Mike Oconnor

A null pointer dereference in `ftpd/popen.c` may lead to remote denial of service of the ftpd service. The issue is related to an uncontrolled resource consumption in the ftpd component. This can be exploited by a remote attacker to cause a denial of service.

SQL injection vulnerability in Domain Technologie Control (DTC) before 0.34.1 allows remote authenticated users to execute arbitrary SQL commands via the addrlink parameter to shared/inc/forms/domain info.php. NOTE: CVE-2011-3197 has been SPLIT due to findings by different researchers. CVE-2011-5272 has been assigned for the vps note parameter to dtcadmin/logPushlet.php vector.

The issue allows remote authenticated users to execute arbitrary SQL commands. This is achieved via the `vps note` parameter to the "dtcadmin/logPushlet.php" endpoint.

The issue in Domain Technologie Control (DTC) allows context-dependent users to gain privileges more easily due to the install script granting sudo permissions for chrootuid to the dtc user.

The issue concerns the `sys mbind` function in `mempolicy.c`, which fails to perform a sanity check on the `maxnod` variable before proceeding with computations for the `get nodes` function. The impact and attack vectors of this issue are not explicitly stated.

The default installation of Horde contains an administrative account with a blank password, allowing remote attackers to gain access.

The issue concerns multiple vulnerabilities in the Linux kernel of Debian GNU/Linux, which can lead to a breach of confidentiality, integrity, and availability of protected information. These vulnerabilities can be exploited remotely. Additionally, a local user can cause a denial of service (system crash) on Itanium (ia64) architectures in Linux kernel 2.6 using the `unw unwind to user` function.