Coppermine Photo Gallery Voting Restriction Bypass

The remote host is running Coppermine Gallery - a set of PHP scripts designed to handle galleries of pictures. This product has a vulnerability which allows a remote attacker with cookies disabled to cast multiple votes for a picture. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

Apache 2, mod_ssl: Bypass of SSLCipherSuite directive

Background The Apache HTTP server is one of the most popular web servers on the internet. modssl provides SSL v2/v3 and TLS v1 support for Apache 1.3 and is also included in Apache 2. Description A flaw has been found in modssl where the "SSLCipherSuite" directive could be bypassed in certain...

Xpdf, CUPS: Multiple integer overflows

Background Xpdf is an open source viewer for Portable Document Format PDF files. The Common UNIX Printing System CUPS is a cross-platform print spooler that includes some Xpdf code. Description Chris Evans discovered multiple integer overflow issues in Xpdf. Impact An attacker could entice an use...

Important: Red Hat Security Advisory: ImageMagick security update

Updated ImageMagick packages that fix a BMP loader vulnerability are now available. ImageMagickTM is an image display and manipulation tool for the X Window System. A heap overflow flaw has been discovered in the ImageMagick image handler. An attacker could create a carefully crafted BMP file in...

BNC: Input validation flaw

Background BNC is an IRC proxying server Description A flaw exists in the input parsing of BNC where part of the sbufgetmsg function handles the backspace character incorrectly. Impact A remote user could issue commands using fake authentication credentials and possibly gain access to scripts...

tiff: Buffer overflows in image decoding

Background The tiff library contains encoding and decoding routines for the Tag Image File Format. It is called by numerous programs, including GNOME and KDE, to help in displaying TIFF images. xv is a multi-format image manipulation utility that is statically linked to the tiff library...

WordPress 'wp-login.php' HTTP Response Splitting

According to its banner, the remote version of WordPress is vulnerable to an HTTP-splitting attack wherein an attacker can insert CR LF characters and then entice an unsuspecting user into accessing the URL. The client will parse and possibly act on the secondary header which was supplied by the...

NetworkActiv Web Server Encoded URL Request Remote DoS

The remote host is running NetworkActive Web Server - an alternative web server. There is a vulnerability in the remote version of this software that could allow an attacker to cause a denial of service against the remote server by sending an HTTP GET request containing a '%25' character...

Debian DSA-108-1 : wmtv - symlink vulnerability

Nicolas Boullis found some security problems in the wmtv package a dockable video4linux TV player for windowmaker which is distributed in Debian GNU/Linux 2.2. With the current version of wmtv, the configuration file is written back as the superuser, and without any further checks. A malicious us...

Debian DSA-170-1 : tomcat4 - source code disclosure

A security vulnerability has been found in all Tomcat 4.x releases. This problem allows an attacker to use a specially crafted URL to return the unprocessed source code of a JSP page, or, under special circumstances, a static resource which would otherwise have been protected by security...

Debian DSA-126-1 : imp - XSS

A cross-site scripting CSS problem was discovered in Horde and IMP a web-based IMAP mail package. This was fixed upstream in Horde version 1.2.8 and IMP version 2.2.8. The relevant patches have been back-ported to version 1.2.6-0.potato.5 of the horde package and version 2.2.6-0.potato.5 of the i...

Debian DSA-174-1 : heartbeat - buffer overflow

Nathan Wallwork discovered a buffer overflow in heartbeat, a subsystem for High-Availability Linux. A remote attacker could send a specially crafted UDP packet that overflows a buffer, leaving heartbeat to execute arbitrary code as root. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

Debian DSA-505-1 : cvs - heap overflow

Stefan Esser discovered a heap overflow in the CVS server, which serves the popular Concurrent Versions System. Malformed 'Entry' Lines in combination with Is-modified and Unchanged can be used to overflow malloced memory. This was proven to be exploitable. %NASLMINLEVEL 70300 C Tenable Network...

Debian DSA-211-1 : micq - denial of service

Rudiger Kuhlmann, upstream developer of mICQ, a text based ICQ client, discovered a problem in mICQ. Receiving certain ICQ message types that do not contain the required 0xFE separator causes all versions to crash. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and...

Debian DSA-357-1 : wu-ftpd - remote root exploit

iSEC Security Research reports that wu-ftpd contains an off-by-one bug in the fbrealpath function which could be exploited by a logged-in user local or anonymous to gain root privileges. A demonstration exploit is reportedly available. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

Debian DSA-200-1 : samba - remote exploit

Steve Langasek found an exploitable bug in the password handling code in samba: when converting from DOS code-page to little endian UCS2 unicode a buffer length was not checked and a buffer could be overflowed. There is no known exploit for this, but an upgrade is strongly recommended...

Debian DSA-516-1 : postgresql - buffer overflow

A buffer overflow has been discovered in the ODBC driver of PostgreSQL, an object-relational SQL database, descended from POSTGRES. It is possible to exploit this problem and crash the surrounding application. Hence, a PHP script using php4-odbc can be utilised to crash the surrounding Apache...

Debian DSA-433-1 : kernel-patch-2.4.17-mips - integer overflow

Red Hat and SuSE kernel and security teams revealed an integer overflow in the dobrk function of the Linux kernel allows local users to gain root privileges. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian...

Debian DSA-544-1 : webmin - insecure temporary directory

Ludwig Nussel discovered a problem in webmin, a web-based administration toolkit. A temporary directory was used but without checking for the previous owner. This could allow an attacker to create the directory and place dangerous symbolic links inside. %NASLMINLEVEL 70300 C Tenable Network...

Debian DSA-139-1 : super - format string vulnerability

GOBBLES found an insecure use of format strings in the super package. The included program super is intended to provide access to certain system users for particular users and programs, similar to the program sudo. Exploiting this format string vulnerability a local user can gain unauthorized roo...