The type of st_rdev changes depending on the arch, on i386 is int, on others long unsigned.
Considering the context I prefer to believe it wont overflow instead of adding complex
conditionals.
CVE-2008-0983 (Medium) :
lighttpd 1.4.18, and possibly other versions before 1.5.0, does not properly calculate the size of a
file descriptor array, which allows remote attackers to cause a denial of service (crash) via a large
number of connections, which triggers an out-of-bounds access.
CVE-2008-1111 (Medium) :
mod_cgi in lighttpd 1.4.18 sends the source code of CGI scripts instead of a 500 error when a
fork failure occurs, which might allow remote attackers to obtain sensitive information.
CVE-2008-1270 (Medium) :
mod_userdir in lighttpd 1.4.18 and earlier, when userdir.path is not set, uses a default of $HOME,
which might allow remote attackers to read arbitrary files, as demonstrated by accessing the
~nobody directory.
CVE-2008-1199 (Medium) :
Dovecot before 1.0.11, when configured to use mail_extra_groups to allow Dovecot to create
dotlocks in /var/mail, might allow local users to read sensitive mail files for other users, or modify
files or directories that are writable by group, via a symlink attack.
CVE-2008-1218 (Medium) :
Argument injection vulnerability in Dovecot 1.0.x before 1.0.13, and 1.1.x before 1.1.rc3, when using
blocking passdbs, allows remote attackers to bypass the password check via a password
containing TAB characters, which are treated as argument delimiters that enable the
skip_password_check field to be specified.
Instead of simply copying the 'ip_vs.h' header file we apply a patch that
assures the installation of a 'sanitized' version while building the
linux-header package.
Alejandro Mery
Christian Wiese
Aldas Nabazas