ruby -- Unintentional file creation caused by inserting an illegal NUL character

The official ruby site reports: A vulnerability was found that file creation routines can create unintended files by strategically inserting NULs in file paths. This vulnerability has been reported as CVE-2012-4522. Ruby can handle arbitrary binary patterns as Strings, including NUL chars. On the...

Slackware: Security Advisory (SSA:2009-218-01)

The remote host is missing an update for the SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CentOS Update for icedtea-web CESA-2012:1132 centos6

The remote host is missing an update for the SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptxrefname:"URL",...

RedHat Update for icedtea-web RHSA-2012:1132-01

Check for the Version of icedtea-web OpenVAS Vulnerability Test RedHat Update for icedtea-web RHSA-2012:1132-01 Authors: System Generated Check Copyright: Copyright c 2012 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it und...

phpDocumentor: Function call injection

Background The phpDocumentor package provides automatic documenting of PHP API directly from the source. Description phpDocumentor bundles Smarty with the modifier.regexreplace.php plug-in which does not properly sanitize input related to the ASCII NUL character in a search string. Impact A remot...

Mandriva Update for kdelibs4 MDVSA-2011:162 (kdelibs4)

The remote host is missing an update for the SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptxrefname:"URL",...

dovecot security update

1:2.0.9-2.1 - fix potential crash when parsing header names that contain NUL characters 728672...

Debian Security Advisory DSA 2252-1 (dovecot)

The remote host is missing an update to dovecot announced via advisory DSA 2252-1. OpenVAS Vulnerability Test $Id: deb22521.nasl 6613 2017-07-07 12:08:40Z cfischer $ Description: Auto-generated from advisory DSA 2252-1 dovecot Authors: Thomas Reinke Copyright: Copyright c 2011 E-Soft Inc...

Mandriva Update for dovecot MDVSA-2011:101 (dovecot)

Check for the Version of dovecot OpenVAS Vulnerability Test Mandriva Update for dovecot MDVSA-2011:101 dovecot Authors: System Generated Check Copyright: Copyright c 2011 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it unde...

dovecot -- denial of service vulnerability

Timo Sirainen reports: Fixed potential crashes and other problems when parsing header names that contained NUL characters...

SuSE 10 Security Update : w3m (ZYPP Patch Number 7076)

w3m does not handle embedded NUL characters in the common name and in subject alternative names of X.509 certificates CVE-2010-2074. This update fixes the issue and also turns on verification of x509 certificates by default which was not the case before. %NASLMINLEVEL 70300 C Tenable Network...

RHEL 4 : openldap (RHSA-2010:0543)

Updated openldap packages that fix two security issues are now available for Red Hat Enterprise Linux 4. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity ratings, are...

Moderate: Red Hat Security Advisory: openldap security update

Updated openldap packages that fix two security issues are now available for Red Hat Enterprise Linux 4. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity ratings, are...

RedHat Update for openldap RHSA-2010:0198-04

Check for the Version of openldap OpenVAS Vulnerability Test RedHat Update for openldap RHSA-2010:0198-04 Authors: System Generated Check Copyright: Copyright c 2010 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the...

RedHat Update for openldap RHSA-2010:0198-04

Check for the Version of openldap OpenVAS Vulnerability Test RedHat Update for openldap RHSA-2010:0198-04 Authors: System Generated Check Copyright: Copyright c 2010 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the...

Debian DSA-1896-1 : opensaml, shibboleth-sp - several vulnerabilities

Several vulnerabilities have been discovered in the opensaml and shibboleth-sp packages, as used by Shibboleth 1.x : - Chris Ries discovered that decoding a crafted URL leads to a crash and potentially, arbitrary code execution. - Ian Young discovered that embedded NUL characters in certificate...

Debian DSA-1895-1 : xmltooling - several vulnerabilities

Several vulnerabilities have been discovered in the xmltooling packages, as used by Shibboleth : - Chris Ries discovered that decoding a crafted URL leads to a crash and potentially, arbitrary code execution. - Ian Young discovered that embedded NUL characters in certificate names were not...

Sendmail Update Patches Memory Leak Flaws

Version 8.14.4 of Sendmail, the open source mail transfer agent MTA, includes fixes for several security vulnerabilities including some integer overflows, memory leaks and for the SSL NUL character problem disclosed in mid 2009. Read the full article. The H Security...

Mandriva Linux Security Advisory : libneon (MDVSA-2009:315)

A vulnerability has been found and corrected in libneo : neon before 0.28.6, when OpenSSL is used, does not properly handle a '' NUL character in a domain name in the subject's Common Name CN field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers vi...

wget: incorrect verification of SSL certificate with NUL in name

GNU Wget before 1.12 does not properly handle a '\0' character in a domain name in the Common Name field of an X.509 certificate, which allows man-in-the-middle remote attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issu...