Cross-site scripting (XSS) vulnerability in startform() of CGI.pm allows remote attackers to insert web script via a URL that is fed into the form's action parameter.
OpenSSH-portable (OpenSSH) 3.6.1p1 and earlier with PAM support enabled immediately sends an error message when a user does not exist, which allows remote attackers to determine valid usernames via a timing attack.
Format string vulnerability in wrapper.c in CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16 allows remote attackers with CVSROOT commit access to cause a denial of service (application crash) and possibly execute arbitrary code via format string specifiers in a wrapper line.
Double free vulnerability for the errorprogname string in CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16, may allow remote attackers to execute arbitrary code.
From: Steve G <linux4ever>
In the pngformatbuffer function located in pngerror.c around line 133 is the following code:
if (message == NULL) buffer[iout] = 0; else { buffer[iout++] = ':'; buffer[iout++] = ' '; pngmemcpy(buffer+iout, message, 64); buffer[iout+63] = 0; } This code is called from the pngchunkerror & pngchunkwarning functions. An example of their use would be in pngutil.c around line 119. pngchunkerror(pngptr, "CRC error"); In the above code, the message being constructed is only 10 characters long. The pngmemcpy function will unconditionally access 54 bytes beyond the message.
This could cause a carefully crafted png image to cause a denial of service.
Possibly embargoed; marking as embargoed until communicated otherwise.
Integer overflow in the "Max-dotdot" CVS protocol command (servemaxdotdot) for CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16, may allow remote attackers to cause a server crash, which could cause temporary data to remain undeleted and consume disk space.
CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16, does not properly handle malformed "Entry" lines, which prevents a NULL terminator from being used and may lead to a denial of service (crash), modification of critical program data, or arbitrary code execution.
servenotify in CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16, does not properly handle empty data lines, which may allow remote attackers to perform an "out-of-bounds" write for a single byte to execute arbitrary code or modify critical program data.