[SECURITY] [DSA 705-1] New wu-ftpd packages fix denial of service

-------------------------------------------------------------------------- Debian Security Advisory DSA 705-1 [email protected] http://www.debian.org/security/ Martin Schulze April 4th, 2005 http://www.debian.org/security/faq -...

[SECURITY] [DSA 704-1] New remstats packages fix several vulnerabilities

-------------------------------------------------------------------------- Debian Security Advisory DSA 704-1 [email protected] http://www.debian.org/security/ Martin Schulze April 4th, 2005 http://www.debian.org/security/faq -...

[SECURITY] [DSA 704-1] New remstats packages fix several vulnerabilities

-------------------------------------------------------------------------- Debian Security Advisory DSA 704-1 [email protected] http://www.debian.org/security/ Martin Schulze April 4th, 2005 http://www.debian.org/security/faq -...

CVE-2005-0388

CVE-2005-0388 applies to remstats' remoteping service in versions up to 1.0.13. The vulnerability arises from missing input sanitising, enabling remote command execution. Debian DSA-704-1 fixes the issue in remstats (uptstream: version 1.0.13a-5 for sid; 1.00a4-8woody1 for woody). Red Hat advisor...

CVE-2005-0966

CVE-2005-0966 concerns the IRC protocol handling in Gaim (GAIM) 1.2.0 and possibly earlier. The vulnerability stems from how IRC messages are processed by the IRC protocol plugin, allowing remote attackers to inject arbitrary markup into the Gaim UI via functions such as irc_msg_kick, irc_msg_mod...

[Full-disclosure] [SECURITY] [DSA 704-1] New remstats packages fix several vulnerabilities

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -------------------------------------------------------------------------- Debian Security Advisory DSA 704-1 [email protected] http://www.debian.org/security/ Martin Schulze April 4th, 2005 http://www.debian.org/security/faq -...

DSA-705-1 wu-ftpd - missing input sanitising

Bulletin has no description...

CVE-2005-0950

CVE-2005-0950 is a directory traversal vulnerability in FastStone 4in1 Browser 1.2. It allows remote attackers to read arbitrary files via a URL containing a triple-dot sequence (…)

CVE-2005-0958

The CVE-2005-0958 entry relates to a format-string vulnerability in the log_do function (log.c) of mtftpd 0.0.3 when the statistics option is enabled. This condition can allow remote attackers to achieve arbitrary code execution via the CWD command. Affected component: mtftpd 0.0.3; vulnerable co...

CVE-2005-0961

Horde 3.0.4 is vulnerable to an XSS in the page title due to insufficient sanitization of the parent frame title, affecting versions before 3.0.4-RC2. The vulnerability allows remote attackers to inject arbitrary script/HTML. Remediation: upgrade to Horde 3.0.4-RC2 or later.

CVE-2005-0942

Affected software: Sybase Adaptive Server Enterprise (ASE) XP Server 12.x. Vulnerable component: XP Server process (xp_server). Root cause: Denial of service caused by processing malformed data sent to the XP Server TCP port, leading to a process crash. Impact: Availability loss for the XP Server...

CVE-2005-0951

...

CVE-2005-0959

CVE-2005-0959 describes a buffer overflow in Yep Yep mtftpd 0.0.3 within the mt_do_dir function. An attacker could trigger arbitrary code execution by supplying a long path, with the NVD entry classifying the impact as Partial confidentiality, integrity, and availability compromise and a basescor...

CVE-2005-0942

The XP Server process xpserver in Sybase Adaptive Server Enterprise ASE XP Server 12.x before 12.5.3 ESD1 allows attackers to cause a denial of service process crash via malformed data sent to the XP Server TCP port...

CVE-2005-0949

CVE-2005-0949 describes multiple cross-site scripting (XSS) vulnerabilities in the PortalApp’s content.asp. The flaws allow remote attackers to inject arbitrary web script or HTML via the parameters contenttype or keywords . The NVD entry provides a base score of 4.3 (Medium) with network attack ...

CVE-2005-0951

CVE-2005-0951 is rejected/not used per initial description.

CVE-2005-0946

CVE-2005-0946 affects phpCOIN 1.2.1b and earlier, with SQL injection vulnerabilities that allow remote attackers to execute arbitrary SQL commands. Affected input surfaces include the term/keywords field on search, username or e-mail on forgot password, and domain name on the new package ordering...

CVE-2005-0960

CVE-2005-0960 affects OpenBSD 3.5 and 3.6, targeting the SACK implementation in tcp_input.c and tcp_usrreq.c. The vulnerability allows remote attackers to cause a denial of service via memory exhaustion or system crash. No remediation details are provided in the available documents; exploitation ...

CVE-2005-0964

Kerio Personal Firewall 4.1.2 and earlier has a local bypass vulnerability where a malicious process impersonates a legitimate, less-restricted process to bypass firewall rules. This can allow local users to circumvent protections. The CVE entry notes a MEDIUM impact (base score 4.6); no specific...

CVE-2005-0957

The CVE-2005-0957 entry concerns BayTech RPC-3 Telnet Daemon (3.05) where an attacker can bypass authentication by sending a specific keystroke sequence at the username prompt. The vulnerability arises from an input sequence that allows access without valid credentials, enabling remote access to ...