Debian DSA-645-1 : cupsys - buffer overflow

iDEFENSE has reported a buffer overflow in xpdf, the portable document format PDF suite. Similar code is present in the PDF processing part of CUPS. A maliciously crafted PDF file could exploit this problem, resulting in the execution of arbitrary code. %NASLMINLEVEL 70300 C Tenable Network...

Debian DSA-630-1 : lintian - insecure temporary directory

Jeroen van Wolffelaar discovered a problem in lintian, the Debian package checker. The program removes the working directory even if it wasn't created at program start, removing an unrelated file or directory a malicious user inserted via a symlink attack. %NASLMINLEVEL 70300 C Tenable Network...

Dillo: Format string vulnerability

Background Dillo is a small and fast multi-platform web browser based on GTK+. Description Gentoo Linux developer Tavis Ormandy found a format string bug in Dillo's handling of messages in aInterfacemsg. Impact An attacker could craft a malicious web page which, when accessed using Dillo, would...

PHProjekt: Remote code execution vulnerability

Background PHProjekt is a modular groupware web application used to coordinate group activities and share files. Description cYon discovered that the authform.inc.php script allows a remote user to define the global variable $pathpre. Impact A remote attacker can exploit this vulnerability to for...

KDE Security Advisory: Konqueror Java Vulnerability

KDE Security Advisory: Konqueror Java Vulnerability Original Release Date: 2004-12-20 URL: http://www.kde.org/info/security/advisory-20041220-1.txt 0. References http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1145 http://www.heise.de/security/dienste/browsercheck/tests/java.shtml 1. Syste...

Gadu-Gadu Remote DoS (all versions)

Product: Tlen.pl = 5.23.4.1 Vendor: o2.pl Sp. z o.o. http://www.tlen.pl/ Impact: Remote script execution Severity: High Authors: Blazej Miga [email protected], Jaroslaw Sajko [email protected] Date: 20/12/04 ISSUE Tlen.pl is the instant messenger application used by more than 700 000 users. The...

Gadu-Gadu, another two bugs

Product: Gadu-Gadu, build 155 and older Vendor: SMS-EXPRESS.COM http://www.gadu-gadu.pl Impact: Script execution in local zone, Remote DoS Severity: High Authors: Blazej Miga [email protected], Jaroslaw Sajko [email protected] Date: 17/12/04 ISSUE Gadu-Gadu is the first Polish instant messenger...

phpMyAdmin < 2.6.1-rc1 Multiple Remote Vulnerabilities

According to its banner, the remote version of phpMyAdmin is vulnerable to one or both of the following flaws : - An attacker may be able to exploit this software to execute arbitrary commands on the remote host on a server which does not run PHP in safe mode. - An attacker may be able to read...

Debian DSA-607-1 : xfree86 - several vulnerabilities

Several developers have discovered a number of problems in the libXpm library which is provided by X.Org, XFree86 and LessTif. These bugs can be exploited by remote and/or local attackers to gain access to the system or to escalate their local privileges, by using a specially crafted XPM image...

up-imapproxy IMAP Proxy IMAP_Line_Read() Function Literal Size DoS

The remote host is running at least one instance of up-imapproxy that does not properly handle IMAP literals. This flaw allows a remote attacker to crash the proxy, killing existing connections as well as preventing new ones, by using literals at unexpected times. This script was written by Georg...

Debian DSA-596-2 : sudo - missing input sanitising

Liam Helmer noticed that sudo, a program that provides limited super user privileges to specific users, does not clean the environment sufficiently. Bash functions and the CDPATH variable are still passed through to the program running as privileged user, leaving possibilities to overload system...

Cyrus IMAP Server < 2.2.10 Multiple Remote Overflows

According to its banner, the remote Cyrus IMAPD server is vulnerable to one pre-authentication buffer overflow, as well as three post- authentication buffer overflows. A remote attacker could exploit these issues to crash the server, or possibly execute arbitrary code. %NASLMINLEVEL 70300 C Tenab...

Debian DSA-577-1 : postgresql - insecure temporary file

Trustix Security Engineers identified insecure temporary file creation in a script included in the postgresql suite, an object-relational SQL database. This could lead an attacker to trick a user to overwrite arbitrary files he has write access to. %NASLMINLEVEL 70300 C Tenable Network Security,...

HTTP URI Handling Format String

The remote web server seems to be vulnerable to a format string attack on the URI. An attacker might use this flaw to make it crash or even execute arbitrary code on this host. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid15640; scriptversion"$Revision: 1.19 $";...

Cherokee: Format string vulnerability

Background Cherokee is an extra-light web server. Description Florian Schilhabel from the Gentoo Linux Security Audit Team found a format string vulnerability in the cherokeeloggerncsawritestring function. Impact Using a specially crafted URL when authenticating via authpam, a malicious user may ...

MoniWiki < 1.0.9 wiki.php XSS

The remote host seems to be running MoniWiki, a wiki web application written in PHP. The remote version of this software is vulnerable to cross-site scripting attacks, through the script 'wiki.php'. With a specially crafted URL, an attacker can cause arbitrary code execution in users' browsers...

MIT krb5: Insecure temporary file use in send-pr.sh

Background MIT krb5 is the free implementation of the Kerberos network authentication protocol written by the Massachusetts Institute of Technology. Description The send-pr.sh script creates temporary files in world-writeable directories with predictable names. Impact A local attacker could creat...

Pinnacle ShowCenter SettingsBase.php Skin Parameter XSS

The remote host runs the Pinnacle ShowCenter web-based interface. The remote version of this software is vulnerable to cross-site scripting attack due to a lack of sanity checks on skin parameter in the SettingsBase.php script. With a specially crafted URL, an attacker can cause arbitrary code...

WordPress Core 1.2 - HTTP Splitting

This script is C Tenable Network Security ifdescription scriptid15443; scriptbugtraqid11348; scriptversion "$Revision: 1.1 $"; name"english" = "WordPress HTTP Splitting Vulnerability"; scriptnameenglish:name"english"; desc"english" = " The remote host is running WordPress BLOG, a web blog manager...

LessTif: Integer and stack overflows in libXpm

Background LessTif is a clone of OSF/Motif, which is the standard user interface toolkit available on Unix and Linux. Description Chris Evans has discovered various integer and stack overflows in libXpm, which is shipped as a part of the X Window System. LessTif, an application that includes this...