Slackware Linux vulnerabilities

CVE-2000-0314 [MEDIUM] CVE-2000-0314: traceroute in NetBSD 1.3.3 and Linux systems allows local users to flood other systems by providing traceroute in NetBSD 1.3.3 and Linux systems allows local users to flood other systems by providing traceroute with a large waittime (-w) option, which is not parsed properly and sets the time delay for sending packets to zero.

CVE-1999-1095 [HIGH] CVE-1999-1095: sort creates temporary files and follows symbolic links, which allows local users to modify arbitrar sort creates temporary files and follows symbolic links, which allows local users to modify arbitrary files that are writable by the user running sort, as observed in updatedb and other programs that use sort.

CVE-1999-1445 [MEDIUM] CVE-1999-1445: Vulnerability in imapd and ipop3d in Slackware 3.4 and 3.3 with shadowing enabled, and possibly othe Vulnerability in imapd and ipop3d in Slackware 3.4 and 3.3 with shadowing enabled, and possibly other operating systems, allows remote attackers to cause a core dump via a short sequence of USER and PASS commands that do not provide valid usernames or passwords.

CVE-1999-1422 [HIGH] CVE-1999-1422: The default configuration of Slackware 3.4, and possibly other versions, includes . (dot, the curren The default configuration of Slackware 3.4, and possibly other versions, includes . (dot, the current directory) in the PATH environmental variable, which could allow local users to create Trojan horse programs that are inadvertently executed by other users.

CVE-2000-0315 [MEDIUM] CVE-2000-0315: traceroute in NetBSD 1.3.3 and Linux systems allows local unprivileged users to modify the source ad traceroute in NetBSD 1.3.3 and Linux systems allows local unprivileged users to modify the source address of the packets, which could be used in spoofing attacks.

CVE-1999-0856 [MEDIUM] CVE-1999-0856: login in Slackware 7.0 allows remote attackers to identify valid users on the system by reporting an login in Slackware 7.0 allows remote attackers to identify valid users on the system by reporting an encryption error when an account is locked or does not exist.

CVE-2004-0881 [LOW] CVE-2004-0881: getmail 4.x before 4.2.0, and other versions before 3.2.5, when run as root, allows local users to w getmail 4.x before 4.2.0, and other versions before 3.2.5, when run as root, allows local users to write files in arbitrary directories via a symlink attack on subdirectories in the maildir.

CVE-1999-1187 [MEDIUM] CVE-1999-1187: Pine before version 3.94 allows local users to gain privileges via a symlink attack on a lockfile th Pine before version 3.94 allows local users to gain privileges via a symlink attack on a lockfile that is created when a user receives new mail.

CVE-2004-0880 [LOW] CVE-2004-0880: getmail 4.x before 4.2.0, when run as root, allows local users to overwrite arbitrary files via a sy getmail 4.x before 4.2.0, when run as root, allows local users to overwrite arbitrary files via a symlink attack on an mbox file.

CVE-1999-0123 [LOW] CVE-1999-0123: Race condition in Linux mailx command allows local users to read user files. Race condition in Linux mailx command allows local users to read user files.

CVE-2004-0231 [LOW] CVE-2004-0231: Multiple vulnerabilities in Midnight Commander (mc) before 4.6.0, with unknown impact, related to "I Multiple vulnerabilities in Midnight Commander (mc) before 4.6.0, with unknown impact, related to "Insecure temporary file and directory creations."

CVE-2007-0823 [LOW] CVE-2007-0823: xterm on Slackware Linux 10.2 stores information that had been displayed for a different user accoun xterm on Slackware Linux 10.2 stores information that had been displayed for a different user account using the same xterm process, which might allow local users to bypass file permissions and read other users' files, or obtain other sensitive information, by reading the xterm process memory. NOTE: it could be argued that this is an expected consequence of multi