3852 matches found
Yubico pam-u2f: Local PIN Bypass vulnerability
Background Yubico pam-u2f is a PAM module for FIDO2 and U2F keys. Description A logic issue in Yubico pam-u2f could result in the bypass of a PIN entry requirement when authenticating with FIDO2. Impact An attacker with local access to certain applications using pam-u2f for authentication could...
rclone: Weak random number generation
Background rclone is a problem to sync files to and from various cloud storage providers. Description Passwords generated with rclone were insecurely generated and are vulnerable to brute force attacks. Impact Data kept secret with a password generated by rclone may be disclosed to a local...
libetpan: Improper STARTTLS handling
Background libetpan is a portable, efficient middleware for different kinds of mail access. Description It was discovered that libetpan was not properly handling state within the STARTTLS protocol handshake. Impact There may be a breach of integrity or confidentiality in connections made using...
yaml-cpp: Denial of service
Background yaml-cpp is a YAML parser and emitter in C++. Description The function Scanner::peek in scanner.cpp may have an assertion failure. Impact An attacker could cause a possible Denial of Service condition. Workaround There is no known workaround at this time. Resolution All yaml-cpp users...
libssh: Denial of service
Background libssh is a multiplatform C library implementing the SSHv2 protocol on client and server side. Description It was discovered that libssh could crash when AES-CTR ciphers are used. Impact A remote attacker running a malicious client or server could possibly crash the counterpart...
Newsbeuter: User-assisted execution of arbitrary code
Background Newsbeuter is a RSS/Atom feed reader for the text console. Description Newsbeuter does not properly escape shell meta-characters in the title and description of RSS feeds when bookmarking. Impact A remote attacker, by enticing a user to open a feed with specially crafted URLs, could...
LibXcursor: User-assisted execution of arbitrary code
Background X.Org X11 libXcursor runtime library. Description It was discovered that libXcursor is prone to several heap overflows when parsing malicious files. Impact A remote attacker, by enticing a user to process a specially crafted cursor file, could possibly execute arbitrary code with the...
D-Bus: Multiple vulnerabilities
Background D-Bus is a message bus system which processes can use to talk to each other. Description Multiple vulnerabilities have been discovered in D-Bus. Please review the original report referenced below for details. Impact An attacker could possibly overwrite arbitrary files named “once” with...
socat: Multiple vulnerabilities
Background socat is a multipurpose bidirectional relay, similar to netcat. Description Multiple vulnerabilities have been discovered in socat. Please review the references below for details. Impact A remote attacker could possibly execute arbitrary code with the privileges of the process, or obta...
CUPS: Multiple vulnerabilities
Background CUPS, the Common Unix Printing System, is a full-featured print server. Description Multiple vulnerabilities have been discovered in cups. Please review the CVE identifiers referenced below for details. Impact A remote attacker could possibly execute arbitrary code with the privileges ...
libXfont: Multiple vulnerabilities
Background libXfont is an X11 font rasterisation library. Description Multiple vulnerabilities have been discovered in libXfont. Please review the CVE identifiers referenced below for details. Impact A remote attacker could possibly execute arbitrary code or cause a Denial of Service condition...
libxml2: Denial of service
Background libxml2 is the XML C parser and toolkit developed for the Gnome project. Description libxml2 returns the empty string when the allocation limit is encountered while constructing the attribute value string. Impact A remote attacker may be able to cause Denial of Service via a specially...
Ettercap: Multiple vulnerabilities
Background Ettercap is a comprehensive suite for man in the middle attacks. Description Multiple vulnerabilities have been discovered in Ettercap. Please review the CVE identifiers referenced below for details. Impact A remote attacker could possibly execute arbitrary code with the privileges of...
mpg123: User-assisted execution of arbitrary code
Background mpg123 is a realtime MPEG 1.0/2.0/2.5 audio player for layers 1, 2 and 3. Description An issue has been found in mpg123 when decoding specifically crafted MP3 file, that causes a heap-based buffer overflow. Impact A remote attacker could entice a user to open a specially crafted MPEG...
Icecast: Multiple Vulnerabilities
Background Icecast is an open source alternative to SHOUTcast that supports MP3, OGG Vorbis/Theora and AAC streaming. Description Two vulnerabilities have been discovered in Icecast: Icecast does not properly handle shared file descriptors CVE-2014-9018 Supplementary group privileges are not...
FreeRADIUS: Arbitrary code execution
Background FreeRADIUS is an open source RADIUS authentication server. Description Large passwords can trigger a stack-based buffer overflow in FreeRADIUS’s rlmpap module when authenticating against an LDAP server. Impact An authenticated user could set a specially crafted long password, possibly...
