4 20050803235347 Red Hat Linux 9 Mutt Jay Beale INTERIM Jay Beale ACCEPTED Buffer overflow in Mutt 1.4.0 and possibly earlier versions, 1.5.x up to 1.5.3, and other programs that use Mutt code such as Balsa before 2.0.10, allows a remote malicious IMAP server to cause a denial of service (crash) and possibly execute arbitrary code via a crafted folder. CAN-2003-0140 ACCEPTED 1 Red Hat Linux 9 CUPS Jay Beale INTERIM Jay Beale ACCEPTED CUPS before 1.1.19 allows remote attackers to cause a denial of service via a partial printing request to the IPP port (631), which does not time out. CAN-2003-0195 ACCEPTED 1 Red Hat Linux 9 skk Jay Beale INTERIM Jay Beale ACCEPTED skk (Simple Kana to Kanji conversion program) 12.1 and earlier, and the ddskk package which is based on skk, creates temporary files insecurely, which allows local users to overwrite arbitrary files. CAN-2003-0539 ACCEPTED 1 Red Hat Linux 9 EOG Jay Beale INTERIM Jay Beale ACCEPTED Format string vulnerability in Eye Of Gnome (EOG) allows attackers to execute arbitrary code via format string specifiers in a command line argument for the file to display. CAN-2003-0165 ACCEPTED 1 Red Hat Linux 9 Ethereal Jay Beale INTERIM Jay Beale ACCEPTED Format string vulnerability in packet-socks.c of the SOCKS dissector for Ethereal 0.8.7 through 0.9.9 allows remote attackers to execute arbitrary code via SOCKS packets containing format string specifiers. CVE-2003-0081 ACCEPTED 1 Red Hat Linux 9 Ethereal Jay Beale INTERIM Jay Beale ACCEPTED Heap-based buffer overflow in the NTLMSSP code for Ethereal 0.9.9 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary code. CAN-2003-0159 ACCEPTED 1 Red Hat Linux 9 Ethereal Jay Beale INTERIM Jay Beale ACCEPTED Multiple off-by-one vulnerabilities in Ethereal 0.9.11 and earlier allow remote attackers to cause a denial of service and possibly execute arbitrary code via the (1) AIM, (2) GIOP Gryphon, (3) OSPF, (4) PPTP, (5) Quake, (6) Quake2, (7) Quake3, (8) Rsync, (9) SMB, (10) SMPP, and (11) TSP dissectors, which do not properly use the tvb_get_nstringz and tvb_get_nstringz0 functions. CAN-2003-0356 ACCEPTED 1 Red Hat Linux 9 Ethereal Jay Beale INTERIM Jay Beale ACCEPTED Multiple integer overflow vulnerabilities in Ethereal 0.9.11 and earlier allow remote attackers to cause a denial of service and possibly execute arbitrary code via the (1) Mount and (2) PPP dissectors. CAN-2003-0357 ACCEPTED 1 Red Hat Linux 9 Ethereal Jay Beale INTERIM Jay Beale ACCEPTED Unknown vulnerability in the DCERPC dissector in Ethereal 0.9.12 and earlier allows remote attackers to cause a denial of service (memory consumption) via a certain NDR string. CAN-2003-0428 ACCEPTED 1 Red Hat Linux 9 Ethereal Jay Beale INTERIM Jay Beale ACCEPTED The OSI dissector in Ethereal 0.9.12 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary code via invalid IPv4 or IPv6 prefix lengths, possibly triggering a buffer overflow. CAN-2003-0429 ACCEPTED 1 Red Hat Linux 9 Ethereal Jay Beale INTERIM Jay Beale ACCEPTED The SPNEGO dissector in Ethereal 0.9.12 and earlier allows remote attackers to cause a denial of service (crash) via an invalid ASN.1 value. CAN-2003-0430 ACCEPTED 1 Red Hat Linux 9 Ethereal Jay Beale INTERIM Jay Beale ACCEPTED The tvb_get_nstringz0 function in Ethereal 0.9.12 and earlier does not properly handle a zero-length buffer size, with unknown consequences. CAN-2003-0431 ACCEPTED 1 Red Hat Linux 9 Ethereal Jay Beale INTERIM Jay Beale ACCEPTED Ethereal 0.9.12 and earlier does not handle certain strings properly, with unknown consequences, in the (1) BGP, (2) WTP, (3) DNS, (4) 802.11, (5) ISAKMP, (6) WSP, (7) CLNP, (8) ISIS, and (9) RMI dissectors. CAN-2003-0432 ACCEPTED 1 Red Hat Linux 9 Ximian Evolution Jay Beale INTERIM Jay Beale ACCEPTED The try_uudecoding function in mail-format.c for Ximian Evolution Mail User Agent 1.2.2 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a malicious uuencoded (UUE) header, possibly triggering a heap-based buffer overflow. CAN-2003-0128 ACCEPTED 1 Red Hat Linux 9 Ximian Evolution Jay Beale INTERIM Jay Beale ACCEPTED Ximian Evolution Mail User Agent 1.2.2 and earlier allows remote attackers to cause a denial of service (memory consumption) via a mail message that is uuencoded multiple times. CAN-2003-0129 ACCEPTED 1 Red Hat Linux 9 Ximian Evolution Jay Beale INTERIM Jay Beale ACCEPTED The handle_image function in mail-format.c for Ximian Evolution Mail User Agent 1.2.2 and earlier does not properly escape HTML characters, which allows remote attackers inject arbitrary data and HTML via a MIME Content-ID header in a MIME-encoded image. CAN-2003-0130 ACCEPTED 1 Red Hat Linux 9 GDM Jay Beale INTERIM ACCEPTED GDM before 2.4.1.6, when using the "examine session errors" feature, allows local users to read arbitrary files via a symlink attack on the ~/.xsession-errors file. CAN-2003-0547 ACCEPTED 1 Red Hat Linux 9 GDM Jay Beale INTERIM ACCEPTED The X Display Manager Control Protocol (XDMCP) support for GDM before 2.4.1.6 allows attackers to cause a denial of service (daemon crash) when a chosen host expires, a different issue than CAN-2003-0549. CAN-2003-0548 ACCEPTED 1 Red Hat Linux 9 GDM Jay Beale INTERIM ACCEPTED The X Display Manager Control Protocol (XDMCP) support for GDM before 2.4.1.6 allows attackers to cause a denial of service (daemon crash) via a short authorization key name. CAN-2003-0549 ACCEPTED 1 Red Hat Linux 9 GNU Ghostscript Jay Beale INTERIM Jay Beale ACCEPTED Unknown vulnerability in GNU Ghostscript before 7.07 allows attackers to execute arbitrary commands, even when -dSAFER is enabled, via a PostScript file that causes the commands to be executed from a malicious print job. CAN-2003-0354 ACCEPTED 1 Red Hat Linux 9 GnuPG Jay Beale INTERIM Jay Beale ACCEPTED The key validation code in GnuPG before 1.2.2 does not properly determine the validity of keys with multiple user IDs and assigns the greatest validity of the most valid user ID, which prevents GnuPG from warning the encrypting user when a user ID does not have a trusted path. CAN-2003-0255 ACCEPTED 1 Red Hat Linux 9 GtkHTML Jay Beale INTERIM ACCEPTED GtkHTML, as included in Evolution before 1.2.4, allows remote attackers to cause a denial of service (crash) via certain malformed messages. CAN-2003-0133 ACCEPTED 1 Red Hat Linux 9 GtkHTML Jay Beale INTERIM Jay Beale ACCEPTED gtkhtml before 1.1.10, as used in Evolution, allows remote attackers to cause a denial of service (crash) via a malformed message that causes a null pointer dereference. CAN-2003-0541 ACCEPTED 1 Red Hat Linux 9 Apache Jay Beale INTERIM Jay Beale ACCEPTED Apache does not filter terminal escape sequences from its error logs, which could make it easier for attackers to insert those sequences into terminal emulators containing vulnerabilities related to escape sequences. CVE-2003-0020 ACCEPTED 1 Red Hat Linux 9 Apache Jay Beale INTERIM Jay Beale ACCEPTED Apache 1.3 before 1.3.25 and Apache 2.0 before version 2.0.46 does not filter terminal escape sequences from its access logs, which could make it easier for attackers to insert those sequences into terminal emulators containing vulnerabilities related to escape sequences, a different vulnerability than CAN-2003-0020. CAN-2003-0083 ACCEPTED 1 Red Hat Linux 9 Apache Jay Beale INTERIM Jay Beale ACCEPTED A memory leak in Apache 2.0 through 2.0.44 allows remote attackers to cause a denial of service (memory consumption) via large chunks of linefeed characters, which causes Apache to allocate 80 bytes for each linefeed. CAN-2003-0132 ACCEPTED 1 Red Hat Enterprise Linux 3 OpenSSL Jay Beale DRAFT INTERIM The der_chop script in the openssl package in Trustix Secure Linux 1.5 through 2.1 and other operating systems allows local users to overwrite files via a symlink attack on temporary files. CAN-2004-0975 INTERIM 0 Red Hat Linux 9 Apache Jay Beale INTERIM Jay Beale ACCEPTED Apache 2 before 2.0.47, and certain versions of mod_ssl for Apache 1.3, do not properly handle "certain sequences of per-directory renegotiations and the SSLCipherSuite directive being used to upgrade from a weak ciphersuite to a strong one," which could cause Apache to use the weak ciphersuite. CAN-2003-0192 ACCEPTED 1 Red Hat Linux 9 Apache Jay Beale INTERIM Jay Beale ACCEPTED The prefork MPM in Apache 2 before 2.0.47 does not properly handle certain errors from accept, which could lead to a denial of service. CAN-2003-0253 ACCEPTED 1 Red Hat Linux 9 Apache Jay Beale INTERIM Jay Beale ACCEPTED Apache 2 before 2.0.47, when running on an IPv6 host, allows attackers to cause a denial of service (CPU consumption by infinite loop) when the FTP proxy server fails to create an IPv6 socket. CAN-2003-0254 ACCEPTED 1 Red Hat Linux 9 KDM Jay Beale INTERIM ACCEPTED KDM in KDE 3.1.3 and earlier does not verify whether the pam_setcred function call succeeds, which may allow attackers to gain root privileges by triggering error conditions within PAM modules, as demonstrated in certain configurations of the MIT pam_krb5 module. CAN-2003-0690 ACCEPTED 1 Red Hat Linux 9 KDM Jay Beale INTERIM ACCEPTED KDM in KDE 3.1.3 and earlier uses a weak session cookie generation algorithm that does not provide 128 bits of entropy, which allows attackers to guess session cookies via brute force methods and gain access to the user session. CAN-2003-0692 ACCEPTED 1 Red Hat Linux 9 krb5 Jay Beale INTERIM Jay Beale ACCEPTED Integer overflow in the xdrmem_getbytes() function, and possibly other functions, of XDR (external data representation) libraries derived from SunRPC, including libnsl, libc, glibc, and dietlibc, allows remote attackers to execute arbitrary code via certain integer values in length fields, a different vulnerability than CAN-2002-0391. CAN-2003-0028 ACCEPTED 1 Red Hat Linux 9 krb5 Jay Beale INTERIM Jay Beale ACCEPTED The Key Distribution Center (KDC) in Kerberos 5 (krb5) 1.2.7 and earlier allows remote, authenticated attackers to cause a denial of service (crash) on KDCs within the same realm using a certain protocol request that causes the KDC to corrupt its heap (aka "buffer underrun"). CAN-2003-0082 ACCEPTED 1 Red Hat Linux 9 krb5 Jay Beale INTERIM Jay Beale ACCEPTED Version 4 of the Kerberos protocol (krb4), as used in Heimdal and other packages, allows an attacker to impersonate any principal in a realm via a chosen-plaintext attack. CAN-2003-0138 ACCEPTED 1 Red Hat Linux 9 krb5 Jay Beale INTERIM Jay Beale ACCEPTED Certain weaknesses in the implementation of version 4 of the Kerberos protocol (krb4) in the krb5 distribution, when triple-DES keys are used to key krb4 services, allow an attacker to create krb4 tickets for unauthorized principals using a cut-and-paste attack and "ticket splicing." CAN-2003-0139 ACCEPTED 1 Red Hat Linux 9 Linux kernel Jay Beale INTERIM Jay Beale ACCEPTED The kernel module loader in Linux kernel 2.2.x before 2.2.25, and 2.4.x before 2.4.21, allows local users to gain root privileges by using ptrace to attach to a child process that is spawned by the kernel. CAN-2003-0127 ACCEPTED 1 Red Hat Linux 9 Netfilter Jay Beale INTERIM Jay Beale ACCEPTED The connection tracking core of Netfilter for Linux 2.4.20, with CONFIG_IP_NF_CONNTRACK enabled or the ip_conntrack module loaded, allows remote attackers to cause a denial of service (resource consumption) due to an inconsistency with Linux 2.4.20's support of linked lists, which causes Netfilter to fail to identify connections with an UNCONFIRMED status and use large timeouts. CAN-2003-0187 ACCEPTED 1 Red Hat Linux 9 Netfilter Jay Beale INTERIM Jay Beale ACCEPTED The route cache implementation in Linux 2.4, and the Netfilter IP conntrack module, allows remote attackers to cause a denial of service (CPU consumption) via packets with forged source addresses that cause a large number of hash table collisions. CAN-2003-0244 ACCEPTED 1 Red Hat Enterprise Linux 3 Gaim Jay Beale DRAFT Gaim