Linux

Unknown vulnerabilities in the UDP port allocation for Linux kernel before 2.2.19 could allow local users to cause a denial of service (deadlock).

Certain operations in Linux kernel before 2.2.19 on the x86 architecture copy the wrong number of bytes, which might allow attackers to modify memory, aka "User access asm bug on x86."

Unknown vulnerability in classifier code for Linux kernel before 2.2.19 could result in denial of service (hang).

Unknown vulnerability in sockfilter for Linux kernel before 2.2.19 related to "boundary cases," with unknown impact.

Unknown vulnerabilities in strnlen_user for Linux kernel before 2.2.19, with unknown impact.

The "mxcsr P4" vulnerability in the Linux kernel before 2.2.17-14, when running on certain Intel CPUs, allows local users to cause a denial of service (system halt).

Kernel logging daemon (klogd) in Linux does not properly cleanse user-injected format strings, which allows local users to gain root privileges by triggering malformed kernel messages.

makewhatis in Linux man package allows local users to overwrite files via a symlink attack.

A system does not present an appropriate legal message or warning to a user who is accessing it.

The knfsd NFS server in Linux kernel 2.2.x allows remote attackers to cause a denial of service via a negative size value.

Linux xmonisdn package allows local users to gain root privileges by modifying the IFS or PATH environmental variables.

IP masquerading in Linux 2.2.x allows remote attackers to route UDP packets through the internal interface by modifying the external source IP address and port number to match those of an established connection.

Linux printtool sets the permissions of printer configuration files to be world-readable, which allows local attackers to obtain printer share passwords.

Vulnerability when Network Address Translation (NAT) is enabled in Linux 2.2.10 and earlier with ipchains, or FreeBSD 3.2 with ipfw, allows remote attackers to cause a denial of service (kernel panic) via a ping -R (record route) command.

strace allows local users to read arbitrary files via memory mapped file names.

Buffer overflow in Linux su command gives root access to local users.

Denial of service in Linux syslogd via a large number of connections.

Linux kernel before 2.3.18 or 2.2.13pre15, with SLIP and PPP options, allows local unprivileged users to forge IP packets via the TIOCSETD option on tty devices.

mknod in Linux 2.2 follows symbolic links, which could allow local users to overwrite files or gain privileges.

Remote attackers can cause a denial of service on Linux in.telnetd telnet daemon through a malformed TERM environmental variable.

Versions of rpcbind including Linux, IRIX, and Wietse Venema's rpcbind allow a remote attacker to insert and delete entries by spoofing a source address.

Linux ftpwatch program allows local users to gain root privileges.

The ugidd RPC interface, by design, allows remote attackers to enumerate valid usernames by specifying arbitrary UIDs that ugidd maps to local user and group names.

A race condition in Linux 2.2.1 allows local users to read arbitrary memory from /proc files.

Linux cfingerd could be exploited to gain root access.

Linux 2.1.132 and earlier allows local users to cause a denial of service (resource exhaustion) by reading a large buffer from a random device (e.g. /dev/urandom), which cannot be interrupted until the read has completed.

fte-console in the fte package before 0.46b-4.1 does not drop root privileges, which allows local users to gain root access via the virtual console device.

KDE allows local users to execute arbitrary commands by setting the KDEDIR environmental variable to modify the search path that KDE uses to locate its executables.

KDE klock allows local users to kill arbitrary processes by specifying an arbitrary PID in the .kss.pid file.

KDE kppp allows local users to create a directory in an arbitrary location via the HOME environmental variable.

Nestea variation of teardrop IP fragmentation denial of service.

Linux bdash game has a buffer overflow that allows local users to gain root access.

Denial of service of inetd on Linux through SYN and RST packets.

File creation and deletion, and remote execution, in the BSD line printer daemon (lpd).

Linux implementations of TFTP would allow access to files outside the restricted directory.

rpc.mountd on Linux, Ultrix, and possibly other operating systems, allows remote attackers to determine the existence of a file on the server by attempting to mount that file, which generates different error messages depending on whether the file exists or not.

Buffer overflow in run-time linkers (1) ld.so or (2) ld-linux.so for Linux systems allows local users to gain privileges by calling a setuid program with a long program name (argv[0]) and forcing ld.so/ld-linux.so to report an error.

The rwho/rwhod service is running, which exposes machine status and user information.

Denial of service in RPC portmapper allows attackers to register or unregister RPC services or spoof RPC services using a spoofed source IP address such as 127.0.0.1.

NFS cache poisoning.

rcp on various Linux systems including Red Hat 4.0 allows a "nobody" user or other user with UID of 65535 to overwrite arbitrary files, since 65535 is interpreted as -1 by chown and other system calls, which causes the calls to fail to modify the ownership of the file.

Denial of service in syslog by sending it a large number of superfluous messages.

The suidperl and sperl program do not give up root privileges when changing UIDs back to the original users, allowing root access.

Race condition in Linux mailx command allows local users to read user files.

Some configurations of NIS+ in Linux allowed attackers to log in as the user "+".