Ubuntu 4.10 / 5.04 / 5.10 : mozilla-firefox, firefox vulnerabilities (USN-271-1)

Web pages with extremely long titles caused subsequent launches of Firefox browser to hang for up to a few minutes, or caused Firefox to crash on computers with insufficient memory. CVE-2005-4134 Igor Bukanov discovered that the JavaScript engine did not properly declare some temporary variables...

Cross site scripting

Cross-site scripting XSS vulnerability in awstats.pl in AWStats 6.5 and earlier allows remote attackers to inject arbitrary web script or HTML via the config parameter. NOTE: this might be the same core issue as CVE-2005-2732...

CVE-2005-4786

The CVE-2005-4786 issue is a buffer overflow in the ALZ archive decompression in vrAZMain.dll (version 5.8.22.137) used by HAURI antivirus products (ViRobot Expert 4.0, ViRobot Advanced Server, HAURI LiveCall). It can allow user‑assisted attackers to execute arbitrary code by processing an ALZ ar...

BrightStor ARCserve Backup discovery service buffer overflow

Added: 04/19/2006 CVE: CVE-2005-2535 BID: 12536 OSVDB: 13814 Background The BrightStor ARCserve Backup server includes a discovery service which listens on ports 41523/TCP and 41524/UDP. Problem A buffer overflow in the discovery service allows remote attackers to execute arbitrary commands...

BrightStor ARCserve Backup discovery service buffer overflow

Added: 04/19/2006 CVE: CVE-2005-2535 BID: 12536 OSVDB: 13814 Background The BrightStor ARCserve Backup server includes a discovery service which listens on ports 41523/TCP and 41524/UDP. Problem A buffer overflow in the discovery service allows remote attackers to execute arbitrary commands...

CVE-2005-4785

CVE-2005-4785 describes a Cross-site scripting (XSS) vulnerability in QuickBlogger 1.4 and earlier. The flaw allows remote attackers to inject arbitrary web script or HTML via the (1) author field and (2) the comment section. The documented impact includes partial integrity compromise of affected...

CVE-2005-4780

CVE-2005-4780 affects Fidra Lighthouse CMS 1.1.0 and earlier. The vulnerability is a cross-site scripting (XSS) flaw that could allow remote attackers to inject arbitrary web script or HTML via the search parameter in the query string on the home page. The vendor disputes the issue, arguing Light...

CVE-2005-4780

Cross-site scripting XSS vulnerability in Fidra Lighthouse CMS 1.1.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the search parameter in a querystring to the home page. NOTE: The vendor disputes this issue, saying "Lighthouse does not in any way make use of the...

CVE-2005-4783

CVE-2005-4783 concerns NetBSD kernels where kernfs_xread in kernfs_vnops.c fails to check for a negative offset when reading the message buffer. This lack of validation allows local users to read arbitrary kernel memory. The description specifies impact as a local information disclosure, affectin...

CVE-2005-4784

CVE-2005-4784 involves multiple buffer overflows in the POSIX readdir_r function. The root cause is a race condition between opendir and pathconf, enabling a symlink attack that can move the filesystem to a state with a longer maximum directory-entry name length, or programmer-introduced errors o...

CVE-2005-4777

CVE-2005-4777 affects Tashcom ASPEdit 2.9, where the administration/FTP password is stored in cleartext in the Windows registry, enabling local users to view it. The vulnerability arises from cleartext storage in the registry; no fix/mitigation details are provided in the supplied documents. Expl...

CVE-2005-4776

CVE-2005-4776 describes an integer overflow in the NetBSD FreeBSD compatibility code (freebsd_misc.c) affecting NetBSD-current, NetBSD-3, NetBSD-2.0, and NetBSD-2 prior to 20050913, and NetBSD-1.6 prior to 20050914. This vulnerability could allow local users to cause a denial of service via heap ...

CVE-2005-4775

CVE-2005-4775 affects Contineo 2.0; when the admin account lacks an e-mail attribute, a warning upon page reload displays the password hash. This could let remote attackers view the hash. No remediation details are provided in the supplied documents.

CVE-2005-4778

The CVE-2005-4778 entry concerns SUSE Linux 10.0 (before 20051007). A configuration problem in the powersave daemon is described as allowing local users to suspend the computer and potentially perform other unauthorized actions. The available documents do not specify the underlying root cause, th...

CVE-2005-4774

The provided data identifies CVE-2005-4774 as a cross-site scripting (XSS) vulnerability in Xerver 4.17. The vulnerability allows remote attackers to inject arbitrary web script or HTML after a /%00/ sequence at the end of the URI, potentially affecting users who view the modified URL. The initia...

CVE-2005-4773

Technical details, affected products, and exploit information for CVE-2005-4773 are not publicly provided in the connected documents. Monitor for updates from trusted sources.

[SECURITY] [DSA 1033-1] New horde3 packages fix several vulnerabilities

-------------------------------------------------------------------------- Debian Security Advisory DSA 1033-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff April 12th, 2006 http://www.debian.org/security/faq -...

Mandrake Linux Security Advisory : sash (MDKSA-2006:070)

Tavis Ormandy of the Gentoo Security Project discovered a vulnerability in zlib where a certain data stream would cause zlib to corrupt a data structure, resulting in the linked application to dump core CVE-2005-2096. Markus Oberhumber discovered additional ways that a specially crafted compresse...

[SECURITY] [DSA 946-2] New sudo packages fix privilege escalation

-------------------------------------------------------------------------- Debian Security Advisory DSA 946-2 [email protected] http://www.debian.org/security/ Martin Schulze April 8th, 2006 http://www.debian.org/security/faq -...

[SECURITY] [DSA 946-2] New sudo packages fix privilege escalation

-------------------------------------------------------------------------- Debian Security Advisory DSA 946-2 [email protected] http://www.debian.org/security/ Martin Schulze April 8th, 2006 http://www.debian.org/security/faq -...