Linux kernel RDS protocol vulnerability

Overview The RDS protocol implementation of Linux kernels 2.6.30 through 2.6.38-rc8 contain a local privilege escalation vulnerability. Description Kernel functions fail to properly check if a user supplied address exists in the user segment of memory. By providing a kernel address to a socket ca...

Mozilla Firefox Floating Point Conversion Heap Overflow Vulnerability

Exploit for unknown platform in category remote exploits ===================================================================== Mozilla Firefox Floating Point Conversion Heap Overflow Vulnerability ===================================================================== Vulnerable: VMWare vMA 4.0...

OpenSSL 'EVP_VerifyFinal'函数签名验证漏洞

BUGTRAQ ID: 33150 CVE ID：CVE-2008-5077 CNCVE ID：CNCVE-20085077 OpenSSL是一款开放源码的SSL实现，用来实现网络通信的高强度加密。 部分OpenSSL函数验证DSA和ECDSA密钥时不正确验证"EVPVerifyFinal"函数返回值，发送特殊构建的签名证书链给客户端，可绕过签名检查。 通过恶意服务器或中间人攻击，可使证书链中的畸形SSL/TLS签名绕过客户端软件检查，导致盲目信任并泄漏敏感信息。 成功利用此漏洞需要服务器使用包含DSA或者ECDSA密钥的证书。 Ubuntu Ubuntu Linux 8.10 spar...

PHP 'chdir()' and 'ftok()' 安全模式绕过漏洞

PHP' safemode‘设置的限制绕过漏洞。成功的攻击可能允许攻击者以确定存在的档案在未经批准的地点;其他攻击也是可能的。 开发这些问题可以让攻击者获得敏感的数据，可用于在其他的攻击。 这些弱点将是一个问题的共同主办的配置在多个用户可以创建并执行任意PHP脚本代码;在这种情况下， ' safemode设置'的限制， PHP的5.2.6是受影响的;其他版本也可能受到影响。 Slackware Linux 12.1 Slackware Linux 12.0 Slackware Linux -current PHP PHP 5.2.6 PHP PHP 5.2.5 PHP PHP 5.2.4...

PHP FastCGI模块文件扩展拒绝服务漏洞

BUGTRAQ ID: 31612 CVE ID：CVE-2008-3660 CNCVE ID：CNCVE-20083660 PHP FastCGI是一款用于提高PHP性能的模块。 PHP FastCGI不正确处理部分文件请求，远程攻击者可以利用漏洞对应用程序进行拒绝服务攻击。 1，ext/gd's imageloadfont函数存在溢出。 2，PHP内部memnstr函数作为explode函数导出到用户空间存在溢出。 这些函数接收部分webapps中用户提供的数据，可远程利用。 S.u.S.E. UnitedLinux 1.0 S.u.S.E. SuSE Linux Standard...

Links 'only proxies'存在未明安全漏洞

BUGTRAQ ID: 30422 CVE ID：CVE-2008-3329 CNCVE ID：CNCVE-20083329 Links是一款基于文本的支持HTML和帧的浏览器。 Links "only proxies"功能存在未明安全问题，远程攻击者可以利用漏洞传递恶意URL给外部程序。 目前没有详细漏洞细节提供。 Slackware Linux 12.1 Slackware Linux 12.0 Slackware Linux 11.0 Slackware Linux -current Links Links 2.1pre25 Links Links 2.1 pre26 Links...

Slackware 10.0 / 10.1 / 10.2 / 11.0 / 12.0 / 12.1 / current : samba (SSA:2008-149-01)

New samba packages are available for Slackware 10.0, 10.1, 10.2, 11.0, 12.0, 12.1, and -current to fix a security issue: 'Specifically crafted SMB responses can result in a heap overflow in the Samba client code. Because the server process, smbd, can itself act as a client during operations such ...

Slackware 10.0 / 10.1 / 10.2 / 11.0 / 12.0 / current : samba (SSA:2007-344-01)

New samba packages are available for Slackware 10.0, 10.1, 10.2, 11.0, 12.0, and -current to fix a security issue. A boundary failure in GETDC mailslot processing can result in a buffer overrun leading to possible code execution. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptiv...

