CVE-2007-6532

CVE-2007-6532 is a double-free vulnerability in libxfcegui4 (Xfce) prior to 4.4.2. The issue arises in session management where freed memory could be accessed, potentially enabling a remote attacker to execute arbitrary code. Gentoo GLSA 200801-06 and related advisories note that affected package...

CVE-2007-6531

CVE-2007-6531: Stack-based buffer overflow in the Panel (xfce4-panel) component of Xfce before 4.4.2 may allow remote code execution via Launcher tooltips. A second over-read exists in xfce_mkdirhier but is not necessarily exploitable. Affected: xfce4-panel; libxfcegui4 linked via the Xfce suite....

[SECURITY] [DSA 1457-1] New dovecot packages fix information disclosure

------------------------------------------------------------------------ Debian Security Advisory DSA-1457-1 [email protected] http://www.debian.org/security/ Thijs Kinkhorst January 09, 2008 http://www.debian.org/security/faq -...

[SECURITY] [DSA 1456-1] New fail2ban packages fix denial of service

------------------------------------------------------------------------ Debian Security Advisory DSA-1456-1 [email protected] http://www.debian.org/security/ Thijs Kinkhorst January 09, 2008 http://www.debian.org/security/faq -...

CVE-2007-5762

CVE-2007-5762 affects the NICM.SYS driver (3.0.0.4) used by Novell NetWare Client 4.91 SP4. The vulnerability allows local users to escalate privileges to kernel mode by opening the .icm device and sending crafted IOCTLs with METHOD_NEITHER, passing kernel addresses as arguments. The issue arises...

Authentication flaw

The DBLink module in PostgreSQL 8.2 before 8.2.6, 8.1 before 8.1.11, 8.0 before 8.0.15, 7.4 before 7.4.19, and 7.3 before 7.3.21, when local trust or ident authentication is used, allows remote attackers to gain privileges via unspecified vectors. NOTE: this issue exists because of an incomplete...

CVE-2007-5616

ssh-signer in SSH Tectia Client and Server 5.x before 5.2.4, and 5.3.x before 5.3.6, on Unix and Linux allows local users to gain privileges via unspecified vectors...

CVE-2007-6067

CVE-2007-6067 is an algorithmic complexity vulnerability in the TCL regular expression parser up to version 8.4.17, used by PostgreSQL 8.2/8.1/8.0/7.4 series. A crafted complex regex with doubly-nested states can be used by remote authenticated users to cause a denial of service via memory consum...

Vulnerability in contrib module (CVE-2007-6601)

DBLink functions combined with local trust or ident access control could be used by a malicious user togain superuser privileges. A valid login is required to exploit this vulnerability...

CVE-2007-5401

CVE-2007-5401 : Unrestricted file upload vulnerability in Layton HelpBox 3.7.1’s uploadrequest.asp allows remote attackers with authentication to upload and execute arbitrary ASP files due to improper validation of file extensions. The issue enables uploading executable server-side scripts and is...

CVE-2007-6601

CVE-2007-6601 is a privilege-escalation flaw in PostgreSQL via the DBLink module when local trust or ident authentication is configured. The issue stems from an incomplete fix for CVE-2007-3278, allowing a user with access to DBLink to gain superuser privileges. The connected advisories indicate ...

CVE-2007-5616

ssh-signer in SSH Tectia Client and Server 5.x before 5.2.4, and 5.3.x before 5.3.6, on Unix and Linux allows local users to gain privileges via unspecified vectors...

CVE-2007-5616

CVE-2007-5616 affects SSH Tectia Client and Server 5.x before 5.2.4 and 5.3.x before 5.3.6 on Unix/Linux. A local user can escalate privileges via the ssh-signer component, with root access reported as the impact. The vulnerability is mitigated by upgrading to SSH Tectia client/server 5.2.4 or 5....

CVE-2007-4772

CVE-2007-4772 concerns the Tcl (Tool Command Language) regular expression parser. The affected code path is TCL before 8.4.17, which, as used in PostgreSQL 8.2 before 8.2.6, 8.1 before 8.1.11, 8.0 before 8.0.15, and 7.4 before 7.4.19, allows context-dependent attackers to cause a denial of servic...

CVE-2007-6601

The DBLink module in PostgreSQL 8.2 before 8.2.6, 8.1 before 8.1.11, 8.0 before 8.0.15, 7.4 before 7.4.19, and 7.3 before 7.3.21, when local trust or ident authentication is used, allows remote attackers to gain privileges via unspecified vectors. NOTE: this issue exists because of an incomplete...

CVE-2007-5403

CVE-2007-5403 affects Layton HelpBox 3.7.1 with multiple cross-site scripting (XSS) vulnerabilities. The issues allow remote injection of arbitrary script/HTML via various form fields (Forename, Surname, Telephone, Fax; Asset, Location, Problem Desc, Solution Desc; End User, Description) and para...

CVE-2007-4769

Vulnerability summary (CVE-2007-4769) The Tcl regular expression parser used by PostgreSQL versions affected by TCL TclRegex before 8.4.17 contains an out-of-bounds backref error that can be triggered by an authenticated remote user, leading to a backend crash (DoS). Impacted versions (per descri...

CVE-2007-6600

CVE-2007-6600 affects PostgreSQL up to certain legacy branches. The initial description notes that PostgreSQL versions 8.2 prior to 8.2.6, 8.1 prior to 8.1.11, 8.0 prior to 8.0.15, 7.4 prior to 7.4.19, and 7.3 prior to 7.3.21 use superuser privileges for VACUUM and ANALYZE inside index functions,...

CVE-2007-5402

CVE-2007-5402 covers multiple SQL injection flaws in Layton HelpBox, affecting version 3.7.1 (and related references to 3.0.1) where an attacker could inject via parameters such as sys_request_id (editrequestenduser.asp, changerequeststatus.asp, editrequestuser.asp, requestcommentsuser.asp, usera...

CVE-2007-5665

The CVE-2007-5665 issue affects Novell ZENworks Endpoint Security Management (ESM) STEngine.exe (version around 3.5.0.20) where diagnostic report generation uses scripts in a world-writable directory. The service runs as SYSTEM and will execute a command shell found in that directory; if a local ...