Important: nfs-utils-lib security update

1.0.8-7.2.z2 - Updated libnfsidmap to -17 to fix a security issue bz 254041 1.0.8-7.2.z1 - Fixed RPC library buffer overflow bz 265061...

Cisco IOS on Catalyst 6500 and Cisco 7600 Access Control List Bypass Vulnerability

Cisco IOS running on Catalyst 6500 and Cisco 7600 contains a vulnerability that could allow an unauthenticated, remote attacker to bypass configured ACLs. The vulnerability exists because the affected devices accept traffic to IP addresses that are reserved for use by the Ethernet Out-of-Band...

Mandrake Linux Security Advisory : qt (MDKSA-2007:183)

A buffer overflow was found in how Qt expanded malformed Unicode strings. If an application linked against Qt parsed a malicious Unicode string, it could lead to a denial of service or potentially allow for the execution of arbitrary code. Updated packages have been patched to prevent this issue...

Mandrake Linux Security Advisory : konqueror (MDKSA-2007:176)

konqueror/konqcombo.cc in Konqueror 3.5.7 allows remote attackers to spoof the data: URI scheme in the address bar via a long URI with trailing whitespace, which prevents the beginning of the URI from being displayed. CVE-2007-3820 KDE Konqueror 3.5.7 allows remote attackers to spoof the URL...

Mandrake Linux Security Advisory : krb5 (MDKSA-2007:174-1)

A stack-based buffer overflow vulnerability was discovered in the RPC library used by Kerberos' kadmind program by Tenable Network Security. A remote unauthenticated user who could access kadmind would be able to trigger the flaw and cause it to crash CVE-2007-3999. This issue is only applicable ...

Mandrake Linux Security Advisory : tar (MDKSA-2007:173)

Dmitry V. Levin discovered a path traversal flaw in how GNU tar extracted archives. A malicious user could create a tar archive that could write to arbitrary fiels that the user running tar has write access to. Updated packages have been patched to prevent these issues. %NASLMINLEVEL 70300 C...

Mandrake Linux Security Advisory : tcpdump (MDKSA-2007:148)

An integer overflow in tcpdump could allow a remote attacker to execute arbitrary code via crafted TLVs in a BGP packet. Updated packages have been patched to prevent this issue. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were...

Incorrect authentication

It has been discovered that the extension ftpbrowser is doing incorrect authentication in some files, making it open for exploiting. Component Type: Third party extension. This extension is not part of the TYPO3 default installation Affected Versions: Version 0.1.2 and all versions below...

RHEL 4 : httpd (RHSA-2007:0534)

Updated Apache httpd packages that correct two security issues are now available for Red Hat Enterprise Linux 4. This update has been rated as having moderate security impact by the Red Hat Security Response Team. The Apache HTTP Server is a popular Web server. A flaw was found in the Apache HTTP...

[Full-disclosure] CheckPoint VPN-1 UTM Edge Cross Site Request Forgery vulnerability

Louhi Networks Oy -= Security Advisory =- Advisory: Checkpoint VPN-1 UTM Edge Cross Site Request Forgery Release Date: 2007/06/26 Last Modified: 2007/06/26 Authors: Henri Lindberg, Associate of ISC? [email protected] Jussi Vuokko, CISSP [email protected] Application: Checkpoint VPN-1 Ed...

[ MDKSA-2007:135 ] - Updated webmin packages fix XSS vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDKSA-2007:135 http://www.mandriva.com/security/ Package : webmin Date : June 23, 2007 Affected: 2007.0, 2007.1, Corporate 4.0 Problem Description: Multiple cross-site scripting XSS vulnerabilities were discovered in...

[ MDKSA-2007:129 ] - Updated jasper packages fix vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDKSA-2007:129 http://www.mandriva.com/security/ Package : jasper Date : June 19, 2007 Affected: 2007.0, 2007.1, Corporate 4.0 Problem Description: A function in the JasPer JPEG-2000 library before 1.900 could allow a...

Solaris 5.9 (sparc) : 125276-08

Directory Server Enterprise Edition 6.3.1 : SunOS 5.9/5.10 Sparc N. Date this patch was last updated by Sun : Feb/09/09 %NASLMINLEVEL 999999 @DEPRECATED@ This script has been deprecated as the associated patch is not currently a recommended security fix. Disabled on 2011/12/27. C Tenable Network...

Mandrake Linux Security Advisory : libwmf (MDKSA-2007:123)

A flaw in libgd2 was found by Xavier Roche where it would not correctly validate PNG callback results. If an application linked against libgd2 was tricked into processing a specially crafted PNG file, it could cause a denial of service scenario via CPU resource consumption. Libwmf uses an embedde...

Mandrake Linux Security Advisory : freetype2 (MDKSA-2007:121)

An integer overflow vulnerability was discovered in the way the FreeType font engine processed TTF files. If a user were to load a special font file with a program linked against freetype, it could cause the application to crash or possibly execute arbitrary code as the user running the program...

Mandrake Linux Security Advisory : php-pear (MDKSA-2007:110)

A security hole was discovered in all versions of the PEAR Installer http://pear.php.net/PEAR. The security hole is the most serious hole found to date in the PEAR Installer, and would allow a malicious package to install files anywhere in the filesystem. The vulnerability only affects users who...

Mandrake Linux Security Advisory : tetex (MDKSA-2007:109)

Buffer overflow in the gdImageStringFTEx function in gdft.c in the GD Graphics Library 2.0.33 and earlier allows remote attackers to cause a denial of service application crash and possibly execute arbitrary code via a crafted string with a JIS encoded font. Tetex 3.x uses an embedded copy of the...

RHEL 5 : bind (RHSA-2007:0057)

Updated bind packages that fix a security issue and a bug are now available for Red Hat Enterprise Linux 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. ISC BIND Berkeley Internet Name Domain is an implementation of the DNS Domain Name Syste...

MDKA-2007:040-1 : gnome-utils

The gnome-system-log viewer could crash when parsing certain log files. The provided updated packages correct this problem. Update: Packages are now available for Mandriva Linux 2007.0. %NASLMINLEVEL 999999 @DEPRECATED@ This script has been deprecated as the associated patch is not currently a...

Cisco CallManager Web Interface Input Validation Bypass Vulnerability

Cisco CallManager versions 4.31 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to bypass security restrictions and conduct cross-site scripting attacks. This vulnerability exists due to insufficient sanitization of user-supplied input to the CallManager web...