Libtasn1: Denial of service

Background Libtasn1 is a library used to parse ASN.1 Abstract Syntax Notation One objects, and perform DER Distinguished Encoding Rules decoding. Description Libtasn1 does not properly handle length fields when performing DER decoding. Impact A remote attacker could entice a user to open a...

sendmail: X.509 NULL spoofing vulnerability

Background sendmail is a widely-used Mail Transport Agent MTA. Description A vulnerability has been discovered in sendmail. Please review the CVE identifier referenced below for details. Impact A remote attacker might employ a specially crafted certificate to conduct man-in-the-middle attacks on...

Adobe Flash Player: Multiple vulnerabilities

Background The Adobe Flash Player is a renderer for the SWF file format, which is commonly used to provide interactive websites. Description Multiple vulnerabilities have been discovered in Adobe Flash Player. Please review the CVE identifiers referenced below for details. Impact A remote attacke...

gdk-pixbuf: Denial of service

Background gdk-pixbuf is an image loading library for GTK+. Description Two vulnerabilities have been found in gdk-pixbuf: The "gdkpixbufgifimageload" function in io-gif.c fails to properly handle certain return values from subroutines CVE-2011-2485. The "readbitmapfiledata" function in io-xbm.c...

Pidgin: Multiple vulnerabilities

Background Pidgin is an GTK Instant Messenger client. Description Multiple vulnerabilities have been discovered in Pidgin. Please review the CVE identifiers referenced below for details. Impact These vulnerabilities allow for arbitrary file retrieval, Denial of Service and arbitrary code executio...

ConnMan: Multiple vulnerabilities

Background ConnMan provides a daemon for managing Internet connections. Description Multiple vulnerabilities have been found in ConnMan: Errors in inet.c and rtnl.c prevent ConnMan from checking the origin of netlink messages CVE-2012-2320. ConnMan does not properly check for shell escapes when...

Audacious Plugins: User-assisted execution of arbitrary code

Background Plugins for the Audacious music player. Description Multiple vulnerabilities have been found in Audacious Plugins: The "CSoundFile::ReadWav" function in loadwav.cpp contains an integer overflow which could cause a heap-based buffer overflow CVE-2011-2911. The "CSoundFile::ReadS3M"...

gif2png: Multiple vulnerabilities

Background gif2png converts images from GIF format to PNG format. Description Two vulnerabilities have been found in gif2png: A boundary error in gif2png.c could cause a buffer overflow CVE-2010-4694. The patch for CVE-2009-5018 causes gif2png to truncate GIF pathnames CVE-2010-4695. Impact A...

Heimdal: Arbitrary code execution

Background Heimdal is a free implementation of Kerberos 5. Description A boundary error in the "encryptkeyid" function in appl/telnet/libtelnet/encrypt.c of the telnet daemon and client could cause a buffer overflow. Impact An unauthenticated remote attacker may be able to execute arbitrary code...

Asterisk: Denial of service

Background Asterisk is an open source telephony engine and toolkit. Description A vulnerability has been found in Asterisk's handling of certain encrypted streams where the ressrtp module has been loaded but video support has not been enabled. Impact A remote attacker could send a specially craft...

Chromium: Multiple vulnerabilities

Background Chromium is an open source web browser project. Description Multiple vulnerabilities have been discovered in Chromium. Please review the CVE identifiers and release notes referenced below for details. Impact A remote attacker could entice a user to open a specially crafted web site usi...

phpDocumentor: Function call injection

Background The phpDocumentor package provides automatic documenting of PHP API directly from the source. Description phpDocumentor bundles Smarty with the modifier.regexreplace.php plug-in which does not properly sanitize input related to the ASCII NUL character in a search string. Impact A remot...

Avahi: Denial of service

Background Avahi is a system which facilitates service discovery on a local network. Description Multiple vulnerabilities have been discovered in Avahi. Please review the CVE identifiers referenced below for details. Impact A remote attacker could cause a Denial of Service. Workaround There is no...

vsftpd: Denial of service

Background vsftpd is a very secure FTP daemon written with speed, size and security in mind. Description A Denial of Service vulnerability was discovered in vsftpd. Please review the CVE identifier referenced below for details. Impact A remote authenticated attacker could cause a Denial of Servic...

nano: Multiple vulnerabilities

Background nano is a GNU GPL'd Pico clone with more functionality. Description Multiple race condition vulnerabilities have been discovered in nano. For further information please consult the CVE entries referenced below. Impact Under certain conditions, a local, user-assisted attacker could...

Adobe Reader: Multiple vulnerabilities

Background Adobe Reader formerly Adobe Acrobat Reader is a closed-source PDF reader. Description Multiple vulnerabilities were discovered in Adobe Reader. For further information please consult the CVE entries and the Adobe Security Bulletin referenced below. Impact A remote attacker might entice...

ModPlug: User-assisted execution of arbitrary code

Background ModPlug is a library for playing MOD-like music. Description Two vulnerabilities have been reported in ModPlug: dummy reported an integer overflow in the CSoundFile::ReadMed function when processing a MED file with a crafted song comment or song name, which triggers a heap-based buffer...

