Low: Red Hat Security Advisory: gdb security update

An updated gdb package that fixes several bugs and minor security issues is now available. This update has been rated as having low security impact by the Red Hat Security Response Team. GDB, the GNU debugger, allows debugging of programs written in C, C++, and other languages by executing them i...

Low: Red Hat Security Advisory: net-snmp security update

Updated net-snmp packages that fix two security issues and various bugs are now available. This update has been rated as having low security impact by the Red Hat Security Response Team. SNMP Simple Network Management Protocol is a protocol used for network management. A denial of service bug was...

Low: Red Hat Security Advisory: perl security update

Updated Perl packages that fix security issues and contain several bug fixes are now available for Red Hat Enterprise Linux 4. This update has been rated as having low security impact by the Red Hat Security Response Team. Perl is a high-level programming language commonly used for system...

CVE-2005-3154

CVE-2005-3154 is a format-string vulnerability in BitDefender Antivirus logging functionality (versions 7.2–9). The flaw arises when printing logging information for file/directory names, allowing a remote attacker to trigger a denial of service and potentially execute arbitrary code. Related adv...

CVE-2005-3137

CVE-2005-3137 affects cfengine 1.6.5 via insecure temporary file handling in cfmailfilter and cfcron.in, enabling a local user to exploit a symlink to overwrite arbitrary files owned by the executing user (likely root). Connected advisories (Debian DSA-835-1, DSA-836-1) document insecure temporar...

CVE-2005-3151

CVE-2005-3151 describes a buffer overflow in Blender Player 2.37a’s blenderplay component that can be triggered by a long command line argument, enabling attackers to potentially execute arbitrary code. The connected documents consistently identify this issue as a vulnerability in Blender Player ...

CVE-2005-3141

CVE-2005-3141 affects Cerulean Studios Trillian 3.0. A remote attacker can cause a crash (denial of service) by initiating a reverse direct connection from a different client, demonstrated using LICQ. The provided documents do not specify exact vulnerable components/versions beyond Trillian 3.0 o...

CVE-2005-3156

GuppY / EasyGuppY (Windows) versions 4.5.4 and 4.5.5 are vulnerable to a directory traversal in printfaq.php via the pg parameter. The input is cleansed for XSS but not for traversal, allowing reading of arbitrary files. Multiple references (NVD CVE-2005-3156, OpenVAS/Nessus plugin) confirm the i...

CVE-2005-3145

The CVE-2005-3145 issue affects sblim-sfcb (httpAdapter.c) where versions before 0.9.2 are vulnerable. Remote attackers can cause denial of service by establishing a connection to sblim-sfcb and not sending any data, leading to resource consumption. This is a network-based impact with no data exf...

CVE-2005-2961

CVE-2005-2961 affects ProZilla (notably 1.3.7.4 and possibly earlier) via a buffer overflow in get_string_ahref when -ftpsearch is enabled, allowing remote servers to execute arbitrary code through a crafted HREF in an A tag. Public records in NVD and Debian DSAs indicate a remote code execution ...

CVE-2005-3155

CVE-2005-3155 concerns a buffer overflow in the W3C logging functionality of MailEnable IMAPD. Publicly documented impact indicates remote code execution against MailEnable Professional 1.6 and earlier and MailEnable Enterprise 1.1 and earlier. Exploit references (Metasploit module and SAINT/pack...

CVE-2005-3153

login.php in myBloggie 2.1.3 beta and earlier allows remote attackers to bypass a whitelist regular expression and conduct SQL injection attacks via a username parameter with SQL after a null character, which causes the whitelist check to succeed but injects the SQL into a query string, a differe...

CVE-2005-3152

Multiple cross-site scripting XSS vulnerabilities in CubeCart 3.0.3 allow remote attackers to inject arbitrary web script or HTML via the redir parameter to 1 cart.php or 2 index.php, or 3 the searchStr parameter in a viewCat action to index.php. Note: vectors 1 and 2 were later reported to affec...

CVE-2005-3152

CubeCart XSS vulnerabilities (CVE-2005-3152) affect CubeCart 3.0.3 and later reports show impact extending to 3.0.7-pl1. The issues arise from failure to properly sanitize user input in scripts such as index.php and cart.php, enabling remote attackers to inject arbitrary HTML/JavaScript. Exploita...

CVE-2005-3142

The connected advisory CPAI-2005-306 documents a heap-based buffer overflow in the Kaspersky Antivirus library used by KAV/AV scanner products when processing CAB archives. Root cause: insufficient boundary checks on user-supplied data during archive processing. Impact: remote code execution and ...

CVE-2005-2966

CVE-2005-2966 concerns the Python SVG import plugin in dia (diasvg_import.py) affecting DIA 0.94 and earlier. A crafted SVG file could allow user‑assisted attackers to execute arbitrary Python code via the xfig/svg import path. Debian/DSA-847-1 and related advisories document three buffer‑overflo...

CVE-2005-3147

CVE-2005-3147 affects the storebackup utility. The backup root directory is created with world-readable permissions, enabling local users to access sensitive data. Debian's DSA-1022-1 confirms fixes in storebackup versions 1.18.4-2sarge1 (stable) and 1.19-2 (sid); OpenVAS and SUSE entries corrobo...

CVE-2005-0023

gnome-pty-helper in GNOME libzvt2 and libvte4 allows local users to spoof the logon hostname via a modified DISPLAY environment variable. NOTE: the severity of this issue has been disputed...

CVE-2005-3143

CVE-2005-3143 affects the Mailbox Server for 4D WebStar prior to 5.3.5. It allows denial-of-service (crash) via IMAP clients on Mac OS X Mail 2. The NVD/Nessus entries document the issue; no exploitation details are provided in the connected documents, and no remediation details are stated here.

CVE-2005-3138

CVE-2005-3138 affects Bugzilla 2.18rc1–2.18.3, 2.19–2.20rc2, and 2.21. An unauthorized remote attacker can retrieve sensitive information (e.g., the list of installed products) through the config.cgi endpoint, which remains accessible even when the requirelogin parameter is set. The underlying is...