FreeBSD : tiff -- RLE decoder heap overflows (f6680c03-0bd8-11d9-8a8a-000c41e2cdad)

Chris Evans discovered several heap buffer overflows in libtiff's RLE decoder. These overflows could be triggered by a specially crafted TIFF image file, resulting in an application crash and possibly arbitrary code execution. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive...

FreeBSD : mozilla -- multiple heap buffer overflows (93d6162f-1153-11d9-bc4a-000c41e2cdad)

Several heap buffer overflows were discovered and fixed in the most recent versions of Mozilla, Firefox, and Thunderbird. These overflows may occur when : - Using the 'Send Page' function. - Checking mail on a malicious POP3 server. - Processing non-ASCII URLs. Each of these vulnerabilities may b...

FreeBSD : libxine -- multiple buffer overflows in RTSP (1b70bef4-649f-11d9-a30e-000a95bc6fae)

A xine security announcement states : Multiple vulnerabilities have been found and fixed in the Real-Time Streaming Protocol RTSP client for RealNetworks servers, including a series of potentially remotely exploitable buffer overflows. This is a joint advisory by the MPlayer and xine teams as the...

FreeBSD : imlib -- xpm heap buffer overflows and integer overflows (2001103a-6bbd-11d9-851d-000a95bc6fae)

Pavel Kankovsky reports : Imlib affected by a variant of CAN-2004-0782 too. I've discovered more vulnerabilities in Imlib 1.9.13. In particular, it appears to be affected by a variant of Chris Evans' libXpm flaw 1 CAN-2004-0782, see http://scary.beasts.org/security/CESA-2004-003.txt. Look at the...

FreeBSD : mplayer -- multiple vulnerabilities (85d76f02-5380-11d9-a9e7-0001020eed82)

iDEFENSE and the MPlayer Team have found multiple vulnerabilities in MPlayer : - Potential heap overflow in Real RTSP streaming code - Potential stack overflow in MMST streaming code - Multiple buffer overflows in BMP demuxer - Potential heap overflow in pnm streaming code - Potential buffer...

FreeBSD : postgresql -- multiple buffer overflows in PL/PgSQL parser (6b4b0b3f-8127-11d9-a9e7-0001020eed82)

The PL/PgSQL parser in postgresql is vulnerable to several buffer overflows. These could be exploited by a remote attacker to execute arbitrary code with the permissions of the postgresql server by running a specially crafted query. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

FreeBSD : rockdodger -- buffer overflows (2b4d5288-447e-11d9-9ebb-000854d03344)

The environment variable HOME is copied without regard to buffer size, which can be used to gain elevated privilege if the binary is installed setgid games, and a string is read from the high score file without bounds check. The port installs the binary without setgid, but with a world-writable...

FreeBSD : mozilla -- BMP decoder vulnerabilities (ab9c559e-115a-11d9-bc4a-000c41e2cdad)

Gael Delalleau discovered several integer overflows in Mozilla's BMP decoder that can result in denial-of-service or arbitrary code execution. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database...

FreeBSD : xview -- multiple buffer overflows in xv_parse_one (ae6ec9b8-2f43-4d02-8129-c6a3a53ef09d)

A Debian Security Advisory reports : Erik Sjolund discovered that programs linked against xview are vulnerable to a number of buffer overflows in the XView library. When the overflow is triggered in a program which is installed setuid root a malicious user could perhaps execute arbitrary code as...

FreeBSD : kstars -- exploitable set-user-ID application fliccd (0512b761-70fb-40d3-9954-aa4565528fa8)

A KDE Security Advisory explains : Overview KStars includes support for the Instrument Neutral Distributed Interface INDI. The build system of this extra 3rd party software contained an installation hook to install fliccd part of INDI as SUID root application. Erik Sjolund discovered that the cod...

Slackware 8.1 / 9.0 / 9.1 / current : metamail security update (SSA:2004-049-02)

Metamail is a set of utilities for processing MIME mail. New metamail packages are available for Slackware 8.1, 9.0, 9.1, and -current. These fix two format string bugs and two buffer overflows which could lead to unauthorized code execution. Thanks to Ulf Hrnhammar for discovering these problems...

FreeBSD : gaim -- multiple buffer overflows (4260eacb-26b8-11d9-9289-000c41e2cdad)

Sean infamous42md reports several situations in gaim that may result in exploitable buffer overflows : - Rich Text Format RTF messages in Novell GroupWise protocol - Unsafe use of gethostbyname in zephyr protocol - URLs which are over 2048 bytes long once decoded %NASLMINLEVEL 70300 C Tenable...

FreeBSD : xshisen -- local buffer overflows (56971fa6-641c-11d9-a097-000854d03344)

Steve Kemp has found buffer overflows in the handling of the command line flag -KCONV and the XSHISENLIB environment variable. Ulf Harnhammer has detected an unbounded copy from the GECOS field to a char array. All overflows can be exploited to gain group games privileges. %NASLMINLEVEL 70300 C...

FreeBSD : zgv -- exploitable heap overflows (249a8c42-6973-11d9-ae49-000c41e2cdad)

infamous41md reports : zgv uses malloc frequently to allocate memory for storing image data. When calculating how much to allocate, user-supplied data from image headers is multiplied and/or added without any checks for arithmetic overflows. We can overflow numerous calculations, and cause small...

Mandrake Linux Security Advisory : mplayer (MDKSA-2005:115)

Two heap overflows were discovered in mplayer's code handling the RealMedia RTSP and Microsoft Media Services streams over TCP MMST. These vulnerabilities could allow for a malicious server to execute arbitrary code on the client computer with the permissions of the user running MPlayer. The...

CVE-2004-2167

Multiple buffer overflows in LaTeX2rtf 1.9.15, and possibly other versions, allow remote attackers to execute arbitrary code via 1 the expandmacro function, and possibly 2 Environments and 3 TranslateCommand...

CVE-2004-2159

Technical details about CVE-2004-2159 are not publicly provided in the supplied documents; monitor for updates.

CVE-2004-2167

Multiple buffer overflows in LaTeX2rtf 1.9.15, and possibly other versions, allow remote attackers to execute arbitrary code via 1 the expandmacro function, and possibly 2 Environments and 3 TranslateCommand...

CVE-2004-2159

Multiple buffer overflows in XMLStarlet Command Line XML Toolkit 0.9.3 have unknown impact and attack vectors via 1 xmlelem.c and 2 xmlselect.c...

[SECURITY] [DSA 743-1] New ht packages fix arbitrary code execution

-------------------------------------------------------------------------- Debian Security Advisory DSA 743-1 [email protected] http://www.debian.org/security/ Martin Schulze July 8th, 2005 http://www.debian.org/security/faq -...