Moderate: Red Hat Security Advisory: libxml2 security update

An updated libxml2 package that fixes multiple buffer overflows is now available. libxml2 is a library for manipulating XML files. Multiple buffer overflow bugs have been found in libxml2 versions prior to 2.6.14. If an attacker can trick a user into passing a specially crafted FTP URL or FTP pro...

Linux kernel USB drivers do not initialize kernel memory properly

Overview Various Linux USB drivers contain an information disclosure vulnerability that may expose sensitive segments of kernel memory to users. Description USB drivers for several versions the Linux kernel do not properly initialize kernel memory before using it. When an affected USB driver copi...

Moderate: Red Hat Security Advisory: XFree86 security update

Updated XFree86 packages that fix several security issues in libXpm, as well as other bug fixes, are now available for Red Hat Enterprise Linux 2.1. XFree86 is an open source implementation of the X Window System. It provides the basic low level functionality which full fledged graphical user...

Low: Red Hat Security Advisory: ruby security update

An updated ruby package that fixes insecure file permissions for CGI session files is now available. Ruby is an interpreted scripting language for object-oriented programming. Andres Salomon reported an insecure file permissions flaw in the CGI session management of Ruby. FileStore created world...

Debian DSA-280-1 : samba - buffer overflow

Digital Defense, Inc. has alerted the Samba Team to a serious vulnerability in Samba, a LanManager-like file and printer server for Unix. This vulnerability can lead to an anonymous user gaining root access on a Samba serving system. An exploit for this problem is already circulating and in use...

Important: Red Hat Security Advisory: gdk-pixbuf security update

Updated gdk-pixbuf packages that fix several security flaws are now available. The gdk-pixbuf package contains an image loading library used with the GNOME GUI desktop environment. Updated 15th September 2004 Packages have been updated to correct a bug which caused the xpm loader to fail. During...

Fedora Core 1 : kdebase-3.1.4-7 (2004-292)

Andrew Tuitt reported that versions of KDE up to and including 3.2.3 create temporary directories with predictable names. A local attacker could prevent KDE applications from functioning correctly, or overwrite files owned by other users by creating malicious symlinks. The Common Vulnerabilities...

Moderate: Red Hat Security Advisory: rsync security update

An updated rsync package that fixes a path sanitizing bug is now available. The rsync program synchronizes files over a network. Versions of rsync up to and including version 2.6.2 contain a path sanitization issue. This issue could allow an attacker to read or write files outside of the rsync...

GLSA-200403-09 : Buffer overflow in Midnight Commander

The remote host is affected by the vulnerability described in GLSA-200403-09 Buffer overflow in Midnight Commander A stack-based buffer overflow has been found in Midnight Commander's virtual filesystem. Impact : This overflow allows an attacker to run arbitrary code on the user's computer during...

GLSA-200405-15 : cadaver heap-based buffer overflow

The remote host is affected by the vulnerability described in GLSA-200405-15 cadaver heap-based buffer overflow Stefan Esser discovered a vulnerability in the code of the neon library see GLSA 200405-13. This library is also included in cadaver. Impact : When connected to a malicious WebDAV serve...

GLSA-200408-16 : glibc: Information leak with LD_DEBUG

The remote host is affected by the vulnerability described in GLSA-200408-16 glibc: Information leak with LDDEBUG Silvio Cesare discovered a potential information leak in glibc. It allows LDDEBUG on SUID binaries where it should not be allowed. This has various security implications, which may be...

GLSA-200405-13 : neon heap-based buffer overflow

The remote host is affected by the vulnerability described in GLSA-200405-13 neon heap-based buffer overflow Stefan Esser discovered a vulnerability in the code of the neon library : if a malicious date string is passed to the nerfc1036parse function, it can trigger a string overflow into static...

GLSA-200405-01 : Multiple format string vulnerabilities in neon 0.24.4 and earlier

The remote host is affected by the vulnerability described in GLSA-200405-01 Multiple format string vulnerabilities in neon 0.24.4 and earlier There are multiple format string vulnerabilities in libneon which may allow a malicious WebDAV server to execute arbitrary code under the context of the...

GLSA-200404-06 : Util-linux login may leak sensitive data

The remote host is affected by the vulnerability described in GLSA-200404-06 Util-linux login may leak sensitive data In some situations the login program could leak sensitive data due to an incorrect usage of a reallocated pointer. NOTE: Only users who have PAM support disabled on their systems...

GLSA-200404-09 : Cross-realm trust vulnerability in Heimdal

The remote host is affected by the vulnerability described in GLSA-200404-09 Cross-realm trust vulnerability in Heimdal Heimdal does not properly perform certain consistency checks for cross-realm requests, which allows remote attackers with control of a realm to impersonate others in the...

GLSA-200404-19 : Buffer overflows and format string vulnerabilities in LCDproc

The remote host is affected by the vulnerability described in GLSA-200404-19 Buffer overflows and format string vulnerabilities in LCDproc Due to insufficient checking of client-supplied data, the LCDd server is susceptible to two buffer overflows and one string buffer vulnerability. If the serve...

GLSA-200403-08 : oftpd DoS vulnerability

The remote host is affected by the vulnerability described in GLSA-200403-08 oftpd DoS vulnerability Issuing a port command with a number higher than 255 causes the server to crash. The port command may be issued before any authentication takes place, meaning the attacker does not need to know a...

GLSA-200403-14 : Multiple Security Vulnerabilities in Monit

The remote host is affected by the vulnerability described in GLSA-200403-14 Multiple Security Vulnerabilities in Monit A denial of service may occur due to Monit not sanitizing remotely supplied HTTP parameters before passing them to memory allocation functions. This could allow an attacker to...

GLSA-200405-05 : Utempter symlink vulnerability

The remote host is affected by the vulnerability described in GLSA-200405-05 Utempter symlink vulnerability Utempter contains a vulnerability that may allow local users to overwrite arbitrary files via a symlink attack. Impact : This vulnerability may allow arbitrary files to be overwritten with...

BasiliX Webmail Content-Type Header XSS

The remote host appears to be running BasiliX version 1.1.1 or lower. Such versions are vulnerable to a cross-scripting attack whereby an attacker may be able to cause a victim to unknowingly run arbitrary JavaScript code in his browser simply by reading a MIME message with a specially crafted...