quagga -- stack overflow and DoS vulnerabilities

The Red Hat security team reported two vulnerabilities: A stack buffer overflow flaw was found in the way Quagga's bgpd daemon processed Route-Refresh messages. A configured Border Gateway Protocol BGP peer could send a Route-Refresh message with specially-crafted Outbound Route Filtering ORF...

horde-gollem -- XSS vulnerability

The Horde team reports: The major changes compared to Gollem version H3 1.1.1 are: Fixed an XSS vulnerability in the file viewer...

corkscrew -- buffer overflow vulnerability

The affected corkscrew versions use sscanf calls without proper bounds checking. In the authentication file parsing routine this can cause an exploitable buffer overflow condition. A similar but issue exists in the server response code but appears to be non-exploitable...

ruby -- UTF-7 encoding XSS vulnerability in WEBrick

The official ruby site reports: WEBrick have had a cross-site scripting vulnerability that allows an attacker to inject arbitrary script or HTML via a crafted URI. This does not affect user agents that strictly implement HTTP/1.1, however, some user agents do not...

opera -- multiple vulnerabilities

The Opera Destkop Team reports: Fixed an issue where heap buffer overflow in HTML5 canvas could be used to execute arbitrary code, as reported by Kuzzcc. Fixed an issue where unexpected changes in tab focus could be used to run programs from the Internet, as reported by Jakob Balle and Sven Krewi...

phpmyadmin -- Several XSS vulnerabilities

phpMyAdmin Team reports: It was possible to conduct a XSS attack using crafted URLs org POST parameters on several pages...

bugzilla -- information disclosure, denial of service

A Bugzilla Security Advisory reports: Remote Information Disclosure: An unprivileged user is normally not allowed to view other users' group membership. But boolean charts let the user use group-based pronouns, indirectly disclosing group membership. This security fix restricts the use of pronoun...

openoffice.org -- Multiple vulnerabilities

OpenOffice.org Security Team reports: Fixed in OpenOffice.org 3.3 CVE-2010-2935 / CVE-2010-2936: Security Vulnerability in OpenOffice.org related to PowerPoint document processing CVE-2010-3450: Security Vulnerability in OpenOffice.org related to Extensions and filter package files CVE-2010-3451 ...

rssh -- configuration restrictions bypass

Derek Martin rssh maintainer reports: John Barber reported a problem where, if the system administrator misconfigures rssh by providing too few access bits in the configuration file, the user will be given default permissions scp to the entire system, potentially circumventing any configured...

vlc -- invalid id3v2 tags may lead to invalid memory dereferencing

VideoLAN project reports: VLC fails to perform sufficient input validation when trying to extract some meta-informations about input media through ID3v2 tags. In the failure case, VLC attempt dereference an invalid memory address, and a crash will ensure...

isolate -- local root exploit

Isolate currently suffers from some bad security bugs! These are local root privilege escalation bugs. Thanks to the helpful person who reported them email Chris if you want credit!. We're working to fix them ASAP, but until then, isolate is unsafe and you should uninstall it. Sorry!...

Piwik -- Local File Inclusion Vulnerability

Piwik versions 0.6 through 0.6.3 are vulnerable to arbitrary, remote file inclusion using a directory traversal pattern infinite a crafted request for a data renderer. A vulnerability has been reported in Piwik, which can before exploited by malicious people to disclose potentially sensitive...

libmspack -- infinite loop denial of service

There is a denial of service vulnerability in libmspack. The libmspack code is built into cabextract, so it is also vulnerable. Secunia reports: The vulnerability is caused due to an error when copying data from an uncompressed block block type 0 and can be exploited to trigger an infinite loop b...

apache -- Remote DoS bug in mod_cache and mod_dav

Apache ChangeLog reports: moddav, modcache: Fix Handling of requests without a path segment...

git -- buffer overflow vulnerability

Greg Brockman reports: If an attacker were to create a crafted working copy where the user runs any git command, the attacker could force execution of arbitrary code...

mozilla -- multiple vulnerabilities

The Mozilla Project reports: MFSA 2010-34 Miscellaneous memory safety hazards rv:1.9.2.7/ 1.9.1.11 MFSA 2010-35 DOM attribute cloning remote code execution vulnerability MFSA 2010-36 Use-after-free error in NodeIterator MFSA 2010-37 Plugin parameter EnsureCachedAttrParamArrays remote code executi...

