Qt: Multiple format string vulnerabilities

Background Qt is a cross-platform GUI framework, which is used e.g. by KDE. Description Tim Brown of Portcullis Computer Security Ltd and Dirk Mueller of KDE reported multiple format string errors in qWarning calls in files qtextedit.cpp, qdatatable.cpp, qsqldatabase.cpp, qsqlindex.cpp,...

Macromedia Flash Player: Remote arbitrary code execution

Background The Macromedia Flash Player is a renderer for the popular SWF file type which is commonly used to provide interactive websites, digital experiences and mobile content. Description Mark Hills discovered some errors when interacting with a browser for keystrokes handling CVE-2007-2022...

Firebird: Buffer overflow

Background Firebird is an open source relational database that runs on Linux, Windows, and various UNIX systems. Description Cody Pierce from TippingPoint DVLabs has discovered a buffer overflow when processing "connect" requests with an overly large "pcnctcount" value. Impact An unauthenticated...

Blackdown Java: Applet privilege escalation

Background Blackdown provides implementations of the Java Development Kit JDK and the Java Runtime Environment JRE. Description Chris Evans has discovered multiple buffer overflows in the Sun JDK and the Sun JRE possibly related to various AWT and font layout functions. Tom Hawtin has discovered ...

Tomcat: Information disclosure

Background Tomcat is the Apache Jakarta Project's official implementation of Java Servlets and Java Server Pages. Description Tomcat allows special characters like slash, backslash or URL-encoded backslash as a separator, while Apache does not. Impact A remote attacker could send a specially...

File: Denial of service

Background file is a utility that identifies a file format by scanning binary data for patterns. Description Conor Edberg discovered an error in the way file processes a specific regular expression. Impact A remote attacker could entice a user to open a specially crafted file, using excessive CPU...

Snort: Remote execution of arbitrary code

Background Snort is a widely deployed intrusion detection program. Description The Snort DCE/RPC preprocessor does not properly reassemble certain types of fragmented SMB and DCE/RPC packets. Impact A remote attacker could send specially crafted fragmented SMB or DCE/RPC packets, without the need...

fvwm: fvwm-menu-directory fvwm command injection

Background fvwm is a highly configurable virtual window manager for X11 desktops. fvwm-menu-directory allows fvwm users to browse directories from within fvwm. Description Tavis Ormandy of the Gentoo Linux Security Audit Team discovered that fvwm-menu-directory does not sufficiently sanitise...

ncompress: Buffer Underflow

Background ncompress is a suite of utilities to create and extract Lempel-Ziff-Welch LZW compressed archives. Description Tavis Ormandy of the Google Security Team discovered a static buffer underflow in ncompress. Impact An attacker could create a specially crafted LZW archive, that when...

libapreq2: Denial of Service vulnerability

Background libapreq is a shared library with associated modules for manipulating client request data via the Apache API. Description A vulnerability has been reported in the apreqparseheaders and apreqparseurlencoded functions of Apache2::Request. Impact A remote attacker could possibly exploit t...

Sendmail: Race condition in the handling of asynchronous signals

Background Sendmail is a popular mail transfer agent MTA. Description ISS discovered that Sendmail is vulnerable to a race condition in the handling of asynchronous signals. Impact An attacker could exploit this via certain crafted timing conditions. Workaround There is no known workaround at thi...

WordPress: SQL injection vulnerability

Background WordPress is a PHP and MySQL based content management and publishing system. Description Patrik Karlsson reported that WordPress 1.5.2 makes use of an insufficiently filtered User Agent string in SQL queries related to comments posting. This vulnerability was already fixed in the...

Xpdf, Poppler: Heap overflow

Background Xpdf is a PDF file viewer that runs under the X Window System. Poppler is a PDF rendering library based on the Xpdf 3.0 code base. Description Dirk Mueller has reported a vulnerability in Xpdf. It is caused by a missing boundary check in the splash rasterizer engine when handling PDF...

XnView: Privilege escalation

Background XnView is an efficient multimedia viewer, browser and converter, distributed free for non-commercial use. Description Krzysiek Pawlik of Gentoo Linux discovered that the XnView package for IA32 used the DTRPATH field insecurely, causing the dynamic loader to search for shared libraries...

Weex: Format string vulnerability

Background Weex is a non-interactive FTP client typically used to update web pages. Description Ulf Harnhammar discovered a format string bug in Weex that can be triggered when it is first run or when its cache files are rebuilt, using the -r option. Impact An attacker could setup a malicious FTP...

