6653 matches found
Boundary checking errors in syscons
The syscons CONSSCRSHOT ioctl2 does insufficient validation of its input arguments. In particular, negative coordinates or large coordinates may cause unexpected behavior. It may be possible to cause the CONSSCRSHOT ioctl to return portions of kernel memory. Such memory might contain sensitive...
samba -- remote file disclosure
According to a Samba Team security notice: A security vulnerability has been located in Samba 2.2.x = 2.2.11 and Samba 3.0.x = 3.0.5. A remote attacker may be able to gain access to files which exist outside of the share's defined path. Such files must still be readable by the account used for th...
samba -- potential remote DoS vulnerability
Karol Wiesek at iDEFENSE reports: A remote attacker could cause an smbd process to consume abnormal amounts of system resources due to an input validation error when matching filenames containing wildcard characters. Although samba.org classifies this as a DoS vulnerability, several members of th...
groff -- groffer uses temporary files unsafely
The groffer script in the groff package 1.18 and later versions allows local users to overwrite files via a symlink attack on temporary files...
squid -- SNMP module denial-of-service vulnerability
The Squid-2.5 patches page notes: If a certain malformed SNMP request is received squid restarts with a Segmentation Fault error. This only affects squid installations where SNMP is explicitly enabled via "make config". As a workaround, SNMP can be disabled by defining "snmpport 0" in squid.conf...
icecast -- HTTP header overflow
It is possible to execute remote code simply using HTTP request plus 31 headers followed by a shellcode that will be executed directly...
linux_base -- vulnerabilities in Red Hat 7.1 libraries
Trevor Johnson reported that the Red Hat Linux RPMs used by linuxbase contained multiple older vulnerabilities, such as a DNS resolver issue and critical bugs in X font handling and XPM image handling...
wordpress -- XSS in administration panel
Pages in the administration panel of Wordpress are vulnerable for XSS attacks...
zinf -- potential buffer overflow playlist support
The audio player Zinf is vulnerable to a buffer-overflow bug in the management of the playlist files...
CUPS -- local information disclosure
Certain methods of authenticated remote printing in CUPS can disclose user names and passwords in the log files. A workaround for this problem is to set more strict access permissions on the CUPS logfiles...
cyrus-sasl -- dynamic library loading and set-user-ID applications
The Cyrus SASL library, libsasl, contains functions which may load dynamic libraries. These libraries may be loaded from the path specified by the environmental variable SASLPATH, which in some situations may be fully controlled by a local attacker. Thus, if a set-user-ID application such as chsh...
freeradius -- denial-of-service vulnerability
A remote attacker may be able to crash the freeRADIUS Server due to three independant bugs in the function which does improper checking values while processing RADIUS attributes...
jabberd -- denial-of-service vulnerability
José Antonio Calvo discovered a bug in the Jabber 1.x server. According to Matthias Wimmer: Without this patch, it is possible to remotly crash jabberd14, if there is access to one of the following types of network sockets: Socket accepting client connections Socket accepting connections from oth...
getmail -- symlink vulnerability during maildir delivery
David Watson reports a symlink vulnerability in getmail. If run as root not the recommended mode of operation, a local user may be able to cause getmail to write files in arbitrary directories via a symlink attack on subdirectories of the maildir...
powerdns -- DoS vulnerability
PowerDNS is vulnerable to a temporary denial-of-service vulnerability that can be triggered using a random stream of bytes...
sudo -- sudoedit information disclosure
A new feature of sudo 1.6.8 called "sudoedit" a safe editing facility may allow users to read files to which they normally have no access...
php -- vulnerability in RFC 1867 file upload processing
Stefano Di Paola discovered an issue with PHP that could allow someone to upload a file to any directory writeable by the httpd process. Any sanitizing performed on the prepended directory path is ignored. This bug can only be triggered if the $FILES element name contains an underscore...
gnu-radius -- SNMP-related denial-of-service
An iDEFENSE security advisory reports: Remote exploitation of an input validation error in version 1.2 of GNU radiusd could allow a denial of service. The vulnerability specifically exists within the asndecodestring function defined in snmplib/asn1.c. When a very large unsigned number is supplied...
