Security

From the Red Hat advisory:

A flaw was found in the way Condor processed user submitted jobs. It was possible for a user to submit a job in a way that could cause that job to run as a different user with access to the pool. (CVE-2008-3826)

A stack based buffer overflow flaw was found in Condor's condor_schedd daemon. A user who had permissions to submit a job could do so in a manner that could cause condor_schedd to crash or, potentially, execute arbitrary code with the permissions of condor_schedd. (CVE-2008-3828)

A denial-of-service flaw was found in Condor's condor_schedd daemon. A user who had permissions to submit a job could do so in a manner that would cause condor_schedd to crash. (CVE-2008-3829)

A flaw was found in the way Condor processes allowed and denied netmasks for access control. If a configuration file contained an overlapping netmask in the allow or deny rules, it could cause that rule to be ignored, allowing unintended access. (CVE-2008-3830)

Dmitry E. Oboukhov discovered that the "to-upgrade" plugin of Feta, a simpler interface to APT, dpkg, and other Debian package tools creates temporary files insecurely, which may lead to local denial of service through symlink attacks.

From the Red Hat advisory:

Missing boundary checks were reported in the Linux kernel SCTP implementation. This could, potentially, cause information disclosure via a specially crafted SCTP_HMAC_IDENT IOCTL request. (CVE-2008-4113, CVE-2008-4445)

From the Debian advisory:

CVE-2008-4298: A memory leak in the http_request_parse function could be used by remote attackers to cause lighttpd to consume memory, and cause a denial of service attack.

CVE-2008-4359: Inconsistent handling of URL patterns could lead to the disclosure of resources a server administrator did not anticipate when using rewritten URLs.

CVE-2008-4360: Upon file systems which don't handle case-insensitive paths differently it might be possible that unanticipated resources could be made available by mod_userdir.

Felipe Andres Manzano discovered that mplayer, a multimedia player, is vulnerable to several integer overflows in the Real video stream demuxing code. These flaws could allow an attacker to cause a denial of service (a crash) or potentially the execution of arbitrary code by supplying a maliciously crafted video file.

A flaw was found in the pam_krb5 "existing_ticket" configuration option. If a system is configured to use an existing credential cache via the "existing_ticket" option, it may be possible for a local user to gain elevated privileges by using a different, local user's credential cache. (CVE-2008-3825)

Several vulnerabilities have been discovered in PHP, a server-side, HTML-embedded scripting language. The Common Vulnerabilities and Exposures project identifies the following problems:

CVE-2008-3658: Buffer overflow in the imageloadfont function allows a denial of service or code execution through a crafted font file.

CVE-2008-3659: Buffer overflow in the memnstr function allows a denial of service or code execution via a crafted delimiter parameter to the explode function.

CVE-2008-3660: Denial of service is possible in the FastCGI module by a remote attacker by making a request with multiple dots before the extension.

It was discovered that the hypervisor's para-virtualized framebuffer (PVFB) backend failed to validate the frontend's framebuffer description properly. This could allow a privileged user in the unprivileged domain (DomU) to cause a denial of service, or, possibly, elevate privileges to the privileged domain (Dom0). (CVE-2008-1952)

A flaw was found in the QEMU block format auto-detection, when running fully-virtualized guests and using Qemu images written on removable media (USB storage, 3.5" disks). Privileged users of such fully-virtualized guests (DomU), with a raw-formatted disk image, were able to write a header to that disk image describing another format. This could allow such guests to read arbitrary files in their hypervisor's host (Dom0). (CVE-2008-1945)