before 1.3.1 allows remote attackers to cause a denial of service (crash) via a malformed MSN message that leads to a memory allocation of a large size, possibly due to an integer signedness error. CAN-2005-1934 DRAFT 0 Red Hat Linux 9 Linux kernel Jay Beale INTERIM Jay Beale ACCEPTED The ioperm system call in Linux kernel 2.4.20 and earlier does not properly restrict privileges, which allows local users to gain read or write access to certain I/O ports. CAN-2003-0246 ACCEPTED 1 Red Hat Linux 9 Linux kernel Jay Beale INTERIM Jay Beale ACCEPTED Unknown vulnerability in the TTY layer of the Linux kernel 2.4 allows attackers to cause a denial of service ("kernel oops"). CAN-2003-0247 ACCEPTED 1 Red Hat Linux 9 Linux kernel Jay Beale INTERIM Jay Beale ACCEPTED The mxcsr code in Linux kernel 2.4 allows attackers to modify CPU state registers via a malformed address. CAN-2003-0248 ACCEPTED 1 Red Hat Linux 9 Linux kernel Jay Beale INTERIM Jay Beale ACCEPTED The TCP/IP fragment reassembly handling in the Linux kernel 2.4 allows remote attackers to cause a denial of service (CPU consumption) via certain packets that cause a large number of hash table collisions. CAN-2003-0364 ACCEPTED 1 Red Hat Linux 9 /proc/tty/driver/serial Jay Beale INTERIM Jay Beale ACCEPTED /proc/tty/driver/serial in Linux 2.4.x reveals the exact number of characters used in serial links, which could allow local users to obtain potentially sensitive information such as the length of passwords. CAN-2003-0461 ACCEPTED 1 Red Hat Linux 9 Linux kernel Jay Beale INTERIM Jay Beale ACCEPTED A race condition in the way env_start and env_end pointers are initialized in the execve system call and used in fs/proc/base.c on Linux 2.4 allows local users to cause a denial of service (crash). CAN-2003-0462 ACCEPTED 1 Red Hat Linux 9 Linux kernel Jay Beale INTERIM Jay Beale ACCEPTED The RPC code in Linux kernel 2.4 sets the reuse flag when sockets are created, which could allow local users to bind to UDP ports that are used by privileged services such as nfsd. CAN-2003-0464 ACCEPTED 1 Red Hat Linux 9 Linux kernel Jay Beale INTERIM Jay Beale ACCEPTED The execve system call in Linux 2.4.x records the file descriptor of the executable process in the file table of the calling process, which allows local users to gain read access to restricted file descriptors. CAN-2003-0476 ACCEPTED 1 Red Hat Linux 9 Linux kernel Jay Beale INTERIM Jay Beale ACCEPTED The /proc filesystem in Linux allows local users to obtain sensitive information by opening various entries in /proc/self before executing a setuid program, which causes the program to fail to change the ownership and permissions of those entries. CAN-2003-0501 ACCEPTED 1 Red Hat Enterprise Linux 3 php Jay Beale DRAFT Race condition in shtool 2.0.1 and earlier allows local users to create or modify arbitrary files via a symlink attack on the .shtool.$$ temporary file, a different vulnerability than CAN-2005-1759. CAN-2005-1751 DRAFT 0 Red Hat Enterprise Linux 3 php Jay Beale DRAFT PEAR XML_RPC 1.3.0 and earlier, as used in products such as WordPress, Serendipity, and others, allows remote attackers to execute arbitrary PHP code via an XML file, which is not properly sanitized before being used in an eval statement. CAN-2005-1921 DRAFT 0 Red Hat Linux 9 Linux kernel Jay Beale INTERIM Jay Beale ACCEPTED The STP protocol, as enabled in Linux 2.4.x, does not provide sufficient security by design, which allows attackers to modify the bridge topology. CAN-2003-0550 ACCEPTED 1 Red Hat Enterprise Linux 3 gzip Jay Beale DRAFT INTERIM Directory traversal vulnerability in gunzip -N in gzip 1.2.4 through 1.3.5 allows remote attackers to write to arbitrary directories via a .. (dot dot) in the original filename within a compressed file. CAN-2005-1228 INTERIM 0 Red Hat Linux 9 Linux kernel Jay Beale INTERIM Jay Beale ACCEPTED The STP protocol implementation in Linux 2.4.x does not properly verify certain lengths, which could allow attackers to cause a denial of service. CAN-2003-0551 ACCEPTED 1 Red Hat Linux 9 Linux kernel Jay Beale INTERIM Jay Beale ACCEPTED Linux 2.4.x allows remote attackers to spoof the bridge Forwarding table via forged packets whose source addresses are the same as the target. CAN-2003-0552 ACCEPTED 1 Red Hat Linux 9 Linux kernel Jay Beale INTERIM Jay Beale ACCEPTED Integer signedness error in the decode_fh function of nfs3xdr.c in Linux kernel before 2.4.21 allows remote attackers to cause a denial of service (kernel panic) via a negative size value within XDR data of an NFSv3 procedure call. CAN-2003-0619 ACCEPTED 1 Red Hat Linux 9 Linux kernel Jay Beale INTERIM Jay Beale ACCEPTED The C-Media PCI sound driver in Linux before 2.4.21 does not use the get_user function to access userspace, which crosses security boundaries and may facilitate the exploitation of vulnerabilities, a different vulnerability than CAN-2003-0700. CAN-2003-0699 ACCEPTED 1 Red Hat Linux 9 Linux kernel Jay Beale INTERIM Jay Beale ACCEPTED The C-Media PCI sound driver in Linux before 2.4.22 does not use the get_user function to access userspace in certain conditions, which crosses security boundaries and may facilitate the exploitation of vulnerabilities, a different vulnerability than CAN-2003-0699. CAN-2003-0700 ACCEPTED 1 Red Hat Linux 9 Konqueror Jay Beale INTERIM ACCEPTED KDE Konqueror for KDE 3.1.2 and earlier does not remove authentication credentials from URLs of the "user:password@host" form in the HTTP-Referer header, which could allow remote web sites to steal the credentials for pages that link to the sites. CAN-2003-0459 ACCEPTED 1 Red Hat Linux 9 LPRng Jay Beale INTERIM Jay Beale ACCEPTED psbanner in the LPRng package allows local users to overwrite arbitrary files via a symbolic link attack on the /tmp/before file. CAN-2003-0136 ACCEPTED 1 Red Hat Linux 9 lv Jay Beale INTERIM Jay Beale ACCEPTED lv reads a .lv file from the current working directory, which allows local users to execute arbitrary commands as other lv users by placing malicious .lv files into other directories. CAN-2003-0188 ACCEPTED 1 Red Hat Linux 9 Mutt Jay Beale INTERIM ACCEPTED Buffer overflow in Mutt 1.4.0 and possibly earlier versions, 1.5.x up to 1.5.3, and other programs that use Mutt code such as Balsa before 2.0.10, allows a remote malicious IMAP server to cause a denial of service (crash) and possibly execute arbitrary code via a crafted folder. CAN-2003-0140 ACCEPTED 1 Red Hat Linux 9 MySQL Jay Beale INTERIM Jay Beale ACCEPTED Double-free vulnerability in mysqld for MySQL before 3.23.55 allows attackers with MySQL access to cause a denial of service (crash) via mysql_change_user. CVE-2003-0073 ACCEPTED 1 Red Hat Linux 9 MySQL Jay Beale INTERIM Jay Beale ACCEPTED MySQL 3.23.55 and earlier creates world-writeable files and allows mysql users to gain root privileges by using the "SELECT * INFO OUTFILE" operator to overwrite a configuration file and cause mysql to run as root upon restart. CAN-2003-0150 ACCEPTED 1 Red Hat Linux 9 nfs-utils Jay Beale INTERIM Jay Beale ACCEPTED Off-by-one error in the xlog function of mountd in the Linux NFS utils package (nfs-utils) before 1.0.4 allows remote attackers to cause a denial of service and possibly execute arbitrary code via certain RPC requests to mountd that do not contain newlines. CAN-2003-0252 ACCEPTED 1 Red Hat Linux 9 OpenSSH Jay Beale INTERIM Jay Beale ACCEPTED OpenSSH-portable (OpenSSH) 3.6.1p1 and earlier with PAM support enabled immediately sends an error message when a user does not exist, which allows remote attackers to determine valid usernames via a timing attack. CAN-2003-0190 ACCEPTED 1 Red Hat Linux 9 OpenSSH Jay Beale INTERIM Jay Beale ACCEPTED "Memory bugs" in OpenSSH 3.7.1 and earlier, with unknown impact, a different set of vulnerabilities than CAN-2003-0693 and CAN-2003-0695. CAN-2003-0682 ACCEPTED 1 Red Hat Linux 9 OpenSSH Jay Beale INTERIM Jay Beale ACCEPTED A "buffer management error" in buffer_append_space of buffer.c for OpenSSH before 3.7 may allow remote attackers to execute arbitrary code by causing an incorrect amount of memory to be freed and corrupting the heap, a different vulnerability than CAN-2003-0695. CAN-2003-0693 ACCEPTED 1 Red Hat Linux 9 OpenSSH Jay Beale INTERIM Jay Beale ACCEPTED Multiple "buffer management errors" in OpenSSH before 3.7.1 may allow attackers to cause a denial of service or execute arbitrary code using (1) buffer_init in buffer.c, (2) buffer_free in buffer.c, or (3) a separate function in channels.c, a different vulnerability than CAN-2003-0693. CAN-2003-0695 ACCEPTED 1 Red Hat Linux 9 OpenSSL Jay Beale INTERIM Jay Beale Jay Beale ACCEPTED The SSL and TLS components for OpenSSL 0.9.6i and earlier, 0.9.7, and 0.9.7a allow remote attackers to perform an unauthorized RSA private key operation via a modified Bleichenbacher attack that uses a large number of SSL or TLS connections using PKCS #1 v1.5 padding that cause OpenSSL to leak information regarding the relationship between ciphertext and the associated plaintext, aka the "Klima-Pokorny-Rosa attack." CAN-2003-0131 ACCEPTED 1 Red Hat Linux 9 OpenSSL Jay Beale INTERIM Jay Beale Jay Beale ACCEPTED OpenSSL does not use RSA blinding by default, which allows local and remote attackers to obtain the server's private key by determining factors using timing differences on (1) the number of extra reductions during Montgomery reduction, and (2) the use of different integer multiplication algorithms ("Karatsuba" and normal). CAN-2003-0147 ACCEPTED 1 Red Hat Linux 9 pam_smb Jay Beale INTERIM Jay Beale ACCEPTED Buffer overflow in PAM SMB module (pam_smb) 1.1.6 and earlier, when authenticating to a remote service, allows remote attackers to execute arbitrary code. CAN-2003-0686 ACCEPTED 1 Red Hat Linux 9 CGI.pm Jay Beale INTERIM ACCEPTED Cross-site scripting (XSS) vulnerability in start_form() of CGI.pm allows remote attackers to insert web script via a URL that is fed into the form's action parameter. CAN-2003-0615 ACCEPTED 1 Red Hat Linux 9 php Jay Beale INTERIM Jay Beale ACCEPTED Cross-site scripting (XSS) vulnerability in the transparent SID support capability for PHP before 4.3.2 (session.use_trans_sid) allows remote attackers to insert arbitrary script via the PHPSESSID parameter. CAN-2003-0442 ACCEPTED 1 Red Hat Linux 9 pine Jay Beale INTERIM Jay Beale ACCEPTED Buffer overflow in PINE before 4.58 allows remote attackers to execute arbitrary code via a malformed message/external-body MIME type. CAN-2003-0720 ACCEPTED 1 Red Hat Linux 9 pine Jay Beale INTERIM Jay Beale ACCEPTED Integer signedness error in rfc2231_get_param from strings.c in PINE before 4.58 allows remote attackers to execute arbitrary code via an email that causes an out-of-bounds array access using a negative number. CAN-2003-0721 ACCEPTED 1 Red Hat Linux 9 Postfix Jay Beale INTERIM ACCEPTED Postfix 1.1.11 and earlier allows remote attackers to use Postfix to conduct "bounce scans" or DDos attacks of other hosts via an email address to the local host containing the target IP address and service name followed by a "!" string, which causes Postfix to attempt to use SMTP to communicate with the target on the associated port. CAN-2003-0468 ACCEPTED 1 Red Hat Linux 9 Postfix Jay Beale INTERIM ACCEPTED The address parser code in Postfix 1.1.12 and earlier allows remote attackers to cause a denial of service (lock) via (1) a malformed envelope address to a local host that would generate a bounce and contains the ".!" string in the MAIL FROM or Errors-To headers, which causes nqmgr to lock up, or (2) via a valid MAIL FROM with a RCPT TO containing a ".!" string, which causes an instance of the SMTP listener to lock up. CAN-2003-0540 ACCEPTED 1 Red Hat Linux 9 smbd Jay Beale INTERIM Jay Beale ACCEPTED Buffer overflow in the SMB/CIFS packet fragment re-assembly code for SMB daemon (smbd) in Samba before 2.2.8, and Samba-TNG