evolution: TNEF attachment decoder input sanitization errors (oCERT-2009-013)

ytnef has directory traversal

EMC RepliStor Server Service before ESA-09-003 has a DoASOCommand Remote Code Execution Vulnerability. The flaw exists within the DoRcvRpcCall RPC function -exposed via the rep_srv.exe process- where the vulnerability is caused by an error when the rep_srv.exe handles a specially crafted packet sent by an unauthenticated attacker.

file: multiple memory corruption issues

Multiple buffer overflows in the (1) cdf_read_sat, (2) cdf_read_long_sector_chain, and (3) cdf_read_ssat function in file before 5.02.

file: multiple memory corruption issues

Multiple integer overflows in the (1) cdf_read_property_info and (2) cdf_read_sat functions in file before 5.02.

gri before 2.12.18 generates temporary files in an insecure way.

clamav 0.91.2 suffers from a floating point exception when using ScanOLE2.

Systrace before 1.6.0 has insufficient escape policy enforcement.

Mondo 2.24 has insecure handling of temporary files.

There is a possible heap overflow in libclamav/fsg.c before 0.100.0.

thttpd 2007 has buffer underflow.

linux vserver 2.6 before 2.6.17 suffers from privilege escalation in remount code.

termpkg 3.3 suffers from buffer overflow.

xlockmore 5.13 allows potential xlock bypass when FVWM switches to the same virtual desktop as a new Gaim window.

xlockmore 5.13 and 5.22 segfaults when using libpam-opensc and returns the underlying xsession. This allows unauthorized users access to the X session.

Simple Machine Forum (SMF) versions 1.0.4 and earlier have an SQL injection vulnerability that allows remote attackers to inject arbitrary SQL statements.

TWiki allows arbitrary shell command execution via the Include function

Nvu 0.99+1.0pre uses an old copy of Mozilla XPCOM which can result in multiple security issues.

go.cgi in GoScript 2.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) query string or (2) artarchive parameter.

Snoopy before 2.0.0 has a security hole in exec cURL

glibc: manual/search.texi lacks a statement about the unspecified tdelete return value upon deletion of a tree's root

manual/search.texi in the GNU C Library (aka glibc) before 2.2 lacks a statement about the unspecified tdelete return value upon deletion of a tree's root, which might allow attackers to access a dangling pointer in an application whose developer was unaware of a documentation update from 1999.