iDefense Security Advisory 11.05.07: Apple QuickTime Panorama Sample Atom Heap Buffer Overflow Vulnerability

iDefense Security Advisory 11.05.07 http://labs.idefense.com/intelligence/vulnerabilities/ Nov 05, 2007 I. BACKGROUND QuickTime is Apple's media player product used to render video and other media. For more information visit http://www.apple.com/quicktime/ QuickTime VR virtual reality is a type o...

Fedora 7 : liferea-1.2.23-4.fc7 (2007-2725)

Added patch to fix weak permission in feedlist.opml backup file. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing addition...

Fedora 7 : firefox-2.0.0.5-1.fc7 (2007-1142)

Mozilla Firefox is an open source web browser, designed for standards compliance, performance and portability. Several flaws were found in the way Firefox processed certain malformed JavaScript code. A web page containing malicious JavaScript code could cause Firefox to crash or potentially execu...

Fedora 7 : cups-1.2.12-4.fc7 (2007-1541)

This update fixes a security problem concerning PDF handling. It also fixes printing speed with USB printers, and includes a fix for the LSPP support. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted...

Fedora 7 : phpPgAdmin-4.1.2-1.fc7 (2007-0469)

This release includes a high-level security fix. All users must upgrade as soon as possible : http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-2865 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to...

Fedora 7 : lighttpd-1.4.18-1.fc7 (2007-2132)

Lighttpd 1.4.17 and earlier is prone to a header overflow when using the modfastcgi extension, this can lead to arbitrary code execution in the fastcgi application. This 1.4.18 update fixes the issue. Note that Tenable Network Security has extracted the preceding description block directly from t...

Fedora 7 : openvrml-0.16.6-3.fc7 (2007-2686)

Wed Oct 24 2007 Braden McDaniel - 0.16.6-3 - Updated firefox dependency to 2.0.0.8. - Thu Jun 7 2007 Braden McDaniel - 0.16.6-2 - Updated firefox dependency to 2.0.0.5. - Thu Jun 7 2007 Braden McDaniel - 0.16.6-1 - Updated to 0.16.6. - Thu Jun 7 2007 Braden McDaniel - 0.16.5-1 - Updated to...

Fedora 7 : openoffice.org-2.2.1-18.2.fc7 (2007-2372)

This security updates addresses CVE-2007-2834 a flaw in how openoffice.org handles corrupt TIFF graphic format file headers Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and...

SiteBar: Multiple issues

Background SiteBar is a PHP application that allows users to store their bookmarks on a web server. Description Tim Brown discovered these multiple issues: the translation module does not properly sanitize the value to the "dir" parameter CVE-2007-5491, CVE-2007-5694; the translation module also...

Fedora Core 6 : ruby-1.8.5.114-1.fc6 (2007-738)

This release contains another fixes of CVE-2007-5162 for Net::FTPTLS, Net::Telnet and Net::IMAP. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as...

Fedora 7 : wordpress-2.2.2-0.fc7 (2007-1885)

Update to upstream 2.2.2, security fixes Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL...

Fedora 7 : tar-1.15.1-28.fc7 (2007-2673)

Wed Oct 24 2007 Radek Brich 2:1.15.1-28 - backported upstream patch for CVE-2007-4476 tar stack crashing in safernamesuffix - Tue Aug 28 2007 Radek Brich 2:1.15.1-27 - fixed CVE-2007-4131 tar directory traversal vulnerability 253684 Note that Tenable Network Security has extracted the preceding...

Fedora 7 : fetchmail-6.3.7-2.fc7 (2007-1983)

Mon Sep 3 2007 Vitezslav Crhonek - 6.3.7-2 - Fix license - Fix fetchmail NULL pointer dereference CVE-2007-4565 Resolves: 260861 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically...

Fedora Core 6 : tar-1.15.1-27.fc6 (2007-735)

Wed Oct 24 2007 Radek Brich 2:1.15.1-27 - backported upstream patch for CVE-2007-4476 tar stack crashing in safernamesuffix Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and...

Fedora 7 : mapserver-4.10.3-2.fc7 (2007-2018)

Thu Aug 30 2007 Oliver Falk 4.10.3-2 - Add fix to include libmapserver in some places, instead of libmap, that doesn't exist anymore - Thu Aug 30 2007 Oliver Falk 4.10.3-1 - Update to fix bz256561, CVE-2007-4542 Note that Tenable Network Security has extracted the preceding description block...

Fedora 7 : star-1.5a84-2.fc7 (2007-1852)

Mon Aug 27 2007 Peter Vrabec 1.5a84-2 - fix segfault of data-change-warn option 255261, patch from dkopecek at redhat.com - Fri Aug 24 2007 Peter Vrabec 1.5a84-1 - new upstream release with CVE-2007-4134 fix - Sun Jun 24 2007 Peter Vrabec 1.5a76-3 - build star on ARM platforms 245465 Note that...

QuickTime < 7.3 Multiple Vulnerabilities (Mac OS X)

The version of QuickTime installed on the remote Mac OS X host is older than 7.3. Such versions contain several vulnerabilities that may allow an attacker to execute arbitrary code on the remote host if he can trick the user to open a specially crafted file with QuickTime. C Tenable Network...

Fedora 7 : httpd-2.2.4-4.1.fc7 (2007-0704)

The Apache HTTP Server did not verify that a process was an Apache child process before sending it signals. A local attacker with the ability to run scripts on the Apache HTTP Server could manipulate the scoreboard and cause arbitrary processes to be terminated which could lead to a denial of...

Fedora 7 : seamonkey-1.1.5-1.fc7 (2007-2601)

SeaMonkey is an open source Web browser, advanced email and newsgroup client, IRC chat client, and HTML editor. By leveraging browser flaws, users could be fooled into possibly surrendering sensitive information CVE-2007-1095, CVE-2007-3511, CVE-2007-3844, CVE-2007-5334. Malformed web content cou...

Fedora 7 : dar-2.3.4-1.fc7 (2007-0904)

Adding CVE reference Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL 70300 C Tenable...