vzctl: Security bypass

Background vzctl is a set of control tools for the OpenVZ server virtualization solution. Description It was discovered that vzctl determined the virtual environment VE layout based on the presence of root.hdd/DiskDescriptor.xml in the VE private directory. This allows local simfs container CT ro...

GnuPG: Multiple vulnerabilities

Background The GNU Privacy Guard, GnuPG, is a free replacement for the PGP suite of cryptographic software. Description Multiple vulnerabilities have been discovered in GnuPG and libgcrypt, please review the CVE identifiers referenced below for details. Impact A local attacker could possibly caus...

libfpx: Denial of service

Background A library for manipulating FlashPIX images. Description A double free vulnerability has been discovered in the FreeAllMemory function in jpeg/dectile.c. Impact A remote attacker could entice a user to open a specially crafted FPX image using an application linked against libfpx, possib...

OpenVPN: Denial of service

Background OpenVPN is a multi-platform, full-featured SSL VPN solution. Description OpenVPN does not properly handle control channel packets that are too small. Impact A remote authenticated attacker could send a specially crafted control channel packet, possibly resulting in a Denial of Service...

Xen: Denial of service

Background Xen is a bare-metal hypervisor. Description Multiple vulnerabilities have been discovered in Xen. Please review the CVE identifiers referenced below for details. Impact A local user could possibly cause a Denial of Service condition. Workaround There is no known workaround at this time...

Django: Multiple vulnerabilities

Background Django is a Python-based web framework. Description Multiple vulnerabilities have been discovered in Django. Please review the CVE identifiers referenced below for details. Impact A remote attacker may be able to create a Denial of Service condition, obtain sensitive information, or...

PlRPC: Arbitrary code execution

Background The Perl RPC Module is a Perl module that implements IDL-free RPCs. Description PlRPC uses Storable module for serialization and deserialization of untrusted data. Deserialized data can contain objects which can lead to loading of foreign modules, and possible execution of arbitrary...

KVIrc: Multiple vulnerabilities

Background KVIrc is a free portable IRC client based on Qt. Description Multiple vulnerabilities have been discovered in KVIrc. Please review the CVE identifiers referenced below for details. Impact A remote attacker could possibly execute arbitrary code with the privileges of the process, cause ...

libtheora: Arbitrary code execution

Background libtheora is the reference implementation of Theora, a free and open video compression format from the Xiph.org Foundation. Description An integer overflow flaw has been discovered in libtheora. Impact A remote attacker could execute arbitrary code or cause a Denial of Service conditio...

cpio: Arbitrary code execution

Background GNU cpio copies files into or out of a cpio or tar archive. Description Cpio contains a heap-based buffer overflow in the rmtread function in lib/rtapelib.c. Impact A remote server could sending more data than was requested, related to archive filenames that contain a : colon character...

Open DC Hub: Arbitrary code execution

Background Open DC Hub is the hub software for the Direct Connect file sharing network. Description A stack-based buffer overflow flaw has been discovered in the way Open DC Hub sanitized content of a user’s MyINFO message. Impact A remote authenticated user may be able to execute arbitrary code ...

Netpbm: User-assisted arbitrary code execution

Background Netpbm is a toolkit for manipulation of graphic images, including conversion of images between a variety of different formats. Description A stack-based buffer overflow exists in converter/ppm/xpmtoppm.c in Netpbm. Impact A remote attacker could entice a user to open a specially crafte...

acpid2: Privilege escalation

Background acpid2 is a daemon for Advanced Configuration and Power Interface. Description acpid2 does not properly use the pidof program in powerbtn.sh. Impact A local attacker could gain escalated privileges. Workaround There is no known workaround at this time. Resolution All acpid2 users shoul...

Dropbear: Multiple vulnerabilities

Background Dropbear is an SSH server and client designed with a small memory footprint. Description Multiple vulnerabilities have been discovered in Dropbear. Please review the CVE identifier and Gentoo bug referenced below for details. Impact A remote attacker could send a specially crafted...

LibRaw, libkdcraw: Multiple vulnerabilities

Background LibRaw is a library for reading RAW files obtained from digital photo cameras. libkdcraw is a wrapper for LibRaw within KDE. Description Multiple vulnerabilities have been discovered in LibRaw and libkdcraw. Please review the CVE identifiers referenced below for details. Impact A remot...

SquidClamav: Denial of service

Background SquidClamav is a HTTP anti-virus for Squid based on ClamAV and ICAP. Description SquidClamav does not properly escape URLs before passing them to the system command call. Impact A remote attacker could send a specially crafted URL to SquidClamav, possibly resulting in a Denial of Servi...

Gajim: Multiple vulnerabilities

Background Gajim is a Jabber and XMPP client written in PyGTK. Description Multiple vulnerabilities have been discovered in Gajim. Please review the CVE identifiers referenced below for details. Impact A remote attacker could entice a user to open a specially crafted link using Gajim, possibly...

