Buffer overflow in Stormy Studios Knet 1.04c and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long HTTP GET request.
The following was reported: ... The function "rsfiltergraph" located in file ./librawstudio/rs-filter.c contains the following code:
gstringappendprintf(str, "}\n"); gfilesetcontents("/tmp/rs-filter-graph", str->str, str->len, NULL);
ignore = system("dot -Tpng >/tmp/rs-filter-graph.png </tmp/rs-filter-graph"); ignore = system("gnome-open /tmp/rs-filter-graph.png");
This code makes insecure use of two temporary files:
/tmp/rs-filter-graph.png /tmp/rs-filter-graph
This allows the truncation of arbitrary files which are owned by the user running rawstudio - for example:
ln -s ~/.important /tmp/rs-filter-graph ln -s /etc/shadow /tmp/rs-filter-graph.png
The Coke Studio 7 (aka com.cokeshare.pakistan) application 1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
The following was reported: ... The function "rsfiltergraph" located in file ./librawstudio/rs-filter.c contains the following code:
gstringappendprintf(str, "}\n"); gfilesetcontents("/tmp/rs-filter-graph", str->str, str->len, NULL);
ignore = system("dot -Tpng >/tmp/rs-filter-graph.png </tmp/rs-filter-graph"); ignore = system("gnome-open /tmp/rs-filter-graph.png");
This code makes insecure use of two temporary files:
/tmp/rs-filter-graph.png /tmp/rs-filter-graph
This allows the truncation of arbitrary files which are owned by the user running rawstudio - for example:
ln -s ~/.important /tmp/rs-filter-graph ln -s /etc/shadow /tmp/rs-filter-graph.png