RHEL 2.1 : mailman (RHSA-2004:019)

Updated mailman packages that close a DoS vulnerability present in mailman versions prior to version 2.1 are now available. Mailman is a mailing list manager. Matthew Galgoci of Red Hat discovered a Denial of Service DoS vulnerability in versions of Mailman prior to 2.1. An attacker could send a...

RHEL 2.1 : apache (RHSA-2003:244)

Updated Apache and modssl packages that fix several minor security issues are now available for Red Hat Enterprise Linux. The Apache HTTP server is a powerful, full-featured, efficient, and freely-available Web server. Ben Laurie found a bug in the optional renegotiation code in modssl which can...

Mac OS X Safari Null Character Cookie Theft (Security Update 2003-12-05)

The remote host is missing Mac OS X Security Update 2003-12-05. This update fixes a flaw in the Safari web browser that may allow a rogue website to access the web cookies of the user of the remote host. C Tenable Network Security, Inc. if ! definedfunc"bnrandom" exit0; include"compat.inc";...

RHEL 2.1 : sendmail (RHSA-2003:284)

Updated Sendmail packages that fix a potentially-exploitable vulnerability are now available. Sendmail is a widely used Mail Transport Agent MTA and is included in all Red Hat Enterprise Linux distributions. There is a bug in the prescan function of Sendmail versions prior to and including 8.12.9...

RHEL 3 : net-snmp (RHSA-2004:023)

Updated Net-SNMP packages are available to correct a security vulnerability and other bugs. The Net-SNMP project includes various Simple Network Management Protocol SNMP tools. A security issue in Net-SNMP versions before 5.0.9 could allow an existing user/community to gain access to data in MIB...

RHEL 2.1 : kernel (RHSA-2003:389)

Updated kernel packages are now available that fix a security vulnerability allowing local users to gain root privileges. The Linux kernel handles the basic functions of the operating system. A flaw in bounds checking in the dobrk function in the Linux kernel versions 2.4.22 and previous can allo...

RHEL 2.1 / 3 : slocate (RHSA-2004:041)

Updated slocate packages are now available that fix vulnerabilities allowing a local user to gain 'slocate' group privileges. Slocate is a security-enhanced version of locate, designed to find files on a system via a central database. Patrik Hornik discovered a vulnerability in Slocate versions u...

RHEL 2.1 : fileutils (RHSA-2003:310)

Updated fileutils packages that close a potential denial of service vulnerability are now available. The fileutils package contains several basic system utilities. One of these utilities is the 'ls' program, which is used to list information about files and directories. Georgi Guninski discovered...

RHEL 2.1 : postgresql (RHSA-2003:314)

Updated PostgreSQL packages that correct a buffer overflow in the toascii routines are now available. PostgreSQL is an advanced Object-Relational database management system DBMS. Two bugs that can lead to buffer overflows have been found in the PostgreSQL abstract data type to ASCII conversion...

RHEL 2.1 / 3 : mod_python (RHSA-2004:058)

Updated modpython packages that fix a denial of service vulnerability are now available for Red Hat Enterprise Linux. modpython embeds the Python language interpreter within the Apache httpd server. A bug has been found in modpython versions 2.7.10 and earlier that can lead to a denial of service...

RHEL 3 : freeradius (RHSA-2003:386)

Updated FreeRADIUS packages are now available that fix a denial of service vulnerability. FreeRADIUS is an Internet authentication daemon, which implements the RADIUS protocol. It allows Network Access Servers NAS boxes to perform authentication for dial-up users. The raddecode function in...

Mac OS X Terminal Application Unspecified Issue (Security Update 2003-11-04)

The remote host is missing Mac OS X Security Update 2003-11-04. This update fixes a flaw in the Terminal application that may allow a rogue web site to access the web cookies of the user of the remote host. C Tenable Network Security, Inc. if ! definedfunc"bnrandom" exit0; include"compat.inc";...

CVE-2004-0199

Help and Support Center in Microsoft Windows XP and Windows Server 2003 SP1 does not properly validate HCP URLs, which allows remote attackers to execute arbitrary code, as demonstrated using certain hcp:// URLs that access the DVD Upgrade capability dvdupgrd.htm...

CVE-2003-1041

Internet Explorer 5.x and 6.0 allows remote attackers to execute arbitrary programs via a modified directory traversal attack using a URL containing ".." dot dot sequences and a filename that ends in "::" which is treated as a .chm file even if it does not have a .chm extension. NOTE: this bug ma...

CVE-2004-0202

IDirectPlay4 Application Programming Interface API of Microsoft DirectPlay 7.0a thru 9.0b, as used in Windows Server 2003 and earlier allows remote attackers to cause a denial of service application crash via a malformed packet...

CVE-2004-0204

CVE-2004-0204 describes a directory traversal in Crystal Reports and Crystal Enterprise Web viewers redistributed with Microsoft Visual Studio .NET 2003, Outlook 2003 with Business Contact Manager, and Microsoft Business Solutions CRM 1.2. The vulnerability arises from improper validation of HTTP...

MS04-016: Vulnerability in DirectPlay Could Allow Denial of Service (839643)

The remote host contains a version of DirectPlay that is vulnerable to a denial of service attack. DirectPlay is a component of DirectX and is frequently used by game developpers to create networked multi-player games. An attacker could exploit this flaw by sending a malformed IDirectPlay packet ...

Microsoft Security Bulletin MS04-017 Vulnerability in Crystal Reports Web Viewer Could Allow Information Disclosure and Denial of Service (842689)

Microsoft Security Bulletin MS04-017 Vulnerability in Crystal Reports Web Viewer Could Allow Information Disclosure and Denial of Service 842689 Issued: June 8, 2004 Version: 1.0 Summary Who should read this document: Customers who use Microsoft® Visual Studio .NET 2003, who use Microsoft Office...

SOL3066 - OpenSSH buffer management vulnerability - CA-2003-24

For information about this vulnerability, refer to...

CVE-2003-1044

CVE-2003-1044 affects Bugzilla 2.16.3 and earlier where, when usebuggroups is enabled, deleting a group fails to remove its group add privileges. This allows users with those privileges to perform unauthorized additions to the next group assigned the original group ID. The root cause is improper ...