Ubuntu 4.10 / 5.04 : cpio vulnerabilities (USN-189-1)

Imran Ghory found a race condition in the handling of output files. While a file was unpacked with cpio, a local attacker with write permissions to the target directory could exploit this to change the permissions of arbitrary files of the cpio user. CAN-2005-1111 Imran Ghory discovered a path...

Ubuntu 4.10 / 5.04 : unzip vulnerability (USN-191-1)

Imran Ghory found a race condition in the handling of output files. While a file was unpacked by unzip, a local attacker with write permissions to the target directory could exploit this to change the permissions of arbitrary files of the unzip user. Note that Tenable Network Security has extract...

Ubuntu 4.10 / 5.04 : apache2, libapache-mod-ssl vulnerabilities (USN-177-1)

Apache did not honour the 'SSLVerifyClient require' directive within a block if the surrounding block contained a directive 'SSLVerifyClient optional'. This allowed clients to bypass client certificate validation on servers with the above configuration. CAN-2005-2700 Filip Sneppe discovered a...

Fedora Core 3 : mod_auth_pgsql-2.0.1-6.2 (2006-014)

Several format string flaws were found in the way modauthpgsql logs information. It may be possible for a remote attacker to execute arbitrary code as the 'apache' user if modauthpgsql is used for user authentication. The Common Vulnerabilities and Exposures project assigned the name CVE-2005-365...

[Full-disclosure] Ultimate Auction <=3.67

Hello! I've found a XSS in Ultimate Auction =3.67. The Vendor was informed mid October 2005! They still haven't fix the script and doesn't reply to mails. Here's a little Example: http://www.ultimate-auction.de/cgi-local/auktion/item.pl/item.pl?item=scriptalert"XSS"/script...

[KAPDA::#21] - HomeFtp v1.1 Denial of Service

KAPDA::21 - HomeFtp v1.1 Denial of Service KAPDA New advisory Vulnerable products : HomeFtp v1.1 Vendor: Helmsmanhttp://www.Frigate3.com Risk: High Vulnerabilities: Denial of service Date : -------------------- Found : Aug 21 2005 Vendor Contacted : Aug 21 2005 Release Date : Jan 14 2006 About...

CVE-2005-1939

Ipswitch WhatsUp Small Business (2004) has a directory traversal vulnerability in the Report service (TCP 8022). The issue stems from insufficient sanitization of HTTP requests, allowing an unauthenticated user to read arbitrary files on the target host by crafting requests with .. sequences. The...

Mandrake Linux Security Advisory : fetchmail (MDKSA-2005:209)

Thomas Wolff and Miloslav Trmac discovered a race condition in the fetchmailconf program. fetchmailconf would create the initial output configuration file with insecure permissions and only after writing would it change permissions to be more restrictive. During that time, passwords and other dat...

Mandrake Linux Security Advisory : gda2.0 (MDKSA-2005:203)

Steve Kemp discovered two format string vulnerabilities in libgda2, the GNOME Data Access library for GNOME2, which may lead to the execution of arbitrary code in programs that use this library. The updated packages have been patched to correct this issue. %NASLMINLEVEL 70300 C Tenable Network...

Fedora Core 4 : poppler-0.4.4-1.1 (2006-026)

Chris Evans discovered several flaws in the way poppler processes PDF files. An attacker could construct a carefully crafted PDF file that could cause poppler to crash or possibly execute arbitrary code when opened. The Common Vulnerabilities and Exposures project assigned the names CVE-2005-3624...

Mandrake Linux Security Advisory : apache2 (MDKSA-2005:233)

A memory leak in the worker MPM in Apache 2 could allow remote attackers to cause a Denial of Service memory consumption via aborted commands in certain circumstances, which prevents the memory for the transaction pool from being reused for other connections. As well, this update addresses two bu...

Mandrake Linux Security Advisory : clamav (MDKSA-2005:205)

A number of vulnerabilities were discovered in ClamAV versions prior to 0.87.1 : The OLE2 unpacker in clamd allows remote attackers to cause a DoS segfault via a DOC file with an invalid property tree CVE-2005-3239 The FSG unpacker allows remote attackers to cause 'memory corruption' and execute...

Mandrake Linux Security Advisory : mailman (MDKSA-2005:222)

Scrubber.py in Mailman 2.1.4 - 2.1.6 does not properly handle UTF8 character encodings in filenames of e-mail attachments, which allows remote attackers to cause a denial of service. CVE-2005-3573 In addition, these versions of mailman have an issue where the server will fail with an Overflow on...

CVE-2005-4651

The CVE-2005-4651 entry describes an SQL injection vulnerability in index.php of AlstraSoft EPay Pro 2.0, exploitable via the pmodule parameter to execute arbitrary SQL commands remotely. Affected component: index.php in AlstraSoft EPay Pro 2.0; root cause is injectable SQL through pmodule. Docum...

CVE-2005-3655

CVE-2005-3655 describes a heap-based buffer overflow in Novell Open Enterprise Server Remote Manager (novell-nrm) for SUSE Linux Enterprise Server 9. The vulnerability arises from improper handling of HTTP POST requests with a negative Content-Length, allowing an unauthenticated attacker to injec...

CVE-2005-4650

Joomla! 1.03 is affected by CVE-2005-4650: it does not restrict the number of "Search" Mambots, allowing remote attackers to cause denial of service through resource consumption. The issue is due to an unbounded count of Mambots. Connected advisories (e.g., Red Hat) corroborate the vulnerability ...

CVE-2005-4649

CVE-2005-4649 affects Advanced Guestbook 2.2 and 2.3.1, with XSS via (1) entry parameter in index.php and (2) gb_id in comment.php. Root cause: insufficient input sanitization on these parameters, allowing remote attackers to inject arbitrary HTML/JS. Index.php/entry vector may be related to CVE-...

Design/Logic Flaw

Unspecified vulnerability in Sun Solaris 10 allows local users to cause a denial of service null dereference via unspecified vectors involving the use of the find command on the "/proc" filesystem. NOTE: due to the vagueness of the vendor advisory, it is not clear whether this is related to...

[SECURITY] [DSA 940-1] New gpdf packages fix arbitrary code execution

-------------------------------------------------------------------------- Debian Security Advisory DSA 940-1 [email protected] http://www.debian.org/security/ Martin Schulze January 13th, 2006 http://www.debian.org/security/faq -...

[SECURITY] [DSA 940-1] New gpdf packages fix arbitrary code execution

-------------------------------------------------------------------------- Debian Security Advisory DSA 940-1 [email protected] http://www.debian.org/security/ Martin Schulze January 13th, 2006 http://www.debian.org/security/faq -...