[SECURITY] [DSA 1181-1] New gzip packages fix arbitrary code execution

-------------------------------------------------------------------------- Debian Security Advisory DSA 1181-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff September 19th, 2006 http://www.debian.org/security/faq -...

DSA-1181-1 gzip

Bulletin has no description...

[SA21615] ImageMagick XCF and Sun Rasterfile Buffer Overflows

TITLE: ImageMagick XCF and Sun Rasterfile Buffer Overflows SECUNIA ADVISORY ID: SA21615 VERIFY ADVISORY: http://secunia.com/advisories/21615/ CRITICAL: Moderately critical IMPACT: DoS, System access WHERE: From remote SOFTWARE: ImageMagick 6.x http://secunia.com/product/3763/ ImageMagick 5.x...

Slackware 10.0 / 10.1 / 10.2 / 9.0 / 9.1 / current : libtiff (SSA:2006-230-01)

New libtiff packages are available for Slackware 9.0, 9.1, 10.0, 10.1, 10.2, and -current to fix security issues. These issues could be used to crash programs linked to libtiff or possibly to execute code as the program's user. Thanks to Tavis Ormandy and the Google Security Team. %NASLMINLEVEL...

libtiff security update

CentOS Errata and Security Advisory CESA-2006:0603 Updated libtiff packages that fix several security flaws are now available for Red Hat Enterprise Linux. This update has been rated as having important security impact by the Red Hat Security Response Team. The libtiff package contains a library ...

USN-330-1: tiff vulnerabilities

Tavis Ormandy discovered that the TIFF library did not sufficiently check handled images for validity. By tricking an user or an automated system into processing a specially crafted TIFF image, an attacker could exploit these weaknesses to execute arbitrary code with the target application's...

USN-277-1: TIFF library vulnerabilities

Tavis Ormandy and Andrey Kiselev discovered that libtiff did not sufficiently verify the validity of TIFF files. By tricking an user into opening a specially crafted TIFF file with any application that uses libtiff, an attacker could exploit this to crash the application or even execute arbitrary...

Mandrake Linux Security Advisory : sash (MDKSA-2006:070)

Tavis Ormandy of the Gentoo Security Project discovered a vulnerability in zlib where a certain data stream would cause zlib to corrupt a data structure, resulting in the linked application to dump core CVE-2005-2096. Markus Oberhumber discovered additional ways that a specially crafted compresse...

USN-264-1: gnupg vulnerability

Tavis Ormandy discovered a flaw in gnupg's signature verification. In some cases, certain invalid signature formats could cause gpg to report a 'good signature' result for auxiliary unsigned data which was prepended or appended to the checked message part...

gnupg security update

CentOS Errata and Security Advisory CESA-2006:0266-01 An updated GnuPG package that fixes signature verification flaws as well as minor bugs is now available. This update has been rated as having important security impact by the Red Hat Security Response Team. GnuPG is a utility for encrypting da...

Fedora Core 4 : gnupg-1.4.2.2-1 (2006-147)

Tavis Ormandy discovered a flaw in the way GnuPG verifies cryptographically signed data with inline signatures. It is possible for an attacker to add unsigned text to a signed message in such a way so that when the signed text is extracted, the unsigned text is extracted as well, appearing as if ...

GLSA-200603-08 : GnuPG: Incorrect signature verification

The remote host is affected by the vulnerability described in GLSA-200603-08 GnuPG: Incorrect signature verification OpenPGP is the standard that defines the format of digital signatures supported by GnuPG. OpenPGP signatures consist of multiple sections, in a strictly defined order. Tavis Ormand...

Ubuntu 4.10 / 5.04 / 5.10 : gnupg vulnerability (USN-252-1)

Tavis Ormandy discovered a potential weakness in the signature verification of gnupg. gpgv and gpg --verify returned a successful exit code even if the checked file did not have any signature at all. The recommended way of checking the result is to evaluate the status messages, but some third-par...

USN-252-1: gnupg vulnerability

Tavis Ormandy discovered a potential weakness in the signature verification of gnupg. gpgv and gpg --verify returned a successful exit code even if the checked file did not have any signature at all. The recommended way of checking the result is to evaluate the status messages, but some third par...

[SECURITY] [DSA 978-1] New GnuPG packages fix invalid success return

-------------------------------------------------------------------------- Debian Security Advisory DSA 978-1 [email protected] http://www.debian.org/security/ Martin Schulze February 17th, 2006 http://www.debian.org/security/faq -...

Ubuntu 4.10 / 5.04 / 5.10 : sudo vulnerability (USN-235-2)

USN-235-1 fixed a vulnerability in sudo's handling of environment variables. Tavis Ormandy noticed that sudo did not filter out the PYTHONINSPECT environment variable, so that users with the limited privilege of calling a python script with sudo could still escalate their privileges. For referenc...

Ubuntu 4.10 / 5.04 : zlib vulnerability (USN-148-1)

Tavis Ormandy discovered that zlib did not properly verify data streams. Decompressing certain invalid compressed files caused corruption of internal data structures, which caused applications which link to zlib to crash. Specially crafted input might even have allowed arbitrary code execution...

Ubuntu 4.10 / 5.04 : binutils vulnerability (USN-136-1)

Tavis Ormandy found an integer overflow in the Binary File Descriptor BFD parser in the GNU debugger. The same vulnerable code is also present in binutils. By tricking an user into processing a specially crafted executable with the binutils tools strings, objdump, nm, readelf, etc., an attacker...

GLSA-200601-01 : pinentry: Local privilege escalation

The remote host is affected by the vulnerability described in GLSA-200601-01 pinentry: Local privilege escalation Tavis Ormandy of the Gentoo Linux Security Audit Team has discovered that the pinentry ebuild incorrectly sets the permissions of the pinentry binaries upon installation, so that the...

Ubuntu 4.10 / 5.04 : tiff vulnerability (USN-130-1)

Tavis Ormandy discovered a buffer overflow in the TIFF library. A malicious image with an invalid 'bits per sample' number could be constructed which, when decoded, would have resulted in execution of arbitrary code with the privileges of the process using the library. Since this library is used ...