3831 matches found
Firebird: Data disclosure
Background Firebird is a multi-platform, open source relational database. Description Viesturs reported that the default configuration for Gentoo's init script "/etc/conf.d/firebird" sets the "ISCPASSWORD" environment variable when starting Firebird. It will be used when no password is supplied b...
Linux Terminal Server Project: Multiple vulnerabilities
Background The Linux Terminal Server Project adds thin-client support to Linux servers. Description LTSP version 4.2, ships prebuilt copies of programs such as the Linux Kernel, the X.org X11 server GLSA 200705-06, GLSA 200710-16, GLSA 200801-09, libpng GLSA 200705-24, GLSA 200711-08, Freetype GL...
eGroupWare: Multiple vulnerabilities
Background eGroupWare is a suite of web-based group applications including calendar, address book, messenger and email. Description A vulnerability has been reported in FCKEditor due to the way that file uploads are handled in the file editor/filemanager/upload/php/upload.php when a filename has...
Multiple X11 terminals: Local privilege escalation
Background Aterm, Eterm, Mrxvt, multi-aterm, RXVT, rxvt-unicode, and wterm are X11 terminal emulators. Description Bernhard R. Link discovered that RXVT opens a terminal on :0 if the "-display" option is not specified and the DISPLAY environment variable is not set. Further research by the Gentoo...
Wireshark: Denial of service
Background Wireshark is a network protocol analyzer with a graphical front-end. Description Errors exist in: the X.509sat dissector because of an uninitialized variable and the Roofnet dissector because a NULL pointer may be passed to the gvsnprintf function CVE-2008-1561. the LDAP dissector...
phpMyAdmin: Information disclosure
Background phpMyAdmin is a tool written in PHP intended to handle the administration of MySQL databases from a web-browser. Description Cezary Tomczak reported that an undefined UploadDir variable exposes an information disclosure vulnerability when running on shared hosts. Impact A remote attack...
Horde Application Framework: Multiple vulnerabilities
Background The Horde Application Framework is a general-purpose web application framework written in PHP, providing classes for handling preferences, compression, browser detection, connection tracking, MIME and more. Description Multiple vulnerabilities have been reported in the Horde Applicatio...
KDE start_kdeinit: Multiple vulnerabilities
Background KDE is a feature-rich graphical desktop environment for Linux and Unix-like operating systems. startkdeinit is a wrapper for kdeinit. Description Vulnerabilities have been reported in the processing of user-controlled data by startkdeinit, which is setuid root by default. Impact A loca...
Comix: Multiple vulnerabilities
Background Comix is a GTK comic book viewer. Description Comix does not properly sanitize filenames containing shell metacharacters when they are passed to the rar, unrar, or jpegtran programs CVE-2008-1568. Comix also creates directories with predictable names CVE-2008-1796. Impact A remote...
JRockit: Multiple vulnerabilities
Background JRockit is BEA WebLogic's J2SE Development Kit. Description Because of sharing the same codebase, JRockit is affected by the vulnerabilities mentioned in GLSA 200804-20. Impact A remote attacker could entice a user to run a specially crafted applet on a website or start an application ...
SILC: Multiple vulnerabilities
Background SILC Secure Internet Live Conferencing protocol Toolkit is a software development kit for use in clients, SILC Server is a communication server, and SILC Client is an IRSSI-based text client. Description Nathan G. Grennan reported a boundary error in SILC Toolkit within the...
Openfire: Denial of service
Background Openfire formerly Wildfire is a Java implementation of a complete Jabber server. Description Openfire's connection manager in the file ConnectionManagerImpl.java cannot handle clients that fail to read messages, and has no limit on their session's send buffer. Impact Remote authenticat...
VLC: User-assisted execution of arbitrary code
Background VLC is a cross-platform media player and streaming server. Description Multiple vulnerabilities were found in VLC: Luigi Auriemma discovered that the stack-based buffer overflow when reading subtitles, which has been reported as CVE-2007-6681 in GLSA 200803-13, was not properly fixed...
Adobe Flash Player: Multiple vulnerabilities
Background The Adobe Flash Player is a renderer for the popular SWF file format, which is commonly used to provide interactive websites, digital experiences and mobile content. Description Multiple vulnerabilities have been discovered in Adobe Flash: Secunia Research and Zero Day Initiative...
PowerDNS Recursor: DNS Cache Poisoning
Background The PowerDNS Recursor is an advanced recursing nameserver. Description Amit Klein of Trusteer reported that insufficient randomness is used to calculate the TRXID values and the UDP source port numbers CVE-2008-1637. Thomas Biege of SUSE pointed out that a prior fix to resolve this iss...
DBmail: Data disclosure
Background DBMail is a mail storage and retrieval daemon that uses SQL databases as its data store. IMAP and POP3 can be used to retrieve mails from the database. Description A vulnerability in DBMail's authldap module when used in conjunction with an Active Directory server has been reported by...
