CentOS 4 / 5 : thunderbird (CESA-2007:0981)

Updated thunderbird packages that fix several security bugs are now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Mozilla Thunderbird is a standalone mail and newsgroup client. Several flaws wer...

Debian DSA-1394-1 : reprepro - authentication bypass

It was discovered that reprepro, a tool to create a repository of Debian packages, only checks the validity of known signatures when updating from a remote site, and thus does not reject packages with only unknown signatures. This allows an attacker to bypass this authentication mechanism. The...

FreeBSD : ldapscripts -- Command Line User Credentials Disclosure (3a81017a-8154-11dc-9283-0016179b2dd5)

Ganael Laplanche reports : Up to now, each ldap command was called with the -w parameter, which allows to specify the bind password on the command line. Unfortunately, this could make the password appear to anybody performing a ps during the call. This is now avoided by using the -y parameter and...

RHEL 2.1 / 3 : openssl (RHSA-2007:0813)

Updated OpenSSL packages that correct security issues are now available for Red Hat Enterprise Linux 2.1 and 3. This update has been rated as having moderate security impact by the Red Hat Security Response Team. OpenSSL is a toolkit that implements Secure Sockets Layer SSL v2/v3 and Transport...

RealPlayer ActiveX control playlist name buffer overflow

Added: 10/25/2007 CVE: CVE-2007-5601 BID: 26130 OSVDB: 41430 Background RealPlayer and RealOne Player include a number of ActiveX controls allowing functions to be called by scripts embedded in web pages. Problem The RealPlayer Database Component MPAMedia.dll is affected by a buffer overflow...

MDKA-2007:096 : timezone

Updated timezone packages are being provided for older Mandriva Linux systems that do not contain the new Daylight Savings Time information for 2007 for certain time zones. These updated packages contain the new information. %NASLMINLEVEL 999999 @DEPRECATED@ This script has been deprecated as the...

RHEL 2.1 / 3 / 4 / 5 : libpng (RHSA-2007:0992)

Updated libpng packages that fix security issues are now available for Red Hat Enterprise Linux. This update has been rated as having moderate security impact by the Red Hat Security Response Team. The libpng package contains a library of functions for creating and manipulating PNG Portable Netwo...

CentOS 3 / 4 / 5 : libpng (CESA-2007:0992)

Updated libpng packages that fix security issues are now available for Red Hat Enterprise Linux. This update has been rated as having moderate security impact by the Red Hat Security Response Team. The libpng package contains a library of functions for creating and manipulating PNG Portable Netwo...

RHEL 5 : kernel (RHSA-2007:0940)

Updated kernel packages that fix various security issues in the Red Hat Enterprise Linux 5 kernel are now available. This update has been rated as having important security impact by the Red Hat Security Response Team. The Linux kernel handles the basic functions of the operating system. These ne...

CentOS 3 / 4 : seamonkey (CESA-2007:0980)

Updated SeaMonkey packages that fix several security bugs are now available for Red Hat Enterprise Linux 2.1, 3, and 4. This update has been rated as having critical security impact by the Red Hat Security Response Team. SeaMonkey is an open source Web browser, advanced email and newsgroup client...

CentOS 4 / 5 : flac (CESA-2007:0975)

An updated flac package to correct a security issue is now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having important security impact by the Red Hat Security Response Team. FLAC is a Free Lossless Audio Codec. The flac package consists of a FLAC encoder and...

RHEL 4 / 5 : firefox (RHSA-2007:0979)

Updated firefox packages that fix several security bugs are now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having critical security impact by the Red Hat Security Response Team. Mozilla Firefox is an open source Web browser. Several flaws were found in the way i...

Debian DSA-1392-1 : xulrunner - several vulnerabilities

Several remote vulnerabilities have been discovered in Xulrunner, a runtime environment for XUL applications. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2007-1095 Michal Zalewski discovered that the unload event handler had access to the address of...

CVE-2007-5678

SQL injection vulnerability in the Music module in phpBasic allows remote attackers to execute arbitrary SQL commands via the id parameter in a view action to the default URI...

CVE-2007-5675

CVE-2007-5675 affects the MultiXTpm Application Server, with the vulnerable component/function identified as the DebugPrint function. The root cause is described as a stack-based buffer overflow, allowing an attacker to supply a long string argument that could lead to remote code execution. Affec...

CVE-2007-5676

CVE-2007-5676 relates to a PHP remote file inclusion in PHP-Nuke Platinum 7.6.b.5, specifically in modules/Forums/favorites.php. The underlying issue allows an attacker to execute arbitrary PHP code via a URL supplied to the nuke_bb_root_path parameter, enabling remote code execution. The affecte...

CVE-2007-5678

The CVE-2007-5678 entry describes an SQL injection in the Music module of phpBasic, exploitable via the id parameter in a view action. Affected component: phpBasic Music module; vulnerability arises from unsanitized input used in SQL queries, enabling remote attackers to alter or access data. Imp...

CVE-2007-5673

CVE-2007-5673 is a confirmed cross-site scripting (XSS) vulnerability in the device’s web interface: specifically the cgi-bin/webif.exe component of the ifnet WebIf. The issue allows remote attackers to inject arbitrary web script or HTML via the cmd parameter, resulting in likely client-side scr...

CVE-2007-5677

CVE-2007-5677 describes a cross-site scripting (XSS) vulnerability in the Hackish BETA 1.1 software, specifically in the shoutbox/blocco.php component. The issue allows remote attackers to inject arbitrary web script or HTML by supplying a crafted value to the go_shout parameter. The vulnerabilit...

CVE-2007-5674

CVE-2007-5674 concerns InstaGuide Weather (aka Weather for PHP) 1.0. a directory traversal flaw in index.php allows remote attackers to include and execute arbitrary local files through a .. in the PageName parameter when magic_quotes_gpc is disabled. Affected component is the web application’s i...