[SECURITY] [DSA 901-1] New gnump3d packages fix several vulnerabilities

-------------------------------------------------------------------------- Debian Security Advisory DSA 901-1 [email protected] http://www.debian.org/security/ Martin Schulze November 19th, 2005 http://www.debian.org/security/faq -...

[SECURITY] [DSA 901-1] New gnump3d packages fix several vulnerabilities

-------------------------------------------------------------------------- Debian Security Advisory DSA 901-1 [email protected] http://www.debian.org/security/ Martin Schulze November 19th, 2005 http://www.debian.org/security/faq -...

DSA-901-1 gnump3d - programming error

Bulletin has no description...

CVE-2005-3355

Directory traversal vulnerability in GNU Gnump3d before 2.9.8 has unknown impact via "CGI parameters, and cookie values"...

CVE-2005-3355

Directory traversal vulnerability in GNU Gnump3d before 2.9.8 has unknown impact via "CGI parameters, and cookie values"...

CVE-2005-3355

Directory traversal vulnerability in GNU Gnump3d before 2.9.8 has unknown impact via "CGI parameters, and cookie values"...

CVE-2005-3355

The CVE-2005-3355 issue affects gnump3d, where the theme parameter in HTTP requests can be used for path traversal. Technical details across connected sources confirm this vulnerability in gnump3d prior to version 2.9.8, caused by inadequate validation of CGI input causing unauthorized file acces...

CVE-2005-3349

GNU Gnump3d before 2.9.8 allows local users to modify or delete arbitrary files via a symlink attack on the index.lok temporary file...

CVE-2005-3349

CVE-2005-3349 affects gnump3d prior to 2.9.8, where insecure temporary-file handling (index.lok) enables local attackers to create symlink attacks and overwrite or delete files. Multiple advisories assess this as a local, path/temporary-file vulnerability in gnump3d and note related issues (CVE-2...

CVE-2005-3349: Improper Link Resolution Before File Access

GNU Gnump3d before 2.9.8 allows local users to modify or delete arbitrary files via a symlink attack on the index.lok temporary file...

CVE-2005-3355: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in GNU Gnump3d before 2.9.8 has unknown impact via "CGI parameters, and cookie values"...

GLSA-200511-05 : GNUMP3d: Directory traversal and XSS vulnerabilities

The remote host is affected by the vulnerability described in GLSA-200511-05 GNUMP3d: Directory traversal and XSS vulnerabilities Steve Kemp reported about two cross-site scripting attacks that are related to the handling of files CVE-2005-3424, CVE-2005-3425. Also reported is a directory travers...

GNUMP3d: Directory traversal and XSS vulnerabilities

Background GNUMP3d is a streaming server for MP3s, OGG vorbis files, movies and other media formats. Description Steve Kemp reported about two cross-site scripting attacks that are related to the handling of files CVE-2005-3424, CVE-2005-3425. Also reported is a directory traversal vulnerability...

CVE-2005-3425

Cross-site scripting XSS vulnerability in GNUMP3D before 2.9.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2005-3424...

CVE-2005-3424

Cross-site scripting XSS vulnerability in GNUMP3D before 2.9.5 allows remote attackers to inject arbitrary web script or HTML via 404 error pages, a different vulnerability than CVE-2005-3425...

CVE-2005-3425

Cross-site scripting XSS vulnerability in GNUMP3D before 2.9.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2005-3424...

CVE-2005-3424

Cross-site scripting XSS vulnerability in GNUMP3D before 2.9.5 allows remote attackers to inject arbitrary web script or HTML via 404 error pages, a different vulnerability than CVE-2005-3425...

CVE-2005-3425

Cross-site scripting XSS vulnerability in GNUMP3D before 2.9.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2005-3424...

CVE-2005-3424

Cross-site scripting XSS vulnerability in GNUMP3D before 2.9.5 allows remote attackers to inject arbitrary web script or HTML via 404 error pages, a different vulnerability than CVE-2005-3425...

CVE-2005-3424

Summary of CVE-2005-3424 (GNUMP3d) : A cross-site scripting (XSS) vulnerability affecting GNUMP3d prior to 2.9.5 (some sources mention up to 2.9.6) enables remote attackers to inject arbitrary web script or HTML, via crafted 404 error pages. The issue is documented alongside CVE-2005-3425 (a sepa...