Debian DSA-967-1 Critical: Elog Remote Code Execution and DoS

"GroundZero Security" discovered that elog insufficiently checks the
size of a buffer used for processing URL parameters, which might lead
to the execution of arbitrary code.

CVE-2006-0347

It was discovered that elog contains a directory traveral vulnerability
in the processing of "../" sequences in URLs, which might lead to
information disclosure.

CVE-2006-0348

The code to write the log file contained a format string vulnerability,
which might lead to the execution of arbitrary code.

CVE-2006-0597

Overly long revision attributes might trigger a crash due to a buffer
overflow.

CVE-2006-0598

The code to write the log file does not enforce bounds checks properly,
which might lead to the execution of arbitrary code.

CVE-2006-0599

elog emitted different errors messages for invalid passwords and invalid
users, which allows an attacker to probe for valid user names.

CVE-2006-0600

An attacker could be driven into infi...