Adobe Flash Player: Multiple vulnerabilities
Background The Adobe Flash Player is a renderer for the SWF file format, which is commonly used to provide interactive websites. Description Multiple vulnerabilities have been discovered in Adobe Flash Player. Please review the CVE identifiers referenced below for details. Impact A remote attacke...
file: Denial of service
Background file is a utility that guesses a file format by scanning binary data for patterns. Description A flaw was found in the way the file utility determines the type of a file. Impact A remote attacker could entice a user to open a specially crafted file, possibly resulting in a Denial of...
TCPTrack: Arbitrary code execution
Background TCPTrack is a simple libpcap based program for live TCP connection monitoring. Description A heap-based buffer overflow vulnerability exists in TCPTrack’s parsing of command line arguments. This is only a vulnerability in limited scenarios in which TCPTrack is “configured as a handler...
FreeType: Multiple vulnerabilities
Background FreeType is a high-quality and portable font engine. Description Multiple vulnerabilities have been discovered in FreeType. Please review the CVE identifiers referenced below for details. Impact A context-dependent attacker could entice a user to open a specially crafted font, possibly...
Freeciv: User-assisted execution of arbitrary code
Background Freeciv is an open-source empire building strategy game. Description The Lua component of Freeciv does not restrict which modules may be loaded by scenario scripts. Impact A remote attacker could entice a user to open a specially crafted scenario file, possibly resulting in execution o...
CEDET: Privilege escalation
Background CEDET is a Collection of Emacs Development Environment Tools written with the end goal of creating an advanced development environment in Emacs. Description An untrusted search path vulnerability was discovered in CEDET. Impact A local attacker could escalate his privileges via a...
libjpeg-turbo: User-assisted execution of arbitrary code
Background libjpeg-turbo accelerates JPEG compression and decompression. Description A vulnerability in the getsos function in jdmarker.c could cause a heap-based buffer overflow. Impact A remote attacker could entice a user to open a specially crafted JPEG file in an application linked against...
Background International Components for Unicode ICU is a set of C/C++ and Java libraries providing Unicode and Globalization support for software applications. Description An error in the canonicalize function in uloc.cpp could cause a stack-based buffer overflow. Impact A remote attacker could...
Perl Config-IniFiles Module: Insecure temporary file usage
Background Config-IniFiles is a Perl module for reading .ini-style configuration files. Description The Perl Config-IniFiles module uses predicatable temporary file names. Impact A local attacker could perform symlink attacks to overwrite arbitrary files with the privileges of the user running th...
TeX Live: Multiple vulnerabilities
Background TeX Live is a complete TeX distribution. Description Multiple vulnerabilities have been discovered in texlive-core. Please review the CVE identifiers referenced below for details. Impact These vulnerabilities might allow user-assisted remote attackers to execute arbitrary code via a...
Logwatch: Arbitrary code execution
Background Logwatch analyzes and reports on system logs. Description logwatch.pl does not properly sanitize log filenames against shell metacharacters before passing them to the "system" function. Impact A remote attacker could pass a specially crafted log filename to Logwatch, possibly resulting...
fence: Multiple symlink vulnerabilities
Background fence is an I/O group fencing system. Description The fenceapc, fenceapcsnmp CVE-2008-4579 and fencemanual CVE-2008-4580 programs contain symlink vulnerabilities. Impact These vulnerabilities may allow arbitrary files to be overwritten with root privileges. Workaround There is no known...
multipath-tools: World-writeable socket
Background multipath-tools are used to drive the Device Mapper multipathing driver. Description multipath-tools uses world-writable permissions for the socket file /var/run/multipathd.sock. Impact Local users could send arbitrary commands to the multipath daemon, causing cluster failures and data...
aria2: Multiple vulnerabilities
Background aria2 is a download utility with resuming and segmented downloading with HTTP/HTTPS/FTP/BitTorrent support. Description Tatsuhiro Tsujikawa reported a buffer overflow in DHTRoutingTableDeserializer.cc CVE-2009-3575 and a format string vulnerability in the AbstractCommand::onAbort...
Wget: Certificate validation error
Background GNU Wget is a free software package for retrieving files using HTTP, HTTPS and FTP, the most widely-used Internet protocols. Description The vendor reported that Wget does not properly handle Common Name CN fields in X.509 certificates that contain an ASCII NUL \0 character...
ZNC: Directory traversal
Background ZNC is an advanced IRC bouncer. Description The vendor reported a directory traversal vulnerability when processing DCC SEND requests. Impact A remote, authenticated user could send a specially crafted DCC SEND request to overwrite arbitrary files with the privileges of the user runnin...
Cyrus-SASL: Execution of arbitrary code
Background Cyrus-SASL is an implementation of the Simple Authentication and Security Layer. Description James Ralston reported that in certain situations, Cyrus-SASL does not properly terminate strings which can result in buffer overflows when performing Base64 encoding. Impact A remote...
Xpdf: Untrusted search path
Background Xpdf is a PDF file viewer that runs under the X Window System. Description Erik Wallin reported that Gentoo's Xpdf attempts to read the "xpdfrc" file from the current working directory if it cannot find a ".xpdfrc" file in the user's home directory. This is caused by a missing definiti...
