Security fix for the ALT Linux 6 package perl version 1:5.12.5-alt1.M60P.1

Nov. 10, 2012 Vladimir Lettiev 1:5.12.5-alt1.M60P.1 - 5.12.3 - 5.12.5 - Security fixes: CVE-2011-2728: File::Glob::bsdglob memory error with GLOBALTDIRFUNC CVE-2012-5195: Heap buffer overrun in 'x' string repeat operator - Applied fix for bug 26249...

CVE-2012-2728

CVE-2012-2728 affects the Drupal Node Hierarchy module (6.x-1.x) prior to 6.x-1.5. The vulnerability allows CSRF that can hijack an administrator’s session to reorder node hierarchy via up/down actions. Impact is admin-authentication compromise leading to unintended hierarchy changes. Remediation...

SA-CONTRIB-2012-099 - Node Hierarchy - Cross Site Request Forgery (CSRF)

Node Hierarchy module allows for the creation of parent child relationships among nodes that can create a tree-like hierarchy of content. The module doesn't sufficiently confirm user intent when reordering children nodes allowing a malicious user to trick a site admin to changing the desired...

Strawberry Perl Modules Multiple Vulnerabilities - Windows

Strawberry Perl is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Perl "decode_xs()"和"File::Glob::bsd_glob()"远程代码执行漏洞

BUGTRAQ ID: 49858 CVE ID: CVE-2011-2728,CVE-2011-2939 Perl是一种高级、通用、直译式、动态的程序语言。 Perl的"decodexs"和"File::Glob::bsdglob"函数在实现上存在远程代码执行漏洞，远程攻击者可利用此漏洞执行任意代码。 1）在处理GLOBALTDIRFUNC旗标时，"File::Glob::bsdglob"函数中存在的错误可被利用造成非法访问和执行任意代码。 2）Encode中的"decodexs"函数中的错误可通过特制输入造成堆缓冲区溢出。 Perl 5.14.1 厂商补丁： Perl ----...

CVE-2010-2728

CVE-2010-2728 is a heap-based buffer overflow in Microsoft Outlook 2002 SP3, 2003 SP3, and 2007 SP2 that occurs when Online Mode for an Exchange Server is enabled. A crafted e-mail message can lead to remote code execution. Public sources (MS10-064) confirm the vulnerability and provide the secur...

openSUSE Security Update : ruby (ruby-123)

This update of ruby fixes : - a possible information leakage CVE-2008-1145 - a directory traversal bug CVE-2008-1891 in WEBrick - various memory corruptions and integer overflows in array and string handling CVE-2008-2662, CVE-2008-2663, CVE-2008-2664, CVE-2008-2725, CVE-2008-2726, CVE-2008-2727,...

Ubuntu: Security Advisory (USN-485-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Gentoo Security Advisory GLSA 200508-15 (apache)

The remote host is missing updates announced in advisory GLSA 200508-15. OpenVAS Vulnerability Test $ Description: Auto generated from Gentoo's XML based advisory Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc. http://www.securityspace.com Text descriptions are largely excerpted fr...

openSUSE 10 Security Update : ruby (ruby-5483)

This update of ruby fixes : - a possible information leakage CVE-2008-1145 - a directory traversal bug CVE-2008-1891 in WEBrick - various memory corruptions and integer overflows in array and string handling CVE-2008-2662, CVE-2008-2663, CVE-2008-2664, CVE-2008-2725, CVE-2008-2726, CVE-2008-2727,...

ruby security update

1.6.8-12.el3 - ruby-1.6.8-string-CVE-2008-2664.patch: wrong patch. Fix a segfault. 1.6.8-11.el3 - CVE-2008-2376: Integer overflow in rbaryfill. 1.6.8-10.el3 - security fixes. 451931 - CVE-2006-6303: Fix the infinite loop issue with the malformed multipart data in cgi.rb. - CVE-2008-2663: Fix the...

Debian Security Advisory DSA 805-1 (apache2)

The remote host is missing an update to apache2 announced via advisory DSA 805-1. Several problems have been discovered in Apache2, the next generation, scalable, extendable web server. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2005-1268 Marc Stern...

SuSE 10 Security Update : PHP5 (ZYPP Patch Number 3980)

This update fixes multiple bugs in php : - predictable generaton of an initialization vector IV in the mcrypt extension - additional cookie attributes could be injected via a session id - specially crafted files could cause integer overflows in gd and leverage them to at least crash gd based...

openSUSE 10 Security Update : apache2-mod_php5 (apache2-mod_php5-3978)

This update fixes multiple bugs in php : - predictable generaton of an initialization vector IV in the mcrypt extension - additional cookie attributes could be injected via a session id - specially crafted files could cause integer overflows in gd and leverage them to at least crash gd based...

openSUSE 10 Security Update : apache2-mod_php5 (apache2-mod_php5-3979)

This update fixes multiple bugs in php : - predictable generaton of an initialization vector IV in the mcrypt extension - additional cookie attributes could be injected via a session id - specially crafted files could cause integer overflows in gd and leverage them to at least crash gd based...

CVE-2004-2728

CVE-2004-2728 describes a buffer overflow in the FTP server component of Hummingbird Connectivity 7.1 and 9.0 triggered by a long argument to the XCWD command. The vulnerability allows remote, authenticated users to cause an application crash and a denial of service. No specific remediation or pa...

CVE-2007-2728

The soap extension in PHP calls phprandr with an uninitialized seed variable, which has unknown impact and attack vectors, a related issue to the mcryptcreateiv issue covered by CVE-2007-2727. Note: The PHP team argue that this is not a valid security issue...

CVE-2007-2728

CVE-2007-2728 concerns the PHP soap extension calling php_rand_r with an uninitialized seed variable. The impact and attack vectors are not clearly defined in the provided documents; it is noted as related to CVE-2007-2727 and the PHP team argued it is not a valid security issue. No exploitation ...

CentOS 3 / 4 : httpd (CESA-2005:608)

Updated Apache httpd packages that correct two security issues are now available for Red Hat Enterprise Linux 3 and 4. This update has been rated as having important security impact by the Red Hat Security Response Team. The Apache HTTP Server is a popular and freely-available Web server. A flaw...

CVE-2006-2728

CVE-2006-2728 is an XSS flaw in Photoalbum B&W 1.3, specifically in the file superalbum/index.php. The vulnerability arises when an attacker supplies a crafted value for the pic parameter, enabling the injection of arbitrary web script or HTML. Documents identify the affected component but do not...