CVE-2005-3357

CVE-2005-3357 affects mod_ssl in Apache 2.0 up to 2.0.55; when using an SSL vhost with access control and a custom 400 error page, a non-SSL request to an SSL port can trigger a NULL pointer dereference, causing a denial of service. Remediation/version is not specified in the provided documents.

CVE-2005-3625

CVE-2005-3625 is confirmed to affect Xpdf and related tools (gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor, etc.). The issue is a denial-of-service in PDF stream handling where streams that end prematurely can cause an infinite loop, demonstrated for the CCITTFaxDecode and DCTDecode s...

CVE-2005-3626

CVE-2005-3626 affects Xpdf and related components (gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor, etc.). The vulnerability arises from a crafted FlateDecode stream that triggers a null dereference, leading to a denial of service (crash). The connected Nessus entry (NEWSTART_CGSL_NS-SA...

Code injection

gdi/driver.c and gdi/printdrv.c in Wine 20050930, and other versions, implement the SETABORTPROC GDI Escape function call for Windows Metafile WMF files, which allows attackers to execute arbitrary code, the same vulnerability as CVE-2005-4560 but in a different codebase...

DEBIAN-CVE-2006-0106

gdi/driver.c and gdi/printdrv.c in Wine 20050930, and other versions, implement the SETABORTPROC GDI Escape function call for Windows Metafile WMF files, which allows attackers to execute arbitrary code, the same vulnerability as CVE-2005-4560 but in a different codebase...

CVE-2005-4624

CVE-2005-4624 affects PTnet ircd versions 1.5 and 1.6. The vulnerability is in the m_join function of channel.c, where a flood of join requests to a “charmed channel” (e.g., PTnet, #PTnoticias, #*.log) can exhaust memory and cause the ircd daemon to restart. Affected component: m_join handling in...

CVE-2005-4625

Technical details (affected components, root cause, impact, versions, fixes) are not provided in the connected documents. Monitor for updates.

CVE-2005-4620

Technical details about CVE-2005-4620 are not publicly available in the provided documents. Monitor for updates.

CVE-2005-3538

HylaFAX vulnerability CVE-2005-3538 affects hfaxd when PAM support is disabled, allowing remote attackers to login with arbitrary passwords and potentially gain privileges. Connected sources confirm the issue is limited to HylaFAX 4.2.3 with PAM disabled and indicate that a fix was released in Hy...

CVE-2005-3656

CVE-2005-3656 describes a format-string vulnerability in mod_auth_pgsql used for authenticating against PostgreSQL. The flaw in logging functions could enable remote, unauthenticated code execution with the httpd user. Affected modules include libapache2-mod-auth-pgsql; multiple advisories (Red H...

CVE-2005-4085

CVE-2005-4085 describes a remote code execution vulnerability in Blue Coat WinProxy (and related ProxyAV web console) caused by a buffer overflow when processing a long Host header. Affected: WinProxy prior to 6.1a; ProxyAV web console prior to 2.4.2.3. Root cause: buffer overflow overwrites SEH ...

CVE-2005-4626

Technical details for CVE-2005-4626 are not publicly available in the provided documents; the connected records do not confirm affected product versions, root cause, or remediation. Monitor for updates.

CVE-2005-4621

CVE-2005-4621 concerns a cross-site scripting (XSS) vulnerability in the editavatar page of vBulletin 3.5.1. The vulnerability allows remote attackers to inject arbitrary web script or HTML via a URL provided in the remote avatar URL field, with the URL potentially triggering a parsing error and ...

CVE-2005-4623

CVE-2005-4623 affects eFileGo 3.01 where upload.exe can be driven to a denial of service (CPU consumption) by supplying an invalid directory name. The vulnerability is described across multiple sources as enabling remote DoS via a crafted argument. No explicit exploitation details, affected versi...

CVE-2005-3539

CVE-2005-3539 affects HylaFAX up to version 4.2.x (notably 4.2.3 and earlier). The root cause is evaluation of untrusted input in HylaFAX components: the notify script and crafted CallID parameters to faxrcvd, enabling remote attackers to execute arbitrary commands with the HylaFAX server privile...

CVE-2005-4622

The CVE-2005-4622 entry describes a directory traversal vulnerability in eFileGo 3.01. The risk stems from an input handling flaw that allows an attacker to traverse directories and execute arbitrary code, read arbitrary files, and upload arbitrary files via a crafted request (notably in the URL ...

CVE-2005-4627

CVE-2005-4627 is a cross-site scripting (XSS) vulnerability described for index.php affecting GmailSite 1.0–1.0.4 and GFHost 0.1.1–0.4.2. The issue allows remote attackers to inject arbitrary web script or HTML via the lng parameter, impacting confidentiality/ integrity of affected sessions as pe...

mod_auth_pgsql security update

CentOS Errata and Security Advisory CESA-2006:0164 Updated modauthpgsql packages that fix format string security issues are now available for Red Hat Enterprise Linux 3 and 4. This update has been rated as having critical security impact by the Red Hat Security Response Team. The modauthpgsql...

CVE-2005-3654

WinProxy

CVE-2005-3187

Blue Coat WinProxy vulnerable to remote denial of service via an excessively long HTTP request that triggers an out-of-bounds read. Affected: WinProxy prior to 6.1a (the vendor released 6.1a to address the issue). Exploitation observed as a crafted GET request containing a long payload (e.g., 32k...