before 0.3.1, allows remote attackers to execute arbitrary code. CAN-2003-0085 ACCEPTED 1 Red Hat Linux 9 Samba Jay Beale INTERIM Jay Beale ACCEPTED The code for writing reg files in Samba before 2.2.8 allows local users to overwrite arbitrary files via a race condition involving chown. CAN-2003-0086 ACCEPTED 1 Red Hat Linux 9 Samba Jay Beale INTERIM Jay Beale ACCEPTED Multiple buffer overflows in Samba before 2.2.8a may allow remote attackers to execute arbitrary code or cause a denial of service, as discovered by the Samba team and a different vulnerability than CAN-2003-0201. CAN-2003-0196 ACCEPTED 1 Red Hat Linux 9 Samba, Samba-TNG Jay Beale INTERIM Jay Beale ACCEPTED Buffer overflow in the call_trans2open function in trans2.c for Samba 2.2.x before 2.2.8a, 2.0.10 and earlier 2.0.x versions, and Samba-TNG before 0.3.2, allows remote attackers to execute arbitrary code. CAN-2003-0201 ACCEPTED 1 Red Hat Linux 9 semi MIME library Jay Beale INTERIM Jay Beale ACCEPTED The (1) semi MIME library 1.14.5 and earlier, and (2) wemi 1.14.0 and possibly other versions, allows local users to overwrite arbitrary files via a symlink attack on temporary files. CAN-2003-0440 ACCEPTED 1 Red Hat Linux 9 Sendmail Jay Beale INTERIM Jay Beale ACCEPTED The prescan function in Sendmail 8.12.9 allows remote attackers to execute arbitrary code via buffer overflow attacks, as demonstrated using the parseaddr function in parseaddr.c. CAN-2003-0694 ACCEPTED 1 Red Hat Linux 9 Sendmail Jay Beale INTERIM Jay Beale ACCEPTED A "potential buffer overflow in ruleset parsing" for Sendmail 8.12.9, when using the nonstandard rulesets (1) recipient (2), final, or (3) mailer-specific envelope recipients, has unknown consequences. CAN-2003-0681 ACCEPTED 1 Red Hat Linux 9 Sendmail Jay Beale INTERIM Jay Beale ACCEPTED The DNS map code in Sendmail 8.12.8 and earlier, when using the "enhdnsbl" feature, does not properly initialize certain data structures, which allows remote attackers to cause a denial of service (process crash) via an invalid DNS response that causes Sendmail to free incorrect data. CAN-2003-0688 ACCEPTED 1 Red Hat Linux 9 Sendmail Jay Beale INTERIM Jay Beale ACCEPTED The prescan function in Sendmail 8.12.9 allows remote attackers to execute arbitrary code via buffer overflow attacks, as demonstrated using the parseaddr function in parseaddr.c. CAN-2003-0694 ACCEPTED 1 Red Hat Linux 9 SquirrelMail Jay Beale INTERIM Jay Beale ACCEPTED Multiple cross-site scripting (XSS) vulnerabilities in SquirrelMail before 1.2.11 allow remote attackers to inject arbitrary HTML code and steal information from a client's web browser. CAN-2003-0160 ACCEPTED 1 Red Hat Linux 9 unzip Jay Beale INTERIM Jay Beale ACCEPTED Directory traversal vulnerability in UnZip 5.50 allows attackers to overwrite arbitrary files via invalid characters between two . (dot) characters, which are filtered and result in a ".." sequence. CAN-2003-0282 ACCEPTED 1 Red Hat Enterprise Linux 3 sysreport Jay Beale DRAFT sysreport 1.3.15 and earlier includes contents of the up2date file in a report, which leaks the password for a proxy server in plaintext and allows local users to gain privileges. CAN-2005-1760 DRAFT 0 Red Hat Linux 9 up2date Jay Beale INTERIM Jay Beale ACCEPTED up2date 3.0.7 and 3.1.23 does not properly verify RPM GPG signatures, which could allow remote attackers to cause unsigned packages to be installed from the Red Hat Network, if that network is compromised. CAN-2003-0546 ACCEPTED 1 Red Hat Linux 9 vsftpd Jay Beale INTERIM Jay Beale ACCEPTED vsftpd FTP daemon in Red Hat Linux 9 is not compiled against TCP wrappers (tcp_wrappers) but is installed as a standalone service, which inadvertently prevents vsftpd from restricting access as intended. CAN-2003-0135 ACCEPTED 1 Red Hat Enterprise Linux 3 mikmod Jay Beale DRAFT INTERIM Buffer overflow in mikmod 3.1.6 and earlier allows remote attackers to execute arbitrary code via an archive file that contains a file with a long filename. CAN-2003-0427 INTERIM 0 Red Hat Linux 9 xinetd Jay Beale INTERIM Jay Beale Jay Beale ACCEPTED Memory leak in xinetd 2.3.10 allows remote attackers to cause a denial of service (memory consumption) via a large number of rejected connections. CAN-2003-0211 ACCEPTED 1 Red Hat Linux 9 xpdf Jay Beale INTERIM ACCEPTED Various PDF viewers including Adobe Acrobat 5.06 and Xpdf 1.01 allow remote attackers to execute arbitrary commands via shell metacharacters in an embedded hyperlink. CAN-2003-0434 ACCEPTED 1 Red Hat Linux 9 ypserv Jay Beale INTERIM Jay Beale ACCEPTED ypserv NIS server before 2.7 allows remote attackers to cause a denial of service via a TCP client request that does not respond to the server, which causes ypserv to block. CAN-2003-0251 ACCEPTED 1 Red Hat Enterprise Linux 3 postgresql Jay Beale DRAFT INTERIM PostgreSQL 7.3.x through 8.0.x gives public EXECUTE access to certain character conversion functions, which allows unprivileged users to call those functions with malicious values, with unknown impact, aka the "Character conversion vulnerability." CAN-2005-1409 INTERIM 0 Red Hat Enterprise Linux 3 ImageMagick Jay Beale DRAFT INTERIM Heap-based buffer overflow in the ReadPNMImage function in pnm.c for ImageMagick 6.2.1 and earlier allows remote attackers to cause a denial of service (application crash) via a PNM file with a small colors value. CAN-2005-1275 INTERIM 0 Red Hat Enterprise Linux 3 gftp Jay Beale DRAFT INTERIM Directory traversal vulnerability in gftp 2.0.18 and earlier for GTK+ allows remote malicious FTP servers to read arbitrary files via .. (dot dot) sequences in filenames returned from a LIST command. CAN-2005-0372 INTERIM 0 Red Hat Enterprise Linux 3 Gaim Jay Beale DRAFT Gaim before 1.3.1 allows remote attackers to cause a denial of service (application crash) via a Yahoo! message with non-ASCII characters in a file name. CAN-2005-1269 DRAFT 0 Red Hat Enterprise Linux 3 bzip2 Jay Beale DRAFT bzip2 allows remote attackers to cause a denial of service (hard drive consumption) via a crafted bzip2 file that causes an infinite loop (a.k.a "decompression bomb"). CAN-2005-1260 DRAFT 0 Red Hat Linux 9 PWLib Jay Beale Matt Busby ACCEPTED Multiple vulnerabilities in PWLib before 1.6.0 allow remote attackers to cause a denial of service and possibly execute arbitrary code, as demonstrated by the NISCC/OUSPG PROTOS test suite for the H.225 protocol. CAN-2004-0097 ACCEPTED 1 Red Hat Linux 9 netpbm Jay Beale Matt Busby ACCEPTED netpbm 9.25 and earlier does not properly create temporary files, which allows local users to overwrite arbitrary files. CVE-2003-0924 ACCEPTED 1 Red Hat Linux 9 XFree86 Jay Beale Matt Busby ACCEPTED Buffer overflow in ReadFontAlias from dirfile.c of XFree86 4.1.0 through 4.3.0 allows local users and remote attackers to execute arbitrary code via a font alias file (font.alias) with a long token, a different vulnerability than CAN-2004-0084 and CAN-2004-0106. CAN-2004-0083 ACCEPTED 1 Red Hat Linux 9 XFree86 Jay Beale Matt Busby ACCEPTED Buffer overflow in the ReadFontAlias function in XFree86 4.1.0 to 4.3.0, when using the CopyISOLatin1Lowered function, allows local or remote authenticated users to execute arbitrary code via a malformed entry in the font alias (font.alias) file, a different vulnerability than CAN-2004-0083 and CAN-2004-0106. CAN-2004-0084 ACCEPTED 1 Red Hat Linux 9 XFree86 Jay Beale Matt Busby ACCEPTED Multiple unknown vulnerabilities in XFree86 4.1.0 to 4.3.0, related to improper handling of font files, a different set of vulnerabilities than CAN-2004-0083 and CAN-2004-0084. CAN-2004-0106 ACCEPTED 1 Red Hat Enterprise Linux 3 netpbm Jay Beale Matt Busby ACCEPTED netpbm 9.25 and earlier does not properly create temporary files, which allows local users to overwrite arbitrary files. CVE-2003-0924 ACCEPTED 1 Red Hat Linux 9 Mutt Jay Beale ACCEPTED Buffer overflow in the index menu code (menu_pad_string of menu.c) for Mutt 1.4.1 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via certain mail messages. CVE-2004-0078 ACCEPTED 1 Red Hat Linux 9 Mailman Jay Beale ACCEPTED Cross-site scripting (XSS) vulnerability in the admin CGI script for Mailman before 2.1.4 allows remote attackers to steal session cookies and conduct unauthorized activities. CAN-2003-0965 ACCEPTED 1 Red Hat Linux 9 Mailman Jay Beale ACCEPTED Cross-site scripting (XSS) vulnerability in the create CGI script for Mailman before 2.1.3 allows remote attackers to steal cookies of other users. CAN-2003-0992 ACCEPTED 1 Red Hat Linux 9 Gaim Jay Beale ACCEPTED Multiple buffer overflows in Gaim 0.75 and earlier, and Ultramagnetic before 0.81, allow remote attackers to cause a denial of service and possibly execute arbitrary code via (1) cookies in a Yahoo web connection, (2) a long name parameter in the Yahoo login web page, (3) a long value parameter in the Yahoo login page, (4) a YMSG packet, (5) the URL parser, and (6) HTTP proxy connect. CAN-2004-0006 ACCEPTED 1 Red Hat Linux 9 Gaim Jay Beale ACCEPTED Buffer overflow in the Extract Info Field Function for (1) MSN and (2) YMSG protocol handlers in Gaim 0.74 and earlier, and Ultramagnetic before 0.81, allows remote attackers to cause a denial of service and possibly execute arbitrary code. CAN-2004-0007 ACCEPTED 1 Red Hat Linux 9 Gaim Jay Beale ACCEPTED Integer overflow in Gaim 0.74 and earlier, and Ultramagnetic before 0.81, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a directIM packet that triggers a heap-based buffer overflow. CAN-2004-0008 ACCEPTED 1 Red Hat Linux 9 slocate Jay Beale Matt Busby ACCEPTED Heap-based buffer overflow in main.c of slocate 2.6, and possibly other versions, may allow local users to gain privileges via a modified slocate database that causes a negative "pathlen" value to be used. CAN-2003-0848 ACCEPTED 1 Red Hat Linux 9 Midnight Commander Jay Beale Matt Busby ACCEPTED Stack-based buffer overflow in vfs_s_resolve_symlink of vfs/direntry.c for Midnight Commander (mc) 4.6.0 and earlier, and possibly later versions, allows remote attackers to execute arbitrary code during symlink conversion. CAN-2003-1023 ACCEPTED 1 Red Hat Linux 9 KDE Jay Beale INTERIM ACCEPTED Konqueror in KDE 3.1.3 and earlier (kdelibs) allows remote attackers to bypass intended cookie access restrictions on a web application via "%2e%2e" (encoded dot dot) directory traversal sequences in a URL, which causes Konqueror to send the cookie outside the specified URL subsets, e.g. to a vulnerable application that runs on the same server as the target application. CAN-2003-0592 ACCEPTED 1 Red Hat Enterprise Linux 3 mremap Jay Beale Matt Busby ACCEPTED The do_mremap function for the mremap system call in Linux 2.2 to 2.2.25, 2.4 to 2.4.24, and 2.6 to 2.6.2, does not properly check the return value from the do_munmap function when the maximum number of VMA descriptors is exceeded, which allows local users to gain root privileges, a different vulnerability than CAN-2003-0985. CVE-2004-0077 ACCEPTED 1 Red Hat Enterprise Linux 3 PWLib Jay Beale Matt Busby ACCEPTED Multiple vulnerabilities in PWLib before 1.6.0 allow remote attackers to cause a denial of service and possibly execute arbitrary code, as demonstrated by the NISCC/OUSPG PROTOS test suite for the H.225 protocol. CAN-2004-0097 ACCEPTED 1 Red Hat Enterprise Linux 3 Samba 3.0.0 and 3.0.1 Jay Beale Matt Busby ACCEPTED The mksmbpasswd shell script (mksmbpasswd.sh) in Samba 3.0.0 and 3.0.1, when creating an account but marking it as disabled, may overwrite the user password with an uninitialized buffer, which could enable the account with a more easily guessable password. CVE-2004-0082 ACCEPTED 1 Red Hat Linux 9 mod_python Jay Beale Matt Busby ACCEPTED Unknown vulnerability in mod_python 3.0.x before 3.0.4, and 2.7.x before 2.7.9, allows remote attackers to cause a denial of service (httpd crash) via a certain query string. CAN-2003-0973 ACCEPTED 1 Red Hat