licq as shipped with Red Hat Linux 7 is vulnerable to two security problems: An overrunnable buffer in its logging code, and an unguarded system() call to execute an external browser when receiving an URL.
When starting, joe looks for a configuration file in the current working directory, the user's home directory, and /etc/joe. A malicious user can use a symlink attack by putting a file in the cwd if it is world writable.
To browse through our weekly Linux Advisory Watch newsletters,