PHP 5.2.4及之前版本存在多个漏洞

PHP是一款流行的网络编程语言。 PHP存在多个安全问题，远程攻击者可以利用漏洞进行缓冲区溢出，拒绝服务，和安全绕过攻击。 -dl处理文件名存在问题，可导致跨站脚本攻击。 -dl处理MAXPATHLEN参数大小存在问题，可导致拒绝服务攻击。 -tmlentities/htmlspecialchars处理部分多字节序列存在问题。 -fnmatch, setlocale和glob函数的glibc实现存在缓冲区溢出。 Slackware Linux 10.2 Slackware Linux 10.1 Slackware Linux 12.0 Slackware Linux 11.0...

Slackware current : thunderbird (SSA:2007-165-01)

A new thunderbird package is available for Slackware -current to fix two possible security issues. This package may also be used on many older versions of Slackware though we're not certain how far back... %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package check...

GNU Locate旧格式locate数据库本地缓冲区溢出漏洞

GNU locate是可以在文件数据库里搜索那些匹配用户提供的文件名的程序。 GNU locate读取旧格式locate数据库的文件名存在缓冲区溢出，本地攻击者可以利用漏洞以应用程序权限执行任意指令。 当GNU locate读取旧格式locate数据库的文件名时会拷贝到分配在堆上的固定缓冲区中，文件名超过1026字节可导致缓冲区溢出，溢出的数据可以由用户选择来控制建立本地系统上的文件名。 GNU findutils 4.2.30 + Slackware Linux 8.0 + Slackware Linux 7.1 GNU findutils 4.2.29 + Slackware Lin...

PHP EXT/Session HTTP应答头注入漏洞

PHP是一款广泛使用的WEB开发脚本语言。 PHP的ext/session在置于会话COOKIE前没有URL编码会话ID，远程攻击者可以利用漏洞可以对会话COOKIE进行注入攻击。 当PHP' ext/session调用sessionstart，会在部分情况下发送新会话COOKIE，这些情况如下： - session id嵌入到PATHINFO - session id重生成 - session id通过sessionid设置 - sessionstart多次调用...

PHP Imap_Mail_Compose()函数缓冲区溢出漏洞

BUGTRAQ ID: 23234 PHP是广泛使用的通用目的脚本语言，特别适合于Web开发，可嵌入到HTML中。 PHP的imapmailcompose函数实现上存在缓冲区溢出漏洞，本地攻击者可能利用此漏洞提升权限。 imapmailcompose函数在名为tmp的栈缓冲区中创建固定大小的多部邮件： PHPFUNCTIONimapmailcompose ... char tmp8 MAILTMPLEN, mystring=NULL, t=NULL, tempstring=NULL;...

Slackware 10.0 / 10.1 / 10.2 / 11.0 / 9.0 / 9.1 : gnupg (SSA:2007-066-01)

New gnupg packages are available for Slackware 9.0, 9.1, 10.0, 10.1, 10.2, and 11.0 to fix security ramifications of incorrect gpg usage. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Slackware Security Advisory...

CVE-2007-0823

xterm on Slackware Linux 10.2 stores information that had been displayed for a different user account using the same xterm process, which might allow local users to bypass file permissions and read other users' files, or obtain other sensitive information, by reading the xterm process memory. NOT...

CVE-2007-0822

umount, when running with the Linux 2.6.15 kernel on Slackware Linux 10.2, allows local users to trigger a NULL dereference and application crash by invoking the program with a pathname for a USB pen drive that was mounted and then physically removed, which might allow the users to obtain sensiti...

Design/Logic Flaw

xterm on Slackware Linux 10.2 stores information that had been displayed for a different user account using the same xterm process, which might allow local users to bypass file permissions and read other users' files, or obtain other sensitive information, by reading the xterm process memory. NOT...

CVE-2007-0823

CVE-2007-0823 affects xterm on Slackware Linux 10.2, where information displayed to one user could remain in the same xterm process memory and be readable by subsequent users sharing that interactive process. This could allow local users to bypass file permissions and obtain sensitive information...

CVE-2007-0822

umount, when running with the Linux 2.6.15 kernel on Slackware Linux 10.2, allows local users to trigger a NULL dereference and application crash by invoking the program with a pathname for a USB pen drive that was mounted and then physically removed, which might allow the users to obtain sensiti...

CVE-2007-0823

xterm on Slackware Linux 10.2 stores information that had been displayed for a different user account using the same xterm process, which might allow local users to bypass file permissions and read other users' files, or obtain other sensitive information, by reading the xterm process memory. NOT...