Enterprise Linux 3 XFree86 Jay Beale Matt Busby Matt Busby ACCEPTED Buffer overflow in ReadFontAlias from dirfile.c of XFree86 4.1.0 through 4.3.0 allows local users and remote attackers to execute arbitrary code via a font alias file (font.alias) with a long token, a different vulnerability than CAN-2004-0084 and CAN-2004-0106. CAN-2004-0083 ACCEPTED 1 Red Hat Enterprise Linux 3 XFree86 Jay Beale Matt Busby Matt Busby ACCEPTED Buffer overflow in the ReadFontAlias function in XFree86 4.1.0 to 4.3.0, when using the CopyISOLatin1Lowered function, allows local or remote authenticated users to execute arbitrary code via a malformed entry in the font alias (font.alias) file, a different vulnerability than CAN-2004-0083 and CAN-2004-0106. CAN-2004-0084 ACCEPTED 1 Red Hat Enterprise Linux 3 XFree86 Jay Beale Matt Busby ACCEPTED Multiple unknown vulnerabilities in XFree86 4.1.0 to 4.3.0, related to improper handling of font files, a different set of vulnerabilities than CAN-2004-0083 and CAN-2004-0084. CAN-2004-0106 ACCEPTED 1 Red Hat Enterprise Linux 3 XMLSoft Libxml2 Jay Beale Matt Busby Matt Busby INTERIM ACCEPTED Buffer overflow in the (1) nanohttp or (2) nanoftp modules in XMLSoft Libxml2 2.6.0 through 2.6.5 allow remote attackers to execute arbitrary code via a long URL. CAN-2004-0110 ACCEPTED 1 Red Hat Linux 9 Linux kernel Jay Beale Matt Busby ACCEPTED Unknown vulnerability in Linux kernel before 2.4.22 allows local users to gain privileges, related to "R128 DRI limits checking." CAN-2004-0003 ACCEPTED 1 Red Hat Linux 9 Linux kernel Jay Beale Matt Busby ACCEPTED Stack-based buffer overflow in the ncp_lookup function for ncpfs in Linux kernel 2.4.x allows local users to gain privileges. CAN-2004-0010 ACCEPTED 1 Red Hat Linux 9 Vicam USB driver Jay Beale Matt Busby ACCEPTED The Vicam USB driver in Linux before 2.4.25 does not use the copy_from_user function when copying data from userspace to kernel space, which crosses security boundaries and allows local users to cause a denial of service. CVE-2004-0075 ACCEPTED 1 Red Hat Linux 9 mremap Jay Beale Matt Busby ACCEPTED The do_mremap function for the mremap system call in Linux 2.2 to 2.2.25, 2.4 to 2.4.24, and 2.6 to 2.6.2, does not properly check the return value from the do_munmap function when the maximum number of VMA descriptors is exceeded, which allows local users to gain root privileges, a different vulnerability than CAN-2003-0985. CVE-2004-0077 ACCEPTED 1 Red Hat Enterprise Linux 3 Mutt Jay Beale ACCEPTED Matt Busby Buffer overflow in the index menu code (menu_pad_string of menu.c) for Mutt 1.4.1 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via certain mail messages. CVE-2004-0078 ACCEPTED 1 Red Hat Linux 9 mod_python Jay Beale Matt Busby ACCEPTED Unknown vulnerability in mod_python 3.0.x before 3.0.4, and 2.7.x before 2.7.9, allows remote attackers to cause a denial of service (httpd crash) via a certain query string. CAN-2003-0973 ACCEPTED 1 Red Hat Enterprise Linux 3 gdk-pixbuf Jay Beale INTERIM Matt Busby ACCEPTED gdk-pixbuf before 0.20 allows attackers to cause a denial of service (crash) via a malformed bitmap (BMP) file. CVE-2004-0111 ACCEPTED 1 Red Hat Linux 9 gdk-pixbuf Jay Beale INTERIM Matt Busby ACCEPTED gdk-pixbuf before 0.20 allows attackers to cause a denial of service (crash) via a malformed bitmap (BMP) file. CVE-2004-0111 ACCEPTED 1 Red Hat Linux 9 tcpdump Jay Beale ACCEPTED tcpdump before 3.8.1 allows remote attackers to cause a denial of service (infinite loop) via certain ISAKMP packets, a different vulnerability than CAN-2004-0057. CAN-2003-0989 ACCEPTED 1 Red Hat Linux 9 sysstat Jay Beale Matt Busby INTERIM ACCEPTED The (1) post and (2) trigger scripts in sysstat 4.0.7 and earlier allow local users to overwrite arbitrary files via symlink attacks on temporary files, a different vulnerability than CAN-2004-0108. CAN-2004-0107 ACCEPTED 1 Red Hat Linux 9 tcpdump Jay Beale ACCEPTED The print_attr_string function in print-radius.c for tcpdump 3.8.1 and earlier allows remote attackers to cause a denial of service (segmentation fault) via a RADIUS attribute with a large length value. CAN-2004-0055 ACCEPTED 1 Red Hat Linux 9 tcpdump Jay Beale ACCEPTED The rawprint function in the ISAKMP decoding routines (print-isakmp.c) for tcpdump 3.8.1 and earlier allows remote attackers to cause a denial of service (segmentation fault) via malformed ISAKMP packets that cause invalid "len" or "loc" values to be used in a loop, a different vulnerability than CAN-2003-0989. CAN-2004-0057 ACCEPTED 1 Red Hat Enterprise Linux 3 tcpdump Jay Beale ACCEPTED tcpdump before 3.8.1 allows remote attackers to cause a denial of service (infinite loop) via certain ISAKMP packets, a different vulnerability than CAN-2004-0057. CAN-2003-0989 ACCEPTED 1 Red Hat Enterprise Linux 3 tcpdump Jay Beale ACCEPTED The print_attr_string function in print-radius.c for tcpdump 3.8.1 and earlier allows remote attackers to cause a denial of service (segmentation fault) via a RADIUS attribute with a large length value. CAN-2004-0055 ACCEPTED 1 Red Hat Enterprise Linux 3 tcpdump Jay Beale ACCEPTED Matt Busby The rawprint function in the ISAKMP decoding routines (print-isakmp.c) for tcpdump 3.8.1 and earlier allows remote attackers to cause a denial of service (segmentation fault) via malformed ISAKMP packets that cause invalid "len" or "loc" values to be used in a loop, a different vulnerability than CAN-2003-0989. CAN-2004-0057 ACCEPTED 1 Red Hat Linux 9 CVS server Jay Beale Matt Busby ACCEPTED CVS server before 1.11.10 may allow attackers to cause the CVS server to create directories and files in the file system root directory via malformed module requests. CAN-2003-0977 ACCEPTED 1 Red Hat Linux 9 Ethereal Jay Beale Matt Busby ACCEPTED The SMB dissector in Ethereal before 0.10.0 allows remote attackers to cause a denial of service via a malformed SMB packet that triggers a segmentation fault during processing of Selected packets. CAN-2003-1012 ACCEPTED 1 Red Hat Linux 9 Tethereal Jay Beale Matt Busby ACCEPTED The Q.931 dissector in Ethereal before 0.10.0, and Tethereal, allows remote attackers to cause a denial of service (crash) via a malformed Q.931, which triggers a null dereference. CAN-2003-1013 ACCEPTED 1 Red Hat Linux 9 KDE Personal Information Management (kdepim) Jay Beale ACCEPTED Buffer overflow in the VCF file information reader for KDE Personal Information Management (kdepim) suite in KDE 3.1.0 through 3.1.4 allows attackers to execute arbitrary code via a VCF file. CVE-2003-0988 ACCEPTED 1 Red Hat Linux 9 Linux kernel Jay Beale Matt Busby ACCEPTED Real time clock (RTC) routines in Linux kernel 2.4.23 and earlier do not properly initialize their structures, which could leak kernel data to user space. CAN-2003-0984 ACCEPTED 1 Red Hat Linux 9 Linux kernel Jay Beale Matt Busby ACCEPTED The mremap system call (do_mremap) in Linux kernel 2.4.x before 2.4.21 does not properly perform bounds checks, which allows local users to cause a denial of service and possibly gain privileges by causing a remapping of a virtual memory area (VMA) to create a zero length VMA, a different vulnerability than CAN-2004-0077. CVE-2003-0985 ACCEPTED 1 Red Hat Enterprise Linux 3 nfs-utils packages Jay Beale Matt Busby Matt Busby INTERIM ACCEPTED rpc.mountd in nfs-utils after 1.0.3 and before 1.0.6 allows attackers to cause a denial of service (crash) via an NFS mount of a directory from a client whose reverse DNS lookup name is different from the forward lookup name. CAN-2004-0154 ACCEPTED 1 Red Hat Enterprise Linux 3 Sysstat Jay Beale Matt Busby Matt Busby INTERIM ACCEPTED The (1) post and (2) trigger scripts in sysstat 4.0.7 and earlier allow local users to overwrite arbitrary files via symlink attacks on temporary files, a different vulnerability than CAN-2004-0108. CAN-2004-0107 ACCEPTED 1 Red Hat Linux 9 httpd Jay Beale Matt Busby INTERIM ACCEPTED Multiple stack-based buffer overflows in (1) mod_alias and (2) mod_rewrite for Apache before 1.3.29 allow attackers to create configuration files to cause a denial of service (crash) or execute arbitrary code via a regular expression with more than 9 captures. CAN-2003-0542 ACCEPTED 1 Red Hat Enterprise Linux 3 Apache Jay Beale Matt Busby INTERIM ACCEPTED Multiple stack-based buffer overflows in (1) mod_alias and (2) mod_rewrite for Apache before 1.3.29 allow attackers to create configuration files to cause a denial of service (crash) or execute arbitrary code via a regular expression with more than 9 captures. CAN-2003-0542 ACCEPTED 1 Red Hat Enterprise Linux 3 KDE Personal Information Management (kdepim) Jay Beale INTERIM Matt Busby ACCEPTED Buffer overflow in the VCF file information reader for KDE Personal Information Management (kdepim) suite in KDE 3.1.0 through 3.1.4 allows attackers to execute arbitrary code via a VCF file. CVE-2003-0988 ACCEPTED 1 Red Hat Enterprise Linux 3 CVS server Jay Beale Matt Busby INTERIM ACCEPTED CVS server before 1.11.10 may allow attackers to cause the CVS server to create directories and files in the file system root directory via malformed module requests. CAN-2003-0977 ACCEPTED 1 Red Hat Enterprise Linux 3 Linux kernel Matt Busby Matt Busby INTERIM ACCEPTED The mremap system call (do_mremap) in Linux kernel 2.4.x before 2.4.21 does not properly perform bounds checks, which allows local users to cause a denial of service and possibly gain privileges by causing a remapping of a virtual memory area (VMA) to create a zero length VMA, a different vulnerability than CAN-2004-0077. CVE-2003-0985 ACCEPTED 1 Red Hat Enterprise Linux 3 Linux kernel Matt Busby Matt Busby INTERIM ACCEPTED Unknown vulnerability in the eflags checking in the 32-bit ptrace emulation for the Linux kernel on AMD64 systems allows local users to gain privileges. CVE-2004-0001 ACCEPTED 1 Red Hat Enterprise Linux 3 Net-SNMP Matt Busby Matt Busby INTERIM ACCEPTED Net-SNMP before 5.0.9 allows a user or community to access data in MIB objects, even if that data is not allowed to be viewed. CAN-2003-0935 ACCEPTED 1 Red Hat Enterprise Linux 3 OpenSSL Matt Busby Matt Busby Matt Busby INTERIM ACCEPTED The do_change_cipher_spec function in OpenSSL 0.9.6c to 0.9.6k, and 0.9.7a to 0.9.7c, allows remote attackers to cause a denial of service (crash) via a crafted SSL/TLS handshake that triggers a null dereference. CAN-2004-0079 ACCEPTED 1 Red Hat Enterprise Linux 3 OpenSSL Matt Busby Matt Busby Matt Busby INTERIM ACCEPTED OpenSSL 0.9.6 before 0.9.6d does not properly handle unknown message types, which allows remote attackers to cause a denial of service (infinite loop), as demonstrated using the Codenomicon TLS Test Tool. CAN-2004-0081 ACCEPTED 1 Red Hat Linux 9 mozilla Jay Beale INTERIM ACCEPTED Multiple vulnerabilities in multiple vendor implementations of the Secure/Multipurpose Internet Mail Extensions (S/MIME) protocol allow remote attackers to cause a denial of service and possibly execute arbitrary code via an S/MIME email message containing certain unexpected ASN.1 constructs, as demonstrated using the NISSC test suite. CAN-2003-0564 ACCEPTED 1 Red Hat Linux 9 mozilla Jay Beale INTERIM ACCEPTED Mozilla allows remote attackers to bypass intended cookie access restrictions on a web application via "%2e%2e" (encoded dot dot) directory traversal sequences in a URL, which causes Mozilla to send the cookie outside the specified URL subsets, e.g. to a vulnerable application that runs on the same server as the target application. CAN-2003-0594 ACCEPTED 1 Red Hat Linux 9 mozilla Jay Beale INTERIM ACCEPTED Mozilla before 1.4.2 executes Javascript events in the context of a new page while it is being loaded, allowing it to interact with the previous page (zombie document) and enable cross-domain and cross-site scripting (XSS) attacks, as demonstrated using onmousemove events. CVE-2004-0191 ACCEPTED 1 Red Hat Enterprise Linux 3 libxml2 Jay Beale Jay Beale INTERIM ACCEPTED Buffer overflow in the (1) nanohttp or (2) nanoftp modules in XMLSoft Libxml2 2.6.0 through 2.6.5 allow remote attackers to execute arbitrary code via a long URL. CAN-2004-0110 ACCEPTED 1 Red Hat Enterprise Linux 3 httpd Jay Beale Jay Beale INTERIM ACCEPTED Memory leak in ssl_engine_io.c for mod_ssl in Apache 2 before 2.0.49 allows remote attackers to cause a denial of service (memory consumption) via plain HTTP requests to the SSL port of an SSL-enabled server. CVE-2004-0113 ACCEPTED 1 Red Hat Linux 9 Red Hat 9 Jay Beale INTERIM ACCEPTED The "%xx" URL decoding function in Squid 2.5STABLE4 and earlier allows remote attackers to bypass url_regex ACLs via a URL with a NULL ("%00") characterm, which causes Squid to use only a portion of the requested URL when comparing it against the access control lists. CVE-2004-0189 ACCEPTED 1 Red Hat Linux 9 Red Hat 9 Jay Beale Jay Beale INTERIM ACCEPTED Multiple buffer overflows in Ethereal 0.8.13 to 0.10.2 allow remote attackers to cause a denial of service and possibly execute arbitrary code via the (1) NetFlow, (2) IGAP, (3) EIGRP, (4) PGM, (5) IrDA, (6) BGP, (7) ISUP, or (8) TCAP dissectors. CAN-2004-0176 ACCEPTED 1 Red Hat Linux 9 Red Hat 9 Jay Beale Jay Beale INTERIM ACCEPTED The dissect_attribute_value_pairs function in packet-radius.c for Ethereal 0.8.13 to 0.10.2 allows remote attackers to cause a denial of service (crash) via a malformed RADIUS packet that triggers a null dereference. CAN-2004-0365 ACCEPTED 1 Red Hat Linux 9 Red Hat 9 Jay Beale Jay Beale INTERIM ACCEPTED Ethereal 0.10.1 to 0.10.2 allows remote attackers to cause a denial of service (crash) via a zero-length Presentation protocol selector. CAN-2004-0367 ACCEPTED 1 Red Hat Enterprise Linux 3 Red Hat Enteprise Linux 3 Jay Beale Jay Beale Jay Beale INTERIM ACCEPTED Multiple buffer overflows in Ethereal 0.8.13 to 0.10.2 allow remote attackers to cause a denial of service and possibly execute arbitrary code via the (1) NetFlow, (2) IGAP, (3) EIGRP, (4) PGM, (5) IrDA, (6) BGP, (7) ISUP, or (8) TCAP dissectors. CAN-2004-0176 ACCEPTED 1 Red Hat Enterprise Linux 3 Red Hat Enteprise Linux 3 Jay Beale Jay Beale Jay Beale INTERIM ACCEPTED The dissect_attribute_value_pairs function in packet-radius.c for Ethereal 0.8.13 to 0.10.2 allows remote attackers to cause a denial of service (crash) via a malformed RADIUS packet that triggers a null dereference. CAN-2004-0365 ACCEPTED 1 Red Hat Linux 9 OpenSSL Matt Busby Matt Busby INTERIM ACCEPTED OpenSSL 0.9.6 before 0.9.6d does not properly handle unknown message types, which allows remote attackers to cause a denial of service (infinite loop), as demonstrated using the Codenomicon TLS Test Tool. CAN-2004-0081 ACCEPTED 1 Red Hat Enterprise Linux 3 Red Hat Enteprise Linux 3 Jay Beale Jay Beale Jay Beale INTERIM ACCEPTED Ethereal 0.10.1 to 0.10.2 allows remote attackers to cause a denial of service (crash) via a zero-length Presentation protocol selector. CAN-2004-0367 ACCEPTED 1 Red Hat Enterprise Linux 3 Red Hat Enteprise Linux 3 Jay Beale INTERIM Jay Beale ACCEPTED Multiple vulnerabilities in multiple vendor implementations of the Secure/Multipurpose Internet Mail Extensions (S/MIME) protocol allow remote attackers to cause a denial of service and possibly execute arbitrary code via an S/MIME email message containing certain unexpected ASN.1 constructs, as demonstrated using the NISSC test suite. CAN-2003-0564 ACCEPTED 1 Red Hat Enterprise Linux 3 Red Hat Enteprise Linux 3 Jay Beale INTERIM Jay Beale ACCEPTED Mozilla allows remote attackers to bypass intended cookie access restrictions on a web application via "%2e%2e" (encoded dot dot) directory traversal sequences in a URL, which causes Mozilla to send the cookie outside the specified URL subsets, e.g. to a vulnerable application that runs on the same server as the target application. CAN-2003-0594 ACCEPTED 1 Red Hat Enterprise Linux 3 OpenSSL Matt Busby Matt Busby INTERIM ACCEPTED The SSL/TLS handshaking code in OpenSSL 0.9.7a, 0.9.7b, and 0.9.7c, when using Kerberos ciphersuites, does not properly check the length of Kerberos tickets during a handshake, which allows remote attackers to cause a denial of service (crash) via a crafted SSL/TLS handshake that causes an out-of-bounds read. CAN-2004-0112 ACCEPTED 1 Red Hat Enterprise Linux 3 Red Hat Enteprise Linux 3 Jay Beale INTERIM Jay Beale ACCEPTED Mozilla before 1.4.2 executes Javascript events in the context of a new page while it is being loaded, allowing it to interact with the previous page (zombie document) and enable cross-domain and cross-site scripting (XSS) attacks, as demonstrated using onmousemove events. CVE-2004-0191 ACCEPTED 1 Red Hat Enterprise Linux 3 Red Hat Enteprise Linux 3 Jay Beale INTERIM ACCEPTED Integer overflow in the ip_setsockopt function in Linux kernel 2.4.22 through 2.4.25 and 2.6.1 through 2.6.3 allows local users to cause a denial of service (crash) or executee arbitrary code via the MCAST_MSFILTER socket option. CAN-2004-0424 ACCEPTED 1 Red Hat Enterprise Linux 3 Red Hat Enteprise Linux 3 Jay Beale INTERIM ACCEPTED Buffer overflow in the ISO9660 file system component for Linux kernel 2.4.x, 2.5.x and 2.6.x , allows local users with physical access to overflow kernel memory and execute arbitrary code via a malformed CD containing a long symbolic link entry. CAN-2004-0109 ACCEPTED 1 Red Hat Enterprise Linux 3 Red Hat Enteprise Linux 3 Jay Beale INTERIM ACCEPTED The "%xx" URL decoding function in Squid 2.5STABLE4 and earlier allows remote attackers to bypass url_regex ACLs via a URL with a NULL ("%00") characterm, which causes Squid to use only a portion of the requested URL when comparing it against the access control lists. CVE-2004-0189 ACCEPTED 1 Red Hat Enterprise Linux 3 Red Hat Enteprise Linux 3 Jay Beale INTERIM ACCEPTED The KAME IKE Daemon Racoon, when authenticating a peer during Phase 1, validates the X.509 certificate but does not verify the RSA signature authentication, which allows remote attackers to establish unauthorized IP connections or conduct man-in-the-middle attacks using a valid, trusted X.509 certificate. CAN-2004-0155 ACCEPTED 1 Red Hat Enterprise Linux 3 Red Hat Enteprise Linux 3 Jay Beale INTERIM ACCEPTED KAME IKE daemon (racoon) does not properly handle hash values, which allows remote attackers to delete certificates via (1) a certain delete message that is not properly handled in isakmp.c or isakmp_inf.c, or (2) a certain INITIAL-CONTACT message that is not properly handled in isakmp_inf.c. CAN-2004-0164 ACCEPTED 1 Red Hat Enterprise Linux 3 Red Hat Enteprise Linux 3 Jay Beale INTERIM ACCEPTED The URI handlers in Konqueror for KDE 3.2.2 and earlier do not properly filter "-" characters that begin a hostname in a (1) telnet, (2) rlogin, (3) ssh, or (4) mailto URI, which allows remote attackers to manipulate the options that are passed to the associated programs, possibly to read arbitrary files or execute arbitrary code. CAN-2004-0411 ACCEPTED 1 Red Hat Enterprise Linux 3 ImageMagick Jay Beale DRAFT The XWD Decoder in ImageMagick before 6.2.2.3, and GraphicsMagick before 1.1.6-r1, allows remote attackers to cause a denial of service (infinite loop) via an image with a zero color mask. CAN-2005-1739 DRAFT 0 Red Hat Enterprise Linux 3 Red Hat Enteprise Linux 3 Jay Beale INTERIM ACCEPTED rsync before 2.6.1 does not properly sanitize paths when running a read/write daemon without using chroot, which allows remote attackers to write files outside of the module's path. CAN-2004-0426 ACCEPTED 1 Red Hat Enterprise Linux 3 Red Hat Enteprise Linux 3 Jay Beale INTERIM ACCEPTED Heap-based buffer overflow in CVS 1.11.x up to 1.11.15, and 1.12.x up to 1.12.7, when using the pserver mechanism allows remote attackers to execute arbitrary code via Entry lines. CAN-2004-0396 ACCEPTED 1 Red Hat Enterprise Linux 3 Red Hat Enteprise Linux 3 Jay Beale INTERIM ACCEPTED The Portable Network Graphics library (libpng) 1.0.15 and earlier allows attackers to cause a denial of service (crash) via a malformed PNG image file that triggers an error that causes an out-of-bounds read when creating the error message. CAN-2004-0421 ACCEPTED 1 Red Hat Enterprise Linux 3 Red Hat Enteprise Linux 3 Jay Beale INTERIM ACCEPTED TCPDUMP 3.8.1 and earlier allows remote attackers to cause a denial of service (crash) via ISAKMP packets containing a Delete payload with a large number of SPI's, which causes an out-of-bounds read, as demonstrated by the Striker ISAKMP Protocol Test Suite. CAN-2004-0183 ACCEPTED 1 Red Hat Linux 9 OpenSSL Matt Busby Matt Busby INTERIM ACCEPTED The do_change_cipher_spec function in OpenSSL 0.9.6c to 0.9.6k, and 0.9.7a to 0.9.7c, allows remote attackers to cause a denial of service (crash) via a crafted SSL/TLS handshake that triggers a null dereference. CAN-2004-0079 ACCEPTED 1 Red Hat Enterprise Linux 3 Red Hat Enteprise Linux 3 Jay Beale INTERIM ACCEPTED Integer underflow in the isakmp_id_print for TCPDUMP 3.8.1 and earlier allows remote attackers to cause a denial of service (crash) via an ISAKMP packet with an Identification payload with a length that becomes less than 8 during byte order conversion, which causes an out-of-bounds read, as demonstrated by the Striker ISAKMP Protocol Test Suite. CAN-2004-0184 ACCEPTED 1 Red Hat Enterprise Linux 3 Red Hat Enteprise Linux 3 Jay Beale INTERIM ACCEPTED Multiple stack-based buffer overflows in the get_header function in header.c for LHA 1.14 allow remote attackers or local users to execute arbitrary code via long directory or file names in an LHA archive, which triggers the overflow when testing or extracting the archive. CAN-2004-0234 ACCEPTED 1 Red Hat Enterprise Linux 3 Red Hat Enteprise Linux 3 Jay Beale INTERIM ACCEPTED Multiple directory traversal vulnerabilities in LHA 1.14 allow remote attackers or local users to create arbitrary files via an LHA archive containing filenames with (1) .. sequences or (2) absolute pathnames with double leading slashes ("//absolute/path"). CAN-2004-0235 ACCEPTED 1 Red Hat Enterprise Linux 3 Red Hat Enteprise Linux 3 Jay Beale INTERIM ACCEPTED Utempter allows device names that contain .. (dot dot) directory traversal sequences, which allows local users to overwrite arbitrary files via a symlink attack on device names in combination with an application that trusts the utmp or wtmp files. CAN-2004-0233 ACCEPTED 1 Red Hat Enterprise Linux 3 Red Hat Enteprise Linux 3 Jay Beale INTERIM ACCEPTED Buffer overflow in the ntlm_check_auth (NTLM authentication) function for Squid Web Proxy Cache 2.5.x and 3.x, when compiled with NTLM handlers enabled, allows remote attackers to execute arbitrary code via a long password ("pass" variable). CAN-2004-0541 ACCEPTED 1 Red Hat Enterprise Linux 3 Red Hat Enteprise Linux 3 Jay Beale INTERIM ACCEPTED Ethereal 0.10.3 allows remote attackers to cause a denial of service (crash) via certain SIP messages between Hotsip servers and clients. CAN-2004-0504 ACCEPTED 1 Red Hat Enterprise Linux 3 Red Hat Enteprise Linux 3 Jay Beale INTERIM ACCEPTED Racoon before 20040408a allows remote attackers to cause a denial of service (memory consumption) via an ISAKMP packet with a large length field. CAN-2004-0403 ACCEPTED 1 Red Hat Enterprise Linux 3 Red Hat Enteprise Linux 3 Jay Beale INTERIM ACCEPTED The AIM dissector in Ethereal 0.10.3 allows remote attackers to cause a denial of service (assert error) via unknown attack vectors. CAN-2004-0505 ACCEPTED 1 Red Hat Enterprise Linux 3 Red Hat Enteprise Linux 3 Jay Beale INTERIM ACCEPTED The SPNEGO dissector in Ethereal 0.9.8 to 0.10.3 allows remote attackers to cause a denial of service (crash) via unknown attack vectors that cause a null pointer dereference. CAN-2004-0506 ACCEPTED 1 Red Hat Enterprise Linux 3 Red Hat Enteprise Linux 3 Jay Beale INTERIM ACCEPTED Buffer overflow in the MMSE dissector for Ethereal 0.10.1 