[SECURITY] [DSA 1392-1] New xulrunner packages fix several vulnerabilities

-------------------------------------------------------------------------- Debian Security Advisory DSA 1392-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff October 20th, 2007 http://www.debian.org/security/faq -...

DSA-1392-1 xulrunner - several vulnerabilities

Bulletin has no description...

Velocity does not automatically escape HTML entities when substituting variables

Velocity should automatically escape encode HTML entities in variables it interpolates in markup. This would remove the need for explicitly escaping variables using $generalUtil.htmlEncode, and fix lots of XSS bugs including ones we haven't discovered yet. This affects all versions of Confluence...

MS07-050: Vulnerability in Vector Markup Language Could Allow Remote Code Execution (938127)

The remote host is running a version of Internet Explorer or Outlook Express with a bug in the Vector Markup Language VML handling routine that may allow an attacker execute arbitrary code on the remote host by sending a specially crafted email or by luring a user on the remote host into visiting...

DEBIAN-CVE-2007-1253

Eval injection vulnerability in the a kmzImportWithMesh.py Script for Blender 0.1.9h, as used in b Blender before 2.43, allows user-assisted remote attackers to execute arbitrary Python code by importing a crafted 1 KML or 2 KMZ file...

security flaw

Apache SpamAssassin before 3.1.8 allows remote attackers to cause a denial of service via long URLs in malformed HTML, which triggers "massive memory usage."...

security flaw

Double free vulnerability in the Adobe Acrobat Reader Plugin before 8.0.0, as used in Mozilla Firefox 1.5.0.7, allows remote attackers to execute arbitrary code by causing an error via a javascript: URI call to document.write in the 1 FDF, 2 XML, or 3 XFDF AJAX request parameters...

CVE-2007-0024

Integer overflow in the Vector Markup Language VML implementation vgx.dll in Microsoft Internet Explorer 5.01, 6, and 7 on Windows 2000 SP4, XP SP2, Server 2003, and Server 2003 SP1 allows remote attackers to execute arbitrary code via a crafted web page that contains unspecified integer properti...

MS07-004: Vulnerability in Vector Markup Language Could Allow Remote Code Execution (929969)

The remote host is running a version of Internet Explorer or Outlook Express that is vulnerable to a bug in the Vector Markup Language VML handling routine that could allow an attacker execute arbitrary code on the remote host by sending a specially crafted email or by luring a user on the remote...

Microsoft VML buffer overflow

Buffer overflow and integer overflows on Vector Markup Language parsing. May be used for hidden malware installation...

Internet Explorer VML Buffer Overrun (MS07-004; CVE-2007-0024)

Microsoft Internet Explorer IE contains a remote code execution vulnerability. The vulnerability exists in Microsoft Vector Markup Language VML. VML is a set of XML tags used for exchange, editing, and delivery of vector graphics on the web. By convincing a user to visit a specially crafted Web...

VulnCheck KEV: CVE-2007-0024

Integer overflow in the Vector Markup Language VML implementation vgx.dll in Microsoft Internet Explorer 5.01, 6, and 7 on Windows 2000 SP4, XP SP2, Server 2003, and Server 2003 SP1 allows remote attackers to execute arbitrary code via a crafted web page that contains unspecified integer...

CVE-2006-6249

Cross-site scripting XSS vulnerability in Chama Cargo 4.36 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Internet Explorer VML Rect Fill Method Buffer Overflow (MS06-055; CVE-2006-4868)

Microsoft Internet Explorer is the most widely used Internet browser. Microsoft Internet Explorer fails to handle Vector Markup Language VML tags. VML is a set of XML tags for drawing vector graphics. A remote attacker may trigger this vulnerability to execute arbitrary code on the target system...

Debian DSA-1176-1 : zope2.7 - programming error

It was discovered that the Zope web application server does not disable the csvtable directive in web pages containing ReST markup, allowing the exposure of files readable by the Zope server. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plug...

MS06-055: Vulnerability in Vector Markup Language Could Allow Remote Code Execution (925486)

The remote host is running a version of Internet Explorer or Outlook Express that is vulnerable to a bug in the Vector Markup Language VML handling routine that could allow an attacker execute arbitrary code on the remote host by sending a specially crafted email or by luring a user on the remote...

CVE-2006-4868

Stack-based buffer overflow in the Vector Graphics Rendering engine vgx.dll, as used in Microsoft Outlook and Internet Explorer 6.0 on Windows XP SP2, and possibly other versions, allows remote attackers to execute arbitrary code via a Vector Markup Language VML file with a long fill parameter...

CVE-2006-4684

The docutils module in Zope Zope2 2.7.0 through 2.7.9 and 2.8.0 through 2.8.8 does not properly handle web pages with reStructuredText reST markup, which allows remote attackers to read arbitrary files via a csvtable directive, a different vulnerability than CVE-2006-3458...

CVE-2006-4684

The docutils module in Zope Zope2 2.7.0 through 2.7.9 and 2.8.0 through 2.8.8 does not properly handle web pages with reStructuredText reST markup, which allows remote attackers to read arbitrary files via a csvtable directive, a different vulnerability than CVE-2006-3458...

PYSEC-2006-8

The docutils module in Zope Zope2 2.7.0 through 2.7.9 and 2.8.0 through 2.8.8 does not properly handle web pages with reStructuredText reST markup, which allows remote attackers to read arbitrary files via a csvtable directive, a different vulnerability than CVE-2006-3458...