A "stack overwrite" vulnerability in GnuPG (gpg) 1.x before 1.4.6, 2.x before 2.0.2, and 1.9.0 through 1.9.95 allows attackers to execute arbitrary code via crafted OpenPGP packets that cause GnuPG to dereference a function pointer from deallocated stack memory.

Integer overflow in the bdfReadCharacters function in bdfread.c in (1) X.Org libXfont before 20070403 and (2) freetype 2.3.2 and earlier allows remote authenticated users to execute arbitrary code via crafted BDF fonts, which result in a heap overflow.

Sebastian Krahmer of the SuSE security team discovered a remote command injection flaws in the gitweb, caused by an insufficient checking of the inputs used to build argument to perl's open() function. Remote attacker could use these flaws to run arbitrary commands with the privileges of the web server executing gitweb CGI scripts.

Issues are already fixed upstream in the latest git branches. It seems that the security consequences were not noticed when fixes were applied upstream, as multiple occurrences of the similar flaws were fixed in different upstream versions:

CVE-2008-5517 http://repo.or.cz/w/git.git?a=commitdiff;h=516381d5 (fixes issues in gitsnapshot and gitobject, first occurred in 1.5.6)

CVE-2008-5516 http://repo.or.cz/w/git.git?a=commitdiff;h=c582abae (fixes issue in gitsearch, first occurred in 1.5.5)

All current Fedora packages use version 1.5.6+, so neither of the issue apply to them. EPEL versions should be affected by one or both of the issues.

Buffer overflow in the polymorphic opcode support in the Regular Expression Engine (regcomp.c) in Perl 5.8 allows context-dependent attackers to execute arbitrary code by switching from byte to Unicode (UTF) characters in a regular expression.

The chroot helper in rMake for rPath Linux 1 does not drop supplemental groups, which causes packages to be installed with insecure permissions and might allow local users to gain privileges.

expn in the am-utils and net-fs packages for Gentoo, rPath Linux, and other distributions, allows local users to overwrite arbitrary files via a symlink attack on the expn[PID] temporary file. NOTE: this is the same issue as CVE-2003-0308.1.

Description of problem: There is a memory leak that causes memory to be allocated but not freed. When the denyfile option is set, it is possible to easily exploit this. This is a regression caused by applied patch in bz174764. Problem also exists in FC-6, F-7, F-8 and fedora/devel. Attached is a patch to solve the problem.

Version-Release number of selected component (if applicable): vsftpd-2.0.5-10.el5

How reproducible: always

Steps to Reproduce: echo denyfile=foo >> /etc/vsftpd/vsftpd.conf service vsftpd restart

$ cat > memtest.sh << EOF #!/bin/bash echo USER anonymous echo PASS foo

while [ 1 ]; do echo CWD pub echo CWD .. done EOF

$ chmod 700 memtest.sh $ ./memtest.sh | telnet localhost 21 > /dev/null

Actual results: vsftpd starts to allocate memory that will never be freed.

Expected results:

Additional info: It is possible that the memory leak can be exploited by other means, or with other vsftpd.conf options. This was not investigated into more depth.

The Chroot server in rMake 1.0.11 creates a /dev/zero device file with read/write permissions for the rMake user and the same minor device number as /dev/port, which might allow local users to gain root privileges.

rc.sysinit in initscripts 8.12-8.21 and 8.56.15-0.1 on rPath allows local users to delete arbitrary files via a symlink attack on a directory under (1) /var/lock or (2) /var/run. NOTE: this issue exists because of a race condition in an incorrect fix for CVE-2008-3524. NOTE: exploitation may require an unusual scenario in which rc.sysinit is executed other than at boot time.

Directory traversal vulnerability in the containsdotdot function in src/names.c in GNU tar allows user-assisted remote attackers to overwrite arbitrary files via certain //.. (slash slash dot dot) sequences in directory symlinks in a TAR archive.

libvorbis 1.1.2, and possibly other versions before 1.2.0, allows context-dependent attackers to cause a denial of service via (1) an invalid mapping type, which triggers an out-of-bounds read in the vorbisinfoclear function in info.c, and (2) invalid blocksize values that trigger a segmentation fault in the read function in block.c.

Chris Montgomery has informed us of a bug found in libvorbis. The patch is in revision 13160 from http://svn.xiph.org/trunk/vorbis (svn diff -r 13159:13160 http://svn.xiph.org/trunk/vorbis)

I'm calling this bug an "array boundary condition flaw". It's the best definition I could find that matched up with something MITRE uses. The issue in question is related to the usage of a function pointer table. Here is an example:

mappingP[ci->maptype[i]]->freeinfo(ci->mapparam[i]);

What happens is the value of 'ci->maptype[i]' can be an attacker controlled 16 bit unsigned integer. The amount of play with the that function pointer is a bit suspect I admit, but I suspect it's still exploitable (some peer review from someone better at this sort of thing would be helpful).

The code in question is called when libvorbis starts to clean things up after receiving bad data.

Stack-based buffer overflow in the zseticcspace function in zicc.c in Ghostscript 8.61 and earlier allows remote attackers to execute arbitrary code via a postscript (.ps) file containing a long Range array in a .seticcspace operator.

The rootpw plugin in rPath Appliance Platform Agent 2 and 3 does not re-validate requests from a browser with a valid administrator session, including requests to change the password, which makes it easier for physically proximate attackers to gain privileges and maintain control over the administrator account.

The RTMPT dissector in Wireshark (formerly Ethereal) 0.99.8 through 1.0.0 allows remote attackers to cause a denial of service (crash) via unknown vectors. NOTE: this might be due to a use-after-free error.

The (1) PANA and (2) KISMET dissectors in Wireshark (formerly Ethereal) 0.99.3 through 1.0.0 allow remote attackers to cause a denial of service (application stop) via unknown vectors.

initscripts in rPath Linux 1 sets insecure permissions for the /var/log/btmp file, which allows local users to obtain sensitive information regarding authentication attempts. NOTE: because sshd detects the insecure permissions and does not log certain events, this also prevents sshd from logging failed authentication attempts by remote attackers.

Integer overflow in the FontFileInitTable function in X.Org libXfont before 20070403 allows remote authenticated users to execute arbitrary code via a long first line in the fonts.dir file, which results in a heap overflow.

Cross-site request forgery (CSRF) vulnerability in the rootpw plugin in rPath Appliance Platform Agent 2 and 3 allows remote attackers to reset the root password as the administrator via a crafted URL.