RealPlayer: Buffer overflow vulnerability

Background RealPlayer is a multimedia player capable of handling multiple multimedia file formats. Description RealPlayer is vulnerable to a buffer overflow when processing malicious SWF files. Impact By enticing a user to open a specially crafted SWF file an attacker could execute arbitrary code...

Macromedia Flash Player: Arbitrary code execution

Background The Macromedia Flash Player is a renderer for the popular SWF filetype which is commonly used to provide interactive websites, digital experiences and mobile content. Description The Macromedia Flash Player contains multiple unspecified vulnerabilities. Impact An attacker serving a...

Opera: Command-line URL shell command injection

Background Opera is a multi-platform web browser. Description Peter Zelezny discovered that the shell script used to launch Opera parses shell commands that are enclosed within backticks in the URL provided via the command line. Impact A remote attacker could exploit this vulnerability by enticin...

Ethereal: Buffer overflow in OSPF protocol dissector

Background Ethereal is a feature-rich network protocol analyzer. It provides protocol analyzers for various network flows, including one for Open Shortest Path First OSPF Interior Gateway Protocol. Description iDEFENSE reported a possible overflow due to the lack of bounds checking in the...

eix: Insecure temporary file creation

Background eix is a small utility for searching ebuilds with indexing for fast results. Description Eric Romang discovered that eix creates a temporary file with a predictable name. eix creates a temporary file in /tmp/eix..sync where is the process ID of the shell running eix. Impact A local...

AbiWord: RTF import stack-based buffer overflow

Background AbiWord is a free and cross-platform word processing program. It allows to import RTF files into AbiWord documents. Description Chris Evans discovered that the RTF import function in AbiWord is vulnerable to a stack-based buffer overflow. Impact An attacker could design a malicious RTF...

PhpWiki: Arbitrary command execution through XML-RPC

Background PhpWiki is an application that creates a web site where anyone can edit the pages through HTML forms. Description Earlier versions of PhpWiki contain an XML-RPC library that improperly handles XML-RPC requests and responses with malformed nested tags. Impact A remote attacker could...

Tor: Information disclosure

Background Tor is an implementation of second generation Onion Routing, a connection-oriented anonymizing communication service. Description The Diffie-Hellman implementation of Tor fails to verify the cryptographic strength of keys which are used during handshakes. Impact By setting up a malicio...

bluez-utils: Bluetooth device name validation vulnerability

Background bluez-utils are the utilities for use with the BlueZ implementation of the Bluetooth wireless standards for Linux. Description The name of a Bluetooth device is improperly validated by the hcid utility when a remote device attempts to pair itself with a computer. Impact An attacker cou...

AMD64 x86 emulation base libraries: Buffer overflow

Background The x86 emulation base libraries for AMD64 emulate the x86 32-bit architecture on the AMD64 64-bit architecture. Description Earlier versions of emul-linux-x86-baselibs contain a vulnerable version of zlib, which may lead to a buffer overflow. Impact By creating a specially crafted...

Mozilla Thunderbird: Multiple vulnerabilities

Background Mozilla Thunderbird is the next-generation mail client from the Mozilla project. Description The following vulnerabilities were found and fixed in Mozilla Thunderbird: "mozbugra4" and "shutdown" discovered that Thunderbird was improperly cloning base objects MFSA 2005-56. "mozbugra4"...

Dzip: Directory traversal vulnerability

Background Dzip is a compressor and uncompressor especially made for demo recordings of id's Quake. Description Dzip is vulnerable to a directory traversal attack when extracting archives. Impact An attacker could exploit this vulnerability by creating a specially crafted archive to extract files...

LimeWire: Disclosure of sensitive information

Background LimeWire is a Java peer-to-peer client compatible with the Gnutella file-sharing protocol. Description Two input validation errors were found in the handling of Gnutella GET requests CAN-2005-0788 and magnet requests CAN-2005-0789. Impact A remote attacker can craft a specific Gnutella...

Grip: CDDB response overflow

Background Grip is a GTK+ based audio CD player/ripper. Description Joseph VanAndel has discovered a buffer overflow in Grip when processing large CDDB results. Impact A malicious CDDB server could cause Grip to crash by returning more then 16 matches, potentially allowing the execution of...

VMware Workstation: Untrusted library search path

Background VMware Workstation is a powerful virtual machine for developers and system administrators. Description Tavis Ormandy of the Gentoo Linux Security Audit Team has discovered that VMware Workstation searches for gdk-pixbuf loadable modules in an untrusted, world-writable directory. Impact...

Ethereal: Multiple vulnerabilities

Background Ethereal is a feature rich network protocol analyzer. Description There are multiple vulnerabilities in versions of Ethereal earlier than 0.10.9, including: The COPS dissector could go into an infinite loop CAN-2005-0006. The DLSw dissector could cause an assertion, making Ethereal exi...

