Ubuntu 6.06 LTS / 7.10 / 8.04 LTS / 8.10 : xine-lib vulnerability (USN-746-1)

It was discovered that the 4xm demuxer in xine-lib did not correctly handle a large currenttrack value in a 4xm file, resulting in an integer overflow. If a user or automated system were tricked into opening a specially crafted 4xm movie file, an attacker could crash xine-lib or possibly execute...

Ubuntu 6.06 LTS / 7.10 / 8.04 LTS / 8.10 : libarchive-tar-perl, perl vulnerabilities (USN-700-1)

Jonathan Smith discovered that the Archive::Tar Perl module did not correctly handle symlinks when extracting archives. If a user or automated system were tricked into opening a specially crafted tar file, a remote attacker could over-write arbitrary files. CVE-2007-4829 Tavis Ormandy and Will...

Fedora 9 : krb5-1.6.3-16.fc9 (2009-2834)

This update incorporates patches to fix potential read overflow and NULL pointer dereferences in the implementation of the SPNEGO GSSAPI mechanism CVE-2009-0844, CVE-2009-0845, attempts to free an uninitialized pointer during protocol parsing CVE-2009-0846, and a bug in length validation during...

Fedora 9 : Miro-2.0.3-2.fc9 / blam-1.8.5-7.fc9.1 / chmsee-1.0.1-10.fc9 / devhelp-0.19.1-10.fc9 / etc (2009-3099)

Mozilla Firefox is an open source Web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox. A memory corruption flaw was discovered in the way Firefox handles XML files containing an XSLT transform. A remote attacker could use this flaw to crash Firefox or, potentially,...

openSUSE 10 Security Update : acroread (acroread-6120)

Multiple flaws in the JBIG2 decoder and the JavaScript engine of the Adobe Reader allowed attackers to crash acroread or even execute arbitrary code by tricking users into opening specially crafted PDF files. CVE-2009-0658, CVE-2009-0927, CVE-2009-0193, CVE-2009-0928, CVE-2009-1061, CVE-2009-1062...

ZDI-09-014: Adobe Acrobat getIcon() Stack Overflow Vulnerability

ZDI-09-014: Adobe Acrobat getIcon Stack Overflow Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-09-014 March 24, 2009 -- CVE ID: CVE-2009-0927 -- Affected Vendors: Adobe -- Affected Products: Adobe Acrobat -- TippingPointTM IPS Customer Protection: TippingPoint IPS customers have...

Fedora 9 : weechat-0.2.6.1-1.fc9 (2009-2861)

Thu Mar 19 2009 Paul P. Komkoff Jr - 0.2.6.1-1 - fix bz490709 - Wed Feb 25 2009 Fedora Release Engineering - 0.2.6-7 - Rebuilt for https://fedoraproject.org/wiki/Fedora11MassRebuild - Sun Nov 30 2008 Ignacio Vazquez-Abrams - 0.2.6-6 - Rebuild for Python 2.6 - Sun Sep 21 2008 Ville Skytta -...

Fedora 9 : roundup-1.4.6-4.fc9 (2009-2591)

Mon Mar 9 2009 Paul P. Komkoff Jr - 1.4.6-4 - security bug bz489355 - Wed Feb 25 2009 Fedora Release Engineering - 1.4.6-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora11MassRebuild - Sat Nov 29 2008 Ignacio Vazquez-Abrams - 1.4.6-2 - Rebuild for Python 2.6 - Fri Oct 3 2008 Paul P. Komkoff...

AIX 610000 : U818429

The remote host is missing AIX PTF U818429 which is related to the security of the package devices.chrp.base.rte You should install this PTF for your system to be up-to-date. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. if ! definedfunc"bnrandom" exit0; include'deprecatednasllevel.inc';...

Thecus NAS Device Detection

According to its web server, the remote host is a Thecus NAS Network- Attached Storage device, which provides file-based data storage to hosts across a network. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid35820; scriptversion"1.12"; scriptnameenglish:"Thecus NAS...

FreeBSD telnetd sys_term.c Environment Variable Handling Privilege Escalation (FreeBSD-SA-09:05)

A flaw in the environment-handling code used by the telnet server running on the remote host fails to scrub the environment of variables such as 'LDPRELOAD' before calling the login program. An attacker who can place an arbitrary library on the remote host, either as a local user or remotely...

Fedora 9 : Miro-1.2.7-4.fc9 / blam-1.8.5-5.fc9.1 / cairo-dock-1.6.3.1-1.fc9.3 / chmsee-1.0.1-8.fc9 / etc (2009-1399)

Update to the new upstream Firefox 3.0.6 / XULRunner 1.9.0.6 fixing multiple security issues: http://www.mozilla.org/security/known- vulnerabilities/firefox30.htmlfirefox3.0.6 This update also contains new builds of all applications depending on Gecko libraries, built against the new version. Not...

AIX 520010 : U823524

The remote host is missing AIX PTF U823524 which is related to the security of the package devices.iscsisw.rte You should install this PTF for your system to be up-to-date. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. if ! definedfunc"bnrandom" exit0; include'deprecatednasllevel.inc';...

Fedora 9 : kernel-2.6.27.12-78.2.8.fc9 (2009-0816)

Update to kernel 2.6.27.12: http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.27.10 http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.27.11 http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.27.12 Includes security fixes: CVE-2009-0029 Linux Kernel insecure 64 bit system ca...

Fedora 9 : DevIL-1.7.5-2.fc9 (2009-0856)

Fix missing symbols rh 480269 - Fix off by one error in CVE-2008-5262 check rh 479864 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without...

Solaris 10 (x86) : 121395-03

SunOS 5.10x86 kaio and aioimpl.h patch. Date this patch was last updated by Sun : Feb/27/09 %NASLMINLEVEL 70300 @DEPRECATED@ This script has been deprecated as the associated patch is not currently a recommended security fix. Disabled on 2011/09/17. C Tenable Network Security, Inc. if !...

Fedora 9 : xterm-238-1.fc9 (2009-0059)

This update fixes the following security issue: CRLF injection vulnerability in xterm allows user-assisted attackers to execute arbitrary commands via LF aka \n characters surrounding a command name within a Device Control Request Status String DECRQSS escape sequence in a text file, a related...

Fedora 8 : xterm-238-1.fc8 (2009-0154)

This update fixes the following security issue: CRLF injection vulnerability in xterm allows user-assisted attackers to execute arbitrary commands via LF aka \n characters surrounding a command name within a Device Control Request Status String DECRQSS escape sequence in a text file, a related...

System Information Enumeration (via DMI)

Using the SMBIOS aka DMI interface, it was possible to retrieve information about the remote system's hardware, such as its product name and serial number. C Tenable Network Security, Inc. include"compat.inc"; ifdescription scriptid35351; scriptversion"1.12";...

CA20090107-01: CA Service Metric Analysis and CA Service Level Management smmsnmpd Arbitrary Command Execution Vulnerability

Title: CA20090107-01: CA Service Metric Analysis and CA Service Level Management smmsnmpd Arbitrary Command Execution Vulnerability CA Advisory Reference: CA20090107-01 CA Advisory Date: 2009-01-07 Reported By: Michel Arboi of Tenable Network Security Impact: A remote attacker can execute arbitra...