mirror of
https://git.FreeBSD.org/ports.git
synced 2024-11-26 00:55:14 +00:00
4575763978
- add vuxml entry - let bindings ports load options file [2] [1] Version 1.8.5 (25 November 2013, from /branches/1.8.x) http://svn.apache.org/repos/asf/subversion/tags/1.8.5 User-visible changes: - Client-side bugfixes: * fix externals that point at redirected locations (issues #4428, #4429) * diff: fix assertion with move inside a copy (issue #4444) - Server-side bugfixes: * mod_dav_svn: Prevent crashes with some 3rd party modules (r1537360 et al) * mod_dav_svn: canonicalize paths properly (r1542071) * mod_authz_svn: fix crash of mod_authz_svn with invalid config (r1541432) * hotcopy: fix hotcopy losing revprop files in packed repos (issue #4448) - Other tool improvements and bugfixes: * mod_dontdothat: Fix the uri parser (r1542069 et al) Developer-visible changes: - General: * fix compilation with '--enable-optimize' with clang (r1534860) * fix copmpilation with debug build of BDB on Windows (r1501656, r1501702) * fix '--with-openssl' option when building on Windows (r1535139) * add test to fail when built against broken ZLib (r1537193 et al) - Bindings: * swig-rb: fix tests to run without installing on OS X (r1535161) * ctypes-python: build with compiler selected via configure (r1536537) Version 1.7.14 (25 Nov 2013, from /branches/1.7.x) http://svn.apache.org/repos/asf/subversion/tags/1.7.14 User-visible changes: - Client- and server-side bugfixes: * fix assertion on urls of the form 'file://./' (r1516806) - Client-side bugfixes: * upgrade: fix an assertion when used with pre-1.3 wcs (r1530849) * ra_local: fix error with repository in Windows drive root (r1518184) * fix crash on windows when piped command is interrupted (r1522892) * fix externals that point at redirected locations (issues #4428, #4429) * diff: fix incorrect calculation of changes in some cases (issue #4283) * diff: fix errors with added/deleted targets (issues #4153, #4421) - Server-side bugfixes: * mod_dav_svn: Prevent crashes with some 3rd party modules (r1537360 et al) * fix OOM on concurrent requests at threaded server start (r1527103 et al) * fsfs: limit commit time of files with deep change histories (r1536790) * mod_dav_svn: canonicalize paths properly (r1542071) - Other tool improvements and bugfixes: * mod_dontdothat: Fix the uri parser (r1542069 et al) Developer-visible changes: - Bindings: * javahl: canonicalize path for streamFileContent method (r1524869) [2] - Set OPTIONS_NAME to let bindings ports load the new options file. Leave OPTIONSFILE for now to load the old file on systems where it hasn't been moved to the new location yet. - Remove an old hack. PR: ports/180612 [2] Submitted by: Tijl Coosemans <tijl@FreeBSD.org> Security: e3244a7b-5603-11e3-878d-20cf30e32f6d CVE-2013-4505 CVE-2013-4558
83543 lines
2.9 MiB
83543 lines
2.9 MiB
<?xml version="1.0" encoding="utf-8"?>
|
|
<!DOCTYPE vuxml PUBLIC "-//vuxml.org//DTD VuXML 1.1//EN" "http://www.vuxml.org/dtd/vuxml-1/vuxml-11.dtd">
|
|
<!--
|
|
Copyright 2003-2013 Jacques Vidrine and contributors
|
|
|
|
Redistribution and use in source (VuXML) and 'compiled' forms (SGML,
|
|
HTML, PDF, PostScript, RTF and so forth) with or without modification,
|
|
are permitted provided that the following conditions are met:
|
|
1. Redistributions of source code (VuXML) must retain the above
|
|
copyright notice, this list of conditions and the following
|
|
disclaimer as the first lines of this file unmodified.
|
|
2. Redistributions in compiled form (transformed to other DTDs,
|
|
published online in any format, converted to PDF, PostScript,
|
|
RTF and other formats) must reproduce the above copyright
|
|
notice, this list of conditions and the following disclaimer
|
|
in the documentation and/or other materials provided with the
|
|
distribution.
|
|
|
|
THIS DOCUMENTATION IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS "AS IS"
|
|
AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
|
|
THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
|
|
PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS
|
|
BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
|
|
OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT
|
|
OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
|
|
BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
|
|
WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
|
|
OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS DOCUMENTATION,
|
|
EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
|
|
|
$FreeBSD$
|
|
|
|
|
|
QUICK GUIDE TO ADDING A NEW ENTRY
|
|
|
|
1. run 'make newentry' to add a template to the top of the document
|
|
2. fill in the template
|
|
3. use 'make validate' to verify syntax correctness (you might need to install
|
|
textproc/libxml2 for parser, and this port for catalogs)
|
|
4. fix any errors
|
|
5. profit!
|
|
|
|
Extensive documentation of the format and help with writing and verifying
|
|
a new entry is available in The Porter's Handbook at:
|
|
|
|
http://www.freebsd.org/doc/en/books/porters-handbook/security-notify.html
|
|
|
|
Help is also available from ports-security@freebsd.org.
|
|
|
|
Note: Please add new entries to the beginning of this file.
|
|
|
|
-->
|
|
<vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">
|
|
<vuln vid="e3244a7b-5603-11e3-878d-20cf30e32f6d">
|
|
<topic>subversion -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>subversion</name>
|
|
<range><ge>1.8.0</ge><lt>1.8.5</lt></range>
|
|
<range><ge>1.7.0</ge><lt>1.7.14</lt></range>
|
|
<range><ge>1.6.0</ge><lt>1.6.24</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Subversion Project reports:</p>
|
|
<blockquote cite="http://subversion.apache.org/security/">
|
|
<p>mod_dontdothat does not restrict requests from serf based clients</p>
|
|
<p>mod_dontdothat allows you to block update REPORT requests against certain
|
|
paths in the repository. It expects the paths in the REPORT request
|
|
to be absolute URLs. Serf based clients send relative URLs instead
|
|
of absolute URLs in many cases. As a result these clients are not blocked
|
|
as configured by mod_dontdothat.</p>
|
|
<p>mod_dav_svn assertion triggered by non-canonical URLs in autoversioning commits</p>
|
|
<p>When SVNAutoversioning is enabled via SVNAutoversioning on
|
|
commits can be made by single HTTP requests such as MKCOL and
|
|
PUT. If Subversion is built with assertions enabled any such
|
|
requests that have non-canonical URLs, such as URLs with a
|
|
trailing /, may trigger an assert. An assert will cause the
|
|
Apache process to abort.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-4505</cvename>
|
|
<cvename>CVE-2013-4558</cvename>
|
|
<url>http://subversion.apache.org/security/CVE-2013-4505-advisory.txt</url>
|
|
<url>http://subversion.apache.org/security/CVE-2013-4558-advisory.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-11-15</discovery>
|
|
<entry>2013-11-25</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="742eb9e4-e3cb-4f5a-b94e-0e9a39420600">
|
|
<topic>ruby-gems -- Algorithmic Complexity Vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>ruby19-gems</name>
|
|
<range><lt>1.8.27</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>ruby20-gems</name>
|
|
<range><lt>1.8.27</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Ruby Gem developers report:</p>
|
|
<blockquote cite="http://blog.rubygems.org/2013/09/24/CVE-2013-4363.html">
|
|
<p>The patch for CVE-2013-4363 was insufficiently verified so the
|
|
combined regular expression for verifying gem version remains
|
|
vulnerable following CVE-2013-4363.</p>
|
|
<p>RubyGems validates versions with a regular expression that is
|
|
vulnerable to denial of service due to backtracking. For specially
|
|
crafted RubyGems versions attackers can cause denial of service
|
|
through CPU consumption.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-4363</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-09-24</discovery>
|
|
<entry>2013-11-24</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="54237182-9635-4a8b-92d7-33bfaeed84cd">
|
|
<topic>ruby-gems -- Algorithmic Complexity Vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>ruby19-gems</name>
|
|
<range><lt>1.8.26</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>ruby20-gems</name>
|
|
<range><lt>1.8.26</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Ruby Gem developers report:</p>
|
|
<blockquote cite="http://blog.rubygems.org/2013/09/09/CVE-2013-4287.html">
|
|
<p>RubyGems validates versions with a regular expression that is
|
|
vulnerable to denial of service due to backtracking. For specially
|
|
crafted RubyGems versions attackers can cause denial of service
|
|
through CPU consumption.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-4287</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-09-09</discovery>
|
|
<entry>2013-11-24</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="cc9043cf-7f7a-426e-b2cc-8d1980618113">
|
|
<topic>ruby -- Heap Overflow in Floating Point Parsing</topic>
|
|
<affects>
|
|
<package>
|
|
<name>ruby19</name>
|
|
<range><lt>1.9.3.484,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>ruby20</name>
|
|
<range><lt>2.0.0.353,1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Ruby developers report:</p>
|
|
<blockquote cite="https://www.ruby-lang.org/en/news/2013/11/22/heap-overflow-in-floating-point-parsing-cve-2013-4164/">
|
|
<p>Any time a string is converted to a floating point value, a
|
|
specially crafted string can cause a heap overflow. This can lead
|
|
to a denial of service attack via segmentation faults and possibly
|
|
arbitrary code execution. Any program that converts input of
|
|
unknown origin to floating point values (especially common when
|
|
accepting JSON) are vulnerable.
|
|
</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>https://www.ruby-lang.org/en/news/2013/11/22/ruby-1-9-3-p484-is-released/</url>
|
|
<url>https://www.ruby-lang.org/en/news/2013/11/22/ruby-2-0-0-p353-is-released/</url>
|
|
<cvename>CVE-2013-4164</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-11-22</discovery>
|
|
<entry>2013-11-23</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="479efd57-516e-11e3-9b62-000c292e4fd8">
|
|
<topic>samba -- Private key in key.pem world readable</topic>
|
|
<affects>
|
|
<package>
|
|
<name>samba4</name>
|
|
<range><gt>4.0.*</gt><lt>4.0.11</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>samba41</name>
|
|
<range><gt>4.1.*</gt><lt>4.1.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Samba project reports:</p>
|
|
<blockquote cite="http://www.samba.org/samba/security/CVE-2013-4476">
|
|
<p>Samba 4.0.x before 4.0.11 and 4.1.x before 4.1.1, when LDAP or HTTP is
|
|
provided over SSL, uses world-readable permissions for a private key,
|
|
which allows local users to obtain sensitive information by reading the
|
|
key file, as demonstrated by access to the local filesystem on an AD
|
|
domain controller.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-4476</cvename>
|
|
<url>http://www.samba.org/samba/security/CVE-2013-4476</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-06-12</discovery>
|
|
<entry>2013-11-19</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="a4f08579-516c-11e3-9b62-000c292e4fd8">
|
|
<topic>samba -- ACLs are not checked on opening an alternate data stream on a file or directory</topic>
|
|
<affects>
|
|
<package>
|
|
<name>samba34</name>
|
|
<range><gt>0</gt></range>
|
|
</package>
|
|
<package>
|
|
<name>samba35</name>
|
|
<range><gt>0</gt></range>
|
|
</package>
|
|
<package>
|
|
<name>samba36</name>
|
|
<range><gt>3.6.*</gt><lt>3.6.20</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>samba4</name>
|
|
<range><gt>4.0.*</gt><lt>4.0.11</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>samba41</name>
|
|
<range><gt>4.1.*</gt><lt>4.1.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Samba project reports:</p>
|
|
<blockquote cite="http://www.samba.org/samba/security/CVE-2013-4475">
|
|
<p>Samba versions 3.2.0 and above (all versions of 3.2.x, 3.3.x,
|
|
3.4.x, 3.5.x, 3.6.x, 4.0.x and 4.1.x) do not check the underlying
|
|
file or directory ACL when opening an alternate data stream.</p>
|
|
<p>According to the SMB1 and SMB2+ protocols the ACL on an underlying
|
|
file or directory should control what access is allowed to alternate
|
|
data streams that are associated with the file or directory.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-4475</cvename>
|
|
<url>http://www.samba.org/samba/security/CVE-2013-4475</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-06-12</discovery>
|
|
<entry>2013-11-19</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="94b6264a-5140-11e3-8b22-f0def16c5c1b">
|
|
<topic>nginx -- Request line parsing vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>nginx</name>
|
|
<range><ge>0.8.41</ge><lt>1.4.4,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>nginx-devel</name>
|
|
<range><ge>0.8.41</ge><lt>1.5.7</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The nginx project reports:</p>
|
|
<blockquote cite="http://mailman.nginx.org/pipermail/nginx-announce/2013/000125.html">
|
|
<p>Ivan Fratric of the Google Security Team discovered a bug in nginx, which might
|
|
allow an attacker to bypass security restrictions in certain configurations by
|
|
using a specially crafted request, or might have potential other impact
|
|
(CVE-2013-4547).</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-4547</cvename>
|
|
<url>http://mailman.nginx.org/pipermail/nginx-announce/2013/000125.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-11-19</discovery>
|
|
<entry>2013-11-19</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="e62ab2af-4df4-11e3-b0cf-00262d5ed8ee">
|
|
<topic>chromium -- multiple memory corruption issues</topic>
|
|
<affects>
|
|
<package>
|
|
<name>chromium</name>
|
|
<range><lt>31.0.1650.57</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Google Chrome Releases reports:</p>
|
|
<blockquote cite="http://googlechromereleases.blogspot.nl/">
|
|
<p>[319117] [319125] Critical CVE-2013-6632: Multiple memory
|
|
corruption issues. Credit to Pinkie Pie.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-6632</cvename>
|
|
<url>http://googlechromereleases.blogspot.nl/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-11-14</discovery>
|
|
<entry>2013-11-15</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="adcbdba2-4c27-11e3-9848-98fc11cdc4f5">
|
|
<topic>linux-flashplugin -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>linux-f10-flashplugin</name>
|
|
<range><lt>11.2r202.327</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Adobe reports:</p>
|
|
<blockquote cite="http://www.adobe.com/support/security/bulletins/apsb13-26.html">
|
|
<p>These updates address vulnerabilities that could cause a crash
|
|
and potentially allow an attacker to take control of the affected system.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-5329</cvename>
|
|
<cvename>CVE-2013-5330</cvename>
|
|
<url>http://www.adobe.com/support/security/bulletins/apsb13-26.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-11-12</discovery>
|
|
<entry>2013-11-12</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="3bfc7016-4bcc-11e3-b0cf-00262d5ed8ee">
|
|
<topic>chromium -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>chromium</name>
|
|
<range><lt>31.0.1650.48</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Google Chrome Releases reports:</p>
|
|
<blockquote cite="http://googlechromereleases.blogspot.nl/">
|
|
<p>25 security fixes in this release, including:</p>
|
|
<ul>
|
|
<li>[268565] Medium CVE-2013-6621: Use after free related to speech input elements.
|
|
Credit to Khalil Zhani.</li>
|
|
<li>[272786] High CVE-2013-6622: Use after free related to media elements. Credit
|
|
to cloudfuzzer.</li>
|
|
<li>[282925] High CVE-2013-6623: Out of bounds read in SVG. Credit to miaubiz.</li>
|
|
<li>[290566] High CVE-2013-6624: Use after free related to “id” attribute strings.
|
|
Credit to Jon Butler.</li>
|
|
<li>[295010] High CVE-2013-6625: Use after free in DOM ranges. Credit to
|
|
cloudfuzzer.</li>
|
|
<li>[295695] Low CVE-2013-6626: Address bar spoofing related to interstitial
|
|
warnings. Credit to Chamal de Silva.</li>
|
|
<li>[299892] High CVE-2013-6627: Out of bounds read in HTTP parsing. Credit to
|
|
skylined.</li>
|
|
<li>[306959] Medium CVE-2013-6628: Issue with certificates not being checked
|
|
during TLS renegotiation. Credit to Antoine Delignat-Lavaud and Karthikeyan
|
|
Bhargavan from Prosecco of INRIA Paris.</li>
|
|
<li>[315823] Medium-Critical CVE-2013-2931: Various fixes from internal audits,
|
|
fuzzing and other initiatives.</li>
|
|
<li>[258723] Medium CVE-2013-6629: Read of uninitialized memory in libjpeg and
|
|
libjpeg-turbo. Credit to Michal Zalewski of Google.</li>
|
|
<li>[299835] Medium CVE-2013-6630: Read of uninitialized memory in libjpeg-turbo.
|
|
Credit to Michal Zalewski of Google.</li>
|
|
<li>[296804] High CVE-2013-6631: Use after free in libjingle. Credit to Patrik
|
|
Höglund of the Chromium project.</li>
|
|
</ul>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-2931</cvename>
|
|
<cvename>CVE-2013-6621</cvename>
|
|
<cvename>CVE-2013-6622</cvename>
|
|
<cvename>CVE-2013-6623</cvename>
|
|
<cvename>CVE-2013-6624</cvename>
|
|
<cvename>CVE-2013-6625</cvename>
|
|
<cvename>CVE-2013-6626</cvename>
|
|
<cvename>CVE-2013-6627</cvename>
|
|
<cvename>CVE-2013-6628</cvename>
|
|
<cvename>CVE-2013-6629</cvename>
|
|
<cvename>CVE-2013-6630</cvename>
|
|
<cvename>CVE-2013-6631</cvename>
|
|
<url>http://googlechromereleases.blogspot.nl/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-11-12</discovery>
|
|
<entry>2013-11-12</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="5709d244-4873-11e3-8a46-000d601460a4">
|
|
<topic>OpenSSH -- Memory corruption in sshd</topic>
|
|
<affects>
|
|
<package>
|
|
<name>openssh-portable</name>
|
|
<range><ge>6.2.p2,1</ge><lt>6.4.p1,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>openssh-portable-base</name>
|
|
<range><ge>6.2.p2,1</ge><lt>6.4.p1,1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The OpenSSH development team reports:</p>
|
|
<blockquote cite="http://www.openssh.com/txt/gcmrekey.adv">
|
|
<p>A memory corruption vulnerability exists in the post-
|
|
authentication sshd process when an AES-GCM cipher
|
|
(aes128-gcm@openssh.com or aes256-gcm@openssh.com) is
|
|
selected during kex exchange.
|
|
|
|
If exploited, this vulnerability might permit code execution
|
|
with the privileges of the authenticated user and may
|
|
therefore allow bypassing restricted shell/command
|
|
configurations.</p>
|
|
<p>Either upgrade to 6.4 or disable AES-GCM in the server
|
|
configuration. The following sshd_config option will disable
|
|
AES-GCM while leaving other ciphers active:
|
|
|
|
Ciphers aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc
|
|
</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://www.openssh.com/txt/gcmrekey.adv</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-11-07</discovery>
|
|
<entry>2013-11-08</entry>
|
|
<modified>2013-11-13</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="f969bad7-46fc-11e3-b6ee-00269ee29e57">
|
|
<topic>Quassel IRC -- SQL injection vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>quassel</name>
|
|
<range><lt>0.9.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Quassel IRC developers report:</p>
|
|
<blockquote cite="http://www.quassel-irc.org/node/120">
|
|
<p>SQL injection vulnerability in Quassel IRC before 0.9.1,
|
|
when Qt 4.8.5 or later and PostgreSQL 8.2 or later are used,
|
|
allows remote attackers to execute arbitrary SQL commands via
|
|
a \ (backslash) in a message.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-4422</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-10-07</discovery>
|
|
<entry>2013-11-06</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="81f866ad-41a4-11e3-a4af-0025905a4771">
|
|
<topic>mozilla -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>firefox</name>
|
|
<range><lt>24.1.0,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-firefox</name>
|
|
<range><lt>25.0,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-seamonkey</name>
|
|
<range><lt>2.22</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-thunderbird</name>
|
|
<range><lt>24.1.0</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>seamonkey</name>
|
|
<range><lt>2.22</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>thunderbird</name>
|
|
<range><lt>24.1.0</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Mozilla Project reports:</p>
|
|
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
|
|
<p> MFSA 2013-93 Miscellaneous memory safety hazards (rv:25.0 /
|
|
rv:24.1 / rv:17.0.10)</p>
|
|
<p> MFSA 2013-94 Spoofing addressbar though SELECT element</p>
|
|
<p> MFSA 2013-95 Access violation with XSLT and uninitialized data</p>
|
|
<p> MFSA 2013-96 Improperly initialized memory and overflows in some
|
|
JavaScript functions</p>
|
|
<p> MFSA 2013-97 Writing to cycle collected object during image
|
|
decoding</p>
|
|
<p> MFSA 2013-98 Use-after-free when updating offline cache</p>
|
|
<p> MFSA 2013-99 Security bypass of PDF.js checks using iframes</p>
|
|
<p> MFSA 2013-100 Miscellaneous use-after-free issues found through
|
|
ASAN fuzzing</p>
|
|
<p> MFSA 2013-101 Memory corruption in workers</p>
|
|
<p> MFSA 2013-102 Use-after-free in HTML document templates</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-1739</cvename>
|
|
<cvename>CVE-2013-5590</cvename>
|
|
<cvename>CVE-2013-5591</cvename>
|
|
<cvename>CVE-2013-5592</cvename>
|
|
<cvename>CVE-2013-5593</cvename>
|
|
<cvename>CVE-2013-5595</cvename>
|
|
<cvename>CVE-2013-5596</cvename>
|
|
<cvename>CVE-2013-5597</cvename>
|
|
<cvename>CVE-2013-5598</cvename>
|
|
<cvename>CVE-2013-5599</cvename>
|
|
<cvename>CVE-2013-5600</cvename>
|
|
<cvename>CVE-2013-5601</cvename>
|
|
<cvename>CVE-2013-5602</cvename>
|
|
<cvename>CVE-2013-5603</cvename>
|
|
<cvename>CVE-2013-5604</cvename>
|
|
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-93.html</url>
|
|
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-94.html</url>
|
|
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-95.html</url>
|
|
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-96.html</url>
|
|
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-97.html</url>
|
|
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-98.html</url>
|
|
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-99.html</url>
|
|
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-100.html</url>
|
|
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-101.html</url>
|
|
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-102.html</url>
|
|
<url>http://www.mozilla.org/security/known-vulnerabilities/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-10-29</discovery>
|
|
<entry>2013-10-30</entry>
|
|
<modified>2013-10-31</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="4e23644c-cb93-4f83-9e20-5bc07ad9b39f">
|
|
<topic>mod_pagespeed -- critical cross-site scripting (XSS) vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>mod_pagespeed</name>
|
|
<range><lt>1.2.24.2,1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>mod_pagespeed developers report:</p>
|
|
<blockquote cite="https://groups.google.com/forum/#!msg/mod-pagespeed-announce/oo015UHRxMc/JcAuf1hE8L8J">
|
|
<p>Various versions of mod_pagespeed are subject to critical
|
|
cross-site scripting (XSS) vulnerability, CVE-2013-6111. This
|
|
permits a hostile third party to execute JavaScript in users'
|
|
browsers in context of the domain running mod_pagespeed, which
|
|
could permit theft of users' cookies or data on the site.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-6111</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-10-04</discovery>
|
|
<entry>2013-10-28</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="cd082cc6-1548-4b8d-a3aa-a007be611a29">
|
|
<cancelled/>
|
|
</vuln>
|
|
|
|
<vuln vid="9065b930-3d8b-11e3-bd1a-e840f2096bd0">
|
|
<topic>gnutls -- denial of service</topic>
|
|
<affects>
|
|
<package>
|
|
<name>gnutls3</name>
|
|
<range><lt>3.1.16</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Salvatore Bonaccorso reports:</p>
|
|
<blockquote cite="http://www.gnutls.org/security.html#GNUTLS-SA-2013-3">
|
|
<p>This vulnerability affects the DANE library of gnutls 3.1.x and
|
|
gnutls 3.2.x. A server that returns more 4 DANE entries could
|
|
corrupt the memory of a requesting client.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-4466</cvename>
|
|
<url>http://www.gnutls.org/security.html#GNUTLS-SA-2013-3</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-10-25</discovery>
|
|
<entry>2013-10-25</entry>
|
|
<modified>2013-11-01</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="9a57c607-3cab-11e3-b4d9-bcaec565249c">
|
|
<topic>xorg-server -- use after free</topic>
|
|
<affects>
|
|
<package>
|
|
<name>xorg-server</name>
|
|
<range><ge>1.7.0</ge><lt>1.7.7_11</lt></range>
|
|
<range><ge>1.12.0</ge><lt>1.12.4_4</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Alan Coopersmith reports:</p>
|
|
<blockquote cite="http://lists.x.org/archives/xorg-announce/2013-October/002332.html">
|
|
<p>Pedro Ribeiro (pedrib at gmail.com) reported an issue to the X.Org
|
|
security team in which an authenticated X client can cause an X
|
|
server to use memory after it was freed, potentially leading to
|
|
crash and/or memory corruption.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-4396</cvename>
|
|
<url>http://lists.x.org/archives/xorg-announce/2013-October/002332.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-10-08</discovery>
|
|
<entry>2013-10-24</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="c0f122e2-3897-11e3-a084-3c970e169bc2">
|
|
<topic>pycrypto -- PRNG reseed race condition</topic>
|
|
<affects>
|
|
<package>
|
|
<name>py26-pycrypto</name>
|
|
<name>py27-pycrypto</name>
|
|
<name>py31-pycrypto</name>
|
|
<name>py32-pycrypto</name>
|
|
<name>py33-pycrypto</name>
|
|
<range><lt>2.6.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Dwayne Litzenberger reports:</p>
|
|
<blockquote cite="http://lists.dlitz.net/pipermail/pycrypto/2013q4/000702.html">
|
|
<p>In PyCrypto before v2.6.1, the Crypto.Random pseudo-random
|
|
number generator (PRNG) exhibits a race condition that may cause
|
|
it to generate the same 'random' output in multiple processes that
|
|
are forked from each other. Depending on the application, this
|
|
could reveal sensitive information or cryptographic keys to remote
|
|
attackers.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-1445</cvename>
|
|
<url>http://lists.dlitz.net/pipermail/pycrypto/2013q4/000702.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-10-17</discovery>
|
|
<entry>2013-10-19</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="043d3a78-f245-4938-9bc7-3d0d35dd94bf">
|
|
<topic>wordpress -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>zh-wordpress-zh_CN</name>
|
|
<name>zh-wordpress-zh_TW</name>
|
|
<name>de-wordpress</name>
|
|
<name>ja-wordpress</name>
|
|
<name>ru-wordpress</name>
|
|
<name>wordpress</name>
|
|
<range><lt>3.6.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The wordpress development team reports:</p>
|
|
<blockquote cite="http://wordpress.org/news/2013/09/wordpress-3-6-1/">
|
|
<ul>
|
|
<li>Block unsafe PHP unserialization that could occur in limited
|
|
situations and setups, which can lead to remote code
|
|
execution.</li>
|
|
<li>Prevent a user with an Author role, using a specially crafted
|
|
request, from being able to create a post "written by" another
|
|
user.</li>
|
|
<li>Fix insufficient input validation that could result in
|
|
redirecting or leading a user to another website.</li>
|
|
</ul>
|
|
<p>Additionally, we've adjusted security restrictions around file
|
|
uploads to mitigate the potential for cross-site scripting.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-4338</cvename>
|
|
<cvename>CVE-2013-4339</cvename>
|
|
<cvename>CVE-2013-4340</cvename>
|
|
<cvename>CVE-2013-5738</cvename>
|
|
<cvename>CVE-2013-5739</cvename>
|
|
<url>http://wordpress.org/news/2013/09/wordpress-3-6-1/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-09-11</discovery>
|
|
<entry>2013-10-19</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="206f9826-a06d-4927-9a85-771c37010b32">
|
|
<topic>node.js -- DoS Vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>node</name>
|
|
<range><lt>0.10.21</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>node-devel</name>
|
|
<range><lt>0.11.7</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>node.js developers report</p>
|
|
<blockquote cite="http://blog.nodejs.org/2013/10/18/node-v0-10-21-stable/">
|
|
<p>This release contains a security fix for the http server implementation, please upgrade as soon as possible.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://blog.nodejs.org/2013/10/18/node-v0-10-21-stable/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-10-19</discovery>
|
|
<entry>2013-10-19</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="e135f0c9-375f-11e3-80b7-20cf30e32f6d">
|
|
<topic>bugzilla -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>bugzilla</name>
|
|
<name>bugzilla40</name>
|
|
<name>bugzilla42</name>
|
|
<name>bugzilla44</name>
|
|
<range><ge>4.0.0</ge><lt>4.0.11</lt></range>
|
|
<range><ge>4.2.0</ge><lt>4.2.7</lt></range>
|
|
<range><ge>4.4</ge><lt>4.4.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<h1>A Bugzilla Security Advisory reports:</h1>
|
|
<blockquote cite="http://www.bugzilla.org/security/4.0.10/">
|
|
<h1>Cross-Site Request Forgery</h1>
|
|
<p>When a user submits changes to a bug right after another
|
|
user did, a midair collision page is displayed to inform
|
|
the user about changes recently made. This page contains
|
|
a token which can be used to validate the changes if the
|
|
user decides to submit his changes anyway. A regression
|
|
in Bugzilla 4.4 caused this token to be recreated if a
|
|
crafted URL was given, even when no midair collision page
|
|
was going to be displayed, allowing an attacker to bypass
|
|
the token check and abuse a user to commit changes on his
|
|
behalf.</p>
|
|
<h1>Cross-Site Request Forgery</h1>
|
|
<p>When an attachment is edited, a token is generated to
|
|
validate changes made by the user. Using a crafted URL,
|
|
an attacker could force the token to be recreated,
|
|
allowing him to bypass the token check and abuse a user
|
|
to commit changes on his behalf.</p>
|
|
<h1>Cross-Site Scripting</h1>
|
|
<p>Some parameters passed to editflagtypes.cgi were not
|
|
correctly filtered in the HTML page, which could lead
|
|
to XSS.</p>
|
|
<h1>Cross-Site Scripting</h1>
|
|
<p>Due to an incomplete fix for CVE-2012-4189, some
|
|
incorrectly filtered field values in tabular reports
|
|
could lead to XSS.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-1733</cvename>
|
|
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=911593</url>
|
|
<cvename>CVE-2013-1734</cvename>
|
|
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=913904</url>
|
|
<cvename>CVE-2013-1742</cvename>
|
|
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=924802</url>
|
|
<cvename>CVE-2013-1743</cvename>
|
|
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=924932</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-10-16</discovery>
|
|
<entry>2013-10-17</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="8c9b48d1-3715-11e3-a624-00262d8b701d">
|
|
<topic>dropbear -- exposure of sensitive information, DoS</topic>
|
|
<affects>
|
|
<package>
|
|
<name>dropbear</name>
|
|
<range><ge>2012.55</ge><lt>2013.59</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Dropbear project reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/55173/">
|
|
<p>A weakness and a vulnerability have been reported in Dropbear
|
|
SSH Server, which can be exploited by malicious people to disclose
|
|
certain sensitive information and cause a DoS.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>62958</bid>
|
|
<bid>62993</bid>
|
|
<cvename>CVE-2013-4421</cvename>
|
|
<cvename>CVE-2013-4434</cvename>
|
|
<url>http://secunia.com/advisories/55173</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-05-08</discovery>
|
|
<!-- discovery>2013-10-03</discovery -->
|
|
<entry>2013-10-17</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="710cd5d5-35cb-11e3-85f9-00262d5ed8ee">
|
|
<topic>chromium -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>chromium</name>
|
|
<range><lt>30.0.1599.101</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Google Chrome Releases reports:</p>
|
|
<blockquote cite="http://googlechromereleases.blogspot.nl/">
|
|
<p>5 security fixes in this release, including:</p>
|
|
<ul>
|
|
<li>[292422] High CVE-2013-2925: Use after free in XHR. Credit to
|
|
Atte Kettunen of OUSPG.</li>
|
|
<li>[294456] High CVE-2013-2926: Use after free in editing. Credit
|
|
to cloudfuzzer.</li>
|
|
<li>[297478] High CVE-2013-2927: Use after free in forms. Credit
|
|
to cloudfuzzer.</li>
|
|
<li>[305790] High CVE-2013-2928: Various fixes from internal
|
|
audits, fuzzing and other initiatives.</li>
|
|
</ul>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-2925</cvename>
|
|
<cvename>CVE-2013-2926</cvename>
|
|
<cvename>CVE-2013-2927</cvename>
|
|
<cvename>CVE-2013-2928</cvename>
|
|
<url>http://googlechromereleases.blogspot.nl/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-10-15</discovery>
|
|
<entry>2013-10-15</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="9003b500-31e3-11e3-b0d0-20cf30e32f6d">
|
|
<topic>mod_fcgid -- possible heap buffer overwrite</topic>
|
|
<affects>
|
|
<package>
|
|
<name>ap22-mod_fcgid</name>
|
|
<range><lt>2.3.9</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>ap24-mod_fcgid</name>
|
|
<range><lt>2.3.9</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Apache Project reports:</p>
|
|
<blockquote cite="https://mail-archives.apache.org/mod_mbox/httpd-cvs/201309.mbox/%3C20130929174048.13B962388831@eris.apache.org%3E">
|
|
<p>Fix possible heap buffer overwrite.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-4365</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-09-29</discovery>
|
|
<entry>2013-10-10</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="749b5587-2da1-11e3-b1a9-b499baab0cbe">
|
|
<topic>gnupg -- possible infinite recursion in the compressed packet parser</topic>
|
|
<affects>
|
|
<package>
|
|
<name>gnupg</name>
|
|
<range><lt>1.4.15</lt></range>
|
|
<range><ge>2.0.0</ge><lt>2.0.22</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Werner Koch reports:</p>
|
|
<blockquote cite="http://lists.gnupg.org/pipermail/gnupg-announce/2013q4/000333.html">
|
|
<p>Special crafted input data may be used to cause a denial of service
|
|
against GPG (GnuPG's OpenPGP part) and some other OpenPGP
|
|
implementations. All systems using GPG to process incoming data are
|
|
affected..</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-4402</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-10-05</discovery>
|
|
<entry>2013-10-05</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="5c34664f-2c2b-11e3-87c2-00215af774f0">
|
|
<topic>xinetd -- ignores user and group directives for TCPMUX services</topic>
|
|
<affects>
|
|
<package>
|
|
<name>xinetd</name>
|
|
<range><lt>2.3.15_1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>xinetd would execute configured TCPMUX services without dropping
|
|
privilege to match the service configuration allowing the service to
|
|
run with same privilege as the xinetd process (root).</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-4342</cvename>
|
|
<url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=324678</url>
|
|
<url>https://bugzilla.redhat.com/show_bug.cgi?id=1006100</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-08-23</discovery>
|
|
<entry>2013-10-03</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="ccefac3e-2aed-11e3-af10-000c29789cb5">
|
|
<topic>polarssl -- Timing attack against protected RSA-CRT implementation</topic>
|
|
<affects>
|
|
<package>
|
|
<name>polarssl</name>
|
|
<range><lt>1.2.9</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>PolarSSL Project reports:</p>
|
|
<blockquote cite="https://polarssl.org/tech-updates/security-advisories/polarssl-security-advisory-2013-05">
|
|
<p>The researchers Cyril Arnaud and Pierre-Alain Fouque
|
|
investigated the PolarSSL RSA implementation and discovered
|
|
a bias in the implementation of the Montgomery multiplication
|
|
that we used. For which they then show that it can be used to
|
|
mount an attack on the RSA key. Although their test attack is
|
|
done on a local system, there seems to be enough indication
|
|
that this can properly be performed from a remote system as
|
|
well.</p>
|
|
<p>All versions prior to PolarSSL 1.2.9 and 1.3.0 are affected
|
|
if a third party can send arbitrary handshake messages to your
|
|
server.</p>
|
|
<p>If correctly executed, this attack reveals the entire private
|
|
RSA key after a large number of attack messages (> 600.000 on
|
|
a local machine) are sent to show the timing differences.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-5915</cvename>
|
|
<url>https://polarssl.org/tech-updates/security-advisories/polarssl-security-advisory-2013-05</url>
|
|
<url>https://polarssl.org/tech-updates/releases/polarssl-1.2.9-released</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-10-01</discovery>
|
|
<entry>2013-10-02</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="e5414d0c-2ade-11e3-821d-00262d5ed8ee">
|
|
<topic>chromium -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>chromium</name>
|
|
<range><lt>30.0.1599.66</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Google Chrome Releases reports:</p>
|
|
<blockquote cite="http://googlechromereleases.blogspot.nl/">
|
|
<p>50 security fixes in this release, including:</p>
|
|
<ul>
|
|
<li>[223962][270758][271161][284785][284786] Medium CVE-2013-2906:
|
|
Races in Web Audio. Credit to Atte Kettunen of OUSPG.</li>
|
|
<li>[260667] Medium CVE-2013-2907: Out of bounds read in
|
|
Window.prototype object. Credit to Boris Zbarsky.</li>
|
|
<li>[265221] Medium CVE-2013-2908: Address bar spoofing related to
|
|
the “204 No Content” status code. Credit to Chamal de Silva.</li>
|
|
<li>[265838][279277] High CVE-2013-2909: Use after free in
|
|
inline-block rendering. Credit to Atte Kettunen of OUSPG.</li>
|
|
<li>[269753] Medium CVE-2013-2910: Use-after-free in Web Audio.