firefox -- Dangling pointer crash regression from plugin parameter array fix

The Mozilla Project reports: MFSA 2010-48 Dangling pointer crash regression from plugin parameter array fix...

webkit-gtk2 -- Multiple vulnerabilities

Gustavo Noronha reports: Debian's Michael Gilbert has done a great job going through all CVEs released about WebKit, and including patches in the Debian package. 1.2.3 includes all of the commits from trunk to fix those, too...

vte -- Classic terminal title set+query attack

Kees Cook reports: Janne Snabb discovered that applications using VTE, such as gnome-terminal, did not correctly filter window and icon title request escape codes. If a user were tricked into viewing specially crafted output in their terminal, a remote attacker could execute arbitrary commands wi...

FreeBSD -- Lost mbuf flag resulting in data corruption

Problem Description: The read-only flag is not correctly copied when a mbuf buffer reference is duplicated. When the sendfile2 system call is used to transmit data over the loopback interface, this can result in the backing pages for the transmitted file being modified, causing data corruption...

codeigniter -- file upload class vulnerability

Derek Jones reports: A fix has been implemented for a security flaw in CodeIgniter 1.7.2. All applications using the File Upload class should install the patch to ensure that their application is not subject to a vulnerability...

redmine -- multiple vulnerabilities

Eric Davis reports: This security release addresses some security vulnerabilities found in the advanced subversion integration module Redmine.pm perl script...

bogofilter -- heap underrun on malformed base64 input

Julius Plenz reports: I found a bug in the base64decode function which may cause memory corruption when the function is executed on a malformed base64 encoded string. If a string starting with an equal-sign is passed to the base64decode function it triggers a memory corruption that in some cases...

OpenTTD -- Denial of service (server) via infinite loop

The OpenTTD Team reports: When multiple commands are queued at the server for execution in the next game tick and an client joins the server can get into an infinite loop. With the default settings triggering this bug is difficult if not impossible, however the larger value of the "framefreq"...

bugzilla -- information disclosure

A Bugzilla Security Advisory reports: Normally, information about time-tracking estimated hours, actual hours, hours worked, and deadlines is restricted to users in the "time-tracking group". However, any user was able, by crafting their own search URL, to search for bugs based using those fields...

mozilla -- multiple vulnerabilities

Mozilla Project reports: MFSA 2010-33 User tracking across sites using Math.random MFSA 2010-32 Content-Disposition: attachment ignored if Content-Type: multipart also present MFSA 2010-31 focus behavior can be used to inject or steal keystrokes MFSA 2010-30 Integer Overflow in XSLT Node Sorting...

opera -- Data URIs can be used to allow cross-site scripting

The Opera Desktop Team reports: Data URIs are allowed to run scripts that manipulate pages from the site that directly opened them. In some cases, the opening site is not correctly detected. In these cases, Data URIs may erroneously be able to run scripts so that they interact with sites that did...

ziproxy -- security vulnerability in PNG decoder

Daniel Mealha Cabrita reports: Fixed security vulnerability heap-related in PNG decoder. new bug from 3.1.0...

wget -- multiple HTTP client download filename vulnerability

GNU Wget version 1.12 and earlier uses a server-provided filename instead of the original URL to determine the destination filename of a download, which allows remote servers to create or overwrite arbitrary files via a 3xx redirect to a URL with a .wgetrc filename followed by a 3xx redirect to a...

p5-libwww -- possibility to remote servers to create file with a .(dot) character

lwp-download in libwww-perl before 5.835 does not reject downloads to filenames that begin with a .' dot character, which allows remote servers to create or overwrite files via a 3xx redirect to a URL with a crafted filename or a Content-Disposition header that suggests a crafted filename, and...

lftp -- multiple HTTP client download filename vulnerability

The get1 command, as used by lftpget, in LFTP before 4.0.6 does not properly validate a server-provided filename before determining the destination filename of a download, which allows remote servers to create or overwrite arbitrary files via a Content-Disposition header that suggests a crafted...

moodle -- multiple vulnerabilities

The Moodle release notes report multiple vulnerabilities which could allow cross site scripting, XSS attacks, unauthorised deletion of attempts in some instances...

