Mandrake Linux Security Advisory : apache2 (MDKSA-2004:135)

A vulnerability in apache 2.0.35-2.0.52 was discovered by Chintan Trivedi; he found that by sending a large amount of specially- crafted HTTP GET requests, a remote attacker could cause a Denial of Service on the httpd server. This vulnerability is due to improper enforcement of the field length...

Mandrake Linux Security Advisory : sudo (MDKSA-2004:133)

Liam Helmer discovered a flow in sudo's environment sanitizing. This flaw could allow a malicious users with permission to run a shell script that uses the bash shell to run arbitrary commands. The problem is fixed in sudo 1.6.8p2; the provided packages have been patched to correct the issue...

CVE-2004-1035

Multiple integer signedness errors in 1 imapcommon.c, 2 main.c, 3 request.c, and 4 select.c for up-imapproxy IMAP proxy 1.2.2 allow remote attackers to cause a denial of service server crash and possibly leak sensitive information via certain literal values that are not properly handled when usin...

CVE-2004-1331

The execCommand method in Microsoft Internet Explorer 6.0 SP2 allows remote attackers to bypass the "File Download - Security Warning" dialog and save arbitrary files with arbitrary extensions via the SaveAs command...

CVE-2004-1034

Buffer overflow in the httpopen function in Kaffeine before 0.5, whose code is also used in gxine before 0.3.3, allows remote attackers to cause a denial of service application crash and possibly execute arbitrary code via a long Content-Type header for a Real Audio Media .ram playlist file...

CVE-2004-1034

Buffer overflow in the httpopen function in Kaffeine before 0.5, whose code is also used in gxine before 0.3.3, allows remote attackers to cause a denial of service application crash and possibly execute arbitrary code via a long Content-Type header for a Real Audio Media .ram playlist file...

CVE-2004-1038

CVE-2004-1038 describes a design error in the IEEE1394 (FireWire) specification that can allow attackers with physical access to read/write sensitive memory via a modified FireWire client, bypassing intended access restrictions. The issue is a local vulnerability in the FireWire stack that could ...

CVE-2004-0892

CVE-2004-0892 describes a spoofing vulnerability in ISA Server 2000 and Proxy Server 2.0 (also in Small Business Server 2000/2003 Premium) where reverse-DNS cache results can be manipulated to spoof trusted Internet content on a crafted page. Connected data confirms the bug exists in these produc...

CVE-2004-0892

Microsoft Proxy Server 2.0 and Microsoft ISA Server 2000 which is included in Small Business Server 2000 and Small Business Server 2003 Premium Edition allows remote attackers to spoof trusted Internet content on a specially crafted webpage via spoofed reverse DNS lookup results...

CVE-2004-1034

CVE-2004-1034 describes a buffer overflow in Kaffeine (before 0.5) whose code is also used in gxine (before 0.3.3) triggered by a long Content-Type header for a Real Audio .ram playlist. The overflow occurs in the http_open function and can cause a denial of service (application crash) and potent...

CVE-2004-1036

CVE-2004-1036 affects SquirrelMail prior to versions 1.4.3a and earlier, and 1.5.1-cvs before 23 Oct 2004. The vulnerability is a cross-site scripting (XSS) flaw in the decoding of encoded text in certain headers within mime.php, enabling remote attackers to run arbitrary web script or HTML in th...

CVE-2004-1038

A design error in the IEEE1394 specification allows attackers with physical access to a device to read and write to sensitive memory using a modified FireWire/IEEE 1394 client, thus bypassing intended restrictions that would normally require greater degrees of physical access to exploit. NOTE: th...

CVE-2004-1035

CVE-2004-1035 affects up-imapproxy IMAP proxy version 1.2.2. The vulnerability is described as multiple integer signedness errors in imapcommon.c, main.c, request.c, and select.c, allowing remote attackers to cause a denial of service (server crash) and possibly leak sensitive information via cer...

Multiple AntiVirus (zip file) Detection Bypass Exploit

Exploit for multiple platform in category local exploits ====================================================== Multiple AntiVirus zip file Detection Bypass Exploit ====================================================== / zipbrk.c - Proof-of-Concept for CAN-2004-0932 - CAN-2004-0937 Copyright C...

GLSA-200411-20 : ez-ipupdate: Format string vulnerability

The remote host is affected by the vulnerability described in GLSA-200411-20 ez-ipupdate: Format string vulnerability Ulf Harnhammar from the Debian Security Audit Project discovered a format string vulnerability in ez-ipupdate. Impact : An attacker could exploit this to execute arbitrary code wi...

RHEL 3 : httpd (RHSA-2004:562)

Updated httpd packages that include fixes for two security issues, as well as other bugs, are now available. The Apache HTTP server is a powerful, full-featured, efficient, and freely-available Web server. An issue has been discovered in the modssl module when configured to use the 'SSLCipherSuit...

RHEL 2.1 / 3 : libxml2 (RHSA-2004:615)

An updated libxml2 package that fixes multiple buffer overflows is now available. libxml2 is a library for manipulating XML files. Multiple buffer overflow bugs have been found in libxml2 versions prior to 2.6.14. If an attacker can trick a user into passing a specially crafted FTP URL or FTP pro...

CVE-2004-1315

viewtopic.php in phpBB 2.x before 2.0.11 improperly URL decodes the highlight parameter when extracting words and phrases to highlight, which allows remote attackers to execute arbitrary PHP code by double-encoding the highlight value so that special characters are inserted into the result, which...

Debian DSA-559-1 : net-acct - insecure temporary file

Stefan Nordhausen has identified a local security hole in net-acct, a user-mode IP accounting daemon. Old and redundant code from some time way back in the past created a temporary file in an insecure fashion. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package...

Debian DSA-574-1 : cabextract - missing directory sanitising

The upstream developers discovered a problem in cabextract, a tool to extract cabinet files. The program was able to overwrite files in upper directories. This could lead an attacker to overwrite arbitrary files. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and packag...