[SECURITY] [DSA 794-1] New polygen packages fix denial of service

-------------------------------------------------------------------------- Debian Security Advisory DSA 794-1 [email protected] http://www.debian.org/security/ Martin Schulze September 1st, 2005 http://www.debian.org/security/faq -...

[SECURITY] [DSA 793-1] New sqwebmail packages fix cross-site scripting

-------------------------------------------------------------------------- Debian Security Advisory DSA 793-1 [email protected] http://www.debian.org/security/ Martin Schulze September 1st, 2005 http://www.debian.org/security/faq -...

CVE-2005-0403

CVE-2005-0403 affects Red Hat Enterprise Linux 3 via the Red Hat backport of NPTL. The vulnerable code is in init_dev of tty_io.c , where controlling ttys are not properly cleared in multi‑threaded applications, enabling a local user to crash the system and potentially gain access to ttys through...

CVE-2005-2765

The CVE-2005-2765 entry concerns the Windows Firewall UI not properly displaying certain malformed Windows Registry entries. The underlying issue is an information-hiding condition that could enable attackers with already elevated (administrator) privileges to obscure activity when monitoring exc...

CVE-2005-0403

initdev in ttyio.c in the Red Hat backport of NPTL to Red Hat Enterprise Linux 3 does not properly clear controlling tty's in multi-threaded applications, which allows local users to cause a denial of service crash and possibly gain tty access via unknown attack vectors that trigger an access of ...

[SECURITY] [DSA 792-1] New pstotext packages fix arbitrary command execution

-------------------------------------------------------------------------- Debian Security Advisory DSA 792-1 [email protected] http://www.debian.org/security/ Martin Schulze August 31st, 2005 http://www.debian.org/security/faq -...

CVE-2005-2761

phpGroupWare suffers a global XSS in the main screen message (CVE-2005-2761). Affected: PhpGroupWare 0.9.16.000 era (and related components like Addressbook

iDEFENSE Security Advisory 08.29.05: Adobe Version Cue VCNative Arbitrary File Overwrite Vulnerability

Adobe Version Cue VCNative Arbitrary File Overwrite Vulnerability iDEFENSE Security Advisory 08.29.05 www.idefense.com/application/poi/display?id=297&type=vulnerabilities August 29, 2005 I. BACKGROUND Adobe Version Cue is a software version tracking system for Adobe products distributed with Adob...

CVE-2005-2655

lockmail in maildrop before 1.5.3 does not drop privileges before executing commands, which allows local users to gain privileges via command line arguments...

CVE-2005-2654

phpldapadmin before 0.9.6c allows remote attackers to gain anonymous access to the LDAP server, even when disableanonbind is set, via an HTTP request to login.php with the anonymousbind parameter set...

CVE-2005-2724

Cross-site scripting XSS vulnerability in SqWebMail 5.0.4 allows remote attackers to inject arbitrary web script or HTML via a file attachment that is processed by the Display feature. NOTE: the severity of this issue has been disputed by the developer...

CVE-2005-2737

Cross-site scripting XSS vulnerability in PhotoPost PHP Pro 5.1 allows remote attackers to inject arbitrary web script or HTML via EXIF data, such as the Camera Model Tag...

CVE-2005-2723

SQL injection vulnerability in auth.php in PaFileDB 3.1, when authmethod is set to cookies, allows remote attackers to execute arbitrary SQL commands via the username value in the pafiledbcookie cookie...

CVE-2005-2730

The HTTP proxy in Astaro Security Linux 6.0 allows remote attackers to obtain sensitive information via an invalid request, which reveals a Proxy-authorization string in an error message...

CVE-2005-2733

uploadimgcgi.php in Simple PHP Blog SPHPBlog does not properly restrict file extensions of uploaded files, which could allow remote attackers to execute arbitrary code...

CVE-2005-2724

Cross-site scripting XSS vulnerability in SqWebMail 5.0.4 allows remote attackers to inject arbitrary web script or HTML via a file attachment that is processed by the Display feature. NOTE: the severity of this issue has been disputed by the developer...

[SECURITY] [DSA 791-1] New maildrop packages fix arbitrary group mail command execution

-------------------------------------------------------------------------- Debian Security Advisory DSA 791-1 [email protected] http://www.debian.org/security/ Martin Schulze August 30th, 2005 http://www.debian.org/security/faq -...

[SECURITY] [DSA 790-1] New phpldapadmin packages fix unauthorised access

-------------------------------------------------------------------------- Debian Security Advisory DSA 790-1 [email protected] http://www.debian.org/security/ Martin Schulze August 30th, 2005 http://www.debian.org/security/faq -...

CVE-2005-2654

CVE-2005-2654 affects phpldapadmin prior to 0.9.6c, where an HTTP request to login.php with the anonymous_bind parameter can bypass disable_anon_bind and grant anonymous access to the LDAP server. Connected sources corroborate this flaw and link to affected releases and upstream advisories. Gento...

CVE-2005-2655

CVE-2005-2655 affects maildrop’s lockmail component; prior to version 1.5.3, it does not drop group privileges before executing commands, enabling local privilege escalation via command-line arguments. Debian’s DSA-791-1 fixes this by updating maildrop to 1.5.3-1.1sarge1 (stable) and 1.5.3-2 (sid...