ISS Protection Brief: Mozilla Foundation GIF Overflow

-----BEGIN PGP SIGNED MESSAGE----- Internet Security Systems Protection Brief March 23, 2005 Mozilla Foundation GIF Overflow Summary: ISS has shipped protection for a flaw X-Force has discovered in the GIF image processing library used in software developed by the Mozilla Foundation. This library...

[Full-Disclosure] Jabberd2.x remote BuffJabberd2.x remote Buffer Overflowser Overflows

Security Advisory Advisory: ADLAB-04002Jabberd2.x remote Buffer Overflows Authors: [email protected] Class: Boundary Condition Error CVE:CAN-2004-0953 Remote: Yes, could allow remote compromise Vulnerable: Jabberd 2. Unvulnerable: Jabberd 1.4 Vendor: http://jabberd.jabberstudio.org/ I.INFO:...

Debian DSA-404-1 : rsync - heap overflow

The rsync team has received evidence that a vulnerability in all versions of rsync prior to 2.5.7, a fast remote file copy program, was recently used in combination with a Linux kernel vulnerability to compromise the security of a public rsync server. While this heap overflow vulnerability could...

GLSA-200407-22 : phpMyAdmin: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-200407-22 phpMyAdmin: Multiple vulnerabilities Two serious vulnerabilities exist in phpMyAdmin. The first allows any user to alter the server configuration variables including host, name, and password by appending new settings to...

ISS Protection Brief: Netscape NSS Library Remote Compromise

-----BEGIN PGP SIGNED MESSAGE----- Internet Security Systems Protection Brief August 23, 2004 Protection for Netscape NSS Library Remote Compromise Summary: A vulnerability exists in the Netscape Network Security Services NSS library suite which may result in remote compromise of products making...

nss -- exploitable buffer overflow in SSLv2 protocol handler

ISS X-Force reports that a remotely exploitable buffer overflow exists in the Netscape Security Services NSS library's implementation of SSLv2. From their advisory: The NSS library contains a flaw in SSLv2 record parsing that may lead to remote compromise. When parsing the first record in an SSLv...

SUSE-SA:2003:003: mysql

The remote host is missing the patch for the advisory SUSE-SA:2003:003 mysql. Stefan Esser from e-matters reported various bugs in MySQL. Within the MySQL server the password checking and a signedness issue has been fixed. These could lead to a remote compromise of the system running an unpatched...

SUSE-SA:2003:0009: mod_php4

The remote host is missing the patch for the advisory SUSE-SA:2003:0009 modphp4. The Apache module modphp4 supports the widely used Web scripting language PHP. Under some special circumstances a buffer overflow can be triggered in modphp4's wordwrap function. This buffer overflow can be used to...

SUSE-SA:2003:0004: libpng

The remote host is missing the patch for the advisory SUSE-SA:2003:0004 libpng. The library libpng provides several functions to encode, decode and manipulate Portable Network Graphics PNG image files. Due to wrong calculation of some loop offset values a buffer overflow can occur. The buffer...

MSIE Similar Method Name Redirection Cross Site/Zone Scripting Vulnerability

Note: This vulnerability and many more can be found at http://www.greyhats.cjb.net SimliarMethodNameRedir Automatic Remote Compromise Tested IEXPLORE.EXE file version 6.0.2800.1106 MSHTML.DLL file version 6.00.2800.1400 Microsoft Windows XP sp2 Discussion At first I thought this vulnerability had...

[Full-Disclosure] MDKSA-2004:063 - Updated libpng packages fix potential remote compromise

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandrakelinux Security Update Advisory Package name: libpng Advisory ID: MDKSA-2004:063 Date: June 29th, 2004 Affected versions: 10.0, 9.1, 9.2, Corporate Server 2.1, Multi Network Firewall 8.2 Problem Description: A buffer overflow vulnerability was...

IBM ACPRunner 1.2.5 - ActiveX Control Dangerous Method

IBM ACPRunner 1.2.5 - ActiveX Control Dangerous Method source: https://www.securityfocus.com/bid/10561/info It is reported that the IBM acpRunner ActiveX control contains dangerous methods that may result in a remote compromise of a system on which the ActiveX control is installed. These methods...

[Full-Disclosure] Advisory 09/2004: More CVS remote vulnerabilities

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 e-matters GmbH www.e-matters.de -= Security Advisory =- Advisory: More CVS remote vulnerabilities Release Date: 2004/06/09 Last Modified: 2004/06/09 Author: Stefan Esser [email protected] Application: CVS feature release = 1.12.8 CVS stable release...

IBM EGatherer 2.0 - ActiveX Control Dangerous Method

IBM EGatherer 2.0 - ActiveX Control Dangerous Method source: https://www.securityfocus.com/bid/10562/info It is reported that the IBM eGatherer ActiveX control contains dangerous methods that may result in a remote compromise of a system on which the ActiveX control is installed. These methods ma...

ProFTPD Access Control List bypass vulnerability

Background ProFTPD is an FTP daemon. Description ProFTPD 1.2.9 introduced a vulnerability that allows CIDR-based ACLs such as 10.0.0.1/24 to be bypassed. The CIDR ACLs are disregarded, with the net effect being similar to an "AllowAll" directive. Impact This vulnerability may allow unauthorized...

ieBad.txt

Wednesday, March 31, 2004 This is somewhat disconcerting. Reference the recently disclosed Internet Explorer 'bug' presently in the wild original discussion: http://www.securityfocus.com/archive/1/358813 with additional input buried thereunder in subsequent threads allowing for complete remote...

Advisory 02/2004: Trillian remote overflows

e-matters GmbH www.e-matters.de -= Security Advisory =- Advisory: Trillian remote overflows Release Date: 2004/02/24 Last Modified: 2004/02/24 Author: Stefan Esser [email protected] Application: Trillian 0.71-0.74 w/ patch f Trillian Pro 1.0, 2.0, 2.01 Severity: 2 vulnerabilities were found in...

ISS Security Brief: Checkpoint VPN-1/SecureClient ISAKMP Buffer Overflow

-----BEGIN PGP SIGNED MESSAGE----- Internet Security Systems Security Brief February 4, 2004 Checkpoint VPN-1/SecureClient ISAKMP Buffer Overflow Synopsis: ISS X-Force has discovered a flaw in the ISAKMP processing for both the Checkpoint VPN-1 server and Checkpoint VPN clients Securemote/...

GAIM security update

GAIM is a GTK2-based Instant Messaging IM client. New GAIM packages are available for Slackware 9.0, 9.1, and -current. 12 vulnerabilities were found in the instant messenger GAIM that allow remote compromise. All sites using GAIM should upgrade to these new packages. These are based on GAIM 0.75...

Advisory 01/2004: 12 x Gaim remote overflows

e-matters GmbH www.e-matters.de -= Security Advisory =- Advisory: 12 x Gaim remote overflows Release Date: 2004/01/26 Last Modified: 2004/01/26 Author: Stefan Esser [email protected] Application: Gaim = 0.75 Severity: 12 vulnerabilities were found in the instant messenger GAIM that allow remot...