[SECURITY] [DSA 879-1] New gallery packages fix privilege escalation

-------------------------------------------------------------------------- Debian Security Advisory DSA 879-1 [email protected] http://www.debian.org/security/ Martin Schulze November 2nd, 2005 http://www.debian.org/security/faq -...

CVE-2005-3409

OpenVPN 2.x is affected by CVE-2005-3409 (pre-2.0.4). The issue is a denial-of-service caused by forcing accept() to return an error, which leads to a NULL pointer dereference in the exception handler, potentially crashing the service. The vulnerability affects OpenVPN servers operating in TCP mo...

Mandrake Linux Security Advisory : php-imap (MDKSA-2005:194)

'infamous41md' discovered a buffer overflow in uw-imap, the University of Washington's IMAP Server that allows attackers to execute arbitrary code. php-imap is compiled against the static c-client libs from imap. These packages have been recompiled against the updated imap development packages...

DSA-880-1 phpmyadmin - several

Bulletin has no description...

CVE-2005-3426

Cisco CSS 11500 Content Services Switch (CSS) with SSL termination services is affected by CVE-2005-3426. The vulnerability allows remote attackers to trigger a denial of service via memory corruption during SSL session negotiation when a malformed client certificate is presented. The entry notes...

Mandrake Linux Security Advisory : nss_ldap (MDKSA-2005:190)

A bug was found in the way the pamldap module processed certain failure messages. If the server includes supplemental data in an authentication failure result message, but the data does not include any specific error code, the pamldap module would proceed as if the authentication request had...

Mandrake Linux Security Advisory : perl-Compress-Zlib (MDKSA-2005:196)

The perl Compress::Zlib module contains an internal copy of the zlib library that was vulnerable to CVE-2005-1849 and CVE-2005-2096. This library was updated with version 1.35 of Compress::Zlib. An updated perl-Compress-Zlib package is now available to provide the fixed module. %NASLMINLEVEL 7030...

GLSA-200510-25 : Ethereal: Multiple vulnerabilities in protocol dissectors

The remote host is affected by the vulnerability described in GLSA-200510-25 Ethereal: Multiple vulnerabilities in protocol dissectors There are numerous vulnerabilities in versions of Ethereal prior to 0.10.13, including: The SLIM3 and AgentX dissectors could overflow a buffer CVE-2005-3243...

[SA17383] Ringtail CaseBook Cross-Site Scripting and Username Enumeration

TITLE: Ringtail CaseBook Cross-Site Scripting and Username Enumeration SECUNIA ADVISORY ID: SA17383 VERIFY ADVISORY: http://secunia.com/advisories/17383/ CRITICAL: Less critical IMPACT: Cross Site Scripting, Exposure of system information WHERE: From remote SOFTWARE: Ringtail CaseBook 6.x...

Lynx <= 2.8.6dev.13 Remote Buffer Overflow Exploit (port bind)

Exploit for linux platform in category remote exploits ============================================================== Lynx xwings 14:21 wanna fuck 14:21 mark: sure 14:21 sweet 14:21 mark gets his lingerie Why lynx ? I guess ... I am bored ... :p Metasploit Port Bind Shellcode , Port : 3964...

CVE-2005-3427

The CVE-2005-3427 issue affects Cisco’s Management Center (MC) for IPS Sensors (IPS MC) version 2.1. The vulnerability arises when port field values are omitted while generating the Cisco IOS IPS configuration file, which can cause some signatures to be disabled and may make detection easier to e...

CVE-2005-3425

Cross-site scripting XSS vulnerability in GNUMP3D before 2.9.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2005-3424...

CVE-2005-3424

Cross-site scripting XSS vulnerability in GNUMP3D before 2.9.5 allows remote attackers to inject arbitrary web script or HTML via 404 error pages, a different vulnerability than CVE-2005-3425...

CVE-2005-3425

Cross-site scripting XSS vulnerability in GNUMP3D before 2.9.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2005-3424...

CVE-2005-3424

Summary of CVE-2005-3424 (GNUMP3d) : A cross-site scripting (XSS) vulnerability affecting GNUMP3d prior to 2.9.5 (some sources mention up to 2.9.6) enables remote attackers to inject arbitrary web script or HTML, via crafted 404 error pages. The issue is documented alongside CVE-2005-3425 (a sepa...

CVE-2005-3425

CVE-2005-3425 is an XSS vulnerability in gnump3d prior to version 2.9.6 . Remote attackers could inject arbitrary web script or HTML via unspecified vectors, potentially compromising the victim’s browser. The CVE is discussed across multiple advisories (Debian/DSA-877-1, SUSE, Gentoo GLSA 200511-...

CVE-2005-3419

SQL injection vulnerability in usercpregister.php in phpBB 2.0.17 allows remote attackers to execute arbitrary SQL commands via the signaturebbcodeuid parameter, which is not properly initialized...

CVE-2005-3418

Multiple cross-site scripting XSS vulnerabilities in phpBB 2.0.17 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 errormsg parameter to usercpregister.php, 2 forwardpage parameter to login.php, and 3 listcat parameter to search.php, which are not initialized as...

CVE-2005-3416

phpBB 2.0.17 and earlier, when registerglobals is enabled and the sessionstart function has not been called to handle a session, allows remote attackers to bypass security checks by setting the $SESSION and $HTTPSESSIONVARS variables to strings instead of arrays, which causes an arraymerge functi...

CVE-2005-3420

usercpregister.php in phpBB 2.0.17 allows remote attackers to modify regular expressions and execute PHP code via the signaturebbcodeuid parameter, as demonstrated by injecting an "e" modifier into a pregreplace statement...