[SECURITY] [DSA 934-1] New pound packages fix multiple vulnerabilities

-------------------------------------------------------------------------- Debian Security Advisory DSA 934-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff January 9, 2006 http://www.debian.org/security/faq -...

[SECURITY] [DSA 934-1] New pound packages fix multiple vulnerabilities

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -------------------------------------------------------------------------- Debian Security Advisory DSA 934-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff January 9, 2006 http://www.debian.org/security/faq -...

DSA-934-1 pound - remote

Bulletin has no description...

CVE-2005-3751

HTTP request smuggling vulnerability in Pound before 1.9.4 allows remote attackers to poison web caches, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with conflicting Content-length and Transfer-encoding headers...

DEBIAN-CVE-2005-3751

HTTP request smuggling vulnerability in Pound before 1.9.4 allows remote attackers to poison web caches, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with conflicting Content-length and Transfer-encoding headers...

CVE-2005-3751

HTTP request smuggling vulnerability in Pound before 1.9.4 allows remote attackers to poison web caches, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with conflicting Content-length and Transfer-encoding headers...

CVE-2005-3751

Pound fixes before 1.9.4 are exposed as an HTTP request smuggling vulnerability: conflicting Content-length and Transfer-encoding headers can allow remote attackers to poison caches, bypass WAFs, and enable XSS. The description notes the vulnerable window (before 1.9.4) but does not provide expli...

CVE-2005-3751

HTTP request smuggling vulnerability in Pound before 1.9.4 allows remote attackers to poison web caches, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with conflicting Content-length and Transfer-encoding headers...

CVE-2004-2026

CVE-2004-2026 describes a format-string vulnerability in Pound’s logmsg function (svc.c) affecting Pound 1.5 and earlier. A remote attacker could trigger arbitrary code execution by supplying format-specifiers in syslog messages. The vulnerability is due to improper handling of user-controlled fo...

CVE-2004-2026

Format string vulnerability in the logmsg function in svc.c for Pound 1.5 and earlier allows remote attackers to execute arbitrary code via format string specifiers in syslog messages...

CVE-2004-2026

Format string vulnerability in the logmsg function in svc.c for Pound 1.5 and earlier allows remote attackers to execute arbitrary code via format string specifiers in syslog messages...

CVE-2005-1391

Buffer overflow in the addport function in APSIS Pound 1.8.2 and earlier allows remote attackers to execute arbitrary code via a long Host HTTP header...

CVE-2005-1391

Buffer overflow in the addport function in APSIS Pound 1.8.2 and earlier allows remote attackers to execute arbitrary code via a long Host HTTP header...

DEBIAN-CVE-2005-1391

Buffer overflow in the addport function in APSIS Pound 1.8.2 and earlier allows remote attackers to execute arbitrary code via a long Host HTTP header...

CVE-2005-1391

Buffer overflow in the addport function in APSIS Pound 1.8.2 and earlier allows remote attackers to execute arbitrary code via a long Host HTTP header...

CVE-2005-1391

Pound (a reverse proxy/load balancer) is affected by CVE-2005-1391 due to an overly long HTTP Host header that can trigger a buffer overflow in add_port(), potentially allowing arbitrary code execution. Debian and Gentoo advisories also reference CVE-2005-3751 (HTTP Request Smuggling) as a separa...

CVE-2005-1391

Buffer overflow in the addport function in APSIS Pound 1.8.2 and earlier allows remote attackers to execute arbitrary code via a long Host HTTP header...

[Full-disclosure] [ GLSA 200504-29 ] Pound: Buffer overflow vulnerability

Gentoo Linux Security Advisory GLSA 200504-29 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity:...

Pound: Buffer overflow vulnerability

Background Pound is a reverse proxy, load balancer and HTTPS front-end. Description Steven Van Acker has discovered a buffer overflow vulnerability in the "addport" function in Pound. Impact A remote attacker could send a request for an overly long hostname parameter, which could lead to the remo...

CVE-2004-2026

Format string vulnerability in the logmsg function in svc.c for Pound 1.5 and earlier allows remote attackers to execute arbitrary code via format string specifiers in syslog messages...