|
|
Credit to Byoungyoung Lee of Georgia Tech Information Security
|
|
Center (GTISC).</li>
|
|
<li>[271939] High CVE-2013-2911: Use-after-free in XSLT. Credit to
|
|
Atte Kettunen of OUSPG.</li>
|
|
<li>[276368] High CVE-2013-2912: Use-after-free in PPAPI. Credit to
|
|
Chamal de Silva and 41.w4r10r(at)garage4hackers.com.</li>
|
|
<li>[278908] High CVE-2013-2913: Use-after-free in XML document
|
|
parsing. Credit to cloudfuzzer.</li>
|
|
<li>[279263] High CVE-2013-2914: Use after free in the Windows
|
|
color chooser dialog. Credit to Khalil Zhani.</li>
|
|
<li>[280512] Low CVE-2013-2915: Address bar spoofing via a
|
|
malformed scheme. Credit to Wander Groeneveld. </li>
|
|
<li>[281256] High CVE-2013-2916: Address bar spoofing related to
|
|
the “204 No Content” status code. Credit to Masato Kinugawa.</li>
|
|
<li>[281480] Medium CVE-2013-2917: Out of bounds read in Web Audio.
|
|
Credit to Byoungyoung Lee and Tielei Wang of Georgia Tech
|
|
Information Security Center (GTISC).</li>
|
|
<li>[282088] High CVE-2013-2918: Use-after-free in DOM. Credit to
|
|
Byoungyoung Lee of Georgia Tech Information Security Center
|
|
(GTISC).</li>
|
|
<li>[282736] High CVE-2013-2919: Memory corruption in V8. Credit to
|
|
Adam Haile of Concrete Data.</li>
|
|
<li>[285742] Medium CVE-2013-2920: Out of bounds read in URL
|
|
parsing. Credit to Atte Kettunen of OUSPG.</li>
|
|
<li>[286414] High CVE-2013-2921: Use-after-free in resource loader.
|
|
Credit to Byoungyoung Lee and Tielei Wang of Georgia Tech
|
|
Information Security Center (GTISC).</li>
|
|
<li>[286975] High CVE-2013-2922: Use-after-free in template
|
|
element. Credit to Jon Butler.</li>
|
|
<li>[299016] CVE-2013-2923: Various fixes from internal audits,
|
|
fuzzing and other initiatives (Chrome 30).</li>
|
|
<li>[275803] Medium CVE-2013-2924: Use-after-free in ICU. Upstream
|
|
bug here.</li>
|
|
</ul>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-2906</cvename>
|
|
<cvename>CVE-2013-2907</cvename>
|
|
<cvename>CVE-2013-2908</cvename>
|
|
<cvename>CVE-2013-2909</cvename>
|
|
<cvename>CVE-2013-2910</cvename>
|
|
<cvename>CVE-2013-2911</cvename>
|
|
<cvename>CVE-2013-2912</cvename>
|
|
<cvename>CVE-2013-2913</cvename>
|
|
<cvename>CVE-2013-2914</cvename>
|
|
<cvename>CVE-2013-2915</cvename>
|
|
<cvename>CVE-2013-2916</cvename>
|
|
<cvename>CVE-2013-2917</cvename>
|
|
<cvename>CVE-2013-2918</cvename>
|
|
<cvename>CVE-2013-2919</cvename>
|
|
<cvename>CVE-2013-2920</cvename>
|
|
<cvename>CVE-2013-2921</cvename>
|
|
<cvename>CVE-2013-2922</cvename>
|
|
<cvename>CVE-2013-2923</cvename>
|
|
<cvename>CVE-2013-2924</cvename>
|
|
<url>http://googlechromereleases.blogspot.nl/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-10-01</discovery>
|
|
<entry>2013-10-01</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="e1f99d59-81aa-4662-bf62-c1076f5016c8">
|
|
<topic>py-graphite-web -- Multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>py26-graphite-web</name>
|
|
<name>py27-graphite-web</name>
|
|
<name>py31-graphite-web</name>
|
|
<name>py32-graphite-web</name>
|
|
<name>py33-graphite-web</name>
|
|
<range><ge>0.9.5</ge><lt>0.9.11</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Graphite developers report:</p>
|
|
<blockquote cite="http://graphite.readthedocs.org/en/0.9.11/releases/0_9_11.html">
|
|
<p>This release contains several security fixes for cross-site
|
|
scripting (XSS) as well as a fix for a remote-execution exploit in
|
|
graphite-web (CVE-2013-5903).</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-5093</cvename>
|
|
<url>https://github.com/rapid7/metasploit-framework/pull/2260</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-08-21</discovery>
|
|
<entry>2013-09-30</entry>
|
|
<modified>2013-09-30</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="05dc6efa-2370-11e3-95b7-00e0814cab4e">
|
|
<topic>django -- denial-of-service via large passwords</topic>
|
|
<affects>
|
|
<package>
|
|
<name>py26-django</name>
|
|
<name>py27-django</name>
|
|
<range><ge>1.5</ge><lt>1.5.4</lt></range>
|
|
<range><ge>1.4</ge><lt>1.4.8</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>py26-django-devel</name>
|
|
<name>py27-django-devel</name>
|
|
<range><lt>20130922,1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Django project reports:</p>
|
|
<blockquote cite="https://www.djangoproject.com/weblog/2013/sep/15/security/">
|
|
<p>These releases address a denial-of-service attack against Django's
|
|
authentication framework. All users of Django are encouraged to
|
|
upgrade immediately.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-1443</cvename>
|
|
<url>https://www.djangoproject.com/weblog/2013/sep/15/security/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-09-15</discovery>
|
|
<entry>2013-09-22</entry>
|
|
<modified>2013-09-30</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="b72bad1c-20ed-11e3-be06-000c29ee3065">
|
|
<topic>FreeBSD -- Cross-mount links between nullfs(5) mounts</topic>
|
|
<affects>
|
|
<system>
|
|
<name>FreeBSD</name>
|
|
<range><gt>9.1</gt><lt>9.1_7</lt></range>
|
|
<range><gt>8.4</gt><lt>8.4_4</lt></range>
|
|
<range><gt>8.3</gt><lt>8.3_11</lt></range>
|
|
</system>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Problem Description:</p>
|
|
<p>The nullfs(5) implementation of the VOP_LINK(9) VFS
|
|
operation does not check whether the source and target of
|
|
the link are both in the same nullfs instance. It is
|
|
therefore possible to create a hardlink from a location in
|
|
one nullfs instance to a file in another, as long as the
|
|
underlying (source) filesystem is the same.</p>
|
|
<p>Impact:</p>
|
|
<p>If multiple nullfs views into the same filesystem are
|
|
mounted in different locations, a user with read access to
|
|
one of these views and write access to another will be able
|
|
to create a hard link from the latter to a file in the
|
|
former, even though they are, from the user's perspective,
|
|
different filesystems. The user may thereby gain write
|
|
access to files which are nominally on a read-only
|
|
filesystem.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-5710</cvename>
|
|
<freebsdsa>SA-13:13.nullfs</freebsdsa>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-09-10</discovery>
|
|
<entry>2013-09-19</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="4d87d357-202c-11e3-be06-000c29ee3065">
|
|
<topic>FreeBSD -- Insufficient credential checks in network ioctl(2)</topic>
|
|
<affects>
|
|
<system>
|
|
<name>FreeBSD</name>
|
|
<range><gt>9.1</gt><lt>9.1_7</lt></range>
|
|
<range><gt>8.4</gt><lt>8.4_4</lt></range>
|
|
<range><gt>8.3</gt><lt>8.3_11</lt></range>
|
|
</system>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Problem Description:</p>
|
|
<p>As is commonly the case, the IPv6 and ATM network layer
|
|
ioctl request handlers are written in such a way that an
|
|
unrecognized request is passed on unmodified to the link
|
|
layer, which will either handle it or return an error
|
|
code.</p>
|
|
<p>Network interface drivers, however, assume that the
|
|
SIOCSIFADDR, SIOCSIFBRDADDR, SIOCSIFDSTADDR and
|
|
SIOCSIFNETMASK requests have been handled at the network
|
|
layer, and therefore do not perform input validation or
|
|
verify the caller's credentials. Typical link-layer actions
|
|
for these requests may include marking the interface as "up"
|
|
and resetting the underlying hardware.</p>
|
|
<p>Impact:</p>
|
|
<p>An unprivileged user with the ability to run arbitrary code
|
|
can cause any network interface in the system to perform the
|
|
link layer actions associated with a SIOCSIFADDR,
|
|
SIOCSIFBRDADDR, SIOCSIFDSTADDR or SIOCSIFNETMASK ioctl
|
|
request; or trigger a kernel panic by passing a specially
|
|
crafted address structure which causes a network interface
|
|
driver to dereference an invalid pointer.</p>
|
|
<p>Although this has not been confirmed, the possibility that
|
|
an attacker may be able to execute arbitrary code in kernel
|
|
context can not be ruled out.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-5691</cvename>
|
|
<freebsdsa>SA-13:12.ifioctl</freebsdsa>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-09-10</discovery>
|
|
<entry>2013-09-19</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="7dfed67b-20aa-11e3-b8d8-0025905a4771">
|
|
<topic>mozilla -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>firefox</name>
|
|
<range><gt>18.0,1</gt><lt>24.0,1</lt></range>
|
|
<range><lt>17.0.9,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-firefox</name>
|
|
<range><lt>17.0.9,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-seamonkey</name>
|
|
<range><lt>2.21</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-thunderbird</name>
|
|
<range><lt>17.0.9</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>seamonkey</name>
|
|
<range><lt>2.21</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>thunderbird</name>
|
|
<range><lt>24.0</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Mozilla Project reports:</p>
|
|
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
|
|
<p> MFSA 2013-76 Miscellaneous memory safety hazards (rv:24.0 /
|
|
rv:17.0.9)</p>
|
|
<p> MFSA 2013-77 Improper state in HTML5 Tree Builder with templates</p>
|
|
<p> MFSA 2013-78 Integer overflow in ANGLE library</p>
|
|
<p> MFSA 2013-79 Use-after-free in Animation Manager during stylesheet
|
|
cloning</p>
|
|
<p> MFSA 2013-80 NativeKey continues handling key messages after
|
|
widget is destroyed</p>
|
|
<p> MFSA 2013-81 Use-after-free with select element</p>
|
|
<p> MFSA 2013-82 Calling scope for new Javascript objects can lead to
|
|
memory corruption</p>
|
|
<p> MFSA 2013-83 Mozilla Updater does not lock MAR file after
|
|
signature verification</p>
|
|
<p> MFSA 2013-84 Same-origin bypass through symbolic links</p>
|
|
<p> MFSA 2013-85 Uninitialized data in IonMonkey</p>
|
|
<p> MFSA 2013-86 WebGL Information disclosure through OS X NVIDIA
|
|
graphic drivers</p>
|
|
<p> MFSA 2013-87 Shared object library loading from writable location</p>
|
|
<p> MFSA 2013-88 compartment mismatch re-attaching XBL-backed nodes</p>
|
|
<p> MFSA 2013-89 Buffer overflow with multi-column, lists, and floats</p>
|
|
<p> MFSA 2013-90 Memory corruption involving scrolling</p>
|
|
<p> MFSA 2013-91 User-defined properties on DOM proxies get the wrong
|
|
"this" object</p>
|
|
<p> MFSA 2013-92 GC hazard with default compartments and frame chain
|
|
restoration</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-1718</cvename>
|
|
<cvename>CVE-2013-1719</cvename>
|
|
<cvename>CVE-2013-1720</cvename>
|
|
<cvename>CVE-2013-1721</cvename>
|
|
<cvename>CVE-2013-1722</cvename>
|
|
<cvename>CVE-2013-1723</cvename>
|
|
<cvename>CVE-2013-1724</cvename>
|
|
<cvename>CVE-2013-1725</cvename>
|
|
<cvename>CVE-2013-1726</cvename>
|
|
<cvename>CVE-2013-1727</cvename>
|
|
<cvename>CVE-2013-1728</cvename>
|
|
<cvename>CVE-2013-1729</cvename>
|
|
<cvename>CVE-2013-1730</cvename>
|
|
<cvename>CVE-2013-1731</cvename>
|
|
<cvename>CVE-2013-1732</cvename>
|
|
<cvename>CVE-2013-1735</cvename>
|
|
<cvename>CVE-2013-1736</cvename>
|
|
<cvename>CVE-2013-1737</cvename>
|
|
<cvename>CVE-2013-1738</cvename>
|
|
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-76.html</url>
|
|
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-77.html</url>
|
|
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-78.html</url>
|
|
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-79.html</url>
|
|
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-80.html</url>
|
|
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-81.html</url>
|
|
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-82.html</url>
|
|
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-83.html</url>
|
|
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-84.html</url>
|
|
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-85.html</url>
|
|
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-86.html</url>
|
|
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-87.html</url>
|
|
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-88.html</url>
|
|
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-89.html</url>
|
|
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-90.html</url>
|
|
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-91.html</url>
|
|
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-92.html</url>
|
|
<url>http://www.mozilla.org/security/known-vulnerabilities/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-08-17</discovery>
|
|
<entry>2013-08-18</entry>
|
|
<modified>2013-09-19</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="5bd6811f-1c75-11e3-ba72-98fc11cdc4f5">
|
|
<topic>linux-flashplugin -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>linux-f10-flashplugin</name>
|
|
<range><lt>11.2r202.310</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Adobe reports:</p>
|
|
<blockquote cite="http://www.adobe.com/support/security/bulletins/apsb13-21.html">
|
|
<p>These updates address vulnerabilities that could cause a crash
|
|
and potentially allow an attacker to take control of the affected system.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-3361</cvename>
|
|
<cvename>CVE-2013-3362</cvename>
|
|
<cvename>CVE-2013-3363</cvename>
|
|
<cvename>CVE-2013-5324</cvename>
|
|
<url>http://www.adobe.com/support/security/bulletins/apsb13-21.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-09-10</discovery>
|
|
<entry>2013-09-13</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="a851b305-1bc3-11e3-95b7-00e0814cab4e">
|
|
<topic>django -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>py26-django</name>
|
|
<name>py27-django</name>
|
|
<range><ge>1.5</ge><lt>1.5.3</lt></range>
|
|
<range><ge>1.4</ge><lt>1.4.7</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>py26-django-devel</name>
|
|
<name>py27-django-devel</name>
|
|
<range><lt>20130912,1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Django project reports:</p>
|
|
<blockquote cite="https://www.djangoproject.com/weblog/2013/sep/10/security-releases-issued/">
|
|
<p>These releases address a directory-traversal vulnerability in one
|
|
of Django's built-in template tags. While this issue requires some
|
|
fairly specific factors to be exploitable, we encourage all users
|
|
of Django to upgrade promptly.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-4315</cvename>
|
|
<url>https://www.djangoproject.com/weblog/2013/sep/10/security-releases-issued/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-09-10</discovery>
|
|
<entry>2013-09-12</entry>
|
|
<modified>2013-09-30</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="f8a913cc-1322-11e3-8ffa-20cf30e32f6d">
|
|
<topic>svnserve is vulnerable to a local privilege escalation vulnerability via symlink attack.</topic>
|
|
<affects>
|
|
<package>
|
|
<name>subversion</name>
|
|
<range><ge>1.4.0</ge><lt>1.6.23_2</lt></range>
|
|
<range><ge>1.7.0</ge><lt>1.7.13</lt></range>
|
|
<range><ge>1.8.0</ge><lt>1.8.3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Subversion Project reports:</p>
|
|
<blockquote cite="http://subversion.apache.org/security/CVE-2013-4277-advisory.txt">
|
|
<p>svnserve takes a --pid-file option which creates a file containing the
|
|
process id it is running as. It does not take steps to ensure that the file
|
|
it has been directed at is not a symlink. If the pid file is in a directory
|
|
writeable by unprivileged users, the destination could be replaced by a
|
|
symlink allowing for privilege escalation. svnserve does not create a pid
|
|
file by default.</p>
|
|
<p>All versions are only vulnerable when the --pid-file=ARG option is used.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-4277</cvename>
|
|
<url>http://subversion.apache.org/security/CVE-2013-4277-advisory.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-08-30</discovery>
|
|
<entry>2013-09-02</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="b3b8d491-0fbb-11e3-8c50-1c6f65c11ee6">
|
|
<topic>cacti -- allow remote attackers to execute arbitrary SQL commands</topic>
|
|
<affects>
|
|
<package>
|
|
<name>cacti</name>
|
|
<range><lt>0.8.8b</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Cacti release reports:</p>
|
|
<blockquote cite="http://www.cacti.net/release_notes_0_8_8b.php">
|
|
<p>Multiple security vulnerabilities have been fixed:</p>
|
|
<ul>
|
|
<li>SQL injection vulnerabilities</li>
|
|
</ul>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-1434</cvename>
|
|
<cvename>CVE-2013-1435</cvename>
|
|
<url>http://www.cacti.net/release_notes_0_8_8b.php</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-08-06</discovery>
|
|
<entry>2013-08-29</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="fd2bf3b5-1001-11e3-ba94-0025905a4771">
|
|
<topic>asterisk -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>asterisk11</name>
|
|
<range><gt>11.*</gt><lt>11.5.1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>asterisk10</name>
|
|
<range><gt>10.*</gt><lt>10.12.3</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>asterisk18</name>
|
|
<range><gt>1.8.*</gt><lt>1.8.21.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Asterisk project reports:</p>
|
|
<blockquote cite="https://www.asterisk.org/security">
|
|
<p>Remote Crash From Late Arriving SIP ACK With SDP</p>
|
|
<p>Remote Crash when Invalid SDP is sent in SIP Request</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-5641</cvename>
|
|
<cvename>CVE-2013-5642</cvename>
|
|
<url>http://downloads.asterisk.org/pub/security/AST-2013-004.html</url>
|
|
<url>http://downloads.asterisk.org/pub/security/AST-2013-005.html</url>
|
|
<url>https://www.asterisk.org/security</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-08-27</discovery>
|
|
<entry>2013-08-28</entry>
|
|
<modified>2013-08-29</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="ae651a4b-0a42-11e3-ba52-00262d5ed8ee">
|
|
<topic>chromium -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>chromium</name>
|
|
<range><lt>29.0.1547.57</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Google Chrome Releases reports:</p>
|
|
<blockquote cite="http://googlechromereleases.blogspot.nl/">
|
|
<p>25 security fixes in this release, including:</p>
|
|
<ul>
|
|
<li>[181617] High CVE-2013-2900: Incomplete path sanitization in
|
|
file handling. Credit to Krystian Bigaj.</li>
|
|
<li> [254159] Low CVE-2013-2905: Information leak via overly broad
|
|
permissions on shared memory files. Credit to Christian
|
|
Jaeger.</li>
|
|
<li>[257363] High CVE-2013-2901: Integer overflow in ANGLE. Credit
|
|
to Alex Chapman.</li>
|
|
<li>[260105] High CVE-2013-2902: Use after free in XSLT. Credit to
|
|
cloudfuzzer.</li>
|
|
<li>[260156] High CVE-2013-2903: Use after free in media element.
|
|
Credit to cloudfuzzer.</li>
|
|
<li>[260428] High CVE-2013-2904: Use after free in document
|
|
parsing. Credit to cloudfuzzer.</li>
|
|
<li>[274602] CVE-2013-2887: Various fixes from internal audits,
|
|
fuzzing and other initiatives (Chrome 29).</li>
|
|
</ul>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-2887</cvename>
|
|
<cvename>CVE-2013-2900</cvename>
|
|
<cvename>CVE-2013-2901</cvename>
|
|
<cvename>CVE-2013-2902</cvename>
|
|
<cvename>CVE-2013-2903</cvename>
|
|
<cvename>CVE-2013-2904</cvename>
|
|
<cvename>CVE-2013-2905</cvename>
|
|
<url>http://googlechromereleases.blogspot.nl/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-08-20</discovery>
|
|
<entry>2013-08-21</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="4d087b35-0990-11e3-a9f4-bcaec565249c">
|
|
<topic>gstreamer-ffmpeg -- Multiple vulnerabilities in bundled libav</topic>
|
|
<affects>
|
|
<package>
|
|
<name>gstreamer-ffmpeg</name>
|
|
<range><lt>0.10.13_1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<blockquote cite="http://libav.org/releases/libav-0.7.7.changelog">
|
|
<p>Bundled version of libav in gstreamer-ffmpeg contains a number of
|
|
vulnerabilities.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2011-3892</cvename>
|
|
<cvename>CVE-2011-3893</cvename>
|
|
<cvename>CVE-2011-3895</cvename>
|
|
<cvename>CVE-2011-3929</cvename>
|
|
<cvename>CVE-2011-3936</cvename>
|
|
<cvename>CVE-2011-3937</cvename>
|
|
<cvename>CVE-2011-3940</cvename>
|
|
<cvename>CVE-2011-3945</cvename>
|
|
<cvename>CVE-2011-3947</cvename>
|
|
<cvename>CVE-2011-3951</cvename>
|
|
<cvename>CVE-2011-3952</cvename>
|
|
<cvename>CVE-2011-4031</cvename>
|
|
<cvename>CVE-2011-4351</cvename>
|
|
<cvename>CVE-2011-4352</cvename>
|
|
<cvename>CVE-2011-4353</cvename>
|
|
<cvename>CVE-2011-4364</cvename>
|
|
<cvename>CVE-2011-4579</cvename>
|
|
<cvename>CVE-2012-0848</cvename>
|
|
<cvename>CVE-2012-0850</cvename>
|
|
<cvename>CVE-2012-0851</cvename>
|
|
<cvename>CVE-2012-0852</cvename>
|
|
<cvename>CVE-2012-0853</cvename>
|
|
<cvename>CVE-2012-0858</cvename>
|
|
<cvename>CVE-2012-0947</cvename>
|
|
<cvename>CVE-2012-2772</cvename>
|
|
<cvename>CVE-2012-2775</cvename>
|
|
<cvename>CVE-2012-2777</cvename>
|
|
<cvename>CVE-2012-2779</cvename>
|
|
<cvename>CVE-2012-2783</cvename>
|
|
<cvename>CVE-2012-2784</cvename>
|
|
<cvename>CVE-2012-2786</cvename>
|
|
<cvename>CVE-2012-2787</cvename>
|
|
<cvename>CVE-2012-2788</cvename>
|
|
<cvename>CVE-2012-2790</cvename>
|
|
<cvename>CVE-2012-2791</cvename>
|
|
<cvename>CVE-2012-2793</cvename>
|
|
<cvename>CVE-2012-2794</cvename>
|
|
<cvename>CVE-2012-2798</cvename>
|
|
<cvename>CVE-2012-2800</cvename>
|
|
<cvename>CVE-2012-2801</cvename>
|
|
<cvename>CVE-2012-2803</cvename>
|
|
<cvename>CVE-2012-5144</cvename>
|
|
<url>http://libav.org/releases/libav-0.7.7.changelog</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-08-20</discovery>
|
|
<entry>2013-08-20</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="689c2bf7-0701-11e3-9a25-002590860428">
|
|
<topic>GnuPG and Libgcrypt -- side-channel attack vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>libgcrypt</name>
|
|
<range><lt>1.5.3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Werner Koch of the GNU project reports:</p>
|
|
<blockquote cite="http://lists.gnupg.org/pipermail/gnupg-announce/2013q3/000329.html">
|
|
<p>Noteworthy changes in version 1.5.3:</p>
|
|
<p>Mitigate the Yarom/Falkner flush+reload side-channel attack on RSA secret keys...</p>
|
|
<p>Note that Libgcrypt is used by GnuPG 2.x and thus this release fixes the above
|
|
problem. The fix for GnuPG less than 2.0 can be found in the just released GnuPG
|
|
1.4.14.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://eprint.iacr.org/2013/448</url>
|
|
<url>http://lists.gnupg.org/pipermail/gnupg-announce/2013q3/000329.html</url>
|
|
<url>http://lists.gnupg.org/pipermail/gnupg-announce/2013q3/000330.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-07-18</discovery>
|
|
<entry>2013-08-17</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="2b2f6092-0694-11e3-9e8e-000c29f6ae42">
|
|
<topic>puppet -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>puppet</name>
|
|
<range><ge>2.7</ge><lt>2.7.23</lt></range>
|
|
<range><ge>3.0</ge><lt>3.2.4</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Puppet Labs reports:</p>
|
|
<blockquote cite="http://puppetlabs.com/security/cve/cve-2013-4761/">
|
|
<p>By using the `resource_type` service, an attacker could
|
|
cause puppet to load arbitrary Ruby files from the puppet
|
|
master node's file system. While this behavior is not
|
|
enabled by default, `auth.conf` settings could be modified
|
|
to allow it. The exploit requires local file system access
|
|
to the Puppet Master.</p>
|
|
<p>Puppet Module Tool (PMT) did not correctly control
|
|
permissions of modules it installed, instead transferring
|
|
permissions that existed when the module was built.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-4761</cvename>
|
|
<cvename>CVE-2013-4956</cvename>
|
|
<url>http://puppetlabs.com/security/cve/cve-2013-4761/</url>
|
|
<url>http://puppetlabs.com/security/cve/cve-2013-4956/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-07-05</discovery>
|
|
<entry>2013-08-16</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="9a0a892e-05d8-11e3-ba09-000c29784fd1">
|
|
<topic>lcms2 -- Null Pointer Dereference Denial of Service Vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>lcms2</name>
|
|
<range><lt>2.5</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Mageia security team reports:</p>
|
|
<blockquote cite="http://advisories.mageia.org/MGASA-2013-0240.html">
|
|
<p>It was discovered that Little CMS did not properly verify certain
|
|
memory allocations. If a user or automated system using Little CMS
|
|
were tricked into opening a specially crafted file, an attacker
|
|
could cause Little CMS to crash (CVE-2013-4160).
