Security fix for the ALT Linux 8 package openssl10 version 0.9.8m-alt1

Feb. 26, 2010 Evgeny Sinelnikov 0.9.8m-alt1 - Updated to 0.9.8m with security fixes and improvements, including: + CVE-2009-3245, CVE-2008-1678 + CVE-2009-1377, CVE-2009-1378, CVE-2009-1379 + CVE-2009-1387 closes: 20280 + CVE-2009-4355 closes: 22817, 23037 + patch for Cisco VPN client DTLS...

Security fix for the ALT Linux 6 package openssl10 version 0.9.8m-alt1

Feb. 26, 2010 Evgeny Sinelnikov 0.9.8m-alt1 - Updated to 0.9.8m with security fixes and improvements, including: + CVE-2009-3245, CVE-2008-1678 + CVE-2009-1377, CVE-2009-1378, CVE-2009-1379 + CVE-2009-1387 closes: 20280 + CVE-2009-4355 closes: 22817, 23037 + patch for Cisco VPN client DTLS...

Security fix for the ALT Linux 9 package openssl10 version 0.9.8m-alt1

Feb. 26, 2010 Evgeny Sinelnikov 0.9.8m-alt1 - Updated to 0.9.8m with security fixes and improvements, including: + CVE-2009-3245, CVE-2008-1678 + CVE-2009-1377, CVE-2009-1378, CVE-2009-1379 + CVE-2009-1387 closes: 20280 + CVE-2009-4355 closes: 22817, 23037 + patch for Cisco VPN client DTLS...

Microsoft Windows内核双重释放本地权限提升漏洞（MS10-015）

BUGTRAQ ID: 38044 CVECAN ID: CVE-2010-0233 Microsoft Windows是微软发布的非常流行的操作系统。 当释放内存时，Windows内核没有正确地重置指针，导致内核中出现双重释放的情况。成功利用此漏洞的攻击者可以运行任意内核态代码。攻击者可随后安装程序；查看、更改或删除数据；或者创建拥有完全用户权限的新帐户。 Microsoft Windows XP SP3 Microsoft Windows XP SP2 Microsoft Windows Vista SP2 Microsoft Windows Vista SP1 Microsoft...

Microsoft DirectX DirectShow AVI文件解析堆溢出漏洞（MS10-013）

BUGTRAQ ID: 38112 CVE ID: CVE-2010-0250 Microsoft DirectX是Windows操作系统中的一项功能，流媒体在玩游戏或观看视频时通过这个功能支持图形和声音。 DirectX的DirectShow组件（quartz.dll）在解析AVI文件中的特定类型视频流时没有正确的使用分配所用的长度字段，导致分配了不充分的缓冲区。用户打开特制的AVI文件就可以触发堆溢出，导致执行任意代码。 Microsoft Windows XP SP3 Microsoft Windows XP SP2 Microsoft Windows Vista SP2...

Debian DSA-1870-1 : pidgin - insufficient input validation

Federico Muttis discovered that libpurple, the shared library that adds support for various instant messaging networks to the pidgin IM client, is vulnerable to a heap-based buffer overflow. This issue exists because of an incomplete fix for CVE-2008-2927 and CVE-2009-1376. An attacker can exploi...

Debian DSA-1977-1 : python2.4 python2.5 - several vulnerabilities

Jukka Taimisto, Tero Rontti and Rauli Kaksonen discovered that the embedded Expat copy in the interpreter for the Python language, does not properly process malformed or crafted XML files. CVE-2009-3560 CVE-2009-3720 This vulnerability could allow an attacker to cause a denial of service while...

Debian DSA-1883-1 : nagios2 - missing input sanitising

Several vulnerabilities have been found in nagios2, a host/service/network monitoring and management system. The Common Vulnerabilities and Exposures project identifies the following problems : Several cross-site scripting issues via several parameters were discovered in the CGI scripts, allowing...

Debian DSA-1902-1 : elinks - buffer overflow

Jakub Wilk discovered an off-by-one buffer overflow in the charset handling of elinks, a feature-rich text-mode WWW browser, which might lead to the execution of arbitrary code if the user is tricked into opening a malformed HTML page. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

Debian DSA-1919-1 : smarty - several vulnerabilities

Several remote vulnerabilities have been discovered in Smarty, a PHP templating engine. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2008-4810 The expandquotedtext function allows for certain restrictions in templates, like function calling and PHP...

