Fedora Core 2 : gftp-2.0.18-0.FC2 (2005-310)

Fri Feb 18 2005 Warren Togami 2.0.18-0.FC2 - FC2 including CVE-2005-0372 - Thu Feb 10 2005 Warren Togami 2.0.18-1 - 2.0.18 - Tue Jun 15 2004 Elliot Lee - rebuilt Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable...

Fedora Core 2 : kdelibs-3.2.2-14.FC2 (2005-244)

Wed Mar 2 2005 Than Ngo 6:3.2.2-14.FC2 - Applied patch to fix DCOP DoS, CVE-2005-0396, 150090 thanks KDE security team - Wed Feb 16 2005 Than Ngo 3.2.2-13.FC2 - Applied patch to fix dcopidlng insecure temporary file usage, CVE-2005-0365, 148823 Note that Tenable Network Security has extracted the...

Mandrake Linux Security Advisory : gzip (MDKSA-2005:092)

Several vulnerabilities have been discovered in the gzip package : Zgrep in gzip before 1.3.5 does not properly sanitize arguments, which allows local users to execute arbitrary commands via filenames that are injected into a sed script. CVE-2005-0758 A race condition in gzip 1.2.4, 1.3.3, and...

Fedora Core 2 : gdk-pixbuf-0.22.0-12.fc2 (2005-265)

David Costanzo found a bug in the way gdk-pixbuf processes BMP images. It is possible that a specially crafted BMP image could cause a denial of service attack in applications linked against gdk-pixbuf. The Common Vulnerabilities and Exposures project cve.mitre.org has assigned the name...

Fedora Core 2 : ImageMagick-6.2.0.7-2.fc2 (2005-234)

Andrei Nigmatulin discovered a heap based buffer overflow flaw in the ImageMagick image handler. An attacker could create a carefully crafted Photoshop Document PSD image in such a way that it would cause ImageMagick to execute arbitrary code when processing the image. The Common Vulnerabilities...

Fedora Core 2 : krb5-1.3.6-4 (2005-269)

Updated krb5 packages which fix two buffer overflow vulnerabilities in the included Kerberos-aware telnet client are now available. Kerberos is a networked authentication system which uses a trusted third-party a KDC to authenticate clients and servers to each other. The krb5-workstation package...

Fedora Core 2 : squirrelmail-1.4.4-1.FC2 (2005-259)

Multiple issues in squirrelmail CVE-2005-0104 Upgrade to 1.4.4 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional...

Fedora Core 2 : xloadimage-4.1-34.FC2 (2005-236)

This update fixes CVE-2005-0638, a problem in the parsing of shell metacharacters in filenames. It also fixes bugs in handling of malformed TIFF and PBM/PNM/PPM issues. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory...

Fedora Core 2 : ipsec-tools-0.5-2.fc2 (2005-216)

This update fixes a potential DoS in parsing ISAKMP headers in racoon. CVE-2005-0398 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without...

Fedora Core 2 : gtk2-2.4.14-2.fc2 (2005-267)

David Costanzo found a bug in the way GTK+ processes BMP images. It is possible that a specially crafted BMP image could cause a denial of service attack in applications linked against GTK+. The Common Vulnerabilities and Exposures project cve.mitre.org has assigned the name CVE-2005-0891 to this...

RHEL 3 : evolution (RHSA-2005:238)

Updated evolution packages that fix various bugs are now available. This update has been rated as having low security impact by the Red Hat Security Response Team. Evolution is the GNOME collection of personal information management PIM tools. Evolution includes a mailer, calendar, contact manage...

Fedora Core 2 : xorg-x11-6.7.0-14 (2005-272)

An integer overflow flaw was found in libXpm, which is used by some applications for loading of XPM images. An attacker could create a malicious XPM file that would execute arbitrary code if opened by a victim using an application linked to the vulnerable library. The Common Vulnerabilities and...

Groove Mobile Workspace vulnerable to script injection via SharePoint lists containing picture columns

Overview A vulnerability in the way that Groove Mobile Workspace handles picture columns embedded within SharePoint lists may allow attackers to execute an arbitrary script. Description Groove Virtual Office provides a collaborative working environment that includes shared documents, databases,...

[SECURITY] [DSA 724-1] New phpsysinfo packages fix cross site scripting

-------------------------------------------------------------------------- Debian Security Advisory DSA 724-1 [email protected] http://www.debian.org/security/ Martin Schulze May 18th, 2005 http://www.debian.org/security/faq -...

CVE-2005-1668

CVE-2005-1668 – YusASP Web Asset Manager 1.0 : Multiple connected sources confirm a privilege escalation via a direct request to the endpoint assetmanager.asp, allowing remote attackers to gain privileges. No patch/version details are provided in the documents. OpenVAS and PT-Security references ...

CVE-2005-1653

Woppoware PostMaster 4.2.2 (build 3.2.5) is affected by a Cross-site Scripting (XSS) vulnerability in the message.htm page due to unsanitized input in the email parameter. This allows remote attackers to inject arbitrary web script or HTML. Root cause: improper input sanitization in the email par...

CVE-2005-1663

Technical details for CVE-2005-1663 are not publicly available in the provided documents; no affected version, root cause, or remediation information is shown. Monitor for updates.

CVE-2005-1646

Affected product: Fastream NETFile FTP/Web Server 7.4.6. Vulnerability: FXP support allows a PORT command with an IP address that may differ from the logged-in user’s IP, enabling FTP Bounce attacks. This can bypass firewall rules and cause a denial of service. Impact: Potential firewall traversa...

CVE-2005-1667

DataTrac Activity Console 1.1 is affected by CVE-2005-1667, where a remote attacker can cause a denial of service by sending a long HTTP GET request. The connected documents confirm the affected product/version and the impact (DoS), but do not provide any remediation details or exploitation speci...

CVE-2005-1656

Mercur Messaging 2005 SP2 is affected by CVE-2005-1656. An attacker can read the source code of .ctml files by issuing a URL containing a trailing hex-encoded space ("%20"). Affected product: Mercur Messaging 2005 SP2. Underlying issue: the vulnerability allows partial disclosure of data via craf...