httpd security, bug fix, and enhancement update

2.0.52-38.ent.0.1 - use oracle index page oracleindex.html - updated string and distro in specfile 2.0.52-38.ent - fix server version string 236419 2.0.52-37.ent - add security fix for CVE-2007-3847 250760 2.0.52-36.ent - add modversion, load in default httpd.conf 248696 2.0.52-35.ent - add...

pam security, bug fix, and enhancement update

0.77-66.23 - pamcracklib should count the last char when computing difference 267201 0.77-66.22 - add pamtally2 module 228044 - unset XAUTHORITY when appropriate 228980 - CVE-2007-1716 always decrement use count 230823 - reset priority only when specified in limits.conf 232407 - CVE-2007-3102...

CVE-2007-5959

CVE-2007-5959 affects Mozilla Firefox before 2.0.0.10 and SeaMonkey before 1.1.7, with memory corruption in the layout/jar handling that could crash the browser and potentially allow arbitrary code execution. Connected advisories note that SeaMonkey updates fixed these issues (and related CVEs li...

CVE-2007-5960

CVE-2007-5960 affects SeaMonkey (and Firefox) where the Referer header is set to the script window/frame instead of the content initiator, enabling spoofing of Referer-based CSRF protections. The vulnerability arises from a race condition when window.location is set, potentially causing a CSRF at...

CVE-2007-5960

Mozilla Firefox before 2.0.0.10 and SeaMonkey before 1.1.7 sets the Referer header to the window or frame in which script is running, instead of the address of the content that initiated the script, which allows remote attackers to spoof HTTP Referer headers and bypass Referer-based CSRF protecti...

CVE-2007-6129

CVE-2007-6129 affects Amber Script 1.0, where a directory traversal flaw in scripts/include/show_content.php allows remote attackers to include and execute arbitrary local files by supplying a .. in the id parameter. In some environments, this can enable remote file inclusion via UNC share paths ...

CVE-2007-6128

CVE-2007-6128 affects WorkingOnWeb 2.0.1400. A SQL injection in events.php via the idevent parameter enables remote attackers to execute arbitrary SQL commands. The provided documents do not include remediation details; no patch/version info is present here.

CVE-2007-6126

Multiple cross-site scripting XSS vulnerabilities in project alumni 1.0.9 and earlier allow remote attackers to inject arbitrary web script or HTML via the year parameter to 1 xml/index.php; or 2 the year parameter to view.page.inc.php, which is reachable through a view action to the top-level...

CVE-2007-6124

CVE-2007-6124 describes a cross-site scripting (XSS) vulnerability in the Softbiz Freelancers Script 1, specifically in signin.php. The vulnerability allows a remote attacker to inject arbitrary web script or HTML by supplying a value for the errmsg parameter. The NVD entry lists a MEDIUM base sc...

CVE-2007-6125

CVE-2007-6125 is a SQL injection vulnerability in the Softbiz Freelancers Script 1, exploitable via the sb_protype parameter in search_form.php. The issue allows remote attackers to execute arbitrary SQL commands; impact vectors are stated as partial confidentiality, integrity, and availability. ...

CVE-2007-6131

CVE-2007-6131 affects scanbuttond 0.2.3: a local attacker can overwrite arbitrary files via a symlink attack on temporary files (scan.pnm and scan.jpg). Root cause is improper handling of temp file names leading to a symlink race; impact is local privilege-related due to file overwrites. The NVD ...

CVE-2007-6123

CVE-2007-6123 is linked to IRC Services 5.1.8. Connected data cites “Code injection” as the vulnerability type, but the public records here do not provide explicit root-cause details, vectors, affected components beyond the product/version, or concrete impact. No remediation or exploitation statu...

CVE-2007-6127

CVE-2007-6127 affects project alumni 1.0.9 and earlier. The vulnerability is a SQL injection in the year parameter of two PHP entry points: view.page.inc.php (accessed via a view action to index.php) and news.page.inc.php (via a news action to index.php). Exploitation allows remote attackers to e...

CVE-2007-6130

The CVE-2007-6130 issue affects gnump3d 2.9final, where password protection is not applied to plugins, potentially allowing remote attackers to bypass intended access restrictions. The vulnerability concerns plugin-level access controls rather than core authentication, with the NVD and SUSE entri...

CVE-2007-6122

CVE-2007-6122 affects IRC Services. The default_encrypt() function in encrypt.c fails to handle overly long passwords, enabling a remote attacker to crash the daemon (DoS). Affected versions are IRC Services prior to 5.0.63 and 5.1.x prior to 5.1.7. Multiple sources (Gentoo GLSA 200712-12; OpenVA...

CVE-2007-6126

CVE-2007-6126 affects Project Alumni versions 1.0.9 and earlier. The vulnerability is a cross-site scripting (XSS) flaw that allows remote attackers to inject arbitrary scripts via the year parameter in (1) xml/index.php and (2) view.page.inc.php, reachable through a view action to index.php. The...

[SECURITY] [DSA 1413-1] New mysql packages fix multiple vulnerabilities

------------------------------------------------------------------------ Debian Security Advisory DSA-1413-1 [email protected] http://www.debian.org/security/ Noah Meyerhans November 26, 2007 http://www.debian.org/security/faq -...

[SECURITY] [DSA 1413-1] New mysql packages fix multiple vulnerabilities

------------------------------------------------------------------------ Debian Security Advisory DSA-1413-1 [email protected] http://www.debian.org/security/ Noah Meyerhans November 26, 2007 http://www.debian.org/security/faq -...

Important: Red Hat Security Advisory: java-1.5.0-ibm security update

Updated java-1.5.0-ibm packages that fix several security issues are now available for Red Hat Enterprise Linux 4 Extras and 5 Supplementary. This update has been rated as having important security impact by the Red Hat Security Response Team. IBM's 1.5.0 Java release includes the IBM Java 2...

[SECURITY] [DSA 1409-2] New samba packages fix several vulnerabilities

------------------------------------------------------------------------ Debian Security Advisory DSA-1409-2 [email protected] http://www.debian.org/security/ Steve Kemp November 26, 2007 http://www.debian.org/security/faq -...