horde-base -- XSS and CSRF vulnerabilities

The Horde team reports: Thanks to Naumann IT Security Consulting for reporting the XSS vulnerability. Thanks to Secunia for releasing an advisory for the new CSRF protection in the preference interface The major changes compared to Horde version 3.3.8 are: Fixed XSS vulnerability in...

sudo -- Secure path vulnerability

Todd Miller reports: Most versions of the C library function getenv return the first instance of an environment variable to the caller. However, some programs, notably the GNU Bourne Again SHell bash, do their own environment parsing and may choose the last instance of a variable rather than the...

mediawiki -- two security vulnerabilities

Two security vulnerabilities were discovered: Noncompliant CSS parsing behaviour in Internet Explorer allows attackers to construct CSS strings which are treated as safe by previous versions of MediaWiki, but are decoded to unsafe strings by Internet Explorer. A CSRF vulnerability was discovered ...

FreeBSD -- OPIE off-by-one stack overflow

Problem Description: A programming error in the OPIE library could allow an off-by-one buffer overflow to write a single zero byte beyond the end of an on-stack buffer...

FreeBSD -- Unvalidated input in nfsclient

Problem Description: The NFS client subsystem fails to correctly validate the length of a parameter provided by the user when a filesystem is mounted...

FreeBSD -- Insufficient environment sanitization in jail(8)

Problem Description: The jail8 utility does not change the current working directory while imprisoning. The current working directory can be accessed by its descendants...

mDNSResponder -- corrupted stack crash when parsing bad resolv.conf

Juli Mallett reports: mdnsd will crash on some systems with a corrupt stack and once that's fixed it will still leak a file descriptor when parsing resolv.conf. The crash is because scanf is used with %10s for a buffer that is only 10 chars long. The buffer size needs increased to 11 chars to hol...

cacti -- multiple vulnerabilities

Multiple vulnerabilities have been reported to exist in older version of Cacti. The release notes of Cacti 0.8.7f summarizes the problems as follows: SQL injection and shell escaping issues Cross-site scripting issues Cacti Graph Viewer SQL injection vulnerability...

ziproxy -- atypical huge picture files vulnerability

Ziproxy 3.0.1 release fixes a security vulnerability related to atypical huge picture files 4GB of size once expanded...

tinyproxy -- ACL lists ineffective when range is configured

When including a line to allow a network of IP addresses, the access to tinyproxy 56 is actually allowed for all IP addresses...

kvirc -- multiple vulnerabilities

Two security vulnerabilities have been discovered: Multiple format string vulnerabilities in the DCC functionality in KVIrc 3.4 and 4.0 have unspecified impact and remote attack vectors. Directory traversal vulnerability in the DCC functionality in KVIrc 3.4 and 4.0 allows remote attackers to...

slim -- insecure PATH assignment

SLiM assigns logged on users a PATH in which the current working directory "./" is included. This PATH can allow unintentional code execution through planted binaries and has therefore been fixed SLiM version 1.3.2...

wireshark -- DOCSIS dissector denial of service

A vulnerability found in the DOCSIS dissector can cause Wireshark to crash when a malformed packet trace file is opened. This means that an attacker will have to trick a victim into opening such a trace file before being able to crash the application...

awstats -- arbitrary commands execution vulnerability

Awstats change log reports: Security fix Traverse directory of LoadPlugin Security fix Limit config to defined directory to avoid access to external config file via a nfs or webdav link...

redmine -- multiple vulnerabilities

The Redmine release announcement reports that several cross side scripting vulnerabilities and a potential data disclosure vulnerability have been fixed in the latest release...

quagga -- two DoS vulnerabilities

Quagga developers report: Quagga 0.99.18 has been released. This release fixes 2 denial of services in bgpd, which can be remotely triggered by malformed AS-Pathlimit or Extended-Community attributes. These issues have been assigned CVE-2010-1674 and CVE-2010-1675. Support for AS-Pathlimit has be...

joomla -- multiple vulnerabilities

Joomla! reported the following vulnerabilities: If a user entered a URL with a negative query limit or offset, a PHP notice would display revealing information about the system.. The migration script in the Joomla! installer does not check the file type being uploaded. If the installation...

tomcat -- information disclosure vulnerability

The Apache software foundation reports: The "WWW-Authenticate" header for BASIC and DIGEST authentication includes a realm name. If a element is specified for the application in web.xml it will be used. However, a is not specified then Tomcat will generate one. In some circumstances this can expo...