WeeChat: Denial of service

Background Wee Enhanced Environment for Chat WeeChat is a light and extensible console IRC client. Description Sebastien Helleu reported an array out-of-bounds error in the colored message handling. Impact A remote attacker could send a specially crafted PRIVMSG command, possibly leading to a...

Gnumeric: Untrusted search path

Background The Gnumeric spreadsheet is a versatile application developed as part of the GNOME Office project. Description James Vega reported an untrusted search path vulnerability in the GObject Python interpreter wrapper in Gnumeric. Impact A local attacker could entice a user to run Gnumeric...

GLib: Execution of arbitrary code

Background The GLib is a library of C routines that is used by a multitude of programs. Description Diego E. Petteno reported multiple integer overflows in glib/gbase64.c when converting a long string from or to a base64 representation. Impact A remote attacker could entice a user or automated...

Openfire: Multiple vulnerabilities

Background Ignite Realtime Openfire is a fast real-time collaboration server. Description Two vulnerabilities have been reported by Federico Muttis, from CORE IMPACT's Exploit Writing Team: Multiple missing or incomplete input validations in several .jsps CVE-2009-0496. Incorrect input validation...

gedit: Untrusted search path

Background gedit is a text editor for the GNOME desktop. Description James Vega reported that gedit uses the current working directory when searching for python modules, a vulnerability related to CVE-2008-5983. Impact A local attacker could entice a user to open gedit from a specially crafted...

Analog: Denial of service

Background Analog is a a webserver log analyzer. Description Diego E. Petteno reported that the Analog package in Gentoo is built with its own copy of bzip2, making it vulnerable to CVE-2008-1372 GLSA 200804-02. Impact A local attacker could place specially crafted log files into a log directory...

pam_krb5: Privilege escalation

Background pamkrb5 is a a Kerberos v5 PAM module. Description The following vulnerabilities were discovered: pamkrb5 does not properly initialize the Kerberos libraries for setuid use CVE-2009-0360. Derek Chan reported that calls to pamsetcred are not properly handled when running setuid...

Squid: Multiple Denial of Service vulnerabilities

Background Squid is a full-featured web proxy cache. Description The arrayShrink function in lib/Array.c can cause an array to shrink to 0 entries, which triggers an assert error. NOTE: this issue is due to an incorrect fix for CVE-2007-6239 CVE-2008-1612. An invalid version number in a HTTP...

MLDonkey: Information disclosure

Background MLDonkey is a multi-network P2P application written in Ocaml, coming with its own Gtk GUI, web and telnet interface. Description Michael Peselnik reported that src/utils/lib/url.ml in the web interface of MLDonkey does not handle file names with leading double slashes properly. Impact ...

Muttprint: Insecure temporary file usage

Background Muttprint formats the output of mail clients to a good-looking printing using LaTeX. Description Dmitry E. Oboukhov reported an insecure usage of the temporary file "/tmp/muttprint.log" in the muttprint script. Impact A local attacker could perform symlink attacks to overwrite arbitrar...

Ghostscript: User-assisted execution of arbitrary code

Background Ghostscript is an interpreter for the PostScript language and the Portable Document Format PDF. Description Jan Lieskovsky from the Red Hat Security Response Team discovered the following vulnerabilities in Ghostscript's ICC Library: Multiple integer overflows CVE-2009-0583. Multiple...

Amarok: User-assisted execution of arbitrary code

Background Amarok is an advanced music player. Description Tobias Klein has discovered multiple vulnerabilities in Amarok: Multiple integer overflows in the Audible::Tag::readTag function in metadata/audible/audibletag.cpp trigger heap-based buffer overflows CVE-2009-0135. Multiple array index...

FFmpeg: Multiple vulnerabilities

Background FFmpeg is a complete solution to record, convert and stream audio and video. gst-plugins-ffmpeg is a FFmpeg based gstreamer plugin which includes a vulnerable copy of FFmpeg code. Mplayer is a multimedia player which also includes a vulnerable copy of the code. Description Multiple...

phpMyAdmin: Multiple vulnerabilities

Background phpMyAdmin is a web-based management tool for MySQL databases. Description Multiple vulnerabilities have been reported in phpMyAdmin: libraries/databaseinterface.lib.php in phpMyAdmin allows remote authenticated users to execute arbitrary code via a request to serverdatabases.php with ...

libcdaudio: User-assisted execution of arbitrary code

Background libcdaudio is a library of CD audio related routines. Description A heap-based buffer overflow has been reported in the cddbreaddiscdata function in cddb.c when processing overly long CDDB data. Impact A remote attacker could entice a user to connect to a malicious CDDB server, possibl...

BlueZ: Arbitrary code execution

Background BlueZ is a set of Bluetooth tools and system daemons for Linux. Description It has been reported that the Bluetooth packet parser does not validate string length fields in SDP packets. Impact A physically proximate attacker using a Bluetooth device with an already established trust...

