mail-notification -- denial-of-service vulnerability

Caused by an untested return value, and a resulting null pointer dereference, it is possible for an attacker to crash the application. However, the attacker must first hijack the connection between Mail Notification and the Gmail or IMAP server...

zip -- long path buffer overflow

A HexView security advisory reports: When zip performs recursive folder compression, it does not check for the length of resulting path. If the path is too long, a buffer overflow occurs leading to stack corruption and segmentation fault. It is possible to exploit this vulnerability by embedding ...

mpg123 -- buffer overflow in URL handling

Carlos Barros reports that mpg123 contains two buffer overflows. These vulnerabilities can potentially lead to execution of arbitrary code. The first buffer overflow can occur when mpg123 parses a URL with a user-name/password field that is more than 256 characters long. This problem can be...

xerces-c2 -- Attribute blowup denial-of-service

Amit Klein reports about Xerces-C++: An attacker can craft a malicious XML document, which uses XML attributes in a way that inflicts a denial of service condition on the target machine XML parser. The result of this attack is that the XML parser consumes all the CPU...

mod_ssl -- SSLCipherSuite bypass

It is possible for clients to use any cipher suite configured by the virtual host, whether or not a certain cipher suite is selected for a specific directory. This might result in clients using a weaker encryption than originally configured...

samba -- potential remote DoS vulnerability

Karol Wiesek at iDEFENSE reports: A remote attacker could cause an smbd process to consume abnormal amounts of system resources due to an input validation error when matching filenames containing wildcard characters. Although samba.org classifies this as a DoS vulnerability, several members of th...

groff -- groffer uses temporary files unsafely

The groffer script in the groff package 1.18 and later versions allows local users to overwrite files via a symlink attack on temporary files...

Boundary checking errors in syscons

The syscons CONSSCRSHOT ioctl2 does insufficient validation of its input arguments. In particular, negative coordinates or large coordinates may cause unexpected behavior. It may be possible to cause the CONSSCRSHOT ioctl to return portions of kernel memory. Such memory might contain sensitive...

samba -- remote file disclosure

According to a Samba Team security notice: A security vulnerability has been located in Samba 2.2.x = 2.2.11 and Samba 3.0.x = 3.0.5. A remote attacker may be able to gain access to files which exist outside of the share's defined path. Such files must still be readable by the account used for th...

icecast -- HTTP header overflow

It is possible to execute remote code simply using HTTP request plus 31 headers followed by a shellcode that will be executed directly...

squid -- SNMP module denial-of-service vulnerability

The Squid-2.5 patches page notes: If a certain malformed SNMP request is received squid restarts with a Segmentation Fault error. This only affects squid installations where SNMP is explicitly enabled via "make config". As a workaround, SNMP can be disabled by defining "snmpport 0" in squid.conf...

linux_base -- vulnerabilities in Red Hat 7.1 libraries

Trevor Johnson reported that the Red Hat Linux RPMs used by linuxbase contained multiple older vulnerabilities, such as a DNS resolver issue and critical bugs in X font handling and XPM image handling...

wordpress -- XSS in administration panel

Pages in the administration panel of Wordpress are vulnerable for XSS attacks...

zinf -- potential buffer overflow playlist support

The audio player Zinf is vulnerable to a buffer-overflow bug in the management of the playlist files...

CUPS -- local information disclosure

Certain methods of authenticated remote printing in CUPS can disclose user names and passwords in the log files. A workaround for this problem is to set more strict access permissions on the CUPS logfiles...

cyrus-sasl -- dynamic library loading and set-user-ID applications

The Cyrus SASL library, libsasl, contains functions which may load dynamic libraries. These libraries may be loaded from the path specified by the environmental variable SASLPATH, which in some situations may be fully controlled by a local attacker. Thus, if a set-user-ID application such as chsh...

freeradius -- denial-of-service vulnerability

A remote attacker may be able to crash the freeRADIUS Server due to three independant bugs in the function which does improper checking values while processing RADIUS attributes...

