CVE-2007-3634

CVE-2007-3634 concerns the G/PGP (GPG) Plugin 2.0 for Squirrelmail 1.4.10a. A remote authenticated attacker could execute arbitrary commands via an unspecified vector, with potential ties to the passphrase variable in the gpg_sign_attachment function. The available documents do not provide a conc...

Code injection

SlackRoll before 8 accepts gpg exit codes other than 0 and 1 as evidence of a valid signature, which allows remote Slackware mirror sites or man-in-the-middle attackers to cause a denial of service data inconsistency or possibly install Trojan horse packages via malformed gpg signatures...

CVE-2007-3499

SlackRoll before 8 accepts gpg exit codes other than 0 and 1 as evidence of a valid signature, which allows remote Slackware mirror sites or man-in-the-middle attackers to cause a denial of service data inconsistency or possibly install Trojan horse packages via malformed gpg signatures...

CVE-2007-3499

CVE-2007-3499 affects SlackRoll before 8. It incorrectly treats gpg exit codes other than 0 and 1 as evidence of a valid signature, enabling remote Slackware mirror sites or man-in-the-middle attackers to cause data inconsistency (DoS) or potentially install Trojan horse packages via malformed si...

CVE-2007-3499

SlackRoll before 8 accepts gpg exit codes other than 0 and 1 as evidence of a valid signature, which allows remote Slackware mirror sites or man-in-the-middle attackers to cause a denial of service data inconsistency or possibly install Trojan horse packages via malformed gpg signatures...

CVE-2007-3499: Undefined Security Weakness

SlackRoll before 8 accepts gpg exit codes other than 0 and 1 as evidence of a valid signature, which allows remote Slackware mirror sites or man-in-the-middle attackers to cause a denial of service data inconsistency or possibly install Trojan horse packages via malformed gpg signatures...

[ MDKSA-2007:135 ] - Updated webmin packages fix XSS vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDKSA-2007:135 http://www.mandriva.com/security/ Package : webmin Date : June 23, 2007 Affected: 2007.0, 2007.1, Corporate 4.0 Problem Description: Multiple cross-site scripting XSS vulnerabilities were discovered in...

SUSE-SA:2007:024: gpg

The remote host is missing the patch for the advisory SUSE-SA:2007:024 gpg. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. This plugin text was extracted from SuSE Security Advisory SUSE-SA:2007:024 if ! definedfunc"bnrandom" exit0; include'deprecatednasllevel.inc'; include'compat.inc';...

syscp1215-exec.txt

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 The System Control Panel www.SysCP.org -= Security Advisory =- Advisory: Ability to inject and execute any code as root in SysCP Release Date: 2007/02/02 Last Modified: 2007/02/07 Author: Florian Lippert Application: SysCP and only affects SysCP 1.2.1...

[ MDKSA-2007:019 ] - Updated pdftohtml packages fix crafted pdf file vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDKSA-2007:019 http://www.mandriva.com/security/ Package : pdftohtml Date : January 18, 2007 Affected: 2006.0, 2007.0 Problem Description: The Adobe PDF specification 1.3, as implemented by xpdf 3.0.1 patch 2, kpdf in...

GLSA-200612-03 : GnuPG: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-200612-03 GnuPG: Multiple vulnerabilities Hugh Warrington has reported a boundary error in GnuPG, in the 'askoutfilename' function from openfile.c: the makeprintablestring function could return a string longer than expected...

CVE-2006-6235: Undefined Security Weakness

A "stack overwrite" vulnerability in GnuPG gpg 1.x before 1.4.6, 2.x before 2.0.2, and 1.9.0 through 1.9.95 allows attackers to execute arbitrary code via crafted OpenPGP packets that cause GnuPG to dereference a function pointer from deallocated stack memory...

CVE-2006-6169: Undefined Security Weakness

Heap-based buffer overflow in the askoutfilename function in openfile.c for GnuPG gpg 1.4 and 2.0, when running interactively, might allow attackers to execute arbitrary code via messages with "C-escape" expansions, which cause the makeprintablestring function to return a longer string than...

Debian DSA-889-1 : enigmail - programming error

Hadmut Danish discovered a bug in enigmail, GPG support for Mozilla MailNews and Mozilla Thunderbird, that can lead to the encryption of mail with the wrong public key, hence, potential disclosure of confidential data to others. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive...

USN-332-1: gnupg vulnerability

Evgeny Legerov discovered that gnupg did not sufficiently check the validity of the comment and a control field. Specially crafted GPG data could cause a buffer overflow. This could be exploited to execute arbitrary code with the user's privileges if an attacker can trick an user into processing ...

CVE-2006-3746

CVE-2006-3746 relates to an integer overflow in GnuPG (gnupg) 1.4.4, specifically in parse_comment, where a crafted message could trigger a remote denial-of-service (segmentation fault) or memory overwrite. Several OpenVAS entries document affected releases and remediation through updated GnuPG p...

CVE-2006-3746: Undefined Security Weakness

Integer overflow in parsecomment in GnuPG gpg 1.4.4 allows remote attackers to cause a denial of service segmentation fault via a crafted message...

CVE-2006-3082

CVE-2006-3082 affects GnuPG (gpg) 1.4.3, 1.9.20 and earlier, where parsing a very large UID can trigger an integer overflow in parse-packet.c, causing a denial of service (gpg crash) and potential memory overwrite when processing oversized message packets (notably with --no-armor). Multiple advis...

Asterisk 1.2.9 and Asterisk 1.0.11 Released - Security Fix

The Asterisk Development Team today released Asterisk 1.2.9 and Asterisk 1.0.11 to address a security vulnerability in the IAX2 channel driver chaniax2. The vulnerability affects all users with IAX2 clients that might be compromised or used by a malicious user, and can lead to denial of service...

[ MDKSA-2006:089 ] - Updated kphone packages fixes permissions issue with .qt/kphonerc

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDKSA-2006:089 http://www.mandriva.com/security/ Package : kphone Date : May 24, 2006 Affected: 2006.0 Problem Description: Kphone creates .qt/kphonerc with world-readable permissions, which allows local users to read...