X.Org: Heap overflow in pixmap allocation

Background X.Org is X.Org Foundation's Public Implementation of the X Window System. Description X.Org is missing an integer overflow check during pixmap memory allocation. Impact An X.Org user could exploit this issue to make the X server execute arbitrary code with elevated privileges. Workarou...

pstotext: Remote execution of arbitrary code

Background pstotext is a program that works with GhostScript to extract plain text from PostScript and PDF files. Description Max Vozeler reported that pstotext calls the GhostScript interpreter on untrusted PostScript files without specifying the -dSAFER option. Impact An attacker could craft a...

Wordpress: Multiple vulnerabilities

Background WordPress is a PHP and MySQL based content management and publishing system. Description Due to a lack of input validation, WordPress is vulnerable to SQL injection and XSS attacks. Impact An attacker could use the SQL injection vulnerabilities to gain information from the database...

GnuTLS: Denial of Service vulnerability

Background GnuTLS is a free TLS 1.0 and SSL 3.0 implementation for the GNU project. Description A vulnerability has been discovered in the record packet parsing in the GnuTLS library. Additionally, a flaw was also found in the RSA key export functionality. Impact A remote attacker could exploit...

Python: Arbitrary code execution through SimpleXMLRPCServer

Background Python is an interpreted, interactive, object-oriented, cross-platform programming language. Description Graham Dumpleton discovered that XML-RPC servers making use of the SimpleXMLRPCServer library that use the registerinstance method to register an object without a dispatch method ar...

KPdf, KOffice: Stack overflow in included Xpdf code

Background KPdf is a KDE-based PDF viewer included in the kdegraphics package. KOffice is an integrated office suite for KDE. Description KPdf and KOffice both include Xpdf code to handle PDF files. Xpdf is vulnerable to a new stack overflow, as described in GLSA 200501-28. Impact An attacker cou...

KDE FTP KIOslave: Command injection

Background KDE is a feature-rich graphical desktop environment for Linux and Unix-like Operating Systems. KDE provided KIOslaves for many protocols in the kdelibs package, one of them being FTP. These are used by KDE applications such as Konqueror. Description The FTP KIOslave fails to properly...

phpWebSite: HTTP response splitting vulnerability

Background phpWebSite is a web site content management system. Description Due to lack of proper input validation, phpWebSite has been found to be vulnerable to HTTP response splitting attacks. Impact A malicious user could inject arbitrary response data, leading to content spoofing, web cache...

phpBB: Remote command execution

Background phpBB is an Open Source bulletin board package. Description phpBB contains a vulnerability in the highlighting code and several vulnerabilities in the username handling code. Impact An attacker can exploit the highlighting vulnerability to access the PHP exec function without...

Kaffeine, gxine: Remotely exploitable buffer overflow

Background Kaffeine and gxine are graphical front-ends for xine-lib multimedia library. Description KF of Secure Network Operations has discovered an overflow that occurs during the Content-Type header processing of Kaffeine. The vulnerable code in Kaffeine is reused from gxine, making gxine...

CUPS: Leakage of sensitive information

Background The Common UNIX Printing System CUPS is a cross-platform print spooler. Description When printing to a SMB-shared printer requiring authentication, CUPS leaks the user name and password to a logfile. Impact A local user could gain knowledge of sensitive authentication data. Workaround...

Qt: Image loader overflows

Background Qt is a cross-platform GUI toolkit used by KDE. Description There are several unspecified bugs in the QImage class which may cause crashes or allow execution of arbitrary code as the user running the Qt application. These bugs affect the PNG, XPM, BMP, GIF and JPEG image types. Impact ...

Tomcat: Insecure installation

Background Tomcat is the Apache Jakarta Project's official implementation of Java Servlets and Java Server Pages. Description The Gentoo ebuild for Tomcat sets the ownership of the Tomcat init scripts as tomcat:tomcat, but those scripts are executed with root privileges when the system is started...

Multiple Security Vulnerabilities in Monit

Background Monit is a system administration utility that allows management and monitoring of processes, files, directories and devices on a Unix system. Description A denial of service may occur due to Monit not sanitizing remotely supplied HTTP parameters before passing them to memory allocation...

GPAC: Multiple Vulnerabilities

Background GPAC is an implementation of the MPEG-4 Systems standard developed from scratch in ANSI C. Description Multiple vulnerabilities have been discovered in GPAC. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifiers for details...

Percona XtraBackup: Multiple Vulnerabilities

Background Percona XtraBackup is a complete and open source online backup solution for all versions of MySQL. Description Multiple vulnerabilities have been discovered in Percona XtraBackup. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE...

