tetex security update

1.0.7-67.19 - apply patch for CVE-2007-5935 in proper location 1.0.7-67.18 - add overflow check for CVE-2009-0791 - unify pacthes for 2010-0739 and CVE-2010-1440 1.0.7-67.17 - fix version typos in the last changelog entries 1.0.7-67.16 - include limits.h for INTMAX 1.0.7-67.15 - fix CVE-2009-0791...

tetex security update

2.0.2-22.EL4.16 - fix last changelog entry 2.0.2-22.EL4.15 - unify patches for CVE-2010-0739 and CVE-2010-1440 2.0.2-22.EL4.14 - add missing check in the first hunk in Stream.cc for CVE-2009-0791 2.0.2-22.EL4.13 - add another hunk to CVE-2010-0827 patch to fix tfmload.c as well...

CVE-2009-4838

SQL injection vulnerability in baseagcommon.php in Basic Analysis and Security Engine BASE before 1.4.3.1 allows remote attackers to execute arbitrary SQL commands via unspecified parameters. NOTE: some of these details are obtained from third party information...

CVE-2009-4837

CVE-2009-4837 involves multiple cross-site scripting (XSS) vulnerabilities in the Basic Analysis and Security Engine (BASE) prior to version 1.4.3.1. The affected components allow remote attackers to inject arbitrary web script or HTML via the following parameters: (1) sig[1] in base/base_qry_mai...

CVE-2009-4840

The CVE-2009-4840 entry describes a heap-based buffer overflow in the IAManager ActiveX control (IAManager.dll) of Roxio CinePlayer 3.2. An attacker can cause arbitrary code execution by sending a long argument to SetIAPlayerName. Connected records confirm the vulnerable component and the root ca...

CVE-2009-4841

The CVE-2009-4841 entry describes a heap-based buffer overflow in the SonicMediaPlayer ActiveX control (SonicMediaPlayer.dll) shipped with Roxio CinePlayer 3.2. An attacker can trigger arbitrary code execution by passing a long argument to the DiskType method of the ActiveX control, enabling remo...

CVE-2009-4838

CVE-2009-4838 : A SQL injection vulnerability exists in Base_Ag_Common.php of the Basic Analysis and Security Engine (BASE) before version 1.4.3.1. Remote attackers can execute arbitrary SQL commands via unspecified parameters due to inadequate input handling. This risk affects BASE deployments r...

CVE-2009-4839

The CVE-2009-4839 entry concerns the Basic Analysis and Security Engine (BASE), likely versions 1.4.4 and earlier. The issue comprises multiple input-validation vulnerabilities in BASE allowing remote attackers to inject arbitrary web script or HTML (XSS) via parameters to admin/base_roleadmin.ph...

CVE-2009-4837

Multiple cross-site scripting XSS vulnerabilities in Basic Analysis and Security Engine BASE before 1.4.3.1 allow remote attackers to inject arbitrary web script or HTML via the 1 sig1 parameter to base/baseqrymain.php, or the time01 parameter to 2 base/basestatalerts.php or 3...

CVE-2009-4836

The CVE-2009-4836 entry concerns Movie PHP Script 2.0. Affected component: system/services/init.php. Root cause: eval injection via the anticode parameter, enabling remote attackers to execute arbitrary PHP code. The vulnerability is described as a remote code execution risk with network access a...

CVE-2009-4835

The 1 htkreadheader, 2 alawinit, 3 ulawinit, 4 pcminit, 5 float32init, and 6 sdsreadheader functions in libsndfile 1.0.20 allow context-dependent attackers to cause a denial of service divide-by-zero error and application crash via a crafted audio file...

CVE-2009-4835

CVE-2009-4835 affects libsndfile 1.0.20, where six internal functions (htk_read_header, alaw_init, ulaw_init, pcm_init, float32_init, sds_read_header) can trigger a divide-by-zero and cause denial of service when processing a crafted audio file. Public records reference this alongside fixes for l...

openSUSE Security Update : libmikmod (openSUSE-SU-2010:0209-1)

Specially crafted 'Impulse Tracker' and 'Ultratracker' files could cause a heap based buffer overflow in libmikmod. Attackers could exploit that to crash or potentially execute code in applications linking against libmikmod CVE-2009-3995, CVE-2009-3996. %NASLMINLEVEL 70300 C Tenable Network...

openSUSE Security Update : libmikmod (openSUSE-SU-2010:0209-1)

Specially crafted 'Impulse Tracker' and 'Ultratracker' files could cause a heap based buffer overflow in libmikmod. Attackers could exploit that to crash or potentially execute code in applications linking against libmikmod CVE-2009-3995, CVE-2009-3996. %NASLMINLEVEL 70300 C Tenable Network...

openSUSE Security Update : libmysqlclient-devel (openSUSE-SU-2010:0198-2)

Updated mysql packages fix the following bugs : - upstream 47320 - checking server certificates CVE-2009-4028 - upstream 48291 - error handling in subqueries CVE-2009-4019 - upstream 47780 - preserving nullvalue flag in GeomFromWKB CVE-2009-4019 - upstream 39277 - symlink behaviour fixed...

openSUSE Security Update : libmikmod (openSUSE-SU-2010:0209-1)

Specially crafted 'Impulse Tracker' and 'Ultratracker' files could cause a heap based buffer overflow in libmikmod. Attackers could exploit that to crash or potentially execute code in applications linking against libmikmod CVE-2009-3995, CVE-2009-3996. %NASLMINLEVEL 70300 C Tenable Network...

openSUSE Security Update : libmysqlclient-devel (openSUSE-SU-2010:0198-2)

Updated mysql packages fix the following bugs : - upstream 47320 - checking server certificates CVE-2009-4028 - upstream 48291 - error handling in subqueries CVE-2009-4019 - upstream 47780 - preserving nullvalue flag in GeomFromWKB CVE-2009-4019 - upstream 39277 - symlink behaviour fixed...

CVE-2009-4834

The lib.php component in Zeroboard 4.1 pl7 is vulnerable to Remote Code Execution (RCE) . The flaw allows remote attackers to execute arbitrary PHP code by providing a crafted parameter name , which is potentially related to the now_connect.php functionality. The vulnerability is confirmed by a s...

Debian: Security Advisory (DSA-2034-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian: Security Advisory (DSA-2038-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...