[SECURITY] [DSA 661-2] New f2c packages fix insecure temporary files

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -------------------------------------------------------------------------- Debian Security Advisory DSA 661-2 [email protected] http://www.debian.org/security/ Martin Schulze April 20th, 2005 http://www.debian.org/security/faq -...

Low: Red Hat Security Advisory: xloadimage security update

A new xloadimage package that fixes bugs in handling malformed tiff and pbm/pnm/ppm images, and in handling metacharacters in filenames is now available. This update has been rated as having low security impact by the Red Hat Security Response Team. The xloadimage utility displays images in an X...

Moderate: Red Hat Security Advisory: logwatch security update

An updated logwatch package that fixes a denial of service issue is now available. This update has been rated as having moderate security impact by the Red Hat Security Response Team. LogWatch is a customizable log analysis system. LogWatch parses through your system's logs for a given period of...

[SECURITY] [DSA 712-1] New geneweb packages fix insecure file operations

-------------------------------------------------------------------------- Debian Security Advisory DSA 712-1 [email protected] http://www.debian.org/security/ Martin Schulze April 19th, 2005 http://www.debian.org/security/faq -...

[SECURITY] [DSA 712-1] New geneweb packages fix insecure file operations

-------------------------------------------------------------------------- Debian Security Advisory DSA 712-1 [email protected] http://www.debian.org/security/ Martin Schulze April 19th, 2005 http://www.debian.org/security/faq -...

CVE-2005-1182

CVE-2005-1182 concerns an unknown vulnerability in IBM OS/400 (R510, R520, R530) Incoming Remote Command (iSeries Access for Windows Remote Command service) that allows denial of service via certain inputs. Public sources (NVD/NIST) describe a non-authenticated, network-facing impact with partial...

CVE-2005-1179

CVE-2005-1179 concerns Xerox MicroServer Web Server in various WorkCentre models (e.g., M35/M45/M55 with 2.028.11.000–2.97.20.032 and 4.84.16.000–4.97.20.032; Pro 35/45/55 and Pro 65/75/90 ranges listed in the description) where an SNMP authentication issue could allow remote modification of syst...

CVE-2005-1190

CVE-2005-1190 affects WebcamXP PRO prior to or including v2.16.468, where a remote attacker can trigger a denial of service by supplying a very long chat name. This causes excessive display space usage and prevents the chat frame from rendering correctly. The description consistently indicates a ...

CVE-2005-1185

CVE-2005-1185 describes an unquoted Windows search path vulnerability in MusicMatch Jukebox versions up to 10.00.2047. Local users can gain privileges by placing a malicious C:\program.exe that is executed by MMFWLaunch.exe when it runs launch.exe. Affected software/function: MusicMatch Jukebox (...

CVE-2005-1180

Technical details about CVE-2005-1180 are not publicly provided in the supplied connected documents. The records here restate the vulnerability description without additional specifics on affected versions, fixes, or exploit information. Monitor for updates.

CVE-2005-1189

CVE-2005-1189 affects WebcamXP PRO (version 2.16.468 and earlier). The vulnerability is a cross-site scripting (XSS) flaw in the chat feature that allows remote attackers to inject arbitrary HTML/script via the chat name, demonstrated by using an IFRAME to redirect users to other sites. The NVD r...

CVE-2005-1181

Ariadne CMS 2.4 is cited as affected by a PHP remote code injection in loader.php via the ariadne parameter referencing a remote URL. The vendor disputes the issue, arguing loader.php must include ariadne.inc (defining $ariadne) and cannot be modified by an attacker; CVE personnel have partially ...

CVE-2005-1177

CVE-2005-1177 affects Webmin and Usermin prior to 1.200, where an unauthorized access issue may allow modification of configuration file permissions/ownership. The connected Nessus plugin reinforces the exposure as “Webmin

CVE-2005-1176

CVE-2005-1176 concerns a race condition in JFS2 on IBM AIX 5.2 and 5.3. The issue arises when deleting a file while I/O is still occurring for that file, potentially causing data to be written to a different file and thus leak sensitive information. The available documents identify the affected c...

CVE-2005-1183

CVE-2005-1183 affects mvnForum 1.0 RC4 and is a cross-site scripting (XSS) vulnerability due to failure to sanitize user-supplied input in the Search field. The issue enables remote injection of arbitrary script/HTML via the search parameter, as described by multiple sources (OpenVAS NASL notes i...

CVE-2005-1187

WinHex 12.05 SR-14 (and possibly related versions) is affected by a heap-based buffer overflow in the command line handling when a long file name argument is supplied. The underlying issue is a heap-based overflow that may allow an attacker to execute arbitrary code. The vulnerability is describe...

CVE-2005-1186

The CVE-2005-1186 entry affects Musicmatch Jukebox 10.00.2047 and earlier. The root cause is that the software adds the musicmatch.com domain to the Internet Explorer Trusted Sites zone, which can enable unauthorized activities within a domain and is demonstrated via cross-site scripting (XSS) at...

CVE-2005-1188

CVE-2005-1188 involves a cross-site scripting (XSS) vulnerability in Comersus Cart, specifically in the comersus_searchItem.asp script. Affected versions range from 3.90 to 4.51. The underlying issue is insufficient sanitization of the curPage parameter, enabling remote attackers to inject arbitr...

CVE-2005-1184

The CVE-2005-1184 entry describes a DoS in the TCP/IP stack across multiple operating systems: a remote attacker sends a TCP packet with the correct sequence number but an incorrect Acknowledgement number, triggering a flood of keep-alive packets and CPU consumption. The impact is listed as Parti...

MS Exchange Server Remote Code Execution Exploit (MS05-021)

漏洞描述：Microsoft Exchange是一款由微软开发的邮件服务程序。Microsoft Exchange Server中存在缓冲区溢出漏洞，攻击者可能利用此漏洞在主机上执行任意指令。 起因是Exchange SMTP Server在处理特殊的扩展SMTP verb时存在缓冲区溢出。漏洞可能允许攻击者连接到Exchange服务器的SMTP端口并发送精心构造的恶意命令，这些命令可能导致拒绝服务或以SMTP服务进程的权限运行攻击者所选择的代码。漏洞影响：受影响的软件： •Microsoft Exchange Server 2000 Service Pack 3 •Microsoft...