Macrovision SafeDisc secdrv.sys Crafted METHOD_NEITHER IOCTL Local Overflow

Macrovision SafeDisc, a copy-protection application for Microsoft Windows, is installed on the remote host. The 'SECDRV.SYS' driver included with the version of SafeDisc currently installed on the remote host enables a local user to gain SYSTEM privileges using a specially crafted argument to the...

Important: Red Hat Security Advisory: kdegraphics security update

Updated kdegraphics packages that fix a security issue are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. The kdegraphics packages contain applications for the K Desktop Environment. This includes...

Important: Red Hat Security Advisory: kdegraphics security update

Updated kdegraphics packages that fix several security issues are now available for Red Hat Enterprise Linux 4. This update has been rated as having important security impact by the Red Hat Security Response Team. The kdegraphics packages contain applications for the K Desktop Environment. This...

[slackware-security] xpdf/poppler/koffice/kdegraphics

New xpdf packages are available for Slackware 9.1, 10.0, 10.1, 10.2, 11.0, 12.0, and -current. New poppler packages are available for Slackware 12.0 and -current. New koffice packages are available for Slackware 11.0, 12.0, and -current. New kdegraphics packages are available for Slackware 10.2,...

[SECURITY] [DSA 1403-1] New phpmyadmin packages fix cross-site scripting

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -------------------------------------------------------------------------- Debian Security Advisory DSA 1403-1 [email protected] http://www.debian.org/security/ Thijs Kinkhorst November 8th, 2007 http://www.debian.org/security/faq -...

Unfixed XSS vulnerability at www.tiens-istanbul.com

Security researcher Uber0n, has submitted on 11/12/2007 a cross-site-scripting XSS vulnerability affecting www.tiens-istanbul.com, which at the time of submission ranked 0 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 21/12/2007. It is...

iDefense Security Advisory 11.09.07: AOL AmpX ActiveX Control Multiple Buffer Overflow Vulnerabilities

iDefense Security Advisory 11.09.07 http://labs.idefense.com/intelligence/vulnerabilities/ Nov 09, 2007 I. BACKGROUND America Online's AmpX is an ActiveX control associated with AOL Radio. It is typically used for embedding streaming audio content in web pages. For more information visit the...

Fedora 8 : openldap-2.3.39-1.fc8 (2007-2796)

Fri Nov 2 2007 Jan Safranek 2.3.39-1.fc8 - new upstream version, fixing few security flaws 362991 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as...

RHEL 4 : kdegraphics (RHSA-2007:1024)

The remote Redhat Enterprise Linux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2007:1024 advisory. - xpdf memory corruption in DCTStream::readProgressiveDataUnit CVE-2007-4352 - xpdf buffer overflow in DCTStream::reset CVE-2007-5392 - xpdf...

Fedora 8 : koffice-1.6.3-13.fc8 (2007-3093)

This update includes fixes to pdf import filters that can cause crashes possibly execute arbitrary code. See http://www.kde.org/info/security/advisory-20071107-1.txt Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenabl...

openSUSE 10 Security Update : libextractor (libextractor-4646)

A buffer overflow in the xpdf code contained in libextractor could be exploited by attackers to potentially execute arbitrary code CVE-2007-4352, CVE-2007-5392, CVE-2007-5393. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracte...

Debian DSA-1406-1 : horde3 - several vulnerabilities

Several remote vulnerabilities have been discovered in the Horde web application framework. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2006-3548 Moritz Naumann discovered that Horde allows remote attackers to inject arbitrary web script or HTML in t...

openSUSE 10 Security Update : pdftohtml (pdftohtml-4642)

A buffer overflow in the xpdf code contained in pdftohtml could be exploited by attackers to potentially execute arbitrary code CVE-2007-4352, CVE-2007-5392, CVE-2007-5393. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted...

openSUSE 10 Security Update : liblcms (liblcms-4629)

This update addresses security bugs in liblcms that occurred while parsing ICC profiles in JPEG images. CVE-2007-2741 Remote attackers can exploit this bug to execute arbitrary commands or cause denial-of-service. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and packa...

FreeBSD : phpmyadmin -- XSS vulnerability (2d2dcbb4-906c-11dc-a951-0016179b2dd5)

The DigiTrust Group reports : When creating a new database, a malicious user can use a client-side Web proxy to place malicious code in the db parameter of the POST request. Since dbcreate.php does not properly sanitize user-supplied input, an administrator could face a persistent XSS attack when...

openSUSE 10 Security Update : librpcsecgss (librpcsecgss-4600)

This update fixes a security problem in the librpcsecgss library used by NFSv4 also found in krb5. A invalid packet could underflow and potentially cause memory corruption and code execution. CVE-2007-3999 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package check...

Unfixed XSS vulnerability at www.grade1.co.uk

Security researcher SeeD, has submitted on 11/12/2007 a cross-site-scripting XSS vulnerability affecting www.grade1.co.uk, which at the time of submission ranked 1912863 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 16/12/2007. It is currentl...

Unfixed XSS vulnerability at www.atwebresults.com

Security researcher SeeD, has submitted on 11/12/2007 a cross-site-scripting XSS vulnerability affecting www.atwebresults.com, which at the time of submission ranked 344288 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 11/12/2007. It is...

openSUSE 10 Security Update : kernel (kernel-4641)

This kernel update fixes the following security problems : ++ CVE-2006-6058: A local denial of service when mounting MINIX filesystems was fixed. ++ CVE-2007-4997: A 2 byte buffer underflow in the ieee80211 stack was fixed, which might be used by attackers in WLAN reach to crash the machine. and...

Unfixed XSS vulnerability at www.rs-mark.schulnetz.hamm.de

Security researcher SeeD, has submitted on 11/12/2007 a cross-site-scripting XSS vulnerability affecting www.rs-mark.schulnetz.hamm.de, which at the time of submission ranked 260187 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 11/12/2007. It...