Buffer overflow in libtelnet/encrypt.c in telnetd in FreeBSD 7.3 through 9.0, MIT Kerberos Version 5 Applications (aka krb5-appl) 1.0.2 and earlier, Heimdal 1.5.1 and earlier, GNU inetutils, and possibly other products allows remote attackers to execute arbitrary code via a long encryption key, as exploited in the wild in December 2011.
OpenStack Object Storage (swift) before 1.7.0 uses the loads function in the pickle Python module unsafely when storing and loading metadata in memcached, which allows remote attackers to execute arbitrary code via a crafted pickle object.
A denial of service flaw was found in the way the server component of Freeciv before 2.3.4 processed certain packets. A remote attacker could send a specially-crafted packet that, when processed would lead to memory exhaustion or excessive CPU consumption.
A Privilege Escalation vulnerability exits in Fedoraproject Sectool due to an incorrect DBus file.
Integer overflow in the vclmi.dll module in OpenOffice.org (OOo) 3.3, 3.4 Beta, and possibly earlier, and LibreOffice before 3.5.3, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted embedded image object, as demonstrated by a JPEG image in a .DOC file, which triggers a heap-based buffer overflow.
A stack based buffer overflow flaw was found in guac client plug-in protocol handling functionality of libguac, a common library used by all C components of Guacamole. A remote attacker could provide a specially-crafted protocol specification to the guac client plug-in that, when processed would lead to guac client crash (denial of service).
References: [1] http://www.openwall.com/lists/oss-security/2012/09/11/3 [2] http://www.openwall.com/lists/oss-security/2012/09/11/7
Upstream patch: [3] http://guac-dev.org/trac/changeset/7dcefa744b4a38825619c00ae8b47e5bae6e38c0/libguac
The SetWiredProperty function in the D-Bus interface in WICD before 1.7.2 allows local users to write arbitrary configuration settings and gain privileges via a crafted property name in a dbus message.
Redland Raptor (aka libraptor) before 2.0.7, as used by OpenOffice 3.3 and 3.4 Beta, LibreOffice before 3.4.6 and 3.5.x before 3.5.1, and other products, allows user-assisted remote attackers to read arbitrary files via a crafted XML external entity (XXE) declaration and reference in an RDF document.
Multiple cross-site scripting (XSS) vulnerabilities in Zend Framework 2.0.x before 2.0.1 allow remote attackers to inject arbitrary web script or HTML via unspecified input to (1) Debug, (2) Feed\PubSubHubbub, (3) Log\Formatter\Xml, (4) Tag\Cloud\Decorator, (5) Uri, (6) View\Helper\HeadStyle, (7) View\Helper\Navigation\Sitemap, or (8) View\Helper\Placeholder\Container\AbstractStandalone, related to Escaper.
A Cross-Site Scripting (XSS) vulnerability exists in LDAP Account Manager (LAM) Pro 3.6 in the export, addvalueform, and dn parameters to cmd.php.
A Cross-Site Scripting (XSS) vulnerability exists in LDAP Account Manager (LAM) Pro 3.6 in the filter parameter to cmd.php in an export and exporterid action. and the filteruid parameter to list.php.
An Information Disclosure vulnerability exists in the Jasig Project php-pear-CAS 1.2.2 package in the /tmp directory. The Central Authentication Service client library archives the debug logging file in an insecure manner.
Last updated 24 July 2024
shadow: TOCTOU (time-of-check time-of-use) race condition when copying and removing directory trees
A full path disclosure flaw was found in the way DokuWiki, a standards compliant, simple to use Wiki, performed sanitization of HTTP POST 'prefix' input value prior passing it to underlying PHP substr() routine, when the PHP error level has been enabled on the particular server. A remote attacker could use this flaw to obtain full path location of particular requested DokuWiki page by issuing a specially-crafted HTTP POST request.
References: [1] http://www.openwall.com/lists/oss-security/2012/06/24/2 [2] http://www.openwall.com/lists/oss-security/2012/06/25/2
Created attachment 591258 [details] proposed patch to fix possible buffer overflows.
Description of problem: compiler warning: call ... will always overflow destination buffer. indeed, there is a trivial bug in the code, no space is reserved for trailing \0. patch to fix: --- libytnef-1.5/ytnef.c 2004-08-26 17:09:05.000000000 +0000 +++ libytnef-1.5/ytnef.c 2012-06-08 19:34:07.826123387 +0000 @@ -1327,7 +1327,7 @@ ULONG compressedSize, uncompressedSize, magic, crc32; compPrebuf.size = strlen(RTFPREBUF); - compPrebuf.data = calloc(compPrebuf.size, 1); + compPrebuf.data = calloc(compPrebuf.size+1, 1); strcpy(compPrebuf.data, RTFPREBUF); src = p->data;
Version-Release number of selected component (if applicable): libytnef-1.5-7.fc17
OpenTTD before 1.1.5 contains a Denial of Service (slow read attack) that prevents users from joining the server.
An information disclosure flaw was found in the way dracut, an initramfs root filesystem images generator, created initramfs images. When the root filesystem contained sensitive information (password based authentication for iSCSI systems or encrypted root filesystem crypttab password information), an attacker could use this flaw to obtain this information.
Acknowledgements:
This issue was discovered by Peter Jones of the Red Hat Installer Team.
The ExecShield feature in a certain Red Hat patch for the Linux kernel in Red Hat Enterprise Linux (RHEL) 5 and 6 and Fedora 15 and 16 does not properly handle use of many shared libraries by a 32-bit executable file, which makes it easier for context-dependent attackers to bypass the ASLR protection mechanism by leveraging a predictable base address for one of these libraries.