Important: Red Hat Security Advisory: alsa-lib security update

An updated alsa-lib package that fixes a flaw that disabled stack execution protection is now available for Red Hat Enterprise Linux 4. This update has been rated as having important security impact by the Red Hat Security Response Team. The alsa-lib package provides a library of functions for...

CVE-2005-0424

Affected software: ASPjar Guestbook 1.00. The CVE-2005-0424 entry maps to CVE-2002-1730 and describes a vulnerability in delete.asp that enables remote attackers to delete arbitrary messages by crafting specific cookie values. Root cause: improper handling of the delete.asp administrative script ...

CVE-2005-0429

Direct code injection vulnerability in forumdisplay.php in vBulletin 3.0 through 3.0.4, when showforumusers is enabled, allows remote attackers to execute inject arbitrary PHP commands via the comma parameter...

CVE-2005-0427

The CVE-2005-0427 issue affects Webmin on Gentoo (before 1.170-r3). The ebuild builds a tbz2 of Webmin that unintentionally includes the encrypted root password in miniserv.users, allowing a remote attacker to obtain and potentially crack the password. Gentoo GLSA 200502-12 documents this design ...

CVE-2005-0419

CVE-2005-0419 concerns the 3Com 3CServer/3CDaemon FTP server family. The connected documents confirm multiple heap-based buffer overflows that allow remote authenticated users to execute arbitrary code by sending long FTP commands (demonstrated via the STAT command). The vulnerability affects the...

CVE-2005-0432

BEA WebLogic Server 7.0 Service Pack 5 and earlier, and 8.1 Service Pack 3 and earlier, generates different login exceptions that suggest why an authentication attempt fails, which makes it easier for remote attackers to guess passwords via brute force attacks...

CVE-2005-0433

Php-Nuke 7.5 allows remote attackers to determine the full path of the web server via invalid or missing arguments to 1 db.php, 2 mainfile.php, 3 Downloads/index.php, or 4 WebLinks/index.php, which lists the path in a PHP error message...

CVE-2005-0433

Technical details about CVE-2005-0433 are not publicly provided in the supplied documents. Available sources describe a path disclosure in Php-Nuke 7.5. Monitor for updates on affected versions, impact, and fixes.

CVE-2005-0159

The tpkg- scripts in the toolchain-source 3.0.4 package on Debian GNU/Linux 3.0 allow local users to overwrite arbitrary files via a symlink attack on temporary files...

CVE-2005-0429

CVE-2005-0429 affects vBulletin 3.0–3.0.4: Direct code injection in forumdisplay.php when showforumusers is enabled enables remote execution of arbitrary PHP commands via the comma parameter. Confirmed by NVD/OpenVAS/Nessus entries; impact is remote command execution with web server privileges. N...

CVE-2005-0426

Unknown vulnerability in Solaris 8 and 9 allows remote attackers to cause a denial of service panic via "Heavy UDP Usage" that triggers a NULL dereference...

CVE-2005-0431

CVE-2005-0431 : Barracuda Spam Firewall 3.1.10 and earlier allows white-listed domains to relay mail to arbitrary destinations, creating an open relay. Root cause: insufficient restriction on destination domains for white-listed senders. Impact: enables spam relaying; CVSS from NVD lists base sco...

CVE-2005-0446

Squid 2.5.STABLE8 and earlier allows remote attackers to cause a denial of service crash via certain DNS responses regarding 1 Fully Qualified Domain Names FQDN in fqdncache.c or 2 IP addresses in ipcache.c, which trigger an assertion failure...

CVE-2005-0445

Open WebMail 2.x is affected by a Cross-Site Scripting (XSS) vulnerability in the logindomain parameter on the login page. The Open WebMail OpenVAS/Nessus entries confirm that insufficient validation of the logindomain input enables arbitrary script execution in a user’s browser. Related referenc...

CVE-2005-0019

Unknown vulnerability in hztty 2.0 and earlier allows local users to execute arbitrary commands...

CVE-2005-0431

Barracuda Spam Firewall 3.1.10 and earlier does not restrict the domains that white-listed domains can send mail to, which allows members of white-listed domains to use Barracuda as an open mail relay for spam...

CVE-2005-0433

Php-Nuke 7.5 allows remote attackers to determine the full path of the web server via invalid or missing arguments to 1 db.php, 2 mainfile.php, 3 Downloads/index.php, or 4 WebLinks/index.php, which lists the path in a PHP error message...

CVE-2005-0447

Solaris 7, 8, and 9 allows remote attackers to cause a denial of service hang via a flood of certain ARP packets...

CVE-2005-0435

CVE-2005-0435 affects AWStats (awstats.pl) versions 6.3 and 6.4, where remote attackers can read server web logs by manipulating CGI parameters loadplugin and pluginmode to rawlog. The underlying issue is improper handling of these parameters in the AWStats plugin, enabling information disclosure...

CVE-2005-0087

The alsa-lib package in Red Hat Linux 4 disables stack protection for the libasound.so library, which makes it easier for attackers to execute arbitrary code if there are other vulnerabilities in the library...