[slackware-security] php5

New php5 packages are available for Slackware 10.2, 11.0, and -current to fix security issues. PHP5 was considered a test package in Slackware 10.2, and an "extra" package in Slackware 11.0. If you are currently running PHP4 you may wish to stick with that, as upgrading to PHP5 will probably...

USN-455-1: PHP vulnerabilities

Stefan Esser discovered multiple vulnerabilities in the "Month of PHP bugs". The substrcompare function did not sufficiently verify its length argument. This might be exploited to read otherwise unaccessible memory, which might lead to information disclosure. CVE-2007-1375 The shared memory shmop...

CVE-2007-1900

CVE-2007-1900 describes a CRLF injection vulnerability in the PHP 5.2.0–5.2.1 FILTER_VALIDATE_EMAIL filter, enabling context-dependent attackers to inject arbitrary email headers by including a newline in the address. The cited advisories indicate this affects PHP up to 5.2.1; a PHP 5.2.3 release...

Microsoft Windows Universal PnP memory corruption

Memory corruption during TCP/2869 and UDP/1900 request processing...

Computer Associates BrightStor ARCserve Backup LGSERVER.EXE stack buffer overflow

Overview Computer Associates BrightStor ARCserve Backup contains a stack buffer overflow, which may allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system. Description Computer Associates BrightStor ARCserve Backup products come with a service called LGSERVER.EX...

ARCserve Backup for Laptops & Desktops Server Admin Service Detection

BrightStor ARCserve Backup for Laptops & Desktops Server formerly BrightStor Mobile Backup Server, an enterprise class backup solution for remote and mobile Windows-based PCs, is installed on the remote host. And the service listening on this port is used by the application's Server Explorer to...

CVE-2007-0449

Multiple buffer overflows in LGSERVER.EXE in CA BrightStor ARCserve Backup for Laptops and Desktops r11.0 through r11.1 SP1, Mobile Backup r4.0, Desktop and Business Protection Suite r2, and Desktop Management Suite DMS r11.0 and r11.1 allow remote attackers to execute arbitrary code via crafted...

CVE-2007-0449

CVE-2007-0449 pertains to a stack/heap buffer overflow in LGSERVER.EXE of CA BrightStor ARCserve Backup products. A remote, unauthenticated attacker could send crafted packets to 1900/tcp or 2200/tcp to trigger arbitrary code execution (often with SYSTEM privileges) or cause a DoS. Affected produ...

Cisco products contain hard-coded SNMP values

Overview Certain versions of the Cisco IOS software have a hard-coded SNMP read-write community string that cannot be changed by an administrator. Description Some versions of the Cisco IOS have a hardcoded SNMP read-write community string. This community string is designed to ensure that...

DOCSIS Read-Write Community String Enabled in Non-DOCSIS Platforms

A vulnerability exists in certain Cisco IOS ® software release trains running on the Cisco IAD2400 series, 1900 Series Mobile Wireless Edge Routers and Cisco VG224 Analog Phone Gateways. Vulnerable versions may contain a default hard-coded Simple Network Management Protocol SNMP community string...

Cisco Security Advisory: DOCSIS Read-Write Community String Enabled in Non-DOCSIS Platforms

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Cisco Security Advisory: DOCSIS Read-Write Community String Enabled in Non-DOCSIS Platforms Document ID: 71255 Advisory ID: cisco-sa-20060920-docsis http://www.cisco.com/warp/public/707/cisco-sa-20060920-docsis.shtml Revision 1.0 For Public Release 20...

CVE-2006-3687

Stack-based buffer overflow in the Universal Plug and Play UPnP service in D-Link DI-524, DI-604 Broadband Router, DI-624, D-Link DI-784, WBR-1310 Wireless G Router, WBR-2310 RangeBooster G Router, and EBR-2310 Ethernet Broadband Router allows remote attackers to execute arbitrary code via a long...

CVE-2006-3687

Stack-based buffer overflow in the Universal Plug and Play UPnP service in D-Link DI-524, DI-604 Broadband Router, DI-624, D-Link DI-784, WBR-1310 Wireless G Router, WBR-2310 RangeBooster G Router, and EBR-2310 Ethernet Broadband Router allows remote attackers to execute arbitrary code via a long...

D-Link Routers - UPNP Buffer Overflow

D-Link Routers - UPNP Buffer Overflow source: https://www.securityfocus.com/bid/19006/info D-Link wired and wireless routers are prone to a buffer-overflow vulnerability because these devices fail to properly bounds-check user-supplied input before copying it to an insufficiently sized memory...

D-Link Routers - UPNP Buffer Overflow

source: https://www.securityfocus.com/bid/19006/info D-Link wired and wireless routers are prone to a buffer-overflow vulnerability because these devices fail to properly bounds-check user-supplied input before copying it to an insufficiently sized memory buffer. Successful exploits can allow...

CVE-2006-1900

Multiple buffer overflows in World Wide Web Consortium W3C Amaya 9.4, and possibly other versions including 8.x before 8.8.5, allow remote attackers to execute arbitrary code via a long value in 1 the COMPACT attribute of the COLGROUP element, 2 the ROWS attribute of the TEXTAREA element, and 3 t...

CVE-2006-1900

CVE-2006-1900 affects the World Wide Web Consortium (W3C) Amaya browser, with multiple buffer overflows in Amaya 9.4 and possibly earlier 8.x versions (pre-8.8.5). The vulnerability arises from boundary errors in parsing attribute values, enabling remote attackers to execute arbitrary code via lo...

CVE-2002-1900

Cross-site scripting XSS vulnerability in Pinboard 1.0 allows remote attackers to inject arbitrary web script or HTML via tasklists...

CVE-2002-1900

This CVE reports a Cross-site scripting (XSS) vulnerability in Pinboard 1.0, exploitable by remote attackers to inject arbitrary web script or HTML via tasklists. The connected documents do not provide additional technical specifics such as exact vulnerable component details beyond the applicatio...

CVE-2005-1900

The vulnerability CVE-2005-1900 affects Sawmill prior to 7.1.6, where an authenticated, remote attacker can bypass authentication to (1) gain administrative privileges or (2) add a license. The connected NASL entry confirms the affected range as Sawmill