3852 matches found
VDE: Privilege escalation
Background VDE is an ethernet compliant virtual network that can be spawned over a set of physical computer over the Internet. Description It was discovered that Gentoo’s default VDE installation suffered from a privilege escalation vulnerability in the init script. This script calls an unsafe...
D-Bus: Multiple vulnerabilities
Background D-Bus is a message bus system which processes can use to talk to each other. Description Multiple vulnerabilities have been discovered in D-Bus. Please review the original report referenced below for details. Impact An attacker could possibly overwrite arbitrary files named “once” with...
Mutt: Heap-based buffer overflow
Background Mutt is a small but very powerful text-based mail client. Description A heap-based buffer overflow was discovered in Mutt’s muttsubstrdup function. Impact A remote attacker could cause a Denial of Service condition. Workaround There is no known workaround at this time. Resolution All...
rsync: Multiple vulnerabilities
Background File transfer program to keep remote files into sync. Description Multiple vulnerabilities have been discovered in rsync. Please review the CVE identifiers referenced below for details. Impact Remote attackers could write arbitrary files via symlink attacks. Workaround There is no know...
CUPS: Multiple vulnerabilities
Background CUPS, the Common Unix Printing System, is a full-featured print server. Description Multiple vulnerabilities have been discovered in cups. Please review the CVE identifiers referenced below for details. Impact A remote attacker could possibly execute arbitrary code with the privileges ...
SNMP: Denial of service
Background SNMP is a widely used protocol for monitoring the health and welfare of network equipment. Description A specially crafted trap message triggers a conversion to an erroneous variable type when the -OQ option is used. Impact A remote attacker could possibly cause a Denial of Service...
GNU Wget: Arbitrary code execution
Background GNU Wget is a free software package for retrieving files using HTTP, HTTPS and FTP, the most widely-used Internet protocols. Description An absolute path traversal vulnerability has been found in GNU Wget. Impact A remote FTP server is able to write to arbitrary files, and consequently...
TigerVNC: User-assisted execution of arbitrary code
Background TigerVNC is a high-performance VNC server/client. Description Two boundary errors in TigerVNC could lead to a heap-based buffer overflow. Impact A remote attacker could entice a user to connect to a malicious VNC server using TigerVNC, possibly resulting in execution of arbitrary code...
GnuPG: Denial of service
Background The GNU Privacy Guard, GnuPG, is a free replacement for the PGP suite of cryptographic software. Description GnuPG does not properly handle a specially crated compressed packet resulting in an infinite loop. Impact A context-dependent attacker can cause a Denial of Service. Workaround...
DenyHosts: Denial of service
Background DenyHosts is a script intended to be run by Linux system administrators to help thwart SSH server attacks. Description DenyHosts does not properly define the regular expressions used when parsing SSH authentication logs. Impact A remote attacker could possibly cause a Denial of Service...
Charybdis, ShadowIRCd: Denial of service
Background Charybdis is the Atheme Project’s IRC daemon based on ratbox. ShadowIRCd is an IRC daemon based on Charybdis that adds several useful features. Description A vulnerability has been discovered in Charybdis and ShadowIRCd. Please review the CVE identifier referenced below for details...
WeeChat: Multiple vulnerabilities
Background Wee Enhanced Environment for Chat WeeChat is a light and extensible console IRC client. Description Two vulnerabilities have been discovered in WeeChat: The hookprocess function does not properly handle shell expansions CVE-2012-5534. WeeChat does not properly decode colors which could...
QtCore: Denial of service
Background The Qt toolkit is a comprehensive C++ application development framework. Description A vulnerability in QXmlSimpleReader’s XML entity parsing has been discovered. Impact A remote attacker could entice a user to open a specially crafted XML file using an application linked against QtCor...
Banshee: Arbitrary code execution
Background Banshee is a multimedia management and playback application for GNOME. Description Banshee places a zero-length directory name in PATH, which allows libraries to be loaded from the working directory. Impact A local attacker could put specially crafted library into working directory of...
CEDET: Privilege escalation
Background CEDET is a Collection of Emacs Development Environment Tools written with the end goal of creating an advanced development environment in Emacs. Description An untrusted search path vulnerability was discovered in CEDET. Impact A local attacker could escalate his privileges via a...
GNUstep Base library: Multiple vulnerabilities
Background GNUstep Base library is a free software package implementing the API of the OpenStep Foundation Kit tm, including later additions. Description Multiple vulnerabilities have been discovered in GNUstep Base library. Please review the CVE identifiers referenced below for details. Impact A...
Festival: Arbitrary code execution
Background Festival is a Text to Speech Engine from The Centre for Speech Technology Research. Description A vulnerability in Festival Server has an incorrect path in LDLIBRARYPATH, which allows local users to place a Trojan horse shared library in the current working directory. Impact A local...
