10033 matches found
CVE-2005-0205
KPPP 2.1.2 in KDE 3.1.5 and earlier, when setuid root without certain wrappers, does not properly close a privileged file descriptor for a domain socket, which allows local users to read and write to /etc/hosts and /etc/resolv.conf and gain control over DNS name resolution by opening a number of...
CVE-2005-0587: Improper Link Resolution Before File Access
Firefox before 1.0.1 and Mozilla before 1.7.6 allows remote malicious web sites to overwrite arbitrary files by tricking the user into downloading a .LNK link file twice, which overwrites the file that was referenced in the first .LNK file...
iDEFENSE Security Advisory 02.28.05: KPPP Privileged File Descriptor Leak Vulnerability
KPPP Privileged File Descriptor Leak Vulnerability iDEFENSE Security Advisory 02.28.05 www.idefense.com/application/poi/display?id=208&type=vulnerabilities February 28, 2005 I. BACKGROUND KPPP is a dialer and front end for pppd. It allows for interactive script generation and network setup. More...
OpenMotif: Multiple vulnerabilities in libXpm
Background OpenMotif provides a free version of the Motif toolkit for open source applications. Description Multiple vulnerabilities, such as buffer overflows, out of bounds memory access or directory traversals, have been discovered in libXpm that is shipped as a part of the X Window System see...
FireHOL: Insecure temporary file creation
Background FireHOL is an iptables rules generator. Description FireHOL insecurely creates temporary files with predictable names. Impact A local attacker could create malicious symbolic links to arbitrary system files. When FireHOL is executed, this could lead to these files being overwritten wit...
Gallery: Cross-site scripting vulnerability
Background Gallery is a web application written in PHP which is used to organize and publish photo albums. It allows multiple users to build and maintain their own albums. It also supports the mirroring of images on other servers. Description Rafel Ivgi has discovered a cross-site scripting...
Perl: rmtree and DBI tmpfile vulnerabilities
Background Perl is a cross platform programming language. The DBI is the standard database interface module for Perl. Description Javier Fernandez-Sanguino Pena discovered that the DBI library creates temporary files in an insecure, predictable way CAN-2005-0077. Paul Szabo found out that...
Exim buffer overflows
Buffer overflows on SPA-authentications and IPv6 names resolution...
RHEL 3 : xpdf (RHSA-2005:018)
Updated Xpdf packages that fix several security issues are now available. Xpdf is an X Window System based viewer for Portable Document Format PDF files. A buffer overflow flaw was found in the Gfx::doImage function of Xpdf. An attacker could construct a carefully crafted PDF file that could caus...
Mozilla, Firefox, Thunderbird: Various vulnerabilities
Background Mozilla is a popular web browser that includes a mail and newsreader. Mozilla Firefox and Mozilla Thunderbird are respectively the next-generation browser and mail client from the Mozilla project. Description Maurycy Prodeus from isec.pl found a potentially exploitable buffer overflow ...
Fcron: Multiple vulnerabilities
Background Fcron is a command scheduler with extended capabilities over cron and anacron. Description Due to design errors in the fcronsighup program, Fcron may allow a local user to bypass access restrictions CAN-2004-1031, view the contents of root owned files CAN-2004-1030, remove arbitrary...
USN-10-1: XML library vulnerabilities
Several buffer overflows have been discovered in libxml2's FTP connection and DNS resolution functions. Supplying very long FTP URLs or IP addresses might result in execution of arbitrary code with the privileges of the process using libxml2. Since libxml2 is used in packages like php4-imagick, t...
inetutils tftp client buffer overflow
Buffer overflow during name resolution...
libxml2 multiple buffer overflows
Buffer overflow on URL parsing, name resolution...
libxml2 remote buffer overflows (not in xml parsing code though)
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Subject: libXML remotely exploitable buffer overflows. +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Product Description: Libxml2 is the XML C parser and toolkit developed for the Gno...
[Security Bulletin] SSRT4807 HP-UX stmkfont local unauthorized privileged access
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 HP SECURITY BULLETIN HPSBUX01088 REVISION: 0 SSRT4807 rev.0 HP-UX stmkfont local unauthorized privileged access NOTICE: There are no restrictions for distribution of this Bulletin provided that it remains complete and intact. The information in this...
Ghostscript: Insecure temporary file use in multiple scripts
Background Ghostscript is a software package providing an interpreter for the PostScript language and the PDF file format. It also provides output drivers for various file formats and printers. Description The pj-gs.sh, ps2epsi, pv.sh and sysvlp.sh scripts create temporary files in world-writeabl...
WordPress: HTTP response splitting and XSS vulnerabilities
Background WordPress is a PHP and MySQL based content management and publishing system. Description Due to the lack of input validation in the administration panel scripts, WordPress is vulnerable to HTTP response splitting and cross-site scripting attacks. Impact A malicious user could inject...
CUPS: Leakage of sensitive information
Background The Common UNIX Printing System CUPS is a cross-platform print spooler. Description When printing to a SMB-shared printer requiring authentication, CUPS leaks the user name and password to a logfile. Impact A local user could gain knowledge of sensitive authentication data. Workaround...
NetKit-telnetd: buffer overflows in telnet and telnetd
Background NetKit-telnetd is a standard Linux telnet client and server from the NetKit utilities. Description A possible buffer overflow exists in the parsing of option strings by the telnet daemon, where proper bounds checking is not applied when writing to a buffer. Additionaly, another possibl...