|
|
</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-4160</cvename>
|
|
<url>http://advisories.mageia.org/MGASA-2013-0240.html</url>
|
|
<url>https://bugs.mageia.org/show_bug.cgi?id=10816</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-07-22</discovery>
|
|
<entry>2013-08-15</entry>
|
|
<modified>2013-08-19</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="72bf9e21-03df-11e3-bd8d-080027ef73ec">
|
|
<topic>polarssl -- denial of service vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>polarssl</name>
|
|
<range><lt>1.2.8</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Paul Bakker reports:</p>
|
|
<blockquote cite="https://polarssl.org/tech-updates/security-advisories/polarssl-security-advisory-2013-03">
|
|
<p>A bug in the logic of the parsing of PEM encoded certificates in
|
|
x509parse_crt() can result in an infinite loop, thus hogging processing
|
|
power.</p>
|
|
<p>While parsing a Certificate message during the SSL/TLS handshake,
|
|
PolarSSL extracts the presented certificates and sends them on to
|
|
be parsed. As the RFC specifies that the certificates in the
|
|
Certificate message are always X.509 certificates in DER format,
|
|
bugs in the decoding of PEM certificates should normally not be
|
|
triggerable via the SSL/TLS handshake.</p>
|
|
<p>Versions of PolarSSL prior to 1.1.7 in the 1.1 branch and prior
|
|
to 1.2.8 in the 1.2 branch call the generic x509parse_crt()
|
|
function for parsing during the handshake. x509parse_crt() is a
|
|
generic functions that wraps parsing of both PEM-encoded and
|
|
DER-formatted certificates. As a result it is possible to craft
|
|
a Certificate message that includes a PEM encoded certificate in
|
|
the Certificate message that triggers the infinite loop.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-4623</cvename>
|
|
<url>https://polarssl.org/tech-updates/security-advisories/polarssl-security-advisory-2013-03</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-06-21</discovery>
|
|
<entry>2013-08-13</entry>
|
|
<modified>2013-08-15</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="e21c7c7a-0116-11e3-9e83-3c970e169bc2">
|
|
<topic>samba -- denial of service vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>samba34</name>
|
|
<range><gt>0</gt></range>
|
|
</package>
|
|
<package>
|
|
<name>samba35</name>
|
|
<range><gt>0</gt></range>
|
|
</package>
|
|
<package>
|
|
<name>samba36</name>
|
|
<range><gt>3.6.*</gt><lt>3.6.17</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>samba4</name>
|
|
<range><gt>4.0.*</gt><lt>4.0.8</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Samba project reports:</p>
|
|
<blockquote cite="http://www.samba.org/samba/security/CVE-2013-4124">
|
|
<p>All current released versions of Samba are vulnerable to
|
|
a denial of service on an authenticated or guest connection.
|
|
A malformed packet can cause the smbd server to loop the CPU
|
|
performing memory allocations and preventing any further service.</p>
|
|
<p>A connection to a file share, or a local account is needed
|
|
to exploit this problem, either authenticated or unauthenticated
|
|
if guest connections are allowed.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-4124</cvename>
|
|
<url>http://www.samba.org/samba/security/CVE-2013-4124</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-08-05</discovery>
|
|
<entry>2013-08-09</entry>
|
|
<modified>2013-08-09</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="0998e79d-0055-11e3-905b-0025905a4771">
|
|
<topic>mozilla -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>firefox</name>
|
|
<range><gt>18.0,1</gt><lt>23.0,1</lt></range>
|
|
<range><lt>17.0.8,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-firefox</name>
|
|
<range><lt>17.0.8,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-seamonkey</name>
|
|
<range><lt>2.20</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-thunderbird</name>
|
|
<range><lt>17.0.8</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>seamonkey</name>
|
|
<range><lt>2.20</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>thunderbird</name>
|
|
<range><gt>11.0</gt><lt>17.0.8</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Mozilla Project reports:</p>
|
|
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
|
|
<p>MFSA 2013-63 Miscellaneous memory safety hazards (rv:23.0 /
|
|
rv:17.0.8)</p>
|
|
<p>MFSA 2013-64 Use after free mutating DOM during SetBody</p>
|
|
<p>MFSA 2013-65 Buffer underflow when generating CRMF requests</p>
|
|
<p>MFSA 2013-66 Buffer overflow in Mozilla Maintenance Service and
|
|
Mozilla Updater</p>
|
|
<p>MFSA 2013-67 Crash during WAV audio file decoding</p>
|
|
<p>MFSA 2013-68 Document URI misrepresentation and masquerading</p>
|
|
<p>MFSA 2013-69 CRMF requests allow for code execution and XSS
|
|
attacks</p>
|
|
<p>MFSA 2013-70 Bypass of XrayWrappers using XBL Scopes</p>
|
|
<p>MFSA 2013-71 Further Privilege escalation through Mozilla Updater</p>
|
|
<p>MFSA 2013-72 Wrong principal used for validating URI for some
|
|
Javascript components</p>
|
|
<p>MFSA 2013-73 Same-origin bypass with web workers and
|
|
XMLHttpRequest</p>
|
|
<p>MFSA 2013-74 Firefox full and stub installer DLL hijacking</p>
|
|
<p>MFSA 2013-75 Local Java applets may read contents of local file
|
|
system</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-1701</cvename>
|
|
<cvename>CVE-2013-1702</cvename>
|
|
<cvename>CVE-2013-1704</cvename>
|
|
<cvename>CVE-2013-1705</cvename>
|
|
<cvename>CVE-2013-1706</cvename>
|
|
<cvename>CVE-2013-1707</cvename>
|
|
<cvename>CVE-2013-1708</cvename>
|
|
<cvename>CVE-2013-1709</cvename>
|
|
<cvename>CVE-2013-1710</cvename>
|
|
<cvename>CVE-2013-1711</cvename>
|
|
<cvename>CVE-2013-1712</cvename>
|
|
<cvename>CVE-2013-1713</cvename>
|
|
<cvename>CVE-2013-1714</cvename>
|
|
<cvename>CVE-2013-1715</cvename>
|
|
<cvename>CVE-2013-1717</cvename>
|
|
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-63.html</url>
|
|
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-64.html</url>
|
|
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-65.html</url>
|
|
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-66.html</url>
|
|
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-67.html</url>
|
|
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-68.html</url>
|
|
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-69.html</url>
|
|
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-70.html</url>
|
|
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-71.html</url>
|
|
<url>https://www.mozilla.org/security/announce/2013/mfsa2013-72.html</url>
|
|
<url>http://www.mozilla.org/security/known-vulnerabilities/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-08-06</discovery>
|
|
<entry>2013-08-08</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="4b448a96-ff73-11e2-b28d-080027ef73ec">
|
|
<topic>PuTTY -- Four security holes in versions before 0.63</topic>
|
|
<affects>
|
|
<package>
|
|
<name>putty</name>
|
|
<range><lt>0.63</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Simon Tatham reports:</p>
|
|
<blockquote cite="http://lists.tartarus.org/pipermail/putty-announce/2013/000018.html">
|
|
<p>This [0.63] release fixes multiple security holes in previous versions of
|
|
PuTTY, which can allow an SSH-2 server to make PuTTY overrun or
|
|
underrun buffers and crash. [...]
|
|
</p><p>
|
|
These vulnerabilities can be triggered before host key verification,
|
|
which means that you are not even safe if you trust the server you
|
|
<em>think</em> you're connecting to, since it could be spoofed over the
|
|
network and the host key check would not detect this before the attack
|
|
could take place.
|
|
</p><p>
|
|
Additionally, when PuTTY authenticated with a user's private key, the
|
|
private key or information equivalent to it was accidentally kept in
|
|
PuTTY's memory for the rest of its run, where it could be retrieved by
|
|
other processes reading PuTTY's memory, or written out to swap files
|
|
or crash dumps. This release fixes that as well.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-4206</cvename>
|
|
<cvename>CVE-2013-4207</cvename>
|
|
<cvename>CVE-2013-4208</cvename>
|
|
<cvename>CVE-2013-4852</cvename>
|
|
<mlist msgid="E1V6lUs-0007kP-40@atreus.tartarus.org">http://lists.tartarus.org/pipermail/putty-announce/2013/000018.html</mlist>
|
|
<url>http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-modmul.html</url>
|
|
<url>http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-bignum-division-by-zero.html</url>
|
|
<url>http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/private-key-not-wiped.html</url>
|
|
<url>http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-signature-stringlen.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-07-08</discovery>
|
|
<entry>2013-08-07</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="e6839625-fdfa-11e2-9430-20cf30e32f6d">
|
|
<topic>typo3 -- Multiple vulnerabilities in TYPO3 Core</topic>
|
|
<affects>
|
|
<package>
|
|
<name>typo3</name>
|
|
<range><ge>4.5.0</ge><lt>4.5.29</lt></range>
|
|
<range><ge>4.7.0</ge><lt>4.7.14</lt></range>
|
|
<range><ge>6.1.0</ge><lt>6.1.3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Typo Security Team reports:</p>
|
|
<blockquote cite="http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2013-002/">
|
|
<p>It has been discovered that TYPO3 Core is vulnerable to
|
|
Cross-Site Scripting and Remote Code Execution.</p>
|
|
<p>TYPO3 bundles flash files for video and audio playback. Old
|
|
versions of FlowPlayer and flashmedia are susceptible to
|
|
Cross-Site Scripting. No authentication is required to exploit
|
|
this vulnerability.</p>
|
|
<p>The file upload component and the File Abstraction Layer are
|
|
failing to check for denied file extensions, which allows
|
|
authenticated editors (even with limited permissions) to
|
|
upload php files with arbitrary code, which can then be
|
|
executed in web server's context.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2011-3642</cvename>
|
|
<cvename>CVE-2013-1464</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-07-30</discovery>
|
|
<entry>2013-08-05</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="17326fd5-fcfb-11e2-9bb9-6805ca0b3d42">
|
|
<topic>phpMyAdmin -- clickJacking protection can be bypassed</topic>
|
|
<affects>
|
|
<package>
|
|
<name>phpMyAdmin</name>
|
|
<range><lt>4.0.5</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The phpMyAdmin development team reports:</p>
|
|
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2013-10.php">
|
|
<p> phpMyAdmin has a number of mechanisms to avoid a
|
|
clickjacking attack, however these mechanisms either work
|
|
only in modern browser versions, or can be bypassed.</p>
|
|
<p>"We have no solution for 3.5.x, due to the proposed
|
|
solution requiring JavaScript. We don't want to introduce a
|
|
dependency to JavaScript in the 3.5.x family."</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2013-10.php</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-08-04</discovery>
|
|
<entry>2013-08-04</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="69098c5c-fc4b-11e2-8ad0-00262d5ed8ee">
|
|
<topic>chromium -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>chromium</name>
|
|
<range><lt>28.0.1500.95</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Google Chrome Releases reports:</p>
|
|
<blockquote cite="http://googlechromereleases.blogspot.nl/">
|
|
<p>Eleven vulnerabilities, including:</p>
|
|
<p>[257748] Medium CVE-2013-2881: Origin bypass in frame handling.
|
|
Credit to Karthik Bhargavan.</p>
|
|
<p>[260106] High CVE-2013-2882: Type confusion in V8. Credit to
|
|
Cloudfuzzer.</p>
|
|
<p>[260165] High CVE-2013-2883: Use-after-free in MutationObserver.
|
|
Credit to Cloudfuzzer.</p>
|
|
<p>[248950] High CVE-2013-2884: Use-after-free in DOM. Credit to Ivan
|
|
Fratric of Google Security Team.</p>
|
|
<p>[249640] [257353] High CVE-2013-2885: Use-after-free in input
|
|
handling. Credit to Ivan Fratric of Google Security Team.</p>
|
|
<p>[261701] High CVE-2013-2886: Various fixes from internal audits,
|
|
fuzzing and other initiatives.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-2881</cvename>
|
|
<cvename>CVE-2013-2882</cvename>
|
|
<cvename>CVE-2013-2883</cvename>
|
|
<cvename>CVE-2013-2884</cvename>
|
|
<cvename>CVE-2013-2885</cvename>
|
|
<cvename>CVE-2013-2886</cvename>
|
|
<url>http://www.googlechromereleases.blogspot.nl/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-07-30</discovery>
|
|
<entry>2013-08-03</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="f4a0212f-f797-11e2-9bb9-6805ca0b3d42">
|
|
<topic>phpMyAdmin -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>phpMyAdmin</name>
|
|
<range><ge>4.0</ge><lt>4.0.4.2</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>phpMyAdmin35</name>
|
|
<range><ge>3.5</ge><lt>3.5.8.2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The phpMyAdmin development team reports:</p>
|
|
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2013-8.php">
|
|
<p>XSS due to unescaped HTML Output when executing a SQL query.</p>
|
|
<p>Using a crafted SQL query, it was possible to produce an
|
|
XSS on the SQL query form.</p>
|
|
<p>This vulnerability can be triggered only by someone who
|
|
logged in to phpMyAdmin, as the usual token protection
|
|
prevents non-logged-in users from accessing the required
|
|
form.</p>
|
|
</blockquote>
|
|
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2013-9.php">
|
|
<p>5 XSS vulnerabilities in setup, chart display, process
|
|
list, and logo link.</p>
|
|
<ul>
|
|
<li>In the setup/index.php, using a crafted # hash with a
|
|
Javascript event, untrusted JS code could be
|
|
executed.</li>
|
|
<li>In the Display chart view, a chart title containing
|
|
HTML code was rendered unescaped, leading to possible
|
|
JavaScript code execution via events.</li>
|
|
<li>A malicious user with permission to create databases
|
|
or users having HTML tags in their name, could trigger an
|
|
XSS vulnerability by issuing a sleep query with a long
|
|
delay. In the server status monitor, the query parameters
|
|
were shown unescaped.</li>
|
|
<li>By configuring a malicious URL for the phpMyAdmin logo
|
|
link in the navigation sidebar, untrusted script code
|
|
could be executed when a user clicked the logo.</li>
|
|
<li>The setup field for "List of trusted proxies for IP
|
|
allow/deny" Ajax validation code returned the unescaped
|
|
input on errors, leading to possible JavaScript execution
|
|
by entering arbitrary HTML.</li>
|
|
</ul>
|
|
</blockquote>
|
|
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2013-11.php">
|
|
<p>If a crafted version.json would be presented, an XSS
|
|
could be introduced.</p>
|
|
<p>Due to not properly validating the version.json file,
|
|
which is fetched from the phpMyAdmin.net website, could lead
|
|
to an XSS attack, if a crafted version.json file would be
|
|
presented.</p>
|
|
<p>This vulnerability can only be exploited with a
|
|
combination of complicated techniques and tricking the user
|
|
to visit a page.</p>
|
|
</blockquote>
|
|
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2013-12.php">
|
|
<p>Full path disclosure vulnerabilities.</p>
|
|
<p>By calling some scripts that are part of phpMyAdmin in an
|
|
unexpected way, it is possible to trigger phpMyAdmin to
|
|
display a PHP error message which contains the full path of
|
|
the directory where phpMyAdmin is installed.</p>
|
|
<p>This path disclosure is possible on servers where the
|
|
recommended setting of the PHP configuration directive
|
|
display_errors is set to on, which is against the
|
|
recommendations given in the PHP manual.</p>
|
|
</blockquote>
|
|
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2013-13.php">
|
|
<p> XSS vulnerability when a text to link transformation is
|
|
used.</p>
|
|
<p>When the TextLinkTransformationPlugin is used to create a
|
|
link to an object when displaying the contents of a table,
|
|
the object name is not properly escaped, which could lead to
|
|
an XSS, if the object name has a crafted value.</p>
|
|
<p>The stored XSS vulnerabilities can be triggered only by
|
|
someone who logged in to phpMyAdmin, as the usual token
|
|
protection prevents non-logged-in users from accessing the
|
|
required forms.</p>
|
|
</blockquote>
|
|
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2013-14.php">
|
|
<p>Self-XSS due to unescaped HTML output in schema
|
|
export.</p>
|
|
<p>When calling schema_export.php with crafted parameters,
|
|
it is possible to trigger an XSS.</p>
|
|
<p>This vulnerability can be triggered only by someone who
|
|
logged in to phpMyAdmin, as the usual token protection
|
|
prevents non-logged-in users from accessing the required
|
|
form.</p>
|
|
</blockquote>
|
|
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2013-15.php">
|
|
<p>SQL injection vulnerabilities, producing a privilege
|
|
escalation (control user).</p>
|
|
<p>Due to a missing validation of parameters passed to
|
|
schema_export.php and pmd_pdf.php, it was possible to inject
|
|
SQL statements that would run with the privileges of the
|
|
control user. This gives read and write access to the tables
|
|
of the configuration storage database, and if the control
|
|
user has the necessary privileges, read access to some
|
|
tables of the mysql database.</p>
|
|
<p>These vulnerabilities can be triggered only by someone
|
|
who logged in to phpMyAdmin, as the usual token protection
|
|
prevents non-logged-in users from accessing the required
|
|
form. Moreover, a control user must have been created and
|
|
configured as part of the phpMyAdmin configuration storage
|
|
installation.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2013-8.php</url>
|
|
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2013-9.php</url>
|
|
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2013-11.php</url>
|
|
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2013-12.php</url>
|
|
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2013-13.php</url>
|
|
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2013-14.php</url>
|
|
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2013-15.php</url>
|
|
<url>http://sourceforge.net/projects/phpmyadmin/files/phpMyAdmin/3.5.8.2/phpMyAdmin-3.5.8.2-notes.html/view</url>
|
|
<url>http://sourceforge.net/projects/phpmyadmin/files/phpMyAdmin/4.0.4.2/phpMyAdmin-4.0.4.2-notes.html/view</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-07-28</discovery>
|
|
<entry>2013-07-28</entry>
|
|
<modified>2013-07-29</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="049332d2-f6e1-11e2-82f3-000c29ee3065">
|
|
<topic>wordpress -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>wordpress</name>
|
|
<range><lt>3.5.2,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>zh-wordpress-zh_CN</name>
|
|
<name>zh-wordpress-zh_TW</name>
|
|
<name>de-wordpress</name>
|
|
<name>ja-wordpress</name>
|
|
<name>ru-wordpress</name>
|
|
<range><lt>3.5.2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The wordpress development team reports:</p>
|
|
<blockquote cite="https://wordpress.org/news/2013/06/wordpress-3-5-2/">
|
|
<ul>
|
|
<li>Blocking server-side request forgery attacks, which could
|
|
potentially enable an attacker to gain access to a site</li>
|
|
<li>Disallow contributors from improperly publishing posts</li>
|
|
<li>An update to the SWFUpload external library to fix cross-site
|
|
scripting vulnerabilities</li>
|
|
<li>Prevention of a denial of service attack, affecting sites
|
|
using password-protected posts</li>
|
|
<li>An update to an external TinyMCE library to fix a cross-site
|
|
scripting vulnerability</li>
|
|
<li>Multiple fixes for cross-site scripting</li>
|
|
<li>Avoid disclosing a full file path when a upload fails</li>
|
|
</ul>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-2199</cvename>
|
|
<cvename>CVE-2013-2200</cvename>
|
|
<cvename>CVE-2013-2201</cvename>
|
|
<cvename>CVE-2013-2202</cvename>
|
|
<cvename>CVE-2013-2203</cvename>
|
|
<cvename>CVE-2013-2204</cvename>
|
|
<cvename>CVE-2013-2205</cvename>
|
|
<url>https://wordpress.org/news/2013/06/wordpress-3-5-2/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-06-21</discovery>
|
|
<entry>2013-07-27</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="7943e521-f648-11e2-8607-3c970e169bc2">
|
|
<topic>bind -- denial of service vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>bind99</name>
|
|
<name>bind99-base</name>
|
|
<range><gt>9.9.3</gt><lt>9.9.3.2</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>bind98</name>
|
|
<name>bind98-base</name>
|
|
<range><gt>9.8.5</gt><lt>9.8.5.2</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>FreeBSD</name>
|
|
<range><gt>9.0</gt><lt>9.1_5</lt></range>
|
|
<range><gt>8.4</gt><lt>8.4_2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>ISC reports:</p>
|
|
<blockquote cite="https://kb.isc.org/article/AA-01015/0">
|
|
<p>A specially crafted query that includes malformed
|
|
rdata can cause named to terminate with an assertion
|
|
failure while rejecting the malformed query.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-4854</cvename>
|
|
<freebsdsa>SA-13:07.bind</freebsdsa>
|
|
<url>https://kb.isc.org/article/AA-01015/0</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-07-26</discovery>
|
|
<entry>2013-07-26</entry>
|
|
<modified>2013-07-27</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="80771b89-f57b-11e2-bf21-b499baab0cbe">
|
|
<topic>gnupg -- side channel attack on RSA secret keys</topic>
|
|
<affects>
|
|
<package>
|
|
<name>gnupg</name>
|
|
<range><lt>1.4.14</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A Yarom and Falkner paper reports:</p>
|
|
<blockquote cite="http://lists.gnupg.org/pipermail/gnupg-announce/2013q3/000330.html">
|
|
<p>Flush+Reload is a cache side-channel attack that monitors access to
|
|
data in shared pages. In this paper we demonstrate how to use the
|
|
attack to extract private encryption keys from GnuPG. The high
|
|
resolution and low noise of the Flush+Reload attack enables a spy
|
|
program to recover over 98% of the bits of the private key in a
|
|
single decryption or signing round. Unlike previous attacks, the
|
|
attack targets the last level L3 cache. Consequently, the spy
|
|
program and the victim do not need to share the execution core of
|
|
the CPU. The attack is not limited to a traditional OS and can be
|
|
used in a virtualised environment, where it can attack programs
|
|
executing in a different VM.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://eprint.iacr.org/2013/448</url>
|
|
<url>http://lists.gnupg.org/pipermail/gnupg-announce/2013q3/000330.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-07-18</discovery>
|
|
<entry>2013-07-25</entry>
|
|
<modified>2013-07-26</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="c4d412c8-f4d1-11e2-b86c-000c295229d5">
|
|
<topic>openafs -- single-DES cell-wide key brute force vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>openafs</name>
|
|
<range><lt>1.6.5</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>OpenAFS Project reports:</p>
|
|
<blockquote cite="http://openafs.org/pages/security/OPENAFS-SA-2013-003.txt">
|
|
<p>The small size of the DES key space permits an attacker to brute
|
|
force a cell's service key and then forge traffic from any user
|
|
within the cell. The key space search can be performed in under 1
|
|
day at a cost of around $100 using publicly available services.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-4134</cvename>
|
|
<url>http://openafs.org/pages/security/OPENAFS-SA-2013-003.txt</url>
|
|
<url>http://openafs.org/pages/security/how-to-rekey.txt</url>
|
|
<url>http://openafs.org/pages/security/install-rxkad-k5-1.6.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-07-24</discovery>
|
|
<entry>2013-07-25</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="2ae24334-f2e6-11e2-8346-001e8c75030d">
|
|
<topic>subversion -- remotely triggerable "Assertion failed" DoS vulnerability or read overflow.</topic>
|
|
<affects>
|
|
<package>
|
|
<name>subversion</name>
|
|
<range><ge>1.8.0</ge><lt>1.8.1</lt></range>
|
|
<range><ge>1.7.0</ge><lt>1.7.11</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Subversion Project reports:</p>
|
|
<blockquote cite="http://subversion.apache.org/security/CVE-2013-4131-advisory.txt">
|
|
<p>Subversion's mod_dav_svn Apache HTTPD server module will trigger an assertion
|
|
on some requests made against a revision root. This can lead to a DoS.
|
|
If assertions are disabled it will trigger a read overflow which may cause a
|
|
SEGFAULT (or equivalent) or undefined behavior.</p>
|
|
<p>Commit access is required to exploit this.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-4131</cvename>
|
|
<url>http://subversion.apache.org/security/CVE-2013-4131-advisory.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-07-19</discovery>
|
|
<entry>2013-07-24</entry>
|
|
<modified>2013-07-25</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="2fbfd455-f2d0-11e2-8a46-000d601460a4">
|
|
<topic>suPHP -- Privilege escalation</topic>
|
|
<affects>
|
|
<package>
|
|
<name>suphp</name>
|
|
<range><lt>0.7.2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>suPHP developer Sebastian Marsching reports:</p>
|
|
<blockquote cite="https://lists.marsching.com/pipermail/suphp/2013-May/002552.html">
|
|
<p>When the suPHP_PHPPath was set, mod_suphp would use the specified PHP
|
|
executable to pretty-print PHP source files (MIME type
|
|
x-httpd-php-source or application/x-httpd-php-source).</p>
|
|
<p>However, it would not sanitize the environment. Thus a user that was
|
|
allowed to use the SetEnv directive in a .htaccess file (AllowOverride
|
|
FileInfo) could make PHP load a malicious configuration file (e.g.
|
|
loading malicious extensions).</p>
|
|
<p>As the PHP process for highlighting the source file was run with the
|
|
privileges of the user Apache HTTPd was running as, a local attacker
|
|
could probably execute arbitrary code with the privileges of this user.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>https://lists.marsching.com/pipermail/suphp/2013-May/002552.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-05-20</discovery>
|
|
<entry>2013-07-22</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="ca4d63fb-f15c-11e2-b183-20cf30e32f6d">
|
|
<topic>apache24 -- several vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>apache24</name>
|
|
<range><lt>2.4.6</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Apache HTTP SERVER PROJECT reports:</p>
|
|
<blockquote cite="http://www.apache.org/dist/httpd/Announcement2.4.html">
|
|
<p>mod_dav: Sending a MERGE request against a URI handled by mod_dav_svn
|
|
with the source href (sent as part of the request body as XML) pointing
|
|
to a URI that is not configured for DAV will trigger a segfault.</p>
|
|
<p>mod_session_dbd: Make sure that dirty flag is respected when saving
|
|
sessions, and ensure the session ID is changed each time the session
|
|
changes. This changes the format of the updatesession SQL statement.
