Debian DSA-3794-1 : munin - security update

Stevie Trujillo discovered a local file write vulnerability in munin, a network-wide graphing framework, when CGI graphs are enabled. GET parameters are not properly handled, allowing to inject options into munin-cgi-graph and overwriting any file accessible by the user running the cgi-process...

Munin Resource Monitoring < 2.0.6 Multiple Vulnerabilities

Binary data 6948.prm...

Mandriva Linux Security Advisory : munin (MDVSA-2013:105)

Updated munin packages fix security vulnerabilities : The qmailscan plugin for Munin before 2.0 rc6 allows local users to overwrite arbitrary files via a symlink attack on temporary files with predictable names CVE-2012-2103. Munin before 2.0.6 stores plugin state files that run as root in the sa...

DEBIAN-CVE-2012-3513

munin-cgi-graph in Munin before 2.0.6, when running as a CGI module under Apache, allows remote attackers to load new configurations and create files in arbitrary directories via the logdir command...

Code injection

munin-cgi-graph for Munin 2.0 rc4 does not delete temporary files, which allows remote attackers to cause a denial of service disk consumption via many requests to an image with unique parameters...

CVE-2012-2147

munin-cgi-graph in Munin 2.0 rc4 allows remote attackers to cause a denial of service disk or memory consumption via many image requests with large values in the 1 sizex or 2 sizey parameters...

CVE-2012-4678

CVE‑2012‑4678 affects munin-cgi-graph in Munin 2.0 rc4. Root cause: it does not delete temporary files, allowing remote attackers to cause DoS via many requests to an image with unique parameters. Public documents do not specify a patch/workaround or explicit exploit details.

CVE-2012-4678

munin-cgi-graph for Munin 2.0 rc4 does not delete temporary files, which allows remote attackers to cause a denial of service disk consumption via many requests to an image with unique parameters...

CVE-2012-2104

cgi-bin/munin-cgi-graph in Munin 2.x writes data to a log file without sanitizing non-printable characters, which might allow user-assisted remote attackers to inject terminal emulator escape sequences and execute arbitrary commands or delete arbitrary files via a crafted HTTP request...