CVE-2007-3635

The CVE-2007-3635 entry details a vulnerability in the SquirrelMail G/PGP plugin prior to version 2.1. The root cause is improper escaping of user-supplied data in functions such as deletekey(), gpg_check_sign_pgp_mime(), and gpg_recv_key(), allowing a local authenticated user to inject commands....

CVE-2007-3636

CVE-2007-3636 involves the G/PGP (GPG) Plugin 2.1 for Squirrelmail with multiple vulnerabilities that enable remote command execution. Publicly available records describe exploitation via unspecified vectors, as noted in both NVD and Red Hat entries. A related historical detail (CVE-2005-1924) sp...

CVE-2007-3634

Unspecified vulnerability in the G/PGP GPG Plugin 2.0 for Squirrelmail 1.4.10a allows remote authenticated users to execute arbitrary commands via unspecified vectors, possibly related to the passphrase variable in the gpgsignattachment function, aka ZD-00000004. this information is based upon a...

CVE-2007-3499

SlackRoll before 8 accepts gpg exit codes other than 0 and 1 as evidence of a valid signature, which allows remote Slackware mirror sites or man-in-the-middle attackers to cause a denial of service data inconsistency or possibly install Trojan horse packages via malformed gpg signatures...

Code injection

SlackRoll before 8 accepts gpg exit codes other than 0 and 1 as evidence of a valid signature, which allows remote Slackware mirror sites or man-in-the-middle attackers to cause a denial of service data inconsistency or possibly install Trojan horse packages via malformed gpg signatures...

CVE-2007-3499

CVE-2007-3499 affects SlackRoll before 8. It incorrectly treats gpg exit codes other than 0 and 1 as evidence of a valid signature, enabling remote Slackware mirror sites or man-in-the-middle attackers to cause data inconsistency (DoS) or potentially install Trojan horse packages via malformed si...

CVE-2007-3499

SlackRoll before 8 accepts gpg exit codes other than 0 and 1 as evidence of a valid signature, which allows remote Slackware mirror sites or man-in-the-middle attackers to cause a denial of service data inconsistency or possibly install Trojan horse packages via malformed gpg signatures...

[ MDKSA-2007:135 ] - Updated webmin packages fix XSS vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDKSA-2007:135 http://www.mandriva.com/security/ Package : webmin Date : June 23, 2007 Affected: 2007.0, 2007.1, Corporate 4.0 Problem Description: Multiple cross-site scripting XSS vulnerabilities were discovered in...

SUSE-SA:2007:024: gpg

The remote host is missing the patch for the advisory SUSE-SA:2007:024 gpg. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. This plugin text was extracted from SuSE Security Advisory SUSE-SA:2007:024 if ! definedfunc"bnrandom" exit0; include'deprecatednasllevel.inc'; include'compat.inc';...

syscp1215-exec.txt

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 The System Control Panel www.SysCP.org -= Security Advisory =- Advisory: Ability to inject and execute any code as root in SysCP Release Date: 2007/02/02 Last Modified: 2007/02/07 Author: Florian Lippert Application: SysCP and only affects SysCP 1.2.1...

[ MDKSA-2007:019 ] - Updated pdftohtml packages fix crafted pdf file vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDKSA-2007:019 http://www.mandriva.com/security/ Package : pdftohtml Date : January 18, 2007 Affected: 2006.0, 2007.0 Problem Description: The Adobe PDF specification 1.3, as implemented by xpdf 3.0.1 patch 2, kpdf in...

GLSA-200612-03 : GnuPG: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-200612-03 GnuPG: Multiple vulnerabilities Hugh Warrington has reported a boundary error in GnuPG, in the 'askoutfilename' function from openfile.c: the makeprintablestring function could return a string longer than expected...

Debian DSA-889-1 : enigmail - programming error

Hadmut Danish discovered a bug in enigmail, GPG support for Mozilla MailNews and Mozilla Thunderbird, that can lead to the encryption of mail with the wrong public key, hence, potential disclosure of confidential data to others. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive...

USN-332-1: gnupg vulnerability

Evgeny Legerov discovered that gnupg did not sufficiently check the validity of the comment and a control field. Specially crafted GPG data could cause a buffer overflow. This could be exploited to execute arbitrary code with the user's privileges if an attacker can trick an user into processing ...

CVE-2006-3746

CVE-2006-3746 relates to an integer overflow in GnuPG (gnupg) 1.4.4, specifically in parse_comment, where a crafted message could trigger a remote denial-of-service (segmentation fault) or memory overwrite. Several OpenVAS entries document affected releases and remediation through updated GnuPG p...

CVE-2006-3082

CVE-2006-3082 affects GnuPG (gpg) 1.4.3, 1.9.20 and earlier, where parsing a very large UID can trigger an integer overflow in parse-packet.c, causing a denial of service (gpg crash) and potential memory overwrite when processing oversized message packets (notably with --no-armor). Multiple advis...

Asterisk 1.2.9 and Asterisk 1.0.11 Released - Security Fix

The Asterisk Development Team today released Asterisk 1.2.9 and Asterisk 1.0.11 to address a security vulnerability in the IAX2 channel driver chaniax2. The vulnerability affects all users with IAX2 clients that might be compromised or used by a malicious user, and can lead to denial of service...

[ MDKSA-2006:089 ] - Updated kphone packages fixes permissions issue with .qt/kphonerc

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDKSA-2006:089 http://www.mandriva.com/security/ Package : kphone Date : May 24, 2006 Affected: 2006.0 Problem Description: Kphone creates .qt/kphonerc with world-readable permissions, which allows local users to read...

FreeBSD : gnupg -- false positive signature verification (63fe4189-9f97-11da-ac32-0001020eed82)

Werner Koch reports : The Gentoo project identified a security related bug in GnuPG. When using any current version of GnuPG for unattended signature verification e.g. by scripts and mail programs, false positive signature verification of detached signatures may occur. This problem affects the to...

SUSE-SA:2006:014: gpg

The remote host is missing the patch for the advisory SUSE-SA:2006:014 gpg. The GNU Privacy Guard GPG allows crafting a message which could check out correct using '--verify', but would extract a different, potentially malicious content when using '-o --batch'. The reason for this is that a .gpg ...