|
|
Existing configurations must be changed.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-1896</cvename>
|
|
<cvename>CVE-2013-2249</cvename>
|
|
<url>http://www.apache.org/dist/httpd/Announcement2.4.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-07-11</discovery>
|
|
<entry>2013-07-20</entry>
|
|
<modified>2013-07-21</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="9b037a0d-ef2c-11e2-b4a0-8c705af55518">
|
|
<topic>gallery -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>gallery3</name>
|
|
<range><lt>3.0.9</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Red Hat Security Response Team reports:</p>
|
|
<blockquote cite="http://www.openwall.com/lists/oss-security/2013/07/04/7">
|
|
<p>Gallery upstream has released 3.0.9 version, correcting two
|
|
security flaws:</p>
|
|
<p>Issue #1 - Improper stripping of URL fragments in flowplayer
|
|
SWF file might lead to reply attacks (a different flaw than
|
|
CVE-2013-2138).</p>
|
|
<p>Issue #2 - gallery3: Multiple information exposure flaws in
|
|
data rest core module.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-2240</cvename>
|
|
<cvename>CVE-2013-2241</cvename>
|
|
<url>http://sourceforge.net/apps/trac/gallery/ticket/2073</url>
|
|
<url>https://bugzilla.redhat.com/show_bug.cgi?id=981197</url>
|
|
<url>http://sourceforge.net/apps/trac/gallery/ticket/2074</url>
|
|
<url>https://bugzilla.redhat.com/show_bug.cgi?id=981198</url>
|
|
<url>http://galleryproject.org/gallery_3_0_9</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-06-28</discovery>
|
|
<entry>2013-07-17</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="31b145f2-d9d3-49a9-8023-11cf742205dc">
|
|
<topic>PHP5 -- Heap corruption in XML parser</topic>
|
|
<affects>
|
|
<package>
|
|
<name>php53</name>
|
|
<range><lt>5.3.27</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The PHP development team reports:</p>
|
|
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4113">
|
|
<p>ext/xml/xml.c in PHP before 5.3.27 does not properly
|
|
consider parsing depth, which allows remote attackers to
|
|
cause a denial of service (heap memory corruption) or
|
|
possibly have unspecified other impact via a crafted
|
|
document that is processed by the xml_parse_into_struct
|
|
function.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-4113</cvename>
|
|
<url>https://bugs.php.net/bug.php?id=65236</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-07-10</discovery>
|
|
<entry>2013-07-16</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="5def3175-f3f9-4476-ba40-b46627cc638c">
|
|
<topic>PHP5 -- Integer overflow in Calendar module</topic>
|
|
<affects>
|
|
<package>
|
|
<name>php5</name>
|
|
<range><ge>5.4.0</ge><lt>5.4.16</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>php53</name>
|
|
<range><lt>5.3.26</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The PHP development team reports:</p>
|
|
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4635">
|
|
<p>Integer overflow in the SdnToJewish function in jewish.c
|
|
in the Calendar component in PHP before 5.3.26 and 5.4.x
|
|
before 5.4.16 allows context-dependent attackers to cause a
|
|
denial of service (application hang) via a large argument to
|
|
the jdtojewish function.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-4635</cvename>
|
|
<url>https://bugs.php.net/bug.php?id=64895</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-05-22</discovery>
|
|
<entry>2013-07-16</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="df428c01-ed91-11e2-9466-98fc11cdc4f5">
|
|
<topic>linux-flashplugin -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>linux-f10-flashplugin</name>
|
|
<range><lt>11.2r202.297</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Adobe reports:</p>
|
|
<blockquote cite="http://www.adobe.com/support/security/bulletins/apsb13-17.html">
|
|
<p>These updates address vulnerabilities that could cause a crash
|
|
and potentially allow an attacker to take control of the affected system.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-3344</cvename>
|
|
<cvename>CVE-2013-3345</cvename>
|
|
<cvename>CVE-2013-3347</cvename>
|
|
<url>http://www.adobe.com/support/security/bulletins/apsb13-17.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-07-09</discovery>
|
|
<entry>2013-07-15</entry>
|
|
<modified>2013-07-18</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="30a04ab4-ed7b-11e2-8643-8c705af55518">
|
|
<topic>squid -- denial of service</topic>
|
|
<affects>
|
|
<package>
|
|
<name>squid</name>
|
|
<range><ge>3.2</ge><lt>3.2.12</lt></range>
|
|
<range><ge>3.3</ge><lt>3.3.8</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Squid project reports:</p>
|
|
<blockquote cite="http://www.squid-cache.org/Advisories/SQUID-2013_3.txt">
|
|
<p>Due to incorrect data validation Squid is vulnerable to a
|
|
denial of service attack when processing specially crafted
|
|
HTTP requests</p>
|
|
<p>This problem allows any client who can generate HTTP requests
|
|
to perform a denial of service attack on the Squid service.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-4123</cvename>
|
|
<url>http://www.squid-cache.org/Advisories/SQUID-2013_3.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-07-13</discovery>
|
|
<entry>2013-07-15</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="04320e7d-ea66-11e2-a96e-60a44c524f57">
|
|
<topic>libzrtpcpp -- multiple security vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>libzrtpcpp</name>
|
|
<range><lt>2.3.4</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Mark Dowd reports:</p>
|
|
<blockquote cite="http://blog.azimuthsecurity.com/2013/06/attacking-crypto-phones-weaknesses-in.html">
|
|
<p>Vulnerability 1. Remote Heap Overflow: If an attacker sends a
|
|
packet larger than 1024 bytes that gets stored temporarily (which
|
|
occurs many times - such as when sending a ZRTP Hello packet), a
|
|
heap overflow will occur, leading to potential arbitrary code
|
|
execution on the vulnerable host.</p>
|
|
<p>Vulnerability 2. Multiple Stack Overflows: ZRTPCPP contains
|
|
multiple stack overflows that arise when preparing a response
|
|
to a client's ZRTP Hello packet.</p>
|
|
<p>Vulnerability 3. Information Leaking / Out of Bounds Reads:
|
|
The ZRTPCPP library performs very little validation regarding the
|
|
expected size of a packet versus the actual amount of data
|
|
received. This can lead to both information leaking and out
|
|
of bounds data reads (usually resulting in a crash).
|
|
Information leaking can be performed for example by sending
|
|
a malformed ZRTP Ping packet.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-2221</cvename>
|
|
<cvename>CVE-2013-2222</cvename>
|
|
<cvename>CVE-2013-2223</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-06-27</discovery>
|
|
<entry>2013-07-11</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="ebd877b9-7ef4-4375-b1fd-c67780581898">
|
|
<topic>ruby -- Hostname check bypassing vulnerability in SSL client</topic>
|
|
<affects>
|
|
<package>
|
|
<name>ruby19</name>
|
|
<range><lt>1.9.3.448,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>ruby18</name>
|
|
<range><lt>1.8.7.374,1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Ruby Developers report:</p>
|
|
<blockquote cite="http://www.ruby-lang.org/en/news/2013/06/27/hostname-check-bypassing-vulnerability-in-openssl-client-cve-2013-4073/">
|
|
<p>Ruby's SSL client implements hostname identity check but it does
|
|
not properly handle hostnames in the certificate that contain null
|
|
bytes.
|
|
</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-4073</cvename>
|
|
<url>http://www.ruby-lang.org/en/news/2013/06/27/hostname-check-bypassing-vulnerability-in-openssl-client-cve-2013-4073/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-06-27</discovery>
|
|
<entry>2013-07-11</entry>
|
|
<modified>2013-09-24</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="e3e788aa-e9fd-11e2-a96e-60a44c524f57">
|
|
<topic>otrs -- Sql Injection + Xss Issue</topic>
|
|
<affects>
|
|
<package>
|
|
<name>otrs</name>
|
|
<range><lt>3.2.9</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The OTRS Project reports:</p>
|
|
<blockquote cite="http://www.otrs.com/en/open-source/community-news/security-advisories/security-advisory-2013-05/">
|
|
<p>An attacker with a valid agent login could manipulate URLs leading to SQL injection. An attacker with a valid agent login could manipulate URLs in the ITSM ConfigItem search, leading to a JavaScript code injection (XSS) problem.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-4717</cvename>
|
|
<cvename>CVE-2013-4718</cvename>
|
|
<url>http://www.otrs.com/en/open-source/community-news/security-advisories/security-advisory-2013-05/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-07-09</discovery>
|
|
<entry>2013-07-11</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="3b80104f-e96c-11e2-8bac-00262d5ed8ee">
|
|
<topic>chromium -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>chromium</name>
|
|
<range><lt>28.0.1500.71</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Google Chrome Releases reports:</p>
|
|
<blockquote cite="http://googlechromereleases.blogspot.nl/">
|
|
<p>A special reward for Andrey Labunets for his combination of
|
|
CVE-2013-2879 and CVE-2013-2868 along with some (since fixed)
|
|
server-side bugs.</p>
|
|
<p>[252216] Low CVE-2013-2867: Block pop-unders in various
|
|
scenarios.</p>
|
|
<p>[252062] High CVE-2013-2879: Confusion setting up sign-in and sync.
|
|
Credit to Andrey Labunets.</p>
|
|
<p>[252034] Medium CVE-2013-2868: Incorrect sync of NPAPI extension
|
|
component. Credit to Andrey Labunets.</p>
|
|
<p>[245153] Medium CVE-2013-2869: Out-of-bounds read in JPEG2000
|
|
handling. Credit to Felix Groebert of Google Security Team.</p>
|
|
<p>[244746] [242762] Critical CVE-2013-2870: Use-after-free with
|
|
network sockets. Credit to Collin Payne.</p>
|
|
<p>[244260] Medium CVE-2013-2853: Man-in-the-middle attack against
|
|
HTTP in SSL. Credit to Antoine Delignat-Lavaud and Karthikeyan
|
|
Bhargavan from Prosecco at INRIA Paris.</p>
|
|
<p>[243991] [243818] High CVE-2013-2871: Use-after-free in input
|
|
handling. Credit to miaubiz.</p>
|
|
<p>[Mac only] [242702] Low CVE-2013-2872: Possible lack of entropy in
|
|
renderers. Credit to Eric Rescorla.</p>
|
|
<p>[241139] High CVE-2013-2873: Use-after-free in resource loading.
|
|
Credit to miaubiz.</p>
|
|
<p>[233848] Medium CVE-2013-2875: Out-of-bounds-read in SVG. Credit
|
|
to miaubiz.</p>
|
|
<p>[229504] Medium CVE-2013-2876: Extensions permissions confusion
|
|
with interstitials. Credit to Dev Akhawe.</p>
|
|
<p>[229019] Low CVE-2013-2877: Out-of-bounds read in XML parsing.
|
|
Credit to Aki Helin of OUSPG.</p>
|
|
<p>[196636] None: Remove the "viewsource" attribute on iframes.
|
|
Credit to Collin Jackson.</p>
|
|
<p>[177197] Medium CVE-2013-2878: Out-of-bounds read in text
|
|
handling. Credit to Atte Kettunen of OUSPG.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-2853</cvename>
|
|
<cvename>CVE-2013-2867</cvename>
|
|
<cvename>CVE-2013-2868</cvename>
|
|
<cvename>CVE-2013-2869</cvename>
|
|
<cvename>CVE-2013-2870</cvename>
|
|
<cvename>CVE-2013-2871</cvename>
|
|
<cvename>CVE-2013-2872</cvename>
|
|
<cvename>CVE-2013-2873</cvename>
|
|
<cvename>CVE-2013-2875</cvename>
|
|
<cvename>CVE-2013-2876</cvename>
|
|
<cvename>CVE-2013-2877</cvename>
|
|
<cvename>CVE-2013-2878</cvename>
|
|
<cvename>CVE-2013-2879</cvename>
|
|
<url>http://googlechromereleases.blogspot.nl/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-07-09</discovery>
|
|
<entry>2013-07-10</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="f3d24aee-e5ad-11e2-b183-20cf30e32f6d">
|
|
<topic>apache22 -- several vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>apache22</name>
|
|
<range><gt>2.2.0</gt><lt>2.2.25</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>apache22-event-mpm</name>
|
|
<range><gt>2.2.0</gt><lt>2.2.25</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>apache22-itk-mpm</name>
|
|
<range><gt>2.2.0</gt><lt>2.2.25</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>apache22-peruser-mpm</name>
|
|
<range><gt>2.2.0</gt><lt>2.2.25</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>apache22-worker-mpm</name>
|
|
<range><gt>2.2.0</gt><lt>2.2.25</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<h1>Apache HTTP SERVER PROJECT reports:</h1>
|
|
<blockquote cite="http://www.apache.org/dist/httpd/CHANGES_2.2.25">
|
|
<p>The mod_rewrite module in the Apache HTTP Server 2.2.x before
|
|
2.2.25 writes data to a log file without sanitizing
|
|
non-printable characters, which might allow remote attackers to
|
|
execute arbitrary commands via an HTTP request containing an
|
|
escape sequence for a terminal emulator.</p>
|
|
<p>mod_dav: Sending a MERGE request against a URI handled by
|
|
mod_dav_svn with the source href (sent as part of the request
|
|
body as XML) pointing to a URI that is not configured for DAV
|
|
will trigger a segfault.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-1862</cvename>
|
|
<cvename>CVE-2013-1896</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-06-21</discovery>
|
|
<entry>2013-07-05</entry>
|
|
<modified>2013-07-10</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="1b93f6fe-e1c1-11e2-948d-6805ca0b3d42">
|
|
<topic>phpMyAdmin -- Global variable scope injection</topic>
|
|
<affects>
|
|
<package>
|
|
<name>phpMyAdmin</name>
|
|
<range><ge>4.0</ge><lt>4.0.4.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The phpMyAdmin development team reports:</p>
|
|
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2013-7.php">
|
|
<p>The import.php script was vulnerable to GLOBALS variable
|
|
injection. Therefore, an attacker could manipulate any
|
|
configuration parameter.</p>
|
|
<p>This vulnerability can be triggered only by someone who
|
|
logged in to phpMyAdmin, as the usual token protection
|
|
prevents non-logged-in users from accessing the required
|
|
form.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2013-7.php</url>
|
|
<cvename>CVE-2013-4729</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-06-30</discovery>
|
|
<entry>2013-06-30</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="81da673e-dfe1-11e2-9389-08002798f6ff">
|
|
<topic>apache-xml-security-c -- heap overflow during XPointer evaluation</topic>
|
|
<affects>
|
|
<package>
|
|
<name>apache-xml-security-c</name>
|
|
<range><lt>1.7.2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Apache Software Foundation reports:</p>
|
|
<blockquote cite="http://santuario.apache.org/secadv.data/CVE-2013-2210.txt">
|
|
<p>The attempted fix to address CVE-2013-2154 introduced the
|
|
possibility of a heap overflow, possibly leading to arbitrary code
|
|
execution, in the processing of malformed XPointer expressions in the
|
|
XML Signature Reference processing code.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-2210</cvename>
|
|
<url>http://santuario.apache.org/secadv.data/CVE-2013-2210.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-06-27</discovery>
|
|
<entry>2013-06-28</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="b3fcb387-de4b-11e2-b1c6-0025905a4771">
|
|
<topic>mozilla -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>firefox</name>
|
|
<range><gt>18.0,1</gt><lt>22.0,1</lt></range>
|
|
<range><lt>17.0.7,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-firefox</name>
|
|
<range><lt>17.0.7,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-seamonkey</name>
|
|
<range><lt>2.19</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-thunderbird</name>
|
|
<range><lt>17.0.7</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>seamonkey</name>
|
|
<range><lt>2.19</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>thunderbird</name>
|
|
<range><gt>11.0</gt><lt>17.0.7</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Mozilla Project reports:</p>
|
|
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
|
|
<p>Miscellaneous memory safety hazards (rv:22.0 / rv:17.0.7)</p>
|
|
<p>Title: Memory corruption found using Address Sanitizer</p>
|
|
<p>Privileged content access and execution via XBL</p>
|
|
<p>Arbitrary code execution within Profiler</p>
|
|
<p>Execution of unmapped memory through onreadystatechange</p>
|
|
<p>Data in the body of XHR HEAD requests leads to CSRF attacks</p>
|
|
<p>SVG filters can lead to information disclosure</p>
|
|
<p>PreserveWrapper has inconsistent behavior</p>
|
|
<p>Sandbox restrictions not applied to nested frame elements</p>
|
|
<p>X-Frame-Options ignored when using server push with multi-part
|
|
responses</p>
|
|
<p>XrayWrappers can be bypassed to run user defined methods in a
|
|
privileged context</p>
|
|
<p>getUserMedia permission dialog incorrectly displays location</p>
|
|
<p>Homograph domain spoofing in .com, .net and .name</p>
|
|
<p>Inaccessible updater can lead to local privilege escalation</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-1682</cvename>
|
|
<cvename>CVE-2013-1683</cvename>
|
|
<cvename>CVE-2013-1684</cvename>
|
|
<cvename>CVE-2013-1685</cvename>
|
|
<cvename>CVE-2013-1686</cvename>
|
|
<cvename>CVE-2013-1687</cvename>
|
|
<cvename>CVE-2013-1688</cvename>
|
|
<cvename>CVE-2013-1690</cvename>
|
|
<cvename>CVE-2013-1692</cvename>
|
|
<cvename>CVE-2013-1693</cvename>
|
|
<cvename>CVE-2013-1694</cvename>
|
|
<cvename>CVE-2013-1695</cvename>
|
|
<cvename>CVE-2013-1696</cvename>
|
|
<cvename>CVE-2013-1697</cvename>
|
|
<cvename>CVE-2013-1698</cvename>
|
|
<cvename>CVE-2013-1699</cvename>
|
|
<cvename>CVE-2013-1700</cvename>
|
|
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-49.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-50.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-51.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-52.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-53.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-54.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-55.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-56.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-57.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-58.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-59.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-60.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-61.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-62.html</url>
|
|
<url>http://www.mozilla.org/security/known-vulnerabilities/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-06-25</discovery>
|
|
<entry>2013-06-26</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="01cf67b3-dc3b-11e2-a6cd-c48508086173">
|
|
<topic>cURL library -- heap corruption in curl_easy_unescape</topic>
|
|
<affects>
|
|
<package>
|
|
<name>curl</name>
|
|
<range><ge>7.7</ge><lt>7.24.0_4</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>cURL developers report:</p>
|
|
<blockquote cite="http://curl.haxx.se/docs/adv_20130622.html">
|
|
<p>libcurl is vulnerable to a case of bad checking of the
|
|
input data which may lead to heap corruption.</p>
|
|
<p>The function curl_easy_unescape() decodes URL-encoded
|
|
strings to raw binary data. URL-encoded octets are
|
|
represented with %HH combinations where HH is a two-digit
|
|
hexadecimal number. The decoded string is written to an
|
|
allocated memory area that the function returns to the
|
|
caller.</p>
|
|
<p>The function takes a source string and a length
|
|
parameter, and if the length provided is 0 the function will
|
|
instead use strlen() to figure out how much data to
|
|
parse.</p>
|
|
<p>The "%HH" parser wrongly only considered the case where a
|
|
zero byte would terminate the input. If a length-limited
|
|
buffer was passed in which ended with a '%' character which
|
|
was followed by two hexadecimal digits outside of the buffer
|
|
libcurl was allowed to parse alas without a terminating
|
|
zero, libcurl would still parse that sequence as well. The
|
|
counter for remaining data to handle would then be decreased
|
|
too much and wrap to become a very large integer and the
|
|
copying would go on too long and the destination buffer that
|
|
is allocated on the heap would get overwritten.</p>
|
|
<p>We consider it unlikely that programs allow user-provided
|
|
strings unfiltered into this function. Also, only the not
|
|
zero-terminated input string use case is affected by this
|
|
flaw. Exploiting this flaw for gain is probably possible for
|
|
specific circumstances but we consider the general risk for
|
|
this to be low.</p>
|
|
<p>The curl command line tool is not affected by this
|
|
problem as it doesn't use this function.</p>
|
|
<p>There are no known exploits available at this time.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-2174</cvename>
|
|
<url>http://curl.haxx.se/docs/adv_20130622.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-06-22</discovery>
|
|
<entry>2013-06-23</entry>
|
|
<modified>2013-07-01</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="b162b218-c547-4ba2-ae31-6fdcb61bc763">
|
|
<topic>puppet -- Unauthenticated Remote Code Execution Vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>puppet</name>
|
|
<range><ge>2.7</ge><lt>2.7.22</lt></range>
|
|
<range><ge>3.0</ge><lt>3.2.2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Puppet Developers report:</p>
|
|
<blockquote cite="http://puppetlabs.com/security/cve/cve-2013-3567/">
|
|
<p>When making REST api calls, the puppet master takes YAML from an
|
|
untrusted client, deserializes it, and then calls methods on the
|
|
resulting object. A YAML payload can be crafted to cause the
|
|
deserialization to construct an instance of any class available in
|
|
the ruby process, which allows an attacker to execute code
|
|
contained in the payload.
|
|
</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-3567</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-06-13</discovery>
|
|
<entry>2013-06-22</entry>
|
|
<modified>2013-08-01</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="8b97d289-d8cf-11e2-a1f5-60a44c524f57">
|
|
<topic>otrs -- information disclosure</topic>
|
|
<affects>
|
|
<package>
|
|
<name>otrs</name>
|
|
<range><lt>3.2.8</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The OTRS Project reports:</p>
|
|
<blockquote cite="http://www.otrs.com/en/open-source/community-news/security-advisories/security-advisory-2013-04/">
|
|
<p>An attacker with a valid agent login could manipulate URLs in the ticket
|
|
watch mechanism to see contents of tickets they are not permitted to see.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-4088</cvename>
|
|
<url>http://www.otrs.com/en/open-source/community-news/security-advisories/security-advisory-2013-04/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-06-18</discovery>
|
|
<entry>2013-06-19</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="abef280d-d829-11e2-b71c-8c705af55518">
|
|
<topic>FreeBSD -- Privilege escalation via mmap</topic>
|
|
<affects>
|
|
<package>
|
|
<name>FreeBSD</name>
|
|
<range><gt>9.0</gt><lt>9.1_4</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<blockquote cite="http://www.freebsd.org/security/advisories/FreeBSD-SA-13%3a06.mmap.asc">
|
|
<p>Due to insufficient permission checks in the virtual memory
|
|
system, a tracing process (such as a debugger) may be able to
|
|
modify portions of the traced process's address space to which
|
|
the traced process itself does not have write access.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-2171</cvename>
|
|
<freebsdsa>SA-13:06.mmap</freebsdsa>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-06-18</discovery>
|
|
<entry>2013-06-18</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="279e5f4b-d823-11e2-928e-08002798f6ff">
|
|
<topic>apache-xml-security-c -- heap overflow</topic>
|
|
<affects>
|
|
<package>
|
|
<name>apache-xml-security-c</name>
|
|
<range><lt>1.7.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Apache Software Foundation reports:</p>
|
|
<blockquote cite="http://santuario.apache.org/secadv.data/CVE-2013-2156.txt">
|
|
<p>A heap overflow exists in the processing of the PrefixList
|
|
attribute optionally used in conjunction with Exclusive
|
|
Canonicalization, potentially allowing arbitary code execution.
|
|
If verification of the signature occurs prior to actual evaluation of a
|
|
signing key, this could be exploited by an unauthenticated attacker.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-2156</cvename>
|
|
<url>http://santuario.apache.org/secadv.data/CVE-2013-2156.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-06-18</discovery>
|
|
<entry>2013-06-18</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="80af2677-d6c0-11e2-8f5e-001966155bea">
|
|
<topic>tor -- guard discovery</topic>
|
|
<affects>
|
|
<package>
|
|
<name>tor-devel</name>
|
|
<range><lt>0.2.4.13.a_1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Tor Project reports:</p>
|
|
<blockquote cite="https://gitweb.torproject.org/tor.git/commit/2a95f3171681ee53c97ccba9d80f4454b462aaa7">
|
|
<p>Disable middle relay queue overfill detection code due to possible guard discovery attack</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>https://trac.torproject.org/projects/tor/ticket/9072</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-06-15</discovery>
|
|
<entry>2013-06-16</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="4e9e410b-d462-11e2-8d57-080027019be0">
|
|
<topic>dbus -- local dos</topic>
|
|
<affects>
|
|
<package>
|
|
<name>dbus</name>
|
|
<range><lt>1.6.12</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Simon McVittie reports:</p>
|
|
<blockquote cite="http://lists.freedesktop.org/archives/dbus/2013-June/015696.html">
|
|
<p>Alexandru Cornea discovered a vulnerability in libdbus caused
|
|
by an implementation bug in _dbus_printf_string_upper_bound().
|
|
This vulnerability can be exploited by a local user to crash
|
|
system services that use libdbus, causing denial of service.
|
|
It is platform-specific: x86-64 Linux is known to be affected.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-2168</cvename>
|
|
<url>http://lists.freedesktop.org/archives/dbus/2013-June/015696.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-06-13</discovery>
|
|
<entry>2013-06-13</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="fce67546-d2e7-11e2-a9bf-98fc11cdc4f5">
|
|
<topic>linux-flashplugin -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>linux-f10-flashplugin</name>
|
|
<range><lt>11.2r202.291</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Adobe reports:</p>
|
|
<blockquote cite="http://www.adobe.com/support/security/bulletins/apsb13-16.html">
|
|
<p>These updates address vulnerabilities that could cause a crash
|
|
and potentially allow an attacker to take control of the affected system.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-3343</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-06-11</discovery>
|
|
<entry>2013-06-14</entry>
|
|
<modified>2013-06-18</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="d7a43ee6-d2d5-11e2-9894-002590082ac6">
|
|
<topic>owncloud -- Multiple security vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>owncloud</name>
|
|
<range><lt>5.0.7</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The ownCloud development team reports:</p>
|
|
<blockquote cite="http://owncloud.org/about/security/advisories/">
|
|
<p>oC-SA-2013-019 / CVE-2013-2045: Multiple SQL Injections.
|
|
Credit to Mateusz Goik (aliantsoft.pl).</p>
|
|
<p>oC-SA-2013-020 / CVE-2013-[2039,2085]: Multiple directory traversals.
|
|
Credit to Mateusz Goik (aliantsoft.pl).</p>
|
|
<p>oC-SQ-2013-021 / CVE-2013-[2040-2042]: Multiple XSS vulnerabilities.
|
|
Credit to Mateusz Goik (aliantsoft.pl) and Kacper R. (http://devilteam.pl).</p>
|
|
<p>oC-SA-2013-022 / CVE-2013-2044: Open redirector.
|
|
Credit to Mateusz Goik (aliantsoft.pl).</p>
|
|
<p>oC-SA-2013-023 / CVE-2013-2047: Password autocompletion.</p>
|
|
<p>oC-SA-2013-024 / CVE-2013-2043: Privilege escalation in the calendar application.
|
|
Credit to Mateusz Goik (aliantsoft.pl).</p>
|
|
<p>oC-SA-2013-025 / CVE-2013-2048: Privilege escalation and CSRF in the API.</p>
|
|
<p>oC-SA-2013-026 / CVE-2013-2089: Incomplete blacklist vulnerability.</p>
|
|
<p>oC-SA-2013-027 / CVE-2013-2086: CSRF token leakage.</p>
|
|
<p>oC-SA-2013-028 / CVE-2013-[2149-2150]: Multiple XSS vulnerabilities.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://owncloud.org/about/security/advisories/oC-SA-2013-019/</url>
|
|
<url>http://owncloud.org/about/security/advisories/oC-SA-2013-020/</url>
|
|
<url>http://owncloud.org/about/security/advisories/oC-SA-2013-021/</url>
|
|
<url>http://owncloud.org/about/security/advisories/oC-SA-2013-022/</url>
|
|
<url>http://owncloud.org/about/security/advisories/oC-SA-2013-023/</url>
|
|
<url>http://owncloud.org/about/security/advisories/oC-SA-2013-024/</url>
|
|
<url>http://owncloud.org/about/security/advisories/oC-SA-2013-025/</url>
|
|
<url>http://owncloud.org/about/security/advisories/oC-SA-2013-026/</url>
|
|
<url>http://owncloud.org/about/security/advisories/oC-SA-2013-027/</url>
|
|
<url>http://owncloud.org/about/security/advisories/oC-SA-2013-028/</url>
|
|
<cvename>CVE-2013-2039</cvename>
|
|
<cvename>CVE-2013-2040</cvename>
|
|
<cvename>CVE-2013-2041</cvename>
|
|
<cvename>CVE-2013-2042</cvename>
|
|
<cvename>CVE-2013-2043</cvename>
|
|
<cvename>CVE-2013-2044</cvename>
|
|
<cvename>CVE-2013-2045</cvename>
|
|
<cvename>CVE-2013-2047</cvename>
|
|
<cvename>CVE-2013-2048</cvename>
|
|
<cvename>CVE-2013-2085</cvename>
|
|
<cvename>CVE-2013-2086</cvename>
|
|
<cvename>CVE-2013-2089</cvename>
|
|
<cvename>CVE-2013-2149</cvename>
|
|
<cvename>CVE-2013-2150</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-05-14</discovery>
|
|
<entry>2013-06-11</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="59e7163c-cf84-11e2-907b-0025905a4770">
|
|
<topic>php5 -- Heap based buffer overflow in quoted_printable_encode</topic>
|
|
<affects>
|
|
<package>
|
|
<name>php5</name>
|
|
<range><lt>5.4.16</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>php53</name>
|
|
<range><lt>5.3.26</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The PHP development team reports:</p>
|
|
<blockquote cite="http://www.php.net/ChangeLog-5.php">
|
|
<p>A Heap-based buffer overflow flaw was found in the php
|
|
quoted_printable_encode() function. A remote attacker could use
|
|
this flaw to cause php to crash or execute arbirary code with the
|
|
permission of the user running php</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-2110</cvename>
|
|
<url>https://bugzilla.redhat.com/show_bug.cgi?id=964969</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-06-06</discovery>
|
|
<entry>2013-06-07</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="72f35727-ce83-11e2-be04-005056a37f68">
|
|
<topic>dns/bind9* -- A recursive resolver can be crashed by a query for a malformed zone</topic>
|
|
<affects>
|
|
<package>
|
|
<name>bind99</name>
|
|
<range><gt>9.9.3</gt><lt>9.9.3.1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>bind99-base</name>
|
|
<range><gt>9.9.3</gt><lt>9.9.3.1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>bind98</name>
|
|
<range><gt>9.8.5</gt><lt>9.8.5.1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>bind98-base</name>
|
|
<range><gt>9.8.5</gt><lt>9.8.5.1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>bind96</name>
|
|
<range><gt>9.6.3.1.ESV.R9</gt><lt>9.6.3.2.ESV.R9</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>bind96-base</name>
|
|
<range><gt>9.6.3.1.ESV.R9</gt><lt>9.6.3.2.ESV.R9</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>ISC reports:</p>
|
|
<blockquote cite="https://kb.isc.org/article/AA-00967">
|
|
<p>A bug has been discovered in the most recent releases of
|
|
BIND 9 which has the potential for deliberate exploitation
|
|
as a denial-of-service attack. By sending a recursive
|
|
resolver a query for a record in a specially malformed zone,
|
|
an attacker can cause BIND 9 to exit with a fatal
|
|
"RUNTIME_CHECK" error in resolver.c.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-3919</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-06-04</discovery>
|
|
<entry>2013-06-06</entry>
|
|
<modified>2013-06-07</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="6b97436c-ce1e-11e2-9cb2-6805ca0b3d42">
|
|
<topic>phpMyAdmin -- XSS due to unescaped HTML output in Create View page</topic>
|
|
<affects>
|
|
<package>
|
|
<name>phpMyAdmin</name>
|
|
<range><ge>4.0</ge><lt>4.0.3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The phpMyAdmin development team reports:</p>
|
|
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2013-6.php">
|
|
<p>When creating a view with a crafted name and an incorrect
|
|
CREATE statement, it is possible to trigger an XSS.</p>
|
|
<p>This vulnerability can be triggered only by someone who
|
|
logged in to phpMyAdmin, as the usual token protection
|
|
prevents non-logged-in users from accessing the required
|
|
form.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2013-6.php</url>
|
|
<cvename>CVE-2013-3742</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-06-05</discovery>
|
|
<entry>2013-06-05</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="a3c2dee5-cdb9-11e2-b9ce-080027019be0">
|
|
<topic>telepathy-gabble -- TLS verification bypass</topic>
|
|
<affects>
|
|
<package>
|
|
<name>telepathy-gabble</name>
|
|
<range><lt>0.16.6</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Simon McVittie reports:</p>
|
|
<blockquote cite="http://lists.freedesktop.org/archives/telepathy/2013-May/006449.html">
|
|
<p>This release fixes a man-in-the-middle attack.</p>
|
|
<p>If you use an unencrypted connection to a "legacy Jabber"
|
|
(pre-XMPP) server, this version of Gabble will not connect
|
|
until you make one of these configuration changes:</p>
|
|
<p>. upgrade the server software to something that supports XMPP 1.0; or</p>
|
|
<p>. use an encrypted "old SSL" connection, typically on port 5223
|
|
(old-ssl); or</p>
|
|
<p>. turn off "Encryption required (TLS/SSL)" (require-encryption).</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-1431</cvename>
|
|
<url>http://lists.freedesktop.org/archives/telepathy/2013-May/006449.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-05-27</discovery>
|
|
<entry>2013-06-05</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="4865d189-cd62-11e2-ae11-00262d5ed8ee">
|
|
<topic>chromium -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>chromium</name>
|
|
<range><lt>27.0.1453.110</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Google Chrome Releases reports:</p>
|
|
<blockquote cite="http://googlechromereleases.blogspot.nl/">
|
|
<p>[242322] Medium CVE-2013-2855: Memory corruption in dev tools API.