JHead: Multiple Vulnerabilities

Background JHead is an EXIF JPEG header manipulation tool. Description Multiple vulnerabilities have been discovered in JHead. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifiers for details. Workaround There is no known workaround a...

libjpeg-turbo: Multiple Vulnerabilities

Background libjpeg-turbo is a MMX, SSE, and SSE2 SIMD accelerated JPEG library. Description Multiple vulnerabilities have been discovered in libjpeg-turbo. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifiers for details. Workaround...

XZ utils: Backdoor in release tarballs

Background XZ Utils is free general-purpose data compression software with a high compression ratio. Description A backdoor has been discovered in XZ utils. Please review the CVE identifier referenced below for details. Impact Our current understanding of the backdoor is that is does not affect...

Mozilla Firefox: Multiple Vulnerabilities

Background Mozilla Firefox is a popular open-source web browser from the Mozilla project. Description Multiple vulnerabilities have been discovered in Mozilla Firefox. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifiers for details...

Synapse: Multiple Vulnerabilities

Background Synapse is a Matrix homeserver written in Python/Twisted. Description Multiple vulnerabilities have been discovered in Synapse. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifiers for details. Workaround There is no known...

util-linux: Multiple Vulnerabilities

Background util-linux is a suite of Linux programs including mount and umount, programs used to mount and unmount filesystems. Description Multiple vulnerabilities have been discovered in util-linux. Please review the CVE identifiers referenced below for details. Impact Please review the referenc...

Gitea: Multiple Vulnerabilities

Background Gitea is a painless self-hosted Git service. Description Multiple vulnerabilities have been discovered in Gitea. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifiers for details. Workaround There is no known workaround at...

Apptainer: Privilege Escalation

Background Apptainer is the container system for secure high-performance computing. Description A vulnerability has been discovered in Apptainer. Please review the CVE identifier referenced below for details. Impact There is an ext4 use-after-free flaw that is exploitable in vulnerable versions...

GitPython: Code Execution via Crafted Input

Background GitPython is a Python library used to interact with Git repositories. Description Please review the CVE identifier referenced below for details. Impact An attacker may be able to trigger Remote Code Execution RCE due to improper user input validation, which makes it possible to inject ...

less: Denial of service

Background less is a pager and text file viewer. Description less suffered from a flaw in its terminal escape sequence handling which made its filtering incomplete. Impact Malicious input could clear the terminal output or otherwise manipulate it with faked interactions. Workaround There is no...

D-Bus: Multiple Vulnerabilities

Background D-Bus is a daemon providing a framework for applications to communicate with one another. Description Multiple vulnerabilities have been discovered in D-Bus. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifiers for details...

Mrxvt: Arbitrary Code Execution

Background Mrxvt is a multi-tabbed rxvt clone with XFT, transparent background and CJK support. Description Mrxvt mishandles certain escape sequences, some of which allow for shell command execution. Impact An attacker with sufficient access to write arbitrary text to the Mrxvt terminal could...

systemd: Multiple vulnerabilities

Background A system and service manager. Description Multiple vulnerabilities have been discovered in systemd. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifiers for details. Workaround There is no known workaround at this time...

LibRaw: Multiple vulnerabilities

Background LibRaw is a library for reading RAW files obtained from digital photo cameras. Description Multiple vulnerabilities have been discovered in LibRaw. Please review the CVE identifiers referenced below for details. Impact A remote attacker could entice a user to open a specially crafted...

Perl DBI: Multiple vulnerabilities

Background A database access module for the Perl programming language. Description Multiple vulnerabilities have been discovered in the Perl module DBI. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifiers for details. Workaround Ther...

libsndfile: Multiple vulnerabilities

Background libsndfile is a C library for reading and writing files containing sampled sound. Description Multiple vulnerabilities have been discovered in libsndfile. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifiers for details...

QEMU: Multiple vulnerabilities

Background QEMU is a generic and open source machine emulator and virtualizer. Description Multiple vulnerabilities have been discovered in QEMU. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifiers for details. Workaround There is no...

Exim: Heap-based buffer overflow

Background Exim is a message transfer agent MTA designed to be a a highly configurable, drop-in replacement for sendmail. Description It was discovered that Exim incorrectly handled certain string operations. Impact A remote attacker, able to connect to a vulnerable Exim instance, could possibly...

pump: User-assisted execution of arbitrary code

Background BOOTP and DHCP client for automatic IP configuration. Description It was discovered that there was an arbitrary code execution vulnerability in the pump DHCP/BOOTP client. Impact A remote attacker, by enticing a user to connect to a malicious server, could cause the execution of...