Opera: Multiple vulnerabilities

Background Opera is a fast web browser that is available free of charge. Description Multiple vulnerabilities were discovered in Opera: Vitaly McLain reported a heap-based buffer overflow when processing host names in file:// URLs CVE-2008-5178. Alexios Fakos reported a vulnerability in the HTML...

libpng: Multiple vulnerabilities

Background libpng is the official PNG reference library used to read, write and manipulate PNG images. Description Multiple vulnerabilities were discovered in libpng: A memory leak bug was reported in pnghandletEXt, a function that is used while reading PNG images CVE-2008-6218. A memory overwrit...

TMSNC: Execution of arbitrary code

Background TMSNC is a Textbased client for the MSN instant messaging protocol. Description Nico Golde reported a stack-based buffer overflow when processing a MSN packet with a UBX command containing a large UBX payload length field. Impact A remote attacker could send a specially crafted message...

ProFTPD: Multiple vulnerabilities

Background ProFTPD is an advanced and very configurable FTP server. Description The following vulnerabilities were reported: Percent characters in the username are not properly handled, which introduces a single quote character during variable substitution by modsql CVE-2009-0542. Some invalid,...

Courier Authentication Library: SQL Injection vulnerability

Background The Courier Authentication Library is a generic authentication API that encapsulates the process of validating account passwords. Description It has been reported that some parameters used in SQL queries are not properly sanitized before being processed when using a non-Latin locale...

Adobe Flash Player: Multiple vulnerabilities

Background The Adobe Flash Player is a renderer for the popular SWF file format, which is commonly used to provide interactive websites, digital experiences and mobile content. Description Multiple vulnerabilities have been discovered in Adobe Flash Player: The access scope of SystemsetClipboard...

Ganglia: Execution of arbitrary code

Background Ganglia is a scalable distributed monitoring system for clusters and grids. Description Spike Spiegel reported a stack-based buffer overflow in the processpath function when processing overly long pathnames in gmetad/server.c. Impact A remote attacker could send a specially crafted...

Shadow: Privilege escalation

Background Shadow is a set of tools to deal with user accounts. Description Paul Szabo reported a race condition in the "login" executable when setting up tty permissions. Impact A local attacker belonging to the "utmp" group could use symlink attacks to overwrite arbitrary files and possibly gai...

OptiPNG: User-assisted execution of arbitrary code

Background OptiPNG is a PNG optimizer that recompresses image files to a smaller size, without losing any information. Description Roy Tam reported a use-after-free vulnerability in the GIFReadNextExtension function in lib/pngxtern/gif/gifread.c leading to a memory corruption when reading a GIF...

Epiphany: Untrusted search path

Background Epiphany is a GNOME webbrowser based on the Mozilla rendering engine Gecko. Description James Vega reported an untrusted search path vulnerability in the Python interface. Impact A local attacker could entice a user to run Epiphany from a directory containing a specially crafted python...

WebSVN: Multiple vulnerabilities

Background WebSVN is a web-based browsing tool for Subversion repositories written in PHP. Description James Bercegay of GulfTech Security reported a Cross-site scripting XSS vulnerability in the getParameterisedSelfUrl function in index.php CVE-2008-5918 and a directory traversal vulnerability i...

Xerces-C++: Denial of service

Background Xerces-C++ is a validating XML parser written in a portable subset of C++. Description Frank Rast reported that the XML parser in Xerces-C++ does not correctly handle an XML schema definition with a large maxOccurs value, which triggers excessive memory consumption during the validatio...

Openswan: Insecure temporary file creation

Background Openswan is an implementation of IPsec for Linux. Description Dmitry E. Oboukhov reported that the IPSEC livetest tool does not handle the ipseclive.conn and ipsec.olts.remote.log temporary files securely. Impact A local attacker could perform symlink attacks to execute arbitrary code...

PyCrypto: Execution of arbitrary code

Background PyCrypto is the Python Cryptography Toolkit. Description Mike Wiacek of the Google Security Team reported a buffer overflow in the ARC2 module when processing a large ARC2 key length. Impact A remote attacker could entice a user or automated system to decrypt an ARC2 stream in an...

MPFR: Denial of service

Background MPFR is a library for multiple-precision floating-point computations with exact rounding. Description Multiple buffer overflows have been reported in the mpfrsnprintf and mpfrvsnprintf functions. Impact A remote user could exploit the vulnerability to cause a Denial of Service in an...

Real VNC: User-assisted execution of arbitrary code

Background Real VNC is a remote desktop viewer display system. Description An unspecified vulnerability has been discovered int the CMsgReader::readRect function in the VNC Viewer component, related to the encoding type of RFB protocol data. Impact A remote attacker could entice a user to connect...

BIND: Incorrect signature verification

Background ISC BIND is the Internet Systems Consortium implementation of the Domain Name System DNS protocol. Description BIND does not properly check the return value from the OpenSSL functions to verify DSA CVE-2009-0025 and RSA CVE-2009-0265 certificates. Impact A remote attacker could bypass...

cURL: Arbitrary file access

Background cURL is a command line tool for transferring files with URL syntax, supporting numerous protocols. Description David Kierznowski reported that the redirect implementation accepts arbitrary Location values when CURLOPTFOLLOWLOCATION is enabled. Impact A remote attacker could possibly...

git: Multiple vulnerabilties

Background GIT - the stupid content tracker, the revision control system used by the Linux kernel team. Description Multiple vulnerabilities have been reported in gitweb that is part of the git package: Shell metacharacters related to gitsearch are not properly sanitized CVE-2008-5516. Shell...