|
|
Credit to "daniel.zulla".</p>
|
|
<p>[242224] High CVE-2013-2856: Use-after-free in input handling.
|
|
Credit to miaubiz.</p>
|
|
<p>[240124] High CVE-2013-2857: Use-after-free in image handling.
|
|
Credit to miaubiz.</p>
|
|
<p>[239897] High CVE-2013-2858: Use-after-free in HTML5 Audio. Credit
|
|
to "cdel921".</p>
|
|
<p>[237022] High CVE-2013-2859: Cross-origin namespace pollution.
|
|
to "bobbyholley".</p>
|
|
<p>[225546] High CVE-2013-2860: Use-after-free with workers accessing
|
|
database APIs. Credit to Collin Payne.</p>
|
|
<p>[209604] High CVE-2013-2861: Use-after-free with SVG. Credit to
|
|
miaubiz.</p>
|
|
<p>[161077] High CVE-2013-2862: Memory corruption in Skia GPU
|
|
handling. Credit to Atte Kettunen of OUSPG.</p>
|
|
<p>[232633] Critical CVE-2013-2863: Memory corruption in SSL socket
|
|
handling. Credit to Sebastian Marchand of the Chromium development
|
|
community.</p>
|
|
<p>[239134] High CVE-2013-2864: Bad free in PDF viewer. Credit to
|
|
Mateusz Jurczyk, with contributions by Gynvael Coldwind, both from
|
|
Google Security Team.</p>
|
|
<p>[246389] High CVE-2013-2865: Various fixes from internal audits,
|
|
fuzzing and other initiatives.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-2855</cvename>
|
|
<cvename>CVE-2013-2856</cvename>
|
|
<cvename>CVE-2013-2857</cvename>
|
|
<cvename>CVE-2013-2858</cvename>
|
|
<cvename>CVE-2013-2859</cvename>
|
|
<cvename>CVE-2013-2860</cvename>
|
|
<cvename>CVE-2013-2861</cvename>
|
|
<cvename>CVE-2013-2862</cvename>
|
|
<cvename>CVE-2013-2863</cvename>
|
|
<cvename>CVE-2013-2864</cvename>
|
|
<cvename>CVE-2013-2865</cvename>
|
|
<url>http://googlechromereleases.blogspot.nl/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-06-04</discovery>
|
|
<entry>2013-06-04</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="2eebebff-cd3b-11e2-8f09-001b38c3836c">
|
|
<topic>xorg -- protocol handling issues in X Window System client libraries</topic>
|
|
<affects>
|
|
<package>
|
|
<name>libX11</name>
|
|
<range><lt>1.6.0</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>libXext</name>
|
|
<range><lt>1.3.2</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>libXfixes</name>
|
|
<range><lt>5.0.1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>libXi</name>
|
|
<range><lt>1.7_1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>libXinerama</name>
|
|
<range><lt>1.1.3</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>libXp</name>
|
|
<range><lt>1.0.2</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>libXrandr</name>
|
|
<range><lt>1.4.1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>libXrender</name>
|
|
<range><lt>0.9.7_1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>libXres</name>
|
|
<range><lt>1.0.7</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>libXtst</name>
|
|
<range><lt>1.2.2</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>libXv</name>
|
|
<range><lt>1.0.8</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>libXvMC</name>
|
|
<range><lt>1.0.7_1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>libXxf86dga</name>
|
|
<range><lt>1.1.4</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>libdmx</name>
|
|
<range><lt>1.1.3</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>libxcb</name>
|
|
<range><lt>1.9.1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>libGL</name>
|
|
<range><lt>7.6.1_4</lt></range>
|
|
<range><gt>7.8.0</gt><lt>8.0.5_4</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>xf86-video-openchrome</name>
|
|
<range><lt>0.3.3</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>libFS</name>
|
|
<range><lt>1.0.5</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>libXxf86vm</name>
|
|
<range><lt>1.1.3</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>libXt</name>
|
|
<range><lt>1.1.4</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>libXcursor</name>
|
|
<range><lt>1.1.14</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>freedesktop.org reports:</p>
|
|
<blockquote cite="http://www.x.org/wiki/Development/Security/Advisory-2013-05-23">
|
|
<p>Ilja van Sprundel, a security researcher with IOActive, has
|
|
discovered a large number of issues in the way various X client
|
|
libraries handle the responses they receive from servers, and has
|
|
worked with X.Org's security team to analyze, confirm, and fix
|
|
these issues.</p>
|
|
<p>Most of these issues stem from the client libraries trusting the
|
|
server to send correct protocol data, and not verifying that the
|
|
values will not overflow or cause other damage. Most of the time X
|
|
clients & servers are run by the same user, with the server
|
|
more privileged from the clients, so this is not a problem, but
|
|
there are scenarios in which a privileged client can be connected
|
|
to an unprivileged server, for instance, connecting a setuid X
|
|
client (such as a screen lock program) to a virtual X server (such
|
|
as Xvfb or Xephyr) which the user has modified to return invalid
|
|
data, potentially allowing the user to escalate their privileges.</p>
|
|
<p>The vulnerabilities include:</p>
|
|
<p>Integer overflows calculating memory needs for replies.</p>
|
|
<p>Sign extension issues calculating memory needs for replies.</p>
|
|
<p>Buffer overflows due to not validating length or offset values in
|
|
replies.</p>
|
|
<p>Integer overflows parsing user-specified files.</p>
|
|
<p>Unbounded recursion parsing user-specified files.</p>
|
|
<p>Memory corruption due to unchecked return values.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-1981</cvename>
|
|
<cvename>CVE-2013-1982</cvename>
|
|
<cvename>CVE-2013-1983</cvename>
|
|
<cvename>CVE-2013-1984</cvename>
|
|
<cvename>CVE-2013-1985</cvename>
|
|
<cvename>CVE-2013-1986</cvename>
|
|
<cvename>CVE-2013-1987</cvename>
|
|
<cvename>CVE-2013-1988</cvename>
|
|
<cvename>CVE-2013-1989</cvename>
|
|
<cvename>CVE-2013-1990</cvename>
|
|
<cvename>CVE-2013-1991</cvename>
|
|
<cvename>CVE-2013-1992</cvename>
|
|
<cvename>CVE-2013-1993</cvename>
|
|
<cvename>CVE-2013-1994</cvename>
|
|
<cvename>CVE-2013-1995</cvename>
|
|
<cvename>CVE-2013-1996</cvename>
|
|
<cvename>CVE-2013-1997</cvename>
|
|
<cvename>CVE-2013-1998</cvename>
|
|
<cvename>CVE-2013-1999</cvename>
|
|
<cvename>CVE-2013-2000</cvename>
|
|
<cvename>CVE-2013-2001</cvename>
|
|
<cvename>CVE-2013-2002</cvename>
|
|
<cvename>CVE-2013-2003</cvename>
|
|
<cvename>CVE-2013-2004</cvename>
|
|
<cvename>CVE-2013-2005</cvename>
|
|
<cvename>CVE-2013-2062</cvename>
|
|
<cvename>CVE-2013-2063</cvename>
|
|
<cvename>CVE-2013-2064</cvename>
|
|
<cvename>CVE-2013-2066</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-05-23</discovery>
|
|
<entry>2013-06-04</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="e3f64457-cccd-11e2-af76-206a8a720317">
|
|
<topic>krb5 -- UDP ping-pong vulnerability in the kpasswd (password changing) service. [CVE-2002-2443]</topic>
|
|
<affects>
|
|
<package>
|
|
<name>krb5</name>
|
|
<range><le>1.11.2</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>No advisory has been released yet.</p>
|
|
<blockquote cite="http://web.mit.edu/kerberos/www/krb5-1.11/">
|
|
<p>schpw.c in the kpasswd service in kadmind in MIT Kerberos 5
|
|
(aka krb5) before 1.11.3 does not properly validate UDP packets
|
|
before sending responses, which allows remote attackers to cause
|
|
a denial of service (CPU and bandwidth consumption) via a forged
|
|
packet that triggers a communication loop, as demonstrated by
|
|
krb_pingpong.nasl, a related issue to CVE-1999-0103.
|
|
[CVE-2002-2443].</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2002-2443</cvename>
|
|
<url>http://web.mit.edu/kerberos/www/krb5-1.11/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-05-10</discovery>
|
|
<entry>2013-06-03</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="0bf376b7-cc6b-11e2-a424-14dae938ec40">
|
|
<topic>net/openafs -- buffer overflow</topic>
|
|
<affects>
|
|
<package>
|
|
<name>openafs</name>
|
|
<range><lt>1.6.2.*</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Nickolai Zeldovich reports:</p>
|
|
<blockquote cite="http://www.openafs.org/pages/security/OPENAFS-SA-2013-001.txt">
|
|
<p>An attacker with the ability to manipulate AFS directory ACLs may
|
|
crash the fileserver hosting that volume.
|
|
In addition, once a corrupt ACL is placed on a fileserver, its
|
|
existence may crash client utilities manipulating ACLs
|
|
on that server.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://www.openafs.org/pages/security/OPENAFS-SA-2013-001.txt</url>
|
|
<cvename>CVE-2013-1794</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-02-27</discovery>
|
|
<entry>2013-06-03</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="9dfb63b8-8f36-11e2-b34d-000c2957946c">
|
|
<topic>www/mod_security -- NULL pointer dereference DoS</topic>
|
|
<affects>
|
|
<package>
|
|
<name>mod_security</name>
|
|
<range><lt>2.7.3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>SecurityFocus reports:</p>
|
|
<blockquote cite="http://www.securityfocus.com/archive/1/526746">
|
|
<p>When ModSecurity receives a request body with a size bigger than the
|
|
value set by the "SecRequestBodyInMemoryLimit" and with a "Content-Type"
|
|
that has no request body processor mapped to it, ModSecurity will
|
|
systematically crash on every call to "forceRequestBodyVariable".</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-2765</cvename>
|
|
<url>https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-2765</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-05-27</discovery>
|
|
<entry>2013-06-03</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="1225549f-ca91-11e2-b3b8-f0def16c5c1b">
|
|
<topic>passenger -- security vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>rubygem-passenger</name>
|
|
<range><lt>4.0.5</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Phusion reports:</p>
|
|
<blockquote cite="http://blog.phusion.nl/2013/05/29/phusion-passenger-4-0-5-released/">
|
|
<p>A denial of service and arbitrary code execution by hijacking temp files. [CVE-2013-2119]</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-2119</cvename>
|
|
<url>http://blog.phusion.nl/2013/05/29/phusion-passenger-4-0-5-released/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-05-29</discovery>
|
|
<entry>2013-06-01</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="ce502902-ca39-11e2-9673-001e8c75030d">
|
|
<topic>devel/subversion -- svnserve remotely triggerable DoS</topic>
|
|
<affects>
|
|
<package>
|
|
<name>subversion</name>
|
|
<range><ge>1.7.0</ge><lt>1.7.10</lt></range>
|
|
<range><ge>1.0.0</ge><lt>1.6.23</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Subversion team reports:</p>
|
|
<blockquote cite="http://subversion.apache.org/security/CVE-2013-2112-advisory.txt">
|
|
<p>Subversion's svnserve server process may exit when an incoming TCP connection
|
|
is closed early in the connection process.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-2112</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-05-31</discovery>
|
|
<entry>2013-05-31</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="6d0bf320-ca39-11e2-9673-001e8c75030d">
|
|
<topic>devel/subversion -- contrib hook-scripts can allow arbitrary code execution</topic>
|
|
<affects>
|
|
<package>
|
|
<name>subversion</name>
|
|
<range><ge>1.7.0</ge><lt>1.7.10</lt></range>
|
|
<range><ge>1.2.0</ge><lt>1.6.23</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Subversion team reports:</p>
|
|
<blockquote cite="http://subversion.apache.org/security/CVE-2013-2088-advisory.txt">
|
|
<p>The script contrib/hook-scripts/check-mime-type.pl does not escape
|
|
argv arguments to 'svnlook' that start with a hyphen. This could be
|
|
used to cause 'svnlook', and hence check-mime-type.pl, to error out.</p>
|
|
<p>The script contrib/hook-scripts/svn-keyword-check.pl parses filenames
|
|
from the output of 'svnlook changed' and passes them to a further
|
|
shell command (equivalent to the 'system()' call of the C standard
|
|
library) without escaping them. This could be used to run arbitrary
|
|
shell commands in the context of the user whom the pre-commit script
|
|
runs as (the user who owns the repository).</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-2088</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-05-31</discovery>
|
|
<entry>2013-05-31</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="787d21b9-ca38-11e2-9673-001e8c75030d">
|
|
<topic>devel/subversion -- fsfs repositories can be corrupted by newline characters in filenames</topic>
|
|
<affects>
|
|
<package>
|
|
<name>subversion</name>
|
|
<range><ge>1.7.0</ge><lt>1.7.10</lt></range>
|
|
<range><ge>1.1.0</ge><lt>1.6.23</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Subversion team reports:</p>
|
|
<blockquote cite="http://subversion.apache.org/security/CVE-2013-1968-advisory.txt">
|
|
<p>If a filename which contains a newline character (ASCII 0x0a) is
|
|
committed to a repository using the FSFS format, the resulting
|
|
revision is corrupt.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-1968</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-05-31</discovery>
|
|
<entry>2013-05-31</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="0a799a8e-c9d4-11e2-a424-14dae938ec40">
|
|
<topic>irc/bitchx -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>BitchX</name>
|
|
<range><lt>1.2.*,1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>bannedit reports:</p>
|
|
<blockquote cite="http://www.cvedetails.com/cve/CVE-2007-4584/">
|
|
<p>Stack-based buffer overflow in BitchX 1.1 Final allows remote IRC
|
|
servers to execute arbitrary code via a long string in a MODE
|
|
command, related to the p_mode variable.</p>
|
|
</blockquote>
|
|
<p>Nico Golde reports:</p>
|
|
<blockquote cite="http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=449149">
|
|
<p>There is a security issue in ircii-pana in bitchx' hostname
|
|
command. The e_hostname function (commands.c) uses tmpnam to
|
|
create a temporary file which is known to be insecure.</p>
|
|
</blockquote>
|
|
<p>Chris reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/27556">
|
|
<p>Chris has reported a vulnerability in the Cypress script for
|
|
BitchX, which can be exploited by malicious people to disclose
|
|
potentially sensitive information or to compromise a vulnerable
|
|
system.</p>
|
|
|
|
<p>The vulnerability is caused due to malicious code being present
|
|
in the modules/mdop.m file. This can be exploited to disclose the
|
|
content of various system files or to execute arbitrary shell
|
|
commands.</p>
|
|
|
|
<p>Successful exploitation allows execution of arbitrary code, but
|
|
requires the control of the "lsyn.webhop.net" domain.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2007-4584</cvename>
|
|
<cvename>CVE-2007-5839</cvename>
|
|
<cvename>CVE-2007-5922</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-08-28</discovery>
|
|
<entry>2013-05-31</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="19751e06-c798-11e2-a373-000c29833058">
|
|
<topic>znc -- null pointer dereference in webadmin module</topic>
|
|
<affects>
|
|
<package>
|
|
<name>znc</name>
|
|
<range><lt>1.0_1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>No advisory has been released yet.</p>
|
|
<blockquote cite="https://github.com/znc/znc/commit/2bd410ee5570cea127233f1133ea22f25174eb28">
|
|
<p>Fix NULL pointer dereference in webadmin.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>https://github.com/znc/znc/commit/2bd410ee5570cea127233f1133ea22f25174eb28</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-05-27</discovery>
|
|
<entry>2013-05-28</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="6d87c2e9-c64d-11e2-9c22-50465d9ff992">
|
|
<topic>socat -- FD leak</topic>
|
|
<affects>
|
|
<package>
|
|
<name>socat</name>
|
|
<range><lt>1.7.2.2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Gerhard Rieger reports:</p>
|
|
<blockquote cite="http://seclists.org/oss-sec/2013/q2/411">
|
|
<p>Under certain circumstances an FD leak occurs and can be misused for
|
|
denial of service attacks against socat running in server mode.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-3571</cvename>
|
|
<url>http://seclists.org/oss-sec/2013/q2/411</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-05-26</discovery>
|
|
<entry>2013-05-26</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="79789daa-8af8-4e21-a47f-e8a645752bdb">
|
|
<topic>ruby -- Object taint bypassing in DL and Fiddle in Ruby</topic>
|
|
<affects>
|
|
<package>
|
|
<name>ruby19</name>
|
|
<range><lt>1.9.3.429,1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Ruby Developers report:</p>
|
|
<blockquote cite="http://www.ruby-lang.org/en/news/2013/05/14/taint-bypass-dl-fiddle-cve-2013-2065/">
|
|
<p>There is a vulnerability in DL and Fiddle in Ruby where tainted
|
|
strings can be used by system calls regardless of the $SAFE level
|
|
set in Ruby.
|
|
</p>
|
|
<p>Native functions exposed to Ruby with DL or Fiddle do not check the
|
|
taint values set on the objects passed in. This can result in
|
|
tainted objects being accepted as input when a SecurityError
|
|
exception should be raised.
|
|
</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-2065</cvename>
|
|
<url>http://www.ruby-lang.org/en/news/2013/05/14/taint-bypass-dl-fiddle-cve-2013-2065/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-05-14</discovery>
|
|
<entry>2013-05-26</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="4fb45a1c-c5d0-11e2-8400-001b216147b0">
|
|
<topic>couchdb -- DOM based Cross-Site Scripting via Futon UI</topic>
|
|
<affects>
|
|
<package>
|
|
<name>couchdb</name>
|
|
<range><lt>1.2.1,1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Jan Lehnardt reports:</p>
|
|
<blockquote cite="http://mail-archives.apache.org/mod_mbox/couchdb-user/201301.mbox/%3C2FFF2FD7-8EAF-4EBF-AFDA-5AEB6EAC853F@apache.org%3E">
|
|
<p>Query parameters passed into the browser-based test suite
|
|
are not sanitised, and can be used to load external resources.
|
|
An attacker may execute JavaScript code in the browser, using
|
|
the context of the remote user.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-5650</cvename>
|
|
<url>http://mail-archives.apache.org/mod_mbox/couchdb-user/201301.mbox/%3C2FFF2FD7-8EAF-4EBF-AFDA-5AEB6EAC853F@apache.org%3E</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-01-14</discovery>
|
|
<entry>2013-05-26</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="a5b24a6b-c37c-11e2-addb-60a44c524f57">
|
|
<topic>otrs -- information disclosure</topic>
|
|
<affects>
|
|
<package>
|
|
<name>otrs</name>
|
|
<range><lt>3.2.7</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The OTRS Project reports:</p>
|
|
<blockquote cite="http://www.otrs.com/en/open-source/community-news/security-advisories/security-advisory-2013-03/">
|
|
<p>An attacker with a valid agent login could manipulate URLs in the ticket split mechanism to see contents of tickets and they are not permitted to see.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-3551</cvename>
|
|
<url>http://www.otrs.com/en/open-source/community-news/security-advisories/security-advisory-2013-03/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-05-22</discovery>
|
|
<entry>2013-05-23</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="661bd031-c37d-11e2-addb-60a44c524f57">
|
|
<topic>otrs -- XSS vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>otrs</name>
|
|
<range><lt>3.1.8</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The OTRS Project reports:</p>
|
|
<blockquote cite="http://www.otrs.com/en/open-source/community-news/security-advisories/security-advisory-2013-02/">
|
|
<p>An attacker with permission to write changes, workorder items or FAQ articles could inject JavaScript code into the articles which would be executed by the browser of other users reading the article.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-2637</cvename>
|
|
<url>http://www.otrs.com/en/open-source/community-news/security-advisories/security-advisory-2013-02/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-04-02</discovery>
|
|
<entry>2013-05-23</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="3a429192-c36a-11e2-97a9-6805ca0b3d42">
|
|
<topic>RT -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>rt38</name>
|
|
<range><ge>3.8</ge><lt>3.8.17</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>rt40</name>
|
|
<range><ge>4.0</ge><lt>4.0.13</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Thomas Sibley reports:</p>
|
|
<blockquote cite="http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000226.html">
|
|
<p>We discovered a number of security vulnerabilities which
|
|
affect both RT 3.8.x and RT 4.0.x. We are releasing RT
|
|
versions 3.8.17 and 4.0.13 to resolve these vulnerabilities,
|
|
as well as patches which apply atop all released versions of
|
|
3.8 and 4.0.</p>
|
|
<p>The vulnerabilities addressed by 3.8.17, 4.0.13, and the
|
|
below patches include the following:</p>
|
|
<p>RT 4.0.0 and above are vulnerable to a limited privilege
|
|
escalation leading to unauthorized modification of ticket
|
|
data. The DeleteTicket right and any custom lifecycle
|
|
transition rights may be bypassed by any user with
|
|
ModifyTicket. This vulnerability is assigned
|
|
CVE-2012-4733.</p>
|
|
<p>RT 3.8.0 and above include a version of bin/rt that uses
|
|
semi-predictable names when creating tempfiles. This could
|
|
possibly be exploited by a malicious user to overwrite files
|
|
with permissions of the user running bin/rt. This
|
|
vulnerability is assigned CVE-2013-3368.</p>
|
|
<p>RT 3.8.0 and above allow calling of arbitrary Mason
|
|
components (without control of arguments) for users who can
|
|
see administration pages. This could be used by a malicious
|
|
user to run private components which may have negative
|
|
side-effects. This vulnerability is assigned
|
|
CVE-2013-3369.</p>
|
|
<p>RT 3.8.0 and above allow direct requests to private
|
|
callback components. Though no callback components ship
|
|
with RT, this could be used to exploit an extension or local
|
|
callback which uses the arguments passed to it insecurely.
|
|
This vulnerability is assigned CVE-2013-3370.</p>
|
|
<p>RT 3.8.3 and above are vulnerable to cross-site scripting
|
|
(XSS) via attachment filenames. The vector is difficult to
|
|
exploit due to parsing requirements. Additionally, RT 4.0.0
|
|
and above are vulnerable to XSS via maliciously-crafted
|
|
"URLs" in ticket content when RT's "MakeClicky" feature is
|
|
configured. Although not believed to be exploitable in the
|
|
stock configuration, a patch is also included for RTIR 2.6.x
|
|
to add bulletproofing. These vulnerabilities are assigned
|
|
CVE-2013-3371.</p>
|
|
<p>RT 3.8.0 and above are vulnerable to an HTTP header
|
|
injection limited to the value of the Content-Disposition
|
|
header. Injection of other arbitrary response headers is
|
|
not possible. Some (especially older) browsers may allow
|
|
multiple Content-Disposition values which could lead to XSS.
|
|
Newer browsers contain security measures to prevent this.
|
|
Thank you to Dominic Hargreaves for reporting this
|
|
vulnerability. This vulnerability is assigned
|
|
CVE-2013-3372.</p>
|
|
<p>RT 3.8.0 and above are vulnerable to a MIME header
|
|
injection in outgoing email generated by RT. The vectors
|
|
via RT's stock templates are resolved by this patchset, but
|
|
any custom email templates should be updated to ensure that
|
|
values interpolated into mail headers do not contain
|
|
newlines. This vulnerability is assigned CVE-2013-3373.</p>
|
|
<p>RT 3.8.0 and above are vulnerable to limited session
|
|
re-use when using the file-based session store,
|
|
Apache::Session::File. RT's default session configuration
|
|
only uses Apache::Session::File for Oracle. RT instances
|
|
using Oracle may be locally configured to use the
|
|
database-backed Apache::Session::Oracle, in which case
|
|
sessions are never re-used. The extent of session re-use is
|
|
limited to information leaks of certain user preferences and
|
|
caches, such as queue names available for ticket creation.
|
|
Thank you to Jenny Martin for reporting the problem that
|
|
lead to discovery of this vulnerability. This vulnerability
|
|
is assigned CVE-2013-3374.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000226.html</url>
|
|
<url>http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000227.html</url>
|
|
<url>http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000228.html</url>
|
|
<cvename>CVE-2012-4733</cvename>
|
|
<cvename>CVE-2013-3368</cvename>
|
|
<cvename>CVE-2013-3369</cvename>
|
|
<cvename>CVE-2013-3370</cvename>
|
|
<cvename>CVE-2013-3371</cvename>
|
|
<cvename>CVE-2013-3372</cvename>
|
|
<cvename>CVE-2013-3373</cvename>
|
|
<cvename>CVE-2013-3374</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-05-22</discovery>
|
|
<entry>2013-05-23</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="358133b5-c2b9-11e2-a738-00262d5ed8ee">
|
|
<topic>chromium -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>chromium</name>
|
|
<range><lt>27.0.1453.93</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Google Chrome Releases reports:</p>
|
|
<blockquote cite="http://googlechromereleases.blogspot.nl/search/Stable%20Updates">
|
|
<p>[235638] High CVE-2013-2837: Use-after-free in SVG. Credit to
|
|
Slawomir Blazek.</p>
|
|
<p>[235311] Medium CVE-2013-2838: Out-of-bounds read in v8. Credit to
|
|
Christian Holler.</p>
|
|
<p>[230176] High CVE-2013-2839: Bad cast in clipboard handling.
|
|
Credit to Jon of MWR InfoSecurity.</p>
|
|
<p>[230117] High CVE-2013-2840: Use-after-free in media loader.
|
|
Credit to Nils of MWR InfoSecurity.</p>
|
|
<p>[227350] High CVE-2013-2841: Use-after-free in Pepper resource
|
|
handling. Credit to Chamal de Silva.</p>
|
|
<p>[226696] High CVE-2013-2842: Use-after-free in widget handling.
|
|
Credit to Cyril Cattiaux.</p>
|
|
<p>[222000] High CVE-2013-2843: Use-after-free in speech handling.
|
|
Credit to Khalil Zhani.</p>
|
|
<p>[196393] High CVE-2013-2844: Use-after-free in style resolution.
|
|
Credit to Sachin Shinde (@cons0ul).</p>
|
|
<p>[188092] [179522] [222136] [188092] High CVE-2013-2845: Memory
|
|
safety issues in Web Audio. Credit to Atte Kettunen of OUSPG.</p>
|
|
<p>[177620] High CVE-2013-2846: Use-after-free in media loader.