Courier Authentication Library: SQL injection vulnerability
Background The Courier Authentication Library is a generic authentication API that encapsulates the process of validating account passwords. Description It has been discovered that some input e.g. the username passed to the library are not properly sanitised before being used in SQL queries. Impa...
RealPlayer: Buffer overflow
Background RealPlayer is a multimedia player capable of handling multiple multimedia file formats. Description Dyon Balding of Secunia Research reported an unspecified heap-based buffer overflow in the Shockwave Flash SWF frame handling. Impact By enticing a user to open a specially crafted SWF...
Roundup: Permission bypass
Background Roundup is an issue-tracking system with command-line, web and e-mail interfaces. Description Philipp Gortan reported that the xml-rpc server in Roundup does not check property permissions CVE-2008-1475. Furthermore, Roland Meister discovered multiple vulnerabilities caused by...
Wireshark: Denial of service
Background Wireshark is a network protocol analyzer with a graphical front-end. Description Multiple unspecified errors exist in the SCTP, SNMP, and TFTP dissectors. Impact A remote attacker could cause a Denial of Service by sending a malformed packet. Workaround Disable the SCTP, SNMP, and TFTP...
Claws Mail: Insecure temporary file creation
Background Claws Mail is a GTK based e-mail client. Description Nico Golde from Debian reported that the sylprint.pl script that is part of the Claws Mail tools creates temporary files in an insecure manner. Impact A local attacker could exploit this vulnerability to conduct symlink attacks to...
Cacti: SQL injection
Background Cacti is a complete web-based frontend to rrdtool. Description It has been reported that the "localgraphid" variable used in the file graph.php is not properly sanitized before being processed in an SQL statement. Impact A remote attacker could send a specially crafted request to the...
PCRE: Multiple vulnerabilities
Background PCRE is a library providing functions for Perl-compatible regular expressions. Description Tavis Ormandy Google Security discovered multiple vulnerabilities in PCRE. He reported an error when processing "\Q\E" sequences with unmatched "\E" codes that can lead to the compiled bytecode...
Mozilla Thunderbird: Multiple vulnerabilities
Background Mozilla Thunderbird is a popular open-source email client from the Mozilla project. Description Multiple vulnerabilities have been reported in Mozilla Thunderbird's HTML browser engine CVE-2007-5339 and JavaScript engine CVE-2007-5340 that can be exploited to cause a memory corruption...
Pioneers: Multiple Denials of Service
Background Pioneers formerly gnocatan is a clone of the popular board game "The Settlers of Catan". Description Roland Clobus discovered that the Pioneers server may free sessions objects while they are still in use, resulting in access to invalid memory zones CVE-2007-5933. Bas Wijnen discovered...
KDM: Local privilege escalation
Background KDM is the Display Manager for the graphical desktop environment KDE. It is part of the kdebase package. Description Kees Huijgen discovered an error when checking the credentials which can lead to a login without specifying a password. This only occurs when auto login is configured fo...
QGit: Insecure temporary file creation
Background QGit is a graphical interface to git repositories that allows you to browse revisions history, view patch content and changed files. Description Raphael Marichez discovered that the DataLoader::doStart method creates temporary files in an insecure manner and executes them. Impact A loc...
libvorbis: Multiple vulnerabilities
Background libvorbis is the reference implementation of the Xiph.org Ogg Vorbis audio file format. It is used by many applications for playback of Ogg Vorbis files. Description David Thiel of iSEC Partners discovered a heap-based buffer overflow in the 01inverse function in res0.c and a boundary...
RPCSEC_GSS library: Buffer overflow
Background librpcsecgss is an implementation of RPCSECGSS for secure RPC communications. Description A stack based buffer overflow has been discovered in the svcauthgssvalidate function in file lib/rpc/svcauthgss.c when processing an overly long string in a RPC message. Impact A remote attacker...
id3lib: Insecure temporary file creation
Background id3lib is an open-source, cross-platform software development library for reading, writing, and manipulating ID3v1 and ID3v2 tags. Description Nikolaus Schulz discovered that the function RenderV2ToFile in file src/tagfile.cpp creates temporary files in an insecure manner. Impact A loc...
Wireshark: Multiple vulnerabilities
Background Wireshark is a network protocol analyzer with a graphical front-end. Description Wireshark doesn't properly handle chunked encoding in HTTP responses CVE-2007-3389, iSeries capture files CVE-2007-3390, certain types of DCP ETSI packets CVE-2007-3391, and SSL or MMS packets CVE-2007-339...
Evolution: User-assisted execution of arbitrary code
Background Evolution is the mail client of the GNOME desktop environment. Description Ulf Harnhammar from Secunia Research has discovered a format string error in the writehtml function in the file calendar/gui/e-cal-component-memo-preview.c. Impact A remote attacker could entice a user to open a...