openSUSE 10 Security Update : postgresql (postgresql-4955)

This version update to 8.2.6 fixes among other things several security issues : - Index Functions Privilege Escalation: CVE-2007-6600 - Regular Expression Denial-of-Service: CVE-2007-4772, CVE-2007-6067, CVE-2007-4769 - DBLink Privilege Escalation: CVE-2007-6601 %NASLMINLEVEL 70300 C Tenable...

Fedora 7 : openldap-2.3.34-6.fc7 (2008-1307)

Tue Feb 5 2008 Jan Safranek 2.3.34-6 - fix CVE-2007-6698 431409 - Mon Jan 14 2008 Jan Safranek 2.3.34-5 - fix default slurpd directory to /var/lib/ldap 424831 - Fri Nov 2 2007 Jan Safranek 2.3.34-4 - fix various security flaws 360081 - Fri Jul 13 2007 Jan Safranek 2.3.34-3 - Fix initscript return...

Debian DSA-1483-1 : net-snmp - design error

The SNMP agent snmpagent.c in net-snmp before 5.4.1 allows remote attackers to cause a denial of service CPU and memory consumption via a GETBULK request with a large max-repeaters value. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin...

[SECURITY] [DSA 1493-1] New sdl-image1.2 packages fix arbitrary code execution

------------------------------------------------------------------------ Debian Security Advisory DSA-1493-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff February 10, 2008 http://www.debian.org/security/faq -...

iDefense Security Advisory 02.07.08: IBM DB2 Universal Database Administration Server Memory Corruption Vulnerability

iDefense Security Advisory 02.07.08 http://labs.idefense.com/intelligence/vulnerabilities/ Feb 07, 2008 I. BACKGROUND IBM Corp.'s DB2 Universal Database product is a large database server product commonly used for high end databases. The DB2 Administration Server DAS provides functionality that...

Fixed in Apache Tomcat 6.0.16

Low: Session hi-jacking CVE-2007-5333 The previous fix for CVE-2007-3385 was incomplete. It did not consider the use of quotes or %5C within a cookie value. Affects: 6.0.0-6.0.14 Low: Elevated privileges CVE-2007-5342 The JULI logging component allows web applications to provide their own logging...

Design/Logic Flaw

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2007-6303. Reason: This candidate is a duplicate of CVE-2007-6303. Notes: All CVE users should reference CVE-2007-6303 instead of this candidate. All references and descriptions in this candidate have been removed to prevent...

CVE-2008-0626

CVE-2008-0626 is rejected per the description; this candidate is a duplicate of CVE-2007-6303.

CVE-2008-0627

CVE-2008-0627 is rejected/not used; refer to CVE-2007-6304 for the active vulnerability entry.

[SECURITY] [DSA 1483-1] New net-snmp packages fix denial of service vulnerability

------------------------------------------------------------------------ Debian Security Advisory DSA-1483-1 [email protected] http://www.debian.org/security/ Noah Meyerhans February 06, 2008 http://www.debian.org/security/faq -...

[SECURITY] [DSA 1483-1] New net-snmp packages fix denial of service vulnerability

------------------------------------------------------------------------ Debian Security Advisory DSA-1483-1 [email protected] http://www.debian.org/security/ Noah Meyerhans February 06, 2008 http://www.debian.org/security/faq -...

SuSE 10 Security Update : nss_ldap (ZYPP Patch Number 4781)

nssldap returned incorrect data under certain circumstances to the calling process. Some applications could therefore work with wrong user data. CVE-2007-5794 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc...

openSUSE 10 Security Update : postgresql (postgresql-4958)

This version update to 8.1.11 fixes among other things several security issues : - Index Functions Privilege Escalation: CVE-2007-6600 - Regular Expression Denial-of-Service: CVE-2007-4772, CVE-2007-6067, CVE-2007-4769 - DBLink Privilege Escalation: CVE-2007-6601 %NASLMINLEVEL 70300 C Tenable...

SuSE 10 Security Update : cairo (ZYPP Patch Number 4961)

This update of cairo fixes several integer overflows while decoding PNG images. This can be exploited remotely with user-assistance to execute arbitrary code. CVE-2007-5503 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc...

SuSE 10 Security Update : PostgreSQL (ZYPP Patch Number 4962)

This version update to 7.4.19 fixes among other things several security issues : - Index Functions Privilege Escalation: CVE-2007-6600 - Regular Expression Denial-of-Service: CVE-2007-4772 / CVE-2007-6067 / CVE-2007-4769 - DBLink Privilege Escalation: CVE-2007-6601 %NASLMINLEVEL 70300 C Tenable...

openSUSE 10 Security Update : nss_ldap (nss_ldap-4773)

nssldap returned incorrect data under certain circumstances to the calling process. Some applications could therefore work with wrong user data CVE-2007-5794. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE...

openSUSE 10 Security Update : cairo (cairo-4947)

This update of cairo fixes several integer overflows while decoding PNG images. This can be exploited remotely with user-assistance to execute arbitrary code. CVE-2007-5503 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted...

[SECURITY] [DSA 1482-1] New squid packages fix denial of service

------------------------------------------------------------------------ Debian Security Advisory DSA-1482-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff February 05, 2008 http://www.debian.org/security/faq -...

[SECURITY] [DSA 1486-1] New gnatsweb packages fix cross-site scripting

------------------------------------------------------------------------ Debian Security Advisory DSA-1486-1 [email protected] http://www.debian.org/security/ Steve Kemp February 04, 2008 http://www.debian.org/security/faq -...

CVE-2007-6340

The connected advisory confirms CVE-2007-6340 affects LSrunasE 1.0 and Supercrypt 1.0 and explains the root cause: RC4 is used without a unique initialization vector, deriving a constant keystream across all passwords. This insecure design allows an attacker with local access to break encryption ...