symfony 1.0.13 is out

symfony 1.0.13 has been released to fix an important bug in the tag helper. Strings were incorrectly escaped due to the change r7900 the 1.0.12 release. The missing regression test has now been added and the bug is fixed. The 1.1 branche has also been updated. Here is the changelog : r8176: Fixes...

MS Windows Message Queuing Service RPC BOF Exploit (dnsname)

No description provided by source. / Windows Message Queuing Service Remote RPC BOF Exploit MS07-065 Mod of axis's code. CHANGELOG - added dnsname as a parameter, before it was hardcoded in the request data. Marcin Kozlowski Provided for legal security research and testing purposes ONLY Go throug...

[DSECRG-08-003] blogcms 4.2.1b Multiple Security Vulnerabilities

Digital Security Research Group DSecRG Advisory DSECRG-08-003 Application: Blogcms Versions Affected: Blogcms 4.2.1b Vendor URL: http://blogcms.com/ Bugs: SQL Injestions, SiXSS, XSS Exploits: YES Reported: 15.01.2008 Vendor response: 16.01.2008 Date of Public Advisory: 16.01.2008 Authors: Alexand...

Fedora 7 : pidgin-2.2.1-1.fc7 (2007-2368)

Minor DOS fix and a great many other bug fixes in upstream's 2.2.1 release. http://developer.pidgin.im/wiki/ChangeLog Upstream changelog. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to...

iDefense Security Advisory 06.07.07: Linux Kernel cpuset tasks Information Disclosure Vulnerability

Linux Kernel cpuset tasks Information Disclosure Vulnerability iDefense Security Advisory 06.07.07 http://labs.idefense.com/intelligence/vulnerabilities/ Jun 07, 2007 I. BACKGROUND Linux is a clone of the UNIX operating system, written from scratch by Linus Torvalds with assistance from a...

[slackware-security] php5

New php5 packages are available for Slackware 10.2, 11.0, and -current to fix security issues. PHP5 was considered a test package in Slackware 10.2, and an "extra" package in Slackware 11.0. If you are currently running PHP4 you may wish to stick with that, as upgrading to PHP5 will probably...

[slackware-security] php

New php packages are available for Slackware 10.2, 11.0, and -current to improve the stability and security of PHP. Quite a few bugs were fixed -- please see http://www.php.net for a detailed list. All sites that use PHP are encouraged to upgrade. Please note that we haven't tested all PHP...

cpp, gcc, libf2c, libgcc, libgcj, libgnat, libobjc, libstdc++ security update

CentOS Errata and Security Advisory CESA-2007:0220 Updated gcc packages that fix a security issue and various bugs are now available. This update has been rated as having moderate security impact by the Red Hat Security Response Team. The gcc packages include C, C++, Java, Fortran 77, Objective C...

[slackware-security] Slackware 11.0 x11-6.9.0 patch fix

A new x11-6.9.0-i486-14slack11.0.tgz patch is available for Slackware 11.0 to fix the inadvertent inclusion of two old fontconfig binaries. Installing the original fontconfig patch followed by the original x11 patch would cause fc-cache and fc-list to be overwritten by old versions, breaking...

Update: ViewCVS and ViewVC 'checkout view' content type fixation issue

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hi! Moritz Naumann wrote: This does not impact how much the rest of my report applies. My findings are now being discussed on the ViewVC developers mailing list 1. They apparently also impact ViewVC. Whether and to which degree what I am reporting c...

Fedora Core 4 : kernel-2.6.16-1.2107_FC4 (2006-500)

An update to the latest upstream -stable snapshot 2.6.16.13 Among quite a few bug-fixes, are two security related fixes : Don't allow a backslash in a path component CVE-2006-1863 NETFILTER: SCTP conntrack: fix infinite loop CVE-2006-1527 Detailed changelogs of the last few point releases can be...

Fedora Core 5 : kernel-2.6.16-1.2122_FC5 (2006-572)

This update rebases to the latest upstream -stable release 2.6.16.17, where a number of security problems have been fixed, notably : SCTP: Validate the parameter length in HB-ACK chunk CVE-2006-1857 SCTP: Respect the real chunk length when walking parameters CVE-2006-1858 fs/locks.c: Fix leaseini...

Fedora Core 4 : kernel-2.6.17-1.2141_FC4 (2006-769)

An update to the latest upstream stable release 2.6.17.3, which fixes a security issue with SCTP. Further details: http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.17.3 http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.17.2 Note that Tenable Network Security has extracted the...

ChangeLog-2.6.19.1

commit 1edb5a2de7a29144644794208eb63abbca419430 Author: Chris Wright [email protected] Date: Mon Dec 11 11:32:53 2006 -0800 Linux 2.6.19.1 commit f558fdfaa8d62e33ef47a819d1ca659a8f9e1f1a Author: David Miller [email protected] Date: Fri Dec 8 17:14:38 2006 -0800 PATCH NETLINK: Put...

[slackware-security] firefox/thunderbird/seamonkey

New Firefox and Thunderbird packages are available for Slackware 10.2 and -current to fix security issues. In addition, a new Seamonkey package is available for Slackware -current to fix similar issues. More details about the issues may be found here:...

Linux Kernel 2.6.13 <= 2.6.17.4 sys_prctl() Local Root Exploit (2)

Exploit for linux platform in category local exploits ================================================================== Linux Kernel 2.6.13 = 2.6.13 prctl kernel exploit C Julien TINNES If you read the Changelog from 2.6.13 you've probably seen: PATCH setuid core dump This patch mainly adds...

Linux Kernel 2.6.13 2.6.17.4 - sys_prctl() Local Privilege Escalation (2)

Linux Kernel 2.6.13 2.6.17.4 - sysprctl Local Privilege Escalation 2 / Linux = 2.6.13 prctl kernel exploit C Julien TINNES If you read the Changelog from 2.6.13 you've probably seen: PATCH setuid core dump This patch mainly adds suidsafe to suiddumpable sysctl but also a new per process, user...

Linux Kernel 2.6.13 < 2.6.17.4 - 'sys_prctl()' Local Privilege Escalation (2)

/ Linux = 2.6.13 prctl kernel exploit C Julien TINNES If you read the Changelog from 2.6.13 you've probably seen: PATCH setuid core dump This patch mainly adds suidsafe to suiddumpable sysctl but also a new per process, user setable argument to PRSETDUMPABLE. This flaw allows us to create a root...

FreeBSD : trac -- Wiki Macro Script Insertion Vulnerability (400d9d22-d6c5-11da-a14b-00123ffe8333)

Secunia reports : A vulnerability has been reported, which can be exploited by malicious people to conduct script insertion attacks. Input passed using the wiki macro isn't properly sanitised before being used. This can be exploited to inject arbitrary HTML and script code, which will be executed...

Fedora Core 5 : kernel-2.6.16-1.2096_FC5 (2006-421)

This update includes a number of security issues that have been fixed upstream over the last week or so. i386/x86-64: Fix x87 information leak between processes CVE-2006-1056 iprouteinput panic fix CVE-2006-1525 fix MADVREMOVE vulnerability CVE-2006-1524 shmat: stop mprotect from giving write...