[ MDKSA-2007:207 ] - Updated perl packages fix vulnerability

Package : perl Date : November 5, 2007 Affected: 2007.0, 2007.1, 2008.0, Corporate 3.0, Corporate 4.0, Multi Network Firewall 2.0 Problem Description: Tavis Ormandy and Will Drewry discovered a flaw in Perl's regular expression engine. Specially crafted input to a regular expression can cause Per...

Immunity Canvas: NUBOARD_INCLUDE

Name| nuboardinclude ---|--- CVE| CVE-2007-5841 Exploit Pack| CANVAS Description| nuBoard remote file include Notes| CVSS: 6.8 Repeatability: Infinite VENDOR: nuboard CVE Url: http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5841 CVE Name: CVE-2007-5841...

Immunity Canvas: VPORTAL_INCLUDE

Name| vportalinclude ---|--- CVE| CVE-2007-5842 Exploit Pack| CANVAS Description| Vortex Portal remote file include Notes| CVSS: 6.8 Repeatability: Infinite VENDOR: igamingcms.com CVE Url: http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5842 CVE Name: CVE-2007-5842...

Immunity Canvas: SCWIKI_INCLUDE

Name| scwikiinclude ---|--- CVE| CVE-2007-5843 Exploit Pack| CANVAS Description| scWiki remote file include Notes| CVSS: 6.8 Repeatability: Infinite VENDOR: scWiki CVE Url: http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5843 CVE Name: CVE-2007-5843...

CVE-2007-5845

Directory traversal vulnerability in error.php in GuppY 4.6.3, 4.5.16, and earlier allows remote attackers to include and execute arbitrary local files via a .. dot dot in the id parameter. NOTE: this can be leveraged to bypass authentication and upload arbitrary files by including...

CVE-2007-4994

CVE-2007-4994 affects Red Hat Certificate System (RHCS) where new revocations generated during CRL creation could cause revoked certificates to be omitted from the CRL, enabling a bypass of revocation for some certificates. Supported by Red Hat advisories (RHSA-2007:0934; RHSA-2008:0566) and rela...

CVE-2007-5845

CVE-2007-5845 affects GuppyY up to 4.6.3 and 4.5.16 and earlier; a directory traversal in error.php allows remote local file inclusion via .. in the id parameter. This can be leveraged to bypass authentication and upload arbitrary files by including admin/inc/upload.inc with specific multipart/fo...

CVE-2007-5843

CVE-2007-5843 affects scWiki 1.0 Beta 2 with a PHP remote file inclusion in includes/common.php via the pathdot parameter, enabling remote code execution. Public exploit references exist (e.g., Exploit-DB), and Immunity CANVAS contains a scwiki_include module; no vendor patch details are provided...

CVE-2007-5846

Vulnerability summary (CVE-2007-5846) The net-snmp SNMP agent (snmp_agent.c) in versions before 5.4.1 is vulnerable to a remote denial-of-service when processing GETBULK requests with a large max-repeaters value, leading to CPU and memory exhaustion. Multiple trusted advisories confirm the issue ...

CVE-2007-5841

PHP remote file inclusion vulnerability in admin/index.php in nuBoard 0.5 allows remote attackers to execute arbitrary PHP code via a URL in the site parameter...

CVE-2007-5840

The CVE-2007-5840 entry concerns SyndeoCMS 2.5.01 (Fred Stuurman) with a PHP remote file inclusion flaw in starnet/themes/c-sky/main.inc.php. The underlying issue is an insecure cmsdir parameter that allows including a URL, enabling remote attackers to execute arbitrary PHP code. This vector is d...

CVE-2007-5844

CVE-2007-5844 affects GuppY 4.6.3. A directory traversal flaw in inc/includes.inc allows remote attackers to include and execute arbitrary local files via .. in the selskin parameter to index.php. The issue can be leveraged for remote file inclusion by including inc/boxleft.inc and supplying a UR...

CVE-2007-4997

CVE-2007-4997 affects the Linux kernel 2.6.x, including components in net/ieee80211/ieee80211_rx.c, where an off-by-two integer underflow in ieee80211_rx can crash the kernel when a runt IEEE 802.11 frame with the IEEE80211_STYPE_QOS_DATA flag is used. Impact is remote denial of service (kernel c...

CVE-2007-5839

CVE-2007-5839 affects BitchX 1.1a: the e_hostname function in commands.c allows local users to overwrite arbitrary files via a symlink attack on temporary files when using the (1) HOSTNAME or (2) IRCHOST command. Root cause described as insecure temporary-file creation (tmpnam). Impact stated: lo...

CVE-2007-4997

Integer underflow in the ieee80211rx function in net/ieee80211/ieee80211rx.c in the Linux kernel 2.6.x before 2.6.23 allows remote attackers to cause a denial of service crash via a crafted SKB length value in a runt IEEE 802.11 frame when the IEEE80211STYPEQOSDATA flag is set, aka an "off-by-two...

CVE-2007-5838

CVE-2007-5838 affects Symantec Altiris Deployment Solution 6.x prior to 6.8.380.0. A local privilege escalation is possible because a local user can gain SYSTEM privileges via the browser option “Enable key-based authentication to Deployment server.” The description notes this is a different issu...

CVE-2007-3874

The CVE-2007-3874 issue affects Symantec Altiris Deployment Solution 6.x PXE server’s tftp/mtftp daemon (pxemtftp.exe). A directory traversal vulnerability in the PXE server component could allow unauthenticated remote attackers to read arbitrary files on the Altiris server. Impact is read access...

Fedora 7 : qtpfsgui-1.8.12-1.fc7 (2007-1581)

Sun Aug 12 2007 Douglas E. Warner 1.8.12-1 - update to version 1.8.12 - fixes CVE-2007-2956; bug251674 - Thu Aug 2 2007 Douglas E. Warner 1.8.11-2 - updated License from GPL to GPLv2+ Note that Tenable Network Security has extracted the preceding description block directly from the Fedora...

Fedora 7 : kdebase-3.5.7-13.fc7 (2007-1700)

This update primarily addresses security issues around URL spoofing. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing...

Debian DSA-1399-1 : pcre3 - several vulnerabilities

Tavis Ormandy of the Google Security Team has discovered several security issues in PCRE, the Perl-Compatible Regular Expression library, which potentially allow attackers to execute arbitrary code by compiling specially crafted regular expressions. Version 7.0 of the PCRE library featured a majo...