Adobe Acrobat Reader: Buffer overflow vulnerability

Background Adobe Acrobat Reader is a utility used to view PDF files. Description A buffer overflow has been discovered in the email processing of Adobe Acrobat Reader. This flaw exists in the mailListIsPdf function, which checks if the input file is an email message containing a PDF file. Impact ...

GIMPS, SETI@home, ChessBrain: Insecure installation

Background GIMPS is a client for the distributed Great Internet Mersenne Prime Search. SETI@home is the client for the Search for Extraterrestrial Intelligence SETI project. ChessBrain is the client for the distributed chess supercomputer. Description GIMPS, SETI@home and ChessBrain ebuilds insta...

Davfs2, lvm-user: Insecure tempfile handling

Background Davfs2 is a file system driver that allows you to mount a WebDAV server as a local disk drive. lvm-user is a package providing userland utilities for LVM Logical Volume Management 1.x features. Description Florian Schilhabel from the Gentoo Linux Security Audit Team found that Davfs2...

mtink: Insecure tempfile handling

Background mtink is a status monitor and inkjet cartridge changer for some Epson printers. Description Tavis Ormandy from Gentoo Linux discovered that mtink uses insecure permissions on temporary files. Impact A local attacker could create symbolic links in the temporary files directory, pointing...

glibc: Insecure tempfile handling in catchsegv script

Background glibc is a package that contains the GNU C library. Description The catchsegv script creates temporary files in world-writeable directories with predictable names. Impact A local attacker could create symbolic links in the temporary files directory, pointing to a valid file somewhere o...

xine-lib: Multiple vulnerabilities

Background xine-lib is a multimedia library which can be utilized to create multimedia frontends. Description xine-lib contains two stack-based overflows and one heap-based overflow. In the code reading VCD disc labels, the ISO disc label is copied into an unprotected stack buffer of fixed size...

Pavuk: Remote buffer overflow

Background Pavuk is web spider and website mirroring tool. Description When Pavuk connects to a web server and the server sends back the HTTP status code 305 Use Proxy, Pavuk copies data from the HTTP Location header in an unsafe manner. Impact An attacker could cause a stack-based buffer overflo...

Multiple XSS Vulnerabilities in SquirrelMail

Background SquirrelMail is a webmail package written in PHP. It supports IMAP and SMTP, and can optionally be installed with SQL support. Description Several unspecified cross-site scripting XSS vulnerabilities and a well hidden SQL injection vulnerability were found. An XSS attack allows an...

Exim verify=header_syntax buffer overflow

Background Exim is an highly configurable message transfer agent MTA developed at the University of Cambridge. Description When the option "verify = headersyntax" is used in an ACL in the configuration file, Exim is vulnerable to a buffer overflow attack that can be triggered remotely by sending...

KDE Personal Information Management Suite Remote Buffer Overflow Vulnerability

Background KDE-PIM is an application suite designed to manage mail, addresses, appointments, and contacts. Description A buffer overflow may occur in KDE-PIM's VCF file reader when a maliciously crafted VCF file is opened by a user on a vulnerable system. Impact A remote attacker may unauthorized...

QEMU: Multiple Vulnerabilities

Background QEMU is a generic and open source machine emulator and virtualizer. Description Multiple vulnerabilities have been discovered in QEMU. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifiers for details. Workaround There is no...

nghttp2: Multiple Vulnerabilities

Background Nghttp2 is an implementation of HTTP/2 and its header compression algorithm HPACK in C. Description Multiple vulnerabilities have been discovered in nghttp2. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifiers for details...

BusyBox: Multiple Vulnerabilities

Background BusyBox is set of tools for embedded systems and is a replacement for GNU Coreutils. Description Multiple vulnerabilities have been discovered in BusyBox. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifiers for details...

KTextEditor: Arbitrary Local Code Execution

Background Framework providing a full text editor component for KDE. Description A vulnerability has been discovered in KTextEditor. Please review the CVE identifiers referenced below for details. Impact KTextEditor executes binaries without user interaction in a few cases, e.g. KTextEditor will...

Eclipse Mosquitto: Multiple Vulnerabilities

Background Eclipse Mosquitto is an open source MQTT v3 broker. Description Multiple vulnerabilities have been discovered in Eclipse Mosquitto. Please review the CVE identifier referenced below for details. Impact Please review the referenced CVE identifiers for details. Workaround There is no kno...

Joblib: Arbitrary Code Execution

Background Joblib is a set of tools to provide lightweight pipelining in Python. In particular: 1. transparent disk-caching of functions and lazy re-evaluation memoize pattern 2. easy simple parallel computing Joblib is optimized to be fast and robust on large data in particular and has specific...

Tor: Multiple Vulnerabilities

Background Tor is an implementation of second generation Onion Routing, a connection-oriented anonymizing communication service. Description Multiple vulnerabilities have been discovered in Tor. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CV...

