Important: Red Hat Security Advisory: firefox security update

Updated firefox packages that fix various security bugs are now available. This update has been rated as having important security impact by the Red Hat Security Response Team. Mozilla Firefox is an open source Web browser. Several bugs were found in the way Firefox executes javascript code...

[SECURITY] [DSA 727-1] New libconvert-uulib-perl packages fix arbitrary code execution

-------------------------------------------------------------------------- Debian Security Advisory DSA 727-1 [email protected] http://www.debian.org/security/ Martin Schulze May 20th, 2005 http://www.debian.org/security/faq -...

CVE-2005-1687

SQL injection vulnerability in wp-trackback.php in Wordpress 1.5 and earlier allows remote attackers to execute arbitrary SQL commands via the tbid parameter...

KLA10185 Multiple vulnerabilities in Groove

Multiple serious vulnerabilities have been found in Groove products. Malicious users can exploit these vulnerabilities to obtain sensitive information, inject web scripts, bypass security restrictions and spoof filenames. Below is a complete list of vulnerabilities 1. Improper file extension...

CVE-2005-1672

Help Center Live (PHP-based live help desk with a MySQL backend) is affected by multiple cross-site scripting (XSS) vulnerabilities identified as CVE-2005-1672. The XSS can be triggered by untrusted input in several fields: the find parameter to index.php, the name or message field of a chat requ...

CVE-2005-1674

CVE-2005-1674 : The provided documents describe a Cross-Site Request Forgery in Help Center Live (view.php) that allows a remote attacker to perform administrator actions via a link or IMG tag. The Red Hat, CVE, CVE List, Exploit-DB, and Nessus entries concur on the vulnerability class and affect...

CVE-2005-1670

The CVE-2005-1670 issue affects Extreme Networks switches running ExtremeWare XOS. Affected products include BlackDiamond/ExtremeWare XOS versions 11.1 (before 11.1.3.3), 11.0 (before 11.0.2.4), and 10.x. The underlying cause is a vulnerability in XOS that allows an authenticated user to execute ...

CVE-2005-1671

The CVE-2005-1671 issue affects Yahoo! Messenger 5.x through 6.0, where the Logfile feature can be activated via a YMSGR: URL. This causes output to be written to a single ypager.log file across multiple users, and there is no proper warning to subsequent users that the feature is enabled, enabli...

CVE-2005-1455

CVE-2005-1455 describes a buffer overflow in the sql_escape_func function of the FreeRADIUS SQL module (versions 1.0.2 and earlier) that enables remote attackers to cause a crash/DoS. The connected documents corroborate that freeradius has multiple advisories across platforms (FreeBSD, Gentoo, Re...

CVE-2005-1674

Cross-Site Request Forgery CSRF vulnerability in Help Center Live allows remote attackers to perform actions as the administrator via a link or IMG tag to view.php...

CVE-2005-0392

CVE-2005-0392 is a local privilege-escalation flaw in the ppxp PPP program where root privileges are not dropped when opening potentially user-supplied log files, enabling an unprivileged user to trigger a root shell. This is discussed in Debian advisories DSA-725-1/DSA-725-2 and mirrored in Open...

CVE-2005-1674

Cross-Site Request Forgery CSRF vulnerability in Help Center Live allows remote attackers to perform actions as the administrator via a link or IMG tag to view.php...

CVE-2005-1673

CVE-2005-1673 affects Help Center Live (PHP/MySQL) with multiple SQL injection flaws (e.g., id in index.php, tid in view.php, fid in download.php/chat_download.php, status in icon.php, TICKET_tid in index.php/view.php). Root cause: insufficient input sanitization in several parameters leading to ...

CVE-2005-1454

SQL injection vulnerability in the radiusxlat function in the SQL module for FreeRADIUS 1.0.2 and earlier allows remote authenticated users to execute arbitrary SQL commands via 1 groupmembershipquery, 2 simulcountquery, or 3 simulverifyquery configuration entries...

CVE-2005-1260

CVE-2005-1260 describes a remote denial-of-service vulnerability in bzip2 where a crafted archive can cause an infinite loop during decompression, potentially exhausting disk space. Public documents show this issue alongside a related local race condition (CVE-2005-0953) and note that untrusted a...

CVE-2005-1454

CVE-2005-1454 is a SQL injection in the radius_xlat function of the FreeRADIUS SQL module affecting 1.0.2 and earlier. Remote authenticated users can inject via (1) group_membership_query, (2) simul_count_query, or (3) simul_verify_query configuration entries. CVSSv2 base score 7.5 (HIGH). Relate...

CVE-2005-0040

DotNetNuke (DNN) before 3.0.12 is affected by multiple XSS vulnerabilities (CVE-2005-0040) that allow remote attackers to inject script via (1) the register-a-new-user page, (2) the User-Agent header, and (3) the Username field, due to improper quoting before logging. Affected versions are

CVE-2005-1454

SQL injection vulnerability in the radiusxlat function in the SQL module for FreeRADIUS 1.0.2 and earlier allows remote authenticated users to execute arbitrary SQL commands via 1 groupmembershipquery, 2 simulcountquery, or 3 simulverifyquery configuration entries...

Fedora Core 2 : telnet-0.17-28.FC2.1 (2005-277)

Two buffer overflow flaws were discovered in the way the telnet client handles messages from a server. An attacker may be able to execute arbitrary code on a victim's machine if the victim can be tricked into connecting to a malicious telnet server. The Common Vulnerabilities and Exposures projec...

Fedora Core 2 : mysql-3.23.58-16.FC2.1 (2005-305)

Sat Apr 2 2005 Tom Lane 3.23.58-16.FC2.1 - Repair uninitialized variable in security2 patch. - Enable testing on 64-bit arches; continue to exclude s390x which still has issues. - Fri Mar 18 2005 Tom Lane 3.23.58-15.FC2.1 - Backpatch repair for CVE-2005-0709, CVE-2005-0710, CVE-2005-0711...