? .vuln.xml.swp ? work Index: vuln.xml =================================================================== RCS file: /home/pcvs/ports/security/vuxml/vuln.xml,v retrieving revision 1.1333 diff -u -r1.1333 vuln.xml --- vuln.xml 31 May 2007 08:05:11 -0000 1.1333 +++ vuln.xml 1 Jun 2007 19:28:23 -0000 @@ -34,6 +34,38 @@ --> + + findutils -- GNU locate heap buffer overrun + + + findutils + 4.2.31 + + + + +

James Youngman reports:

+
When GNU locate reads filenames from an old-format locate database, + they are read into a fixed-length buffer allocated on the heap. + Filenames longer than the 1026-byte buffer can cause a buffer overrun. + The overrunning data can be chosen by any person able to control the + names of filenames created on the local system. This will normally + include all local users, but in many cases also remote users (for + example in the case of FTP servers allowing uploads).
+

+ + + + CVE-2007-2452 + http://lists.gnu.org/archive/html/bug-findutils/2007-06/msg00000.html + + + 2007-05-30 + 2007-06-01 + + + FreeType 2 -- Heap overflow vulnerability