Vixie cron: Denial of service
Background Paul Vixie’s cron daemon, a fully featured crond implementation. Description Vixie cron contains a race condition relating to atime and mtime values of temporary files. Impact A local attacker could change the modification time of files, possibly resulting in a Denial of Service...
pmake: Insecure temporary file usage
Background pmake is Debian’s version of NetBSD’s make, a tool to build programs in parallel. Description /usr/share/mk/bsd.lib.mk and /usr/share/mk/bsd.prog.mk create temporary files insecurely, with predictable names /tmp/dependPID, and without using $TMPDIR. Impact The make include files allow...
isync: Man-in-the-Middle attack
Background isync is an IMAP and MailDir mailbox synchronizer. Description isync does not properly verify the server’s hostname against the CN field in the SSL certificate. Impact A remote server could perform man-in-the-middle attacks to disclose passwords or obtain other sensitive information...
TPP: User-assisted execution of arbitrary code
Background TPP is an ncurses-based text presentation tool. Description TPP templates may contain a --exec clause, the contents of which are automatically executed without confirmation from the user. Impact A remote attacker could entice a user to open a specially crafted file using TPP, possibly...
Snack: User-assisted execution of arbitrary code
Background Snack is a sound toolkit for creating multi-platform audio applications with scripting languages. Description The GetWavHeader function in jkSoundFile.c does not have boundary checks when parsing format sub-chunks or unknown sub-chunks. Impact A remote attacker could entice a user to...
D-Bus: Denial of service
Background D-Bus is a message bus system which processes can use to talk to each other. Description D-Bus’ dbusprintfstringupperbound function crashes if it returns exactly 1024 bytes. Impact A local attacker could provide specially-crafted input to an application using D-Bus which would cause...
GIMP: Multiple vulnerabilities
Background GIMP is the GNU Image Manipulation Program. Description Multiple vulnerabilities have been discovered in GIMP. Please review the CVE identifiers referenced below for details. Impact A remote attacker could possibly execute arbitrary code with the privileges of the process or cause a...
Background International Components for Unicode ICU is a set of C/C++ and Java libraries providing Unicode and Globalization support for software applications. Description An error in the canonicalize function in uloc.cpp could cause a stack-based buffer overflow. Impact A remote attacker could...
QtGui: User-assisted execution of arbitrary code
Background QtGui is a module for the Qt toolkit. Description An error in qtiffhandler.cpp could cause a buffer overflow. Impact A remote attacker could entice a user to open a specially crafted TIFF image with an application linked against QtGui, possibly resulting in execution of arbitrary code...
SWFTools: User-assisted execution of arbitrary code
Background SWFTools is a collection of SWF manipulation and generation utilities written by Rainer Böhme and Matthias Kramm. Description Integer overflow errors in the "getPNG" function in png.c and the "jpegload" function in jpeg.c could cause a heap-based buffer overflow. Impact A remote attack...
Asterisk: Multiple vulnerabilities
Background Asterisk is an open source telephony engine and toolkit. Description Two vulnerabilities have been found in Asterisk: The "milliwattgenerate" function in appmilliwatt.c is vulnerable to a stack overrun AST-2012-002. The "astparsedigest" function in utils.c is vulnerable to a stack-base...
OpenTTD: Multiple vulnerabilities
Background OpenTTD is a clone of Transport Tycoon Deluxe. Description Multiple vulnerabilities have been discovered in OpenTTD. Please review the CVE identifiers referenced below for details. Impact A remote attacker could execute arbitrary code with the privileges of the OpenTTD process or cause...
Wget: Certificate validation error
Background GNU Wget is a free software package for retrieving files using HTTP, HTTPS and FTP, the most widely-used Internet protocols. Description The vendor reported that Wget does not properly handle Common Name CN fields in X.509 certificates that contain an ASCII NUL \0 character...
Subversion: Remote execution of arbitrary code
Background Subversion is a versioning system designed to be a replacement for CVS. Description Matt Lewis of Google reported multiple integer overflows in the libsvndelta library, possibly leading to heap-based buffer overflows. Impact A remote attacker with commit access could exploit this...
IPSec Tools: Denial of service
Background The IPSec Tools are a port of KAME's IPsec utilities to the Linux-2.6 IPsec implementation. They include racoon, an Internet Key Exchange daemon for automatically keying IPsec connections. Description The following vulnerabilities have been found in the racoon daemon as shipped with...
Shadow: Privilege escalation
Background Shadow is a set of tools to deal with user accounts. Description Paul Szabo reported a race condition in the "login" executable when setting up tty permissions. Impact A local attacker belonging to the "utmp" group could use symlink attacks to overwrite arbitrary files and possibly gai...
gEDA: Insecure temporary file creation
Background gEDA is an Electronic Design Automation tool used for electrical circuit design. Description Dmitry E. Oboukhov reported an insecure temporary file usage within the sch2eaglepos.sh script. Impact A local attacker could perform symlink attacks to overwrite arbitrary files with the...
