Apache HTTP Server 2.2.6, 2.0.61和1.3.39 'mod_status'跨站脚本漏洞

BUGTRAQ ID: 27237 CVE ID:CVE-2007-6388 CNCVE ID:CNCVE-20076388 Apache HTTP Server是一款开放源码的WEB服务程序。 Apache HTTP Server包含的modstatus模块存在输入验证问题，远程攻击者可以利用漏洞进行跨站脚本攻击，可能获得目标用户敏感信息。 server-status页默认不启用。目前没有详细漏洞细节提供。 Posadis Posadis 1.3.31 Posadis Posadis 1.3.28 Apache Software Foundation Apache 2.2.6 Apac...

SuSE 10 Security Update : libexif5 (ZYPP Patch Number 4883)

One bug in libexif5 was identified by a Google Security Audit done by Meder Kydyraliev. - Integer overflows in the thumbnail handler could be used to overflow buffers and potentially execute code or crash a program using libexif. CVE-2007-6352 %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

DSA-1463-1 postgresql-7.4 - several

Bulletin has no description...

Debian DSA-1461-1 : libxml2 - missing input validation

Brad Fitzpatrick discovered that the UTF-8 decoding functions of libxml2, the GNOME XML library, validate UTF-8 correctness insufficiently, which may lead to denial of service by forcing libxml2 into an infinite loop. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and...

CentOS 3 : postgresql (CESA-2008:0039)

Updated postgresql packages that fix several security issues are now available for Red Hat Enterprise Linux 3. This update has been rated as having moderate security impact by the Red Hat Security Response Team. PostgreSQL is an advanced Object-Relational database management system DBMS. The...

Fedora 8 : postgresql-8.2.6-1.fc8 (2008-0478)

Mon Jan 7 2008 Tom Lane 8.2.6-1 - Update to PostgreSQL 8.2.6 to fix CVE-2007-4769, CVE-2007-4772, CVE-2007-6067, CVE-2007-6600, CVE-2007-6601 - Make initscript and pam config files be installed unconditionally; seems new buildroots don't necessarily have those directories in place Note that...

Security fix for the ALT Linux 9 package libxml2 version 1:2.6.31-alt1

Jan. 14, 2008 Alexey Tourbin 1:2.6.31-alt1 - 2.6.30+svn3661 - 2.6.31 fixes CVE-2007-6284...

RHEL 3 : postgresql (RHSA-2008:0039)

Updated postgresql packages that fix several security issues are now available for Red Hat Enterprise Linux 3. This update has been rated as having moderate security impact by the Red Hat Security Response Team. PostgreSQL is an advanced Object-Relational database management system DBMS. The...

openSUSE 10 Security Update : openafs (openafs-4887)

This update fixes a remote denial of service crash against the openafs server. CVE-2007-6599 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update openafs-4887. The text description of this plugin i...

openSUSE 10 Security Update : libexif (libexif-4886)

Two bugs in libexif were identified by a Google Security Audit done by Meder Kydyraliev. CVE-2007-6351: Loading EXIF data could be used to cause a infinite recursion and crash CVE-2007-6352: Integer overflows in the thumbnail handler could be used to overflow buffers and potentially execute code ...

SuSE 10 Security Update : libexif (ZYPP Patch Number 4884)

Two bugs in libexif were identified by a Google Security Audit done by Meder Kydyraliev. - Loading EXIF data could be used to cause a infinite recursion and crash CVE-2007-6352: Integer overflows in the thumbnail handler could be used to overflow buffers and potentially execute code or crash a...

openSUSE 10 Security Update : libexif5 (libexif5-4882)

One bug in libexif5 was identified by a Google Security Audit done by Meder Kydyraliev. CVE-2007-6352: Integer overflows in the thumbnail handler could be used to overflow buffers and potentially execute code or crash a program using libexif. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. T...

openSUSE 10 Security Update : xen (xen-4901)

This update fixes Xen security issues. Two security problems were fixed: CVE-2007-5906: Xen allowed virtual guest system users to cause a denial of service hypervisor crash by using a debug register DR7 to set certain breakpoints. CVE-2007-5907: Xen 3.1.1 does not prevent modification of the CR4...

[SECURITY] [DSA 1462-1] New hplip packages fix privilege escalation

------------------------------------------------------------------------ Debian Security Advisory DSA-1462-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff January 13, 2008 http://www.debian.org/security/faq -...

[SECURITY] [DSA 1461-1] New libxml2 packages fix denial of service

------------------------------------------------------------------------ Debian Security Advisory DSA-1461-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff January 13, 2008 http://www.debian.org/security/faq -...

[SECURITY] [DSA 1460-1] New postgresql-8.1 packages fix several vulnerabilities

------------------------------------------------------------------------ Debian Security Advisory DSA-1460-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff January 13, 2008 http://www.debian.org/security/faq -...

MS07-064 Microsoft DirectX DirectShow SAMI Buffer Overflow

This module exploits a stack buffer overflow in the DirectShow Synchronized Accessible Media Interchanged SAMI parser in quartz.dll. This module has only been tested with Windows Media Player 6.4.09.1129 and DirectX 8.0. This module requires Metasploit: https://metasploit.com/download Current...

CVE-2007-6284

CVE-2007-6284 describes a denial-of-service vulnerability in libxml2 where the function xmlCurrentChar() mishandles certain UTF-8 sequences, allowing context-dependent attackers to cause an infinite loop or high CPU consumption when parsing XML. The issue is triggered by malformed XML content and...

CVE-2007-6423

Unspecified vulnerability in modproxybalancer for Apache HTTP Server 2.2.x before 2.2.7-dev, when running on Windows, allows remote attackers to trigger memory corruption via a long URL. NOTE: the vendor could not reproduce this issue...

[SECURITY] [DSA 1458-1] New openafs packages fix denial of service vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------ Debian Security Advisory DSA-1458-1 [email protected] http://www.debian.org/security/ Noah Meyerhans January 10, 2008 http://www.debian.org/security/faq -...