values, which causes it to search for libraries in the current directory. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin...

Mandrake Linux Security Advisory : Zope (MDKSA-2000:086)

A potential security issue exists in versions of Zope up to and including 2.2.4. This issue involves incorrect protection of a data updating method on Image and File objects. Because the method was not correctly protected, it was possible for users with DTML editing privileges to update the raw...

Mandrake Linux Security Advisory : gnupg (MDKSA-2000:087)

When importing keys from public key servers, GnuPG will import private keys also known as secret keys in addition to public keys. If this happens, the user's web of trust becomes corrupt. Additionally, when used to check detached signatures, if the data file being checked contains clearsigned dat...