6655 matches found
openx -- remote code execution vulnerability
The OpenX project reported: It has been brought to our attention that there is a vulnerability in the 2.8 downloadable version of OpenX that can result in a server running the downloaded version of OpenX being compromised. This vulnerability exists in the file upload functionality and allows...
linux-flashplugin -- remote code execution
Adobe Product Security Incident Response Team reports: A critical vulnerability exists in Adobe Flash Player 10.1.82.76 and earlier versions for Windows, Macintosh, Linux, Solaris, and Adobe Flash Player 10.1.92.10 for Android. This vulnerability also affects Adobe Reader 9.3.4 and earlier versio...
Mailman -- cross-site scripting in web interface
Secunia reports: Two vulnerabilities have been reported in Mailman, which can be exploited by malicious users to conduct script insertion attacks. Certain input passed via the list descriptions is not properly sanitised before being displayed to the user. This can be exploited to insert arbitrary...
django -- cross-site scripting vulnerability
Django project reports: The provided template tag for inserting the CSRF token into forms -- % csrftoken % -- explicitly trusts the cookie value, and displays it as-is. Thus, an attacker who is able to tamper with the value of the CSRF cookie can cause arbitrary content to be inserted, unescaped,...
mozilla -- multiple vulnerabilities
The Mozilla Project reports: MFSA 2010-49 Miscellaneous memory safety hazards rv:1.9.2.9/ 1.9.1.12 MFSA 2010-50 Frameset integer overflow vulnerability MFSA 2010-51 Dangling pointer vulnerability using DOM plugin array MFSA 2010-52 Windows XP DLL loading vulnerability MFSA 2010-53 Heap buffer...
sudo -- Flaw in Runas group matching
Todd Miller reports: Beginning with sudo version 1.7.0 it has been possible to grant permission to run a command using a specified group via sudo -g option run as group. A flaw exists in the logic that matches Runas groups in the sudoers file when the -u option is also specified run as user. This...
webkit-gtk2 -- Multiple vulnerabilities
Gustavo Noronha Silva reports: With help from Vincent Danen and other members of the Red Hat security team, the following CVE's where fixed...
squid -- Denial of service vulnerability in request handling
Squid security advisory 2010:3 reports: Due to an internal error in string handling Squid is vulnerable to a denial of service attack when processing specially crafted requests. This problem allows any trusted client to perform a denial of service attack on the Squid service...
quagga -- stack overflow and DoS vulnerabilities
The Red Hat security team reported two vulnerabilities: A stack buffer overflow flaw was found in the way Quagga's bgpd daemon processed Route-Refresh messages. A configured Border Gateway Protocol BGP peer could send a Route-Refresh message with specially-crafted Outbound Route Filtering ORF...
horde-gollem -- XSS vulnerability
The Horde team reports: The major changes compared to Gollem version H3 1.1.1 are: Fixed an XSS vulnerability in the file viewer...
corkscrew -- buffer overflow vulnerability
The affected corkscrew versions use sscanf calls without proper bounds checking. In the authentication file parsing routine this can cause an exploitable buffer overflow condition. A similar but issue exists in the server response code but appears to be non-exploitable...
ruby -- UTF-7 encoding XSS vulnerability in WEBrick
The official ruby site reports: WEBrick have had a cross-site scripting vulnerability that allows an attacker to inject arbitrary script or HTML via a crafted URI. This does not affect user agents that strictly implement HTTP/1.1, however, some user agents do not...
opera -- multiple vulnerabilities
The Opera Destkop Team reports: Fixed an issue where heap buffer overflow in HTML5 canvas could be used to execute arbitrary code, as reported by Kuzzcc. Fixed an issue where unexpected changes in tab focus could be used to run programs from the Internet, as reported by Jakob Balle and Sven Krewi...
phpmyadmin -- Several XSS vulnerabilities
phpMyAdmin Team reports: It was possible to conduct a XSS attack using crafted URLs org POST parameters on several pages...
bugzilla -- information disclosure, denial of service
A Bugzilla Security Advisory reports: Remote Information Disclosure: An unprivileged user is normally not allowed to view other users' group membership. But boolean charts let the user use group-based pronouns, indirectly disclosing group membership. This security fix restricts the use of pronoun...