PDFjam: Multiple vulnerabilities
Background PDFjam is a small collection of shell scripts to edit PDF documents, including pdfnup, pdfjoin and pdf90. Description Martin Vaeth reported multiple untrusted search path vulnerabilities CVE-2008-5843. Marcus Meissner of the SUSE Security Team reported that temporary files are created...
Archive::Tar: Directory traversal vulnerability
Background Archive::Tar is a Perl module for creation and manipulation of tar files. Description Jonathan Smith of rPath reported that Archive::Tar does not check for ".." in file names. Impact A remote attacker could entice a user or automated system to extract a specially crafted tar archive,...
IPsec-Tools: racoon Denial of service
Background IPsec-Tools is a port of KAME's implementation of the IPsec utilities. It contains a collection of network monitoring tools, including racoon, ping, and ping6. Description Two Denial of Service vulnerabilities have been reported in racoon: The vendor reported a memory leak in...
libspf2: DNS response buffer overflow
Background libspf2 is a library that implements the Sender Policy Framework, allowing mail transfer agents to make sure that an email is authorized by the domain name that it is coming from. Currently, only the exim MTA uses libspf2 in Gentoo. Description libspf2 uses a fixed-length buffer to...
Newsbeuter: User-assisted execution of arbitrary code
Background Newsbeuter is a RSS/Atom feed reader for the text console. Description J.H.M. Dassen reported that the open-in-browser command does not properly escape shell metacharacters in the URL before passing it to system. Impact A remote attacker could entice a user to open a feed with speciall...
yelp: User-assisted execution of arbitrary code
Background yelp is the default help browser for GNOME. Description Aaron Grattafiori reported a format string vulnerability in the windowerror function in yelp-window.c. Impact A remote attacker can entice a user to open specially crafted "man:" or "ghelp:" URIs in yelp, or an application using...
OpenLDAP: Denial of Service vulnerability
Background OpenLDAP Software is an open source implementation of the Lightweight Directory Access Protocol. Description Cameron Hotchkies discovered an error within the parsing of ASN.1 BER encoded packets in the "bergetnext" function in libraries/liblber/io.c. Impact A remote unauthenticated...
PeerCast: Buffer overflow
Background PeerCast is a client and server for P2P-radio networks. Description Nico Golde reported a boundary error in the HTTP::getAuthUserPass function when processing overly long HTTP Basic authentication requests. Impact A remote attacker could send a specially crafted HTTP request to the...
GnuTLS: Execution of arbitrary code
Background GnuTLS is an implementation of Secure Sockets Layer SSL 3.0 and Transport Layer Security TLS 1.0, 1.1 and 1.2. Description Ossi Herrala and Jukka Taimisto of Codenomicon reported three vulnerabilities in libgnutls of GnuTLS: "Client Hello" messages containing an invalid server name can...
policyd-weight: Insecure temporary file creation
Background policyd-weight is a Perl policy daemon for the Postfix MTA intended to eliminate forged envelope senders and HELOs. Description Chris Howells reported that policyd-weight creates and uses the "/tmp/.policyd-weight/" directory in an insecure manner. Impact A local attacker could exploit...
OpenLDAP: Denial of Service vulnerabilities
Background OpenLDAP Software is an open source implementation of the Lightweight Directory Access Protocol. Description The following errors have been discovered in OpenLDAP: Tony Blake discovered an error which exists within the normalisation of "objectClasses" CVE-2007-5707. Thomas Sesselmann...
MaraDNS: CNAME Denial of service
Background MaraDNS is a package that implements the Domain Name Service DNS with resolver and caching ability. Description Michael Krieger reported that a specially crafted DNS could prevent an authoritative canonical name CNAME record from being resolved because of an "improper rotation of...
Blam: User-assisted execution of arbitrary code
Background Blam is an RSS and Atom feed reader for GNOME written in C. Description The "/usr/bin/blam" script sets the "LDLIBRARYPATH" environment variable incorrectly, which might result in the current working directory . being included when searching for dynamically linked libraries of the Mono...
OpenAFS: Denial of service
Background OpenAFS is a distributed network filesystem. Description Russ Allbery, Jeffrey Altman, Dan Hyde and Thomas Mueller discovered a race condition due to an improper handling of the clients callbacks lists. Impact A remote attacker could construct cases which trigger the race condition,...
Net-SNMP: Denial of service
Background Net-SNMP is a collection of tools for generating and retrieving SNMP data. Description The SNMP agent snmpd does not properly handle GETBULK requests with an overly large "max-repetitions" field. Impact A remote unauthenticated attacker could send a specially crafted SNMP request to th...
MadWifi: Denial of service
Background The MadWifi driver provides support for Atheros based IEEE 802.11 Wireless Lan cards. Description Clemens Kolbitsch and Sylvester Keil reported an error when processing beacon frames with an overly large "length" value in the "xrates" element. Impact A remote attacker could act as an...