Important: tetex security update

2.0.2-22.0.1.EL4.10 - fix t1lib flaw CVE-2007-4033 356691 Resolves: 356691 2.0.2-22.0.1.EL4.9 - fix CVE-2007-4352 CVE-2007-5392 CVE-2007-5393, various xpdf flaws 356691 Resolves: 356691...

Unfixed XSS vulnerability at www.deathpenaltyinfo.org

Security researcher Narcoticxs, has submitted on 11/08/2007 a cross-site-scripting XSS vulnerability affecting www.deathpenaltyinfo.org, which at the time of submission ranked 235568 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 21/08/2007. I...

Unfixed XSS vulnerability at www.ericclaptonphotos.com

Security researcher CoNqUeRoR, has submitted on 11/08/2007 a cross-site-scripting XSS vulnerability affecting www.ericclaptonphotos.com, which at the time of submission ranked 1204555 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 21/08/2007. ...

DSA-1403-1 phpmyadmin - cross-site scripting

Bulletin has no description...

Fedora 8 : mono-1.2.5.1-2.fc8 (2007-2969)

A buffer overflow in the Mono.Math.BigInteger class in Mono allows attackers to execute arbitrary code. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much a...

RHEL 3 : xpdf (RHSA-2007:1030)

Updated xpdf packages that fix several security issues are now available for Red Hat Enterprise Linux 3. This update has been rated as having important security impact by the Red Hat Security Response Team. Xpdf is an X Window System-based viewer for Portable Document Format PDF files. Alin Rad P...

Fedora 8 : cups-1.3.4-2.fc8 (2007-2982)

This update fixes a remote code execution vulnerability in the IPP handling part of the CUPS scheduler, as well as several PDF handling security issues. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempt...

CVE-2007-4766

Multiple integer overflows in Perl-Compatible Regular Expression PCRE library before 7.3 allow context-dependent attackers to cause a denial of service crash or execute arbitrary code via unspecified escape backslash sequences...

CVE-2007-4676

Heap-based buffer overflow in Apple QuickTime before 7.3 allows remote attackers to execute arbitrary code via malformed elements when parsing 1 Poly type 0x0070 through 0x0074 and 2 PackBitsRgn field 0x0099 opcodes in a PICT image...

CVE-2007-1659

Perl-Compatible Regular Expression PCRE library before 7.3 allows context-dependent attackers to cause a denial of service crash and possibly execute arbitrary code via regex patterns containing unmatched "\Q\E" sequences with orphan "\E" codes...

CVE-2007-1662

Perl-Compatible Regular Expression PCRE library before 7.3 reads past the end of the string when searching for unmatched brackets and parentheses, which allows context-dependent attackers to cause a denial of service crash, possibly involving forward references...

CVE-2007-1659

Perl-Compatible Regular Expression PCRE library before 7.3 allows context-dependent attackers to cause a denial of service crash and possibly execute arbitrary code via regex patterns containing unmatched "\Q\E" sequences with orphan "\E" codes...

CVE-2007-4675

Heap-based buffer overflow in the QuickTime VR extension 7.2.0.240 in QuickTime.qts in Apple QuickTime before 7.3 allows remote attackers to execute arbitrary code via a QTVR QuickTime Virtual Reality movie file containing a large size field in the atom header of a panorama sample atom...

CVE-2007-1660

Perl-Compatible Regular Expression PCRE library before 7.0 does not properly calculate sizes for unspecified "multiple forms of character class", which triggers a buffer overflow that allows context-dependent attackers to cause a denial of service crash and possibly execute arbitrary code...

CVE-2007-1661

Perl-Compatible Regular Expression PCRE library before 7.3 backtracks too far when matching certain input bytes against some regex patterns in non-UTF-8 mode, which allows context-dependent attackers to obtain sensitive information or cause a denial of service crash, as demonstrated by the "\X?\d...

CVE-2007-5888

Cross-site scripting XSS vulnerability in displayecard.php in Coppermine Photo Gallery CPG before 1.4.14 allows remote attackers to inject arbitrary web script or HTML via the data parameter...

CVE-2007-5887

The CVE-2007-5887 entry describes an SQL injection vulnerability in the ASP Message Board 2.2.1c component boards/printer.asp, exploitable via the id parameter to allow remote execution of arbitrary SQL commands. The affected software is ASP Message Board 2.2.1c; root cause is improper handling o...

CVE-2007-5741

Concrete details found: CVE-2007-5741 affects Plone 2.5–2.5.4 and 3.0–3.0.2. The vulnerability arises from unpickling of network data in the statusmessages and linkintegrity modules, enabling remote arbitrary Python code execution. Exploitation details are not provided in the connected documents....

CVE-2007-5888

CVE-2007-5888 is a cross-site scripting (XSS) vulnerability in Coppermine Photo Gallery (CPG) that affects the file displayecard.php. It allows remote attackers to inject arbitrary web script or HTML via the data parameter in versions before 1.4.14. The documented impact is injection of script/HT...

[SECURITY] [DSA 1402-1] New gforge packages fix several vulnerabilities

------------------------------------------------------------------------ Debian Security Advisory DSA-1402-1 [email protected] http://www.debian.org/security/ Steve Kemp November 07, 2007 http://www.debian.org/security/faq -...