Ubuntu 6.06 LTS / 8.04 LTS / 9.10 / 10.04 LTS / 10.10 : tiff vulnerability (USN-1102-1)

Martin Barbella discovered that the thunder aka ThunderScan decoder in the TIFF library incorrectly handled an unexpected BitsPerSample value. If a user or automated system were tricked into opening a specially crafted TIFF image, a remote attacker could execute arbitrary code with user privilege...

ZDI-11-115: IBM solidDB solid.exe Authentication Bypass Remote Code Execution Vulnerability

ZDI-11-115: IBM solidDB solid.exe Authentication Bypass Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-11-115 April 1, 2011 -- CVSS: 9.3, AV:N/AC:M/Au:N/C:C/I:C/A:C -- Affected Vendors: IBM -- Affected Products: IBM solidDB -- TippingPointTM IPS Customer...

Fedora 14 : php-doctrine-Doctrine-1.2.4-1.fc14 (2011-4098)

upstream 1.2.4 security update, see: http://www.doctrine-project.org/blog/doctrine-security-fix Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possib...

Ubuntu 8.04 LTS / 9.10 / 10.04 LTS / 10.10 : qt4-x11 vulnerabilities (USN-1101-1)

It was discovered that several invalid HTTPS certificates were issued and revoked. An attacker could exploit these to perform a man in the middle attack to view sensitive information or alter encrypted communications. These were placed on the certificate blacklist to prevent their misuse. Note th...

Fedora 14 : pure-ftpd-1.0.30-1.fc14 (2011-3349)

Wietse Venema and Victor Duchovni discovered and reported an issue that could lead to a potential information disclosure. An unencrypted FTP command immediately following STARTTLS request would get buffered and processed prior to SSL/TLS handshake, resulting in potential authentication bypass in...

Ubuntu 8.04 LTS / 9.10 / 10.04 LTS / 10.10 : openldap, openldap2.3 vulnerabilities (USN-1100-1)

It was discovered that OpenLDAP did not properly check forwarded authentication failures when using a slave server and chain overlay. If OpenLDAP were configured in this manner, an attacker could bypass authentication checks by sending an invalid password to a slave server. CVE-2011-1024 It was...

Ubuntu 9.10 / 10.04 LTS / 10.10 : gdm vulnerability (USN-1099-1)

Sebastian Krahmer discovered that GDM GNOME Display Manager did not properly drop privileges when handling the cache directories used to store users' dmrc and face icon files. This could allow a local attacker to change the ownership of arbitrary files, thereby gaining root privileges. Note that...

Fedora 13 : wordpress-3.1-1.fc13 (2011-3738)

In order to protect against two CVEs, I'm upgrading Wordpress in all releases to 3.1. In addition, this will obsolete wordpress-mu, since this functionality has been migrated to the main wordpress release as of wordpress 3.0, and wordpress-mu has been deprecated upstream. I would not normally mak...

Fedora 15 : roundcubemail-0.5.1-1.fc15 (2011-4038)

Roundcube Webmail upstream has released v0.5.1 version: 1 http://trac.roundcube.net/wiki/Changelog which adds one security hardening: 1, Security: add optional referer check to prevent CSRF in GET requests Relevant patches: 2 http://trac.roundcube.net/changeset/4503 3...

Fedora 15 : php-doctrine-Doctrine-1.2.4-1.fc15 (2011-4056)

upstream 1.2.4 security update, see: http://www.doctrine-project.org/blog/doctrine-security-fix Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possib...

Fedora 15 : asterisk-1.8.3.2-1.fc15 (2011-3958)

The Asterisk Development Team has announced security releases for Asterisk branches 1.6.1, 1.6.2, and 1.8. The available security releases are released as versions 1.6.1.24, 1.6.2.17.2, and 1.8.3.2. These releases are available for immediate download at...

Fedora 14 : gnash-0.8.9-1.fc14 (2011-3658)

---------------------------------------------------------------------- ---------- ChangeLog : - Fri Mar 18 2011 Hicham HAOUARI - 1:0.8.9-1 - Update to 0.8.9 final - Sat Mar 12 2011 Hicham HAOUARI - 1:0.8.9-0.1.20110312git - Switch to 0.8.9 branch - Spec cleanup - Add extensions - Enable testsuite...

Fedora 15 : subversion-1.6.16-1.fc15 (2011-3775)

A NULL pointer dereference flaw was found in the way the moddavsvn module processed certain requests to lock working copy paths in a repository. A remote attacker could issue a lock request that could cause the httpd process serving the request to crash. CVE-2011-0715 The Fedora Project would lik...

Solaris 10 (sparc) : 146857-01

SunOS 5.10: ssl patch for wanboot. Date this patch was last updated by Sun : Mar/23/11 %NASLMINLEVEL 70300 @DEPRECATED@ This script has been deprecated as the associated patch is not currently a recommended security fix. Disabled on 2011/09/17. C Tenable Network Security, Inc. if !...

AIX 610003 : U838079

The remote host is missing AIX PTF U838079 which is related to the security of the package bos.sysmgt.nim.client You should install this PTF for your system to be up-to-date. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. if ! definedfunc"bnrandom" exit0; include'deprecatednasllevel.inc';...

Fedora 15 : php-pear-1.9.2-1.fc15 (2011-2367)

Upstream Changelog : Important! This is a security fix release. The advisory can be found at http://pear.php.net/advisory-20110228.txt Bugs : - Fixed Bug 17463: Regression: On Windows, svntag patch by doconnor - Fixed Bug 17641: pecl-list doesn't sort packages by name dufuz - Fixed Bug 17781:...

Fedora 14 : samba-3.5.8-74.fc14 (2011-3118)

Tue Mar 8 2011 Guenther Deschner - 3.5.8-74 - Update to 3.5.8 - resolves: 596830 - Thu Mar 3 2011 Guenther Deschner - 3.5.7-73 - Security update to 3.5.7 to address CVE-2011-0719 - resolves: 681852 - Thu Jan 6 2011 Guenther Deschner - 3.5.6-72 - Fix GSSAPI checksum for some SMB servers -...

Fedora 14 : policycoreutils-2.0.85-19.fc14 (2011-3043)

This fixes the problem with seunshare causing applications to mistakenly use the /tmp directory in an unsafe manner. CVE-2011-1011 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically...

Ubuntu 10.04 LTS / 10.10 : linux vulnerabilities (USN-1090-1)

Dan Rosenberg discovered that multiple terminal ioctls did not correctly initialize structure memory. A local attacker could exploit this to read portions of kernel stack memory, leading to a loss of privacy. CVE-2010-4075 Dan Rosenberg discovered that the SCSI subsystem did not correctly validat...

Fedora 13 : subversion-1.6.16-1.fc13 (2011-2698)

A NULL pointer dereference flaw was found in the way the moddavsvn module processed certain requests to lock working copy paths in a repository. A remote attacker could issue a lock request that could cause the httpd process serving the request to crash. CVE-2011-0715 The Fedora Project would lik...