[SECURITY] [DSA 694-1] New xloadimage packages fix several vulnerabilities

-------------------------------------------------------------------------- Debian Security Advisory DSA 694-1 [email protected] http://www.debian.org/security/ Martin Schulze March 21st, 2005 http://www.debian.org/security/faq -...

GLSA-200503-12 : Hashcash: Format string vulnerability

The remote host is affected by the vulnerability described in GLSA-200503-12 Hashcash: Format string vulnerability Tavis Ormandy of the Gentoo Linux Security Audit Team identified a flaw in the Hashcash utility that an attacker could expose by specifying a malformed reply address. Impact :...

xloadimage -- arbitrary command execution when handling compressed files

Tavis Ormandy discovered that xli and xloadimage attempt to decompress images by piping them through gunzip or similar decompression tools. Unfortunately, the unsanitized file name is included as part of the command. This is dangerous, as in some situations, such as mailcap processing, an attacke...

GLSA-200502-26 : GProFTPD: gprostats format string vulnerability

The remote host is affected by the vulnerability described in GLSA-200502-26 GProFTPD: gprostats format string vulnerability Tavis Ormandy of the Gentoo Linux Security Audit Team has identified a format string vulnerability in the gprostats utility. Impact : An attacker could exploit the...

xli -- integer overflows in image size calculations

Tavis Ormandy discovered several integer overflows in xli's image size handling. A maliciously crafted image may be able to cause a heap buffer overflow and execute arbitrary code...