Vulnerabilities > Debian > Linux

DATE CVE VULNERABILITY TITLE RISK
2011-03-30 CVE-2011-1548 Permissions, Privileges, and Access Controls vulnerability in Gentoo Logrotate
The default configuration of logrotate on Debian GNU/Linux uses root privileges to process files in directories that permit non-root write access, which allows local users to conduct symlink and hard link attacks by leveraging logrotate's lack of support for untrusted directories, as demonstrated by /var/log/postgresql/.
6.3
2011-01-20 CVE-2010-4338 Link Following vulnerability in Jwilk Ocrodjvu 0.4.61
ocrodjvu 0.4.6-1 on Debian GNU/Linux allows local users to modify arbitrary files via a symlink attack on temporary files that are generated when Cuneiform is invoked as the OCR engine.
local
high complexity
jwilk debian CWE-59
6.2
2011-01-14 CVE-2010-4695 Buffer Errors vulnerability in Catb Gif2Png 2.5.1/2.5.2
A certain Fedora patch for gif2png.c in gif2png 2.5.1 and 2.5.2, as distributed in gif2png-2.5.1-1200.fc12 on Fedora 12 and gif2png_2.5.2-1 on Debian GNU/Linux, truncates a GIF pathname specified on the command line, which might allow remote attackers to create PNG files in unintended directories via a crafted command-line argument, as demonstrated by a CGI program that launches gif2png, a different vulnerability than CVE-2009-5018.
network
low complexity
catb debian redhat CWE-119
5.0
2009-09-04 CVE-2009-2946 Unspecified vulnerability in Devscripts Devel Team Devscripts
Eval injection vulnerability in scripts/uscan.pl before Rev 1984 in devscripts allows remote attackers to execute arbitrary Perl code via crafted pathnames on distribution servers for upstream source code used in Debian GNU/Linux packages.
network
devscripts-devel-team debian
critical
9.3
2008-09-18 CVE-2008-4126 Configuration vulnerability in Debian Python-Dns
PyDNS (aka python-dns) before 2.3.1-5 in Debian GNU/Linux does not use random source ports for DNS requests and does not use random transaction IDs for DNS retries, which makes it easier for remote attackers to spoof DNS responses, a different vulnerability than CVE-2008-1447.
network
low complexity
debian CWE-16
6.4
2008-09-18 CVE-2008-4099 Configuration vulnerability in Debian Python-Dns
PyDNS (aka python-dns) before 2.3.1-4 in Debian GNU/Linux does not use random source ports or transaction IDs for DNS requests, which makes it easier for remote attackers to spoof DNS responses, a different vulnerability than CVE-2008-1447.
network
low complexity
debian CWE-16
6.4
2008-09-18 CVE-2008-4109 Permissions, Privileges, and Access Controls vulnerability in Openbsd Openssh
A certain Debian patch for OpenSSH before 4.3p2-9etch3 on etch; before 4.6p1-1 on sid and lenny; and on other distributions such as SUSE uses functions that are not async-signal-safe in the signal handler for login timeouts, which allows remote attackers to cause a denial of service (connection slot exhaustion) via multiple login attempts.
network
low complexity
debian openbsd CWE-264
5.0