Fedora 7 : clamav-0.91.2-2.fc7 (2007-2050)

Sat Aug 25 2007 Enrico Scholz - 0.91.2-2 - fixed an open2 issue - Sat Aug 25 2007 Enrico Scholz - 0.91.2-1 - updated to 0.91.2 SECURITY : - CVE-2007-4510 DOS in RTF parser - DOS in html normalizer - arbitrary command execution by special crafted recipients in clamav-milter's black-hole mode Note...

Fedora 7 : star-1.5a84-2.fc7 (2007-1852)

Mon Aug 27 2007 Peter Vrabec 1.5a84-2 - fix segfault of data-change-warn option 255261, patch from dkopecek at redhat.com - Fri Aug 24 2007 Peter Vrabec 1.5a84-1 - new upstream release with CVE-2007-4134 fix - Sun Jun 24 2007 Peter Vrabec 1.5a76-3 - build star on ARM platforms 245465 Note that...

QuickTime < 7.3 Multiple Vulnerabilities (Mac OS X)

The version of QuickTime installed on the remote Mac OS X host is older than 7.3. Such versions contain several vulnerabilities that may allow an attacker to execute arbitrary code on the remote host if he can trick the user to open a specially crafted file with QuickTime. C Tenable Network...

RHEL 3 / 4 / 5 : perl (RHSA-2007:0966)

Updated Perl packages that fix a security issue are now available for Red Hat Enterprise Linux 3, 4, and 5. This update has been rated as having important security impact by the Red Hat Security Response Team. Perl is a high-level programming language commonly used for system administration...

Fedora 7 : ruby-1.8.6.110-1.fc7 (2007-2406)

Thu Oct 4 2007 Akira TAGOH - 1.8.6.110-1 - New upstream release. - ruby-r12567.patch: removed. - ruby-1.8.6-CVE-2007-5162.patch: security fix for Net::HTTP that is insufficient verification of SSL certificate. 313791 - Wed Jul 25 2007 Akira TAGOH - 1.8.6.36-3 - ruby-r12567.patch: backport patch...

Fedora 7 : openoffice.org-2.2.0-14.11 (2007-0410)

This update fixes a possible buffer overrun in hand-crafted rtf files that use the custom /prtdata tag. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much a...

Fedora 7 : thunderbird-2.0.0.4-1.fc7 (2007-0544)

This update fixes two security issues found in the 2.0.0.0 version of Thunderbird. Details at: http://www.mozilla.org/security/announce/2007/mfsa2007-12.html http://www.mozilla.org/security/announce/2007/mfsa2007-15.html Users of Thunderbird are recommended to update to this erratum package which...

Fedora 7 : fetchmail-6.3.7-2.fc7 (2007-1983)

Mon Sep 3 2007 Vitezslav Crhonek - 6.3.7-2 - Fix license - Fix fetchmail NULL pointer dereference CVE-2007-4565 Resolves: 260861 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically...

Fedora 7 : openssl-0.9.8b-14.fc7 (2007-1444)

Fri Aug 3 2007 Tomas Mraz 0.9.8b-14 - use localhost in testsuite, hopefully fixes slow build in koji - CVE-2007-3108 - fix side channel attack on private keys 250577 - make ssl session cache id matching strict 233599 - Wed Jul 25 2007 Tomas Mraz 0.9.8b-13 - allow building on ARM architectures...

Fedora 7 : krb5-1.6.1-4.fc7 (2007-2066)

The originally-used patch for CVE-2007-3999 didn't completely fix the bug. This update includes the revised patch. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format i...

Fedora 7 : bochs-2.3-7.fc7 (2007-1778)

This security update of bochs fixes CVE-2007-2894 : The emulated floppy disk controller in Bochs 2.3 allows local users of the guest operating system to cause a denial of service virtual machine crash via unspecified vectors, resulting in a divide-by-zero error. Note that Tenable Network Security...

[SECURITY] [DSA 1401-1] New iceape packages fix several vulnerabilities

-------------------------------------------------------------------------- Debian Security Advisory DSA 1401-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff November 5th, 2007 http://www.debian.org/security/faq -...

Design/Logic Flaw

Unspecified vulnerability in selectLanguage.do in SSL-Explorer before 0.2.15 allows remote attackers to inject 1 headers or 2 body data in an HTTP transaction, a different vulnerability than CVE-2007-2907. NOTE: some of these details are obtained from third party information...

CVE-2007-5824

webserver.c in mt-dappd in Firefly Media Server 0.2.4 and earlier allows remote attackers to cause a denial of service NULL dereference and daemon crash via a stats method action to /xml-rpc with 1 an empty Authorization header line, which triggers a crash in the wsdecodepassword function; or 2 a...

CVE-2007-5836

CVE-2007-5836 documents a SQL injection vulnerability in Amazing Flash AFCommerce Shopping Cart. The affected component/entry points are an unspecified component via the firstname parameter (and related references indicate a similar issue via the search field). The root cause is SQL injection all...

CVE-2007-5823

CVE-2007-5823 affects Ben Ng Scribe 0.2 and earlier. The vulnerability is a directory traversal in forum.php, exploitable via the username parameter in a Register action, allowing remote attackers to create or overwrite arbitrary files by using .. (dot dot). The linked sources (NVD/NVD-processed ...

CVE-2007-5824

CVE-2007-5824, CVE-2007-5825 and CVE-2008-1771 affect mt-daapd (Firefly Media Server) and its web/XML-RPC handling. The issues include: (1) insufficient validation and bounds checking of the Authorization HTTP header leading to a heap buffer overflow; (2) format string vulnerabilities in debug lo...

CVE-2007-5827

CVE-2007-5827 affects iscsitarget (iSCSI Enterprise Target) version 0.4.15, where /etc/ietd.conf is created with weak permissions. This allows local users to read passwords stored in that file, resulting in potential credential exposure. The underlying issue is improper access permissions on a cr...

CVE-2007-5828

Cross-site request forgery (CSRF) vulnerability in Django 0.96 is exposed in the admin panel, allowing remote attackers to change passwords via a request to admin/auth/user/1/password/. The issue stems from the default configuration not enabling the CSRF protection module, though Debian notes thi...

CVE-2007-5835

CVE-2007-5835 affects BosDev BosNews 4 and 5, where Install.php does not require authentication for replacing an existing installation or creating a new admin account. The described impact is denial of service via overwritten files and the possibility of obtaining administrative access. No explic...