Irrlicht: User-assisted execution of arbitrary code

Background The Irrlicht Engine is an open source cross-platform high performance realtime 3D engine written in C++. Description An unspecified component of the B3D loader is vulnerable to a buffer overflow due to missing boundary checks. Impact A remote attacker could entice a user to open a...

Samba: Data disclosure

Background Samba is a suite of SMB and CIFS client/server programs. Description Samba does not properly check memory boundaries when handling trans, rans2, and nttrans requests. Impact A remote attacker could send specially crafted requests to a Samba daemon, leading to the disclosure of arbitrar...

nfs-utils: Access restriction bypass

Background nfs-utils contains the client and daemon implementations for the NFS protocol. Description Michele Marcionelli reported that nfs-utils invokes the hostsctl function with the wrong order of arguments, which causes TCP Wrappers to ignore netgroups. Impact A remote attacker could bypass...

PDFjam: Multiple vulnerabilities

Background PDFjam is a small collection of shell scripts to edit PDF documents, including pdfnup, pdfjoin and pdf90. Description Martin Vaeth reported multiple untrusted search path vulnerabilities CVE-2008-5843. Marcus Meissner of the SUSE Security Team reported that temporary files are created...

gEDA: Insecure temporary file creation

Background gEDA is an Electronic Design Automation tool used for electrical circuit design. Description Dmitry E. Oboukhov reported an insecure temporary file usage within the sch2eaglepos.sh script. Impact A local attacker could perform symlink attacks to overwrite arbitrary files with the...

OpenTTD: Execution of arbitrary code

Background OpenTTD is a clone of Transport Tycoon Deluxe. Description Multiple buffer overflows have been reported in OpenTTD, when storing long for client names CVE-2008-3547, in the TruncateString function in src/gfx.cpp CVE-2008-3576 and in src/openttd.cpp when processing a large filename...

Vinagre: User-assisted execution of arbitrary code

Background Vinagre is a VNC Client for the GNOME Desktop. Description Alfredo Ortega Core Security Technologies reported a format string error in the vinagreutilsshowerror function in src/vinagre-utils.c. Impact A remote attacker could entice a user into opening a specially crafted .vnc file or...

DevIL: User-assisted execution of arbitrary code

Background Developer's Image Library DevIL is a cross-platform image library. Description Stefan Cornelius Secunia Research discovered two boundary errors within the iGetHdrHeader function in src-IL/src/ilhdr.c. Impact A remote attacker could entice a user to open a specially crafted Radiance RGB...

ZNC: Privilege escalation

Background ZNC is an advanced IRC bouncer. Description cnu discovered multiple CRLF injection vulnerabilities in ZNC's webadmin module. Impact A remote authenticated attacker could modify the znc.conf configuration file and gain privileges via newline characters in e.g. the QuitMessage field, and...

Audacity: User-assisted execution of arbitrary code

Background Audacity is a free cross-platform audio editor. Description Houssamix discovered a boundary error in the Stringparse::getnonspacequoted function in lib-src/allegro/strparse.cpp. Impact A remote attacker could entice a user into importing a specially crafted .gro file, resulting in the...

GNU Emacs, XEmacs: Multiple vulnerabilities

Background GNU Emacs and XEmacs are highly extensible and customizable text editors. edit-utils are miscellaneous extensions to XEmacs. Description Morten Welinder reports about GNU Emacs and edit-utils in XEmacs: By shipping a .flc accompanying a source file .c for example and setting...

KTorrent: Multiple vulnerabilitites

Background KTorrent is a BitTorrent program for KDE. Description The web interface plugin does not restrict access to the torrent upload functionality CVE-2008-5905 and does not sanitize request parameters properly CVE-2008-5906 . Impact A remote attacker could send specially crafted parameters t...

Valgrind: Untrusted search path

Background Valgrind is an open-source memory debugger. Description Tavis Ormandy reported that Valgrind loads a .valgrindrc file in the current working directory, executing commands specified there. Impact A local attacker could prepare a specially crafted .valgrindrc file and entice a user to ru...

OpenSSL: Certificate validation error

Background OpenSSL is an Open Source toolkit implementing the Secure Sockets Layer SSL v2/v3 and Transport Layer Security TLS v1 as well as a general purpose cryptography library. Description The Google Security Team reported that several functions incorrectly check the result after calling the...

xterm: User-assisted arbitrary commands execution

Background xterm is a terminal emulator for the X Window system. Description Paul Szabo reported an insufficient input sanitization when processing Device Control Request Status String DECRQSS sequences. Impact A remote attacker could entice a user to display a file containing specially crafted...