[SECURITY] [DSA 1033-1] New horde3 packages fix several vulnerabilities

-------------------------------------------------------------------------- Debian Security Advisory DSA 1033-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff April 12th, 2006 http://www.debian.org/security/faq -...

Microsoft Internet Explorer fails to properly handle double-byte characters in specially crafted URLs

Overview Microsoft Internet Explorer IE fails to properly handle double-byte characters in URLs, which may allow a remote, unauthenticated attacker to execute arbitrary code. Description IE fails to properly handle double-byte characters in URLs. When a specially crafted HTML file is opened in IE...

TWiki Search.pm shell command injection

Added: 04/06/2006 CVE: CVE-2004-1037 BID: 11674 OSVDB: 11714 Background TWiki is a web-based collaboration platform written in PERL. Problem The Search.pm module does not sufficiently check search strings for illegal characters, allowing remote attackers to execute commands using search strings...

TWiki Search.pm shell command injection

Added: 04/06/2006 CVE: CVE-2004-1037 BID: 11674 OSVDB: 11714 Background TWiki is a web-based collaboration platform written in PERL. Problem The Search.pm module does not sufficiently check search strings for illegal characters, allowing remote attackers to execute commands using search strings...

Preemptive Protection against BlueCoat WinProxy Host Header Stack Overflow Vulnerability

BlueCoat WinProxy is an Internet sharing proxy server designed for small to medium businesses. A vulnerability that was detected in WinProxy could allow remote execution of arbitrary code. The vulnerability can be triggered by sending an overly long Host string in a HTTP request to the Web proxy...

The Includer RCE Vulnerability

The Includer is prone to a remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2005 David Maciejak Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[UNIX] FACE CONTROL CMS vis.pl Directory Traversal

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com - - promotion The SecuriTeam alerts list - Free, Accurate, Independent. Get your security news from a reliable source...

Moderate: Red Hat Security Advisory: initscripts security update

An updated initscripts package that fixes a privilege escalation issue and several bugs is now available. This update has been rated as having moderate security impact by the Red Hat Security Response Team. The initscripts package contains the basic system scripts used to boot your Red Hat system...

Design/Logic Flaw

server.cpp in Monopd 0.9.3 allows remote attackers to cause a denial of service CPU and memory consumption via a string containing a large number of characters that are escaped when Monopd produces XML output...

CVE-2006-0814

response.c in Lighttpd 1.4.10 and possibly previous versions, when run on Windows, allows remote attackers to read arbitrary source code via requests that contain trailing 1 "." dot and 2 space characters, which are ignored by Windows, as demonstrated by PHP files...

CVE-2006-0377

CRLF injection vulnerability in SquirrelMail 1.4.0 to 1.4.5 allows remote attackers to inject arbitrary IMAP commands via newline characters in the mailbox parameter of the sqimapmailboxselect command, aka "IMAP injection."...

OpenSSH, Dropbear: Insecure use of system() call

Background OpenSSH is a free application suite consisting of server and clients that replace tools like telnet, rlogin, rcp and ftp with more secure versions offering additional functionality. Dropbear is an SSH server and client designed with a small memory footprint that includes OpenSSH scp...

Crlf injection

CRLF injection vulnerability in mailback.pl in Erik C. Thauvin mailback allows remote attackers to use mailback as a "spam proxy" by modifying mail headers, including recipient e-mail addresses, via newline characters in the Subject field...

CVE-2006-0631

CRLF injection vulnerability in mailback.pl in Erik C. Thauvin mailback allows remote attackers to use mailback as a "spam proxy" by modifying mail headers, including recipient e-mail addresses, via newline characters in the Subject field...

bzip2 bzgrep and gzip zgrep shell characters problem

Unfiltered characters in filename allow code execution...

vis.pl.txt

Hackers Center Security Group http://www.hackerscenter.com/ spher3's Security Advisory Multiple transversal bug in vis.pl -------------------------------------------------------------------------- Description: Vis.pl is a perl script which manages files in order to show these; you can find it in...

OpenSSH scp client unfiltered shell characters

Unsafe argument filename usage in system call...

Design/Logic Flaw

RockLiffe MailSite HTTP Mail management agent httpma 7.0.3.1 allows remote attackers to cause a denial of service CPU consumption and crash via a malformed query string containing special characters such as "|"...

CVE-2006-0342

RockLiffe MailSite HTTP Mail management agent httpma 7.0.3.1 allows remote attackers to cause a denial of service CPU consumption and crash via a malformed query string containing special characters such as "|"...

Ubuntu 4.10 / 5.04 / 5.10 : mailman vulnerabilities (USN-242-1)

Aliet Santiesteban Sifontes discovered a remote Denial of Service vulnerability in the attachment handler. An email with an attachment whose filename contained invalid UTF-8 characters caused mailman to crash. CVE-2005-3573 Mailman did not sufficiently verify the validity of email dates. Very lar...