Gnash: Multiple vulnerabilities

Background Gnash is a GNU flash movie player that supports many SWF features. Description Multiple vulnerabilities have been found in Gnash: The "nsPluginInstance::setupCookies" function in plugin.cpp creates world-readable cookies with predictable file names CVE-2011-4328. The "GnashImage::size"...

sendmail: X.509 NULL spoofing vulnerability

Background sendmail is a widely-used Mail Transport Agent MTA. Description A vulnerability has been discovered in sendmail. Please review the CVE identifier referenced below for details. Impact A remote attacker might employ a specially crafted certificate to conduct man-in-the-middle attacks on...

ConnMan: Multiple vulnerabilities

Background ConnMan provides a daemon for managing Internet connections. Description Multiple vulnerabilities have been found in ConnMan: Errors in inet.c and rtnl.c prevent ConnMan from checking the origin of netlink messages CVE-2012-2320. ConnMan does not properly check for shell escapes when...

Chromium: Multiple vulnerabilities

Background Chromium is an open source web browser project. Description Multiple vulnerabilities have been discovered in Chromium. Please review the CVE identifiers and release notes referenced below for details. Impact A remote attacker could entice a user to open a specially crafted web site usi...

Audacious Plugins: User-assisted execution of arbitrary code

Background Plugins for the Audacious music player. Description Multiple vulnerabilities have been found in Audacious Plugins: The "CSoundFile::ReadWav" function in loadwav.cpp contains an integer overflow which could cause a heap-based buffer overflow CVE-2011-2911. The "CSoundFile::ReadS3M"...

Heimdal: Arbitrary code execution

Background Heimdal is a free implementation of Kerberos 5. Description A boundary error in the "encryptkeyid" function in appl/telnet/libtelnet/encrypt.c of the telnet daemon and client could cause a buffer overflow. Impact An unauthenticated remote attacker may be able to execute arbitrary code...

Asterisk: Denial of service

Background Asterisk is an open source telephony engine and toolkit. Description A vulnerability has been found in Asterisk's handling of certain encrypted streams where the ressrtp module has been loaded but video support has not been enabled. Impact A remote attacker could send a specially craft...

Chromium: Multiple vulnerabilities

Background Chromium is an open source web browser project. Description Multiple vulnerabilities have been discovered in Chromium. Please review the CVE identifiers and release notes referenced below for details. Impact A remote attacker could entice a user to open a specially crafted web site usi...

gif2png: User-assisted execution of arbitrary code

Background gif2png is a command line program that converts image files from the Graphics Interchange Format GIF format to the Portable Network Graphics PNG format. Description gif2png contains a command line parsing vulnerability that may result in a stack overflow due to an unexpectedly long inp...

lighttpd: Denial of service

Background lighttpd is a lightweight high-performance web server. Description Li Ming reported that lighttpd does not properly process packets that are sent overly slow. Impact A remote attacker might send specially crafted packets to a server running lighttpd, possibly resulting in a Denial of...

sudo: Privilege escalation

Background sudo allows a system administrator to give users the ability to run commands as other users. Description The command matching functionality does not properly handle when a file in the current working directory has the same name as a pseudo-command in the sudoers file and the PATH...

nano: Multiple vulnerabilities

Background nano is a GNU GPL'd Pico clone with more functionality. Description Multiple race condition vulnerabilities have been discovered in nano. For further information please consult the CVE entries referenced below. Impact Under certain conditions, a local, user-assisted attacker could...

UW IMAP toolkit: Multiple vulnerabilities

Background The UW IMAP toolkit is a daemon for the IMAP and POP3 network mail protocols. The c-client library provides an API for IMAP, POP3 and other protocols. Description Multiple vulnerabilities were found in the UW IMAP toolkit: Aron Andersson and Jan Sahlin of Bitsec reported boundary error...

DokuWiki: Local file inclusion

Background DokuWiki is a standards compliant Wiki system written in PHP. Description girex reported that data from the "configcascade" parameter in inc/init.php is not properly sanitized before being used. Impact A remote attacker could exploit this vulnerability to execute PHP code from arbitrar...

ModPlug: User-assisted execution of arbitrary code

Background ModPlug is a library for playing MOD-like music. Description Two vulnerabilities have been reported in ModPlug: dummy reported an integer overflow in the CSoundFile::ReadMed function when processing a MED file with a crafted song comment or song name, which triggers a heap-based buffer...

libsndfile: User-assisted execution of arbitrary code

Background libsndfile is a C library for reading and writing files containing sampled sound. Description Alin Rad Pop from Secunia Research reported an integer overflow when processing CAF description chunks, leading to a heap-based buffer overflow. Impact A remote attacker could entice a user to...

Real VNC: User-assisted execution of arbitrary code

Background Real VNC is a remote desktop viewer display system. Description An unspecified vulnerability has been discovered int the CMsgReader::readRect function in the VNC Viewer component, related to the encoding type of RFB protocol data. Impact A remote attacker could entice a user to connect...

