ruby security update

1.8.5-19.el56.1 - Address CVE-2011-1004 'Symlink race condition by removing directory trees in fileutils module' ruby-1.8.7-CVE-2011-1004.patch - Address CVE-2011-1005 'Untrusted codes able to modify arbitrary strings' ruby-1.8.7-CVE-2011-1005.patch - Address CVE-2011-0188 'memory corruption in...

ruby security update

1.8.1-16.el4 - Comply with guidelines - Related: rhbz709959 1.8.1-15.el4 - Address CVE-2011-1005 'Untrusted codes able to modify arbitrary strings' ruby-1.8.7-CVE-2011-1005.patch - Address CVE-2011-0188 'memory corruption in BigDecimal on 64bit platforms' ruby-1.8.7-CVE-2011-0188.patch - Address...

CVE-2009-5044

contrib/pdfmark/pdfroff.sh in GNU troff aka groff before 1.21 allows local users to overwrite arbitrary files via a symlink attack on a pdf.tmp temporary file...

CVE-2009-5044

contrib/pdfmark/pdfroff.sh in GNU troff aka groff before 1.21 allows local users to overwrite arbitrary files via a symlink attack on a pdf.tmp temporary file...

CVE-2009-5044

CVE-2009-5044 affects Groff (GNU Troff) via contrib/pdfmark/pdfroff.sh, where groff before 1.21 creates insecure temporary files (pdf#####.tmp) that can be exploited by a local user to overwrite arbitrary files through a symlink attack. Public sources in connected docs confirm this vulnerability ...

CVE-2009-5044

contrib/pdfmark/pdfroff.sh in GNU troff aka groff before 1.21 allows local users to overwrite arbitrary files via a symlink attack on a pdf.tmp temporary file...

USN-1158-1: curl vulnerabilities

Richard Silverman discovered that when doing GSSAPI authentication, libcurl unconditionally performs credential delegation, handing the server a copy of the client's security credential. CVE-2011-2192 Wesley Miaw discovered that when zlib is enabled, libcurl does not properly restrict the amount ...

Discuz!多版本 存储型XSS脚本漏洞

简要描述： 2009年一次偶然间测试发现的此XSS漏洞，因为是存储型的，我想大家应该知道它的危害吧。相隔这么多年DZ不断的更新版本，但此漏洞依然存在,今天就发布出来吧！留着也没什么用会长毛的，呵呵。 在此我要感谢一下我的好朋友Jackal在09年的时候一起帮我测试漏洞的。 当时我们一起测试的是DZ6.0-DZ7.2，不知道是不是通杀啊。哈哈！没有一个一个去测试。有条件的去测试一下吧。 详细说明： 发贴进入源码模式，写入如下的exp emailurlimghttp://qhkest.com onmouseover=alert/DZ-xss-0day/; /img /url/email...

DreamBox DM800 Arbitrary File Download Vulnerability

Exploit for hardware platform in category remote exploits Exploit Title: title Date: date Author: ShellVision Version: dm800 / !CDATA / functiontryvar...

JustSystems Ichitaro Memory Management Program Remote Heap Buffer Overflow Vulnerability

Description JustSystems Ichitaro is prone to a remote buffer-overflow vulnerability. Attackers can exploit this issue by enticing an unsuspecting user to open a specially crafted file. Successful exploits can allow attackers to execute arbitrary code with the privileges of the user running the...

Debian DSA-2260-1 : rails - several vulnerabilities

Two vulnerabilities were discovered in Ruby on Rails, a web application framework. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2009-3086 The cookie store may be vulnerable to a timing attack, potentially allowing remote attackers to forge message...

[SECURITY] [DSA 2259-1] rails security update

------------------------------------------------------------------------- Debian Security Advisory DSA-2260-1 [email protected] http://www.debian.org/security/ Florian Weimer June 14, 2011 http://www.debian.org/security/faq -...

Mandriva Linux Security Advisory : xerces-j2 (MDVSA-2011:108)

A vulnerability was discovered and corrected in xerces-j2 : Apache Xerces2 Java, as used in Sun Java Runtime Environment JRE in JDK and JRE 6 before Update 15 and JDK and JRE 5.0 before Update 20, and in other products, allows remote attackers to cause a denial of service infinite loop and...

Ubuntu 6.06 LTS / 8.04 LTS / 9.10 / 10.04 LTS / 10.10 : postfix vulnerabilities (USN-1113-1)

It was discovered that the Postfix package incorrectly granted write access on the PID directory to the postfix user. A local attacker could use this flaw to possibly conduct a symlink attack and overwrite arbitrary files. This issue only affected Ubuntu 6.06 LTS and 8.04 LTS. CVE-2009-2939 Wiets...

Debian DSA-2243-1 : unbound - design flaw

It was discovered that Unbound, a caching DNS resolver, ceases to provide answers for zones signed using DNSSEC after it has processed a crafted query. CVE-2009-4008 In addition, this update improves the level of DNSSEC support in the lenny version of Unbound so that it is possible for system...

[SECURITY] [DSA 2256-1] tiff security update

------------------------------------------------------------------------- Debian Security Advisory DSA-2256-1 [email protected] http://www.debian.org/security/ Thijs Kinkhorst June 9, 2011 http://www.debian.org/security/faq -...

RHEL 6 : xerces-j2 (RHSA-2011:0858)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2011:0858 advisory. - xerces-j2, JDK: XML parsing Denial-Of-Service 6845701 CVE-2009-2625 Note that Nessus has not tested for this issue but has instead relied only on t...

CVE-2009-5077

CRE Loaded before 6.2.14 allows remote attackers to bypass authentication and gain administrator privileges via vectors related to a modified PHPSELF variable, which is not properly handled by 1 includes/applicationtop.php and 2 admin/includes/applicationtop.php...

CVE-2009-5077

CRE Loaded before 6.2.14 allows remote attackers to bypass authentication and gain administrator privileges via vectors related to a modified PHPSELF variable, which is not properly handled by 1 includes/applicationtop.php and 2 admin/includes/applicationtop.php...

CVE-2009-5077

CRE Loaded before 6.2.14 is vulnerable to an authentication bypass that can grant administrator privileges via manipulation of a modified PHP_SELF variable, not properly handled by includes/application_top.php and admin/includes/application_top.php. The issue affects CRE Loaded prior to version 6...