to 0.10.3 allows remote attackers to cause a denial of service and possibly execute arbitrary code. CAN-2004-0507 ACCEPTED 1 Red Hat Enterprise Linux 3 MIT Kerberos 5 (krb5) Jay Beale INTERIM ACCEPTED Multiple buffer overflows in krb5_aname_to_localname for MIT Kerberos 5 (krb5) 1.3.3 and earlier allow remote attackers to execute arbitrary code as root. CAN-2004-0523 ACCEPTED 1 Red Hat Enterprise Linux 3 CVS Jay Beale INTERIM ACCEPTED CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16, does not properly handle malformed "Entry" lines, which prevents a NULL terminator from being used and may lead to a denial of service (crash), modification of critical program data, or arbitrary code execution. CAN-2004-0414 ACCEPTED 1 Red Hat Enterprise Linux 3 CVS Jay Beale INTERIM ACCEPTED Double-free vulnerability for the error_prog_name string in CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16, may allow remote attackers to execute arbitrary code. CAN-2004-0416 ACCEPTED 1 Red Hat Enterprise Linux 3 Red Hat Enteprise Linux 3 Jay Beale INTERIM INTERIM ACCEPTED /proc/tty/driver/serial in Linux 2.4.x reveals the exact number of characters used in serial links, which could allow local users to obtain potentially sensitive information such as the length of passwords. CAN-2003-0461 ACCEPTED 1 Red Hat Enterprise Linux 3 CVS Jay Beale INTERIM ACCEPTED Integer overflow in the "Max-dotdot" CVS protocol command (serve_max_dotdot) for CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16, may allow remote attackers to cause a server crash, which could cause temporary data to remain undeleted and consume disk space. CAN-2004-0417 ACCEPTED 1 Red Hat Enterprise Linux 3 CVS Jay Beale INTERIM ACCEPTED serve_notify in CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16, does not properly handle empty data lines, which may allow remote attackers to perform an "out-of-bounds" write for a single byte to execute arbitrary code or modify critical program data. CAN-2004-0418 ACCEPTED 1 Red Hat Enterprise Linux 3 SquirrelMail Jay Beale INTERIM ACCEPTED Multiple cross-site scripting (XSS) vulnerabilities in SquirrelMail 1.4.2 allow remote attackers to execute arbitrary script as other users and possibly steal authentication information via multiple attack vectors, including the mailbox parameter in compose.php. CAN-2004-0519 ACCEPTED 0 Red Hat Enterprise Linux 3 SquirrelMail Jay Beale INTERIM ACCEPTED Cross-site scripting (XSS) vulnerability in mime.php for SquirrelMail before 1.4.3 allows remote attackers to insert arbitrary HTML and script via the content-type mail header, as demonstrated using read_body.php. CAN-2004-0520 ACCEPTED 0 Red Hat Enterprise Linux 3 Red Hat Enteprise Linux 3 Jay Beale INTERIM ACCEPTED Real time clock (RTC) routines in Linux kernel 2.4.23 and earlier do not properly initialize their structures, which could leak kernel data to user space. CAN-2003-0984 ACCEPTED 2 Red Hat Enterprise Linux 3 Red Hat Enteprise Linux 3 Jay Beale INTERIM ACCEPTED Unknown vulnerability in Linux kernel before 2.4.22 allows local users to gain privileges, related to "R128 DRI limits checking." CAN-2004-0003 ACCEPTED 1 Red Hat Enterprise Linux 3 SquirrelMail Jay Beale INTERIM ACCEPTED SQL injection vulnerability in SquirrelMail before 1.4.3 RC1 allows remote attackers to execute unauthorized SQL statements, with unknown impact, probably via abook_database.php. CAN-2004-0521 ACCEPTED 0 Red Hat Enterprise Linux 3 Red Hat Enteprise Linux 3 Jay Beale INTERIM ACCEPTED Stack-based buffer overflow in the ncp_lookup function for ncpfs in Linux kernel 2.4.x allows local users to gain privileges. CAN-2004-0010 ACCEPTED 2 Red Hat Enterprise Linux 3 Red Hat Enteprise Linux 3 Jay Beale INTERIM ACCEPTED The client for CVS before 1.11 allows a remote malicious CVS server to create arbitrary files using certain RCS diff files that use absolute pathnames during checkouts or updates, a different vulnerability than CAN-2004-0405. CAN-2004-0180 ACCEPTED 1 Red Hat Linux 9 OpenSSL Matt Busby Matt Busby INTERIM ACCEPTED The SSL/TLS handshaking code in OpenSSL 0.9.7a, 0.9.7b, and 0.9.7c, when using Kerberos ciphersuites, does not properly check the length of Kerberos tickets during a handshake, which allows remote attackers to cause a denial of service (crash) via a crafted SSL/TLS handshake that causes an out-of-bounds read. CAN-2004-0112 ACCEPTED 1 Red Hat Enterprise Linux 3 Red Hat Enteprise Linux 3 Jay Beale INTERIM ACCEPTED CVS before 1.11 allows CVS clients to read arbitrary files via .. (dot dot) sequences in filenames via CVS client requests, a different vulnerability than CAN-2004-0180. CAN-2004-0405 ACCEPTED 1 Red Hat Enterprise Linux 3 Red Hat Enteprise Linux 3 Jay Beale INTERIM ACCEPTED Multiple format string vulnerabilities in (1) neon 0.24.4 and earlier, and other producs that use neon including (2) Cadaver, (3) Subversion, or (4) OpenOffice, allow remote malicious WebDAV servers to execute arbitrary code. CAN-2004-0179 ACCEPTED 1 Red Hat Enterprise Linux 3 zgrep Jay Beale DRAFT zgrep in gzip before 1.3.5 does not properly sanitize arguments, which allows local users to execute arbitrary commands via filenames that are injected into a sed script. CAN-2005-0758 DRAFT 0 Red Hat Enterprise Linux 3 postgresql Jay Beale DRAFT INTERIM The tsearch2 module in PostgreSQL 7.4 through 8.0.x declares the (1) dex_init, (2) snb_en_init, (3) snb_ru_init, (4) spell_init, and (5) syn_init functions as "internal" even when they do not take an internal argument, which allows attackers to cause a denial of service (application crash) and possibly have other impacts via SQL commands that call other functions that accept internal arguments. CAN-2005-1410 INTERIM 0 Red Hat Enterprise Linux 3 gzip Jay Beale DRAFT INTERIM zgrep in gzip before 1.3.5 does not properly sanitize arguments, which allows local users to execute arbitrary commands via filenames that are injected into a sed script. CAN-2005-0758 INTERIM 0 Red Hat Enterprise Linux 3 Linux kernel Jay Beale DRAFT INTERIM The linux-2.4.21-mlock.patch in Red Hat Enterprise Linux 3 does not properly maintain the mlock page count when one process unlocks pages that belong to another process, which allows local users to mlock more memory than specified by the rlimit. CAN-2004-0491 INTERIM 0 Red Hat Enterprise Linux 3 Linux kernel Jay Beale DRAFT INTERIM The elf_core_dump function in binfmt_elf.c for Linux kernel 2.x.x to 2.2.27-rc2, 2.4.x to 2.4.31-pre1, and 2.6.x to 2.6.12-rc4 allows local users to execute arbitrary code via an ELF binary that, in certain conditions involving the create_elf_tables function, causes a negative length argument to pass a signed integer comparison, leading to a buffer overflow. CAN-2005-1263 INTERIM 0 Red Hat Enterprise Linux 3 telnet Jay Beale DRAFT Certain BSD-based Telnet clients, including those used on Solaris and SuSE Linux, allow remote malicious Telner servers to read sensitive environment variables via the NEW-ENVIRON option with a SEND ENV_USERVAR command. CAN-2005-0488 DRAFT 0 Red Hat Enterprise Linux 3 bzip2 Jay Beale DRAFT Race condition in bzip2 1.0.2 and earlier allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompressed, whose permissions are changed by bzip2 after the decompression is complete. CAN-2005-0953 DRAFT 0 Red Hat Enterprise Linux 3 gzip Jay Beale DRAFT INTERIM Race condition in gzip 1.2.4, 1.3.3, and earlier when decompressing a gzip allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompressed, whose permissions are changed by gzip after the decompression is complete. CAN-2005-0988 INTERIM 0 Red Hat Enterprise Linux 3 libxml2 Jay Beale DRAFT INTERIM Multiple buffer overflows in libXML 2.6.12 and 2.6.13 (libxml2), and possibly other versions, may allow remote attackers to execute arbitrary code via (1) a long FTP URL that is not properly handled by the xmlNanoFTPScanURL function, (2) a long proxy URL containing FTP data that is not properly handled by the xmlNanoFTPScanProxy function, and other overflows related to manipulation of DNS length values, including (3) xmlNanoFTPConnect, (4) xmlNanoHTTPConnectHost, and (5) xmlNanoHTTPConnectHost. CAN-2004-0989 INTERIM 0 Red Hat Enterprise Linux 3 libgd Jay Beale DRAFT INTERIM Multiple buffer overflows in the gd graphics library (libgd) 2.0.21 and earlier may allow remote attackers to execute arbitrary code via malformed image files that trigger the overflows due to improper calls to the gdMalloc function, a different set of vulnerabilities than CAN-2004-0990. CAN-2004-0941 INTERIM 0 Red Hat Enterprise Linux 3 Linux kernel Jay Beale DRAFT INTERIM The shmctl function in Linux 2.6.9 and earlier allows local users to unlock the memory of other processes, which could cause sensitive memory to be swapped to disk, which could allow it to be read by other users once it has been released. CAN-2005-0176 INTERIM 0 Red Hat Enterprise Linux 3 sudo Jay Beale DRAFT Race condition in sudo 1.3.1 up to 1.6.8p8, when the ALL pseudo-command is used after a user entry in the sudoers file, allows local users to gain privileges via a symlink attack. CAN-2005-1993 DRAFT 0 It appears that we can't parse the vulnerable configuration condition (an ALL in the second field of a line after a line that has no ALL in the second field) with our existing regexp. Red Hat Enterprise Linux 3 gedit Jay Beale DRAFT Format string vulnerability in gedit 2.10.2 may allow attackers to cause a denial of service (application crash) via a bin file with format string specifiers in the filename. NOTE: while this issue is triggered on the command line by the gedit user, it has been reported that web browsers and email clients could be configured to provide a file name as an argument to gedit, so there is a valid attack that crosses security boundaries. CAN-2005-1686 DRAFT 0 Red Hat Enterprise Linux 3 libgd Jay Beale DRAFT INTERIM Integer overflow in GD Graphics Library libgd 2.0.28 (libgd2), and possibly other versions, allows remote attackers to cause a denial of service and possibly execute arbitrary code via PNG image files with large image rows values that lead to a heap-based buffer overflow in the gdImageCreateFromPngCtx function, a different set of vulnerabilities than CAN-2004-0941. CAN-2004-0990 INTERIM 0 Red Hat Enterprise Linux 3 FreeRADIUS Jay Beale DRAFT INTERIM ACCEPTED FreeRADIUS before 1.0.1 allows remote attackers to cause a denial of service (server crash) by sending an Ascend-Send-Secret attribute without the required leading packet CAN-2004-0938 ACCEPTED 1 Red Hat Enterprise Linux 3 Linux kernel Jay Beale DRAFT INTERIM ACCEPTED The do_fork function in Linux 2.4.x before 2.4.26, and 2.6.x before 2.6.6, does not properly decrement the mm_count counter when an error occurs after the mm_struct for a child process has been activated, which triggers a memory leak that allows local users to cause a denial of service (memory exhaustion) via the clone (CLONE_VM) system call. CAN-2004-0427 ACCEPTED 1 Red Hat Enterprise Linux 3 Linux kernel Jay Beale DRAFT INTERIM ACCEPTED Linux kernel 2.4.2x and 2.6.x for x86 allows local users to cause a denial of service (system crash), possibly via an infinite loop that triggers a signal handler with a certain sequence of fsave and frstor instructions, as originally demonstrated using a "crash.c" program. CAN-2004-0554 ACCEPTED 1 Red Hat Enterprise Linux 3 Linux kernel Jay Beale DRAFT INTERIM ACCEPTED Multiple unknown vulnerabilities in Linux kernel 2.4 and 2.6 allow local users to gain privileges or access kernel memory, as found by the Sparse source code checking tool. CAN-2004-0495 ACCEPTED 1 Red Hat Enterprise Linux 3 libpng Jay Beale DRAFT INTERIM ACCEPTED Portable Network Graphics (PNG) library libpng 1.2.5 and earlier does not correctly calculate offsets, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a buffer overflow attack on the row buffers. CVE-2002-1363 ACCEPTED 1 \bpostmaster\b ^.