Debian: Security Advisory (DSA-274-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2008 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SecurityReason - Apache (mod_proxy_ftp) Undefined Charset UTF-7 XSS Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SecurityReason - Apache modproxyftp Undefined Charset UTF-7 XSS Vulnerability Author: sp3x Date: - - Written: 15.12.2007 - - Public: 10.01.2008 SecurityReason Research SecurityAlert Id: 49 CVE: CVE-2008-0005 SecurityRisk: Low Affected Software: Apache...

SecurityReason - Apache2 CSRF, XSS, Memory Corruption and Denial of Service Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Apache2 CSRF, XSS, Memory Corruption and Denial of Service Vulnerability Author: sp3x Date: - - Written: 06.12.2007 - - Public: 09.01.2008 SecurityReason Research SecurityAlert Id: 48 CVE: CVE-2007-6420 CVE-2007-6421 CVE-2007-6422 CVE-2007-6423...

Two vulnerabilities in SquirrelMail GPG plugin

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Site address: http://www.braverock.com/gpg SquirrelMail plugin page: http://www.squirrelmail.org/pluginview.php?id=153 1 issue - Deletion of files writable by web server user SquirrelMail GPG plugin allows end users to delete or overwrite files writab...

SuSE 10 Security Update : gpg (ZYPP Patch Number 2355)

Specially crafted files could overflow a buffer when gpg2 was used in interactive mode. CVE-2006-6169 - Specially crafted files could modify a function pointer and execute code this way. CVE-2006-6235 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C...

SuSE 10 Security Update : gpg (ZYPP Patch Number 2994)

When printing a text stream with a GPG signature it was possible for an attacker to create a stream with 'unsigned text, signed text' where both unsigned and signed text would be shown without distinction which one was signed and which part wasn't. This is tracked by the Mitre CVE ID CVE-2007-126...

SuSE 10 Security Update : gpg (ZYPP Patch Number 1959)

This update of gpg fixes an segmentation fault when using the--no-armor option. This failure leads to a denial-of-service attack and may be used execute arbitrary code. CVE-2006-3746 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc...

SquirrelMail GPGP Encryption Plugin - deletekey() Command Injection

SquirrelMail GPGP Encryption Plugin - deletekey Command Injection !/usr/local/bin/ruby puts"http://backdoored.net\n" puts "SquirrelMail G/PG deletekey command injection exploit\n" puts "http://backdoored.net Visit Us\n" puts "Coded by Backdoored member. \n" puts...

SquirrelMail G/PGP Encryption Plugin - 'deletekey()' Command Injection

!/usr/local/bin/ruby puts"http://backdoored.net\n" puts "SquirrelMail G/PG deletekey command injection exploit\n" puts "http://backdoored.net Visit Us\n" puts "Coded by Backdoored member. \n" puts "--------------------------------------------------\n" if ARGV0 == nil && ARGV1 == nil && ARGV2 == n...

[SECURITY] Fedora 7 Update: kdeutils-3.5.8-2.fc7

Utilities for the K Desktop Environment. Includes: ark tar/gzip archive manager; kcalc scientific calculator; kcharselect character selector; kdepasswd change password; kdessh ssh front end; kdf view disk usage; kedit simple text editor; kfloppy floppy formatting tool; kgpg gpg gui khexedit hex...

openSUSE 10 Security Update : gpg (gpg-2995)

When printing a text stream with a GPG signature it was possible for an attacker to create a stream with 'unsigned text, signed text' where both unsigned and signed text would be shown without distinction which one was signed and which part wasn't. This is tracked by the Mitre CVE ID CVE-2007-126...

openSUSE 10 Security Update : gpg (gpg-1955)

This update of gpg fixes an segmentation fault when using the--no-armor option. This failure leads to a denial-of-service attack and may be used execute arbitrary code. CVE-2006-3746 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were...

openSUSE 10 Security Update : gpg (gpg-2353)

Specially crafted files could overflow a buffer when gpg2 was used in interactive mode CVE-2006-6169. - Specially crafted files could modify a function pointer and execute code this way CVE-2006-6235. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in...

openSUSE 10 Security Update : gpg (gpg-1664)

It is possible to crash denial of service the GNU Privacy Guard gpg by supplying a specifically crafted message specifying a very large UID, which leads to an out of memory situation or an integer overflow. It is unclear if this problem can be exploited to execute code. This issue is tracked by t...

openSUSE 10 Security Update : gpg (gpg-2388)

Specially crafted files could overflow a buffer when gpg was used in interactive mode CVE-2006-6169. - Specially crafted files could modify a function pointer and execute code this way CVE-2006-6235. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in...

SquirrelMail G/PGP加密插件多个远程命令执行漏洞

BUGTRAQ ID: 24874,24782 CVECAN ID: CVE-2005-1924,CVE-2006-4169 SquirrelMail是一个多功能的用PHP4实现的Webmail程序，可运行于Linux/Unix类操作系统下。 SquirrelMail的实现上存在多个输入验证漏洞，远程攻击者可能利用这些漏洞在服务器上执行任意命令。 SquirrelMail中的G/PGP加密插件没有正确地过滤所包含的某些文件，gpghelp.php和gpghelpbase.php文件中可能包含有通过“help” HTTP GET请求参数所提供的本地文件，代码如下： 68 // Help...

Code injection

The G/PGP GPG Plugin 2.0, and 2.1dev before 20060912, for Squirrelmail allows remote attackers to execute arbitrary commands via shell metacharacters in the messageSignedText parameter to the gpgchecksignpgpmime function in gpghookfunctions.php. NOTE: a parameter value can be set in the contents ...

CVE-2005-1924

The CVE-2005-1924 issue affects the G/PGP plugin for SquirrelMail (2.1 and earlier). It allows an authenticated remote user to execute arbitrary commands by injecting shell metacharacters in the fpr parameter to deleteKey (via gpg_keyring.php called by import_key_file.php, import_key_text.php, an...

CVE-2005-1924

The G/PGP GPG Plugin 2.1 and earlier for Squirrelmail allow remote authenticated users to execute arbitrary commands via shell metacharacters in 1 the fpr parameter to the deleteKey function in gpgkeyring.php, as called by a importkeyfile.php, b importkeytext.php, and c keyringmain.php; and 2 the...

CVE-2007-3779

The CVE-2007-3779 entry concerns a local file inclusion vulnerability in the G/PGP (GPG) Plugin for Squirrelmail, specifically in gpg_pop_init.php prior to 20070707. The flaw, related to the MOD parameter, allows remote attackers to include and execute arbitrary local files. This is the explicit ...