Multiple SQL injection vulnerabilities in BOINC allow remote attackers to execute arbitrary SQL commands via unspecified vectors.

Berkeley Open Infrastructure for Network Computing BOINC Server and Website Code version 0.9-1.0.2 contains a CWE-302: Authentication Bypass by Assumed-Immutable Data vulnerability in Website Terms of Service Acceptance Page that can result in Access to any user account. This attack appear to be exploitable via Specially crafted URL. This vulnerability appears to have been fixed in 1.0.3.

Buffer overflow in Berkeley parallel make (pmake) 2.1.33 and earlier allows a local user to gain root privileges via a long check argument of a shell definition.

Format string vulnerability in Berkeley parallel make (pmake) 2.1.33 and earlier allows a local user to gain root privileges via format specifiers in the check argument of a shell definition.

The Berkeley Open Infrastructure for Network Computing (BOINC) client software incorrectly checked the result after calling the RSApublicdecrypt function, allowing a malformed signature to be treated as a good signature rather than as an error. This issue affected the signature checks on RSA keys used with SSL/TLS.

References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=511521

This issue is related with recent OpenSSL's CVE-2008-5077 flaw.

Multiple cross-site scripting (XSS) vulnerabilities in Boinc Forum 5.10.20 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) id parameter to forumforum.php, or the searchstring parameter to forumtextsearchaction.php in a (2) titles or (3) bodies search.

Format string flaw was found in the way boinc-client, a Berkeley Open Infrastructure for Network Computing (BOINC) client for distributed computing, performed account information write / dump into corresponding XML file. An attacker could provide an account file (file containing account information) with specially-crafted value of the 'guiurls' item that, when processed would lead to boinc-client executable crash or, potentially, arbitrary code execution with the privileges of the user running the boinc-client binary.

References: [1] http://www.openwall.com/lists/oss-security/2013/04/28/3

Relevant upstream patch: [2] http://boinc.berkeley.edu/gitweb/?p=boinc-v2.git;a=commitdiff;h=99258dcecba8ef36e1ce0fd6e0dacffe53613ac9

nviboot boot script in the Debian nvi package allows local users to delete files via malformed entries in vi.recover.