Showing all newswire headlines
View by date, instead?« Previous ( 1 ... 2042 2043 2044 2045 2046 2047 2048 2049 2050 2051 2052 ... 2119 ) Next »
Debian alert: New eldav packages fix insecure temporary file creation
eldav, a WebDAV client for Emacs, creates temporary files without
taking appropriate security precautions. This vulnerability could be
exploited by a local user to create or overwrite files with the
privileges of the user running emacs and eldav.
Red Hat alert: Updated Xpdf packages fix security vulnerability
Updated Xpdf packages are available that fix a vulnerability where a
malicious PDF document could run arbitrary code.
Slackware alert: 2.4.21 kernels available (SSA:2003-168-01)
Precompiled Linux 2.4.21 kernels and source packages are now available for
Slackware 9.0 and -current. These provide an improved version of the
ptrace fix that had been applied to 2.4.20 in Slackware 9.0 (for example,
command line options now appear correctly when root does 'ps ax'), and
fix a potential denial of service problem with netfilter.
Debian alert: New ethereal packages fix multiple vulnerabilities
Several of the packet dissectors in ethereal contain string handling
bugs which could be exploited using a maliciously crafted packet to
cause ethereal to consume excessive amounts of memory, crash, or
execute arbitrary code.
Debian alert: New jnethack packages fix buffer overflow, incorrect permissions
The jnethack package is vulnerable to a buffer overflow exploited via a
long '-s' command line option. This vulnerability could be used by an
attacker to gain gid 'games' on a system where jnethack is installed.
Mandrake alert: Updated BitchX packages fix DoS vulnerability
A Denial Of Service (DoS) vulnerability was discovered in BitchX that would allow a remote attacker to crash BitchX by changing certain channel modes. This vulnerability has been fixed in CVS and patched in the released updates.
Debian alert: New noweb packages fix insecure temporary file creation
Jakob Lell discovered a bug in the 'noroff' script included in noweb
whereby a temporary file was created insecurely. During a review,
several other instances of this problem were found and fixed. Any of
these bugs could be exploited by a local user to overwrite arbitrary
files owned by the user invoking the script.
Debian alert: New typespeed packages fix buffer overflow
typespeed is a game which challenges the player to type words
correctly and quickly. It contains a network play mode which allows
players on different systems to play competitively. The network code
contains a buffer overflow which could allow a remote attacker to
execute arbitrary code under the privileges of the user invoking
typespeed, in addition to gid games.
Mandrake alert: Updated gzip packages fix insecure temporary file creation
A vulnerability exists in znew, a script included with gzip, that would create temporary files without taking precautions to avoid a symlink attack. Patches have been applied to make use of mktemp to generate unique filenames, and properly make use of noclobber in the script. Likewise, a fix for gzexe which had been applied previously was incomplete. It has been fixed to make full use of mktemp everywhere a temporary file is created.
Mandrake alert: Updated ethereal packages fix multiple vulnerabilities
Several vulnerabilities in ethereal were discovered by Timo Sirainen. Integer overflows were found in the Mount and PPP dissectors, as well as one-byte buffer overflows in the AIM, GIOP Gryphon, OSPF, PPTP, Quake, Quake2, Quake3, Rsync, SMB, SMPP, and TSP dissectors. These vulnerabilties were corrected in ethereal 0.9.12.
Debian alert: New radiusd-cistron packages fix buffer overflow
radiusd-cistron contains a bug allowing a buffer overflow when a long
NAS-Port attribute is received. This could allow a remote attacker to
execute arbitrary code on the with the privileges of the RADIUS daemon
(usually root).
Debian alert: New mikmod packages fix buffer overflow
Ingo Saitz discovered a bug in mikmod whereby a long filename inside
an archive file can overflow a buffer when the archive is being read
by mikmod.
SuSE alert: radiusd-cistron
The package radiusd-cistron is an implementation of the RADIUS protocol. Unfortunately the RADIUS server handles too large NAS numbers not correctly. This leads to overwriting internal memory of the server process and may be abused to gain remote access to the system the RADIUS server is running on.
Debian alert: New webmin packages fix remote session ID spoofing
miniserv.pl in the webmin package does not properly handle
metacharacters, such as line feeds and carriage returns, in
Base64-encoded strings used in Basic authentication. This
vulnerability allows remote attackers to spoof a session ID, and
thereby gain root privileges.
Debian alert: New lyskom-server packages fix denial of service
Calle Dybedahl discovered a bug in lyskom-server which could result in
a denial of service where an unauthenticated user could cause the
server to become unresponsive as it processes a large query.
Debian alert: New cupsys packages fix denial of service
The CUPS print server in Debian is vulnerable to a denial of service
when an HTTP request is received without being properly terminated.
Debian alert: New slashem packages fix buffer overflow
The slashem package is vulnerable to a buffer overflow exploited via a
long '-s' command line option. This vulnerability could be used by an
attacker to gain gid 'games' on a system where slashem is installed.
Debian alert: New nethack packages fix buffer overflow, incorrect permissions
The nethack package is vulnerable to a buffer overflow exploited via a
long '-s' command line option. This vulnerability could be used by an
attacker to gain gid 'games' on a system where nethack is installed.
Debian alert: New gnocatan packages fix buffer overflows, denial of service
Bas Wijnen discovered that the gnocatan server is vulnerable to
several buffer overflows which could be exploited to execute arbitrary
code on the server system
Debian alert: New atftp packages fix buffer overflow
Rick Patel discovered that atftpd is vulnerable to a buffer overflow
when a long filename is sent to the server. An attacker could exploit
this bug remotely to execute arbitrary code on the server.
« Previous ( 1 ... 2042 2043 2044 2045 2046 2047 2048 2049 2050 2051 2052 ... 2119 ) Next »