CUPS: Integer overflow vulnerability
Background CUPS provides a portable printing layer for UNIX-based operating systems. Description Thomas Pollet reported a possible integer overflow vulnerability in the PNG image handling in the file filter/image-png.c. Impact A malicious user might be able to execute arbitrary code with the...
Sun JDK/JRE: Multiple vulnerabilities
Background The Sun Java Development Kit JDK and the Sun Java Runtime Environment JRE provide the Sun Java platform. Description Multiple vulnerabilities have been discovered in Sun Java: Daniel Soeder discovered that a long codebase attribute string in a JNLP file will overflow a stack variable...
rsync: Execution of arbitrary code
Background rsync is a file transfer program to keep remote directories synchronized. Description Sebastian Krahmer of SUSE reported an integer overflow in the expanditemlist function in the file util.c which might lead to a heap-based buffer overflow when extended attribute xattr support is...
Poppler: User-assisted execution of arbitrary code
Background Poppler is a cross-platform PDF rendering library originally based on Xpdf. Description Kees Cook from the Ubuntu Security Team reported that the CairoFont::create function in the file CairoFontEngine.cc does not verify the type of an embedded font object inside a PDF file before...
PHP Toolkit: Data disclosure and Denial of service
Background PHP Toolkit is a utility to manage parallel installations of PHP within Gentoo. It is executed by the PHP ebuilds at setup. Description Toni Arnold, David Sveningsson, Michal Bartoszkiewicz, and Joseph reported that php-select does not quote parameters passed to the "tr" command, which...
Speex: User-assisted execution of arbitrary code
Background Speex is an audio compression format designed for speech that is free of patent restrictions. Description oCERT reported that the Speex library does not properly validate the "mode" value it derives from Speex streams, allowing for array indexing vulnerabilities inside multiple player...
libpng: Execution of arbitrary code
Background libpng is a free ANSI C library used to process and manipulate PNG images. Description Tavis Ormandy of the Google Security Team discovered that libpng does not handle zero-length unknown chunks in PNG files correctly, which might lead to memory corruption in applications that call...
Opera: Multiple vulnerabilities
Background Opera is a fast web browser that is available free of charge. Description Michal Zalewski reported two vulnerabilities, memory corruption when adding news feed sources from a website CVE-2008-1761 as well as when processing HTML CANVAS elements to use scaled images CVE-2008-1762...
Asterisk: Multiple vulnerabilities
Background Asterisk is an open source telephony engine and tool kit. Description Asterisk upstream developers reported multiple vulnerabilities: The Call Detail Record Postgres logging engine cdrpgsql does not correctly escape the ANI and DNIS arguments before using them in SQL statements...
policyd-weight: Insecure temporary file creation
Background policyd-weight is a Perl policy daemon for the Postfix MTA intended to eliminate forged envelope senders and HELOs. Description Chris Howells reported that policyd-weight creates and uses the "/tmp/.policyd-weight/" directory in an insecure manner. Impact A local attacker could exploit...
gnome-screensaver: Privilege escalation
Background gnome-screensaver is a screensaver, designed to integrate with the Gnome desktop, that can replace xscreensaver. Description gnome-screensaver incorrectly handles the results of the getpwuid function in the file src/setuid.c when using directory servers like NIS during a network outage...
Tomcat: Multiple vulnerabilities
Background Tomcat is the Apache Jakarta Project's official implementation of Java Servlets and Java Server Pages. Description The following vulnerabilities were reported: Delian Krustev discovered that the JULI logging component does not properly enforce access restrictions, allowing web...
lighttpd: Multiple vulnerabilities
Background lighttpd is a lightweight high-performance web server. Description Julien Cayzax discovered that an insecure default setting exists in moduserdir in lighttpd. When userdir.path is not set the default value used is $HOME. It should be noted that the "nobody" user's $HOME is "/"...
am-utils: Insecure temporary file creation
Background am-utils is a collection of utilities for use with the Berkeley Automounter. Description Tavis Ormandy discovered that, when creating temporary files, the 'expn' utility does not check whether the file already exists. Impact A local attacker could exploit the vulnerability via a symlin...
PECL APC: Buffer Overflow
Background PECL Alternative PHP Cache PECL APC is a free, open, and robust framework for caching and optimizing PHP intermediate code. Description Daniel Papasian discovered a stack-based buffer overflow in the apcsearchpaths function in the file apc.c when processing long filenames. Impact A...
MySQL: Multiple vulnerabilities
Background MySQL is a popular multi-threaded, multi-user SQL server. Description Multiple vulnerabilities have been reported in MySQL: Mattias Jonsson reported that a "RENAME TABLE" command against a table with explicit "DATA DIRECTORY" and "INDEX DIRECTORY" options would overwrite the file to...
UnZip: User-assisted execution of arbitrary code
Background Info-ZIP's UnZip is a tool to list and extract files inside PKZIP compressed files. Description Tavis Ormandy of the Google Security Team discovered that the NEEDBITS macro in the inflatedynamic function in the file inflate.c can be invoked using invalid buffers, which can lead to a...