|
|
Credit to Chamal de Silva.</p>
|
|
<p>[176692] High CVE-2013-2847: Use-after-free race condition with
|
|
workers. Credit to Collin Payne.</p>
|
|
<p>[176137] Medium CVE-2013-2848: Possible data extraction with XSS
|
|
Auditor. Credit to Egor Homakov.</p>
|
|
<p>[171392] Low CVE-2013-2849: Possible XSS with drag+drop or
|
|
copy+paste. Credit to Mario Heiderich.</p>
|
|
<p>[241595] High CVE-2013-2836: Various fixes from internal audits,
|
|
fuzzing and other initiatives.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-2836</cvename>
|
|
<cvename>CVE-2013-2837</cvename>
|
|
<cvename>CVE-2013-2838</cvename>
|
|
<cvename>CVE-2013-2839</cvename>
|
|
<cvename>CVE-2013-2840</cvename>
|
|
<cvename>CVE-2013-2841</cvename>
|
|
<cvename>CVE-2013-2842</cvename>
|
|
<cvename>CVE-2013-2843</cvename>
|
|
<cvename>CVE-2013-2844</cvename>
|
|
<cvename>CVE-2013-2845</cvename>
|
|
<cvename>CVE-2013-2846</cvename>
|
|
<cvename>CVE-2013-2847</cvename>
|
|
<cvename>CVE-2013-2848</cvename>
|
|
<cvename>CVE-2013-2849</cvename>
|
|
<url>http://googlechromereleases.blogspot.nl/search/Stable%20Updates</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-05-21</discovery>
|
|
<entry>2013-05-22</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="c72a2494-c08b-11e2-bb21-083e8ed0f47b">
|
|
<topic>plib -- stack-based buffer overflow</topic>
|
|
<affects>
|
|
<package>
|
|
<name>plib</name>
|
|
<range><lt>1.8.5_4</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>CVE reports:</p>
|
|
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=2012-4552">
|
|
<p>Stack-based buffer overflow in the error function in
|
|
ssg/ssgParser.cxx in PLIB 1.8.5 allows remote attackers to
|
|
execute arbitrary code via a crafted 3d model file that
|
|
triggers a long error message, as demonstrated by a .ase
|
|
file.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>55839</bid>
|
|
<cvename>CVE-2012-4552</cvename>
|
|
<mlist>http://www.openwall.com/lists/oss-security/2012/10/29/8</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-10-09</discovery>
|
|
<entry>2013-05-19</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="13bf0602-c08a-11e2-bb21-083e8ed0f47b">
|
|
<topic>plib -- buffer overflow</topic>
|
|
<affects>
|
|
<package>
|
|
<name>plib</name>
|
|
<range><lt>1.8.5_4</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="https://secunia.com/advisories/47297">
|
|
<p>A vulnerability has been discovered in PLIB, which can be
|
|
exploited by malicious people to compromise an application
|
|
using the library. The vulnerability is caused due to a
|
|
boundary error within the "ulSetError()" function
|
|
(src/util/ulError.cxx) when creating the error message,
|
|
which can be exploited to overflow a static buffer.</p>
|
|
<p>Successful exploitation allows the execution of arbitrary
|
|
code but requires that the attacker can e.g. control the
|
|
content of an overly long error message passed to the
|
|
"ulSetError()" function.</p>
|
|
<p>The vulnerability is confirmed in version 1.8.5. Other
|
|
versions may also be affected.</p>
|
|
<p>Originally reported in TORCS by Andres Gomez.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2011-4620</cvename>
|
|
<mlist>http://openwall.com/lists/oss-security/2011/12/21/2</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-12-21</discovery>
|
|
<entry>2013-05-19</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="a0c65049-bddd-11e2-a0f6-001060e06fd4">
|
|
<topic>linux-flashplugin -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>linux-f10-flashplugin</name>
|
|
<range><lt>11.2r202.285</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Adobe reports:</p>
|
|
<blockquote cite="http://www.adobe.com/support/security/bulletins/apsb13-14.html">
|
|
<p>These updates address vulnerabilities that could cause a crash
|
|
and potentially allow an attacker to take control of the affected system.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-2728</cvename>
|
|
<cvename>CVE-2013-3324</cvename>
|
|
<cvename>CVE-2013-3325</cvename>
|
|
<cvename>CVE-2013-3326</cvename>
|
|
<cvename>CVE-2013-3327</cvename>
|
|
<cvename>CVE-2013-3328</cvename>
|
|
<cvename>CVE-2013-3329</cvename>
|
|
<cvename>CVE-2013-3330</cvename>
|
|
<cvename>CVE-2013-3331</cvename>
|
|
<cvename>CVE-2013-3332</cvename>
|
|
<cvename>CVE-2013-3333</cvename>
|
|
<cvename>CVE-2013-3334</cvename>
|
|
<cvename>CVE-2013-3335</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-05-14</discovery>
|
|
<entry>2013-05-16</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="4a1ca8a4-bd82-11e2-b7a0-d43d7e0c7c02">
|
|
<topic>mozilla -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>firefox</name>
|
|
<range><gt>18.0,1</gt><lt>21.0,1</lt></range>
|
|
<range><lt>17.0.6,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-firefox</name>
|
|
<range><lt>17.0.6,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-seamonkey</name>
|
|
<range><lt>2.17.1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-thunderbird</name>
|
|
<range><lt>17.0.6</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>seamonkey</name>
|
|
<range><lt>2.17.1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>thunderbird</name>
|
|
<range><gt>11.0</gt><lt>17.0.6</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Mozilla Project reports:</p>
|
|
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
|
|
<p>MFSA 2013-41 Miscellaneous memory safety hazards (rv:21.0
|
|
/ rv:17.0.6)</p>
|
|
<p>MFSA 2013-42 Privileged access for content level constructor</p>
|
|
<p>MFSA 2013-43 File input control has access to full path</p>
|
|
<p>MFSA 2013-44 Local privilege escalation through Mozilla
|
|
Maintenance Service</p>
|
|
<p>MFSA 2013-45 Mozilla Updater fails to update some Windows Registry
|
|
entries</p>
|
|
<p>MFSA 2013-46 Use-after-free with video and onresize event</p>
|
|
<p>MFSA 2013-47 Uninitialized functions in DOMSVGZoomEvent</p>
|
|
<p>MFSA 2013-48 Memory corruption found using Address Sanitizer</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-1942</cvename>
|
|
<cvename>CVE-2013-0801</cvename>
|
|
<cvename>CVE-2013-1669</cvename>
|
|
<cvename>CVE-2013-1670</cvename>
|
|
<cvename>CVE-2013-1671</cvename>
|
|
<cvename>CVE-2013-1672</cvename>
|
|
<cvename>CVE-2013-1674</cvename>
|
|
<cvename>CVE-2013-1675</cvename>
|
|
<cvename>CVE-2013-1676</cvename>
|
|
<cvename>CVE-2013-1677</cvename>
|
|
<cvename>CVE-2013-1678</cvename>
|
|
<cvename>CVE-2013-1679</cvename>
|
|
<cvename>CVE-2013-1680</cvename>
|
|
<cvename>CVE-2013-1681</cvename>
|
|
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-40.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-41.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-42.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-43.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-44.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-45.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-46.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-47.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-48.html</url>
|
|
<url>http://www.mozilla.org/security/known-vulnerabilities/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-05-14</discovery>
|
|
<entry>2013-05-15</entry>
|
|
<modified>2013-05-21</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="efaa4071-b700-11e2-b1b9-f0def16c5c1b">
|
|
<topic>nginx -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>nginx</name>
|
|
<range><ge>1.2.0,1</ge><le>1.2.8,1</le></range>
|
|
<range><ge>1.3.0,1</ge><lt>1.4.1,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>nginx-devel</name>
|
|
<range><ge>1.1.4</ge><le>1.2.8</le></range>
|
|
<range><ge>1.3.0</ge><lt>1.5.0</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The nginx project reports:</p>
|
|
<blockquote cite="http://nginx.org/en/security_advisories.html">
|
|
<p>A stack-based buffer overflow might occur in a worker process
|
|
process while handling a specially crafted request, potentially
|
|
resulting in arbitrary code execution. [CVE-2013-2028]</p>
|
|
<p>A security problem related to CVE-2013-2028 was identified,
|
|
affecting some previous nginx versions if proxy_pass to
|
|
untrusted upstream HTTP servers is used.</p>
|
|
<p>The problem may lead to a denial of service or a disclosure of a
|
|
worker process memory on a specially crafted response from an
|
|
upstream proxied server. [CVE-2013-2070]</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-2028</cvename>
|
|
<cvename>CVE-2013-2070</cvename>
|
|
<url>http://mailman.nginx.org/pipermail/nginx-announce/2013/000114.html</url>
|
|
<url>http://mailman.nginx.org/pipermail/nginx-announce/2013/000112.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-05-07</discovery>
|
|
<entry>2013-05-07</entry>
|
|
<modified>2013-05-16</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="6ff570cb-b418-11e2-b279-20cf30e32f6d">
|
|
<topic>strongSwan -- ECDSA signature verification issue</topic>
|
|
<affects>
|
|
<package>
|
|
<name>strongswan</name>
|
|
<range><lt>5.0.4</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>strongSwan security team reports:</p>
|
|
<blockquote cite="http://www.strongswan.org/blog/2013/04/30/strongswan-5.0.4-released-%28cve-2013-2944%29.html">
|
|
<p>If the openssl plugin is used for ECDSA signature verification an empty,
|
|
zeroed or otherwise invalid signature is handled as a legitimate one.
|
|
Both IKEv1 and IKEv2 are affected.</p>
|
|
<p>Affected are only installations that have enabled and loaded the OpenSSL
|
|
crypto backend (--enable-openssl). Builds using the default crypto backends
|
|
are not affected.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-2944</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-04-30</discovery>
|
|
<entry>2013-05-03</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="622e14b1-b40c-11e2-8441-00e0814cab4e">
|
|
<topic>jenkins -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>jenkins</name>
|
|
<range><lt>1.514</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Jenkins Security Advisory reports:</p>
|
|
<blockquote cite="https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2013-05-02">
|
|
<p>This advisory announces multiple security vulnerabilities that
|
|
were found in Jenkins core.</p>
|
|
<ol>
|
|
<li>
|
|
<p>SECURITY-63 / CVE-2013-2034</p>
|
|
<p>This creates a cross-site request forgery (CSRF) vulnerability
|
|
on Jenkins master, where an anonymous attacker can trick an
|
|
administrator to execute arbitrary code on Jenkins master by
|
|
having him open a specifically crafted attack URL.</p>
|
|
<p>There's also a related vulnerability where the permission
|
|
check on this ability is done imprecisely, which may affect
|
|
those who are running Jenkins instances with a custom
|
|
authorization strategy plugin.</p>
|
|
</li>
|
|
<li>
|
|
<p>SECURITY-67 / CVE-2013-2033</p>
|
|
<p>This creates a cross-site scripting (XSS) vulnerability, where
|
|
an attacker with a valid user account on Jenkins can execute
|
|
JavaScript in the browser of other users, if those users are
|
|
using certain browsers.</p>
|
|
</li>
|
|
<li>
|
|
<p>SECURITY-69 / CVE-2013-2034</p>
|
|
<p>This is another CSRF vulnerability that allows an attacker to
|
|
cause a deployment of binaries to Maven repositories. This
|
|
vulnerability has the same CVE ID as SEUCRITY-63.</p>
|
|
</li>
|
|
<li>
|
|
<p>SECURITY-71 / CVE-2013-1808</p>
|
|
<p>This creates a cross-site scripting (XSS) vulnerability.</p>
|
|
</li>
|
|
</ol>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2013-05-02</url>
|
|
<cvename>CVE-2013-2034</cvename>
|
|
<cvename>CVE-2013-2033</cvename>
|
|
<cvename>CVE-2013-2034</cvename>
|
|
<cvename>CVE-2013-1808</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-05-02</discovery>
|
|
<entry>2013-05-03</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="e66a6e2f-b0d5-11e2-9164-0016e6dcb562">
|
|
<topic>FreeBSD -- NFS remote denial of service</topic>
|
|
<affects>
|
|
<package>
|
|
<name>FreeBSD</name>
|
|
<range><gt>8.3</gt><lt>8.3_8</lt></range>
|
|
<range><gt>9.1</gt><lt>9.1_3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<blockquote cite="http://www.freebsd.org/security/advisories/FreeBSD-SA-13:05.nfsserver.asc">
|
|
<p>Insufficient input validation in the NFS server allows an
|
|
attacker to cause the underlying file system to treat a
|
|
regular file as a directory.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-3266</cvename>
|
|
<freebsdsa>SA-13:05.nfsserver</freebsdsa>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-04-21</discovery>
|
|
<entry>2013-04-29</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="57df803e-af34-11e2-8d62-6cf0490a8c18">
|
|
<topic>Joomla! -- XXS and DDoS vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>joomla</name>
|
|
<range><ge>2.0.*</ge><lt>2.5.10</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The JSST and the Joomla! Security Center report:</p>
|
|
<blockquote cite="http://developer.joomla.org/security/80-20130405-core-xss-vulnerability.html">
|
|
<h2>[20130405] - Core - XSS Vulnerability</h2>
|
|
<p>Inadequate filtering leads to XSS vulnerability in Voting plugin.</p>
|
|
</blockquote>
|
|
<blockquote cite="http://developer.joomla.org/security/81-20130403-core-xss-vulnerability.html">
|
|
<h2>[20130403] - Core - XSS Vulnerability</h2>
|
|
<p>Inadequate filtering allows possibility of XSS exploit in some
|
|
circumstances.</p>
|
|
</blockquote>
|
|
<blockquote cite="http://developer.joomla.org/security/82-20130402-core-information-disclosure.html">
|
|
<h2>[20130402] - Core - Information Disclosure</h2>
|
|
<p>Inadequate permission checking allows unauthorised user to see
|
|
permission settings in some circumstances.</p>
|
|
</blockquote>
|
|
<blockquote cite="http://developer.joomla.org/security/83-20130404-core-xss-vulnerability.html">
|
|
<h2>[20130404] - Core - XSS Vulnerability</h2>
|
|
<p>Use of old version of Flash-based file uploader leads to XSS
|
|
vulnerability.</p>
|
|
</blockquote>
|
|
<blockquote cite="http://developer.joomla.org/security/84-20130401-core-privilege-escalation.html">
|
|
<h2>[20130401] - Core - Privilege Escalation</h2>
|
|
<p>Inadequate permission checking allows unauthorised user to delete
|
|
private messages.</p>
|
|
</blockquote>
|
|
<blockquote cite="http://developer.joomla.org/security/85-20130406-core-dos-vulnerability.html">
|
|
<h2>[20130406] - Core - DOS Vulnerability</h2>
|
|
<p>Object unserialize method leads to possible denial of service
|
|
vulnerability.</p>
|
|
</blockquote>
|
|
<blockquote cite="http://developer.joomla.org/security/86-20130407-core-xss-vulnerability.html">
|
|
<h2>[20130407] - Core - XSS Vulnerability</h2>
|
|
<p>Inadequate filtering leads to XSS vulnerability in highlighter
|
|
plugin</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-3059</cvename>
|
|
<cvename>CVE-2013-3058</cvename>
|
|
<cvename>CVE-2013-3057</cvename>
|
|
<url>http://developer.joomla.org/security/83-20130404-core-xss-vulnerability.html</url>
|
|
<cvename>CVE-2013-3056</cvename>
|
|
<cvename>CVE-2013-3242</cvename>
|
|
<cvename>CVE-2013-3267</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-04-24</discovery>
|
|
<entry>2013-04-27</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="8c8fa44d-ad15-11e2-8cea-6805ca0b3d42">
|
|
<topic>phpMyAdmin -- Multiple security vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>phpMyAdmin</name>
|
|
<range><ge>3.5</ge><lt>3.5.8.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The phpMyAdmin development team reports:</p>
|
|
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2013-2.php">
|
|
<p>In some PHP versions, the preg_replace() function can be
|
|
tricked into executing arbitrary PHP code on the
|
|
server. This is done by passing a crafted argument as the
|
|
regular expression, containing a null byte. phpMyAdmin does
|
|
not correctly sanitize an argument passed to preg_replace()
|
|
when using the "Replace table prefix" feature, opening the
|
|
way to this vulnerability..</p>
|
|
<p>This vulnerability can be triggered only by someone who
|
|
logged in to phpMyAdmin, as the usual token protection
|
|
prevents non-logged-in users to access the required
|
|
form.</p>
|
|
</blockquote>
|
|
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2013-3.php">
|
|
<p>phpMyAdmin can be configured to save an export file on
|
|
the web server, via its SaveDir directive. With this in
|
|
place, it's possible, either via a crafted filename template
|
|
or a crafted table name, to save a double extension file
|
|
like foobar.php.sql. In turn, an Apache webserver on which
|
|
there is no definition for the MIME type "sql" (the default)
|
|
will treat this saved file as a ".php" script, leading to
|
|
remote code execution.</p>
|
|
<p>This vulnerability can be triggered only by someone who
|
|
logged in to phpMyAdmin, as the usual token protection
|
|
prevents non-logged-in users to access the required
|
|
form. Moreover, the SaveDir directive is empty by default,
|
|
so a default configuration is not vulnerable. The
|
|
$cfg['SaveDir'] directive must be configured, and the server
|
|
must be running Apache with mod_mime to be exploitable.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-3238</cvename>
|
|
<cvename>CVE-2013-3239</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-04-24</discovery>
|
|
<entry>2013-04-24</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="aeb962f6-ab8d-11e2-b3f5-003067c2616f">
|
|
<topic>tinc -- Buffer overflow</topic>
|
|
<affects>
|
|
<package>
|
|
<name>tinc</name>
|
|
<range><lt>1.0.21</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>tinc-vpn.org reports:</p>
|
|
<blockquote cite="http://www.tinc-vpn.org/news/">
|
|
<p>Drop packets forwarded via TCP if they are too big.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-1428</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-01-26</discovery>
|
|
<entry>2013-04-22</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="7280c3f6-a99a-11e2-8cef-6805ca0b3d42">
|
|
<topic>phpMyAdmin -- XSS due to unescaped HTML output in GIS visualisation page</topic>
|
|
<affects>
|
|
<package>
|
|
<name>phpMyAdmin</name>
|
|
<range><ge>3.5</ge><lt>3.5.8</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The phpMyAdmin development team reports:</p>
|
|
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2013-1.php">
|
|
<p> When modifying a URL parameter with a crafted value it
|
|
is possible to trigger an XSS.</p>
|
|
<p>These XSS can only be triggered when a valid database is
|
|
known and when a valid cookie token is used.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-1937</cvename>
|
|
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2013-1.php</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-04-18</discovery>
|
|
<entry>2013-04-20</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="a592e991-a919-11e2-ade0-8c705af55518">
|
|
<topic>roundcube -- arbitrary file disclosure vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>roundcube</name>
|
|
<range><lt>0.8.6,1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>RoundCube development team reports:</p>
|
|
<blockquote cite="http://lists.roundcube.net/pipermail/dev/2013-March/022337.html">
|
|
<p>After getting reports about a possible vulnerability
|
|
of Roundcube which allows an attacker to modify its
|
|
users preferences in a way that he/she can then read
|
|
files from the server, we now published updated packages
|
|
as well as patches that fix this security issue.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-1904</cvename>
|
|
<url>https://secunia.com/advisories/52806/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-03-27</discovery>
|
|
<entry>2013-04-19</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="8ff84335-a7da-11e2-b3f5-003067c2616f">
|
|
<topic>jasper -- buffer overflow</topic>
|
|
<affects>
|
|
<package>
|
|
<name>jasper</name>
|
|
<range><lt>1.900.1_12</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Fedora reports:</p>
|
|
<blockquote cite="http://www.kb.cert.org/vuls/id/887409">
|
|
<p>JasPer fails to properly decode marker segments and other
|
|
sections in malformed JPEG2000 files. Malformed inputs can
|
|
cause heap buffer overflows which in turn may result in
|
|
execution of attacker-controlled code.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-3520</cvename>
|
|
<cvename>CVE-2008-3522</cvename>
|
|
<cvename>CVE-2011-4516</cvename>
|
|
<cvename>CVE-2011-4517</cvename>
|
|
<url>http://www.kb.cert.org/vuls/id/887409</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-12-09</discovery>
|
|
<entry>2013-04-18</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="2070c79a-8e1e-11e2-b34d-000c2957946c">
|
|
<topic>ModSecurity -- XML External Entity Processing Vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>mod_security</name>
|
|
<range><gt>2.*</gt><lt>2.7.3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Positive Technologies has reported a vulnerability in ModSecurity,
|
|
which can be exploited by malicious people to disclose potentially
|
|
sensitive information or cause a DoS (Denial Of Serice).</p>
|
|
<p>The vulnerability is caused due to an error when parsing external
|
|
XML entities and can be exploited to e.g. disclose local files or
|
|
cause excessive memory and CPU consumption.</p>
|
|
<blockquote cite="https://secunia.com/advisories/52847/">
|
|
<p>.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-1915</cvename>
|
|
<url>https://secunia.com/advisories/52847/</url>
|
|
<url>https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-1915</url>
|
|
<url>https://bugs.gentoo.org/show_bug.cgi?id=464188</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-04-02</discovery>
|
|
<entry>2013-04-16</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="a2ff483f-a5c6-11e2-9601-000d601460a4">
|
|
<topic>sieve-connect -- TLS hostname verification was not occurring</topic>
|
|
<affects>
|
|
<package>
|
|
<name>sieve-connect</name>
|
|
<range><lt>0.85</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>sieve-connect developer Phil Pennock reports:</p>
|
|
<blockquote cite="http://mail.globnix.net/pipermail/sieve-connect-announce/2013/000005.html">
|
|
<p>sieve-connect was not actually verifying TLS certificate identities
|
|
matched the expected hostname.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://mail.globnix.net/pipermail/sieve-connect-announce/2013/000005.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-04-14</discovery>
|
|
<entry>2013-04-15</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="15236023-a21b-11e2-a460-208984377b34">
|
|
<topic>linux-flashplugin -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>linux-f10-flashplugin</name>
|
|
<range><lt>11.2r202.280</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Adobe reports:</p>
|
|
<blockquote cite="http://www.adobe.com/support/security/bulletins/apsb13-12.html">
|
|
<p>These updates address vulnerabilities that could cause a crash
|
|
and potentially allow an attacker to take control of the affected system.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-1383</cvename>
|
|
<cvename>CVE-2013-1384</cvename>
|
|
<cvename>CVE-2013-1385</cvename>
|
|
<cvename>CVE-2013-1386</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-04-09</discovery>
|
|
<entry>2013-04-10</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="db0c4b00-a24c-11e2-9601-000d601460a4">
|
|
<topic>rubygem-rails -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>rubygem-rails</name>
|
|
<range><lt>3.2.13</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>rubygem-actionpack</name>
|
|
<range><lt>3.2.13</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>rubygem-activerecord</name>
|
|
<range><lt>3.2.13</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>rubygem-activesupport</name>
|
|
<range><lt>3.2.13</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Ruby on Rails team reports:</p>
|
|
<blockquote cite="http://weblog.rubyonrails.org/2013/3/18/SEC-ANN-Rails-3-2-13-3-1-12-and-2-3-18-have-been-released/">
|
|
<p>Rails versions 3.2.13 has been released. This release
|
|
contains important security fixes. It is recommended
|
|
users upgrade as soon as possible.</p>
|
|
<p>Four vulnerabilities have been discovered and fixed:</p>
|
|
<ol>
|
|
<li>(CVE-2013-1854) Symbol DoS vulnerability in Active Record</li>
|
|
<li>(CVE-2013-1855) XSS vulnerability in sanitize_css in Action Pack</li>
|
|
<li>(CVE-2013-1856) XML Parsing Vulnerability affecting JRuby users</li>
|
|
<li>(CVE-2013-1857) XSS Vulnerability in the `sanitize` helper of Ruby on Rails</li>
|
|
</ol>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-1854</cvename>
|
|
<cvename>CVE-2013-1856</cvename>
|
|
<cvename>CVE-2013-1856</cvename>
|
|
<cvename>CVE-2013-1857</cvename>
|
|
<url>http://weblog.rubyonrails.org/2013/3/18/SEC-ANN-Rails-3-2-13-3-1-12-and-2-3-18-have-been-released/</url>
|
|
<url>https://groups.google.com/forum/#!topic/ruby-security-ann/o0Dsdk2WrQ0</url>
|
|
<url>https://groups.google.com/forum/?fromgroups=#!topic/rubyonrails-security/4_QHo4BqnN8</url>
|
|
<url>https://groups.google.com/forum/?fromgroups=#!topic/rubyonrails-security/KZwsQbYsOiI</url>
|
|
<url>https://groups.google.com/forum/?fromgroups=#!topic/rubyonrails-security/zAAU7vGTPvI</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-03-18</discovery>
|
|
<entry>2013-04-10</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="1431f2d6-a06e-11e2-b9e0-001636d274f3">
|
|
<topic>NVIDIA UNIX driver -- ARGB cursor buffer overflow in "NoScanout" mode</topic>
|
|
<affects>
|
|
<package>
|
|
<name>nvidia-driver</name>
|
|
<range><ge>310.14</ge><lt>310.44</lt></range>
|
|
<range><ge>195.22</ge><lt>304.88</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>NVIDIA Unix security team reports:</p>
|
|
<blockquote cite="http://nvidia.custhelp.com/app/answers/detail/a_id/3290">
|
|
<p>When the NVIDIA driver for the X Window System is operated in
|
|
"NoScanout" mode, and an X client installs an ARGB cursor that
|
|
is larger than the expected size (64x64 or 256x256, depending on
|
|
the driver version), the driver will overflow a buffer. This
|
|
can cause a denial of service (e.g., an X server segmentation
|
|
fault), or could be exploited to achieve arbitrary code
|
|
execution. Because the X server runs as setuid root in many
|
|
configurations, an attacker could potentially use this
|
|
vulnerability in those configurations to gain root privileges.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-0131</cvename>
|
|
<url>http://nvidia.custhelp.com/app/answers/detail/a_id/3290</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-03-27</discovery>
|
|
<entry>2013-04-08</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="cebed39d-9e6f-11e2-b3f5-003067c2616f">
|
|
<topic>opera -- moderately severe issue</topic>
|
|
<affects>
|
|
<package>
|
|
<name>opera</name>
|
|
<name>opera-devel</name>
|
|
<name>linux-opera</name>
|
|
<name>linux-opera-devel</name>
|
|
<range><lt>12.15</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Opera reports:</p>
|
|
<blockquote cite="http://www.opera.com/support/kb/view/1042/">
|
|
<p>Fixed a moderately severe issue, as reported by Attila Suszte.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://www.opera.com/docs/changelogs/unified/1215/</url>
|
|
<url>http://www.opera.com/support/kb/view/1046/</url>
|
|
<url>http://www.opera.com/support/kb/view/1047/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-04-04</discovery>
|
|
<entry>2013-04-06</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="b6beb137-9dc0-11e2-882f-20cf30e32f6d">
|
|
<topic>Subversion -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>subversion</name>
|
|
<range><ge>1.7.0</ge><lt>1.7.9</lt></range>
|
|
<range><ge>1.6.0</ge><lt>1.6.21</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Subversion team reports:</p>
|
|
<blockquote cite="http://subversion.apache.org/security/CVE-2013-1845-advisory.txt">
|
|
<p>Subversion's mod_dav_svn Apache HTTPD server module will use excessive
|
|
amounts of memory when a large number of properties are set or deleted
|
|
on a node.</p>
|
|
</blockquote>
|
|
<blockquote cite="http://subversion.apache.org/security/CVE-2013-1846-advisory.txt">
|
|
<p>Subversion's mod_dav_svn Apache HTTPD server module will crash when
|
|
a LOCK request is made against activity URLs.</p>
|
|
</blockquote>
|
|
<blockquote cite="http://subversion.apache.org/security/CVE-2013-1847-advisory.txt">
|
|
<p>Subversion's mod_dav_svn Apache HTTPD server module will crash in some
|
|
circumstances when a LOCK request is made against a non-existent URL.</p>
|
|
</blockquote>
|
|
<blockquote cite="http://subversion.apache.org/security/CVE-2013-1849-advisory.txt">
|
|
<p>Subversion's mod_dav_svn Apache HTTPD server module will crash when a
|
|
PROPFIND request is made against activity URLs.</p>
|
|
</blockquote>
|
|
<blockquote cite="http://subversion.apache.org/security/CVE-2013-1884-advisory.txt">
|
|
<p>Subversion's mod_dav_svn Apache HTTPD server module will crash when a
|
|
log REPORT request receives a limit that is out of the allowed range.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-1845</cvename>
|
|
<cvename>CVE-2013-1846</cvename>
|
|
<cvename>CVE-2013-1847</cvename>
|
|
<cvename>CVE-2013-1849</cvename>
|
|
<cvename>CVE-2013-1884</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-04-05</discovery>
|
|
<entry>2013-04-05</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="eae8e3cf-9dfe-11e2-ac7f-001fd056c417">
|
|
<topic>otrs -- Information disclosure and Data manipulation</topic>
|
|
<affects>
|
|
<package>
|
|
<name>otrs</name>
|
|
<range><lt>3.1.14</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The OTRS Project reports:</p>
|
|
<blockquote cite="http://www.otrs.com/en/open-source/community-news/security-advisories/security-advisory-2013-01/">
|
|
<p>An attacker with a valid agent login could manipulate URLs in the
|
|
object linking mechanism to see titles of tickets and other objects
|
|
that are not obliged to be seen. Furthermore, links to objects without
|
|
permission can be placed and removed.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-2625</cvename>
|
|
<url>http://www.otrs.com/en/open-source/community-news/security-advisories/security-advisory-2013-01/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-04-02</discovery>
|
|
<entry>2013-04-05</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="3f332f16-9b6b-11e2-8fe9-08002798f6ff">
|
|
<topic>PostgreSQL -- anonymous remote access data corruption vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>postgresql-server</name>
|
|
<range><ge>8.3.0</ge><lt>8.3.21_1</lt></range>
|
|
<range><ge>8.4.0</ge><lt>8.4.17</lt></range>
|
|
<range><ge>9.0.0</ge><lt>9.0.13</lt></range>
|
|
<range><ge>9.1.0</ge><lt>9.1.9</lt></range>
|
|
<range><ge>9.2.0</ge><lt>9.2.4</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>PostgreSQL project reports:</p>
|
|
<blockquote cite="http://www.postgresql.org/about/news/1456/">
|
|
<p>
|
|
The PostgreSQL Global Development Group has released a security
|
|
update to all current versions of the PostgreSQL database system,
|
|
including versions 9.2.4, 9.1.9, 9.0.13, and 8.4.17. This update
|
|
fixes a high-exposure security vulnerability in versions 9.0 and
|
|
later. All users of the affected versions are strongly urged to apply
|
|
the update *immediately*.
|
|
</p>
|
|
<p>
|
|
A major security issue (for versions 9.x only) fixed in this release,
|
|
[CVE-2013-1899](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1899),
|
|
makes it possible for a connection request containing a database name
|
|
that begins with "-" to be crafted that can damage or destroy files
|
|
within a server's data directory. Anyone with access to the port the
|
|
PostgreSQL server listens on can initiate this request. This issue was
|
|
discovered by Mitsumasa Kondo and Kyotaro Horiguchi of NTT Open Source
|
|
Software Center.
|
|
</p>
|
|
<p>
|
|
Two lesser security fixes are also included in this release:
|
|
[CVE-2013-1900](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1900),
|
|
wherein random numbers generated by contrib/pgcrypto functions may be
|
|
easy for another database user to guess (all versions), and
|
|
[CVE-2013-1901](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1901),
|
|
which mistakenly allows an unprivileged user to run commands that
|
|
could interfere with in-progress backups (for versions 9.x only).
