initscripts in rPath Linux 1 sets insecure permissions for the /var/log/btmp file, which allows local users to obtain sensitive information regarding authentication attempts. NOTE: because sshd detects the insecure permissions and does not log certain events, this also prevents sshd from logging failed authentication attempts by remote attackers.

Buffer overflow in the polymorphic opcode support in the Regular Expression Engine (regcomp.c) in Perl 5.8 allows context-dependent attackers to execute arbitrary code by switching from byte to Unicode (UTF) characters in a regular expression.

Directory traversal vulnerability in the containsdotdot function in src/names.c in GNU tar allows user-assisted remote attackers to overwrite arbitrary files via certain //.. (slash slash dot dot) sequences in directory symlinks in a TAR archive.

libvorbis 1.1.2, and possibly other versions before 1.2.0, allows context-dependent attackers to cause a denial of service via (1) an invalid mapping type, which triggers an out-of-bounds read in the vorbisinfoclear function in info.c, and (2) invalid blocksize values that trigger a segmentation fault in the read function in block.c.

Chris Montgomery has informed us of a bug found in libvorbis. The patch is in revision 13160 from http://svn.xiph.org/trunk/vorbis (svn diff -r 13159:13160 http://svn.xiph.org/trunk/vorbis)

I'm calling this bug an "array boundary condition flaw". It's the best definition I could find that matched up with something MITRE uses. The issue in question is related to the usage of a function pointer table. Here is an example:

mappingP[ci->maptype[i]]->freeinfo(ci->mapparam[i]);

What happens is the value of 'ci->maptype[i]' can be an attacker controlled 16 bit unsigned integer. The amount of play with the that function pointer is a bit suspect I admit, but I suspect it's still exploitable (some peer review from someone better at this sort of thing would be helpful).

The code in question is called when libvorbis starts to clean things up after receiving bad data.

Integer overflow in the bdfReadCharacters function in bdfread.c in (1) X.Org libXfont before 20070403 and (2) freetype 2.3.2 and earlier allows remote authenticated users to execute arbitrary code via crafted BDF fonts, which result in a heap overflow.

The chroot helper in rMake for rPath Linux 1 does not drop supplemental groups, which causes packages to be installed with insecure permissions and might allow local users to gain privileges.