ProFTPd: Memory Disclosure

Background ProFTPD is an advanced and very configurable FTP server. Description ProFTPd unconditionally sends passwords to Radius servers for authentication in multiples of 16 bytes. If a password is not of a length that is a multiple of 16 bytes, ProFTPd will read beyond the end of the password...

Open Asset Import Library ("assimp"): Multiple Vulnerabilities

Background Open Asset Import Library is a library to import and export various 3d-model-formats including scene-post-processing to generate missing render data. Description Multiple vulnerabilities have been discovered in Fetchmail, the worst of which could result in email disclosure to third...

Yubico pam-u2f: Local PIN Bypass vulnerability

Background Yubico pam-u2f is a PAM module for FIDO2 and U2F keys. Description A logic issue in Yubico pam-u2f could result in the bypass of a PIN entry requirement when authenticating with FIDO2. Impact An attacker with local access to certain applications using pam-u2f for authentication could...

ClamAV: Denial of service

Background ClamAV is a GPL virus scanner. Description A vulnerability has been discovered in ClamAV. Please review the CVE identifier referenced below for details. Impact A remote attacker could cause ClamAV to scan a specially crafted file, possibly resulting a Denial of Service condition...

ZeroMQ: Denial of service

Background Looks like an embeddable networking library but acts like a concurrency framework. Description It was discovered that ZeroMQ does not properly handle connecting peers before a handshake is completed. Impact An unauthenticated remote attacker able to connect to a ZeroMQ endpoint, even...

Wireshark: Denial of service

Background Wireshark is a network protocol analyzer formerly known as ethereal. Description A double free error was discovered in Wireshark’s Kafka dissector. Impact A remote attacker could exploit these vulnerabilities by sending a malformed packet or enticing a user to read a malformed packet...

GDK-PixBuf: Remote code execution

Background GDK-PixBuf is an image loading library for GTK+. Description Several integer overflows were discovered in GDK-PixBuf’s gifgetlzw function. Impact A remote attacker, by enticing a user to process a specially crafted image file, could execute arbitrary code or cause a Denial of Service...

MiniUPnPc: Arbitrary code execution

Background The client library, enabling applications to access the services provided by an UPnP “Internet Gateway Device” present on the network. Description An exploitable buffer overflow vulnerability exists in the XML parser functionality of the MiniUPnP library. Impact A remote attacker, by...

socat: Multiple vulnerabilities

Background socat is a multipurpose bidirectional relay, similar to netcat. Description Multiple vulnerabilities have been discovered in socat. Please review the references below for details. Impact A remote attacker could possibly execute arbitrary code with the privileges of the process, or obta...

libfpx: Denial of service

Background A library for manipulating FlashPIX images. Description A double free vulnerability has been discovered in the FreeAllMemory function in jpeg/dectile.c. Impact A remote attacker could entice a user to open a specially crafted FPX image using an application linked against libfpx, possib...

libCapsiNetwork: Denial of service

Background libCapsiNetwork is a C++ network library to allow fast development of server daemon processes. Description An off-by-one buffer overflow in libcapsinetwork network handling code is discovered. Impact A remote attacker could send a specially crafted request to application, that is linke...

c-icap: Denial of service

Background c-icap is an implementation of an ICAP server. It can be used with HTTP proxies that support the ICAP protocol to implement content adaptation and filtering services. Description c-icap contains a flaw in the parserequest function of request.c that may allow a remote denial of service...

sudo: Privilege escalation

Background sudo allows a system administrator to give users the ability to run commands as other users. Access to commands may also be granted on a range to hosts. Description When the Sudo envreset option is disabled it is enabled by default, certain environment variables are not blacklisted as...

Bacula: Information disclosure

Background Bacula is a network based backup suite. Description Bacula does not properly enforce console access control lists. Impact A remote authenticated attacker may be able to bypass restrictions to obtain sensitive information. Workaround There is no known workaround at this time. Resolution...

ArgyllCMS: User-assisted execution of arbitrary code

Background ArgyllCMS is an ICC compatible color management system that supports accurate ICC profile creation for scanners, cameras and film recorders. Description Multiple integer overflow vulnerabilities have been discovered in the ICC Format Library in ArgyllCMS. Impact A remote attacker could...

OpenSSL: Denial of service

Background OpenSSL is an Open Source toolkit implementing the Secure Sockets Layer SSL v2/v3 and Transport Layer Security TLS v1 as well as a general purpose cryptography library. Description A flaw in the ssl3takemac function can result in a NULL pointer dereference. Impact A remote attacker cou...

CEDET: Privilege escalation

Background CEDET is a Collection of Emacs Development Environment Tools written with the end goal of creating an advanced development environment in Emacs. Description An untrusted search path vulnerability was discovered in CEDET. Impact A local attacker could escalate his privileges via a...