tetex security update

CentOS Errata and Security Advisory CESA-2006:0160-01 Updated tetex packages that fix several integer overflows are now available. This update has been rated as having moderate security impact by the Red Hat Security Response Team. TeTeX is an implementation of TeX. TeX takes a text file and a se...

apache security update

CentOS Errata and Security Advisory CESA-2006:0158-01 Updated Apache httpd packages that correct a security issue are now available for Red Hat Enterprise Linux 2.1. This update has been rated as having moderate security impact by the Red Hat Security Response Team. The Apache HTTP Server is a...

CVE-2005-4672

The CVE-2005-4672 entry describes a cross-site scripting (XSS) flaw in CityPost Simple Image-Editor 0.52, specifically in image-editor-52/index.php. The vulnerability allows remote attackers to inject arbitrary web script or HTML via one of five parameters: m1, m2, m3, imgsrc, or m4. The affected...

CVE-2005-4675

CVE-2005-4675 describes a Cross-site scripting (XSS) vulnerability in list.php of the product Complete PHP Counter, exploitable via the c parameter to inject arbitrary web script or HTML. The available connected documents confirm the affected component (list.php) and the vulnerable input (the c p...

CVE-2005-4673

The CVE-2005-4673 entry concerns ioFTPD version 0.5.84u, where the login reply differs depending on whether a username exists, enabling remote attackers to enumerate valid usernames. This is the core vulnerability: user enumeration via auth responses. The provided documents do not specify a fix o...

CVE-2005-4671

Technical details about CVE-2005-4671 are not publicly available in the provided connected documents. Monitor for updates.

CVE-2005-4670

Technical details about CVE-2005-4670 are not publicly provided in the connected documents. The description remains the only explicit detail; monitor for updates for affected products, versions, and fixes.

[SECURITY] [DSA 958-1] New drupal packages fix several vulnerabilities

-------------------------------------------------------------------------- Debian Security Advisory DSA 958-1 [email protected] http://www.debian.org/security/ Martin Schulze January 27th, 2006 http://www.debian.org/security/faq -...

[Full-disclosure] [ MDKSA-2006:023 ] - Updated perl-Net_SSLeay packages fix vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDKSA-2006:023 http://www.mandriva.com/security/ Package : perl-NetSSLeay Date : January 26, 2006 Affected: 10.1, 10.2, 2006.0, Corporate 3.0 Problem Description: Javier Fernandez-Sanguino Pena discovered that the perl...

CVE-2005-4669

The CVE-2005-4669 entry concerns RT Internet Solutions (RTIS) WebAdmin with a SQL injection vulnerability in the login fields (username and password). Affected component is the WebAdmin interface; root cause is improper handling of input in the authentication form, enabling arbitrary SQL executio...

CVE-2005-4668

Technical specifics for CVE-2005-4668 (ParosProxy/HSQLDB) are not provided in the supplied connected documents. Monitor for updates.

[SECURITY] [DSA 957-1] New ImageMagick packages fix arbitrary command execution

-------------------------------------------------------------------------- Debian Security Advisory DSA 957-1 [email protected] http://www.debian.org/security/ Martin Schulze January 26th, 2006 http://www.debian.org/security/faq -...

[SECURITY] [DSA 957-1] New ImageMagick packages fix arbitrary command execution

-------------------------------------------------------------------------- Debian Security Advisory DSA 957-1 [email protected] http://www.debian.org/security/ Martin Schulze January 26th, 2006 http://www.debian.org/security/faq -...

CVE-2005-4667

CVE-2005-4667 is a vulnerability in the unzip utility where a buffer overflow can occur in command line argument handling (long filename) that could allow arbitrary code execution. The issue is reported in Unzip 5.50 and earlier and is exploitable when unzip processes crafted long file name argum...

[SECURITY] [DSA 953-1] New flyspray packages fix cross-site scripting

-------------------------------------------------------------------------- Debian Security Advisory DSA 953-1 [email protected] http://www.debian.org/security/ Martin Schulze January 24th, 2006 http://www.debian.org/security/faq -...

Trend Micro ServerProtect Management Console isaNVWRequest.dll chunked POST buffer overflow

Added: 01/24/2006 CVE: CVE-2005-1929 BID: 15865 OSVDB: 21771 Background ServerProtect is a virus scanner for servers. Problem A buffer overflow in ServerProtect Management Console could allow a remote attacker to execute commands using a chunked POST request to isaNVWRequest.dll. Resolution Use t...

QuickTime JPEG buffer overflow

Added: 01/24/2006 CVE: CVE-2005-2340 BID: 16212 OSVDB: 22335 Background QuickTime is a media player for Windows and Mac OS platforms. Problem A buffer overflow in QuickTime allows command execution when a user opens a specially crafted JPEG file. Resolution Upgrade to QuickTime 7.0.4 or higher...

CVE-2005-3628

CVE-2005-3628 is a buffer overflow in JBIG2Bitmap::JBIG2Bitmap in JBIG2Stream.cc of Xpdf (and derivatives like gpdf, kpdf, pdftohtml, poppler, etc.). The vulnerability could allow attackers to modify memory and potentially execute arbitrary code. OpenVAS/Slackware/Debian OpenVAS entries reference...

CVE-2005-3356

CVE-2005-3356 is a kernel vulnerability in Linux 2.6.x where the mq_open system call can be tricked into decrementing an internal counter twice, potentially leading to a kernel panic and local denial of service. The connected documents describe the root cause as a faulty sequence in mntput/dentry...

CVE-2005-3653

CVE-2005-3653 describes a heap-based buffer overflow in the CA iTechnology iGateway service, caused by insufficient boundary checks of the HTTP Content-Length header. An unauthenticated remote attacker can send a crafted HTTP request with a negative Content-Length to trigger a heap overflow, pote...