MandrakeSoft Mandrake Linux 8.2

passwd 0.68 does not check the return code for the pam_start function, which has unknown impact and attack vectors that may prevent "safe and proper operation" of PAM.

Published: 2005-08-17T04:00:00.000Z
Updated: 2024-08-08T01:22:13.939Z

Memory leak in passwd 0.68 allows local users to cause a denial of service (memory consumption) via a large number of failed read attempts from the password buffer.

Published: 2005-08-17T04:00:00.000Z
Updated: 2024-08-08T01:22:13.698Z

Off-by-one error in passwd 0.68 and earlier, when using the --stdin option, causes passwd to use the first 78 characters of a password instead of the first 79, which results in a small reduction of the search space required for brute force attacks.

Published: 2005-08-17T04:00:00.000Z
Updated: 2024-08-08T01:22:13.912Z

Format string vulnerability in Speedtouch USB driver before 1.3.1 allows local users to execute arbitrary code via (1) modem_run, (2) pppoa2, or (3) pppoa3.

Published: 2004-10-20T04:00:00.000Z
Updated: 2024-08-08T00:31:47.532Z

A race condition in the way env_start and env_end pointers are initialized in the execve system call and used in fs/proc/base.c on Linux 2.4 allows local users to cause a denial of service (crash).

Published: 2003-07-25T04:00:00.000Z
Updated: 2024-08-08T01:58:09.649Z

Kerberos FTP client allows remote FTP sites to execute arbitrary code via a pipe (|) character in a filename that is retrieved by the client.

Published: 2003-02-01T05:00:00.000Z
Updated: 2024-08-08T01:43:35.114Z

The Internet Group Management Protocol (IGMP) allows local users to cause a denial of service via an IGMP membership report to a target's Ethernet address instead of the Multicast group address, which causes the target to stop sending reports to the router and effectively disconnect the group from the network.

Published: 2005-11-16T21:17:00.000Z
Updated: 2024-08-08T03:51:17.597Z

The Standard security setting for Mandrake-Security package (msec) in Mandrake 8.2 installs home directories with world-readable permissions, which could allow local users to read other user's files.

Published: 2005-06-21T04:00:00.000Z
Updated: 2024-08-08T03:34:55.794Z

dvips converter for Postscript files in the tetex package calls the system() function insecurely, which allows remote attackers to execute arbitrary commands via certain print jobs, possibly involving fonts.

Published: 2004-09-01T04:00:00.000Z
Updated: 2024-08-08T03:03:49.020Z

setpwnam.c in the util-linux package, as included in Red Hat Linux 7.3 and earlier, and other operating systems, does not properly lock a temporary file when modifying /etc/passwd, which may allow local users to gain privileges via a complex race condition that uses an open file descriptor in utility programs such as chfn and chsh.

Published: 2003-04-02T05:00:00.000Z
Updated: 2024-08-08T02:56:38.516Z