GLSA-200403-08 : oftpd DoS vulnerability

The remote host is affected by the vulnerability described in GLSA-200403-08 oftpd DoS vulnerability Issuing a port command with a number higher than 255 causes the server to crash. The port command may be issued before any authentication takes place, meaning the attacker does not need to know a...

GLSA-200404-19 : Buffer overflows and format string vulnerabilities in LCDproc

The remote host is affected by the vulnerability described in GLSA-200404-19 Buffer overflows and format string vulnerabilities in LCDproc Due to insufficient checking of client-supplied data, the LCDd server is susceptible to two buffer overflows and one string buffer vulnerability. If the serve...

GLSA-200404-06 : Util-linux login may leak sensitive data

The remote host is affected by the vulnerability described in GLSA-200404-06 Util-linux login may leak sensitive data In some situations the login program could leak sensitive data due to an incorrect usage of a reallocated pointer. NOTE: Only users who have PAM support disabled on their systems...

GLSA-200405-05 : Utempter symlink vulnerability

The remote host is affected by the vulnerability described in GLSA-200405-05 Utempter symlink vulnerability Utempter contains a vulnerability that may allow local users to overwrite arbitrary files via a symlink attack. Impact : This vulnerability may allow arbitrary files to be overwritten with...

GLSA-200403-14 : Multiple Security Vulnerabilities in Monit

The remote host is affected by the vulnerability described in GLSA-200403-14 Multiple Security Vulnerabilities in Monit A denial of service may occur due to Monit not sanitizing remotely supplied HTTP parameters before passing them to memory allocation functions. This could allow an attacker to...

BasiliX Webmail Content-Type Header XSS

The remote host appears to be running BasiliX version 1.1.1 or lower. Such versions are vulnerable to a cross-scripting attack whereby an attacker may be able to cause a victim to unknowingly run arbitrary JavaScript code in his browser simply by reading a MIME message with a specially crafted...

Mandrake Linux Security Advisory : samba (MDKSA-2004:071)

A vulnerability was discovered in SWAT, the Samba Web Administration Tool. The routine used to decode the base64 data during HTTP basic authentication is subject to a buffer overrun caused by an invalid base64 character. This same code is also used to internally decode the sambaMungedDial attribu...

Fedora Core 1 : kernel-2.4.22-1.2173.nptl (2004-079)

Paul Starzetz discovered a flaw in return value checking in mremap in the Linux kernel versions 2.4.24 and previous that may allow a local attacker to gain root privileges. No exploit is currently available; however this issue is exploitable. The Common Vulnerabilities and Exposures project...

RHEL 3 : php (RHSA-2004:392)

Updated php packages that fix various security issues are now available. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP server. Stefan Esser discovered a flaw when memorylimit is enabled in versions of PHP 4 before 4.3.8. If a remote attacker could force the PHP...

RHEL 2.1 : mysql (RHSA-2003:094)

Updated packages are available that fix both a double-free security vulnerability and a remote root exploit security vulnerability found in the MySQL server. Updated 11 Aug 2003 Updated mysqlclient9 packages are now included. These were previously missing from this erratum. MySQL is a multi-user,...

RHEL 2.1 / 3 : lftp (RHSA-2003:404)

Updated lftp packages are now available that fix a buffer overflow security vulnerability. lftp is a command-line file transfer program supporting FTP and HTTP protocols. Ulf Harnhammar discovered a buffer overflow bug in versions of lftp up to and including 2.6.9. An attacker could create a...

RHEL 2.1 / 3 : kdelibs (RHSA-2004:222)

Updated kdelibs packages that fix telnet URI handler and mailto URI handler file vulnerabilities are now available. The kdelibs packages include libraries for the K Desktop Environment. KDE Libraries include: kdecore KDE core library, kdeui user interface, kfm file manager, khtmlw HTML widget, ki...

RHEL 2.1 : lynx (RHSA-2003:030)

Updated Lynx packages fix an error in the way Lynx parses its command line arguments which can lead to faked headers being sent to a Web server. Lynx is a character-cell Web browser, suitable for running on terminals such as the VT100. Lynx constructs its HTTP queries from the command line or...

RHEL 2.1 : fetchmail (RHSA-2002:216)

Updated Fetchmail packages are available for Red Hat Linux Advanced Server which close a remotely-exploitable vulnerability in unpatched versions of Fetchmail prior to 6.1.0. Fetchmail is a remote mail retrieval and forwarding utility intended for use over on-demand TCP/IP links such as SLIP and...

RHEL 2.1 : postgresql (RHSA-2003:314)

Updated PostgreSQL packages that correct a buffer overflow in the toascii routines are now available. PostgreSQL is an advanced Object-Relational database management system DBMS. Two bugs that can lead to buffer overflows have been found in the PostgreSQL abstract data type to ASCII conversion...

RHEL 2.1 : pam_smb (RHSA-2003:262)

Updated pamsmb packages are now available which fix a security vulnerability buffer overflow. The pamsmb module is a pluggable authentication module PAM used to authenticate users using an external Server Message Block SMB server. A buffer overflow vulnerability has been found that affects...

RHEL 2.1 : XFree86 (RHSA-2003:289)

Updated XFree86 packages provide security fixes to font libraries and XDM. XFree86 is an implementation of the X Window System providing the core graphical user interface and video drivers. XDM is the X display manager. Multiple integer overflows in the transfer and enumeration of font libraries ...

Important: Red Hat Security Advisory: squirrelmail security update

An updated SquirrelMail package that fixes several security vulnerabilities is now available. SquirrelMail is a webmail package written in PHP. Multiple vulnerabilities have been found which affect the version of SquirrelMail shipped with Red Hat Enterprise Linux 3. An SQL injection flaw was foun...

Low: Red Hat Security Advisory: tcpdump security update

Updated tcpdump, libpcap, and arpwatch packages fix vulnerabilities in ISAKMP parsing. Tcpdump is a command-line tool for monitoring network traffic. Tcpdump v3.8.1 and earlier versions contained multiple flaws in the packet display functions for the ISAKMP protocol. Upon receiving specially...

[ GLSA 200405-18 ] Buffer Overflow in Firebird

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200405-18 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - -...