Sun JavaDoc工具跨站脚本漏洞

BUGTRAQ ID: 24690 CVECAN ID: CVE-2007-3503 Solaris系统的Java运行时环境（JRE）为JAVA应用程序提供可靠的运行环境。 Javadoc工具处理用户请求数据时存在跨站脚本执行漏洞，远程攻击者可能利用此漏洞在用户浏览器中执行恶意代码。 Javadoc工具可以生成包含有跨站脚本（XSS）漏洞的HTML文档页面，远程攻击者可以利用这个漏洞注入任意Web脚本或HTML。如果用户受骗访问了该页面的话，就可能从承载所生成文档的站点访问cookies。 Sun JDK = 5.0 Update 11 Sun JDK 6 BEA Systems...

Apache HTTP Server Worker进程多个本地拒绝服务漏洞

BUGTRAQ ID: 24215 CVECAN ID: CVE-2007-3304 Apache HTTP Server是一款流行的Web服务器。 Apache HTTP Server Worker进程实现上存在多个漏洞，本地攻击者可能利用这些漏洞导致服务不可用。 在发送信号之前Apache HTTP Server没有验证进程为Apache子进程。能够在Apache HTTP Server上运行脚本的本地攻击者可以控制记分板并终止任意进程，导致拒绝服务。 如果Apache httpd安装了Prefork...

GNU Tar contains_dot_dot函数远程目录遍历漏洞

BUGTRAQ ID: 25417 CVECAN ID: CVE-2007-4131 GNU tar可创建和解压tar文档，并进行各种存档文件管理。 GNU tar在处理符号链接时存在漏洞，本地攻击者可能利用此漏洞提升权限或破坏文件。 GNU tar的containsdotdot函数没有正确地检查目录符号链接的名称，恶意用户所创建tar文档可以写入运行GNU tar的用户可写访问的任意文件。 GNU tar = 1.15.91 RedHat已经为此发布了一个安全公告（RHSA-2007:0860-01）以及相应补丁: RHSA-2007:0860-01：Moderate: tar...

Security fix for the ALT Linux 5 package netpbm version 10.35.30-alt1

Aug. 20, 2007 Alexey Tourbin 10.35.30-alt1 - 10.33 - 10.35.30 from netpbm.svn.sourceforge.net repo + fixes buffer overflow in pamtofits CVE-2006-3145 - sync RedHat patches Jindrich Novy, 10.35-14 + pamscale won't waste all system resources by usage of uninitialized variables for output image...

RHEL 4 : libgtop2 (RHSA-2007:0765)

The remote Redhat Enterprise Linux 4 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2007:0765 advisory. - Stack overflow libgtop when pathname of mmap-ed file is too long CVE-2007-0235 Note that Nessus has not tested for this issue but has instead relie...

RHEL 4 / 5 : tetex (RHSA-2007:0731)

The remote Redhat Enterprise Linux 4 / 5 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2007:0731 advisory. - xpdf integer overflow CVE-2007-3387 Note that Nessus has not tested for this issue but has instead relied only on the application's self-report...

USN-489-2: redhat-cluster-suite vulnerability

USN-489-1 fixed vulnerabilities in the Linux kernel. This update provides the corresponding fixes for the redhat cluster suite kernel sources. Original advisory details: A flaw was discovered in the cluster manager. A remote attacker could connect to the DLM port and block further DLM operations...

Linux PowerPC Kernel Restore_Sigcontext本地拒绝服务漏洞

BUGTRAQ ID: 24845 CVE ID:CVE-2007-3107 CNCVE ID:CNCVE-20073107 Linux PowerPC是一款嵌入式Linux操作系统。 Linux PowerPC存在一个信号处理缺陷，本地攻击者可以利用漏洞对系统进行拒绝服务攻击。...

possible buffer overflow could cause local DoS by crashing cman

Buffer overflow in cluster/cman/daemon/daemon.c in cman redhat-cluster-suite before 20070622 allows local users to cause a denial of service crash and possibly execute arbitrary code via long client messages...

Apache HTTP Server Mod_Cache拒绝服务漏洞

Apache HTTP Server是一款开放源代码的WEB服务程序。 Apache HTTP Server包含的Modcache存在设计错误，远程攻击者可以利用漏洞对应用程序进行拒绝服务攻击。 如果Cache-Control头字段数据s-maxage, max-age, min-fresh, max-stale其中一个值不赋值，那么Modcache模块在解析的时候可导致应用程序崩溃，造成拒绝服务攻击。 RedHat Enterprise Linux Desktop Workstation v. 5 client RedHat Enterprise Linux Desktop v.5...

Buffer overflow

Buffer overflow in cluster/cman/daemon/daemon.c in cman redhat-cluster-suite before 20070622 allows local users to cause a denial of service crash and possibly execute arbitrary code via long client messages...

CVE-2007-3374

CVE-2007-3374 concerns a buffer overflow in the cman daemon (cluster/cman/daemon/daemon.c) of the Red Hat Cluster Suite (cman). The flaw allows a local attacker to crash the service and, potentially, execute arbitrary code via lengthy client messages. Public records from RHSA-2007:0559 and relate...

CVE-2007-3374

Buffer overflow in cluster/cman/daemon/daemon.c in cman redhat-cluster-suite before 20070622 allows local users to cause a denial of service crash and possibly execute arbitrary code via long client messages...

CVE-2007-3373

daemon.c in cman redhat-cluster-suite before 20070622 does not clear a buffer for reading requests, which might allow local users to obtain sensitive information from previous requests...

CVE-2007-3373

CVE-2007-3373 affects daemon.c in cman (redhat-cluster-suite) prior to 20070622, where a buffer is not cleared when reading requests. This may allow local users to obtain sensitive information from previous requests. The NVD entry lists a Medium base score (5.0) with Network attack vector and Low...

Redhat Linux cluster service multiple security vulnerabilities

Uninitialized memory, buffer oveflows...

[email protected], [email protected]

=========================================================== Ubuntu Security Notice USN-476-1 June 22, 2007 redhat-cluster-suite vulnerability https://launchpad.net/bugs/121780 =========================================================== A security issue affects the following Ubuntu releases: Ubunt...

USN-476-1: redhat-cluster-suite vulnerability

Fabio Massimo Di Nitto discovered that cman did not correctly validate the size of client messages. A local user could send a specially crafted message and execute arbitrary code with cluster manager privileges or crash the manager, leading to a denial of service...

mod_perl security update

CentOS Errata and Security Advisory CESA-2007:0395 Updated modperl packages that fix a security issue are now available for Red Hat Enterprise Linux 3, 4, 5. This update has been rated as having low security impact by the Red Hat Security Response Team. Modperl incorporates a Perl interpreter int...

Quagga BGPD UPDATE消息远程拒绝服务漏洞

Quagga是一款基于TCP/IP路由软件套件。 Quagga's bgpd存在一个越界内存读取问题，远程攻击者可以利用漏洞对应用程序进行拒绝服务攻击。 攻击者发送一个特殊构建的，畸形的多协议可到达/不可到达NLRI属性的UPDATE消息，可触发Quagga's bgpd发生assert而放弃，导致拒绝服务攻击。 Ubuntu Ubuntu Linux 7.04 sparc Ubuntu Ubuntu Linux 7.04 powerpc Ubuntu Ubuntu Linux 7.04 i386 Ubuntu Ubuntu Linux 7.04 amd64 Ubuntu Ubuntu...