Syslog-ng: Chroot escape

Background Syslog-ng is a flexible and scalable system logger. Description Florian Grandel reported that Syslog-ng does not call chdir before chroot which leads to an inherited file descriptor to the current working directory. Impact A local attacker might exploit a separate vulnerability in...

libpng: Information disclosure

Background libpng is the official PNG reference library used to read, write and manipulate PNG images. Description Jeff Phillips discovered that libpng does not properly parse 1-bit interlaced images with width values that are not divisible by 8, which causes libpng to include uninitialized bits ...

Real VNC: User-assisted execution of arbitrary code

Background Real VNC is a remote desktop viewer display system. Description An unspecified vulnerability has been discovered int the CMsgReader::readRect function in the VNC Viewer component, related to the encoding type of RFB protocol data. Impact A remote attacker could entice a user to connect...

OpenSSL: Certificate validation error

Background OpenSSL is an Open Source toolkit implementing the Secure Sockets Layer SSL v2/v3 and Transport Layer Security TLS v1 as well as a general purpose cryptography library. Description The Google Security Team reported that several functions incorrectly check the result after calling the...

sudo: Privilege escalation

Background sudo allows a system administrator to give users the ability to run commands as other users. Description Harald Koenig discovered that sudo incorrectly handles group specifications in RunasAlias and related entries when a group is specified in the list using %group syntax, to allow a...

Tremulous: User-assisted execution of arbitrary code

Background Tremulous is a team-based First Person Shooter game. Description It has been reported that Tremulous includes a vulnerable version of the ioQuake3 engine GLSA 200605-12, CVE-2006-2236. Impact A remote attacker could entice a user to connect to a malicious games server, possibly resulti...

cbrPager: User-assisted execution of arbitrary code

Background cbrPager is a comic book pager. Description Mamoru Tasaka discovered that filenames of the image archives are not properly sanitized before being passed to decompression utilities like unrar and unzip, which use the system libc library call. Impact A remote attacker could entice a user...

KDE start_kdeinit: Multiple vulnerabilities

Background KDE is a feature-rich graphical desktop environment for Linux and Unix-like operating systems. startkdeinit is a wrapper for kdeinit. Description Vulnerabilities have been reported in the processing of user-controlled data by startkdeinit, which is setuid root by default. Impact A loca...

PHP Toolkit: Data disclosure and Denial of service

Background PHP Toolkit is a utility to manage parallel installations of PHP within Gentoo. It is executed by the PHP ebuilds at setup. Description Toni Arnold, David Sveningsson, Michal Bartoszkiewicz, and Joseph reported that php-select does not quote parameters passed to the "tr" command, which...

MPlayer: Multiple buffer overflows

Background MPlayer is a media player incuding support for a wide range of audio and video formats. Description The following errors have been discovered in MPlayer: Felipe Manzano and Anibal Sacco Core Security Technologies reported an array indexing error in the file libmpdemux/demuxmov.c when...

SplitVT: Privilege escalation

Background SplitVT is a program for splitting terminals into two shells. Description Mike Ashton reported that SplitVT does not drop group privileges before executing the xprop utility. Impact A local attacker could exploit this vulnerability to gain the "utmp" group privileges. Workaround There ...

ClamAV: Multiple vulnerabilities

Background Clam AntiVirus is a free anti-virus toolkit for UNIX, designed especially for e-mail scanning on mail gateways. Description An integer overflow has been reported in the "cliscanpe" function in file libclamav/pe.c CVE-2008-0318. Another unspecified vulnerability has been reported in fil...

ClamAV: Multiple vulnerabilities

Background Clam AntiVirus is a free anti-virus toolkit for UNIX, designed especially for e-mail scanning on mail gateways. Description iDefense reported an integer overflow vulnerability in the cliscanpe function when parsing Portable Executable PE files packed in the MEW format, that could be...

Qt: Buffer overflow

Background Qt is a cross-platform GUI framework, which is used e.g. by KDE. Description Dirk Mueller from the KDE development team discovered a boundary error in file qutfcodec.cpp when processing Unicode strings. Impact A remote attacker could send a specially crafted Unicode string to a...

ClamAV: Multiple Denials of Service

Background ClamAV is a GPL virus scanner. Description Several vulnerabilities were discovered in ClamAV by various researchers: Victor Stinner INL discovered that the OLE2 parser may enter in an infinite loop CVE-2007-2650. A boundary error was also reported by an anonymous researcher in the file...

FreeType: Buffer overflow

Background FreeType is a True Type Font rendering library. Description Victor Stinner discovered a heap-based buffer overflow in the function GetVMetrics in src/truetype/ttgload.c when processing TTF files with a negative npoints attribute. Impact A remote attacker could entice a user to open a...

