CVE-2002-0761

CVE-2002-0761 affects bzip2 before 1.0.2 on FreeBSD (4.5 and earlier) and OpenLinux (3.1 and 3.1.1). The issue arises when creating an archive: bzip2 honors the permissions of the symbolic link rather than those of the target file, which could cause files to be extracted with less restrictive per...

CVE-2002-0761

bzip2 before 1.0.2 in FreeBSD 4.5 and earlier, OpenLinux 3.1 and 3.1.1, and possibly systems, uses the permissions of symbolic links instead of the actual files when creating an archive, which could cause the files to be extracted with less restrictive permissions than intended...

CVE-2002-0512

The CVE-2002-0512 entry describes a local privilege escalation in KDE’s startkde (Caldera OpenLinux 2.3–3.1.1). The root cause is that LD_LIBRARY_PATH is set to include the current working directory, allowing a local attacker to influence loaded libraries (Trojan horse libraries) and potentially ...

CVE-2002-0759

CVE-2002-0759 affects bzip2 prior to 1.0.2, notably in FreeBSD 4.5 and earlier and OpenLinux 3.1/3.1.1. The issue is that bzip2 does not use the O_EXCL flag to create files during decompression and does not warn if an existing file would be overwritten. This could allow an attacker to overwrite f...

CVE-2002-0759

bzip2 before 1.0.2 in FreeBSD 4.5 and earlier, OpenLinux 3.1 and 3.1.1, and possibly other operating systems, does not use the OEXCL flag to create files during decompression and does not warn the user if an existing file would be overwritten, which could allow attackers to overwrite files via a...

CVE-2002-0760

Race condition in bzip2 before 1.0.2 in FreeBSD 4.5 and earlier, OpenLinux 3.1 and 3.1.1, and possibly other operating systems, decompresses files with world-readable permissions before setting the permissions to what is specified in the bzip2 archive, which could allow local users to read the...

CVE-2002-0511

The default configuration of Name Service Cache Daemon nscd in Caldera OpenLinux 3.1 and 3.1.1 uses cached PTR records instead of consulting the authoritative DNS server for the A record, which could make it easier for remote attackers to bypass applications that restrict access based on host nam...

CVE-2002-0761: Undefined Security Weakness

bzip2 before 1.0.2 in FreeBSD 4.5 and earlier, OpenLinux 3.1 and 3.1.1, and possibly systems, uses the permissions of symbolic links instead of the actual files when creating an archive, which could cause the files to be extracted with less restrictive permissions than intended...

CVE-2002-0759: Undefined Security Weakness

bzip2 before 1.0.2 in FreeBSD 4.5 and earlier, OpenLinux 3.1 and 3.1.1, and possibly other operating systems, does not use the OEXCL flag to create files during decompression and does not warn the user if an existing file would be overwritten, which could allow attackers to overwrite files via a...

CVE-2002-0760: Undefined Security Weakness

Race condition in bzip2 before 1.0.2 in FreeBSD 4.5 and earlier, OpenLinux 3.1 and 3.1.1, and possibly other operating systems, decompresses files with world-readable permissions before setting the permissions to what is specified in the bzip2 archive, which could allow local users to read the...

CVE-2002-0511: Undefined Security Weakness

The default configuration of Name Service Cache Daemon nscd in Caldera OpenLinux 3.1 and 3.1.1 uses cached PTR records instead of consulting the authoritative DNS server for the A record, which could make it easier for remote attackers to bypass applications that restrict access based on host nam...

Sun XDR Library xdrmem_getbytes() Integer Overflow Vulnerability

Description A vulnerability has been discovered in the Sun XDR library. Specifically, an integer overflow as been found in the xdrmemgetbytes function. As a result, applications implementing the vulnerable library call may be prone to denial of service attacks. It should be noted that the...

Security Update: [CSSA-2003-002.0] Linux: Webmin Cross-site Scripting and Session ID Spoofing Vulnerabilities

To: [email protected] [email protected] [email protected] [email protected] SCO Security Advisory Subject: Linux: Webmin Cross-site Scripting and Session ID Spoofing Vulnerabilities Advisory number: CSSA-2003-002.0 Issue date: 2003 January 09 Cross...

Security Update: [CSSA-2003-007.0] Linux: Apache mod_dav module format string vulnerability

To: [email protected] [email protected] [email protected] [email protected] SCO Security Advisory Subject: Linux: Apache moddav module format string vulnerability Advisory number: CSSA-2003-007.0 Issue date: 2003 February 17 Cross reference: 1...

Security Update: [CSSA-2002-048.0] Linux: wwwoffled remote access vulnerability

To: [email protected] [email protected] [email protected] [email protected] SCO Security Advisory Subject: Linux: wwwoffled remote access vulnerability Advisory number: CSSA-2002-048.0 Issue date: 2002 November 18 Cross reference: 1. Problem...

CVE-2002-0760

Race condition in bzip2 before 1.0.2 in FreeBSD 4.5 and earlier, OpenLinux 3.1 and 3.1.1, and possibly other operating systems, decompresses files with world-readable permissions before setting the permissions to what is specified in the bzip2 archive, which could allow local users to read the...

CVE-2002-0511

The default configuration of Name Service Cache Daemon nscd in Caldera OpenLinux 3.1 and 3.1.1 uses cached PTR records instead of consulting the authoritative DNS server for the A record, which could make it easier for remote attackers to bypass applications that restrict access based on host nam...

CVE-2001-0850

A configuration error in the libdb1 package in OpenLinux 3.1 uses insecure versions of the snprintf and vsnprintf functions, which could allow local or remote users to exploit those functions with a buffer overflow...

CVE-2001-0850

The CVE-2001-0850 entry concerns a configuration error in the libdb1 package of OpenLinux 3.1. The vulnerability arises from insecure versions of snprintf and vsnprintf used by libdb1, which could allow local or remote users to trigger a buffer overflow. Affected software: OpenLinux 3.1 (libdb1)....

CVE-2001-0850: Undefined Security Weakness

A configuration error in the libdb1 package in OpenLinux 3.1 uses insecure versions of the snprintf and vsnprintf functions, which could allow local or remote users to exploit those functions with a buffer overflow...