Heap-based buffer overflow in the env_opt_add function in telnet.c for various BSD-based Telnet clients allows remote attackers to execute arbitrary code via responses that contain a large number of characters that require escaping, which consumers more memory than allocated.
http://www.ubuntulinux.org/usn/usn-224-1
http://www.securityfocus.com/bid/12919
http://www.redhat.com/support/errata/RHSA-2005-330.html
http://www.redhat.com/support/errata/RHSA-2005-327.html
http://www.mandriva.com/security/advisories?name=MDKSA-2005:061
http://www.kb.cert.org/vuls/id/341908
http://www.debian.org/security/2005/dsa-703
http://www.debian.de/security/2005/dsa-731
http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2005-001-telnet.txt
http://sunsolve.sun.com/search/document.do?assetkey=1-26-57761-1
http://sunsolve.sun.com/search/document.do?assetkey=1-26-57755-1
http://sunsolve.sun.com/search/document.do?assetkey=1-26-101671-1
http://sunsolve.sun.com/search/document.do?assetkey=1-26-101665-1
http://secunia.com/advisories/17899
http://secunia.com/advisories/14745
http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000962