security flaw

gpg in GnuPG before 1.4.2.2 does not properly verify non-detached signatures, which allows attackers to inject unsigned data via a data packet that is not associated with a control packet, which causes the check for concatenated signatures to report that the signature is valid, a different...

CVE-2006-0049

gpg in GnuPG before 1.4.2.2 does not properly verify non-detached signatures, which allows attackers to inject unsigned data via a data packet that is not associated with a control packet, which causes the check for concatenated signatures to report that the signature is valid, a different...

SUSE-SA:2006:013: gpg,liby2util

The remote host is missing the patch for the advisory SUSE-SA:2006:013 gpg,liby2util. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. This plugin text was extracted from SuSE Security Advisory SUSE-SA:2006:013 if ! definedfunc"bnrandom" exit0; include'deprecatednasllevel.inc';...

CVE-2006-0803

The signature verification functionality in the YaST Online Update YOU script handling relies on a gpg feature that is not intended for signature verification, which prevents YOU from detecting malicious scripts or code that do not pass the signature check when gpg 1.4.x is being used...

Code injection

The signature verification functionality in the YaST Online Update YOU script handling relies on a gpg feature that is not intended for signature verification, which prevents YOU from detecting malicious scripts or code that do not pass the signature check when gpg 1.4.x is being used...

CVE-2006-0803

The CVE describes a flaw in YaST Online Update (YOU) signature verification: it relies on a GPG feature not intended for signature verification, preventing YOU from detecting malicious scripts that fail the signature check when using GPG 1.4.x. Affected component: YOU script; root cause: improper...

CVE-2006-0803

The signature verification functionality in the YaST Online Update YOU script handling relies on a gpg feature that is not intended for signature verification, which prevents YOU from detecting malicious scripts or code that do not pass the signature check when gpg 1.4.x is being used...

PnuPG gpgv / gpg invalid return code

Utility returns 0 status code if no signature found...

SUSE-SA:2006:009: gpg,liby2util

The remote host is missing the patch for the advisory SUSE-SA:2006:009 gpg,liby2util. With certain handcraftable signatures GPG was returning a 0 valid signature when used on command-line with option --verify. This only affects GPG version 1.4.x, so it only affects SUSE Linux 9.3 and 10.0. Other...

Mandrake Linux Security Advisory : gnupg (MDKSA-2006:043)

Tavis Ormandy discovered it is possible to make gpg incorrectly return success when verifying an invalid signature file. The updated packages have been patched to address this issue. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were...

gnupg -- false positive signature verification

Werner Koch reports: The Gentoo project identified a security related bug in GnuPG. When using any current version of GnuPG for unattended signature verification e.g. by scripts and mail programs, false positive signature verification of detached signatures may occur. This problem affects the too...

Mandrake Linux Security Advisory : mozilla-thunderbird (MDKSA-2005:226)

A bug in enigmail, the GPG support extension for Mozilla MailNews and Mozilla Thunderbird was discovered that could lead to the encryption of an email with the wrong public key. This could potentially disclose confidential data to unintended recipients. The updated packages have been patched to...

rssh: root privilege escalation flaw

Affected Software: rssh - all versions prior to 2.3.0 Vulnerability: local user privilege escalation Severity: CRITICAL Impact: local users can gain root access Solution: Please upgrade to v2.3.1 Summary ------- rssh is a restricted shell which allows a system administrator to limit users' access...

phpBB2018.txt

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 phpBB 2.0.18 XSS and Full Path Disclosure cXIb8O3.22 Author: Maksymilian Arciemowicz cXIb8O3 Date: 16.12.2005 from securityreason.com TEAM - --- 0.Description --- phpBB is a high powered, fully scalable, and highly customizable Open Source bulletin...

SA027.txt

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SecurityAlert SA027 Author: sp3x GPG: http://securityreason.com/key/sp3x.gpg Date: 15. November 2005 Affected software : =================== PHPNuke version : 7.8 with all security fixes/patches Not Affected software : ======================= PHPNuke...

[Full-disclosure] phpBB 2.0.18 SQL Query problem

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 phpBB 2.0.18 SQL Query problem cXIb8O3.19 Author: Maksymilian Arciemowicz cXIb8O3 Date: 11.11.2005 from securityreason.com TEAM - --- 0.Description --- phpBB is a high powered, fully scalable, and highly customizable Open Source bulletin boar d packag...

[SECURITY] [DSA 889-1] New enigmail packages fix information disclosure

-------------------------------------------------------------------------- Debian Security Advisory DSA 889-1 [email protected] http://www.debian.org/security/ Martin Schulze November 8th, 2005 http://www.debian.org/security/faq -...

[SECURITY] [DSA 889-1] New enigmail packages fix information disclosure

-------------------------------------------------------------------------- Debian Security Advisory DSA 889-1 [email protected] http://www.debian.org/security/ Martin Schulze November 8th, 2005 http://www.debian.org/security/faq -...

DSA-889-1 enigmail - programming error

Bulletin has no description...

[Full-disclosure] Advisory 18/2005: PHP Cross Site Scripting (XSS) Vulnerability in phpinfo()

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hardened-PHP Project www.hardened-php.net -= Security Advisory =- Advisory: PHP Cross Site Scripting XSS Vulnerability in phpinfo Release Date: 2005/10/31 Last Modified: 2005/10/31 Author: Stefan Esser [email protected] Application: PHP4 = 4.4.0...