Crashes with evidence of memory corruption (rv:1.8.1.8) — Mozilla

As part of the Firefox 2.0.0.8 update releases Mozilla developers fixed many bugs to improve the stability of the product. Some of these crashes showed evidence of memory corruption under certain circumstances and we presume that with enough effort at least some of these could be exploited to run...

openSUSE 10 Security Update : dia (dia-1435)

Format string bugs in dia could potentially be exploited to execute arbitrary code CVE-2006-2453, CVE-2006-2480. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update dia-1435. The text description ...

openSUSE 10 Security Update : apache2-mod_php5 (apache2-mod_php5-3978)

This update fixes multiple bugs in php : - predictable generaton of an initialization vector IV in the mcrypt extension - additional cookie attributes could be injected via a session id - specially crafted files could cause integer overflows in gd and leverage them to at least crash gd based...

openSUSE 10 Security Update : qt3 (qt3-3899)

Format string bugs in QTextEdit can be exploited via specially crafted HTML tags to potentially execute code CVE-2007-3388. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update qt3-3899. The text...

openSUSE 10 Security Update : OpenOffice_org (OpenOffice_org-3530)

This update of OpenOfficeorg fixes a heap-overflow in the RTF parser and additional non-security bugs. CVE-2007-0245 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update OpenOfficeorg-3530. The tex...

openSUSE 10 Security Update : krb5 (krb5-4191)

This update of krb5 fixes two bugs in kadmind that can be used to execute arbitrary code remotely. CVE-2007-3999, CVE-2007-4000 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update krb5-4191. The...

openSUSE 10 Security Update : zypper (zypper-4443)

This update of zypper fixes some security related bugs that occur while handling files. These bugs can be abused to get access to log-files for reading and writing as well as causing denial-of-service conditions. Thanks to Stefan Nordhausen for reporting this. %NASLMINLEVEL 70300 C Tenable Networ...

openSUSE 10 Security Update : apache2-mod_php5 (apache2-mod_php5-3979)

This update fixes multiple bugs in php : - predictable generaton of an initialization vector IV in the mcrypt extension - additional cookie attributes could be injected via a session id - specially crafted files could cause integer overflows in gd and leverage them to at least crash gd based...

openSUSE 10 Security Update : apache2-mod_php5 (apache2-mod_php5-3288)

This Update fixes numerous vulnerabilities in PHP. Most of them were made public during the 'Month of PHP Bugs'. The vulnerabilities potentially lead to crashes, information leaks or even execution of malicious code. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and...

openSUSE 10 Security Update : clamav (clamav-1844)

This versionupdate to 0.88.3 fixes small bugs. Among others a problem with large binhex files has been fixed. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update clamav-1844. The text description ...

openSUSE 10 Security Update : kernel (kernel-4503)

This kernel update fixes the following security problems : - CVE-2007-4571: An information disclosure vulnerability in the ALSA driver can be exploited by local users to read sensitive data from the kernel memory. - CVE-2007-4573: It was possible for local user to become root by exploitable a bug...

openSUSE 10 Security Update : xine-lib (xine-lib-2487)

This update fixes several format string bugs that can be exploited remotely with user-assistance to execute arbitrary code. CVE-2007-0017 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update...

openSUSE 10 Security Update : OpenOffice_org (OpenOffice_org-3626)

This update of OpenOfficeorg fixes a heap-overflow in the RTF parser and additional non-security bugs. CVE-2007-0245 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update OpenOfficeorg-3626. The tex...

openSUSE 10 Security Update : kernel (kernel-3760)

This kernel update fixes the following security problems : - CVE-2007-1861: The nlfiblookup function in net/ipv4/fibfrontend.c allows attackers to cause a denial of service kernel panic via NETLINKFIBLOOKUP replies, which trigger infinite recursion and a stack overflow. - CVE-2007-1496:...

openSUSE 10 Security Update : kernel (kernel-4487)

This kernel update fixes the following security problems : - CVE-2007-3105: Stack-based buffer overflow in the random number generator RNG implementation in the Linux kernel before 2.6.22 might allow local root users to cause a denial of service or gain privileges by setting the default wake-up...

Several vulnerabilities in CMS Made Simple 1.1.3.1

Hi, There are several security bugs in CMS Made Simple 1.1.3.1 : I am not going to release dangerous and exploitable info here 1 There is a highly dangerous PHP code execution bug in the script . 2 A registered user can access unauthorized pages . For example he can upload files to the server, or...

CVE-2007-5191

mount and umount in util-linux and loop-aes-utils call the setuid and setgid functions in the wrong order and do not check the return values, which might allow attackers to gain privileges via helpers such as mount.nfs...

Velocity does not automatically escape HTML entities when substituting variables

Velocity should automatically escape encode HTML entities in variables it interpolates in markup. This would remove the need for explicitly escaping variables using $generalUtil.htmlEncode, and fix lots of XSS bugs including ones we haven't discovered yet. This affects all versions of Confluence...

Velocity does not automatically escape HTML entities when substituting variables

Velocity should automatically escape encode HTML entities in variables it interpolates in markup. This would remove the need for explicitly escaping variables using $generalUtil.htmlEncode, and fix lots of XSS bugs including ones we haven't discovered yet. This affects all versions of Confluence...

Velocity does not automatically escape HTML entities when substituting variables

Velocity should automatically escape encode HTML entities in variables it interpolates in markup. This would remove the need for explicitly escaping variables using $generalUtil.htmlEncode, and fix lots of XSS bugs including ones we haven't discovered yet. This affects all versions of Confluence...