gdk-pixbuf -- image decoding vulnerabilities
Chris Evans discovered several flaws in the gdk-pixbuf XPM image decoder: Heap-based overflow in pixbufcreatefromxpm Stack-based overflow in xpmextractcolor Integer overflows in io-ico.c Some of these flaws are believed to be exploitable...
php -- php_variables memory disclosure
Stefano Di Paola reports: Bad array parsing in phpvariables.c could lead to show arbitrary memory content such as pieces of php code and other data. This affects all GET, POST or COOKIES variables...
xpm -- image decoding vulnerabilities
Chris Evans discovered several vulnerabilities in the libXpm image decoder: A stack-based buffer overflow in xpmParseColors An integer overflow in xpmParseColors A stack-based buffer overflow in ParsePixels and ParseAndPutPixels The X11R6.8.1 release announcement reads: This version is purely a...
apache -- apr_uri_parse IPv6 address handling vulnerability
The Apache Software Foundation Security Team discovered a programming error in the apr-util library function apruriparse. When parsing IPv6 literal addresses, it is possible that a length is incorrectly calculated to be negative, and this value is passed to memcpy. This may result in an exploitab...
subversion -- WebDAV fails to protect metadata
In some situations, subversion metadata may be unexpectedly disclosed via WebDAV. A subversion advisory states: modauthzsvn, the Apache httpd module which does path-based authorization on Subversion repositories, is not correctly protecting all metadata on unreadable paths. This security issue is...
apache -- ap_resolve_env buffer overflow
SITIC discovered a vulnerability in Apache 2's handling of environmental variable settings in the httpd configuration files the main httpd.conf' and .htaccess' files. According to a SITIC advisory: The buffer overflow occurs when expanding $ENVVAR constructs in .htaccess or httpd.conf files. The...
mod_dav -- lock related denial-of-service
A malicious user with DAV write privileges can trigger a null pointer dereference in the Apache moddav module. This could cause the server to become unavailable...
mozilla -- vCard stack buffer overflow
Georgi Guninski discovered a stack buffer overflow which may be triggered when viewing email messages with vCard attachments...
mozilla -- scripting vulnerabilities
Several scripting vulnerabilities were discovered and corrected in Mozilla: CVE-2004-0905 javascript; links dragged onto another frame or page allows an attacker to steal or modify sensitive information from other sites. The user could be convinced to drag obscurred links in the context of a game...
mozilla -- multiple heap buffer overflows
Several heap buffer overflows were discovered and fixed in the most recent versions of Mozilla, Firefox, and Thunderbird. These overflows may occur when: Using the "Send Page" function. Checking mail on a malicious POP3 server. Processing non-ASCII URLs. Each of these vulnerabilities may be...
mozilla -- BMP decoder vulnerabilities
Gael Delalleau discovered several integer overflows in Mozilla's BMP decoder that can result in denial-of-service or arbitrary code execution...
postgresql-contrib -- insecure temporary file creation
The makeoidjoinscheck script in the PostgreSQL RDBMS has insecure handling of temporary files, which could lead to an attacker overwriting arbitrary files with the credentials of the user running the makeoidjoinscheck script...
mysql -- heap buffer overflow with prepared statements
There is a buffer overflow in the prepared statements API libmysqlclient when a statement containing thousands of placeholders is executed...
libxine -- multiple vulnerabilities in VideoCD handling
A xine security announcement states: Several string overflows on the stack have been fixed in xine-lib, some of them can be used for remote buffer overflow exploits leading to the execution of arbitrary code with the permissions of the user running a xine-lib based media application. Stack-based...
libxine -- DVD subpicture decoder heap overflow
A xine security announcement states: A heap overflow has been found in the DVD subpicture decoder of xine-lib. This can be used for a remote heap overflow exploit, which can, on some systems, lead to or help in executing malicious code with the permissions of the user running a xine-lib based med...
