[SECURITY] [DSA 717-1] New lsh packages fix several vulnerabilities

-------------------------------------------------------------------------- Debian Security Advisory DSA 717-1 [email protected] http://www.debian.org/security/ Martin Schulze April 27th, 2005 http://www.debian.org/security/faq -...

CVE-2005-1321

The CVE-2005-1321 entry concerns the Horde Vacation module. Affected software: Horde Vacation prior to version 2.2.2. Vulnerability: Cross-site scripting (XSS) via the parent’s frame page title in the Vacation module. Impact: enables remote attackers to inject arbitrary web script or HTML. Root c...

CVE-2005-1314

The vulnerability CVE-2005-1314 affects the Horde Kronolith module prior to version 1.1.4. It is an XSS in the web UI that allows a remote attacker to inject arbitrary script or HTML via the parent frame page title. Impact is cross-site scripting; the document does not provide exploitation detail...

CVE-2005-1320

CVE-2005-1320 affects Horde Mnemo Note Manager prior to 1.1.4. It is a cross-site scripting (XSS) vulnerability that allows remote attackers to inject arbitrary web script or HTML via the parent frame page title. Exploitation details are limited to this vector in the provided documents; there is ...

CVE-2005-1311

CVE-2005-1311 affects Yappa-NG prior to 2.3.2. The vulnerability is a cross-site scripting (XSS) flaw that allows remote attackers to inject arbitrary web script or HTML via unknown vectors. According to the NVD entry, the issue has a CVSS v2 base score of 4.3 (Medium) with Network access, no aut...

CVE-2005-1344

CVE-2005-1344 describes a buffer overflow in Apache's htdigest (version 2.0.52) that could allow arbitrary code execution via a long realm argument. The advisory notes that htdigest is typically locally accessible and not setuid/setgid, so privilege escalation is unlikely unless htdigest is invok...

CVE-2005-0419

Multiple heap-based buffer overflows in 3Com 3CServer allow remote authenticated users to execute arbitrary code via long FTP commands, as demonstrated using the STAT command...

CVE-2005-1327

CVE-2005-1327 is a cross-site scripting vulnerability in Woltlab Burning Board 2.3.1 PL2 and earlier, affecting the pms.php script where the folderid parameter is not sanitized. The issue allows remote attackers to inject arbitrary HTML/script that is executed in a user’s browser within the conte...

CVE-2005-1323

Summary: CVE-2005-1323 is a remote buffer overflow in NetFtpd/NetFTPD used by NetTerm, triggered by a long USER command. Affected versions are NetTerm NetFTPD 5.1.1 and earlier. The overflow can allow arbitrary code execution on the FTP server running NetTerm NetFTPD. Public references in NVD, CV...

CVE-2005-1324

CVE-2005-1324 affects phpMyVisites via multiple XSS in index.php. The vulnerability allows remote attackers to inject arbitrary scripts/HTML through the (1) part, (2) per, or (3) site parameters. The issue originates from improper handling of user-supplied input in the index.php script, enabling ...

CVE-2005-1319

CVE-2005-1319 describes a cross-site scripting (XSS) vulnerability in the Horde IMP Webmail client, affecting versions prior to 3.2.8. The root cause is unsanitized input used to set the parent frame page title, allowing remote attackers to inject arbitrary script/HTML. Public references (NVD, SU...

CVE-2005-1309

CVE-2005-1309 is an XSS vulnerability in bBlog 0.7.4 that allows remote attackers to inject arbitrary script or HTML via the entry title field or the comment body text. The weakness is confirmed in multiple sources (NVD entry with CVSSv2 base score 4.3, MEDIUM) and is echoed across related adviso...

CVE-2005-1325

CVE-2005-1325 affects phpMyVisites 1.3, where the file set_lang.php processes a mylang parameter in a way that allows remote attackers to read and include arbitrary files. The underlying flaw is the uncontrolled file handling via the mylang input, enabling arbitrary file access/inclusion. Documen...

CVE-2005-0159

The tpkg- scripts in the toolchain-source 3.0.4 package on Debian GNU/Linux 3.0 allow local users to overwrite arbitrary files via a symlink attack on temporary files...

CVE-2005-1312

Affected software: Yappa-NG before 2.3.2. Vulnerabilities: PHP remote file inclusion (CVE-2005-1312) that could allow arbitrary PHP code execution via unknown vectors; and multiple include/XSS flaws due to failure to sanitize user input, as described in connected Nessus details. Exploitation deta...

CVE-2005-1318

The CVE-2005-1318 entry concerns Horde Forwards E-Mail Forwarding Manager prior to 2.2.2, which is vulnerable to cross-site scripting (XSS) via the parent frame page title. The affected component is the Forwarding Manager’s web interface; the root cause is improper handling of the frame title lea...

CVE-2005-1313

CVE-2005-1313 describes a cross-site scripting (XSS) vulnerability in the Horde Passwd module prior to 2.2.2. The issue allows remote attackers to inject arbitrary web script or HTML via the parent frame page title. Affected component: Horde Passwd module. Root cause: insufficient input validatio...

CVE-2005-1326

CVE-2005-1326 describes a buffer overflow in the VooDoo cIRCle BOTNET prior to version 1.0.33, enabling remote authenticated attackers to cause a denial of service (client crash) through a crafted packet. The vulnerability is documented across multiple sources (NVD, CVE/Vuln lists) with a base sc...

CVE-2005-1315

CVE-2005-1315 describes a cross-site scripting (XSS) vulnerability in the Horde Turba module prior to 1.2.5. The flaw allows a remote attacker to inject arbitrary web script or HTML by crafting the parent’s frame page title. The vulnerability is associated with Horde Turba’s handling of the paren...

CVE-2005-1317

CVE-2005-1317 affects the Horde Chora module prior to version 1.2.3, enabling a remote attacker to execute arbitrary script/HTML via the parent frame page title (XSS). The vulnerability is due to insufficient input sanitization in the frame title handling. No exploitation details or concrete reme...