jabberd -- denial-of-service vulnerability

José Antonio Calvo discovered a bug in the Jabber 1.x server. According to Matthias Wimmer: Without this patch, it is possible to remotly crash jabberd14, if there is access to one of the following types of network sockets: Socket accepting client connections Socket accepting connections from oth...

getmail -- symlink vulnerability during maildir delivery

David Watson reports a symlink vulnerability in getmail. If run as root not the recommended mode of operation, a local user may be able to cause getmail to write files in arbitrary directories via a symlink attack on subdirectories of the maildir...

powerdns -- DoS vulnerability

PowerDNS is vulnerable to a temporary denial-of-service vulnerability that can be triggered using a random stream of bytes...

sudo -- sudoedit information disclosure

A new feature of sudo 1.6.8 called "sudoedit" a safe editing facility may allow users to read files to which they normally have no access...

subversion -- WebDAV fails to protect metadata

In some situations, subversion metadata may be unexpectedly disclosed via WebDAV. A subversion advisory states: modauthzsvn, the Apache httpd module which does path-based authorization on Subversion repositories, is not correctly protecting all metadata on unreadable paths. This security issue is...

xpm -- image decoding vulnerabilities

Chris Evans discovered several vulnerabilities in the libXpm image decoder: A stack-based buffer overflow in xpmParseColors An integer overflow in xpmParseColors A stack-based buffer overflow in ParsePixels and ParseAndPutPixels The X11R6.8.1 release announcement reads: This version is purely a...

php -- vulnerability in RFC 1867 file upload processing

Stefano Di Paola discovered an issue with PHP that could allow someone to upload a file to any directory writeable by the httpd process. Any sanitizing performed on the prepended directory path is ignored. This bug can only be triggered if the $FILES element name contains an underscore...

gnu-radius -- SNMP-related denial-of-service

An iDEFENSE security advisory reports: Remote exploitation of an input validation error in version 1.2 of GNU radiusd could allow a denial of service. The vulnerability specifically exists within the asndecodestring function defined in snmplib/asn1.c. When a very large unsigned number is supplied...

apache -- apr_uri_parse IPv6 address handling vulnerability

The Apache Software Foundation Security Team discovered a programming error in the apr-util library function apruriparse. When parsing IPv6 literal addresses, it is possible that a length is incorrectly calculated to be negative, and this value is passed to memcpy. This may result in an exploitab...

php -- php_variables memory disclosure

Stefano Di Paola reports: Bad array parsing in phpvariables.c could lead to show arbitrary memory content such as pieces of php code and other data. This affects all GET, POST or COOKIES variables...

mod_dav -- lock related denial-of-service

A malicious user with DAV write privileges can trigger a null pointer dereference in the Apache moddav module. This could cause the server to become unavailable...

gdk-pixbuf -- image decoding vulnerabilities

Chris Evans discovered several flaws in the gdk-pixbuf XPM image decoder: Heap-based overflow in pixbufcreatefromxpm Stack-based overflow in xpmextractcolor Integer overflows in io-ico.c Some of these flaws are believed to be exploitable...

apache -- ap_resolve_env buffer overflow

SITIC discovered a vulnerability in Apache 2's handling of environmental variable settings in the httpd configuration files the main httpd.conf' and .htaccess' files. According to a SITIC advisory: The buffer overflow occurs when expanding $ENVVAR constructs in .htaccess or httpd.conf files. The...

mozilla -- multiple heap buffer overflows

Several heap buffer overflows were discovered and fixed in the most recent versions of Mozilla, Firefox, and Thunderbird. These overflows may occur when: Using the "Send Page" function. Checking mail on a malicious POP3 server. Processing non-ASCII URLs. Each of these vulnerabilities may be...

mozilla -- vCard stack buffer overflow

Georgi Guninski discovered a stack buffer overflow which may be triggered when viewing email messages with vCard attachments...

mozilla -- scripting vulnerabilities

Several scripting vulnerabilities were discovered and corrected in Mozilla: CVE-2004-0905 javascript; links dragged onto another frame or page allows an attacker to steal or modify sensitive information from other sites. The user could be convinced to drag obscurred links in the context of a game...

