[SECURITY] [DSA 988-1] New squirrelmail packages fix several vulnerabilities

-------------------------------------------------------------------------- Debian Security Advisory DSA 988-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff March 8th, 2006 http://www.debian.org/security/faq -...

DSA-988-1 squirrelmail - several

Bulletin has no description...

CVE-2006-0188

webmail.php in SquirrelMail 1.4.0 to 1.4.5 allows remote attackers to inject arbitrary web pages into the right frame via a URL in the rightframe parameter. NOTE: this has been called a cross-site scripting XSS issue, but it is different than what is normally identified as XSS...

CVE-2005-0188

CVE-2005-0188 concerns a format-string vulnerability in the SetBaseURL function of the AtHoc toolbar. The issue allows remote attackers to execute arbitrary code by supplying an invalid URL that is recorded in the debug log, leveraging format specifiers. Public references in NVD/CVE records indic...

CVE-2005-0188

Format string vulnerability in the SetBaseURL function in AtHoc toolbar allows remote attackers to execute arbitrary code via format string specifiers in an invalid URL that is recorded in the debug log...

CVE-2005-0188

Format string vulnerability in the SetBaseURL function in AtHoc toolbar allows remote attackers to execute arbitrary code via format string specifiers in an invalid URL that is recorded in the debug log...

CVE-2004-0188

Calife (affected: 2.8.5 and earlier) contains a heap-based buffer overflow that could allow a local user to execute arbitrary code via a long password. Debian’s advisory DSA-461-1 documents this issue and indicates a security update is required for Calife packages; OpenVAS entry confirms the Debi...

CVE-2002-0188

Affected software: Microsoft Internet Explorer 5.01 and 6.0. The vulnerability arises from incorrect handling of Content-Disposition and Content-Type header fields, causing the spoofed file type to be passed to the OS for handling instead of triggering an error. This can enable remote code execut...

CVE-2002-0188

Microsoft Internet Explorer 5.01 and 6.0 allow remote attackers to execute arbitrary code via malformed Content-Disposition and Content-Type header fields that cause the application for the spoofed file type to pass the file back to the operating system for handling rather than raise an error...

CVE-2004-0188

Heap-based buffer overflow in Calife 2.8.5 and earlier may allow local users to execute arbitrary code via a long password...

CVE-2004-0188

Heap-based buffer overflow in Calife 2.8.5 and earlier may allow local users to execute arbitrary code via a long password...

CVE-2003-0188

lv reads a .lv file from the current working directory, which allows local users to execute arbitrary commands as other lv users by placing malicious .lv files into other directories...

CVE-2003-0188

lv reads a .lv file from the current working directory, which allows local users to execute arbitrary commands as other lv users by placing malicious .lv files into other directories...

CVE-2003-0188

lv reads a .lv file from the current working directory, which allows local users to execute arbitrary commands as other lv users by placing malicious .lv files into other directories...

CVE-2003-0188

CVE-2003-0188: lv, a multilingual file viewer, reads a .lv configuration file from the current working directory. A crafted .lv file placed in a directory can cause lv to execute arbitrary commands as the invoking user, enabling local privilege escalation (including root) on affected systems. Pub...

CVE-2003-0188

lv reads a .lv file from the current working directory, which allows local users to execute arbitrary commands as other lv users by placing malicious .lv files into other directories...

[RHSA-2003:169-01] Updated lv packages fix vulnerability

--------------------------------------------------------------------- Red Hat Security Advisory Synopsis: Updated lv packages fix vulnerability Advisory ID: RHSA-2003:169-01 Issue date: 2003-05-16 Updated on: 2003-05-16 Product: Red Hat Linux Keywords: local root exploit Cross references:...

CVE-2001-0188

GoodTech FTP server 3.0.1.2.1.0 and earlier allows remote attackers to cause a denial of service via a flood of connections to the server, which causes it to crash...

CVE-2001-0188

Affected software: GoodTech FTP Server for Windows. Vulnerability: denial-of-service via a flood of connections that causes the server to crash (CVE-2001-0188, affected versions 3.0.1.2.1.0 and earlier). Evidence: multiple sources describe an DoS condition from rapid/abusive connection attempts; ...

CVE-2000-0188

EZShopper 3.0’s search.cgi is vulnerable to directory traversal and command injection. Remote attackers can read arbitrary files via a .. path and may execute shell commands through metacharacters. The Nessus entry also mentions directory traversal in loadpage.cgi and possible arbitrary command e...