Security fix for the ALT Linux 5 package cvs version 1.11.19-alt1

April 6, 2005 Dmitry V. Levin 1.11.19-alt1 - Updated to 1.11.19. - Updated patches. - Applied upstream security fixes for CAN-2005-0753 issue...

RHEL 3 : mysql-server (RHSA-2005:348)

Updated mysql-server packages that fix several vulnerabilities are now available. This update has been rated as having important security impact by the Red Hat Security Response Team. MySQL is a multi-user, multi-threaded SQL database server. This update fixes several security risks in the MySQL...

mysql security update

CentOS Errata and Security Advisory CESA-2005:348 Updated mysql-server packages that fix several vulnerabilities are now available. This update has been rated as having important security impact by the Red Hat Security Response Team. MySQL is a multi-user, multi-threaded SQL database server. This...

Important: Red Hat Security Advisory: gdk-pixbuf security update

Updated gdk-pixbuf packages that fix a double free vulnerability are now available. This update has been rated as having important security impact by the Red Hat Security Response Team. The gdk-pixbuf package contains an image loading library used with the GNOME GUI desktop environment. A bug was...

CVE-2005-0981

CVE-2005-0981 describes multiple cross-site scripting (XSS) vulnerabilities in AlstraSoft EPay Pro 2.0 that allow remote attackers to inject arbitrary web script or HTML via the (1) payment or (2) send parameter. The NVD entry lists a base score of 4.3 (MEDIUM) with network attack vector, no conf...

CVE-2005-0979

CVE-2005-0979 affects RUMBA 7.3 and earlier, where multiple buffer overflows in the profile parsing allow remote attackers to cause a denial of service and potentially execute arbitrary code. The exploitation vector shown uses a crafted profile file, notably a long SysName field. Connected source...

CVE-2005-0982

CVE-2005-0982 affects Yet Another Forum.net 0.9.9 and involves multiple cross-site scripting (XSS) vulnerabilities that allow remote attackers to inject arbitrary script or HTML via the (1) name, (2) location, or (3) Subject field. The NVD entry lists a base score of 4.3 (Medium) with Network att...

CVE-2005-0981

Multiple cross-site scripting XSS vulnerabilities in AlstraSoft EPay Pro 2.0 allow remote attackers to inject arbitrary web script or HTML via the 1 payment or 2 send parameter...

CVE-2005-0980

Vulnerability: CVE-2005-0980 affects AlstraSoft EPay Pro 2.0 (index.php) through a PHP remote file inclusion via the view parameter, enabling arbitrary PHP code execution when an attacker references a URL on a remote server. Root cause: insufficient input validation/ sanitization allowing inclusi...

CVE-2005-0968

CA eTrust Intrusion Detection 3.0 is affected. The issue arises in the Crypto API function CPImportKey, where large size values are not properly validated, enabling remote attackers to trigger a denial of service by sending crafted input and crashing the remote IDS service. The vulnerability is e...

CVE-2005-1035

Multiple buffer overflows in Pavuk before 0.9.32 have unknown attack vectors and impact...

CVE-2005-0984

The CVE-2005-0984 issue affects Star Wars Jedi Knight: Jedi Academy (game) up to version 1.011. The root cause is a buffer overflow in the G_Printf function when processing long messages, enabling remote attackers to execute arbitrary code via commands such as say or tell. The connected documents...

CVE-2005-0749

The CVE-2005-0749 issue affects the Linux kernel prior to 2.6.11.6. The vulnerability arises in load_elf_library where freeing an invalid pointer via a crafted ELF library or executable can trigger a kernel crash (DoS). Affected component: kernel’s ELF loading/free path (load_elf_library). The pu...

CVE-2005-0983

CVE-2005-0983 concerns the Quake 3 engine (as used in multiple games). The vulnerability allows a remote attacker to cause a denial of service (client disconnect) by sending a long message that isn’t properly truncated, causing the engine to treat the remainder of the data as network input. Concr...

CVE-2005-0708

CVE-2005-0708 affects FreeBSD 4.8–4.11 and 5–5.4. The flaw lies in the sendfile(2) system call: if the file being transmitted is truncated after transmission has started, sendfile may expose portions of kernel memory to remote observers, enabling disclosure of sensitive information. According to ...

CVE-2005-0978

Directory traversal vulnerability in the Object Push service in IVT BlueSoleil 1.4 allows remote attackers to upload arbitrary files via a .. dot dot in a PUSH command...

CVE-2005-0977

The CVE-2005-0977 entry concerns the Linux kernel 2.6 tmpfs shmem_nopage function, where the address argument is not properly verified in shmem.c. This allows a local user to trigger a denial of service (kernel crash) via an invalid address. Public advisories (RHSA-2005:366 / CESA-2005:366) indic...

CVE-2005-0400

The CVE-2005-0400 issue affects the Linux kernel ext2 file system: ext2_make_empty does not initialize memory when allocating a new directory entry block, enabling local users to read potentially sensitive data from the block. The documented fix is in kernel update 2.6.11.6 (and related Red Hat/U...

CVE-2005-0978

The CVE-2005-0978 entry describes a directory traversal flaw in the IVT BlueSoleil 1.4 Object Push service, exploitable by sending a PUSH command containing .. to upload arbitrary files. Affected component: Object Push service of IVT BlueSoleil 1.4. Root cause: directory traversal in PUSH handlin...

[SECURITY] [DSA 705-1] New wu-ftpd packages fix denial of service

-------------------------------------------------------------------------- Debian Security Advisory DSA 705-1 [email protected] http://www.debian.org/security/ Martin Schulze April 4th, 2005 http://www.debian.org/security/faq -...