[SECURITY] [DSA 1537-1] New xpdf packages fix multiple vulnerabilities

------------------------------------------------------------------------ Debian Security Advisory DSA-1537-1 [email protected] http://www.debian.org/security/ Devin Carraway April 02, 2008 http://www.debian.org/security/faq -...

UltraVNC buffer overflow vulnerability

Overview UltraVNC viewer contains a buffer overflow vulnerability. If exploited, this vulnerability may allow an attacker to execute arbitrary code. Description UltraVNC viewer is a remote desktop application that allows a user to control compatible VNC servers. The UltraVNC viewer includes a...

DEBIAN-CVE-2008-1070

The SCTP dissector in Wireshark formerly Ethereal 0.99.5 through 0.99.7 allows remote attackers to cause a denial of service crash via a malformed packet...

GLSA-200801-17 : Netkit FTP Server: Denial of Service

The remote host is affected by the vulnerability described in GLSA-200801-17 Netkit FTP Server: Denial of Service Venustech AD-LAB discovered that an FTP client connected to a vulnerable server with passive mode and SSL support can trigger an fclose function call on an uninitialized stream in...

CVE-2007-6340

Geert Moernaut LSrunasE 1.0 and Supercrypt 1.0 use the RC4 stream cipher without constructing a unique initialization vector IV, which makes it easier for local users to obtain cleartext passwords...

CVE-2007-6340

The connected advisory confirms CVE-2007-6340 affects LSrunasE 1.0 and Supercrypt 1.0 and explains the root cause: RC4 is used without a unique initialization vector, deriving a constant keystream across all passwords. This insecure design allows an attacker with local access to break encryption ...

CVE-2007-6340

Geert Moernaut LSrunasE 1.0 and Supercrypt 1.0 use the RC4 stream cipher without constructing a unique initialization vector IV, which makes it easier for local users to obtain cleartext passwords...

Insecure Use of RC4 in LSrunasE and Supercrypt (CVE-2007-6340)

COMPASS SECURITY ADVISORY http://www.csnc.ch/ Product: LSrunasE, Supercrypt Vendor: Geert Moernaut Type: Flawed Encryption Risk: Medium Author: Daniel Roethlisberger Date: 2008-01-29 CVE Name: CVE-2007-6340 Introduction ------------ LSrunasE 1 and Supercrypt 2 are utilities used to run commands...

Stack overflow

Multiple stack-based buffer overflows in inmp3.dll in Winamp 5.21, 5.5, and 5.51 allow remote attackers to execute arbitrary code via a long 1 artist or 2 name tag in Ultravox streaming metadata, related to construction of stream titles...

[SECURITY] [DSA 1472-1] New xine-lib packages fix arbitrary code execution

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------ Debian Security Advisory DSA-1472-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff January 21, 2008 http://www.debian.org/security/faq -...

Debian Security Advisory DSA 657-1 (xine-lib)

The remote host is missing an update to xine-lib announced via advisory DSA 657-1. SPDX-FileCopyrightText: 2008 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SuSE 10 Security Update : PHP (ZYPP Patch Number 2236)

This update fixes the following security problems in the PHP scripting language : - Various buffer overflows in htmlentities/htmlspecialchars internal routines could be used to crash the PHP interpreter or potentially execute code, depending on the PHP application used. CVE-2006-5465 - A missing...

CVE-2007-6263

The dataconn function in ftpd.c in netkit ftpd netkit-ftpd 0.17, when certain modifications to support SSL have been introduced, calls fclose on an uninitialized file stream, which allows remote attackers to cause a denial of service daemon crash and possibly have unspecified other impact via som...

DEBIAN-CVE-2007-6263

The dataconn function in ftpd.c in netkit ftpd netkit-ftpd 0.17, when certain modifications to support SSL have been introduced, calls fclose on an uninitialized file stream, which allows remote attackers to cause a denial of service daemon crash and possibly have unspecified other impact via som...

CVE-2007-6190

The HTTP daemon in the Cisco Unified IP Phone, when the Extension Mobility feature is enabled, allows remote authenticated users of other phones associated with the same CUCM server to eavesdrop on the physical environment via a CiscoIPPhoneExecute message containing a URL attribute of an...

Design/Logic Flaw

The HTTP daemon in the Cisco Unified IP Phone, when the Extension Mobility feature is enabled, allows remote authenticated users of other phones associated with the same CUCM server to eavesdrop on the physical environment via a CiscoIPPhoneExecute message containing a URL attribute of an...

CVE-2007-6190

The CVE affects Cisco Unified IP Phone devices with Extension Mobility enabled. The HTTP daemon can be abused by remote authenticated users on other phones within the same CUCM domain to eavesdrop on the physical environment by triggering a CiscoIPPhoneExecute message that points to an RTP audio ...

CVE-2007-6190

The HTTP daemon in the Cisco Unified IP Phone, when the Extension Mobility feature is enabled, allows remote authenticated users of other phones associated with the same CUCM server to eavesdrop on the physical environment via a CiscoIPPhoneExecute message containing a URL attribute of an...

Design/Logic Flaw

PHP 5.2.5 and earlier allows context-dependent attackers to cause a denial of service application crash via a long string in 1 the domain parameter to the dgettext function, the message parameter to the 2 dcgettext or 3 gettext function, the msgid1 parameter to the 4 dngettext or 5 ngettext...

Alcatel OmniPCX Enterprise VoIP Vulnerability

COMPASS SECURITY ADVISORY http://www.csnc.ch/ Product: OmniPCX Enterprise Vendor: Alcatel Subject: VoIP Phone Audio Stream Rerouting Vulnerability Risk High Effect Currently exploitable Author: Daniel Stirnimann daniel.stirnimann at csnc dot ch Date: November, 19th 2007 Introduction: ------------...