gnutls security update

1.4.1-3.5 - fix NUL characters in DN and SAN cert fields issue, make sure gnutlsx509crtcheckhostname fails when certificate has no CN or SAN CVE-2009-2730 516231...

Fedora 11 : neon-0.28.6-1.fc11 (2009-8815)

This update includes the latest release of neon, version 0.28.6. This fixes two security issues: the 'billion laughs' attack against expat could allow a Denial of Service attack by a malicious server. CVE-2009-2473 an embedded NUL byte in a certificate subject name could allow an undetected MITM...

curl: incorrect verification of SSL certificate with NUL in name

lib/ssluse.c in cURL and libcurl 7.4 through 7.19.5, when OpenSSL is used, does not properly handle a '\0' character in a domain name in the subject's Common Name CN field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate...

FreeBSD : fetchmail -- improper SSL certificate subject verification (5179d85c-8683-11de-91b9-0022157515b2)

Matthias Andree reports : Moxie Marlinspike demonstrated in July 2009 that some CAs would sign certificates that contain embedded NUL characters in the Common Name or subjectAltName fields of ITU-T X.509 certificates. Applications that would treat such X.509 strings as NUL-terminated C strings...

fetchmail

New fetchmail packages are available for Slackware 8.1, 9.0, 9.1, 10.0, 10.1, 10.2, 11.0, 12.0, 12.1, 12.2, and -current to a fix security issue. More details about this issue may be found in the Common Vulnerabilities and Exposures CVE database: https://vulners.com/cve/CVE-2009-2666 Here are the...

CVE-2008-4326

The PMAescapeJsString function in libraries/jsescape.lib.php in phpMyAdmin before 2.11.9.2, when Internet Explorer is used, allows remote attackers to bypass cross-site scripting XSS protection mechanisms and conduct XSS attacks via a NUL byte inside a "/script" sequence...

DEBIAN-CVE-2008-4326

The PMAescapeJsString function in libraries/jsescape.lib.php in phpMyAdmin before 2.11.9.2, when Internet Explorer is used, allows remote attackers to bypass cross-site scripting XSS protection mechanisms and conduct XSS attacks via a NUL byte inside a "/script" sequence...

CVE-2008-4326

The PMAescapeJsString function in libraries/jsescape.lib.php in phpMyAdmin before 2.11.9.2, when Internet Explorer is used, allows remote attackers to bypass cross-site scripting XSS protection mechanisms and conduct XSS attacks via a NUL byte inside a "/script" sequence...

Cross site scripting

The PMAescapeJsString function in libraries/jsescape.lib.php in phpMyAdmin before 2.11.9.2, when Internet Explorer is used, allows remote attackers to bypass cross-site scripting XSS protection mechanisms and conduct XSS attacks via a NUL byte inside a "/script" sequence...

CVE-2008-4326

The PMAescapeJsString function in libraries/jsescape.lib.php in phpMyAdmin before 2.11.9.2, when Internet Explorer is used, allows remote attackers to bypass cross-site scripting XSS protection mechanisms and conduct XSS attacks via a NUL byte inside a "/script" sequence...

CVE-2008-4326

The PMAescapeJsString function in libraries/jsescape.lib.php in phpMyAdmin before 2.11.9.2, when Internet Explorer is used, allows remote attackers to bypass cross-site scripting XSS protection mechanisms and conduct XSS attacks via a NUL byte inside a "/script" sequence...

Fedora 8 : phpMyAdmin-2.11.9.2-1.fc8 (2008-8286)

This update by upstream to phpMyAdmin 2.11.9.2 solves a not yet clearly specified XSS in MSIE using NUL byte vulnerability. - auth Links to version number on login screen - core PMA does not start if iniset is disabled - bookmarks Saved queries greater than 1000 chars not displayed - export Expor...

Fedora 9 : phpMyAdmin-2.11.9.2-1.fc9 (2008-8335)

This update by upstream to phpMyAdmin 2.11.9.2 solves a not yet clearly specified XSS in MSIE using NUL byte vulnerability. - auth Links to version number on login screen - core PMA does not start if iniset is disabled - bookmarks Saved queries greater than 1000 chars not displayed - export Expor...

Ubuntu 5.04 / 5.10 : mysql-dfsg vulnerability (USN-274-2)

USN-274-1 fixed a logging bypass in the MySQL server. Unfortunately it was determined that the original update was not sufficient to completely fix the vulnerability, thus another update is necessary. We apologize for the inconvenience. For reference, these are the details of the original USN : A...

Ubuntu 4.10 / 5.04 / 5.10 : mysql-dfsg vulnerability (USN-274-1)

A logging bypass was discovered in the MySQL query parser. A local attacker could exploit this by inserting NUL characters into query strings even into comments, which would cause the query to be logged incompletely. This only affects you if you enabled the 'log' parameter in the MySQL...

USN-274-1: MySQL vulnerability

A logging bypass was discovered in the MySQL query parser. A local attacker could exploit this by inserting NUL characters into query strings even into comments, which would cause the query to be logged incompletely. This only affects you if you enabled the 'log' parameter in the MySQL...

CVE-2006-1292

CVE-2006-1292 is a directory-traversal vulnerability in PHP iCalendar 2.21 and earlier. An attacker can cause local file inclusion and remote code execution by manipulating cookies phpicalendar[cookie_language] and phpicalendar[cookie_style] (with a NUL/%00) so that PHP sequences injected into an...

Directory traversal

Directory traversal vulnerability in install05.php in Simple PHP Blog SPB 0.4.7.1 and earlier allows remote attackers to include and execute arbitrary local files via directory traversal sequences and a NUL %00 character in the bloglanguage parameter, as demonstrated by injecting PHP sequences in...

CVE-2006-0644

Multiple directory traversal vulnerabilities in install.php in CPG-Nuke Dragonfly CMS aka CPG Dragonfly CMS 9.0.6.1 allow remote attackers to include and execute arbitrary local files via directory traversal sequences and a NUL %00 character in 1 the newlang parameter and 2 the installlang...

MSDTC denial of service by flooding with nul bytes

It was possible to crash the MSDTC service by sending 20200 nul bytes. OpenVAS Vulnerability Test $Id: msdtcdos.nasl 8023 2017-12-07 08:36:26Z teissa $ Description: MSDTC denial of service by flooding with nul bytes Authors: Michel Arboi Copyright: Copyright C 2002 Michel Arboi This program is fr...