openoffice.org -- Multiple vulnerabilities
OpenOffice.org Security Team reports: Fixed in OpenOffice.org 3.3 CVE-2010-2935 / CVE-2010-2936: Security Vulnerability in OpenOffice.org related to PowerPoint document processing CVE-2010-3450: Security Vulnerability in OpenOffice.org related to Extensions and filter package files CVE-2010-3451 ...
rssh -- configuration restrictions bypass
Derek Martin rssh maintainer reports: John Barber reported a problem where, if the system administrator misconfigures rssh by providing too few access bits in the configuration file, the user will be given default permissions scp to the entire system, potentially circumventing any configured...
vlc -- invalid id3v2 tags may lead to invalid memory dereferencing
VideoLAN project reports: VLC fails to perform sufficient input validation when trying to extract some meta-informations about input media through ID3v2 tags. In the failure case, VLC attempt dereference an invalid memory address, and a crash will ensure...
isolate -- local root exploit
Isolate currently suffers from some bad security bugs! These are local root privilege escalation bugs. Thanks to the helpful person who reported them email Chris if you want credit!. We're working to fix them ASAP, but until then, isolate is unsafe and you should uninstall it. Sorry!...
Piwik -- Local File Inclusion Vulnerability
Piwik versions 0.6 through 0.6.3 are vulnerable to arbitrary, remote file inclusion using a directory traversal pattern infinite a crafted request for a data renderer. A vulnerability has been reported in Piwik, which can before exploited by malicious people to disclose potentially sensitive...
libmspack -- infinite loop denial of service
There is a denial of service vulnerability in libmspack. The libmspack code is built into cabextract, so it is also vulnerable. Secunia reports: The vulnerability is caused due to an error when copying data from an uncompressed block block type 0 and can be exploited to trigger an infinite loop b...
apache -- Remote DoS bug in mod_cache and mod_dav
Apache ChangeLog reports: moddav, modcache: Fix Handling of requests without a path segment...
git -- buffer overflow vulnerability
Greg Brockman reports: If an attacker were to create a crafted working copy where the user runs any git command, the attacker could force execution of arbitrary code...
firefox -- Dangling pointer crash regression from plugin parameter array fix
The Mozilla Project reports: MFSA 2010-48 Dangling pointer crash regression from plugin parameter array fix...
mozilla -- multiple vulnerabilities
The Mozilla Project reports: MFSA 2010-34 Miscellaneous memory safety hazards rv:1.9.2.7/ 1.9.1.11 MFSA 2010-35 DOM attribute cloning remote code execution vulnerability MFSA 2010-36 Use-after-free error in NodeIterator MFSA 2010-37 Plugin parameter EnsureCachedAttrParamArrays remote code executi...
webkit-gtk2 -- Multiple vulnerabilities
Gustavo Noronha reports: Debian's Michael Gilbert has done a great job going through all CVEs released about WebKit, and including patches in the Debian package. 1.2.3 includes all of the commits from trunk to fix those, too...
vte -- Classic terminal title set+query attack
Kees Cook reports: Janne Snabb discovered that applications using VTE, such as gnome-terminal, did not correctly filter window and icon title request escape codes. If a user were tricked into viewing specially crafted output in their terminal, a remote attacker could execute arbitrary commands wi...
FreeBSD -- Lost mbuf flag resulting in data corruption
Problem Description: The read-only flag is not correctly copied when a mbuf buffer reference is duplicated. When the sendfile2 system call is used to transmit data over the loopback interface, this can result in the backing pages for the transmitted file being modified, causing data corruption...
codeigniter -- file upload class vulnerability
Derek Jones reports: A fix has been implemented for a security flaw in CodeIgniter 1.7.2. All applications using the File Upload class should install the patch to ensure that their application is not subject to a vulnerability...
redmine -- multiple vulnerabilities
Eric Davis reports: This security release addresses some security vulnerabilities found in the advanced subversion integration module Redmine.pm perl script...
bogofilter -- heap underrun on malformed base64 input
Julius Plenz reports: I found a bug in the base64decode function which may cause memory corruption when the function is executed on a malformed base64 encoded string. If a string starting with an equal-sign is passed to the base64decode function it triggers a memory corruption that in some cases...