webmin -- insecure temporary file creation at installation time
The Webmin developers documented a security issue in the release notes for version 1.160: Fixed a security hole in the maketemp.pl script, used to create the /tmp/.webmin directory at install time. If an un-trusted user creates this directory before Webmin is installed, he could create in it a...
samba3 DoS attack
Code found in nmbd and smbd may allow a remote attacker to effectively crash the nmbd server or use the smbd server to exhaust the system memory...
krb5 -- ASN.1 decoder denial-of-service vulnerability
An advisory published by the MIT Kerberos team says: The ASN.1 decoder library in the MIT Kerberos 5 distribution is vulnerable to a denial-of-service attack causing an infinite loop in the decoder. The KDC is vulnerable to this attack. An unauthenticated remote attacker can cause a KDC or...
imlib2 -- BMP decoder buffer overflow
Marcus Meissner discovered that imlib2's BMP decoder would crash when loading the test BMP file created by Chris Evans for testing the previous Qt vulnerability. There appears to be both a stack-based and a heap-based buffer overflow that are believed to be exploitable for arbitrary code executio...
krb5 -- double-free vulnerabilities
An advisory published by the MIT Kerberos team says: The MIT Kerberos 5 implementation's Key Distribution Center KDC program contains a double-free vulnerability that potentially allows a remote attacker to execute arbitrary code. Compromise of a KDC host compromises the security of the entire...
gaim -- multiple buffer overflows
Sean infamous42md reports several situations in gaim that may result in exploitable buffer overflows: Rich Text Format RTF messages in Novell GroupWise protocol Unsafe use of gethostbyname in zephyr protocol URLs which are over 2048 bytes long once decoded...
gaim -- heap overflow exploitable by malicious GroupWise server
Sean infamous42md reports that a malicious GroupWise messaging server may be able to exploit a heap buffer overflow in gaim, leading to arbitrary code execution...
gaim -- Content-Length header denial-of-service vulnerability
Sean infamous42md reports: When a remote server provides a large "content-length" header value, Gaim will attempt to allocate a buffer to store the content, however this allocation attempt will cause Gaim to crash if the length exceeds the amount of possible memory. This happens when reading...
tor -- remote DoS and loss of anonymity
Tor has various remote crashes which could lead to a remote denial-of-service and be used to defeat clients anonymity. It is not expected that these vulnerabilities are exploitable for arbitrary code execution...
imlib -- BMP decoder heap buffer overflow
Marcus Meissner discovered that imlib's BMP decoder would crash when loading the test BMP file created by Chris Evans for testing the previous Qt vulnerability. It is believed that this bug could be exploited for arbitrary code execution...
ImageMagick -- BMP decoder buffer overflow
Marcus Meissner discovered that ImageMagick's BMP decoder would crash when loading the test BMP file created by Chris Evans for testing the previous Qt vulnerability...
openoffice -- document disclosure
OpenOffice creates a working directory in /tmp on startup, and uses this directory to temporarily store document content. However, the permissions of the created directory may allow other user on the system to read these files, potentially exposing information the user likely assumed was...
icecast -- Cross-Site Scripting Vulnerability
Caused by improper filtering of HTML code in the status display, it is possible for a remote user to execute scripting code in the target user's browser...
nss -- exploitable buffer overflow in SSLv2 protocol handler
ISS X-Force reports that a remotely exploitable buffer overflow exists in the Netscape Security Services NSS library's implementation of SSLv2. From their advisory: The NSS library contains a flaw in SSLv2 record parsing that may lead to remote compromise. When parsing the first record in an SSLv...
hafiye -- lack of terminal escape sequence filtering
A siyahsapka.org advisory reads: Hafiye-1.0 doesnt filter the payload when printing it to the terminal. A malicious attacker can send packets with escape sequence payloads to exploit this vulnerability. If Hafiye has been started with -n packet count option , the vulnerability could allow remote...
ifmail -- unsafe set-user-ID application
Niels Heinen reports that ifmail allows one to specify a configuration file. Since ifmail runs set-user-ID news', this may allow a local attacker to write to arbitrary files or execute arbitrary commands as the news' user...