[SECURITY] [DSA 1200-1] New Qt packages fix integer overflow

------------------------------------------------------------------------ Debian Security Advisory DSA-1200-1 [email protected] http://www.debian.org/security/ Noah Meyerhans October 30, 2006 - ------------------------------------------------------------------------ Package : qt-x11-free...

Debian DSA-974-1 : gpdf - buffer overflows

SuSE researchers discovered heap overflow errors in xpdf, the Portable Document Format PDF suite, which is also present in gpdf, the GNOME version of the Portable Document Format viewer, and which can allow attackers to cause a denial of service by crashing the application or possibly execute...

Debian DSA-1098-1 : horde3 - missing input sanitising

Michael Marek discovered that the Horde web application framework performs insufficient input sanitising, which might lead to the injection of web script code through cross-site scripting. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin...

[SECURITY] [DSA 1185-1] New openssl packages fix denial of service

-------------------------------------------------------------------------- Debian Security Advisory DSA 1185-1 [email protected] http://www.debian.org/security/ Noah Meyerhans September 28th, 2006 http://www.debian.org/security/faq -...

[ MDKSA-2006:140 ] - Updated ncompress packages fix vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDKSA-2006:140 http://www.mandriva.com/security/ Package : ncompress Date : August 9, 2006 Affected: 2006.0, Corporate 3.0 Problem Description: Tavis Ormandy, of the Google Security Team, discovered that ncompress, whe...

Slackware 10.0 / 10.1 / 10.2 / 9.0 / 9.1 / current : gnupg (SSA:2006-215-01)

New GnuPG packages are available for Slackware 9.0, 9.1, 10.0, 10.1, 10.2, and -current to fix security issues which could allow an attacker to crash gnupg and possibly overwrite memory which could lead to an integer overflow. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive...

Low: Red Hat Bug Fix Advisory: conga bug fix update

Updated conga packages that provide critical bug fixes are now available. The Conga package is a web-based administration tool for remote cluster and storage management. This erratum applies the following bug fixes: - The borrowed Zope packages used by Conga have been patched to eliminate a...

CentOS 3 / 4 : SquirrelMail (CESA-2005:595)

An updated squirrelmail package that fixes two security issues is now available. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Updated 04 Aug 2005 The previous SquirrelMail package released with this errata contained a bug which rendered the...

CentOS 3 / 4 : cpio (CESA-2005:378)

An updated cpio package that fixes multiple issues is now available. This update has been rated as having low security impact by the Red Hat Security Response Team. GNU cpio copies files into or out of a cpio or tar archive. A race condition bug was found in cpio. It is possible for a local...

CentOS 3 / 4 : sudo (CESA-2005:535)

An updated sudo package is available that fixes a race condition in sudo's pathname validation. This update has been rated as having moderate security impact by the Red Hat Security Response Team. The sudo superuser do utility allows system administrators to give certain users the ability to run...

CentOS 3 / 4 : mozilla (CESA-2006:0329)

Updated mozilla packages that fix several security bugs are now available. This update has been rated as having critical security impact by the Red Hat Security Response Team. Updated 24 Apr 2006 The erratum text has been updated to include the details of additional issues that were fixed by thes...

FreeBSD : bind -- buffer overrun vulnerability (947f4b14-1c89-11da-bc01-000e0c2e438a)

An ISC advisory reports a buffer overrun vulnerability within bind. The vulnerability could result in a Denial of Service. A workaround is available by disabling recursion and glue fetching. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugi...

FreeBSD : unzip -- permission race vulnerability (9750cf22-216d-11da-bc01-000e0c2e438a)

Imran Ghory reports a vulnerability within unzip. The vulnerability is caused by a race condition between extracting an archive and changing the permissions of the extracted files. This would give an attacker enough time to remove a file and hardlink it to another file owned by the user running...

DSA-1011-1 kernel-patch-server, util-vserver - missing attribute support

Bulletin has no description...

Mandrake Linux Security Advisory : kdegraphics (MDKSA-2006:054)

Marcelo Ricardo Leitner discovered the official published kpdf patches for several previous xpdf vulnerabilities were lacking some hunks published by upstream xpdf. As a result, kpdf is still vulnerable to certain carefully crafted pdf files. Although previous updates captured most of these...

Moderate: Red Hat Security Advisory: RHAPS security and enhancement update

Red Hat Application Server Release 2 Update 1 is now available. This update contains an upgrade of several RHAPS components to newer releases, including JOnAS 4.6.3, Tomcat 5.5.12 and Struts 1.2.8. This update has been rated as having moderate security impact by the Red Hat Security Response Team...

Mandrake Linux Security Advisory : php (MDKSA-2006:028)

Multiple response splitting vulnerabilities in PHP allow remote attackers to inject arbitrary HTTP headers via unknown attack vectors, possibly involving a crafted Set-Cookie header, related to the 1 session extension aka ext/session and the 2 header function. CVE-2006-0207 Multiple cross-site...

Ubuntu 4.10 / 5.04 / 5.10 : courier vulnerability (USN-226-1)

Patrick Cheong Shu Yang discovered a flaw in the user account handling of courier-authdaemon. After successful authorization, the Courier mail server granted access to deactivated accounts. Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu...

Mandrake Linux Security Advisory : webmin (MDKSA-2005:223)

Jack Louis discovered a format string vulnerability in miniserv.pl Perl web server in Webmin before 1.250 and Usermin before 1.180, with syslog logging enabled. This can allow remote attackers to cause a denial of service crash or memory consumption and possibly execute arbitrary code via format...

[Full-disclosure] [SECURITY] [DSA 930-1] New smstools packages fix format string vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -------------------------------------------------------------------------- Debian Security Advisory DSA 930-1 [email protected] http://www.debian.org/security/ Steve Kemp Jan 9, 2006 http://www.debian.org/security/faq -...