Debian DSA-2408-1 : php5 - several vulnerabilities

Several vulnerabilities have been discovered in PHP, the web scripting language. The Common Vulnerabilities and Exposures project identifies the following issues : - CVE-2011-1072 It was discovered that insecure handling of temporary files in the PEAR installer could lead to denial of service. -...

SuSE 10 Security Update : PHP5 (ZYPP Patch Number 7553)

This update for PHP5 fixes the following security issues : - Input Validation in the ZIP extension and NumberFormatter. CWE-20, CVE-2011-0421 / CVE-2011-1470 / CVE-2011-1467 - Numeric Errors in the SHM support and ZIP extension. CWE-189, CVE-2011-1092 / CVE-2011-1471 - Buffer overflows in the...

SuSE 11.1 Security Update : PHP5 (SAT Patch Number 4663)

This PHP5 update fixes : - CVE-2011-0421: CVSS v2 Base Score: 2.6 AV:N/AC:H/Au:N/C:N/I:N/A:P: Input Validation CWE-20 - CVE-2011-1092: CVSS v2 Base Score: 5.1 AV:N/AC:H/Au:N/C:P/I:P/A:P: Numeric Errors CWE-189 - CVE-2011-1148: CVSS v2 Base Score: 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P: Resource Managemen...

Ubuntu 6.06 LTS / 8.04 LTS / 9.10 / 10.04 LTS / 10.10 / 11.04 : php5 regressions (USN-1126-2)

USN 1126-1 fixed several vulnerabilities in PHP. The fix for CVE-2010-4697 introduced an incorrect reference counting regression in the Zend engine that caused the PHP interpreter to segfault. This regression affects Ubuntu 6.06 LTS and Ubuntu 8.04 LTS. The fixes for CVE-2011-1072 and CVE-2011-11...

Ubuntu 6.06 LTS / 8.04 LTS / 9.10 / 10.04 LTS / 10.10 / 11.04 : php5 vulnerabilities (USN-1126-1)

Stephane Chazelas discovered that the /etc/cron.d/php5 cron job for PHP 5.3.5 allows local users to delete arbitrary files via a symlink attack on a directory under /var/lib/php5/. CVE-2011-0441 Raphael Geisert and Dan Rosenberg discovered that the PEAR installer allows local users to overwrite...

Mandriva Update for php MDVSA-2011:052 (php)

The remote host is missing an update for the SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptxrefname:"URL",...

CVE-2011-1464

CVE-2011-1464 affects PHP prior to 5.3.6. It is described as a buffer overflow in the strval function triggered when the precision configuration option has a large value, potentially causing a denial of service (application crash) with a small numeric argument. Affected product: PHP (versions bef...

CVE-2010-1464

Multiple cross-site scripting XSS vulnerabilities in WebAsyst Shop-Script FREE allow remote attackers to inject arbitrary web script or HTML via the 1 currencyidleft, 2 currencyidright, 3 darkcolor, 4 lightcolor, 5 middlecolor, and 6 w parameters...

CVE-2010-1464

The CVE-2010-1464 entry describes multiple reflected XSS vulnerabilities in WebAsyst Shop-Script FREE, exploitable via the parameters currency_id_left, currency_id_right, darkcolor, lightcolor, middlecolor, and w. The underlying issue is an XSS input handling weakness that permits remote attacker...

CVE-2009-1464

CVE-2009-1464 involves CSRF vulnerabilities in index.aas of Application Access Server (A-A-S) 2.0.48 that allow remote attackers to hijack administrator authentication and trigger actions such as executing arbitrary commands, stopping services, or terminating processes via specific jobs. The vuln...

FreeBSD Ports: ethereal*, tethereal*

The remote host is missing an update to the system as announced in the referenced advisory. SPDX-FileCopyrightText: 2008 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

SuSE 10 Security Update : inkscape (ZYPP Patch Number 3061)

Several format string problems where fixed in inkscape. - A format string vulnerability in Inkscape allows user-assisted remote attackers to execute arbitrary code via format string specifiers in a URI, which is not properly handled by certain dialogs. CVE-2007-1463 - Format string vulnerability ...

CVE-2007-1464

CVE-2007-1464 refers to a format-string vulnerability in Inkscape’s Jabber whiteboard protocol (remote code execution) and is accompanied by CVE-2007-1463 describing a separate format-string issue in Inkscape URIs. Affected product: Inkscape (pre-0.45.1). Root cause: improper handling of format s...

CVE-2007-1464

Format string vulnerability in the whiteboard Jabber protocol in Inkscape before 0.45.1 allows user-assisted remote attackers to execute arbitrary code via unspecified vectors...

CVE-2007-1464

Format string vulnerability in the whiteboard Jabber protocol in Inkscape before 0.45.1 allows user-assisted remote attackers to execute arbitrary code via unspecified vectors...

CentOS 3 / 4 : ethereal (CESA-2005:427)

Updated Ethereal packages that fix various security vulnerabilities are now available. This update has been rated as having moderate security impact by the Red Hat Security Response Team. The ethereal package is a program for monitoring network traffic. A number of security flaws have been...

Apple QuickTime MPEG-4 movie buffer overflow

Overview Apple QuickTime fails to properly handle MPEG-4 movie files. This vulnerability may allow a remote, unauthenticated attacker to execute arbitrary code or cause a denial of service condition. Description Apple's QuickTime Player is multimedia software that allows users to view local and...

CVE-2006-1464

CVE-2006-1464 is a buffer overflow in Apple QuickTime before 7.1 that enables a remote attacker to execute arbitrary code by supplying a crafted MPEG-4 (M4P) video file. The CERT entry corroborates that both Mac OS X and Windows QuickTime installations are affected, with the vulnerability trigger...

CVE-2005-1464

CVE-2005-1464 is listed among multiple vulnerabilities in Ethereal up to version 0.10.11 that allow a remote attacker to cause a denial of service (infinite loop). The connected advisories confirm Ethereal upgrades to version 0.10.11 as a remediation. The exact root cause per-CVE isn’t detailed i...

CVE-2001-1464

Crystal Reports vulnerability: when displaying data for a password-protected database via HTML pages, it embeds the username and password in cleartext in the HTML content and in the URL, allowing remote attackers to obtain passwords. Affected: Crystal Reports HTML rendering for password-protected...