Webmin pam_login.cgis远程跨站脚本执行漏洞

BUGTRAQ ID: 24381 CVECAN ID: CVE-2007-3156 Webmin是一款基于WEB的Unix和Linux操作系统管理界面。 Webmin的pamlogin.cgi文件中存在多个跨站脚本漏洞，如果用户受骗访问了恶意网页的话，远程攻击者就可以通过cid、message或question参数向用户浏览器会话注入并执行任意脚本。 Webmin Webmin 1.340 Webmin Usermin 1.270 Webmin ------ 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...

GLSA-200707-04 : GNU C Library: Integer overflow

The remote host is affected by the vulnerability described in GLSA-200707-04 GNU C Library: Integer overflow Tavis Ormandy of the Gentoo Linux Security Team discovered a flaw in the handling of the hardware capabilities mask by the dynamic loader. If a mask is specified with a high population...

GLSA-200707-02 : OpenOffice.org: Two buffer overflows

The remote host is affected by the vulnerability described in GLSA-200707-02 OpenOffice.org: Two buffer overflows John Heasman of NGSSoftware has discovered a heap-based buffer overflow when parsing the 'prdata' tag in RTF files where the first token is smaller than the second one CVE-2007-0245...

GLSA-200706-01 : libexif: Integer overflow vulnerability

The remote host is affected by the vulnerability described in GLSA-200706-01 libexif: Integer overflow vulnerability Victor Stinner reported an integer overflow in the exifdataloaddataentry function from file exif-data.c while handling Exif data. Impact : An attacker could entice a user to proces...

GLSA-200705-25 : file: Integer overflow

The remote host is affected by the vulnerability described in GLSA-200705-25 file: Integer overflow Colin Percival from FreeBSD reported that the previous fix for the fileprintf buffer overflow introduced a new integer overflow. Impact : A remote attacker could entice a user to run the file progr...

GLSA-200705-17 : Apache mod_security: Rule bypass

The remote host is affected by the vulnerability described in GLSA-200705-17 Apache modsecurity: Rule bypass Stefan Esser discovered that modsecurity processes NULL characters as terminators in POST requests using the application/x-www-form-urlencoded encoding type, while other parsers used in we...

GLSA-200705-16 : PhpWiki: Remote execution of arbitrary code

The remote host is affected by the vulnerability described in GLSA-200705-16 PhpWiki: Remote execution of arbitrary code Harold Hallikainen has reported that the Upload page fails to properly check the extension of a file. Impact : A remote attacker could upload a specially crafted PHP file to th...

GLSA-200705-18 : PPTPD: Denial of Service attack

The remote host is affected by the vulnerability described in GLSA-200705-18 PPTPD: Denial of Service attack James Cameron from HP has reported a vulnerability in PPTPD caused by malformed GRE packets. Impact : A remote attacker could exploit this vulnerability to cause a Denial of Service on the...

MySQL IF查询处理远程拒绝服务漏洞

MySQL是一款使用非常广泛的开放源代码关系数据库系统，拥有各种平台的运行版本。 MySQL处理IF请求时存在漏洞，如果向MySQL数据库提交了恶意的IF查询请求的话，就可能触发空指针引用，导致服务器崩溃。 MySQL AB MySQL 5.0.40-debug MySQL AB MySQL 5.0.34 MySQL AB MySQL 5.0.26 MySQL AB -------- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://dev.mysql.com/downloads/mysql/5.0.html Gentoo ------...

GLSA-200705-06 : X.Org X11 library: Multiple integer overflows

The remote host is affected by the vulnerability described in GLSA-200705-06 X.Org X11 library: Multiple integer overflows Multiple integer overflows have been reported in the XGetPixel function of the X.Org X11 library. Impact : By enticing a user to open a specially crafted image, an attacker...

GLSA-200705-04 : Apache mod_perl: Denial of Service

The remote host is affected by the vulnerability described in GLSA-200705-04 Apache modperl: Denial of Service Alex Solvey discovered that the 'pathinfo' variable used in file RegistryCooker.pm modperl 2.x or file PerlRun.pm modperl 1.x, is not properly escaped before being processed. Impact : A...

GLSA-200705-02 : FreeType: User-assisted execution of arbitrary code

The remote host is affected by the vulnerability described in GLSA-200705-02 FreeType: User-assisted execution of arbitrary code Greg MacManus of iDefense Labs has discovered an integer overflow in the function bdfReadCharacters when parsing BDF fonts. Impact : A remote attacker could entice a us...

GLSA-200704-18 : Courier-IMAP: Remote execution of arbitrary code

The remote host is affected by the vulnerability described in GLSA-200704-18 Courier-IMAP: Remote execution of arbitrary code CJ Kucera has discovered that some Courier-IMAP scripts don't properly handle the XMAILDIR variable, allowing for shell command injection. Impact : A remote attacker could...

GLSA-200704-08 : DokuWiki: XSS vulnerability

The remote host is affected by the vulnerability described in GLSA-200704-08 DokuWiki: XSS vulnerability DokuWiki does not sanitize user input to the GET variable 'media' in the fetch.php file. Impact : An attacker could entice a user to click a specially crafted link and inject CRLF characters...

GLSA-200704-10 : Inkscape: Two format string vulnerabilities

The remote host is affected by the vulnerability described in GLSA-200704-10 Inkscape: Two format string vulnerabilities Kees Cook has discovered two vulnerabilities in Inkscape. The application does not properly handle format string specifiers in some dialog boxes. Inkscape is also vulnerable to...

GLSA-200704-09 : xine-lib: Heap-based buffer overflow

The remote host is affected by the vulnerability described in GLSA-200704-09 xine-lib: Heap-based buffer overflow xine-lib does not check boundaries on data being read into buffers from DMO video files in code that is shared with MPlayer DMOVideoDecoder.c. Impact : An attacker could entice a user...

GLSA-200703-26 : file: Integer underflow

The remote host is affected by the vulnerability described in GLSA-200703-26 file: Integer underflow Jean-Sebastien Guay-Leroux reported an integer underflow in fileprintf function. Impact : A remote attacker could entice a user to run the 'file' program on a specially crafted file that would...

GLSA-200703-06 : AMD64 x86 emulation Qt library: Integer overflow

The remote host is affected by the vulnerability described in GLSA-200703-06 AMD64 x86 emulation Qt library: Integer overflow An integer overflow flaw has been found in the pixmap handling of Qt, making the AMD64 x86 emulation Qt library vulnerable as well. Impact : By enticing a user to open a...

GLSA-200703-05 : Mozilla Suite: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-200703-05 Mozilla Suite: Multiple vulnerabilities Several vulnerabilities ranging from code execution with elevated privileges to information leaks affect the Mozilla Suite. Impact : A remote attacker could entice a user to browse...

GLSA-200701-25 : X.Org X server: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-200701-25 X.Org X server: Multiple vulnerabilities Multiple memory corruption vulnerabilities have been found in the ProcDbeGetVisualInfo and the ProcDbeSwapBuffers of the DBE extension, and ProcRenderAddGlyphs in the Render...