Debian DSA-1942-1 : wireshark - several vulnerabilities

Several remote vulnerabilities have been discovered in the Wireshark network traffic analyzer, which may lead to the execution of arbitrary code or denial of service. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2009-2560 A NULL pointer dereference wa...

openSUSE Security Update : apache2-mod_php5 (apache2-mod_php5-1993)

This update of php5 fixes: CVE-2008-5624: CVSS v2 Base Score: 7.5 HIGH AV:N/AC:L/Au:N/C:P/I:P/A:P: Permissions, Privileges, and Access Control CWE-264 CVE-2008-5625: CVSS v2 Base Score: 7.5 HIGH AV:N/AC:L/Au:N/C:P/I:P/A:P: Permissions, Privileges, and Access Control CWE-264 CVE-2008-5814: CVSS v2...

openSUSE Security Update : apache2-mod_php5 (apache2-mod_php5-1993)

This update of php5 fixes: CVE-2008-5624: CVSS v2 Base Score: 7.5 HIGH AV:N/AC:L/Au:N/C:P/I:P/A:P: Permissions, Privileges, and Access Control CWE-264 CVE-2008-5625: CVSS v2 Base Score: 7.5 HIGH AV:N/AC:L/Au:N/C:P/I:P/A:P: Permissions, Privileges, and Access Control CWE-264 CVE-2008-5814: CVSS v2...

SuSE 10 Security Update : PHP5 (ZYPP Patch Number 6846)

This update of PHP5 fixes : - CVE-2008-5625: CVSS v2 Base Score: 7.5 HIGH AV:N/AC:L/Au:N/C:P/I:P/A:P: Permissions, Privileges, and Access Control CWE-264 CVE-2008-5814: CVSS v2 Base Score: 2.6 LOW AV:N/AC:H/Au:N/C:N/I:P/A:N: Cross-Site Scripting XSS CWE-79 CVE-2009-2626: CVSS v2 Base Score: 6.4...

openSUSE Security Update : apache2-mod_php5 (apache2-mod_php5-1993)

This update of php5 fixes: CVE-2008-5624: CVSS v2 Base Score: 7.5 HIGH AV:N/AC:L/Au:N/C:P/I:P/A:P: Permissions, Privileges, and Access Control CWE-264 CVE-2008-5625: CVSS v2 Base Score: 7.5 HIGH AV:N/AC:L/Au:N/C:P/I:P/A:P: Permissions, Privileges, and Access Control CWE-264 CVE-2008-5814: CVSS v2...

SuSE 11 Security Update : PHP5 (SAT Patch Number 1978)

This update of PHP5 fixes : - CVE-2008-5624: CVSS v2 Base Score: 7.5 HIGH AV:N/AC:L/Au:N/C:P/I:P/A:P : Permissions, Privileges, and Access Control CWE-264 - CVE-2008-5625: CVSS v2 Base Score: 7.5 HIGH AV:N/AC:L/Au:N/C:P/I:P/A:P : Permissions, Privileges, and Access Control CWE-264 - Cross-Site...

VMware COM API ActiveX Control Buffer Overflow (CVE-2008-3892)

VMware API is developed by VMware Inc. to provide a complete set of language-neutral interfaces to the VMware Virtual Infrastructure Management VIM Framework. When the Windows version, VMware COM API, is installed on a Windows hosting computer, an ActiveX control is registered. A buffer overflow...

Mandriva Update for mysql MDVSA-2010:044 (mysql)

Check for the Version of mysql OpenVAS Vulnerability Test Mandriva Update for mysql MDVSA-2010:044 mysql Authors: System Generated Check Copyright: Copyright c 2010 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the...

Mandriva Update for mysql MDVSA-2010:044 (mysql)

Check for the Version of mysql OpenVAS Vulnerability Test Mandriva Update for mysql MDVSA-2010:044 mysql Authors: System Generated Check Copyright: Copyright c 2010 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the...

Microsoft Windows TCP/IP栈选择性应答远程拒绝服务漏洞（MS10-009）

BUGTRAQ ID: 38064 CVE ID: CVE-2010-0242 Microsoft Windows是微软发布的非常流行的操作系统。 Windows的TCP/IP栈在处理设置了畸形选择性应答（SACK）值的TCP报文时存在拒绝服务漏洞，远程攻击者可以向目标系统发送少量的特制报文导致受影响的系统停止响应和自动重启。 Microsoft Windows Vista SP2 Microsoft Windows Vista SP1 Microsoft Windows Vista Microsoft Windows Server 2008 SP2 Microsoft Windows...