[slackware-security] php

New php packages are available for Slackware 10.2, 11.0, 12.0, 12.1, and -current to fix security issues. Note that PHP5 is not the default PHP for Slackware 10.2 or 11.0 those use PHP4, so if your PHP code is not ready for PHP5, don't upgrade until it is or you'll by definition run into problems...

PHP path translation vulnerability

Overview PHP contains a path translation vulnerability that may allow an attacker to execute arbitrary code. Description PHP is a scripting language that is designed for web-based applications and can be imbedded directly into HTML.PHP versions prior to 5.2.6 contain a path translation...

CVE-2008-0599

The initrequestinfo function in sapi/cgi/cgimain.c in PHP before 5.2.6 does not properly consider operator precedence when calculating the length of PATHTRANSLATED, which might allow remote attackers to execute arbitrary code via a crafted URI...

CVE-2008-0599

CVE-2008-0599 affects PHP before 5.2.6. The vulnerability is in init_request_info within sapi/cgi/cgi_main.c where operator precedence mishandles the length calculation of PATH_TRANSLATED, enabling remote attackers to execute arbitrary code via a crafted URI. CVSSv3 base score 9.8 (CRITICAL; AV:N...

Debian: Security Advisory (DSA-967-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2008 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2007-0599

CVE-2007-0599 affects Aztek Forum 4.00 and represents a variable overwrite vulnerability in common/config.php. The issue allows remote attackers to overwrite arbitrary program variables and perform other unauthorized actions, such as copying arbitrary files, by abusing extract operations on the P...

CVE-2006-0599

CVE-2006-0599 affects the elog/elogd components in the Debian elog package prior to version 2.5.7+r1558-4. The vulnerability causes the system to emit different error messages for invalid passwords versus invalid usernames, enabling remote attackers to probe for valid usernames (information discl...

CVE-2005-0599

Cisco devices running Application and Content Networking System ACNS 4.x, 5.0, or 5.1 before 5.1.11.6 allow remote attackers to cause a denial of service CPU consumption via malformed IP packets...

CVE-2005-0599

CVE-2005-0599 affects Cisco Application and Content Networking System (ACNS) 4.x, 5.0, and 5.1 prior to 5.1.11.6. Exploitation by remote attackers via malformed IP packets can cause CPU exhaustion, leading to a denial of service on affected devices. A reboot is required to recover. Remediation: u...

CVE-2004-0955

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2004-0599. Reason: This candidate is a reservation duplicate of CVE-2004-0599 the first item listed in that candidate. Notes: All CVE users should reference CVE-2004-0599 instead of this candidate. All references and descriptions...

CVE-2004-0955

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2004-0599. Reason: This candidate is a reservation duplicate of CVE-2004-0599 the first item listed in that candidate. Notes: All CVE users should reference CVE-2004-0599 instead of this candidate. All references and descriptions...

CVE-2004-0599

Multiple integer overflows in the 1 pngreadpng in pngread.c or 2 pnghandlesPLT functions in pngrutil.c or 3 progressive display image reading capability in libpng 1.2.5 and earlier allow remote attackers to cause a denial of service application crash via a malformed PNG image...

CVE-2004-0599

Multiple integer overflows in the 1 pngreadpng in pngread.c or 2 pnghandlesPLT functions in pngrutil.c or 3 progressive display image reading capability in libpng 1.2.5 and earlier allow remote attackers to cause a denial of service application crash via a malformed PNG image...

CVE-2004-0955

CVE-2004-0955 is rejected/not used; reference CVE-2004-0599 instead.

Fedora Core 1 : libpng-1.2.5-7 (2004-237)

The libpng package contains a library of functions for creating and manipulating PNG Portable Network Graphics image format files. During a source code audit, Chris Evans discovered several buffer overflows in libpng. An attacker could create a carefully crafted PNG file in such a way that it wou...

Fedora Core 2 : libpng-1.2.5-8 (2004-239)

The libpng package contains a library of functions for creating and manipulating PNG Portable Network Graphics image format files. During a source code audit, Chris Evans discovered several buffer overflows in libpng. An attacker could create a carefully crafted PNG file in such a way that it wou...

CVE-2003-0599

Unknown vulnerability in the Virtual File System VFS capability for phpGroupWare 0.9.16preRC and versions before 0.9.14.004 with unknown implications, related to the VFS path being under the web document root...

CVE-2003-0599

CVE-2003-0599 concerns phpGroupWare (0.9.16preRC and all versions before 0.9.14.004). The vulnerability lies in the Virtual File System (VFS) capability, with the root cause described as the VFS path being under the web document root, and implications are stated as unknown. The advisory lists a h...

CVE-2002-0599

Blahz-DNS 0.2 and earlier is affected by CVE-2002-0599. The vulnerability allows remote attackers to bypass authentication and modify DNS configuration by directly requesting CGI programs (e.g., dostuff.php) instead of using the login screen. Affected component is the authentication/config flow; ...

CVE-2002-0599

Blahz-DNS 0.2 and earlier allows remote attackers to bypass authentication and modify configuration by directly requesting CGI programs such as dostuff.php instead of going through the login screen...