OpenTTD -- Denial of service (server) via infinite loop
The OpenTTD Team reports: When multiple commands are queued at the server for execution in the next game tick and an client joins the server can get into an infinite loop. With the default settings triggering this bug is difficult if not impossible, however the larger value of the "framefreq"...
bugzilla -- information disclosure
A Bugzilla Security Advisory reports: Normally, information about time-tracking estimated hours, actual hours, hours worked, and deadlines is restricted to users in the "time-tracking group". However, any user was able, by crafting their own search URL, to search for bugs based using those fields...
mozilla -- multiple vulnerabilities
Mozilla Project reports: MFSA 2010-33 User tracking across sites using Math.random MFSA 2010-32 Content-Disposition: attachment ignored if Content-Type: multipart also present MFSA 2010-31 focus behavior can be used to inject or steal keystrokes MFSA 2010-30 Integer Overflow in XSLT Node Sorting...
opera -- Data URIs can be used to allow cross-site scripting
The Opera Desktop Team reports: Data URIs are allowed to run scripts that manipulate pages from the site that directly opened them. In some cases, the opening site is not correctly detected. In these cases, Data URIs may erroneously be able to run scripts so that they interact with sites that did...
ziproxy -- security vulnerability in PNG decoder
Daniel Mealha Cabrita reports: Fixed security vulnerability heap-related in PNG decoder. new bug from 3.1.0...
wget -- multiple HTTP client download filename vulnerability
GNU Wget version 1.12 and earlier uses a server-provided filename instead of the original URL to determine the destination filename of a download, which allows remote servers to create or overwrite arbitrary files via a 3xx redirect to a URL with a .wgetrc filename followed by a 3xx redirect to a...
lftp -- multiple HTTP client download filename vulnerability
The get1 command, as used by lftpget, in LFTP before 4.0.6 does not properly validate a server-provided filename before determining the destination filename of a download, which allows remote servers to create or overwrite arbitrary files via a Content-Disposition header that suggests a crafted...
p5-libwww -- possibility to remote servers to create file with a .(dot) character
lwp-download in libwww-perl before 5.835 does not reject downloads to filenames that begin with a .' dot character, which allows remote servers to create or overwrite files via a 3xx redirect to a URL with a crafted filename or a Content-Disposition header that suggests a crafted filename, and...
moodle -- multiple vulnerabilities
The Moodle release notes report multiple vulnerabilities which could allow cross site scripting, XSS attacks, unauthorised deletion of attempts in some instances...
horde-base -- XSS and CSRF vulnerabilities
The Horde team reports: Thanks to Naumann IT Security Consulting for reporting the XSS vulnerability. Thanks to Secunia for releasing an advisory for the new CSRF protection in the preference interface The major changes compared to Horde version 3.3.8 are: Fixed XSS vulnerability in...
sudo -- Secure path vulnerability
Todd Miller reports: Most versions of the C library function getenv return the first instance of an environment variable to the caller. However, some programs, notably the GNU Bourne Again SHell bash, do their own environment parsing and may choose the last instance of a variable rather than the...
mediawiki -- two security vulnerabilities
Two security vulnerabilities were discovered: Noncompliant CSS parsing behaviour in Internet Explorer allows attackers to construct CSS strings which are treated as safe by previous versions of MediaWiki, but are decoded to unsafe strings by Internet Explorer. A CSRF vulnerability was discovered ...
FreeBSD -- OPIE off-by-one stack overflow
Problem Description: A programming error in the OPIE library could allow an off-by-one buffer overflow to write a single zero byte beyond the end of an on-stack buffer...
FreeBSD -- Unvalidated input in nfsclient
Problem Description: The NFS client subsystem fails to correctly validate the length of a parameter provided by the user when a filesystem is mounted...
FreeBSD -- Insufficient environment sanitization in jail(8)
Problem Description: The jail8 utility does not change the current working directory while imprisoning. The current working directory can be accessed by its descendants...
mDNSResponder -- corrupted stack crash when parsing bad resolv.conf
Juli Mallett reports: mdnsd will crash on some systems with a corrupt stack and once that's fixed it will still leak a file descriptor when parsing resolv.conf. The crash is because scanf is used with %10s for a buffer that is only 10 chars long. The buffer size needs increased to 11 chars to hol...
cacti -- multiple vulnerabilities
Multiple vulnerabilities have been reported to exist in older version of Cacti. The release notes of Cacti 0.8.7f summarizes the problems as follows: SQL injection and shell escaping issues Cross-site scripting issues Cacti Graph Viewer SQL injection vulnerability...