US Tax Season Phishing Scams and Malware Campaigns

In the past, US-CERT has received reports of an increased number of phishing scams and malware campaigns that take advantage of the United States tax season. Due to the upcoming tax deadline, US-CERT reminds users to remain cautious when receiving unsolicited email that could be part of a potenti...

Firefox Gets Browser Boost From IE Attacks

Mozilla yesterday reported a “huge increase” in downloads of Firefox in Germany after that country’s computer security agency urged users of Microsoft’s Internet Explorer to dump the browser and run a rival instead. Read the full article. Computerworld...

Firefox 3.0.14 Insufficient warning for PKCS11 module installation and removal

Mozilla Firefox before 3.0.14 does not properly implement certain dialogs associated with the 1 pkcs11.addmodule and 2 pkcs11.deletemodule operations, which makes it easier for remote attackers to trick a user into installing or removing an arbitrary PKCS11 module...

Mandrake Security Advisory MDVSA-2009:161-1 (squid)

The remote host is missing an update to squid announced via advisory MDVSA-2009:161-1. SPDX-FileCopyrightText: 2009 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only OR...

Security fix for the ALT Linux 5 package libxml2 version 1:2.7.3-alt2

Aug. 17, 2009 Dmitry V. Levin 1:2.7.3-alt2 - Applied FICORA 245608 patches for CVE-2009-2414 and CVE-2009-2416. - xmlversion.h: Removed ATTRIBUTEPRINTF redefinition. - Fixed some compiler warnings...

Security fix for the ALT Linux 9 package libxml2 version 1:2.7.3-alt2

Aug. 17, 2009 Dmitry V. Levin 1:2.7.3-alt2 - Applied FICORA 245608 patches for CVE-2009-2414 and CVE-2009-2416. - xmlversion.h: Removed ATTRIBUTEPRINTF redefinition. - Fixed some compiler warnings...

Fedora 10 : nagios-3.0.5-1.fc10 (2008-10323)

Upstream has released a new version: Security fix for Cross Site Request Forgery CSRF bug reported by Tim Starling. Sample audio files for CGIs removed from distribution Fix for mutliline config file continuation bug Minor fix to RPM spec file Fix for AIX compiler warnings Minor sample config fil...

FreeBSD Ports: squid

The remote host is missing an update to the system as announced in the referenced advisory. SPDX-FileCopyrightText: 2008 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

HPSBPI02265 SSRT3515 rev.2 - Re-release of HPSBMI00004 HP Jetdirect Running ftp, Advisory

Potential Security Impact Advisory VULNERABILITY SUMMARY Some security scanners generate warnings that the Jetdirect ftp directory is writable. RESOLUTION To restrict printing or suppress the security scanners warning, the ftp service can be disabled. To disable ftp, telnet to the Jetdirect devic...

DEBIAN-CVE-2007-4565

sink.c in fetchmail before 6.3.9 allows context-dependent attackers to cause a denial of service NULL dereference and application crash by refusing certain warning messages that are sent over SMTP...

DGNews version 2.1 Path Disclosure Vulnerability

netVigilance Security Advisory 21 DGNews version 2.1 Path Disclosure Vulnerability Description: DGNews is small and simple but powered news publishing. Easy installation, no programing required. But you can still change whatever you want for advanced users. Features: add unlimited categories,...

[Full-disclosure] Jetbox CMS version 2.1 Multiple Path Disclosure Vulnerabilities

netVigilance Security Advisory 27 Jetbox CMS version 2.1 Multiple Path Disclosure Vulnerabilities Description: Jetbox CMS is seriously tested on usability & has a professional intuitive interface. The system is role based, with workflow and module orientated. All content is fully separated from...

Fedora Core 6 : fetchmail-6.3.6-1.fc6 (2007-042)

Sat Jan 6 2007 Miloslav Trmac - 6.3.6-1 - Update to fetchmail-6.3.6 CVE-2006-5867, CVE-2006-5974 - Wed Nov 1 2006 Miloslav Trmac - 6.3.5-1 - Update to fetchmail-6.3.5 - Fix some rpmlint warnings Note that Tenable Network Security has extracted the preceding description block directly from the...

CVE-2006-6257

The file manager in AlternC 0.9.5 and earlier, when warnings are enabled in PHP, allows remote attackers to obtain sensitive information via certain folder names such as ones composed of JavaScript code, which reveal the path in a warning message...

[Full-disclosure] Invision Power Board 2.1.7 debug mode vulnerability

Debug mode is a feature in IPB 2.0.0-2.1.7 that shows all database queries for each forum page requested. If Debug mode is turned on, it is possible for anyone to request a forgotten password for an account, and capture the validation key that is sent to the account's email address. This allows a...

Perl hackers need to know the 1 0 thing-vulnerability warning-the black bar safety net

Perl is the expert level of the system administrator's preferred scripting language, but its role is far more than that. As a design for file and text processing language, in addition to a variety of other uses, it is also extremely suitable for UNIX system Management, Web programming, and databa...

Remote file inclusion

DISPUTED PHP remote file inclusion vulnerability in functions/plugin.php in SquirrelMail 1.4.6 and earlier, if registerglobals is enabled and magicquotesgpc is disabled, allows remote attackers to execute arbitrary PHP code via a URL in the plugins array parameter. NOTE: this issue has been...

CVE-2006-2480

Format string vulnerability in Dia 0.94 allows user-assisted attackers to cause a denial of service crash and possibly execute arbitrary code by triggering errors or warnings, as demonstrated via format string specifiers in a .bmp filename. NOTE: the original exploit was demonstrated through a...

CVE-2006-0754

dotProject 2.0.1 and earlier allows remote attackers to obtain sensitive information via direct requests with an invalid baseDir to certain PHP scripts in the db directory, which reveal the path in an error message. NOTE: the vendor disputes this issue, saying that it could only occur if the...

CVE-2006-0765

GUI display truncation vulnerability in ICQ Inc. formerly Mirabilis ICQ 2003a, 2003b, Lite 4.0, Lite 4.1, and possibly other Windows versions allows user-assisted remote attackers to hide malicious file extensions, bypass Windows security warnings via a filename that is all uppercase and of a...