GnuTLS堆溢出及拒绝服务漏洞

BUGTRAQ ID: 29292 CVECAN ID: CVE-2008-1948,CVE-2008-1949,CVE-2008-1950 GnuTLS是用于实现TLS加密协议的函数库。 GnuTLS在处理各种畸形TLS报文时存在多个安全漏洞，可能导致拒绝服务或完全入侵运行该库应用程序所在的操作系统。 如果用户所发送的Client Hello消息包含有Server Name扩展的话，就可能在lib/extservername.c文件的gnutlsservernamerecvparams函数中触发堆溢出，导致执行任意代码。...

Debian DSA-1581-1 : gnutls13 - several vulnerabilities

Several remote vulnerabilities have been discovered in GNUTLS, an implementation of the SSL/TLS protocol suite. NOTE: The libgnutls13 package, which provides the GNUTLS library, does not contain logic to automatically restart potentially affected services. You must restart affected services...

Fedora 8 : gnutls-1.6.3-3.fc8 (2008-4183)

Fixes critical security issue GNUTLS-SA-2008-1 described here: http://lists.gnu.org/archive/html/gnutls-devel/2008-05/msg00060.html All applications and system services which utilize gnutls library must be restarted for the updates to take effect. Note that Tenable Network Security has extracted...

Fedora 7 : gnutls-1.6.3-3.fc7 (2008-4274)

Fixes critical security issue GNUTLS-SA-2008-1 described here: http://lists.gnu.org/archive/html/gnutls-devel/2008-05/msg00060.html All applications and system services which utilize gnutls library must be restarted for the updates to take effect. Note that Tenable Network Security has extracted...

BELL-CVE-2008-1950 CVE-2008-1950 does not affect BellSoft software

Bulletin has no description...

CVE-2008-1950

CVE-2008-1950 affects the GnuTLS stack (libgnutls) with an integer signedness flaw in _gnutls_ciphertext2compressed, exploitable via a crafted Random field in an encrypted Client Hello within a TLS record with invalid Record Length. This can trigger a buffer over-read and cause a denial of servic...

[SECURITY] [DSA 1581-1] New gnutls13 packages fix potential code execution

------------------------------------------------------------------------ Debian Security Advisory DSA-1581-1 [email protected] http://www.debian.org/security/ Florian Weimer May 20, 2008 http://www.debian.org/security/faq -...

Critical: Red Hat Security Advisory: gnutls security update

Updated gnutls packages that fix several security issues are now available for Red Hat Enterprise Linux 5. This update has been rated as having critical security impact by the Red Hat Security Response Team. The GnuTLS Library provides support for cryptographic algorithms and protocols such as TL...

DSA-1581-1 gnutls13 - potential code execution

Bulletin has no description...

CVE-2007-1950

Cross-site scripting XSS vulnerability in indexcms.php in WebBlizzard CMS allows remote attackers to inject arbitrary web script or HTML via the Suchzeile parameter...

CVE-2007-1950

CVE-2007-1950 describes a cross-site scripting (XSS) vulnerability in WebBlizzard CMS, specifically in the file index_cms.php where the Suchzeile parameter accepts user input without proper sanitization. This allows remote attackers to inject arbitrary web script or HTML. The available documents ...

CVE-2006-1950

CVE-2006-1950 describes multiple cross-site scripting (XSS) vulnerabilities in banners.cgi of PerlCoders BannerFarm 2.3 and earlier. The issue allows remote attackers to inject arbitrary web script or HTML via the (1) aff and (2) cat parameters. The affected component is the banners.cgi script wi...

WebHints remote command execution flaw

The remote version of the WebHints scripts is vulnerable to remote command execution flaw through the script SPDX-FileCopyrightText: 2005 David Maciejak Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifie...

CVE-2002-1950

The CVE-2002-1950 entry concerns a Cross-site Scripting (XSS) flaw in phpRank 1.8. The vulnerability allows remote attackers to inject arbitrary web script or HTML through (1) the email parameter of add.php or (2) the banurl parameter in the main list. The provided documents do not specify affect...

CVE-2005-1950

The CVE-2005-1950 entry concerns WebHints 1.03, where the hints.pl script allows remote command execution by passing shell metacharacters in the argument. OpenVAS entries corroborate a remote command execution flaw in the remote WebHints scripts, describing an exploitable condition that enables a...

WebHints hints.pl Arbitrary Command Execution

The remote host is running the WebHints scripts. This version of WebHints has a remote command execution vulnerability in hints.pl. A remote attacker could exploit this to execute arbitrary commands on the system. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

CVE-2004-1950

The CVE documents a vulnerability in phpBB 2.0.8a and earlier where the application trusts the IP address provided in the X-Forwarded-For HTTP header. This mis-trust lets remote attackers spoof the user’s apparent IP address. Affected software: phpBB 2.0.8a and older. Root cause: server-side code...