[SECURITY] [DSA 761-1] New heartbeat packages fix insecure temporary files

-------------------------------------------------------------------------- Debian Security Advisory DSA 761-1 [email protected] http://www.debian.org/security/ Martin Schulze July 19th, 2005 http://www.debian.org/security/faq -...

CVE-2005-2303

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2005-1218. Reason: This candidate is a duplicate of CVE-2005-1218. Notes: All CVE users should reference CVE-2005-1218 instead of this candidate. All references and descriptions in this candidate have been removed to prevent...

CVE-2005-2304

The CVE-2005-2304 entry concerns Microsoft MSN Messenger 9.0 and Internet Explorer 6.0, where processing an image with an ICC Profile that has a large Tag Count can cause a denial of service (crash). The vulnerability is rooted in image handling in these products, enabling a remote attacker to tr...

CVE-2005-2317

Shorewall 2.4.x before 2.4.1, 2.2.x before 2.2.5, and 2.0.x before 2.0.17, when MACLISTTTL is greater than 0 or MACLISTDISPOSITION is set to ACCEPT, allows remote attackers with an accepted MAC address to bypass other firewall rules or policies...

CVE-2005-1850

Certain contributed scripts for ekg Gadu Gadu client 1.5 and earlier create temporary files insecurely, with unknown impact and attack vectors, a different vulnerability than CVE-2005-1916...

CVE-2005-2320

WebCalendar (PHP-based calendar) before 1.0.0 contains an access-control flaw in assistant_edit.php that can let remote attackers gain privileges. Affected versions are WebCalendar prior to 1.0.0; multiple advisories (Debian DSA-766-1, Red Hat CVE note) confirm an unauthorized-access/privilege di...

CVE-2005-2303

...

CVE-2005-2326

CVE-2005-2326 is a Cross-site scripting (XSS) vulnerability in Clever Copy 2.0 and 2.0a that allows remote attackers to inject arbitrary web script or HTML via the yr parameter to calendar.php. The NVD entry provides a MEDIUM severity (CVSSv2 base score 4.3) with network access and no authenticat...

CVE-2005-2306

The CVE describes a race condition in Macromedia JRun 4.0 and ColdFusion MX 6.1/7.0 where under heavy load JRun may assign a duplicate authentication token to multiple sessions. This could allow authenticated users to gain privileges as other users. Affected components include JRun 4.0 and ColdFu...

CVE-2005-2308

The CVE-2005-2308 entry affects Microsoft Internet Explorer's JPEG decoding component. The provided documents describe a denial-of-service condition (CPU consumption or crash) and the possibility of arbitrary code execution triggered by specially crafted JPEG images (examples: mov_fencepost.jpg, ...

CVE-2005-2319

CVE-2005-2319 describes a PHP remote file include vulnerability in the Yawp library (version 1.0.6 and earlier) as used in YaWiki and potentially other products. The issue allows attackers to include arbitrary files via the parameter _Yawp[conf_path] . Affected software: Yawp library 1.0.6 and ol...

CVE-2005-2324

Cross-site scripting XSS vulnerability in Clever Copy 2.0 and 2.0a allows remote attackers to inject arbitrary web script or HTML via the searchtype or searchterm parameters to 1 results.php or 2 categorysearch.php...

CVE-2005-2311

CVE-2005-2311 affects SMS 1.9.2m and earlier. The vulnerability is a local file overwrite via a symlink attack on temporary files (request1 or request2), caused by improper handling of symbolic links in the temporary file paths. Impact is local privilege concerns (I = PARTIAL) with no confidentia...

CVE-2005-1850

CVE-2005-1850 concerns ekg Gadu Gadu client (contributed scripts) with insecure temporary file creation in version 1.5 and earlier. Connected entries also reference CVE-2005-1851 (potential shell command injection) and CVE-2005-1916 (insecure temp file creation plus arbitrary command execution) i...

CVE-2005-1851

CVE-2005-1851 affects the ekg Gadu-Gadu client and its contributed scripts. Umbrella advisories describe insecure temporary file handling and a shell command injection path in contributed scripts (including ekgbot-pre1.py), which could allow an attacker to execute arbitrary commands with the priv...

CVE-2005-2322

CVE-2005-2322 describes a cross-site scripting (XSS) vulnerability in the PHP-based forum software Class-1 Forum (versions 0.24.4 and 0.23.2) and in Clever Copy when used with forums. According to the provided documents, the issue allows remote attackers to inject arbitrary web script or HTML by ...

CVE-2005-2324

CVE-2005-2324 affects Clever Copy 2.0 and 2.0a. The vulnerability is a Cross-site Scripting (XSS) flaw that allows remote attackers to inject arbitrary web script or HTML via the searchtype or searchterm parameters to (1) results.php or (2) categorysearch.php. The cited sources confirm the vulner...

CVE-2005-2298

CVE-2005-2298 affects BitDefender Engine versions 1.6.1 and earlier. The issue arises because the scanner does not properly process all email attachments: begin and end commands in the message body are treated as a uuencoded attachment, causing scanning to stop prematurely. This allows remote att...

CVE-2005-2318

Concrete details exist: CVE-2005-2318 is an XSS vulnerability in DVBBS 7.1 SP2, specifically in showerr.asp, exploitable via the action parameter. The issue allows remote injection of arbitrary script/HTML and is rated with CVSS v2.0 base metrics (AV:N/AC:M/Au:N/C:N/I:P/A:N; base score 4.3, MEDIU...

CVE-2005-2314

CVE-2005-2314 (PHPsFTPd) affects PHPsFTPd versions 0.2–0.4. The flaw allows remote attackers to bypass login checks and exfiltrate the administrator’s credentials by setting the do_login parameter and performing an edit action via user.php, causing the login verification to be leaked in the respo...