Multiple unspecified vulnerabilities in FFmpeg 0.4.x through 0.6.x, as used in MPlayer 1.0 and other products, in Mandriva Linux 2009.0, 2010.0, and 2010.1; Corporate Server 4.0 (aka CS4.0); and Mandriva Enterprise Server 5 (aka MES5) have unknown impact and attack vectors, related to issues "originally discovered by Google Chrome developers."
Unspecified vulnerability in ping.c in iputils 20020927, 20070202, 20071127, and 20100214 on Mandriva Linux allows remote attackers to cause a denial of service (hang) via a crafted echo response.
dbus-daemon in D-Bus before 1.0.3, and 1.1.x before 1.1.20, recognizes sendinterface attributes in allow directives in the security policy only for fully qualified method calls, which allows local users to bypass intended access restrictions via a method call with a NULL interface.
Stack-based buffer overflow in the zseticcspace function in zicc.c in Ghostscript 8.61 and earlier allows remote attackers to execute arbitrary code via a postscript (.ps) file containing a long Range array in a .seticcspace operator.
Description of problem: The generic handler of xdg-open (i.e. when not running in KDE, GNOME or XFCE) has the following code:
browserwitharg=echo "$browser" | sed s#%s#"$1"#
if [ x"$browserwitharg" = x"$browser" ]; then "$browser" "$1"; else $browserwitharg; fi
sed interprets any commands in the argument and the result is executed by the script.
Version-Release number of selected component (if applicable): xdg-utils-1.0.2-2.fc8
How reproducible: Always
Steps to Reproduce: 1. uninstall perl-File-MimeInfo package (not necessary with xdg-utils-1.0.2-3) 2. start plain X session 3. xdg-open 'http://foo.org/bar#;g;sx$xtouch:foox' Actual results: File foo created.
Expected results: The page opened in a web browser.
Additional info:
The padroproot function in PulseAudio 0.9.8, and a certain 0.9.9 build, does not check return values from (1) setresuid, (2) setreuid, (3) setuid, and (4) seteuid calls when attempting to drop privileges, which might allow local users to gain privileges by causing those calls to fail via attacks such as resource exhaustion.