Debian DSA-126-1 : imp - XSS

A cross-site scripting CSS problem was discovered in Horde and IMP a web-based IMAP mail package. This was fixed upstream in Horde version 1.2.8 and IMP version 2.2.8. The relevant patches have been back-ported to version 1.2.6-0.potato.5 of the horde package and version 2.2.6-0.potato.5 of the i...

Debian DSA-253-1 : openssl - information leak

A vulnerability has been discovered in OpenSSL, a Secure Socket Layer SSL implementation. In an upcoming paper, Brice Canvel EPFL, Alain Hiltgen UBS, Serge Vaudenay EPFL, and Martin Vuagnoux EPFL, Ilion describe and demonstrate a timing-based attack on CBC cipher suites used in SSL and TLS. OpenS...

Debian DSA-108-1 : wmtv - symlink vulnerability

Nicolas Boullis found some security problems in the wmtv package a dockable video4linux TV player for windowmaker which is distributed in Debian GNU/Linux 2.2. With the current version of wmtv, the configuration file is written back as the superuser, and without any further checks. A malicious us...

Debian DSA-286-1 : gs-common - insecure temporary file

Paul Szabo discovered insecure creation of a temporary file in ps2epsi, a script that is distributed as part of gs-common which contains common files for different Ghostscript releases. ps2epsi uses a temporary file in the process of invoking ghostscript. This file was created in an insecure...

Debian DSA-170-1 : tomcat4 - source code disclosure

A security vulnerability has been found in all Tomcat 4.x releases. This problem allows an attacker to use a specially crafted URL to return the unprocessed source code of a JSP page, or, under special circumstances, a static resource which would otherwise have been protected by security...

Debian DSA-516-1 : postgresql - buffer overflow

A buffer overflow has been discovered in the ODBC driver of PostgreSQL, an object-relational SQL database, descended from POSTGRES. It is possible to exploit this problem and crash the surrounding application. Hence, a PHP script using php4-odbc can be utilised to crash the surrounding Apache...

Debian DSA-139-1 : super - format string vulnerability

GOBBLES found an insecure use of format strings in the super package. The included program super is intended to provide access to certain system users for particular users and programs, similar to the program sudo. Exploiting this format string vulnerability a local user can gain unauthorized roo...

Debian DSA-544-1 : webmin - insecure temporary directory

Ludwig Nussel discovered a problem in webmin, a web-based administration toolkit. A temporary directory was used but without checking for the previous owner. This could allow an attacker to create the directory and place dangerous symbolic links inside. %NASLMINLEVEL 70300 C Tenable Network...

Debian DSA-433-1 : kernel-patch-2.4.17-mips - integer overflow

Red Hat and SuSE kernel and security teams revealed an integer overflow in the dobrk function of the Linux kernel allows local users to gain root privileges. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian...

Debian DSA-223-1 : geneweb - information exposure

A security issue has been discovered by Daniel de Rauglaudre, upstream author of geneweb, a genealogical software with web interface. It runs as a daemon on port 2317 by default. Paths are not properly sanitized, so a carefully crafted URL lead geneweb to read and display arbitrary files of the...

Serendipity < 0.7.0beta3 Multiple Vulnerabilities

The remote version of Serendipity is vulnerable to SQL injection issues due to a failure of the application to properly sanitize user- supplied input. An attacker may exploit this flaw to issue arbitrary statements in the remote database, and therefore, bypass authorization or even overwrite...

aspWebAlbum album.asp SQL Injection

The remote host appears to be running aspWebAlbum, an ASP script designed to faciliate the integration of multiple photo albums in a web-based application. There is a flaw in the remote software that could allow anyone to inject arbitrary SQL commands, which may in turn be used to gain...

Emulive Server4 Authentication Bypass

The remote host is running EmuLive Server4, a web and media streaming server. There is a flaw in the administrative interface that allows a remote attacker to bypass the authentication procedure by requesting the page '/public/admin/index.htm' directly. An attacker may exploit this flaw to gain...

Subversion < 1.0.8 / 1.1.0-rc4 mod_authz_svn Unreadable Path Metadata Information Disclosure

You are running a version of Subversion which is older than 1.0.8 or 1.1.0-rc4. A flaw exists in older version, in the apache module modauthzsvn, which fails to properly restrict access to metadata within unreadable paths. An attacker can read metadata in unreadable paths, which can contain...

Important: Red Hat Security Advisory: samba security update

Updated samba packages that fix two denial of service vulnerabilities are now available. Updated 23rd September 2004 Packages have been updated to include the ppc64 packages which were left out of the initial errata. Samba provides file and printer sharing services to SMB/CIFS clients. The Samba...

FreeRADIUS: Multiple Denial of Service vulnerabilities

Background FreeRADIUS is an open source RADIUS authentication server implementation. Description There are undisclosed defects in the way FreeRADIUS handles incorrect received packets. Impact A remote attacker could send specially-crafted packets to the FreeRADIUS server to deny service to other...

xine-lib: Multiple vulnerabilities

Background xine-lib is a multimedia library which can be utilized to create multimedia frontends. Description xine-lib contains two stack-based overflows and one heap-based overflow. In the code reading VCD disc labels, the ISO disc label is copied into an unprotected stack buffer of fixed size...

Foomatic: Arbitrary command execution in foomatic-rip filter

Background Foomatic is a system for connecting printer drivers with spooler systems such as CUPS and LPD. The foomatic-filters package contains wrapper scripts which are designed to be used with Foomatic. Description There is a vulnerability in the foomatic-filters package. This vulnerability is...

PHP rfc1867.c $_FILES Array Crafted MIME Header Arbitrary File Upload

The remote host is running a version of PHP that is older than 4.3.9 or 5.0.2. The remote version of this software is affected by an unspecified file upload vulnerability that could allow a local attacker to upload arbitrary files to the server. This flaw can only be exploited locally...

phpGroupWare: XSS vulnerability in wiki module

Background phpGroupWare is a web-based suite of group applications including calendar, todo-list, addressbook, email, wiki, news headlines, and a file manager. Description Due to an input validation error, the wiki module in the phpGroupWare suite is vulnerable to cross site scripting attacks...