mozilla -- BMP decoder vulnerabilities

Gael Delalleau discovered several integer overflows in Mozilla's BMP decoder that can result in denial-of-service or arbitrary code execution...

postgresql-contrib -- insecure temporary file creation

The makeoidjoinscheck script in the PostgreSQL RDBMS has insecure handling of temporary files, which could lead to an attacker overwriting arbitrary files with the credentials of the user running the makeoidjoinscheck script...

mysql -- heap buffer overflow with prepared statements

There is a buffer overflow in the prepared statements API libmysqlclient when a statement containing thousands of placeholders is executed...

libxine -- multiple vulnerabilities in VideoCD handling

A xine security announcement states: Several string overflows on the stack have been fixed in xine-lib, some of them can be used for remote buffer overflow exploits leading to the execution of arbitrary code with the permissions of the user running a xine-lib based media application. Stack-based...

libxine -- DVD subpicture decoder heap overflow

A xine security announcement states: A heap overflow has been found in the DVD subpicture decoder of xine-lib. This can be used for a remote heap overflow exploit, which can, on some systems, lead to or help in executing malicious code with the permissions of the user running a xine-lib based med...

webmin -- insecure temporary file creation at installation time

The Webmin developers documented a security issue in the release notes for version 1.160: Fixed a security hole in the maketemp.pl script, used to create the /tmp/.webmin directory at install time. If an un-trusted user creates this directory before Webmin is installed, he could create in it a...

samba3 DoS attack

Code found in nmbd and smbd may allow a remote attacker to effectively crash the nmbd server or use the smbd server to exhaust the system memory...

krb5 -- ASN.1 decoder denial-of-service vulnerability

An advisory published by the MIT Kerberos team says: The ASN.1 decoder library in the MIT Kerberos 5 distribution is vulnerable to a denial-of-service attack causing an infinite loop in the decoder. The KDC is vulnerable to this attack. An unauthenticated remote attacker can cause a KDC or...

krb5 -- double-free vulnerabilities

An advisory published by the MIT Kerberos team says: The MIT Kerberos 5 implementation's Key Distribution Center KDC program contains a double-free vulnerability that potentially allows a remote attacker to execute arbitrary code. Compromise of a KDC host compromises the security of the entire...

imlib2 -- BMP decoder buffer overflow

Marcus Meissner discovered that imlib2's BMP decoder would crash when loading the test BMP file created by Chris Evans for testing the previous Qt vulnerability. There appears to be both a stack-based and a heap-based buffer overflow that are believed to be exploitable for arbitrary code executio...

gaim -- multiple buffer overflows

Sean infamous42md reports several situations in gaim that may result in exploitable buffer overflows: Rich Text Format RTF messages in Novell GroupWise protocol Unsafe use of gethostbyname in zephyr protocol URLs which are over 2048 bytes long once decoded...

gaim -- Content-Length header denial-of-service vulnerability

Sean infamous42md reports: When a remote server provides a large "content-length" header value, Gaim will attempt to allocate a buffer to store the content, however this allocation attempt will cause Gaim to crash if the length exceeds the amount of possible memory. This happens when reading...

gaim -- heap overflow exploitable by malicious GroupWise server

Sean infamous42md reports that a malicious GroupWise messaging server may be able to exploit a heap buffer overflow in gaim, leading to arbitrary code execution...

tor -- remote DoS and loss of anonymity

Tor has various remote crashes which could lead to a remote denial-of-service and be used to defeat clients anonymity. It is not expected that these vulnerabilities are exploitable for arbitrary code execution...

ImageMagick -- BMP decoder buffer overflow

Marcus Meissner discovered that ImageMagick's BMP decoder would crash when loading the test BMP file created by Chris Evans for testing the previous Qt vulnerability...

imlib -- BMP decoder heap buffer overflow

Marcus Meissner discovered that imlib's BMP decoder would crash when loading the test BMP file created by Chris Evans for testing the previous Qt vulnerability. It is believed that this bug could be exploited for arbitrary code execution...

icecast -- Cross-Site Scripting Vulnerability

Caused by improper filtering of HTML code in the status display, it is possible for a remote user to execute scripting code in the target user's browser...