|
|
</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-1899</cvename>
|
|
<cvename>CVE-2013-1900</cvename>
|
|
<cvename>CVE-2013-1901</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-04-04</discovery>
|
|
<entry>2013-04-04</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="94976433-9c74-11e2-a9fc-d43d7e0c7c02">
|
|
<topic>mozilla -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>firefox</name>
|
|
<range><gt>18.0,1</gt><lt>20.0,1</lt></range>
|
|
<range><lt>17.0.5,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-firefox</name>
|
|
<range><lt>17.0.5,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-seamonkey</name>
|
|
<range><lt>2.17</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-thunderbird</name>
|
|
<range><lt>17.0.5</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>seamonkey</name>
|
|
<range><lt>2.17</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>thunderbird</name>
|
|
<range><gt>11.0</gt><lt>17.0.5</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Mozilla Project reports:</p>
|
|
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
|
|
<p>MFSA 2013-30 Miscellaneous memory safety hazards (rv:20.0 /
|
|
rv:17.0.5)</p>
|
|
<p>MFSA 2013-31 Out-of-bounds write in Cairo library</p>
|
|
<p>MFSA 2013-32 Privilege escalation through Mozilla Maintenance
|
|
Service</p>
|
|
<p>MFSA 2013-33 World read and write access to app_tmp directory on
|
|
Android</p>
|
|
<p>MFSA 2013-34 Privilege escalation through Mozilla Updater</p>
|
|
<p>MFSA 2013-35 WebGL crash with Mesa graphics driver on Linux</p>
|
|
<p>MFSA 2013-36 Bypass of SOW protections allows cloning of protected
|
|
nodes</p>
|
|
<p>MFSA 2013-37 Bypass of tab-modal dialog origin disclosure</p>
|
|
<p>MFSA 2013-38 Cross-site scripting (XSS) using timed history
|
|
navigations</p>
|
|
<p>MFSA 2013-39 Memory corruption while rendering grayscale PNG
|
|
images</p>
|
|
<p>MFSA 2013-40 Out-of-bounds array read in CERT_DecodeCertPackage</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-0788</cvename>
|
|
<cvename>CVE-2013-0789</cvename>
|
|
<cvename>CVE-2013-0790</cvename>
|
|
<cvename>CVE-2013-0791</cvename>
|
|
<cvename>CVE-2013-0792</cvename>
|
|
<cvename>CVE-2013-0793</cvename>
|
|
<cvename>CVE-2013-0794</cvename>
|
|
<cvename>CVE-2013-0795</cvename>
|
|
<cvename>CVE-2013-0796</cvename>
|
|
<cvename>CVE-2013-0797</cvename>
|
|
<cvename>CVE-2013-0798</cvename>
|
|
<cvename>CVE-2013-0799</cvename>
|
|
<cvename>CVE-2013-0800</cvename>
|
|
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-30.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-31.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-32.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-33.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-34.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-35.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-36.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-37.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-38.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-39.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-40.html</url>
|
|
<url>http://www.mozilla.org/security/known-vulnerabilities/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-04-02</discovery>
|
|
<entry>2013-04-03</entry>
|
|
<modified>2013-04-08</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="13031d98-9bd1-11e2-a7be-8c705af55518">
|
|
<topic>FreeBSD -- BIND remote denial of service</topic>
|
|
<affects>
|
|
<package>
|
|
<name>FreeBSD</name>
|
|
<range><gt>9.0</gt><lt>9.0_7</lt></range>
|
|
<range><gt>9.1</gt><lt>9.1_2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<blockquote cite="http://www.freebsd.org/security/advisories/FreeBSD-SA-13:04.bind.asc">
|
|
<p>A flaw in a library used by BIND allows an
|
|
attacker to deliberately cause excessive memory
|
|
consumption by the named(8) process. This
|
|
affects both recursive and authoritative
|
|
servers.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-2266</cvename>
|
|
<freebsdsa>SA-13:04.bind</freebsdsa>
|
|
<url>https://kb.isc.org/article/AA-00871</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-04-02</discovery>
|
|
<entry>2013-04-02</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="69bfc852-9bd0-11e2-a7be-8c705af55518">
|
|
<topic>FreeBSD -- OpenSSL multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>FreeBSD</name>
|
|
<range><gt>8.3</gt><lt>8.3_7</lt></range>
|
|
<range><gt>9.0</gt><lt>9.0_7</lt></range>
|
|
<range><gt>9.1</gt><lt>9.1_2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<blockquote cite="http://www.freebsd.org/security/advisories/FreeBSD-SA-13:03.openssl.asc">
|
|
<p>A flaw in the OpenSSL handling of OCSP response
|
|
verification could be exploited to cause a denial of
|
|
service attack.</p>
|
|
<p>OpenSSL has a weakness in the handling of CBC
|
|
ciphersuites in SSL, TLS and DTLS. The weakness could reveal
|
|
plaintext in a timing attack.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-0166</cvename>
|
|
<cvename>CVE-2013-0169</cvename>
|
|
<freebsdsa>SA-13:04.openssl</freebsdsa>
|
|
<url>http://www.openssl.org/news/secadv_20130205.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-04-02</discovery>
|
|
<entry>2013-04-02</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="92f30415-9935-11e2-ad4c-080027ef73ec">
|
|
<topic>OpenVPN -- potential side-channel/timing attack when comparing HMACs</topic>
|
|
<affects>
|
|
<package>
|
|
<name>openvpn</name>
|
|
<range><lt>2.0.9_4</lt></range>
|
|
<range><ge>2.1.0</ge><lt>2.2.2_2</lt></range>
|
|
<range><ge>2.3.0</ge><lt>2.3.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The OpenVPN project reports:</p>
|
|
<blockquote cite="https://community.openvpn.net/openvpn/wiki/SecurityAnnouncement-f375aa67cc">
|
|
<p>OpenVPN 2.3.0 and earlier running in UDP mode are subject
|
|
to chosen ciphertext injection due to a non-constant-time
|
|
HMAC comparison function.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>https://community.openvpn.net/openvpn/wiki/SecurityAnnouncement-f375aa67cc</url>
|
|
<cvename>CVE-2013-2061</cvename>
|
|
<url>http://www.openwall.com/lists/oss-security/2013/05/06/6</url>
|
|
<url>https://github.com/OpenVPN/openvpn/commit/11d21349a4e7e38a025849479b36ace7c2eec2ee</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-03-19</discovery>
|
|
<entry>2013-03-31</entry>
|
|
<modified>2013-06-01</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="843a4641-9816-11e2-9c51-080027019be0">
|
|
<topic>libxml2 -- cpu consumption Dos</topic>
|
|
<affects>
|
|
<package>
|
|
<name>libxml2</name>
|
|
<range><lt>2.8.0</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Kurt Seifried reports:</p>
|
|
<blockquote cite="http://seclists.org/oss-sec/2013/q1/391">
|
|
<p>libxml2 is affected by the expansion of internal entities
|
|
(which can be used to consume resources) and external entities
|
|
(which can cause a denial of service against other services,
|
|
be used to port scan, etc.)..</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-0338</cvename>
|
|
<cvename>CVE-2013-0339</cvename>
|
|
<url>http://seclists.org/oss-sec/2013/q1/391</url>
|
|
<url>https://security-tracker.debian.org/tracker/CVE-2013-0338</url>
|
|
<url>https://security-tracker.debian.org/tracker/CVE-2013-0339</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-02-21</discovery>
|
|
<entry>2013-03-29</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="daf0a339-9850-11e2-879e-d43d7e0c7c02">
|
|
<topic>asterisk -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>asterisk11</name>
|
|
<range><gt>11.*</gt><lt>11.2.2</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>asterisk10</name>
|
|
<range><gt>10.*</gt><lt>10.12.2</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>asterisk18</name>
|
|
<range><gt>1.8.*</gt><lt>1.8.20.2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Asterisk project reports:</p>
|
|
<blockquote cite="https://www.asterisk.org/security">
|
|
<p>Buffer Overflow Exploit Through SIP SDP Header</p>
|
|
<p>Username disclosure in SIP channel driver</p>
|
|
<p>Denial of Service in HTTP server</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-2685</cvename>
|
|
<cvename>CVE-2013-2686</cvename>
|
|
<cvename>CVE-2013-2264</cvename>
|
|
<url>http://downloads.asterisk.org/pub/security/AST-2013-001.html</url>
|
|
<url>http://downloads.asterisk.org/pub/security/AST-2013-002.html</url>
|
|
<url>http://downloads.asterisk.org/pub/security/AST-2013-003.html</url>
|
|
<url>https://www.asterisk.org/security</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-03-27</discovery>
|
|
<entry>2013-03-29</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="7a282e49-95b6-11e2-8433-0800273fe665">
|
|
<topic>dns/bind9* -- Malicious Regex Can Cause Memory Exhaustion</topic>
|
|
<affects>
|
|
<package>
|
|
<name>bind99</name>
|
|
<range><lt>9.9.2.2</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>bind99-base</name>
|
|
<range><lt>9.9.2.2</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>bind98</name>
|
|
<range><lt>9.8.4.2</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>bind98-base</name>
|
|
<range><lt>9.8.4.2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>ISC reports:</p>
|
|
<blockquote cite="https://kb.isc.org/article/AA-00871">
|
|
<p>A critical defect in BIND 9 allows an attacker to cause
|
|
excessive memory consumption in named or other programs
|
|
linked to libdns.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-2266</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-03-11</discovery>
|
|
<entry>2013-03-27</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="bdd48858-9656-11e2-a9a8-00262d5ed8ee">
|
|
<topic>chromium -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>chromium</name>
|
|
<range><lt>26.0.1410.43</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Google Chrome Releases reports:</p>
|
|
<blockquote cite="http://googlechromereleases.blogspot.nl/search/Stable%20Updates">
|
|
<p>[172342] High CVE-2013-0916: Use-after-free in Web Audio. Credit
|
|
to Atte Kettunen of OUSPG.</p>
|
|
<p>[180909] Low CVE-2013-0917: Out-of-bounds read in URL loader.
|
|
Credit to Google Chrome Security Team (Cris Neckar).</p>
|
|
<p>[180555] Low CVE-2013-0918: Do not navigate dev tools upon drag
|
|
and drop. Credit to Vsevolod Vlasov of the Chromium development
|
|
community.</p>
|
|
<p>[Linux only] [178760] Medium CVE-2013-0919: Use-after-free with
|
|
pop-up windows in extensions. Credit to Google Chrome Security Team
|
|
(Mustafa Emre Acer).</p>
|
|
<p>[177410] Medium CVE-2013-0920: Use-after-free in extension
|
|
bookmarks API. Credit to Google Chrome Security Team (Mustafa Emre
|
|
Acer).</p>
|
|
<p>[174943] High CVE-2013-0921: Ensure isolated web sites run in
|
|
their own processes.</p>
|
|
<p>[174129] Low CVE-2013-0922: Avoid HTTP basic auth brute force
|
|
attempts. Credit to "t3553r".</p>
|
|
<p>[169981] [169972] [169765] Medium CVE-2013-0923: Memory safety
|
|
issues in the USB Apps API. Credit to Google Chrome Security Team
|
|
(Mustafa Emre Acer).</p>
|
|
<p>[169632] Low CVE-2013-0924: Check an extension's permissions API
|
|
usage again file permissions. Credit to Benjamin Kalman of the
|
|
Chromium development community.</p>
|
|
<p>[168442] Low CVE-2013-0925: Avoid leaking URLs to extensions
|
|
without the tabs permissions. Credit to Michael Vrable of
|
|
Google.</p>
|
|
<p>[112325] Medium CVE-2013-0926: Avoid pasting active tags in
|
|
certain situations. Credit to Subho Halder, Aditya Gupta, and Dev
|
|
Kar of xys3c (xysec.com).</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-0916</cvename>
|
|
<cvename>CVE-2013-0917</cvename>
|
|
<cvename>CVE-2013-0918</cvename>
|
|
<cvename>CVE-2013-0919</cvename>
|
|
<cvename>CVE-2013-0920</cvename>
|
|
<cvename>CVE-2013-0921</cvename>
|
|
<cvename>CVE-2013-0922</cvename>
|
|
<cvename>CVE-2013-0923</cvename>
|
|
<cvename>CVE-2013-0924</cvename>
|
|
<cvename>CVE-2013-0925</cvename>
|
|
<cvename>CVE-2013-0926</cvename>
|
|
<url>http://googlechromereleases.blogspot.nl/search/Stable%20Updates</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-03-26</discovery>
|
|
<entry>2013-03-26</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="6adca5e9-95d2-11e2-8549-68b599b52a02">
|
|
<topic>firebird -- Remote Stack Buffer Overflow</topic>
|
|
<affects>
|
|
<package>
|
|
<name>firebird25-server</name>
|
|
<range><ge>2.5.0</ge><le>2.5.2</le></range>
|
|
</package>
|
|
<package>
|
|
<name>firebird21-server</name>
|
|
<range><ge>2.1.0</ge><le>2.1.5</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Firebird Project reports:</p>
|
|
<blockquote cite="http://tracker.firebirdsql.org/browse/CORE-4058">
|
|
<p>The FirebirdSQL server is vulnerable to a stack buffer overflow
|
|
that can be triggered when an unauthenticated user sends a
|
|
specially crafted packet. The result can lead to remote code
|
|
execution as the user which runs the FirebirdSQL server.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-2492</cvename>
|
|
<url>https://gist.github.com/zeroSteiner/85daef257831d904479c</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-01-31</discovery>
|
|
<entry>2013-03-06</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="a8818f7f-9182-11e2-9bdf-d48564727302">
|
|
<topic>optipng -- use-after-free vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>optipng</name>
|
|
<range><ge>0.7</ge><lt>0.7.4</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="https://secunia.com/advisories/50654">
|
|
<p>A vulnerability has been reported in OptiPNG, which can be
|
|
exploited by malicious people to potentially compromise a user's
|
|
system.</p>
|
|
<p>The vulnerability is caused due to a use-after-free error related
|
|
to the palette reduction functionality. No further information is
|
|
currently available.</p>
|
|
<p>Success exploitation may allow execution of arbitrary code.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-4432</cvename>
|
|
<url>https://secunia.com/advisories/50654</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-09-16</discovery>
|
|
<entry>2013-03-21</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="1d23109a-9005-11e2-9602-d43d7e0c7c02">
|
|
<topic>php5 -- Multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>php5</name>
|
|
<range><lt>5.4.13</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>php53</name>
|
|
<range><lt>5.3.23</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The PHP development team reports:</p>
|
|
<blockquote cite="http://www.php.net/ChangeLog-5.php">
|
|
<p>PHP does not validate the relationship between the soap.wsdl_cache_dir
|
|
directive and the open_basedir directive, which allows remote attackers to
|
|
bypass intended access restrictions by triggering the creation of cached
|
|
SOAP WSDL files in an arbitrary directory.</p>
|
|
<p>The SOAP parser in PHP allows remote attackers to read arbitrary files
|
|
via a SOAP WSDL file containing an XML external entity declaration in
|
|
conjunction with an entity reference, related to an XML External Entity
|
|
(XXE) issue in the soap_xmlParseFile and soap_xmlParseMemory functions.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-1635</cvename>
|
|
<cvename>CVE-2013-1643</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-03-04</discovery>
|
|
<entry>2013-03-18</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="edd201a5-8fc3-11e2-b131-000c299b62e1">
|
|
<topic>piwigo -- CSRF/Path Traversal</topic>
|
|
<affects>
|
|
<package>
|
|
<name>piwigo</name>
|
|
<range><lt>2.4.7</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>High-Tech Bridge Security Research Lab reports:</p>
|
|
<blockquote cite="http://piwigo.org/releases/2.4.7">
|
|
<p>The CSRF vulnerability exists due to insufficient verification of the
|
|
HTTP request origin in "/admin.php" script. A remote attacker can trick
|
|
a logged-in administrator to visit a specially crafted webpage and
|
|
create arbitrary PHP file on the remote server.</p>
|
|
<p>The path traversal vulnerability exists due to insufficient filtration
|
|
of user-supplied input in "dl" HTTP GET parameter passed to
|
|
"/install.php" script. The script is present on the system after
|
|
installation by default, and can be accessed by attacker without any
|
|
restrictions.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-1468</cvename>
|
|
<cvename>CVE-2013-1469</cvename>
|
|
<url>http://piwigo.org/bugs/view.php?id=0002843</url>
|
|
<url>http://piwigo.org/bugs/view.php?id=0002844</url>
|
|
<url>http://dl.packetstormsecurity.net/1302-exploits/piwigo246-traversalxsrf.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-02-06</discovery>
|
|
<entry>2013-03-18</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="d881d254-70c6-11e2-862d-080027a5ec9a">
|
|
<topic>libexif -- multiple remote vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>libexif</name>
|
|
<range><lt>0.6.21</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>libexif project security advisory:</p>
|
|
<blockquote cite="http://sourceforge.net/mailarchive/message.php?msg_id=29534027">
|
|
<p>A number of remotely exploitable issues were discovered in libexif
|
|
and exif, with effects ranging from information leakage to potential
|
|
remote code execution.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-2812</cvename>
|
|
<cvename>CVE-2012-2813</cvename>
|
|
<cvename>CVE-2012-2814</cvename>
|
|
<cvename>CVE-2012-2836</cvename>
|
|
<cvename>CVE-2012-2837</cvename>
|
|
<cvename>CVE-2012-2840</cvename>
|
|
<cvename>CVE-2012-2841</cvename>
|
|
<cvename>CVE-2012-2845</cvename>
|
|
<bid>54437</bid>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-07-12</discovery>
|
|
<entry>2013-03-13</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="5ff40cb4-8b92-11e2-bdb6-001060e06fd4">
|
|
<topic>linux-flashplugin -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>linux-f10-flashplugin</name>
|
|
<range><lt>11.2r202.275</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Adobe reports:</p>
|
|
<blockquote cite="http://www.adobe.com/support/security/bulletins/apsb13-09.html">
|
|
<p>These updates address vulnerabilities that could cause a crash
|
|
and potentially allow an attacker to take control of the affected system.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-0646</cvename>
|
|
<cvename>CVE-2013-0650</cvename>
|
|
<cvename>CVE-2013-1371</cvename>
|
|
<cvename>CVE-2013-1375</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-03-12</discovery>
|
|
<entry>2013-03-12</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="cda566a0-2df0-4eb0-b70e-ed7a6fb0ab3c">
|
|
<topic>puppet27 and puppet -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>puppet</name>
|
|
<range><ge>3.0</ge><lt>3.1.1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>puppet27</name>
|
|
<range><ge>2.7</ge><lt>2.7.21</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Moses Mendoza reports:</p>
|
|
<blockquote cite="https://puppetlabs.com/blog/security-updates-new-releases-of-puppet-and-puppet-enterprise/">
|
|
<p>A vulnerability found in Puppet could allow an authenticated client
|
|
to cause the master to execute arbitrary code while responding to a
|
|
catalog request. Specifically, in order to exploit the
|
|
vulnerability, the puppet master must be made to invoke the
|
|
'template' or 'inline_template' functions during catalog compilation.
|
|
</p>
|
|
<p>A vulnerability found in Puppet could allow an authenticated client
|
|
to connect to a puppet master and perform unauthorized actions.
|
|
Specifically, given a valid certificate and private key, an agent
|
|
could retrieve catalogs from the master that it is not authorized
|
|
to access or it could poison the puppet master's caches for any
|
|
puppet-generated data that supports caching such as catalogs,
|
|
nodes, facts, and resources. The extent and severity of this
|
|
vulnerability varies depending on the specific configuration of the
|
|
master: for example, whether it is using storeconfigs or not, which
|
|
version, whether it has access to the cache or not, etc.
|
|
</p>
|
|
<p>A vulnerability has been found in Puppet which could allow
|
|
authenticated clients to execute arbitrary code on agents that have
|
|
been configured to accept kick connections. This vulnerability is
|
|
not present in the default configuration of puppet agents, but if
|
|
they have been configured to listen for incoming connections
|
|
('listen=true'), and the agent's auth.conf has been configured to
|
|
allow access to the `run` REST endpoint, then a client could
|
|
construct an HTTP request which could execute arbitrary code. The
|
|
severity of this issue is exacerbated by the fact that puppet
|
|
agents typically run as root.
|
|
</p>
|
|
<p>A vulnerability has been found in Puppet that could allow a client
|
|
negotiating a connection to a master to downgrade the master's
|
|
SSL protocol to SSLv2. This protocol has been found to contain
|
|
design weaknesses. This issue only affects systems running older
|
|
versions (pre 1.0.0) of openSSL. Newer versions explicitly disable
|
|
SSLv2.
|
|
</p>
|
|
<p>A vulnerability found in Puppet could allow unauthenticated clients
|
|
to send requests to the puppet master which would cause it to load
|
|
code unsafely. While there are no reported exploits, this
|
|
vulnerability could cause issues like those described in Rails
|
|
CVE-2013-0156. This vulnerability only affects puppet masters
|
|
running Ruby 1.9.3 and higher.
|
|
</p>
|
|
<p>This vulnerability affects puppet masters 0.25.0 and above. By
|
|
default, auth.conf allows any authenticated node to submit a report
|
|
for any other node. This can cause issues with compliance. The
|
|
defaults in auth.conf have been changed.
|
|
</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-1640</cvename>
|
|
<cvename>CVE-2013-1652</cvename>
|
|
<cvename>CVE-2013-1653</cvename>
|
|
<cvename>CVE-2013-1654</cvename>
|
|
<cvename>CVE-2013-1655</cvename>
|
|
<cvename>CVE-2013-2275</cvename>
|
|
<url>https://puppetlabs.com/security/cve/cve-2013-1640/</url>
|
|
<url>https://puppetlabs.com/security/cve/cve-2013-1652/</url>
|
|
<url>https://puppetlabs.com/security/cve/cve-2013-1653/</url>
|
|
<url>https://puppetlabs.com/security/cve/cve-2013-1654/</url>
|
|
<url>https://puppetlabs.com/security/cve/cve-2013-1655/</url>
|
|
<url>https://puppetlabs.com/security/cve/cve-2013-2275/</url>
|
|
<url>https://groups.google.com/forum/?fromgroups=#!topic/puppet-announce/f_gybceSV6E</url>
|
|
<url>https://groups.google.com/forum/?fromgroups=#!topic/puppet-announce/kgDyaPhHniw</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-03-13</discovery>
|
|
<entry>2013-03-13</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="04042f95-14b8-4382-a8b9-b30e365776cf">
|
|
<topic>puppet26 -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>puppet26</name>
|
|
<range><ge>2.6</ge><lt>2.6.18</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Moses Mendoza reports:</p>
|
|
<blockquote cite="https://puppetlabs.com/blog/security-updates-new-releases-of-puppet-and-puppet-enterprise/">
|
|
<p>A vulnerability found in Puppet could allow an authenticated client
|
|
to cause the master to execute arbitrary code while responding to a
|
|
catalog request. Specifically, in order to exploit the
|
|
vulnerability, the puppet master must be made to invoke the
|
|
'template' or 'inline_template' functions during catalog compilation.
|
|
</p>
|
|
<p>A vulnerability found in Puppet could allow an authenticated client
|
|
to connect to a puppet master and perform unauthorized actions.
|
|
Specifically, given a valid certificate and private key, an agent
|
|
could retrieve catalogs from the master that it is not authorized
|
|
to access or it could poison the puppet master's caches for any
|
|
puppet-generated data that supports caching such as catalogs,
|
|
nodes, facts, and resources. The extent and severity of this
|
|
vulnerability varies depending on the specific configuration of the
|
|
master: for example, whether it is using storeconfigs or not, which
|
|
version, whether it has access to the cache or not, etc.
|
|
</p>
|
|
<p>A vulnerability has been found in Puppet that could allow a client
|
|
negotiating a connection to a master to downgrade the master's
|
|
SSL protocol to SSLv2. This protocol has been found to contain
|
|
design weaknesses. This issue only affects systems running older
|
|
versions (pre 1.0.0) of openSSL. Newer versions explicitly disable
|
|
SSLv2.
|
|
</p>
|
|
<p>A vulnerability found in Puppet could allow an authenticated client
|
|
to execute arbitrary code on a puppet master that is running in the
|
|
default configuration, or an agent with `puppet kick` enabled.
|
|
Specifically, a properly authenticated and connected puppet agent
|
|
could be made to construct an HTTP PUT request for an authorized
|
|
report that actually causes the execution of arbitrary code on the
|
|
master.
|
|
</p>
|
|
<p>This vulnerability affects puppet masters 0.25.0 and above. By
|
|
default, auth.conf allows any authenticated node to submit a report
|
|
for any other node. This can cause issues with compliance. The
|
|
defaults in auth.conf have been changed.
|
|
</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-1640</cvename>
|
|
<cvename>CVE-2013-1652</cvename>
|
|
<cvename>CVE-2013-1654</cvename>
|
|
<cvename>CVE-2013-2274</cvename>
|
|
<cvename>CVE-2013-2275</cvename>
|
|
<url>https://puppetlabs.com/security/cve/cve-2013-1640/</url>
|
|
<url>https://puppetlabs.com/security/cve/cve-2013-1652/</url>
|
|
<url>https://puppetlabs.com/security/cve/cve-2013-1654/</url>
|
|
<url>https://puppetlabs.com/security/cve/cve-2013-2274/</url>
|
|
<url>https://puppetlabs.com/security/cve/cve-2013-2275/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-03-13</discovery>
|
|
<entry>2013-03-13</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="68c1f75b-8824-11e2-9996-c48508086173">
|
|
<topic>perl -- denial of service via algorithmic complexity attack on hashing routines</topic>
|
|
<affects>
|
|
<package>
|
|
<name>perl</name>
|
|
<range><lt>5.12.4_5</lt></range>
|
|
<range><ge>5.14.0</ge><lt>5.14.2_3</lt></range>
|
|
<range><ge>5.16.0</ge><lt>5.16.2_1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>perl-threaded</name>
|
|
<range><lt>5.12.4_5</lt></range>
|
|
<range><ge>5.14.0</ge><lt>5.14.2_3</lt></range>
|
|
<range><ge>5.16.0</ge><lt>5.16.2_1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Perl developers report:</p>
|
|
<blockquote cite="http://www.nntp.perl.org/group/perl.perl5.porters/2013/03/msg199755.html">
|
|
<p>In order to prevent an algorithmic complexity attack
|
|
against its hashing mechanism, perl will sometimes
|
|
recalculate keys and redistribute the contents of a hash.
|
|
This mechanism has made perl robust against attacks that
|
|
have been demonstrated against other systems.</p>
|
|
<p>Research by Yves Orton has recently uncovered a flaw in
|
|
the rehashing code which can result in pathological
|
|
behavior. This flaw could be exploited to carry out a
|
|
denial of service attack against code that uses arbitrary
|
|
user input as hash keys.</p>
|
|
<p>Because using user-provided strings as hash keys is a
|
|
very common operation, we urge users of perl to update their
|
|
perl executable as soon as possible.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-1667</cvename>
|
|
<url>http://www.nntp.perl.org/group/perl.perl5.porters/2013/03/msg199755.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-03-04</discovery>
|
|
<entry>2013-03-10</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="549787c1-8916-11e2-8549-68b599b52a02">
|
|
<topic>libpurple -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>libpurple</name>
|
|
<range><lt>2.10.7</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Pidgin reports:</p>
|
|
<blockquote cite="https://developer.pidgin.im/wiki/ChangeLog">
|
|
<p>libpurple</p>
|
|
<p>Fix a crash when receiving UPnP responses with abnormally long values.</p>
|
|
<p>MXit</p>
|
|
<p>Fix two bugs where a remote MXit user could possibly specify a local file
|
|
path to be written to.</p>
|
|
<p>Fix a bug where the MXit server or a man-in-the-middle could potentially
|
|
send specially crafted data that could overflow a buffer and lead to a crash
|
|
or remote code execution.</p>
|
|
<p>Sametime</p>
|
|
<p>Fix a crash in Sametime when a malicious server sends us an abnormally long
|
|
user ID.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-0274</cvename>
|
|
<cvename>CVE-2013-0271</cvename>
|
|
<cvename>CVE-2013-0272</cvename>
|
|
<cvename>CVE-2013-0273</cvename>
|
|
<url>https://developer.pidgin.im/wiki/ChangeLog</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-02-13</discovery>
|
|
<entry>2013-03-10</entry>
|
|
<modified>2013-03-16</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="630c8c08-880f-11e2-807f-d43d7e0c7c02">
|
|
<topic>mozilla -- Use-after-free in HTML Editor</topic>
|
|
<affects>
|
|
<package>
|
|
<name>firefox</name>
|
|
<range><gt>18.0,1</gt><lt>19.0.2,1</lt></range>
|
|
<range><lt>17.0.3,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-firefox</name>
|
|
<range><lt>17.0.4,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-seamonkey</name>
|
|
<range><lt>2.16.1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-thunderbird</name>
|
|
<range><lt>17.0.4</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>seamonkey</name>
|
|
<range><lt>2.16.1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>thunderbird</name>
|
|
<range><gt>11.0</gt><lt>17.0.4</lt></range>
|
|
<range><lt>10.0.12</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Mozilla Project reports:</p>
|
|
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
|
|
<p>MFSA 2013-29 Use-after-free in HTML Editor</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-0787</cvename>
|
|
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-29.html</url>
|
|
<url>http://www.mozilla.org/security/known-vulnerabilities/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-03-07</discovery>
|
|
<entry>2013-03-08</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="54bed676-87ce-11e2-b528-00262d5ed8ee">
|
|
<topic>chromium -- WebKit vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>chromium</name>
|
|
<range><lt>25.0.1364.160</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Google Chrome Releases reports:</p>
|
|
<blockquote cite="http://googlechromereleases.blogspot.nl/search/Stable%20Updates">
|
|
<p>[180763] High CVE-2013-0912: Type confusion in WebKit. Credit to
|
|
Nils and Jon of MWR Labs.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-0912</cvename>
|
|
<url>http://googlechromereleases.blogspot.nl/search/Stable%20Updates</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-03-07</discovery>
|
|
<entry>2013-03-08</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="b9a347ac-8671-11e2-b73c-0019d18c446a">
|
|
<topic>typo3 -- Multiple vulnerabilities in TYPO3 Core</topic>
|
|
<affects>
|
|
<package>
|
|
<name>typo3</name>
|
|
<range><ge>4.5.0</ge><lt>4.5.23</lt></range>
|
|
<range><ge>4.6.0</ge><lt>4.6.16</lt></range>
|
|
<range><ge>4.7.0</ge><lt>4.7.8</lt></range>
|
|
<range><ge>6.0.0</ge><lt>6.0.2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Typo Security Team reports:</p>
|
|
<blockquote cite="http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2013-001/">
|
|
<p>Extbase Framework - Failing to sanitize user input, the Extbase
|
|
database abstraction layer is susceptible to SQL Injection. TYPO3
|
|
sites which have no Extbase extensions installed are not affected.
