CVE-2007-6105

TalkBack 2.2.7 is affected by multiple PHP remote file inclusion vulnerabilities. The flaws allow remote attackers to execute arbitrary PHP code via a URL parameter in (1) language_file for comments-display-tpl.php and addons/separate-comments-mod/my-comments-display-tpl.php, and (2) config[comme...

CVE-2007-6113

CVE-2007-6113 is a vulnerability in Wireshark's DNP3 dissector where an integer signedness error in the 0.10.12–0.99.6 range can cause a denial of service (long loop) by processing a malformed DNP3 packet. Connected advisories confirm the issue was fixed by upgrading to Wireshark 0.99.7 (and late...

CVE-2007-6117

Wireshark (formerly Ethereal) HTTP dissector vulnerability CVE-2007-6117 affects Wireshark versions 0.10.14 through 0.99.6. The issue allows remote attackers to crash the dissector and potentially execute arbitrary code via crafted chunked messages. Connected advisories confirm affected product i...

CVE-2007-6119

CVE-2007-6119:Wireshark (formerly Ethereal) before 0.99.7 is affected; the DCP ETSI dissector in 0.99.6 can cause denial of service (long loop/resource consumption) via unknown vectors. Public advisories (RHSA/CESA/MDA etc.) indicate upgrading to Wireshark 0.99.7 or later mitigates the issue. Oth...

CVE-2007-6120

CVE-2007-6120 affects Wireshark (formerly Ethereal) Bluetooth SDP dissector, enabling remote denial of service via infinite loop in versions 0.99.2–0.99.6. Connected advisories confirm the vulnerability in the Bluetooth SDP parser and related DoS concerns; upgrade to Wireshark 0.99.7 (or later) t...

CVE-2007-6103

CVE-2007-6103 affects I Hear U (IHU) 0.5.6 and earlier. The vulnerability allows remote attackers to cause denial of service: (1) an infinite loop by sending a packet with zero in the size field, handled by Receiver::processPacket; and (2) a daemon crash by IHU_INFO_INIT or IHU_INFO_RING packets ...

CVE-2007-6104

Cross-site scripting XSS vulnerability in the Instant Web Publishing feature in FileMaker Pro 7 and 8, Server 7 and 8, and Developer 7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2007-6115

CVE-2007-6115 describes a buffer overflow in Wireshark’s ANSI MAP dissector affecting 0.99.5–0.99.6 on unspecified platforms. This flaw can be triggered by malformed input packets, enabling remote attackers to cause a denial of service and potentially execute arbitrary code. Public advisories ref...

CVE-2007-6121

Wireshark (formerly Ethereal) versions 0.8.16 through 0.99.6 are affected by CVE-2007-6121 due to a malformed RPC Portmap packet that could crash the process (denial of service). Severity is shown as MEDIUM with network vector and no authentication required in the CVE entry; the impact is a crash...

CVE-2007-6118

Wireshark’s MEGACO dissector (CVE-2007-6118) is vulnerable to resource exhaustion through crafted network packets, causing a long loop and denial of service. Reports across multiple advisories indicate the MEGACO dissector could loop or consume excessive resources when parsing certain input. The ...

CVE-2007-6113

Integer signedness error in the DNP3 dissector in Wireshark formerly Ethereal 0.10.12 to 0.99.6 allows remote attackers to cause a denial of service long loop via a malformed DNP3 packet...

CVE-2007-6101

CVE-2007-6101 affects Ability Mail Server up to version 2.61 (i.e., before 2.61). The vulnerability arises in two areas: (1) IMAP commands with malformed number list ranges and (2) messages containing a blank string. Both issues can be exploited by remote authenticated users to cause a denial of ...

CVE-2007-6112

Wireshark 0.99.6 is affected by CVE-2007-6112 (buffer overflow in the PPP dissector) that could be triggered remotely to crash the application and potentially execute arbitrary code. Public advisories (e.g., RHSA-2008:0058, CESA-2008:0058, and related NASL summaries) indicate fixes in subsequent ...

CVE-2007-6104

The CVE-2007-6104 issue affects FileMaker Pro 7/8, Server 7/8, and Developer 7, with a cross-site scripting vulnerability in the Instant Web Publishing function. The root cause is an XSS flaw allowing injected scripts/HTML via unspecified vectors. Documented impact: arbitrary script execution in ...

Important: poppler security update

2.3.27-8.1 Fixes for: - 345101 - CVE-2007-4352 xpdf memory corruption in DCTStream::readProgressiveDataUnit - 345111 - CVE-2007-5392 xpdf buffer overflow in DCTStream::reset - 345121 - CVE-2007-5393 xpdf buffer overflow in CCITTFaxStream::lookChar...

Important: openldap security and enhancement update

2.3.27-8.1 - fix security issue CVE-2007-5707 360001 - fix manual bind timeout 368231 -------------- next part -------------- An HTML attachment was scrubbed... URL: http://oss.oracle.com/pipermail/el-errata/attachments/20071123/279499e3/attachment-0001.html...

Critical: samba security update

3.0.25b-0.el51.1 - Security fix for CVE-2007-4138 - Security fix for CVE-2007-4572 - Security fix for CVE-2007-5398 - Multilib Fix - resolves: 351501 - resolves: 350761 - resolves: 359151 - resolves: 356851 -------------- next part -------------- An HTML attachment was scrubbed... URL:...

Microsoft Jet Engine MDB file ColumnName buffer overflow

Added: 11/23/2007 CVE: CVE-2007-6026 BID: 26468 OSVDB: 44880 Background The Microsoft Jet Database Engine provides data access functionality for a number of applications. Problem A buffer overflow vulnerability in the Microsoft Jet Database Engine could lead to command execution when a user opens...

Moderate: ruby security update

1.8.5-5.el51.1 - security fix for CVE-2007-5162 and CVE-2007-5770 - ruby-1.8.5-CVE-2007-5162.patch: fix issues that is insufficient verification of SSL certificate. 320331 - Fix the multilib regression issue. 1.8.5-5 - security fix release. - ruby-1.8.5-cgi-CVE-2006-6303.patch: fix a infinite loo...

Microsoft Jet Engine MDB file ColumnName buffer overflow

Added: 11/23/2007 CVE: CVE-2007-6026 BID: 26468 OSVDB: 44880 Background The Microsoft Jet Database Engine provides data access functionality for a number of applications. Problem A buffer overflow vulnerability in the Microsoft Jet Database Engine could lead to command execution when a user opens...