CVE-2007-3499: Undefined Security Weakness

SlackRoll before 8 accepts gpg exit codes other than 0 and 1 as evidence of a valid signature, which allows remote Slackware mirror sites or man-in-the-middle attackers to cause a denial of service data inconsistency or possibly install Trojan horse packages via malformed gpg signatures...

PHP .Htaccess Safe_Mode和Open_Basedir限制绕过漏洞

BUGTRAQ ID: 24661 CVE ID:CVE-2007-3378 CNCVE ID:CNCVE-20073378 PHP是一款广泛使用的WEB开发脚本语言。 PHP存在'safemode'和'openbasedir'限制绕过问题，远程攻击者可以利用漏洞写文件到未授权系统位置。 当使用PHP作为Apache模块，可以通过在.htaccess文件中使用指示进行培植二十时亿兆时毫...

[slackware-security] gd

GD is an open source code library for the dynamic creation of images. New gd packages are available for Slackware 11.0, and -current to fix possible security issues. Please see: http://www.libgd.org/ReleaseNote020035 for complete release notes. "Upgrading is strongly recommended." Here are the...

[slackware-security] thunderbird

A new thunderbird package is available for Slackware -current to fix two possible security issues. This package may also be used on many older versions of Slackware though we're not certain how far back... More details about the issues may be found here:...

[slackware-security] libexif

New libexif packages are available for Slackware 10.2, 11.0, and -current to fix a crash and potential security issue. More details about this issue may be found in the Common Vulnerabilities and Exposures CVE database: https://vulners.com/cve/CVE-2007-4168 Here are the details from the Slackware...

GNU Locate旧格式locate数据库本地缓冲区溢出漏洞

GNU locate是可以在文件数据库里搜索那些匹配用户提供的文件名的程序。 GNU locate读取旧格式locate数据库的文件名存在缓冲区溢出，本地攻击者可以利用漏洞以应用程序权限执行任意指令。 当GNU locate读取旧格式locate数据库的文件名时会拷贝到分配在堆上的固定缓冲区中，文件名超过1026字节可导致缓冲区溢出，溢出的数据可以由用户选择来控制建立本地系统上的文件名。 GNU findutils 4.2.30 + Slackware Linux 8.0 + Slackware Linux 7.1 GNU findutils 4.2.29 + Slackware Lin...

PHP EXT/Session HTTP应答头注入漏洞

PHP是一款广泛使用的WEB开发脚本语言。 PHP的ext/session在置于会话COOKIE前没有URL编码会话ID，远程攻击者可以利用漏洞可以对会话COOKIE进行注入攻击。 当PHP' ext/session调用sessionstart，会在部分情况下发送新会话COOKIE，这些情况如下： - session id嵌入到PATHINFO - session id重生成 - session id通过sessionid设置 - sessionstart多次调用...

Slackware 10.2 / 11.0 / current : firefox-seamonkey-thunderbird (SSA:2007-152-02)

New mozilla-firefox and seamonkey packages are available for Slackware 10.2, 11.0, and -current to fix security issues. New thunderbird packages are are available for Slackware 10.2 and 11.0 to fix security issues. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and...

Slackware 10.2 / 11.0 / current : php5 (SSA:2007-152-01)

New php5 packages are available for Slackware 10.2, 11.0, and -current to fix security issues. PHP5 was considered a test package in Slackware 10.2, and an 'extra' package in Slackware 11.0. If you are currently running PHP4 you may wish to stick with that, as upgrading to PHP5 will probably...

[slackware-security] firefox-seamonkey-thunderbird

New mozilla-firefox and seamonkey packages are available for Slackware 10.2, 11.0, and -current to fix security issues. New thunderbird packages are are available for Slackware 10.2 and 11.0 to fix security issues. More details about this issue may be found at these links:...

[slackware-security] php5

New php5 packages are available for Slackware 10.2, 11.0, and -current to fix security issues. PHP5 was considered a test package in Slackware 10.2, and an "extra" package in Slackware 11.0. If you are currently running PHP4 you may wish to stick with that, as upgrading to PHP5 will probably...

OS Identification : Linux Distribution

This plugin attempts to identify the operating system type and version by looking at certain files on the remote operating system e.g., '/etc/redhat-release' on Red Hat. %NASLMINLEVEL 70300 C Tenable, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid25335;...

Slackware 10.0 / 10.1 / 10.2 / 11.0 / 8.1 / 9.0 / 9.1 / current : libpng (SSA:2007-136-01)

New libpng packages are available for Slackware 8.1, 9.0, 9.1, 10.0, 10.1, 10.2, 11.0, and -current to fix a security issue. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Slackware Security Advisory 2007-136-01. The...

[slackware-security] libpng

New libpng packages are available for Slackware 8.1, 9.0, 9.1, 10.0, 10.1, 10.2, 11.0, and -current to fix a security issue. More details about this issue may be found in the Common Vulnerabilities and Exposures CVE database: https://vulners.com/cve/CVE-2007-2445 Here are the details from the...

Slackware 10.0 / 10.1 / 10.2 / 11.0 / current : samba (SSA:2007-134-01)

New samba packages are available for Slackware 10.0, 10.1, 10.2, 11.0, and -current to fix security issues. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Slackware Security Advisory 2007-134-01. The text itself is...

[slackware-security] samba

New samba packages are available for Slackware 10.0, 10.1, 10.2, 11.0, and -current to fix security issues. More details about the issues may be found in the Common Vulnerabilities and Exposures CVE database: https://vulners.com/cve/CVE-2007-2444 https://vulners.com/cve/CVE-2007-2446...

Samba command injection vulnerability

Overview Samba fails to properly filter input to /bin/sh. This vulnerability may allow a remote, authenticated attacker to execute arbitrary code on a Samba server. Description Samba provides file and print services for Microsoft Windows, Unix, Linux, and OS X clients. Samba can also act as a...

Slackware 10.2 / 11.0 / current : php (SSA:2007-127-01)

New php packages are available for Slackware 10.2, 11.0, and -current to improve the stability and security of PHP. Quite a few bugs were fixed -- please see http://www.php.net for a detailed list. All sites that use PHP are encouraged to upgrade. Please note that we haven't tested all PHP...

[slackware-security] php

New php packages are available for Slackware 10.2, 11.0, and -current to improve the stability and security of PHP. Quite a few bugs were fixed -- please see http://www.php.net for a detailed list. All sites that use PHP are encouraged to upgrade. Please note that we haven't tested all PHP...

Slackware 11.0 : Slackware 11.0 x11-6.9.0 patch fix (SSA:2007-110-01)

A new x11-6.9.0-i486-14slack11.0.tgz patch is available for Slackware 11.0 to fix the inadvertent inclusion of two old fontconfig binaries. Installing the original fontconfig patch followed by the original x11 patch would cause fc-cache and fc-list to be overwritten by old versions, breaking...