CVE-2009-1955

CVE-2009-1955 affects the Expact XML parser used by the apr_xml_* interface in xml/apr_xml.c of APR-util, with the vulnerability present in APR-util prior to 1.3.7. In Apache HTTP Server deployments that enable mod_dav and mod_dav_svn, a crafted XML document containing a large number of nested en...

CVE-2009-0023

The aprstrmatchprecompile function in strmatch/aprstrmatch.c in Apache APR-util before 1.3.5 allows remote attackers to cause a denial of service daemon crash via crafted input involving 1 a .htaccess file used with the Apache HTTP Server, 2 the SVNMasterURI directive in the moddavsvn module in t...

CVE-2009-1956

Off-by-one error in the aprbrigadevprintf function in Apache APR-util before 1.3.5 on big-endian platforms allows remote attackers to obtain sensitive information or cause a denial of service application crash via crafted input...

CVE-2009-0023

CVE-2009-0023 affects Apache APR-util prior to 1.3.5. The vulnerability in apr_strmatch_precompile (strmatch/apr_strmatch.c) can be exploited by crafted input via that library’s usage contexts (e.g., .htaccess with Apache HTTP Server, SVNMasterURI in mod_dav_svn, mod_apreq2, or applications using...

CVE-2009-1955

The expat XML parser in the aprxml interface in xml/aprxml.c in Apache APR-util before 1.3.7, as used in the moddav and moddavsvn modules in the Apache HTTP Server, allows remote attackers to cause a denial of service memory consumption via a crafted XML document containing a large number of nest...

Apache Httpd < 2.2.12 : APR-util XML DoS

A denial of service flaw was found in the bundled copy of the APR-util library Extensible Markup Language XML parser. A remote attacker could create a specially-crafted XML document that would cause excessive memory consumption when processed by the XML decoding engine...

[SECURITY] [DSA 1812-1] New apr-util packages fix several vulnerabilities

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------ Debian Security Advisory DSA-1812-1 [email protected] http://www.debian.org/security/ Stefan Fritsch June 04, 2009 http://www.debian.org/security/faq -...

apr -- multiple vulnerabilities

Secunia reports: Some vulnerabilities have been reported in APR-util, which can be exploited by malicious users and malicious people to cause a DoS Denial of Service. A vulnerability is caused due to an error in the processing of XML files and can be exploited to exhaust all available memory via ...

[SECURITY] [DSA 1812-1] New apr-util packages fix several vulnerabilities

------------------------------------------------------------------------ Debian Security Advisory DSA-1812-1 [email protected] http://www.debian.org/security/ Stefan Fritsch June 04, 2009 http://www.debian.org/security/faq -...

DSA-1812-1 apr-util - several vulnerabilities

Bulletin has no description...

AIX 610002 : U825561

The remote host is missing AIX PTF U825561 which is related to the security of the package X11.samples.fnt.util You should install this PTF for your system to be up-to-date. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. if ! definedfunc"bnrandom" exit0; include'deprecatednasllevel.inc';...

util-linux security and bug fix update

2.12a-24.el4 - fix 458539 - man nfs : wrong information about nfs version used 2.12a-23.el4 - fix 485004 - move mount doesnt correctly update mtab 2.12a-22.el4 - fix 472186 - mount -a has problems with duplicate labels in a mpath setup - fix 471372 - RHEL4: fdisk cannot create partition with...

RedHat Security Advisory RHSA-2009:0981

The remote host is missing updates to util-linux announced in advisory RHSA-2009:0981. A log injection attack was found in util-linux when logging log in attempts via the audit subsystem of the Linux kernel. A remote attacker could use this flaw to modify certain parts of logged events, possibly...

RedHat Security Advisory RHSA-2009:0981

The remote host is missing updates to util-linux announced in advisory RHSA-2009:0981. A log injection attack was found in util-linux when logging log in attempts via the audit subsystem of the Linux kernel. A remote attacker could use this flaw to modify certain parts of logged events, possibly...

RHEL 4 : util-linux (RHSA-2009:0981)

An updated util-linux package that fixes one security issue and several bugs is now available. This update has been rated as having low security impact by the Red Hat Security Response Team. The util-linux package contains a collection of basic system utilities, such as fdisk and mount. A log...

util-linux: audit log injection via login

Argument injection vulnerability in login login-utils/login.c in util-linux-ng 2.14 and earlier makes it easier for remote attackers to hide activities by modifying portions of log events, as demonstrated by appending an "addr=" statement to the login name, aka "audit log injection."...

Apache Httpd < 2.2.12 : APR-util off-by-one overflow

An off-by-one overflow flaw was found in the way the bundled copy of the APR-util library processed a variable list of arguments. An attacker could provide a specially-crafted string as input for the formatted output conversion routine, which could, on big-endian platforms, potentially lead to th...

Mandriva Linux Security Advisory : util-linux-ng (MDVSA-2008:114)

Argument injection vulnerability in login login-utils/login.c in util-linux-ng 2.14 and earlier makes it easier for remote attackers to hide activities by modifying portions of log events. The updated packages have been patched to fix the issue. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

FreeBSD : apache -- apr_uri_parse IPv6 address handling vulnerability (762d1c6d-0722-11d9-b45d-000c41e2cdad)

The Apache Software Foundation Security Team discovered a programming error in the apr-util library function apruriparse. When parsing IPv6 literal addresses, it is possible that a length is incorrectly calculated to be negative, and this value is passed to memcpy. This may result in an exploitab...

MDVA-2008:154 : util-linux-ng

Several bugs were found in util-linux-ng package: - Using an offset on loopback device was broken - Creating an encrypted loopback with losetup -e was broken - Using fdisk to modify the partition table of an image file did not write the changes The updated package fixes these issues. %NASLMINLEVE...