*rhnsd.*$ /tmp 1 /usr/bin/bzgrep 1 1 1 /bin/mount 1 /bin/mount 1 /usr/bin/telnet 1 /usr/bin/telnet 1 /usr/bin/telnet 1 /usr/kerberos/bin/telnet 1 /usr/kerberos/bin/telnet 1 /usr/kerberos/bin/telnet 1 /usr/bin/rlogin 1 /usr/bin/rlogin 1 /usr/bin/rlogin 1 /usr/kerberos/bin/rlogin 1 /usr/kerberos/bin/rlogin 1 /usr/kerberos/bin/rlogin 1 /usr/bin/ssh 1 /usr/bin/ssh 1 /usr/bin/ssh 1 /usr/bin/kmail 1 /usr/bin/kmail 1 /usr/bin/kmail 1 /usr/bin/cvs 1 /usr/bin/cvs 1 /usr/bin/cvs 1 /proc/tty/driver/serial 1 /proc/tty/driver/ 1 /proc/tty/ 1 /proc/ 1 /usr/bin/oocalc 1 /usr/bin/oocalc 1 /usr/bin/oocalc 1 /usr/bin/oodraw 1 /usr/bin/oodraw 1 /usr/bin/oodraw 1 /usr/bin/oofice 1 /usr/bin/oofice 1 /usr/bin/oofice 1 /usr/bin/ooimpress 1 /usr/bin/ooimpress 1 /usr/bin/ooimpress 1 /usr/bin/oowriter 1 /usr/bin/oowriter 1 /usr/bin/oowriter 1 /usr/sbin/tcpdump 1 /usr/sbin/tcpdump 1 /usr/sbin/tcpdump 1 /usr/bin/lha 1 /usr/bin/lha 1 /usr/bin/lha 1 /usr/sbin/utempter 1 /usr/sbin/utempter 1 /usr/sbin/utempter 1 /usr/sbin/utempter 1 /usr/bin/bzip2 1 1 1 /usr/bin/gaim 1 1 1 /usr/bin/telnet 1 1 1 For "/tmp is readable by non-root users," use a compound test. /tmp 1 /usr/bin/gedit 1 1 1 /usr/bin/sudo 1 /usr/bin/gftp 1 1 1 /usr/bin/balsa 1 /usr/bin/balsa 1 /usr/bin/balsa 1 /usr/bin/eog 1 /usr/bin/eog 1 /usr/bin/eog 1 /usr/bin/gs 1 /usr/bin/gs 1 /usr/bin/gs 1 /usr/bin/gnupg 1 /usr/bin/gnupg 1 /usr/bin/evolution 1 /usr/bin/evolution 1 /usr/bin/evolution 1 /usr/bin/kdm 1 /usr/bin/kdm 1 /usr/bin/kdm 1 /usr/bin/konqueror 1 /usr/bin/konqueror 1 /usr/bin/konqueror 1 /usr/libexec/filters/psbanner 1 /usr/bin/mutt 1 /usr/bin/mutt 1 /usr/bin/mutt 1 /usr/bin/pine 1 /usr/bin/pine 1 /usr/bin/pine 1 /usr/bin/emacs 1 /usr/bin/emacs 1 /usr/bin/emacs 1 /usr/bin/xemacs 1 /usr/bin/xemacs 1 /usr/bin/xemacs 1 /usr/sbin/sendmail.sendmail 1 /usr/sbin/sendmail.sendmail 1 /usr/sbin/sendmail.sendmail 1 /usr/sbin/sendmail.sendmail 1 /usr/bin/unzip 1 /usr/bin/unzip 1 /usr/bin/unzip 1 /usr/bin/xpdf 1 /usr/bin/xpdf 1 /usr/bin/xpdf 1 /usr/bin/411toppm 1 /usr/bin/411toppm 1 /usr/bin/411toppm 1 /usr/bin/asciitopgm 1 /usr/bin/asciitopgm 1 /usr/bin/asciitopgm 1 /usr/bin/atktopbm 1 /usr/bin/atktopbm 1 /usr/bin/atktopbm 1 /usr/bin/bioradtopgm 1 /usr/bin/bioradtopgm 1 /usr/bin/bioradtopgm 1 /usr/bin/bmptoppm 1 /usr/bin/bmptoppm 1 /usr/bin/bmptoppm 1 /usr/bin/brushtopbm 1 /usr/bin/brushtopbm 1 /usr/bin/brushtopbm 1 /usr/bin/cmuwmtopbm 1 /usr/bin/cmuwmtopbm 1 /usr/bin/cmuwmtopbm 1 /usr/bin/eyuvtoppm 1 /usr/bin/eyuvtoppm 1 /usr/bin/eyuvtoppm 1 /usr/bin/fiascotopnm 1 /usr/bin/fiascotopnm 1 /usr/bin/fiascotopnm 1 /usr/bin/fitstopnm 1 /usr/bin/fitstopnm 1 /usr/bin/fitstopnm 1 /usr/bin/fstopgm 1 /usr/bin/fstopgm 1 /usr/bin/fstopgm 1 /usr/bin/g3topbm 1 /usr/bin/g3topbm 1 /usr/bin/g3topbm 1 /usr/bin/gemtopbm 1 /usr/bin/gemtopbm 1 /usr/bin/gemtopbm 1 /usr/bin/gemtopnm 1 /usr/bin/gemtopnm 1 /usr/bin/gemtopnm 1 /usr/bin/giftopnm 1 /usr/bin/giftopnm 1 /usr/bin/giftopnm 1 /usr/bin/gouldtoppm 1 /usr/bin/gouldtoppm 1 /usr/bin/gouldtoppm 1 /usr/bin/hipstopgm 1 /usr/bin/hipstopgm 1 /usr/bin/hipstopgm 1 /usr/bin/hpcdtoppm 1 /usr/bin/hpcdtoppm 1 /usr/bin/hpcdtoppm 1 /usr/bin/icontopbm 1 /usr/bin/icontopbm 1 /usr/bin/icontopbm 1 /usr/bin/ilbmtoppm 1 /usr/bin/ilbmtoppm 1 /usr/bin/ilbmtoppm 1 /usr/bin/imgtoppm 1 /usr/bin/imgtoppm 1 /usr/bin/imgtoppm 1 /usr/bin/jpegtopnm 1 /usr/bin/jpegtopnm 1 /usr/bin/jpegtopnm 1 /usr/bin/leaftoppm 1 /usr/bin/leaftoppm 1 /usr/bin/leaftoppm 1 /usr/bin/lispmtopgm 1 /usr/bin/lispmtopgm 1 /usr/bin/lispmtopgm 1 /usr/bin/macptopbm 1 /usr/bin/macptopbm 1 /usr/bin/macptopbm 1 /usr/bin/mdatopbm 1 /usr/bin/mdatopbm 1 /usr/bin/mdatopbm 1 /usr/bin/mgrtopbm 1 /usr/bin/mgrtopbm 1 /usr/bin/mgrtopbm 1 /usr/bin/mtvtoppm 1 /usr/bin/mtvtoppm 1 /usr/bin/mtvtoppm 1 /usr/bin/neotoppm 1 /usr/bin/neotoppm 1 /usr/bin/neotoppm 1 /usr/bin/palmtopnm 1 /usr/bin/palmtopnm 1 /usr/bin/palmtopnm 1 /usr/bin/pamchannel 1 /usr/bin/pamchannel 1 /usr/bin/pamchannel 1 /usr/bin/pamcut 1 /usr/bin/pamcut 1 /usr/bin/pamcut 1 /usr/bin/pamdeinterlace 1 /usr/bin/pamdeinterlace 1 /usr/bin/pamdeinterlace 1 /usr/bin/pamfile 1 /usr/bin/pamfile 1 /usr/bin/pamfile 1 /usr/bin/pamoil 1 /usr/bin/pamoil 1 /usr/bin/pamoil 1 /usr/bin/pamstretch 1 /usr/bin/pamstretch 1 /usr/bin/pamstretch 1 /usr/bin/pamtopnm 1 /usr/bin/pamtopnm 1 /usr/bin/pamtopnm 1 /usr/bin/pbmclean 1 /usr/bin/pbmclean 1 /usr/bin/pbmclean 1 /usr/bin/pbmlife 1 /usr/bin/pbmlife 1 /usr/bin/pbmlife 1 /usr/bin/pbmmake 1 /usr/bin/pbmmake 1 /usr/bin/pbmmake 1 /usr/bin/pbmmask 1 /usr/bin/zgrep 1 1 1 /usr/bin/pbmmask 1 /usr/bin/pbmmask 1 /usr/bin/pbmpage 1 /usr/bin/pbmpage 1 /usr/bin/pbmpage 1 /usr/bin/pbmpscale 1 /usr/bin/pbmpscale 1 /usr/bin/pbmpscale 1 /usr/bin/pbmreduce 1 /usr/bin/pbmreduce 1 /usr/bin/pbmreduce 1 /usr/bin/pbmtext 1 /usr/bin/pbmtext 1 /usr/bin/pbmtext 1 /usr/bin/pbmto10x 1 /usr/bin/pbmto10x 1 /usr/bin/pbmto10x 1 /usr/bin/pbmto4425 1 /usr/bin/pbmto4425 1 /usr/bin/pbmto4425 1 /usr/bin/pbmtoascii 1 /usr/bin/pbmtoascii 1 /usr/bin/pbmtoascii 1 /usr/bin/pbmtoatk 1 /usr/bin/pbmtoatk 1 /usr/bin/pbmtoatk 1 /usr/bin/pbmtobbnbg 1 /usr/bin/pbmtobbnbg 1 /usr/bin/pbmtobbnbg 1 /usr/bin/pbmtocmuwm 1 /usr/bin/pbmtocmuwm 1 /usr/bin/pbmtocmuwm 1 /usr/bin/pbmtoepsi 1 /usr/bin/pbmtoepsi 1 /usr/bin/pbmtoepsi 1 /usr/bin/pbmtoepson 1 /usr/bin/pbmtoepson 1 /usr/bin/pbmtoepson 1 /usr/bin/pbmtog3 1 /usr/bin/pbmtog3 1 /usr/bin/pbmtog3 1 /usr/bin/pbmtogem 1 /usr/bin/pbmtogem 1 /usr/bin/pbmtogem 1 /usr/bin/pbmtogo 1 /usr/bin/pbmtogo 1 /usr/bin/pbmtogo 1 /usr/bin/pbmtoicon 1 /usr/bin/pbmtoicon 1 /usr/bin/pbmtoicon 1 /usr/bin/pbmtolj 1 /usr/bin/pbmtolj 1 /usr/bin/pbmtolj 1 /usr/bin/pbmtoln03 1 /usr/bin/pbmtoln03 1 /usr/bin/pbmtoln03 1 /usr/bin/pbmtolps 1 /usr/bin/pbmtolps 1 /usr/bin/pbmtolps 1 /usr/bin/pbmtomacp 1 /usr/bin/pbmtomacp 1 /usr/bin/pbmtomacp 1 /usr/bin/pbmtomda 1 /usr/bin/pbmtomda 1 /usr/bin/pbmtomda 1 /usr/bin/pbmtomgr 1 /usr/bin/pbmtomgr 1 /usr/bin/pbmtomgr 1 /usr/bin/pbmtonokia 1 /usr/bin/pbmtonokia 1 /usr/bin/pbmtonokia 1 /usr/bin/pbmtopgm 1 /usr/bin/pbmtopgm 1 /usr/bin/pbmtopgm 1 /usr/bin/pbmtopi3 1 /usr/bin/pbmtopi3 1 /usr/bin/pbmtopi3 1 /usr/bin/pbmtopk 1 /usr/bin/pbmtopk 1 /usr/bin/pbmtopk 1 /usr/bin/pbmtoplot 1 /usr/bin/pbmtoplot 1 /usr/bin/pbmtoplot 1 /usr/bin/pbmtoppa 1 /usr/bin/pbmtoppa 1 /usr/bin/pbmtoppa 1 /usr/bin/pbmtopsg3 1 /usr/bin/pbmtopsg3 1 /usr/bin/pbmtopsg3 1 /usr/bin/pbmtoptx 1 /usr/bin/pbmtoptx 1 /usr/bin/pbmtoptx 1 /usr/bin/pbmtowbmp 1 /usr/bin/pbmtowbmp 1 /usr/bin/pbmtowbmp 1 /usr/bin/pbmtox10bm 1 /usr/bin/pbmtox10bm 1 /usr/bin/pbmtox10bm 1 /usr/bin/pbmtoxbm 1 /usr/bin/pbmtoxbm 1 /usr/bin/pbmtoxbm 1 /usr/bin/pbmtoybm 1 /usr/bin/pbmtoybm 1 /usr/bin/pbmtoybm 1 /usr/bin/pbmtozinc 1 /usr/bin/pbmtozinc 1 /usr/bin/pbmtozinc 1 /usr/bin/pbmupc 1 /usr/bin/pbmupc 1 /usr/bin/pbmupc 1 /usr/bin/pcxtoppm 1 /usr/bin/pcxtoppm 1 /usr/bin/pcxtoppm 1 /usr/bin/pgmbentley 1 /usr/bin/pgmbentley 1 /usr/bin/pgmbentley 1 /usr/bin/pgmcrater 1 /usr/bin/pgmcrater 1 /usr/bin/pgmcrater 1 /usr/bin/pgmedge 1 /usr/bin/pgmedge 1 /usr/bin/pgmedge 1 /usr/bin/pgmenhance 1 /usr/bin/pgmenhance 1 /usr/bin/pgmenhance 1 /usr/bin/pgmhist 1 /usr/bin/pgmhist 1 /usr/bin/pgmhist 1 /usr/bin/pgmkernel 1 /usr/bin/pgmkernel 1 /usr/bin/pgmkernel 1 /usr/bin/pgmnoise 1 /usr/bin/pgmnoise 1 /usr/bin/pgmnoise 1 /usr/bin/pgmnorm 1 /usr/bin/pgmnorm 1 /usr/bin/pgmnorm 1 /usr/bin/pgmoil 1 /usr/bin/pgmoil 1 /usr/bin/pgmoil 1 /usr/bin/pgmramp 1 /usr/bin/pgmramp 1 /usr/bin/pgmramp 1 /usr/bin/pgmslice 1 /usr/bin/pgmslice 1 /usr/bin/pgmslice 1 /usr/bin/pgmtexture 1 /usr/bin/pgmtexture 1 /usr/bin/pgmtexture 1 /usr/bin/pgmtofs 1 /usr/bin/pgmtofs 1 /usr/bin/pgmtofs 1 /usr/bin/pgmtolispm 1 /usr/bin/pgmtolispm 1 /usr/bin/pgmtolispm 1 /usr/bin/pgmtopbm 1 /usr/bin/pgmtopbm 1 /usr/bin/pgmtopbm 1 /usr/bin/pgmtoppm 1 /usr/bin/pgmtoppm 1 /usr/bin/pgmtoppm 1 /usr/bin/pi1toppm 1 /usr/bin/pi1toppm 1 /usr/bin/pi1toppm 1 /usr/bin/pi3topbm 1 /usr/bin/pi3topbm 1 /usr/bin/pi3topbm 1 /usr/bin/pjtoppm 1 /usr/bin/pjtoppm 1 /usr/bin/pjtoppm 1 /usr/bin/pktopbm 1 /usr/bin/pktopbm 1 /usr/bin/pktopbm 1 /usr/bin/pngtopnm 1 /usr/bin/pngtopnm 1 /usr/bin/pngtopnm 1 /usr/bin/pnmalias 1 /usr/bin/pnmalias 1 /usr/bin/pnmalias 1 /usr/bin/pnmarith 1 /usr/bin/pnmarith 1 /usr/bin/pnmarith 1 /usr/bin/pnmcat 1 /usr/bin/pnmcat 1 /usr/bin/pnmcat 1 /usr/bin/pnmcolormap 1 /usr/bin/pnmcolormap 1 /usr/bin/pnmcolormap 1 /usr/bin/pnmcomp 1 /usr/bin/pnmcomp 1 /usr/bin/pnmcomp 1 /usr/bin/pnmconvol 1 /usr/bin/pnmconvol 1 /usr/bin/pnmconvol 1 /usr/bin/pnmcrop 1 /usr/bin/pnmcrop 1 /usr/bin/pnmcrop 1 /usr/bin/pnmcut 1 /usr/bin/pnmcut 1 /usr/bin/pnmcut 1 /usr/bin/gunzip 1 1 1 /usr/bin/pnmdepth 1 /usr/bin/pnmdepth 1 /usr/bin/pnmdepth 1 /usr/bin/pnmenlarge 1 /usr/bin/pnmenlarge 1 /usr/bin/pnmenlarge 1 /usr/bin/pnmfile 1 /usr/bin/pnmfile 1 /usr/bin/pnmfile 1 /usr/bin/pnmflip 1 /usr/bin/pnmflip 1 /usr/bin/pnmflip 1 /usr/bin/pnmgamma 1 /usr/bin/pnmgamma 1 /usr/bin/pnmgamma 1 /usr/bin/pnmhisteq 1 /usr/bin/pnmhisteq 1 /usr/bin/pnmhisteq 1 /usr/bin/pnmhistmap 1 /usr/bin/pnmhistmap 1 /usr/bin/pnmhistmap 1 /usr/bin/pnminterp 1 /usr/bin/pnminterp 1 /usr/bin/pnminterp 1 /usr/bin/pnminvert 1 /usr/bin/pnminvert 1 /usr/bin/pnminvert 1 /usr/bin/pnmmontage 1 /usr/bin/pnmmontage 1 /usr/bin/pnmmontage 1 /usr/bin/pnmnlfilt 1 /usr/bin/pnmnlfilt 1 /usr/bin/pnmnlfilt 1 /usr/bin/pnmnoraw 1 /usr/bin/pnmnoraw 1 /usr/bin/pnmnoraw 1 /usr/bin/pnmpad 1 /usr/bin/pnmpad 1 /usr/bin/pnmpad 1 /usr/bin/pnmpaste 1 /usr/bin/pnmpaste 1 /usr/bin/pnmpaste 1 /usr/bin/pnmpsnr 1 /usr/bin/pnmpsnr 1 /usr/bin/pnmpsnr 1 /usr/bin/pnmremap 1 /usr/bin/pnmremap 1 /usr/bin/pnmremap 1 /usr/bin/pnmrotate 1 /usr/bin/pnmrotate 1 /usr/bin/pnmrotate 1 /usr/bin/pnmscale 1 /usr/bin/pnmscale 1 /usr/bin/pnmscale 1 /usr/bin/pnmscalefixed 1 /usr/bin/pnmscalefixed 1 /usr/bin/pnmscalefixed 1 /usr/bin/pnmshear 1 /usr/bin/pnmshear 1 /usr/bin/pnmshear 1 /usr/bin/pnmsmooth 1 /usr/bin/pnmsmooth 1 /usr/bin/pnmsmooth 1 /usr/bin/pnmsplit 1 /usr/bin/pnmsplit 1 /usr/bin/pnmsplit 1 /usr/bin/pnmtile 1 /usr/bin/pnmtile 1 /usr/bin/pnmtile 1 /usr/bin/pnmtoddif 1 /usr/bin/pnmtoddif 1 /usr/bin/pnmtoddif 1 /usr/bin/pnmtofiasco 1 /usr/bin/pnmtofiasco 1 /usr/bin/pnmtofiasco 1 /usr/bin/pnmtofits 1 /usr/bin/pnmtofits 1 /usr/bin/pnmtofits 1 /usr/bin/pnmtojpeg 1 /usr/bin/pnmtojpeg 1 /usr/bin/pnmtojpeg 1 /usr/bin/pnmtopalm 1 /usr/bin/pnmtopalm 1 /usr/bin/pnmtopalm 1 /usr/bin/pnmtoplainpnm 1 /usr/bin/pnmtoplainpnm 1 /usr/bin/pnmtoplainpnm 1 /usr/bin/pnmtopng 1 /usr/bin/pnmtopng 1 /usr/bin/pnmtopng 1 /usr/bin/pnmtops 1 /usr/bin/pnmtops 1 /usr/bin/pnmtops 1 /usr/bin/pnmtorast 1 /usr/bin/pnmtorast 1 /usr/bin/pnmtorast 1 /usr/bin/pnmtorle 1 /usr/bin/pnmtorle 1 /usr/bin/pnmtorle 1 /usr/bin/pnmtosgi 1 /usr/bin/gzip 1 1 1 /usr/bin/pnmtosgi 1 /usr/bin/pnmtosgi 1 /usr/bin/pnmtosir 1 /usr/bin/pnmtosir 1 /usr/bin/pnmtosir 1 /usr/bin/pnmtotiff 1 /usr/bin/pnmtotiff 1 /usr/bin/pnmtotiff 1 /usr/bin/pnmtotiffcmyk 1 /usr/bin/pnmtotiffcmyk 1 /usr/bin/pnmtotiffcmyk 1 /usr/bin/pnmtoxwd 1 /usr/bin/pnmtoxwd 1 /usr/bin/pnmtoxwd 1 /usr/bin/ppm3d 1 /usr/bin/ppm3d 1 /usr/bin/ppm3d 1 /usr/bin/ppmbrighten 1 /usr/bin/ppmbrighten 1 /usr/bin/ppmbrighten 1 /usr/bin/ppmchange 1 /usr/bin/ppmchange 1 /usr/bin/ppmchange 1 /usr/bin/ppmcie 1 /usr/bin/ppmcie 1 /usr/bin/ppmcie 1 /usr/bin/ppmcolormask 1 /usr/bin/ppmcolormask 1 /usr/bin/ppmcolormask 1 /usr/bin/ppmcolors 1 /usr/bin/ppmcolors 1 /usr/bin/ppmcolors 1 /usr/bin/ppmdim 1 /usr/bin/ppmdim 1 /usr/bin/ppmdim 1 /usr/bin/ppmdist 1 /usr/bin/ppmdist 1 /usr/bin/ppmdist 1 /usr/bin/ppmdither 1 /usr/bin/ppmdither 1 /usr/bin/ppmdither 1 /usr/bin/ppmflash 1 /usr/bin/ppmflash 1 /usr/bin/ppmflash 1 /usr/bin/ppmforge 1 /usr/bin/ppmforge 1 /usr/bin/ppmforge 1 /usr/bin/ppmhist 1 /usr/bin/ppmhist 1 /usr/bin/ppmhist 1 /usr/bin/ppmlabel 1 /usr/bin/ppmlabel 1 /usr/bin/ppmlabel 1 /usr/bin/ppmmake 1 /usr/bin/ppmmake 1 /usr/bin/ppmmake 1 /usr/bin/ppmmix 1 /usr/bin/ppmmix 1 /usr/bin/ppmmix 1 /usr/bin/ppmnorm 1 /usr/bin/ppmnorm 1 /usr/bin/ppmnorm 1 /usr/bin/ppmntsc 1 /usr/bin/ppmntsc 1 /usr/bin/ppmntsc 1 /usr/bin/ppmpat 1 /usr/bin/ppmpat 1 /usr/bin/ppmpat 1 /usr/bin/ppmquant 1 /usr/bin/ppmquant 1 /usr/bin/ppmquant 1 /usr/bin/ppmqvga 1 /usr/bin/ppmqvga 1 /usr/bin/ppmqvga 1 /usr/bin/ppmrelief 1 /usr/bin/ppmrelief 1 /usr/bin/ppmrelief 1 /usr/bin/ppmshift 1 /usr/bin/ppmshift 1 /usr/bin/ppmshift 1 /usr/bin/ppmspread 1 /usr/bin/ppmspread 1 /usr/bin/ppmspread 1 /usr/bin/ppmtoacad 1 /usr/bin/ppmtoacad 1 /usr/bin/ppmtoacad 1 /usr/bin/ppmtobmp 1 /usr/bin/ppmtobmp 1 /usr/bin/ppmtobmp 1 /usr/bin/ppmtoeyuv 1 /usr/bin/ppmtoeyuv 1 /usr/bin/ppmtoeyuv 1 /usr/bin/ppmtogif 1 /usr/bin/ppmtogif 1 /usr/bin/ppmtogif 1 /usr/bin/ppmtoicr 1 /usr/bin/ppmtoicr 1 /usr/bin/ppmtoicr 1 /usr/bin/ppmtoilbm 1 /usr/bin/ppmtoilbm 1 /usr/bin/ppmtoilbm 1 /usr/bin/ppmtojpeg 1 /usr/bin/ppmtojpeg 1 /usr/bin/ppmtojpeg 1 /usr/bin/ppmtoleaf 1 /usr/bin/ppmtoleaf 1 /usr/bin/ppmtoleaf 1 /usr/bin/ppmtolj 1 /usr/bin/ppmtolj 1 /usr/bin/ppmtolj 1 /usr/bin/ppmtomitsu 1 /usr/bin/ppmtomitsu 1 /usr/bin/ppmtomitsu 1 /usr/bin/ppmtompeg 1 /usr/bin/ppmtompeg 1 /usr/bin/ppmtompeg 1 /usr/bin/ppmtoneo 1 /usr/bin/ppmtoneo 1 /usr/bin/ppmtoneo 1 /usr/bin/ppmtopcx 1 /usr/bin/ppmtopcx 1 /usr/bin/ppmtopcx 1 /usr/bin/ppmtopgm 1 /usr/bin/ppmtopgm 1 /usr/bin/ppmtopgm 1 /usr/bin/ppmtopi1 1 /usr/bin/ppmtopi1 1 /usr/bin/ppmtopi1 1 /usr/bin/ppmtopict 1 /usr/bin/ppmtopict 1 /usr/bin/ppmtopict 1 /usr/bin/ppmtopj 1 /usr/bin/ppmtopj 1 /usr/bin/ppmtopj 1 /usr/bin/ppmtopjxl 1 /usr/bin/ppmtopjxl 1 /usr/bin/ppmtopjxl 1 /usr/bin/ppmtopuzz 1 /usr/bin/ppmtopuzz 1 /usr/bin/ppmtopuzz 1 /usr/bin/ppmtorgb3 1 /usr/bin/ppmtorgb3 1 /usr/bin/ppmtorgb3 1 /usr/bin/ppmtosixel 1 /usr/bin/ppmtosixel 1 /usr/bin/ppmtosixel 1 /usr/bin/ppmtotga 1 /usr/bin/ppmtotga 1 /usr/bin/ppmtotga 1 /usr/bin/ppmtouil 1 /usr/bin/ppmtouil 1 /usr/bin/ppmtouil 1 /usr/bin/ppmtowinicon 1 /usr/bin/ppmtowinicon 1 /usr/bin/ppmtowinicon 1 /usr/bin/ppmtoxpm 1 /usr/bin/ppmtoxpm 1 /usr/bin/ppmtoxpm 1 /usr/bin/ppmtoyuv 1 /usr/bin/ppmtoyuv 1 /usr/bin/ppmtoyuv 1 /usr/bin/ppmtoyuvsplit 1 /usr/bin/ppmtoyuvsplit 1 /usr/bin/ppmtoyuvsplit 1 /usr/bin/ppmtv 1 /usr/bin/ppmtv 1 /usr/bin/ppmtv 1 /usr/bin/psidtopgm 1 /usr/bin/psidtopgm 1 /usr/bin/psidtopgm 1 /usr/bin/pstopnm 1 /usr/bin/pstopnm 1 /usr/bin/pstopnm 1 /usr/bin/qrttoppm 1 /usr/bin/qrttoppm 1 /usr/bin/qrttoppm 1 /usr/bin/rasttopnm 1 /usr/bin/rasttopnm 1 /usr/bin/rasttopnm 1 /usr/bin/rawtopgm 1 /usr/bin/rawtopgm 1 /usr/bin/rawtopgm 1 /usr/bin/rawtoppm 1 /usr/bin/rawtoppm 1 /usr/bin/rawtoppm 1 /usr/bin/rgb3toppm 1 /usr/bin/rgb3toppm 1 /usr/bin/rgb3toppm 1 /usr/bin/rletopnm 1 /usr/bin/rletopnm 1 /usr/bin/rletopnm 1 /usr/bin/sbigtopgm 1 /usr/bin/sbigtopgm 1 /usr/bin/sbigtopgm 1 /usr/bin/sgitopnm 1 /usr/bin/sgitopnm 1 /usr/bin/sgitopnm 1 /usr/bin/sirtopnm 1 /usr/bin/sirtopnm 1 /usr/bin/sirtopnm 1 /usr/bin/mikmod 1 1 1 /usr/bin/sldtoppm 1 /usr/bin/sldtoppm 1 /usr/bin/sldtoppm 1 /usr/bin/spctoppm 1 /usr/bin/spctoppm 1 /usr/bin/spctoppm 1 /usr/bin/spottopgm 1 /usr/bin/spottopgm 1 /usr/bin/spottopgm 1 /usr/bin/sputoppm 1 /usr/bin/sputoppm 1 /usr/bin/sputoppm 1 /usr/bin/tgatoppm 1 /usr/bin/tgatoppm 1 /usr/bin/tgatoppm 1 /usr/bin/thinkjettopbm 1 /usr/bin/thinkjettopbm 1 /usr/bin/thinkjettopbm 1 /usr/bin/tifftopnm 1 /usr/bin/tifftopnm 1 /usr/bin/tifftopnm 1 /usr/bin/wbmptopbm 1 /usr/bin/wbmptopbm 1 /usr/bin/wbmptopbm 1 /usr/bin/winicontoppm 1 /usr/bin/winicontoppm 1 /usr/bin/winicontoppm 1 /usr/bin/xbmtopbm 1 /usr/bin/xbmtopbm 1 /usr/bin/xbmtopbm 1 /usr/bin/ximtoppm 1 /usr/bin/ximtoppm 1 /usr/bin/ximtoppm 1 /usr/bin/xpmtoppm 1 /usr/bin/xpmtoppm 1 /usr/bin/xpmtoppm 1 /usr/bin/xvminitoppm 1 /usr/bin/xvminitoppm 1 /usr/bin/xvminitoppm 1 /usr/bin/xwdtopnm 1 /usr/bin/xwdtopnm 1 /usr/bin/xwdtopnm 1 /usr/bin/ybmtopbm 1 /usr/bin/ybmtopbm 1 /usr/bin/ybmtopbm 1 /usr/bin/yuvsplittoppm 1 /usr/bin/yuvsplittoppm 1 /usr/bin/yuvsplittoppm 1 /usr/bin/yuvtoppm 1 /usr/bin/yuvtoppm 1 /usr/bin/yuvtoppm 1 /usr/bin/zeisstopnm 1 /usr/bin/zeisstopnm 1 /usr/bin/zeisstopnm 1 /usr/X11R6/bin/XFree86 1 /usr/X11R6/bin/XFree86 1 /usr/X11R6/bin/XFree86 1 /usr/bin/gaim 1 /usr/bin/gaim 1 /usr/bin/gaim 1 /usr/bin/slocate 1 /usr/bin/slocate 1 /usr/bin/mc 1 /usr/bin/mc 1 /usr/bin/mc 1 /usr/sbin/tcpdump 1 /usr/sbin/tcpdump 1 /usr/sbin/tcpdump 1 / 1 /usr/bin/ethereal 1 /usr/bin/ethereal 1 /usr/bin/ethereal 1 /usr/sbin/ethereal 1 /usr/sbin/ethereal 1 /usr/sbin/ethereal 1 /usr/sbin/tethereal 1 /usr/sbin/tethereal 1 /usr/sbin/tethereal 1 /usr/share/services/kfile_vcf.desktop 1 /usr/share/services/kfile_vcf.desktop 1 /usr/share/services/kfile_vcf.desktop 1 /usr/bin/mozilla 1 /usr/bin/mozilla 1 /usr/bin/mozilla 1 /usr/bin/ethereal 1 /usr/bin/ethereal 1 /usr/bin/ethereal 1 /usr/sbin/ethereal 1 /usr/sbin/ethereal 1 /usr/sbin/ethereal 1 /usr/bin/tethereal 1 /usr/bin/tethereal 1 /usr/bin/tethereal 1 /etc/httpd/modules/libphp4.so /usr/lib/pgsql/tsearch.so regular /etc/sudoers /etc/httpd/conf.d/php.conf ^.*cupsd.* ^.*httpd.* ^.*httpd\.worker.* ^.*lpd.* ^.*mysqld.* ^.*rpc\.mountd.* ^.*sshd.* ^.*smtpd.* ^.*smbd.* TCP ^.*smbd.* ^.*sendmail.* TCP ^.*sendmail.* ^.*vsftpd.* TCP ^.*xinetd.* ^.*ypserv.* .* 1720 ^.*httpd.* TCP ^.*httpd TCP ^.*rpc\.mountd ^.*snmpd.* ^.*squid.* ^.*racoon UDP ^.*squid .*/radiusd 1812 udp redhat-release 9 kernel NULL 6 2.4.20 redhat-release ^3.S redhat-release ^.*3.S php ^i.*86 2.4.20-6 x86_64 openssl096b 0 0.9.6b 16.22.3 earlier rh-postgresql-contrib 0 7.3.10 1 earlier libgd 0 1.8.4 12.3.1 earlier libgd-devel 0 1.8.4 12.3.1 earlier libxml 1 1.8.17 9.2 earlier libxml-devel 1 1.8.17 9.2 earlier The ImageMagick-devel, ImageMagick-c++-devel, and ImageMagick-c++ RPMs all require that the exact same version of the ImageMagick RPM is present. As such, we can test for a vulnerable version of the former alone, rather than testing for the presence of each of these RPMs in particular. ImageMagick 0 5.5.6 14 earlier kernel 0 2.4.21 32.0.1.EL earlier kernel-hugemem 0 2.4.21 32.0.1.EL earlier kernel-smp 0 2.4.21 32.0.1.EL earlier FreeRADIUS NULL 1.0.1 1 earlier bzip2 0 1.0.2 11.EL3.4 earlier balsa NULL 2.0.6 2 earlier cups NULL 1.1.17 13.3 earlier ddskk NULL 11.6.0 11.90 earlier ddskk-xemacs NULL 11.6.0 11.90 earlier eog NULL 2.2.0 2 earlier ethereal NULL 0.9.11 0.90.1 earlier ethereal NULL 0.9.13 1.90.1 earlier ethereal-gnome NULL 0.9.13 1.90.1 earlier evolution NULL 1.2.2 5 earlier gaim 1 1.3.1 0.el3 earlier gdm 1 2.4.1.3 5.1 earlier ghostscript NULL 7.05 32.1 earlier gnupg NULL 1.2.1 4 earlier gtkhtml NULL 1.1.9 0.9 earlier gtkhtml NULL 1.1.9 0.9.1 earlier httpd NULL 2.0.40 21.1 earlier httpd NULL 2.0.40 21.5 earlier kdebase 6 3.1 15 earlier krb5-server NULL 1.2.7 14 earlier krb5-libs NULL 1.2.7 14 earlier telnet 1 0.17 20.EL3.3 earlier krb5-workstation NULL 1.2.7 14 earlier kernel NULL 2.4.20 13.9 earlier kernel NULL 2.4.20 18.9 earlier kernel NULL 2.4.20 19.9 earlier kdelibs 6 3.1 12 earlier lprng NULL 3.8.19 3.1 earlier lv NULL 4.49.4 9.9.1 earlier mutt 5 1.4.1 1 earlier mysql-server NULL 3.23.56 1.9 earlier nfs-utils NULL 1.0.1 3.9 earlier The ImageMagick-* RPMs all require that the main ImageMagick RPM have the same version and release number. ImageMagick 0 5.5.6 15 earlier openssh-server NULL 3.5p1 6.9 earlier openssh-server NULL 3.5p1 11 earlier openssl NULL 0.9.7a 5 earlier openssl-devel NULL 0.9.7a 5 earlier openssl-perl NULL 0.9.7a 5 earlier openssl096 NULL 0.9.6 17 earlier openssl096b NULL 0.9.6b 6 earlier pam_smb NULL 1.1.6 9.9 earlier perl-CGI 2 2.81 88.3 earlier php NULL 4.2.2 17.2 earlier sysreport 0 1.3.7.2 6 earlier pine NULL 4.44 19.90.0 earlier postfix 2 1.1.12 1 earlier samba NULL 2.2.7a 7.9.0 earlier samba NULL 2.2.7a 8.9.0 earlier wl NULL 2.10.1 1.1 earlier wl-xemacs NULL 2.10.1 1.1 earlier sendmail NULL 8.12.8 5.90 earlier sendmail NULL 8.12.8 9.90 earlier sendmail NULL 8.12.8 6.90 earlier squirrelmail NULL 1.2.11 1 earlier gedit 1 2.2.2 4rhel3 earlier unzip NULL 5.50 33 earlier up2date NULL 3.1.23.1 5 earlier vsftpd NULL 1.1.3 8 earlier xinetd 2 2.3.11 1.9.0 earlier xpdf 1 2.0.1 11 earlier ypserv NULL 2.8 0.9E earlier pwlib NULL 1.4.7 4.1 earlier netpbm NULL 9.24 10.90.1 earlier netpbm-devel NULL 9.24 10.90.1 earlier sudo 0 1.6.7p5 1.1 earlier netpbm-progs NULL 9.24 10.90.1 earlier XFree86 NULL 4.3.0 2.90.55 earlier netpbm NULL 9.24 11.30.1 earlier netpbm-devel NULL 9.24 11.30.1 earlier netpbm-progs NULL 9.24 11.30.1 earlier mutt 5 1.4.1 3.3 earlier mailman 3 2.1.1 5 earlier gaim 1 0.75 0.9.0 earlier slocate NULL 2.7 2 earlier mc 1 4.6.0 7.9 earlier php 0 4.3.2 24.ent earlier kdelibs 6 3.1 13 earlier kernel NULL 2.4.21 9.0.1.EL earlier kernel-smp NULL 2.4.21 9.0.1.EL earlier kernel-hugemem NULL 2.4.21 9.0.1.EL earlier pwlib NULL 1.4.7 7.EL earlier samba NULL 3.0.2 6.3E earlier mod_python NULL 3.0.1 4 earlier XFree86 NULL 4.3.0 55.EL earlier libxml2 NULL 2.5.10 6 earlier libxml2-devel NULL 2.5.10 6 earlier libxml2-python NULL 2.5.10 6 earlier kernel NULL 2.4.20 30.9 earlier kernel-smp NULL 2.4.20 30.9 earlier kernel-bigmem NULL 2.4.20 30.9 earlier mutt 5 1.4.1 3.4 earlier gdk-pixbuf 1 0.22.0 6.0.3 earlier gdk-pixbuf-devel 1 0.22.0 6.0.3 earlier gdk-pixbuf-gnome 1 0.22.0 6.0.3 earlier gdk-pixbuf 1 0.22.0 6.1.0 earlier gdk-pixbuf-devel 1 0.22.0 6.1.0 earlier gdk-pixbuf-gnome 1 0.22.0 6.1.0 earlier tcpdump 14 3.7.2 7.9.1 earlier sysstat NULL 4.0.7 4.rhl9.1 earlier tcpdump 14 3.7.2 7.E3.1 earlier cvs NULL 1.11.2 13 earlier ethereal NULL 0.10.0a 0.90.1 earlier ethereal=gnome NULL 0.10.0a 0.90.1 earlier kdepim 6 3.1 6 earlier kernel NULL 2.4.20 28.9 earlier kernel-smp NULL 2.4.20 28.9 earlier openssl-perl 0 0.9.7a 33.15 earlier kernel-bigmem NULL 2.4.20 28.9 earlier nfs-utils NULL 1.0.6 7.EL earlier sysstat NULL 4.0.7 4.EL3.2 earlier httpd NULL 2.0.40 21.9 earlier httpd NULL 2.0.46 26.ent earlier kdepim 6 3.1.3 3.3 earlier cvs NULL 1.11.2 14 earlier kernel NULL 2.4.21 4.0.2.EL earlier kernel-smp NULL 2.4.21 4.0.2.EL earlier kernel-bigmem NULL 2.4.21 4.0.2.EL earlier kernel NULL 2.4.21 9.EL earlier net-snmp NULL 5.0.9 2.30E.1 earlier openssl NULL 0.9.7a 33.4 earlier openssl-devel NULL 0.9.7a 33.4 earlier openssl-perl NULL 0.9.7a 33.4 earlier openssl096b NULL 0.9.6b 16 earlier mozilla-nss 37 1.4.2 0.9.0 earlier mozilla 37 1.4.2 0.9.0 earlier openssl NULL 0.9.7a 20.2 earlier openssl-devel NULL 0.9.7a 20.2 earlier openssl-perl NULL 0.9.7a 20.2 earlier openssl096 NULL 0.9.6 25.9 earlier openssl096b NULL 0.9.6b 15 earlier mod_ssl NULL 2.0.46 32.ent earlier squid 7 2.5STABLE1 3.9 earlier ethereal NULL 0.10.3 0.90.1 earlier ethereal-gnome NULL 0.10.3 0.90.1 earlier ethereal NULL 0.10.3 0.30E.1 earlier ethereal-gnome NULL 0.10.3 0.30E.1 earlier mozilla-nss 37 1.4.2 3.0.2 earlier kernel NULL 2.4.21 9.0.3.EL earlier kernel-smp NULL 2.4.21 9.0.3.EL earlier kernel-hugemem NULL 2.4.21 9.0.3.EL earlier squid 7 2.5.STABLE3 5.3E earlier ipsec-tools NULL 0.2.5 0.4 earlier kdelibs 6 3.1.3 6.4 earlier rsync NULL 2.5.7 4.3E earlier cvs NULL 1.11.2 22 earlier libpng 2 1.2.2 21 earlier libpng-devel 2 1.2.2 21 earlier libpng NULL 1.0.13 12 earlier libpng-devel NULL 1.0.13 12 earlier kernel NULL 2.4.21 15.EL earlier kernel-unsupported NULL 2.4.21 15.EL earlier cvs NULL 1.11.2 18 earlier openoffice NULL 1.1.0 15.EL earlier tcpdump 14 3.7.2 7.E3.2 earlier lha NULL 1.14i 10.2 earlier utempter NULL 0.5.5 1.3EL.0 earlier squid 7 2.5.STABLE3 6.3E earlier ethereal NULL 0.10.3 0.30E.2 earlier ethereal-gnome NULL 0.10.3 0.30E.2 earlier krb5-libs NULL 1.2.7 24 earlier cvs NULL 1.11.2 24 earlier squirrelmail NULL 1.4.3 0.e3.1 earlier kernel 0 2.4.21 15.0.2.EL earlier kernel-hugemem 0 2.4.21 15.0.2.EL earlier kernel-smp 0 2.4.21 15.0.2.EL earlier libpng 2 1.2.2 24 earlier libpng-devel 2 1.2.2 24 earlier libpng10-devel 0 1.0.13 14 earlier libpng10 0 1.0.13 14 earlier openssl-devel 0 0.9.7a 33.15 earlier openssl 0 0.9.7a 33.15 earlier gftp 1 2.0.14 4 earlier gzip 0 1.3.3 12.rhel3 earlier mikmod 0 3.1.6 22.EL3 earlier rh-postgresql-server 0 7.3.10 1 earlier