JHead: Multiple vulnerabilities

Background JHead is an exif jpeg header manipulation tool. Description Marc Merlin and John Dong reported multiple vulnerabilities in JHead: A buffer overflow in the DoCommand function when processing the cmd argument and related to potential string overflows CVE-2008-4575. An insecure creation o...

JasPer: User-assisted execution of arbitrary code

Background The JasPer Project is an open-source initiative to provide a free software-based reference implementation of the codec specified in the JPEG-2000 Part-1 jpeg2k standard. Description Marc Espie and Christian Weisgerber have discovered multiple vulnerabilities in JasPer: Multiple integer...

Honeyd: Insecure temporary file creation

Background Honeyd is a small daemon that creates virtual hosts on a network. Description Dmitry E. Oboukhov reported an insecure temporary file usage within the "test.sh" script. Impact A local attacker could perform symlink attacks and overwrite arbitrary files with the privileges of the user...

ClamAV: Multiple Denials of Service

Background Clam AntiVirus is a free anti-virus toolkit for UNIX, designed especially for e-mail scanning on mail gateways. Description Damian Put has discovered an out-of-bounds memory access while processing Petite files CVE-2008-2713, CVE-2008-3215. Also, please note that the 0.93 ClamAV branch...

OpenOffice.org: User-assisted execution of arbitrary code

Background OpenOffice.org is an open source office productivity suite, including word processing, spreadsheet, presentation, drawing, data charting, formula editing, and file conversion facilities. Description Sean Larsson iDefense Labs reported an integer overflow in the function rtlallocateMemo...

Imlib 2: User-assisted execution of arbitrary code

Background Imlib 2 is an advanced replacement library for libraries like libXpm. Description Stefan Cornelius Secunia Research reported two boundary errors in Imlib2: One of them within the load function in the file src/modules/loaders/loaderpnm.c when processing the header of a PNM image file,...

Common Data Format library: User-assisted execution of arbitrary code

Background The Common Data Format library is a scientific data management package which allows programmers and application developers to manage and manipulate scalar, vector, and multi-dimensional data arrays in a platform independent fashion. Description Alfredo Ortega Core Security Technologies...

MoinMoin: Privilege escalation

Background MoinMoin is an advanced and extensible Wiki Engine. Description It has been reported that the user form processing in the file userform.py does not properly manage users when using Access Control Lists or a non-empty superusers list. Impact A remote attacker could exploit this...

Cairo: User-assisted execution of arbitrary code

Background Cairo is a 2D vector graphics library with cross-device output support. Description Multiple integer overflows were reported, one of which Peter Valchev Google Security found to be leading to a heap-based buffer overflow in the cairoimagesurfacecreatefrompng function that processes PNG...

Mozilla Thunderbird: Multiple vulnerabilities

Background Mozilla Thunderbird is a popular open-source email client from the Mozilla project. Description Multiple vulnerabilities have been reported in Mozilla Thunderbird's HTML browser engine CVE-2007-5339 and JavaScript engine CVE-2007-5340 that can be exploited to cause a memory corruption...

Bochs: Multiple vulnerabilities

Background Bochs is a IA-32 x86 PC emulator written in C++. Description Tavis Ormandy of the Google Security Team discovered a heap-based overflow vulnerability in the NE2000 driver CVE-2007-2893. He also discovered a divide-by-zero error in the emulated floppy disk controller CVE-2007-2894. Impa...

HPLIP: Privilege escalation

Background The Hewlett-Packard Linux Imaging and Printing system HPLIP provides drivers for HP's inkjet and laser printers, scanners and fax machines. It integrates with the Common UNIX Printing System CUPS and Scanner Access Now Easy SANE. Description Kees Cook from the Ubuntu Security team...

Bugzilla: Multiple vulnerabilities

Background Bugzilla is a web application designed to help with managing software development. Description Masahiro Yamada found that from the 2.17.1 version, Bugzilla does not properly sanitize the content of the "buildid" parameter when filing bugs CVE-2007-4543. The next two vulnerabilities onl...

PhpWiki: Authentication bypass

Background PhpWiki is an application that creates a web site where anyone can edit the pages through HTML forms. Description The PhpWiki development team reported an authentication error within the file lib/WikiUser/LDAP.php when binding to an LDAP server with an empty password. Impact A remote...

GNU Tar: Directory traversal vulnerability

Background The GNU Tar program provides the ability to create tar archives, as well as various other kinds of manipulation. Description Dmitry V. Levin discovered a directory traversal vulnerability in the containsdotdot function in file src/names.c. Impact By enticing a user to extract a special...

GNU C Library: Integer overflow

Background The GNU C library is the standard C library used by Gentoo Linux systems. It provides programs with basic facilities and interfaces to system calls. ld.so is the dynamic linker which prepares dynamically linked programs for execution by resolving runtime dependencies and related...