CVE-2007-6402

Stack-based buffer overflow in mplayerc.exe in Media Player Classic MPC 6.4.9, when used with the 3ivx 4.5.1 or 5.0.1 codec, allows remote attackers to execute arbitrary code via a certain .mp4 file, possibly a related issue to CVE-2007-6401...

CVE-2007-6400

CVE-2007-6400 affects PolDoc CMS (aka PDDMS) 0.96 in download_file.php. The vulnerability is a directory traversal flaw that lets remote attackers read arbitrary files by supplying a .. or absolute path in the filename parameter. This exposes partial confidentiality (per the CVSS 2.0 entry: AV:N/...

Security fix for the ALT Linux 7 package libexif version 0.6.16-alt2

Dec. 17, 2007 Dmitriy Khanzhin 0.6.16-alt2 - security fixes: + CVE-2007-6351, CVE-2007-6352 upstream patches + thanks ldv@ for information - licence tag changed to LGPLv2+...

Unfixed XSS vulnerability at www.hugegaypass.com

Security researcher TreX, has submitted on 17/12/2007 a cross-site-scripting XSS vulnerability affecting www.hugegaypass.com, which at the time of submission ranked 336558 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 19/12/2007. It is...

Apple OS X Software Update Command Execution

This module exploits a feature in the Distribution Packages, which are used in the Apple Software Update mechanism. This feature allows for arbitrary command execution through JavaScript. This exploit provides the malicious update server. Requests must be redirected to this server by other means...

Fedora 7 : squid-2.6.STABLE16-2.fc7 (2007-4161)

Thu Dec 6 2007 Martin Nagy - 7:2.6.STABLE16-1 - Upstream patch to fix CVE-2007-6239 410181 - Fri Sep 7 2007 Martin Bacovsky - 7:2.6.STABLE16-1 - upgrade to latest upstream 2.6.STABLE14 - Wed Aug 1 2007 Martin Bacovsky - 7:2.6.STABLE14-1 - upgrade to latest upstream 2.6.STABLE14 - Mon Jun 4 2007...

Fedora 7 : autofs-5.0.1-29 (2007-4469)

Thu Dec 13 2007 Ian Kent - 5.0.1-29 - Bug 421351: CVE-2007-5964 autofs defaults don't restrict suid in /net f7 - use mount option 'nosuid' for '-hosts' map unless 'suid' is explicily specified. - Wed Sep 5 2007 Ian Kent - 5.0.1-28 - add ldaps support required by schema discovery. - add back LDAP...

Mac OS X : Java for Mac OS X 10.4 Release 6

The remote Mac OS X 10.4 host is running a version of Java for Mac OS X that is older than release 6. The remote version of this software contains several security vulnerabilities that may allow a rogue Java applet to escalate its privileges and to add or remove arbitrary items from the user's...

Fedora 8 : mysql-5.0.45-6.fc8 (2007-4465)

Thu Dec 13 2007 Tom Lane 5.0.45-6 - Back-port upstream fixes for CVE-2007-5925, CVE-2007-5969, CVE-2007-6303. Related: 422211 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean...

Slackware 11.0 / 12.0 / current : mysql (SSA:2007-348-01)

New mysql packages are available for Slackware 11.0, 12.0, and -current to fix bugs and security issues. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Slackware Security Advisory 2007-348-01. The text itself is...

Debian DSA-1432-1 : link-grammar - buffer overflow

Alin Rad Pop discovered that link-grammar, Carnegie Mellon University's link grammar parser for English, performed insufficient validation within its tokenizer, which could allow a malicious input file to execute arbitrary code. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive...

Fedora 7 : mysql-5.0.45-6.fc7 (2007-4471)

Thu Dec 13 2007 Tom Lane 5.0.45-6 - Back-port upstream fixes for CVE-2007-5925, CVE-2007-5969, CVE-2007-6303. Related: 422211 - Update License tag to match code. - Sun Jul 22 2007 Tom Lane 5.0.45-1 - Update to MySQL 5.0.45 Resolves: 246535 - Move mysqlconfig's man page to base package Resolves:...

[SECURITY] [DSA 1434-1] New mydns packages fix denial of service

------------------------------------------------------------------------ Debian Security Advisory DSA-1434-1 [email protected] http://www.debian.org/security/ Thijs Kinkhorst December 16, 2007 http://www.debian.org/security/faq -...

[SECURITY] [DSA 1433-1] New centericq packages fix execution of code

------------------------------------------------------------------------ Debian Security Advisory DSA-1433-1 [email protected] http://www.debian.org/security/ Steve Kemp December 16, 2007 http://www.debian.org/security/faq -...

[SECURITY] [DSA 1432-1] New link-grammar packages fix execution of code

------------------------------------------------------------------------ Debian Security Advisory DSA-1432-1 [email protected] http://www.debian.org/security/ Steve Kemp December 16, 2007 http://www.debian.org/security/faq -...

Unfixed XSS vulnerability at www.behtarinbazi.com

Security researcher TreX, has submitted on 16/12/2007 a cross-site-scripting XSS vulnerability affecting www.behtarinbazi.com, which at the time of submission ranked 227825 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 12/01/2008. It is...

Unfixed XSS vulnerability at www.behtarincd.com

Security researcher TreX, has submitted on 16/12/2007 a cross-site-scripting XSS vulnerability affecting www.behtarincd.com, which at the time of submission ranked 114244 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 12/01/2008. It is current...

Unfixed XSS vulnerability at www.airasia.com

Security researcher DerickTham, has submitted on 16/12/2007 a cross-site-scripting XSS vulnerability affecting www.airasia.com, which at the time of submission ranked 2421 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 16/12/2007. It is...

Hosting Controller - Multiple Security Bugs (Extremely Critical)

Title: Multiple Security Bugs In Hosting Controller Critical: Extremely critical Impact: Full system administrator access Vendor: Hosting Controller Version: 6.1 Hot fix = 3.3 Vendor URL: www.hostingcontroller.com Solution: N/A From company - There is temporary solution in this report Exploit:...

[security bulletin] HPSBUX02294 SSRT071451 rev.1 - HP-UX Running DCE, Remote Denial of Service (DoS)

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c01294212 Version: 1 HPSBUX02294 SSRT071451 rev.1 - HP-UX Running DCE, Remote Denial of Service DoS NOTICE: The information in this Security Bulletin should be acted upon as soon as possible...