Security

From the Mandriva advisory:

A cross-site scripting vulnerability was found in the mod_proxy_ftp module in Apache that allowed remote attackers to inject arbitrary web script or HTML via wildcards in a pathname in an FTP URI (CVE-2008-2939).

CVE-2008-3526: Eugene Teo reported a missing bounds check in the SCTP subsystem. By exploiting an integer overflow in the SCTP_AUTH_KEY handling code, remote attackers may be able to cause a denial of service in the form of a kernel panic.

CVE-2008-3534: Kel Modderman reported an issue in the tmpfs filesystem that allows local users to crash a system by triggering a kernel BUG() assertion.

CVE-2008-3535: Alexey Dobriyan discovered an off-by-one-error in the iov_iter_advance function which can be exploited by local users to crash a system, resulting in a denial of service.

CVE-2008-3792: Vlad Yasevich reported several NULL pointer reference conditions in the SCTP subsystem that can be triggered by entering sctp-auth codepaths when the AUTH feature is inactive. This may allow attackers to cause a denial of service condition via a system panic.

CVE-2008-3915: Johann Dahm and David Richter reported and issue in the nfsd subsystem that may allow remote attackers to cause a denial of service via a buffer overflow.

From the Mandriva advisory:

Gavin McCullagh of Griffith College Dublin reported an issue in Kolab v1 where user passwords were being recorded in the Apache log files due to Kolab using HTTP GET requests rather than HTTP POST requests. This would allow any users with access to the Apache log files to harvest user passwords and possibly other sensitive data.

From the Debian advisory:

It has been discovered that the signal handler implementing the login timeout in Debian's version of the OpenSSH server uses functions which are not async-signal-safe, leading to a denial of service vulnerability (CVE-2008-4109).

The problem was originally corrected in OpenSSH 4.4p1 (CVE-2006-5051), but the patch backported to the version released with etch was incorrect.

From the Mandriva advisory:

A symlink vulnerability was found in the javareconf script in R that allows local users to overwrite arbitrary files (CVE-2008-3931).

Multiple memory leaks were identified in the Directory Server. An unauthenticated remote attacker could use these flaws to trigger high memory consumption in the Directory Server, possibly causing it to crash or terminate unexpectedly when the server ran out of available memory. (CVE-2008-3283)

Ulf Weltman of Hewlett-Packard discovered a flaw in the way Directory Server handled LDAP search requests with patterns. A remote attacker with access to the LDAP service could create a search request that, when the search pattern was matched against specially crafted data records, caused Directory Server to use a large amount of CPU time. Directory Server did not impose time limits on such search requests. In this updated package, Directory Server imposes a configurable limit on the pattern-search query run time, with the default limit set to 30 seconds. (CVE-2008-2930)

From the Red Hat bugzilla:

The from_format function in ssmtp.c in ssmtp 2.62, in certain configurations, uses uninitialized memory for the From: field of an e-mail message, which might allow remote attackers to obtain sensitive information (memory contents) in opportunistic circumstances by reading a message.