[SECURITY] [DSA 1395-1] New xen-utils packages fix file truncation

------------------------------------------------------------------------ Debian Security Advisory DSA 1395-1 [email protected] http://www.debian.org/security/ Steve Kemp October 25th, 2007 http://www.debian.org/security/faq -...

JVN#50495547 Ichitaro series buffer overflow vulnerability

The "Ichitaro" series word processing software, from JustSystems Corporation, contains a buffer overflow vulnerability. If a user opens a specially crafted jtd file or views it on a web browser, an attacker could execute arbitrary code with the privileges of the user. Impact An attacker could...

MDKA-2007:096 : timezone

Updated timezone packages are being provided for older Mandriva Linux systems that do not contain the new Daylight Savings Time information for 2007 for certain time zones. These updated packages contain the new information. %NASLMINLEVEL 999999 @DEPRECATED@ This script has been deprecated as the...

Unfixed XSS vulnerability at www.gmail.it

Security researcher Langy, has submitted on 25/10/2007 a cross-site-scripting XSS vulnerability affecting www.gmail.it, which at the time of submission ranked 421085 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 04/11/2007. It is currently...

openSUSE 10 Security Update : fetchmail (fetchmail-4490)

This update fixes a remote denial-of-service attack. CVE-2007-4565 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update fetchmail-4490. The text description of this plugin is C SUSE LLC...

RHEL 2.1 / 3 / 4 / 5 : libpng (RHSA-2007:0992)

Updated libpng packages that fix security issues are now available for Red Hat Enterprise Linux. This update has been rated as having moderate security impact by the Red Hat Security Response Team. The libpng package contains a library of functions for creating and manipulating PNG Portable Netwo...

Debian DSA-1391-1 : icedove - several vulnerabilities

Several remote vulnerabilities have been discovered in the Icedove mail client, an unbranded version of the Thunderbird client. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2007-3734 Bernd Mielke, Boris Zbarsky, David Baron, Daniel Veditz, Jesse...

CentOS 4 / 5 : firefox (CESA-2007:0979)

Updated firefox packages that fix several security bugs are now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having critical security impact by the Red Hat Security Response Team. Mozilla Firefox is an open source Web browser. Several flaws were found in the way i...

Debian DSA-1394-1 : reprepro - authentication bypass

It was discovered that reprepro, a tool to create a repository of Debian packages, only checks the validity of known signatures when updating from a remote site, and thus does not reject packages with only unknown signatures. This allows an attacker to bypass this authentication mechanism. The...

CentOS 4 / 5 : flac (CESA-2007:0975)

An updated flac package to correct a security issue is now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having important security impact by the Red Hat Security Response Team. FLAC is a Free Lossless Audio Codec. The flac package consists of a FLAC encoder and...

RHEL 2.1 / 3 / 4 : seamonkey (RHSA-2007:0980)

Updated SeaMonkey packages that fix several security bugs are now available for Red Hat Enterprise Linux 2.1, 3, and 4. This update has been rated as having critical security impact by the Red Hat Security Response Team. SeaMonkey is an open source Web browser, advanced email and newsgroup client...

GLSA-200710-27 : ImageMagick: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-200710-27 ImageMagick: Multiple vulnerabilities regenrecht reported multiple infinite loops in functions ReadDCMImage and ReadXCFImage CVE-2007-4985, multiple integer overflows when handling certain types of images CVE-2007-4986,...

CentOS 3 / 4 : seamonkey (CESA-2007:0980)

Updated SeaMonkey packages that fix several security bugs are now available for Red Hat Enterprise Linux 2.1, 3, and 4. This update has been rated as having critical security impact by the Red Hat Security Response Team. SeaMonkey is an open source Web browser, advanced email and newsgroup client...

Unfixed XSS vulnerability at www.fritolay.com.tr

Security researcher Kara, has submitted on 25/10/2007 a cross-site-scripting XSS vulnerability affecting www.fritolay.com.tr, which at the time of submission ranked 1025999 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 04/11/2007. It is...

Unfixed XSS vulnerability at www.dii.unisi.it

Security researcher Langy, has submitted on 25/10/2007 a cross-site-scripting XSS vulnerability affecting www.dii.unisi.it, which at the time of submission ranked 75542 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 04/11/2007. It is currently...

RHEL 4 / 5 : flac (RHSA-2007:0975)

An updated flac package to correct a security issue is now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having important security impact by the Red Hat Security Response Team. FLAC is a Free Lossless Audio Codec. The flac package consists of a FLAC encoder and...

Unfixed XSS vulnerability at harzack.freeshell.org

Security researcher Langy, has submitted on 25/10/2007 a cross-site-scripting XSS vulnerability affecting harzack.freeshell.org, which at the time of submission ranked 65641 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 04/11/2007. It is...

RealPlayer ActiveX control playlist name buffer overflow

Added: 10/25/2007 CVE: CVE-2007-5601 BID: 26130 OSVDB: 41430 Background RealPlayer and RealOne Player include a number of ActiveX controls allowing functions to be called by scripts embedded in web pages. Problem The RealPlayer Database Component MPAMedia.dll is affected by a buffer overflow...

Unfixed XSS vulnerability at www.newsday.com

Security researcher Skunkfoot, has submitted on 25/10/2007 a cross-site-scripting XSS vulnerability affecting www.newsday.com, which at the time of submission ranked 7002 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 04/11/2007. It is current...

Debian DSA-1389-2 : zoph - missing input sanitising

It was discovered that zoph, a web-based photo management system, performs insufficient input sanitising, which allows SQL injection. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Security Advisory DSA-1389...