NX: User-assisted execution of arbitrary code
Background NoMachine's NX establishes remote connections to X11 desktops over small bandwidth links. NX and NX Node are the compression core libraries, whereas NX is used by FreeNX and NX Node by the binary-only NX servers. Description Multiple integer overflow and buffer overflow vulnerabilities...
OpenSSH: Privilege escalation
Background OpenSSH is a complete SSH protocol implementation that includes an SFTP client and server support. Description Two issues have been discovered in OpenSSH: Timo Juhani Lindfors discovered that OpenSSH sets the DISPLAY variable in SSH sessions using X11 forwarding even when it cannot bin...
bzip2: Denial of service
Background bzip2 is a free and open source lossless data compression program. Description The Oulu University discovered that bzip2 does not properly check offsets provided by the bzip2 file, leading to a buffer overread. Impact Remote attackers can entice a user or automated system to open a...
CUPS: Multiple vulnerabilities
Background CUPS provides a portable printing layer for UNIX-based operating systems. Description Multiple vulnerabilities have been reported in CUPS: regenrecht VeriSign iDefense discovered that the cgiCompileSearch function used in several CGI scripts in CUPS' administration interface does not...
Wireshark: Denial of service
Background Wireshark is a network protocol analyzer with a graphical front-end. Description Multiple unspecified errors exist in the SCTP, SNMP, and TFTP dissectors. Impact A remote attacker could cause a Denial of Service by sending a malformed packet. Workaround Disable the SCTP, SNMP, and TFTP...
MIT Kerberos 5: Multiple vulnerabilities
Background MIT Kerberos 5 is a suite of applications that implement the Kerberos network protocol. kadmind is the MIT Kerberos 5 administration daemon, KDC is the Key Distribution Center. Description Two vulnerabilities were found in the Kerberos 4 support in KDC: A global variable is not set for...
ssl-cert eclass: Certificate disclosure
Background The ssl-cert eclass is a code module used by Gentoo ebuilds to generate SSL certificates. Description Robin Johnson reported that the docert function provided by ssl-cert.eclass can be called by source building stages of an ebuild, such as srccompile or srcinstall, which will result in...
OpenLDAP: Denial of Service vulnerabilities
Background OpenLDAP Software is an open source implementation of the Lightweight Directory Access Protocol. Description The following errors have been discovered in OpenLDAP: Tony Blake discovered an error which exists within the normalisation of "objectClasses" CVE-2007-5707. Thomas Sesselmann...
ViewVC: Multiple vulnerabilities
Background ViewVC is a browser interface for CVS and Subversion version control repositories. Description Multiple unspecified errors were reportedly fixed by the ViewVC development team. Impact A remote attacker could send a specially crafted URL to the server to list CVS or SVN commits on...
Adobe Acrobat Reader: Insecure temporary file creation
Background Acrobat Reader is a PDF reader released by Adobe. Description SUSE reported that the "acroread" wrapper script does not create temporary files in a secure manner when handling SSL certificates CVE-2008-0883. Impact A local attacker could exploit this vulnerability to overwrite arbitrar...
MoinMoin: Multiple vulnerabilities
Background MoinMoin is an advanced, easy to use and extensible Wiki Engine. Description Multiple vulnerabilities have been discovered: A vulnerability exists in the file wikimacro.py because the macroGetval function does not properly enforce ACLs CVE-2008-1099. A directory traversal vulnerability...
Dovecot: Multiple vulnerabilities
Background Dovecot is a lightweight, fast and easy to configure IMAP and POP3 mail server. Description Dovecot uses the group configured via the "mailextragroups" setting, which should be used to create lockfiles in the /var/mail directory, when accessing arbitrary files CVE-2008-1199. Dovecot do...
PCRE: Buffer overflow
Background PCRE is a Perl-compatible regular expression library. GLib includes a copy of PCRE. Description PCRE contains a buffer overflow vulnerability when processing a character class containing a very large number of characters with codepoints greater than 255. Impact A remote attacker could...
Website META Language: Insecure temporary file usage
Background Website META Language is a free and extensible Webdesigner's off-line HTML generation toolkit for Unix. Description Temporary files are handled insecurely in the files wmlbackend/p1ipp/ipp.src, wmlcontrib/wmg.cgi, and wmlbackend/p3eperl/eperlsys.c, allowing users to overwrite or delete...
LIVE555 Media Server: Denial of service
Background LIVE555 Media Server is a set of libraries for multimedia streaming. Description Luigi Auriemma reported a signedness error in the parseRTSPRequestString function when processing short RTSP queries. Impact A remote attacker could send a specially crafted RTSP query to the vulnerable...
Sarg: Remote execution of arbitrary code
Background Sarg Squid Analysis Report Generator is a tool that provides many informations about the Squid web proxy server users activities: time, sites, traffic, etc. Description Sarg doesn't properly check its input for abnormal content when processing Squid log files. Impact A remote attacker...
International Components for Unicode: Multiple vulnerabilities
Background International Components for Unicode is a set of C/C++ and Java libraries providing Unicode and Globalization support for software applications. Description Will Drewry Google Security reported a vulnerability in the regular expression engine when using back references to capture \0...