Ktorrent: Multiple vulnerabilities

Background Ktorrent is a Bittorrent client for KDE. Description Bryan Burns of Juniper Networks discovered a vulnerability in chunkcounter.cpp when processing large or negative idx values, and a directory traversal vulnerability in torrent.cpp. Impact A remote attacker could entice a user to...

LTSP: Authentication bypass in included LibVNCServer code

Background The Linux Terminal Server Project adds thin-client support to Linux servers. Description The LTSP server includes vulnerable LibVNCServer code, which fails to properly validate protocol types effectively letting users decide what protocol to use, such as "Type 1 - None" GLSA-200608-05...

Nexuiz: Multiple vulnerabilities

Background Nexuiz is a multi-player FPS game which uses a modified version of the Quake 1 engine. Description Nexuiz fails to correctly validate input within "clientcommands". There is also a failure to correctly handle connection attempts from remote hosts. Impact Using a specially crafted...

Samba: Multiple vulnerabilities

Background Samba is a suite of SMB and CIFS client/server programs for UNIX. Description A format string vulnerability exists in the VFS module when handling AFS file systems and an infinite loop has been discovered when handling file rename operations. Impact A user with permission to write to a...

Ingo H3: Folder name shell command injection

Background Ingo H3 is a generic frontend for editing Sieve, procmail, maildrop and IMAP filter rules. Description Ingo H3 fails to properly escape shell metacharacters in procmail rules. Impact A remote authenticated attacker could craft a malicious rule which could lead to the execution of...

RPM: Buffer overflow

Background The Red Hat Package Manager RPM is a command line driven package management system capable of installing, uninstalling, verifying, querying, and updating computer software packages. Description Vladimir Mosgalin has reported that when processing certain packages, RPM incorrectly...

GraphicsMagick: PALM and DCM buffer overflows

Background GraphicsMagick is a collection of tools and libraries which support reading, writing, and manipulating images in many major formats. Description M. Joonas Pihlaja has reported that a boundary error exists within the ReadDCMImage function of coders/dcm.c, causing the improper handling o...

Mozilla Network Security Service (NSS): RSA signature forgery

Background The Mozilla Network Security Service is a library implementing security features like SSL v.2/v.3, TLS, PKCS 5, PKCS 7, PKCS 11, PKCS 12, S/MIME and X.509 certificates. Description Daniel Bleichenbacher discovered that it might be possible to forge signatures signed by RSA keys with th...

WordPress: Privilege escalation

Background WordPress is a PHP and MySQL based multiuser blogging system. Description The WordPress developers have confirmed a vulnerability in capability checking for plugins. Impact By exploiting a flaw, a user can circumvent WordPress access restrictions when using plugins. The actual impact...

SHOUTcast server: Multiple vulnerabilities

Background SHOUTcast server is a streaming audio server. Description The SHOUTcast server is vulnerable to a file disclosure when the server receives a specially crafted GET request. Furthermore it also fails to sanitize the input passed to the "Description", "URL", "Genre", "AIM", and "ICQ"...

Cyrus-SASL: DIGEST-MD5 Pre-Authentication Denial of service

Background Cyrus-SASL is an implementation of the Simple Authentication and Security Layer. Description Cyrus-SASL contains an unspecified vulnerability in the DIGEST-MD5 process that could lead to a Denial of Service. Impact An attacker could possibly exploit this vulnerability by sending...

xine-lib, FFmpeg: Heap-based buffer overflow

Background xine is a GPL high-performance, portable and reusable multimedia playback engine. xine-lib is xine's core engine. FFmpeg is a very fast video and audio converter and is used in xine-lib. Description Simon Kilvington has reported a vulnerability in FFmpeg libavcodec. The flaw is due to ...

CenterICQ: Multiple vulnerabilities

Background CenterICQ is a text-based instant messaging interface that supports multiple protocols. It includes the ktools library, which provides text-mode user interface controls. Description Gentoo developer Wernfried Haas discovered that when the "Enable peer-to-peer communications" option is...

Opera: Command-line URL shell command injection

Background Opera is a multi-platform web browser. Description Peter Zelezny discovered that the shell script used to launch Opera parses shell commands that are enclosed within backticks in the URL provided via the command line. Impact A remote attacker could exploit this vulnerability by enticin...

Webmin, Usermin: Format string vulnerability

Background Webmin is a web-based interface for Unix-like systems. Usermin is a simplified version of Webmin designed for use by normal users rather than system administrators. Description Jack Louis discovered that the Webmin and Usermin "miniserv.pl" web server component is vulnerable to a Perl...

phpMyAdmin: Local file inclusion and XSS vulnerabilities

Background phpMyAdmin is a tool written in PHP intended to handle the administration of MySQL over the web. Description Stefan Esser discovered that by calling certain PHP files directly, it was possible to workaround the grabglobals.lib.php security model and overwrite the $cfg configuration...

uw-imap: Remote buffer overflow

Background uw-imap is the University of Washington's IMAP and POP server daemons. Description Improper bounds checking of user supplied data while parsing IMAP mailbox names can lead to overflowing the stack buffer. Impact Successful exploitation requires an authenticated IMAP user to request a...