[SECURITY] [DSA 574-1] New cabextract packages fix unintended directory traversal

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -------------------------------------------------------------------------- Debian Security Advisory DSA 574-1 [email protected] http://www.debian.org/security/ Martin Schulze October 28th, 2004 http://www.debian.org/security/faq -...

MDKSA-2004:111 - Updated wxGTK2 packages fix vulnerabilities

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandrakelinux Security Update Advisory Package name: wxGTK2 Advisory ID: MDKSA-2004:111 Date: October 21st, 2004 Affected versions: 10.0 Problem Description: Several vulnerabilities have been discovered in the libtiff package; wxGTK2 uses a libtiff co...

[SECURITY] [DSA 572-1] New ecartis packages fix unauthorised access to admin interface

-------------------------------------------------------------------------- Debian Security Advisory DSA 572-1 [email protected] http://www.debian.org/security/ Martin Schulze October 21st, 2004 http://www.debian.org/security/faq -...

RHEL 3 : mysql (RHSA-2004:569)

Updated mysql packages that fix various temporary file security issues, as well as a number of bugs, are now available. MySQL is a multi-user, multi-threaded SQL database server. This update fixes a number of small bugs, including some potential security problems associated with careless handling...

RHEL 2.1 / 3 : squid (RHSA-2004:591)

An updated squid package that fixes a remote denial of service vulnerability is now available. Squid is a full-featured Web proxy cache. iDEFENSE reported a flaw in the squid SNMP module. This flaw could allow an attacker who has the ability to send arbitrary packets to the SNMP port to restart t...

[SECURITY] [DSA 571-1] New libpng3 packages fix several vulnerabilities

-------------------------------------------------------------------------- Debian Security Advisory DSA 571-1 [email protected] http://www.debian.org/security/ Martin Schulze October 20th, 2004 http://www.debian.org/security/faq -...

[SECURITY] [DSA 566-1] New CUPS packages fix information leak

-------------------------------------------------------------------------- Debian Security Advisory DSA 566-1 [email protected] http://www.debian.org/security/ Martin Schulze October 14th, 2004 http://www.debian.org/security/faq -...

[Full-Disclosure] [FLSA-2004:1372] Updated sysstat packages fix security vulnerabilities

------------------------------------------------------------------------ Fedora Legacy Update Advisory Synopsis: Updated sysstat packages fix security vulnerabilities Advisory ID: FLSA:1372 Issue date: 2004-10-03 Product: Red Hat Linux Keywords: Bugfix Cross references:...

Debian DSA-508-1 : xpcd - buffer overflow

Jaguar discovered a vulnerability in one component of xpcd, a PhotoCD viewer. xpcd-svga, part of xpcd which uses svgalib to display graphics on the console, would copy user-supplied data of arbitrary length into a fixed-size buffer in the pcdopen function. %NASLMINLEVEL 70300 C Tenable Network...

Debian DSA-157-1 : irssi-text - denial of service

The IRC client irssi is vulnerable to a denial of service condition. The problem occurs when a user attempts to join a channel that has an overly long topic description. When a certain string is appended to the topic, irssi will crash. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

Debian DSA-345-1 : xbl - buffer overflow

Another buffer overflow was discovered in xbl, distinct from the one addressed in DSA-327 CAN-2003-0451, involving the-display command line option. This vulnerability could be exploited by a local attacker to gain gid 'games'. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive...

Debian DSA-322-1 : typespeed - buffer overflow

typespeed is a game which challenges the player to type words correctly and quickly. It contains a network play mode which allows players on different systems to play competitively. The network code contains a buffer overflow which could allow a remote attacker to execute arbitrary code under the...

Debian DSA-512-1 : gallery - unauthenticated access

A vulnerability was discovered in gallery, a web-based photo album written in php, whereby a remote attacker could gain access to the gallery 'admin' user without proper authentication. No CVE candidate was available for this vulnerability at the time of release. %NASLMINLEVEL 70300 C Tenable...

Debian DSA-251-1 : w3m - missing HTML quoting

Hironori Sakamoto, one of the w3m developers, found two security vulnerabilities in w3m and associated programs. The w3m browser does not properly escape HTML tags in frame contents and img alt attributes. A malicious HTML frame or img alt attribute may deceive a user to send their local cookies...

Debian DSA-521-1 : sup - format string vulnerability

discovered a format string vulnerability in sup, a set of programs to synchronize collections of files across a number of machines, whereby a remote attacker could potentially cause arbitrary code to be executed with the privileges of the supfilesrv process this process does not run automatically...

Debian DSA-255-1 : tcpdump - infinite loop

Andrew Griffiths and iDEFENSE Labs discovered a problem in tcpdump, a powerful tool for network monitoring and data acquisition. An attacker is able to send a specially crafted network packet which causes tcpdump to enter an infinite loop. In addition to the above problem the tcpdump developers...

Debian DSA-437-1 : cgiemail - open mail relay

A vulnerability was discovered in cgiemail, a CGI program used to email the contents of an HTML form, whereby it could be used to send email to arbitrary addresses. This type of vulnerability is commonly exploited to send unsolicited commercial email spam. %NASLMINLEVEL 70300 C Tenable Network...

Debian DSA-247-1 : courier-ssl - missing input sanitizing

The developers of courier, an integrated user side mail server, discovered a problem in the PostgreSQL auth module. Not all potentially malicious characters were sanitized before the username was passed to the PostgreSQL engine. An attacker could inject arbitrary SQL commands and queries exploiti...

Debian DSA-347-1 : teapop - SQL injection

teapop, a POP-3 server, includes modules for authenticating users against a PostgreSQL or MySQL database. These modules do not properly escape user-supplied strings before using them in SQL queries. This vulnerability could be exploited to execute arbitrary SQL code under the privileges of the...

Debian DSA-528-1 : ethereal - denial of service

Several denial of service vulnerabilities were discovered in ethereal, a network traffic analyzer. These vulnerabilities are described in the ethereal advisory 'enpa-sa-00015'. Of these, only one CAN-2004-0635 affects the version of ethereal in Debian woody. This vulnerability could be exploited ...