[SECURITY] [DSA 1527-1] New debian-goodies packages fix privilege escalation

------------------------------------------------------------------------ Debian Security Advisory DSA-1527-1 [email protected] http://www.debian.org/security/ Thijs Kinkhorst March 24, 2008 http://www.debian.org/security/faq -...

Information disclosure

MRcgi/MRProcessIncomingForms.pl in Numara FootPrints 8.1 on Linux allows remote attackers to execute arbitrary code via shell metacharacters in the PROJECTNUM parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

Code injection

The Utils::runScripts function in src/utils.cpp in vdccm 0.92 through 0.10.0 in SynCE SynCE-dccm allows remote attackers to execute arbitrary commands via shell metacharacters in a certain string to TCP port 5679...

CVE-2008-1136

The CVE-2008-1136 entry affects SynCE-dccm (vdccm) versions 0.92 through 0.10.0. The vulnerability resides in Utils::runScripts (src/utils.cpp), where a string processed and sent to TCP port 5679 can be tainted by shell metacharacters, permitting remote command execution. This is a remote, networ...

CVE-2008-1136

The Utils::runScripts function in src/utils.cpp in vdccm 0.92 through 0.10.0 in SynCE SynCE-dccm allows remote attackers to execute arbitrary commands via shell metacharacters in a certain string to TCP port 5679...

Design/Logic Flaw

diatheke.pl in The SWORD Project Diatheke 1.5.9 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the range parameter...

CVE-2008-0932

diatheke.pl in The SWORD Project Diatheke 1.5.9 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the range parameter...

DEBIAN-CVE-2008-0932

diatheke.pl in The SWORD Project Diatheke 1.5.9 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the range parameter...

CVE-2008-0932

diatheke.pl in The SWORD Project Diatheke 1.5.9 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the range parameter...

Code injection

Xdg-utils 1.0.2 and earlier allows user-assisted remote attackers to execute arbitrary commands via shell metacharacters in a URL argument to 1 xdg-open or 2 xdg-email...

CVE-2008-0386

Xdg-utils 1.0.2 and earlier allows user-assisted remote attackers to execute arbitrary commands via shell metacharacters in a URL argument to 1 xdg-open or 2 xdg-email...

CVE-2008-0386

Xdg-utils 1.0.2 and earlier allows user-assisted remote attackers to execute arbitrary commands via shell metacharacters in a URL argument to 1 xdg-open or 2 xdg-email...

CVE-2008-0386

Xdg-utils 1.0.2 and earlier allows user-assisted remote attackers to execute arbitrary commands via shell metacharacters in a URL argument to 1 xdg-open or 2 xdg-email...

Code injection

include/imageObjectIM.class.php in Coppermine Photo Gallery CPG before 1.4.15, when the ImageMagick picture processing method is configured, allows remote attackers to execute arbitrary commands via shell metacharacters in the 1 quality, 2 angle, or 3 clipval parameter to picEditor.php...

Debian Security Advisory DSA 1251-1 (netrik)

The remote host is missing an update to netrik announced via advisory DSA 1251-1. It has been discovered that netrik, a text mode WWW browser with vi like keybindings, doesn't properly sanitize temporary filenames when editing textareas which could allow attackers to execute arbitrary commands vi...

CVE-2008-0244

SAP MaxDB 7.6.03 build 007 and earlier allows remote attackers to execute arbitrary commands via "&&" and other shell metacharacters in execsdbinfo and other unspecified commands, which are executed when MaxDB invokes cons.exe...

CVE-2008-0244

SAP MaxDB 7.6.03 build 007 and earlier allows remote attackers to execute arbitrary commands via "&&" and other shell metacharacters in execsdbinfo and other unspecified commands, which are executed when MaxDB invokes cons.exe...

CVE-2008-0244

SAP MaxDB 7.6.03 build 007 and earlier allows remote attackers to execute arbitrary commands via "&&" and other shell metacharacters in execsdbinfo and other unspecified commands, which are executed when MaxDB invokes cons.exe...

Adobe Flash Player ActionScript launch command execution

Added: 01/07/2008 CVE: CVE-2008-5499 BID: 32896 OSVDB: 50796 Background Adobe Flash Player is a cross-platform browser plug-in providing visual enhancements for web pages. Problem An input validation vulnerability allows command execution when the browser loads an SWF file which contains shell...

Adobe Flash Player ActionScript launch command execution

Added: 01/07/2008 CVE: CVE-2008-5499 BID: 32896 OSVDB: 50796 Background Adobe Flash Player is a cross-platform browser plug-in providing visual enhancements for web pages. Problem An input validation vulnerability allows command execution when the browser loads an SWF file which contains shell...