|
|
Extbase extensions are affected if they use the Query Object Model
|
|
and relation values are user generated input. Credits go to Helmut
|
|
Hummel and Markus Opahle who discovered and reported the issue.</p>
|
|
<p>Access tracking mechanism - Failing to validate user provided
|
|
input, the access tracking mechanism allows redirects to arbitrary
|
|
URLs. To fix this vulnerability, we had to break existing
|
|
behaviour of TYPO3 sites that use the access tracking mechanism
|
|
(jumpurl feature) to transform links to external sites. The link
|
|
generation has been changed to include a hash that is checked
|
|
before redirecting to an external URL. This means that old links
|
|
that have been distributed (e.g. by a newsletter) will not work
|
|
any more.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2013-001/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-03-06</discovery>
|
|
<entry>2013-03-06</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="40d5ab37-85f2-11e2-b528-00262d5ed8ee">
|
|
<topic>chromium -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>chromium</name>
|
|
<range><lt>25.0.1364.152</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Google Chrome Releases reports:</p>
|
|
<blockquote cite="http://googlechromereleases.blogspot.nl/search/Stable%20Updates">
|
|
<p>[176882] High CVE-2013-0902: Use-after-free in frame loader.
|
|
Credit to Chamal de Silva.</p>
|
|
<p>[176252] High CVE-2013-0903: Use-after-free in browser navigation
|
|
handling. Credit to "chromium.khalil".</p>
|
|
<p>[172926] [172331] High CVE-2013-0904: Memory corruption in Web
|
|
Audio. Credit to Atte Kettunen of OUSPG.</p>
|
|
<p>[168982] High CVE-2013-0905: Use-after-free with SVG animations.
|
|
Credit to Atte Kettunen of OUSPG.</p>
|
|
<p>[174895] High CVE-2013-0906: Memory corruption in Indexed DB.
|
|
Credit to Google Chrome Security Team (Juri Aedla).</p>
|
|
<p>[174150] Medium CVE-2013-0907: Race condition in media thread
|
|
handling. Credit to Andrew Scherkus of the Chromium development
|
|
community.</p>
|
|
<p>[174059] Medium CVE-2013-0908: Incorrect handling of bindings for
|
|
extension processes.</p>
|
|
<p>[173906] Low CVE-2013-0909: Referer leakage with XSS Auditor.
|
|
Credit to Egor Homakov.</p>
|
|
<p>[172573] Medium CVE-2013-0910: Mediate renderer -> browser
|
|
plug-in loads more strictly. Credit to Google Chrome Security Team
|
|
(Chris Evans).</p>
|
|
<p>[172264] High CVE-2013-0911: Possible path traversal in database
|
|
handling. Credit to Google Chrome Security Team (Juri Aedla).</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-0902</cvename>
|
|
<cvename>CVE-2013-0903</cvename>
|
|
<cvename>CVE-2013-0904</cvename>
|
|
<cvename>CVE-2013-0905</cvename>
|
|
<cvename>CVE-2013-0906</cvename>
|
|
<cvename>CVE-2013-0907</cvename>
|
|
<cvename>CVE-2013-0908</cvename>
|
|
<cvename>CVE-2013-0909</cvename>
|
|
<cvename>CVE-2013-0910</cvename>
|
|
<cvename>CVE-2013-0911</cvename>
|
|
<url>http://googlechromereleases.blogspot.nl/search/Stable%20Updates</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-03-04</discovery>
|
|
<entry>2013-03-06</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="c97219b6-843d-11e2-b131-000c299b62e1">
|
|
<topic>stunnel -- Remote Code Execution</topic>
|
|
<affects>
|
|
<package>
|
|
<name>stunnel</name>
|
|
<range><ge>4.21</ge><lt>4.55</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Michal Trojnara reports:</p>
|
|
<blockquote cite="https://www.stunnel.org/CVE-2013-1762.html">
|
|
<p>64-bit versions of stunnel with the following conditions:
|
|
* NTLM authentication enabled
|
|
* CONNECT protocol negotiation enabled
|
|
* Configured in SSL client mode
|
|
* An attacker that can either control the proxy server specified in
|
|
the "connect" option or execute MITM attacks on the TCP session
|
|
between stunnel and the proxy</p>
|
|
<p>Can be exploited for remote code execution. The code is executed
|
|
within the configured chroot directory, with privileges of the
|
|
configured user and group.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-1762</cvename>
|
|
<url>https://www.stunnel.org/CVE-2013-1762.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-03-03</discovery>
|
|
<entry>2013-03-03</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="9c88d8a8-8372-11e2-a010-20cf30e32f6d">
|
|
<topic>apache22 -- several vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>apache22</name>
|
|
<range><gt>2.2.0</gt><lt>2.2.24</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>apache22-event-mpm</name>
|
|
<range><gt>2.2.0</gt><lt>2.2.24</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>apache22-itk-mpm</name>
|
|
<range><gt>2.2.0</gt><lt>2.2.24</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>apache22-peruser-mpm</name>
|
|
<range><gt>2.2.0</gt><lt>2.2.24</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>apache22-worker-mpm</name>
|
|
<range><gt>2.2.0</gt><lt>2.2.24</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<h1>Apache HTTP SERVER PROJECT reports:</h1>
|
|
<blockquote cite="http://httpd.apache.org/security/vulnerabilities_22.html">
|
|
<h1>low: XSS due to unescaped hostnames CVE-2012-3499</h1>
|
|
<p>Various XSS flaws due to unescaped hostnames and URIs HTML output in
|
|
mod_info, mod_status, mod_imagemap, mod_ldap, and mod_proxy_ftp.</p>
|
|
<h1>moderate: XSS in mod_proxy_balancer CVE-2012-4558</h1>
|
|
<p>A XSS flaw affected the mod_proxy_balancer manager interface.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-3499</cvename>
|
|
<cvename>CVE-2012-4558</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-10-07</discovery>
|
|
<entry>2013-03-02</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="764344fb-8214-11e2-9273-902b343deec9">
|
|
<topic>sudo -- Authentication bypass when clock is reset</topic>
|
|
<affects>
|
|
<package>
|
|
<name>sudo</name>
|
|
<range><lt>1.8.6.p7</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Todd Miller reports:</p>
|
|
<blockquote cite="http://www.sudo.ws/sudo/alerts/epoch_ticket.html">
|
|
<p>The flaw may allow someone with physical access to a machine that
|
|
is not password-protected to run sudo commands without knowing the
|
|
logged in user's password. On systems where sudo is the principal
|
|
way of running commands as root, such as on Ubuntu and Mac OS X,
|
|
there is a greater chance that the logged in user has run sudo
|
|
before and thus that an attack would succeed.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-1775</cvename>
|
|
<url>http://www.sudo.ws/sudo/alerts/epoch_ticket.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-02-27</discovery>
|
|
<entry>2013-03-01</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="82cfd919-8213-11e2-9273-902b343deec9">
|
|
<topic>sudo -- Potential bypass of tty_tickets constraints</topic>
|
|
<affects>
|
|
<package>
|
|
<name>sudo</name>
|
|
<range><lt>1.8.6.p7</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Todd Miller reports:</p>
|
|
<blockquote cite="http://www.sudo.ws/sudo/alerts/tty_tickets.html">
|
|
<p>A (potentially malicious) program run by a user with sudo access
|
|
may be able to bypass the "tty_ticket" constraints. In order for
|
|
this to succeed there must exist on the machine a terminal device
|
|
that the user has previously authenticated themselves on via sudo
|
|
within the last time stamp timeout (5 minutes by default).</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-1776</cvename>
|
|
<url>http://www.sudo.ws/sudo/alerts/tty_tickets.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-02-27</discovery>
|
|
<entry>2013-03-01</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="aa7764af-0b5e-4ddc-bc65-38ad697a484f">
|
|
<topic>rubygem-dragonfly -- arbitrary code execution</topic>
|
|
<affects>
|
|
<package>
|
|
<name>rubygem18-dragonfly</name>
|
|
<name>rubygem19-dragonfly</name>
|
|
<name>rubygem20-dragonfly</name>
|
|
<range><lt>0.9.14</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Mark Evans reports:</p>
|
|
<blockquote cite="https://groups.google.com/forum/?fromgroups=#!topic/dragonfly-users/3c3WIU3VQTo">
|
|
<p>Unfortnately there is a security vulnerability in Dragonfly when
|
|
used with Rails which would potentially allow an attacker to run
|
|
arbitrary code on a host machine using carefully crafted
|
|
requests.
|
|
</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-1756</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-02-19</discovery>
|
|
<entry>2013-02-28</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="dbdac023-80e1-11e2-9a29-001060e06fd4">
|
|
<topic>linux-flashplugin -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>linux-f10-flashplugin</name>
|
|
<range><lt>11.2r202.273</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Adobe reports:</p>
|
|
<blockquote cite="https://www.adobe.com/support/security/bulletins/apsb13-08.html">
|
|
<p>These updates address vulnerabilities that could cause a crash
|
|
and potentially allow an attacker to take control of the affected system.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-0504</cvename>
|
|
<cvename>CVE-2013-0643</cvename>
|
|
<cvename>CVE-2013-0648</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-02-26</discovery>
|
|
<entry>2013-02-27</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="84065569-7fb4-11e2-9c5a-000d601460a4">
|
|
<topic>otrs -- XSS vulnerability could lead to remote code execution</topic>
|
|
<affects>
|
|
<package>
|
|
<name>otrs</name>
|
|
<range><ge>3.1.*</ge><lt>3.1.11</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The OTRS Project reports:</p>
|
|
<blockquote cite="http://www.otrs.com/en/open-source/community-news/security-advisories/security-advisory-2012-03">
|
|
<p>This advisory covers vulnerabilities discovered in the OTRS core
|
|
system. This is a variance of the XSS vulnerability, where an attacker
|
|
could send a specially prepared HTML email to OTRS which would cause
|
|
JavaScript code to be executed in your browser while displaying the
|
|
email. In this case this is achieved by using javascript source
|
|
attributes with whitespaces.</p>
|
|
<p>Affected by this vulnerability are all releases of OTRS 2.4.x up to
|
|
and including 2.4.14, 3.0.x up to and including 3.0.16 and 3.1.x up to
|
|
and including 3.1.10.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-4751</cvename>
|
|
<url>http://www.otrs.com/en/open-source/community-news/security-advisories/security-advisory-2012-03</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-10-16</discovery>
|
|
<entry>2013-02-25</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="d60199df-7fb3-11e2-9c5a-000d601460a4">
|
|
<topic>otrs -- XSS vulnerability in Firefox and Opera could lead to remote code execution</topic>
|
|
<affects>
|
|
<package>
|
|
<name>otrs</name>
|
|
<range><ge>3.1.*</ge><lt>3.1.10</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The OTRS Project reports:</p>
|
|
<blockquote cite="http://www.otrs.com/en/open-source/community-news/security-advisories/security-advisory-2012-02/">
|
|
<p>This advisory covers vulnerabilities discovered in the OTRS core
|
|
system. This is a variance of the XSS vulnerability, where an attacker
|
|
could send a specially prepared HTML email to OTRS which would cause
|
|
JavaScript code to be executed in your browser while displaying the
|
|
email in Firefox and Opera. In this case this is achieved with an
|
|
invalid HTML structure with nested tags.</p>
|
|
<p>Affected by this
|
|
vulnerability are all releases of OTRS 2.4.x up to and including
|
|
2.4.13, 3.0.x up to and including 3.0.15 and 3.1.x up to and including
|
|
3.1.9 in combination with Firefox and Opera.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-4600</cvename>
|
|
<url>http://www.otrs.com/en/open-source/community-news/security-advisories/security-advisory-2012-02</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-08-30</discovery>
|
|
<entry>2013-02-25</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="b50cbbc0-7fb2-11e2-9c5a-000d601460a4">
|
|
<topic>otrs -- XSS vulnerability in Internet Explorer could lead to remote code execution</topic>
|
|
<affects>
|
|
<package>
|
|
<name>otrs</name>
|
|
<range><ge>3.1.*</ge><lt>3.1.9</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The OTRS Project reports:</p>
|
|
<blockquote cite="http://www.otrs.com/en/open-source/community-news/security-advisories/security-advisory-2012-01">
|
|
<p>This advisory covers vulnerabilities discovered in the OTRS core
|
|
system. Due to the XSS vulnerability in Internet Explorer an attacker
|
|
could send a specially prepared HTML email to OTRS which would cause
|
|
JavaScript code to be executed in your Internet Explorer while
|
|
displaying the email.</p>
|
|
<p>Affected by this vulnerability are all releases of OTRS 2.4.x up to
|
|
and including 2.4.12, 3.0.x up to and including 3.0.14 and 3.1.x up to
|
|
and including 3.1.8 in combination with Internet Explorer.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-2582</cvename>
|
|
<url>http://www.otrs.com/en/open-source/community-news/security-advisories/security-advisory-2012-01</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-08-22</discovery>
|
|
<entry>2013-02-25</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="844cf3f5-9259-4b3e-ac9e-13ca17333ed7">
|
|
<topic>ruby -- DoS vulnerability in REXML</topic>
|
|
<affects>
|
|
<package>
|
|
<name>ruby</name>
|
|
<range><ge>1.9,1</ge><lt>1.9.3.392,1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Ruby developers report:</p>
|
|
<blockquote cite="http://www.ruby-lang.org/en/news/2013/02/22/rexml-dos-2013-02-22/">
|
|
<p>Unrestricted entity expansion can lead to a DoS vulnerability in
|
|
REXML. (The CVE identifier will be assigned later.) We strongly
|
|
recommend to upgrade ruby.
|
|
</p>
|
|
<p>When reading text nodes from an XML document, the REXML parser can
|
|
be coerced in to allocating extremely large string objects which
|
|
can consume all of the memory on a machine, causing a denial of
|
|
service.
|
|
</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://www.ruby-lang.org/en/news/2013/02/22/rexml-dos-2013-02-22/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-02-22</discovery>
|
|
<entry>2013-02-24</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="e1aa3bdd-839a-4a77-8617-cca439a8f9fc">
|
|
<topic>rubygem-ruby_parser -- insecure tmp file usage</topic>
|
|
<affects>
|
|
<package>
|
|
<name>rubygem18-ruby_parser</name>
|
|
<name>rubygem19-ruby_parser</name>
|
|
<name>rubygem20-ruby_parser</name>
|
|
<range><lt>3.1.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Michael Scherer reports:</p>
|
|
<blockquote cite="http://seclists.org/oss-sec/2013/q1/393">
|
|
<p>This is a relatively minor tmp file usage issue.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-0162</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-02-24</discovery>
|
|
<entry>2013-02-24</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="21c59f5e-7cc5-11e2-9c11-080027a5ec9a">
|
|
<topic>django -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>py26-django</name>
|
|
<name>py27-django</name>
|
|
<range><ge>1.3</ge><lt>1.3.6</lt></range>
|
|
<range><ge>1.4</ge><lt>1.4.4</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Django Project reports:</p>
|
|
<blockquote cite="https://www.djangoproject.com/weblog/2013/feb/19/security/">
|
|
<p>These security releases fix four issues: one potential phishing
|
|
vector, one denial-of-service vector, an information leakage issue,
|
|
and a range of XML vulnerabilities.</p>
|
|
<ol>
|
|
<li>
|
|
<p>Host header poisoning</p>
|
|
<p>an attacker could cause Django to generate and display URLs that
|
|
link to arbitrary domains. This could be used as part of a phishing
|
|
attack. These releases fix this problem by introducing a new
|
|
setting, ALLOWED_HOSTS, which specifies a whitelist of domains your
|
|
site is known to respond to.</p>
|
|
<p>Important: by default Django 1.3.6 and 1.4.4 set ALLOWED_HOSTS to
|
|
allow all hosts. This means that to actually fix the security
|
|
vulnerability you should define this setting yourself immediately
|
|
after upgrading.</p>
|
|
</li>
|
|
<li>
|
|
<p>Formset denial-of-service</p>
|
|
<p>an attacker can abuse Django's tracking of the number of forms in
|
|
a formset to cause a denial-of-service attack. This has been fixed
|
|
by adding a default maximum number of forms of 1,000. You can still
|
|
manually specify a bigger max_num, if you wish, but 1,000 should be
|
|
enough for anyone.</p>
|
|
</li>
|
|
<li>
|
|
<p>XML attacks</p>
|
|
<p>Django's serialization framework was vulnerable to attacks via XML
|
|
entity expansion and external references; this is now fixed.
|
|
However, if you're parsing arbitrary XML in other parts of your
|
|
application, we recommend you look into the defusedxml Python
|
|
packages which remedy this anywhere you parse XML, not just via
|
|
Django's serialization framework.</p>
|
|
</li>
|
|
<li>
|
|
<p>Data leakage via admin history log</p>
|
|
<p>Django's admin interface could expose supposedly-hidden
|
|
information via its history log. This has been fixed.</p>
|
|
</li>
|
|
</ol>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-1664</cvename>
|
|
<cvename>CVE-2013-1665</cvename>
|
|
<cvename>CVE-2013-0305</cvename>
|
|
<cvename>CVE-2013-0306</cvename>
|
|
<bid>58022</bid>
|
|
<bid>58061</bid>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-02-21</discovery>
|
|
<entry>2013-02-24</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="dfd92cb2-7d48-11e2-ad48-00262d5ed8ee">
|
|
<topic>chromium -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>chromium</name>
|
|
<range><lt>25.0.1364.97</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Google Chrome Releases reports:</p>
|
|
<blockquote cite="http://googlechromereleases.blogspot.nl/search/label/Stable%20updates">
|
|
<p>[172243] High CVE-2013-0879: Memory corruption with web audio
|
|
node. Credit to Atte Kettunen of OUSPG.</p>
|
|
<p>[171951] High CVE-2013-0880: Use-after-free in database handling.
|
|
Credit to Chamal de Silva.</p>
|
|
<p>[167069] Medium CVE-2013-0881: Bad read in Matroska handling.
|
|
Credit to Atte Kettunen of OUSPG.</p>
|
|
<p>[165432] High CVE-2013-0882: Bad memory access with excessive SVG
|
|
parameters. Credit to Renata Hodovan.</p>
|
|
<p>[142169] Medium CVE-2013-0883: Bad read in Skia. Credit to Atte
|
|
Kettunen of OUSPG.</p>
|
|
<p>[172984] Low CVE-2013-0884: Inappropriate load of NaCl. Credit to
|
|
Google Chrome Security Team (Chris Evans).</p>
|
|
<p>[172369] Medium CVE-2013-0885: Too many API permissions granted to
|
|
web store.</p>
|
|
<p>[171065] [170836] Low CVE-2013-0887: Developer tools process has
|
|
too many permissions and places too much trust in the connected
|
|
server.</p>
|
|
<p>[170666] Medium CVE-2013-0888: Out-of-bounds read in Skia. Credit
|
|
to Google Chrome Security Team (Inferno).</p>
|
|
<p>[170569] Low CVE-2013-0889: Tighten user gesture check for
|
|
dangerous file downloads.</p>
|
|
<p>[169973] [169966] High CVE-2013-0890: Memory safety issues across
|
|
the IPC layer. Credit to Google Chrome Security Team (Chris
|
|
Evans).</p>
|
|
<p>[169685] High CVE-2013-0891: Integer overflow in blob handling.
|
|
Credit to Google Chrome Security Team (Jüri Aedla).</p>
|
|
<p>[169295] [168710] [166493] [165836] [165747] [164958] [164946]
|
|
Medium CVE-2013-0892: Lower severity issues across the IPC layer.
|
|
Credit to Google Chrome Security Team (Chris Evans).</p>
|
|
<p>[168570] Medium CVE-2013-0893: Race condition in media handling.
|
|
Credit to Andrew Scherkus of the Chromium development community.</p>
|
|
<p>[168473] High CVE-2013-0894: Buffer overflow in vorbis decoding.
|
|
Credit to Google Chrome Security Team (Inferno).</p>
|
|
<p>[Linux / Mac] [167840] High CVE-2013-0895: Incorrect path handling
|
|
in file copying. Credit to Google Chrome Security Team (Jüri
|
|
Aedla).</p>
|
|
<p>[166708] High CVE-2013-0896: Memory management issues in plug-in
|
|
message handling. Credit to Google Chrome Security Team (Cris
|
|
Neckar).</p>
|
|
<p>[165537] Low CVE-2013-0897: Off-by-one read in PDF. Credit to
|
|
Mateusz Jurczyk, with contributions by Gynvael Coldwind, both from
|
|
Google Security Team.</p>
|
|
<p>[164643] High CVE-2013-0898: Use-after-free in URL handling.
|
|
Credit to Alexander Potapenko of the Chromium development
|
|
community.</p>
|
|
<p>[160480] Low CVE-2013-0899: Integer overflow in Opus handling.
|
|
Credit to Google Chrome Security Team (Jüri Aedla).</p>
|
|
<p>[152442] Medium CVE-2013-0900: Race condition in ICU. Credit to
|
|
Google Chrome Security Team (Inferno).</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-0879</cvename>
|
|
<cvename>CVE-2013-0880</cvename>
|
|
<cvename>CVE-2013-0881</cvename>
|
|
<cvename>CVE-2013-0882</cvename>
|
|
<cvename>CVE-2013-0883</cvename>
|
|
<cvename>CVE-2013-0884</cvename>
|
|
<cvename>CVE-2013-0885</cvename>
|
|
<cvename>CVE-2013-0887</cvename>
|
|
<cvename>CVE-2013-0888</cvename>
|
|
<cvename>CVE-2013-0889</cvename>
|
|
<cvename>CVE-2013-0890</cvename>
|
|
<cvename>CVE-2013-0891</cvename>
|
|
<cvename>CVE-2013-0892</cvename>
|
|
<cvename>CVE-2013-0893</cvename>
|
|
<cvename>CVE-2013-0894</cvename>
|
|
<cvename>CVE-2013-0895</cvename>
|
|
<cvename>CVE-2013-0896</cvename>
|
|
<cvename>CVE-2013-0897</cvename>
|
|
<cvename>CVE-2013-0898</cvename>
|
|
<cvename>CVE-2013-0899</cvename>
|
|
<cvename>CVE-2013-0900</cvename>
|
|
<url>http://googlechromereleases.blogspot.nl/search/label/Stable%20updates</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-02-21</discovery>
|
|
<entry>2013-02-22</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="f54584bc-7d2b-11e2-9bd1-206a8a720317">
|
|
<topic>krb5 -- null pointer dereference in the KDC PKINIT code [CVE-2013-1415]</topic>
|
|
<affects>
|
|
<package>
|
|
<name>krb5</name>
|
|
<range><le>1.11</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>No advisory has been released yet.</p>
|
|
<blockquote cite="http://web.mit.edu/kerberos/www/krb5-1.11/">
|
|
<p>Fix a null pointer dereference in the KDC PKINIT code [CVE-2013-1415].</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-1415</cvename>
|
|
<url>http://web.mit.edu/kerberos/www/krb5-1.11/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-02-21</discovery>
|
|
<entry>2013-02-22</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="3c90e093-7c6e-11e2-809b-6c626d99876c">
|
|
<topic>FreeBSD -- glob(3) related resource exhaustion</topic>
|
|
<affects>
|
|
<package>
|
|
<name>FreeBSD</name>
|
|
<range><gt>7.4</gt><lt>7.4_12</lt></range>
|
|
<range><gt>8.3</gt><lt>8.3_6</lt></range>
|
|
<range><gt>9.0</gt><lt>9.0_6</lt></range>
|
|
<range><gt>9.1</gt><lt>9.1_1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Problem description:</p>
|
|
<blockquote cite="http://www.freebsd.org/security/advisories/FreeBSD-SA-13:02.libc.asc">
|
|
<p>GLOB_LIMIT is supposed to limit the number of paths to prevent against
|
|
memory or CPU attacks. The implementation however is insufficient.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<freebsdsa>SA-13:02.libc</freebsdsa>
|
|
<cvename>CVE-2010-2632</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-02-19</discovery>
|
|
<entry>2013-02-21</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="4671cdc9-7c6d-11e2-809b-6c626d99876c">
|
|
<topic>FreeBSD -- BIND remote DoS with deliberately crafted DNS64 query</topic>
|
|
<affects>
|
|
<package>
|
|
<name>FreeBSD</name>
|
|
<range><ge>9.0</ge><lt>9.0_6</lt></range>
|
|
<range><ge>9.1</ge><lt>9.1_1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Problem description:</p>
|
|
<blockquote cite="http://www.freebsd.org/security/advisories/FreeBSD-SA-13:01.bind.asc">
|
|
<p>Due to a software defect a crafted query can cause named(8) to crash
|
|
with an assertion failure.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<freebsdsa>SA-13:01.bind</freebsdsa>
|
|
<cvename>CVE-2012-5688</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-02-19</discovery>
|
|
<entry>2013-02-21</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="a4d71e4c-7bf4-11e2-84cd-d43d7e0c7c02">
|
|
<topic>drupal7 -- Denial of service</topic>
|
|
<affects>
|
|
<package>
|
|
<name>drupal7</name>
|
|
<range><lt>7.19</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Drupal Security Team reports:</p>
|
|
<blockquote cite="https://drupal.org/SA-CORE-2013-002">
|
|
<p>Drupal core's Image module allows for the on-demand generation
|
|
of image derivatives. This capability can be abused by requesting
|
|
a large number of new derivatives which can fill up the server disk
|
|
space, and which can cause a very high CPU load. Either of these
|
|
effects may lead to the site becoming unavailable or unresponsive.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-0316</cvename>
|
|
<url>https://drupal.org/SA-CORE-2013-002</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-02-20</discovery>
|
|
<entry>2013-02-21</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="58c15292-7b61-11e2-95da-001e8c1a8a0e">
|
|
<topic>nss-pam-ldapd -- file descriptor buffer overflow</topic>
|
|
<affects>
|
|
<package>
|
|
<name>nss-pam-ldapd</name>
|
|
<range><lt>0.8.12</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Garth Mollett reports:</p>
|
|
<blockquote cite="http://arthurdejong.org/nss-pam-ldapd/CVE-2013-0288">
|
|
<p>A file descriptor overflow issue in the use of FD_SET()
|
|
in nss-pam-ldapd can lead to a stack-based buffer overflow.
|
|
An attacker could, under some circumstances, use this flaw
|
|
to cause a process that has the NSS or PAM module loaded to
|
|
crash or potentially execute arbitrary code.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-0288</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-02-18</discovery>
|
|
<entry>2013-02-20</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="1c8a039b-7b23-11e2-b17b-20cf30e32f6d">
|
|
<topic>bugzilla -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>bugzilla</name>
|
|
<name>de-bugzilla</name>
|
|
<name>ru-bugzilla</name>
|
|
<name>ja-bugzilla</name>
|
|
<range><ge>3.6.0</ge><lt>3.6.13</lt></range>
|
|
<range><ge>4.0.0</ge><lt>4.0.10</lt></range>
|
|
<range><ge>4.2.0</ge><lt>4.2.5</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<h1>A Bugzilla Security Advisory reports:</h1>
|
|
<blockquote cite="http://www.bugzilla.org/security/3.6.12/">
|
|
<h1>Cross-Site Scripting</h1>
|
|
<p>When viewing a single bug report, which is the default,
|
|
the bug ID is validated and rejected if it is invalid.
|
|
But when viewing several bug reports at once, which is
|
|
specified by the format=multiple parameter, invalid bug
|
|
IDs can go through and are sanitized in the HTML page
|
|
itself. But when an invalid page format is passed to the
|
|
CGI script, the wrong HTML page is called and data are not
|
|
correctly sanitized, which can lead to XSS.</p>
|
|
<h1>Information Leak</h1>
|
|
<p>When running a query in debug mode, the generated SQL
|
|
query used to collect the data is displayed. The way this
|
|
SQL query is built permits the user to determine if some
|
|
confidential field value (such as a product name) exists.
|
|
This problem only affects Bugzilla 4.0.9 and older. Newer
|
|
releases are not affected by this issue.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-0785</cvename>
|
|
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=842038</url>
|
|
<cvename>CVE-2013-0786</cvename>
|
|
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=824399</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-02-19</discovery>
|
|
<entry>2013-02-20</entry>
|
|
<modified>2013-03-31</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="e3f0374a-7ad6-11e2-84cd-d43d7e0c7c02">
|
|
<topic>mozilla -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>firefox</name>
|
|
<range><gt>18.0,1</gt><lt>19.0,1</lt></range>
|
|
<range><lt>17.0.3,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-firefox</name>
|
|
<range><lt>17.0.3,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-seamonkey</name>
|
|
<range><lt>2.16</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-thunderbird</name>
|
|
<range><lt>17.0.3</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>seamonkey</name>
|
|
<range><lt>2.16</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>thunderbird</name>
|
|
<range><gt>11.0</gt><lt>17.0.3</lt></range>
|
|
<range><lt>10.0.12</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>libxul</name>
|
|
<range><gt>1.9.2.*</gt><lt>10.0.12</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Mozilla Project reports:</p>
|
|
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
|
|
<p>MFSA 2013-21 Miscellaneous memory safety hazards (rv:19.0 /
|
|
rv:17.0.3)</p>
|
|
<p>MFSA 2013-22 Out-of-bounds read in image rendering</p>
|
|
<p>MFSA 2013-23 Wrapped WebIDL objects can be wrapped again</p>
|
|
<p>MFSA 2013-24 Web content bypass of COW and SOW security wrappers</p>
|
|
<p>MFSA 2013-25 Privacy leak in JavaScript Workers</p>
|
|
<p>MFSA 2013-26 Use-after-free in nsImageLoadingContent</p>
|
|
<p>MFSA 2013-27 Phishing on HTTPS connection through malicious proxy</p>
|
|
<p>MFSA 2013-28 Use-after-free, out of bounds read, and buffer
|
|
overflow issues found using Address Sanitizer</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-0765</cvename>
|
|
<cvename>CVE-2013-0772</cvename>
|
|
<cvename>CVE-2013-0773</cvename>
|
|
<cvename>CVE-2013-0774</cvename>
|
|
<cvename>CVE-2013-0775</cvename>
|
|
<cvename>CVE-2013-0776</cvename>
|
|
<cvename>CVE-2013-0783</cvename>
|
|
<cvename>CVE-2013-0784</cvename>
|
|
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-20.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-21.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-22.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-23.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-24.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-25.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-26.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-27.html</url>
|
|
<url>http://www.mozilla.org/security/known-vulnerabilities/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-02-19</discovery>
|
|
<entry>2013-02-19</entry>
|
|
<modified>2013-02-20</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="fcfdabb7-f14d-4e61-a7d5-cfefb4b99b15">
|
|
<topic>Ruby Rack Gem -- Multiple Issues</topic>
|
|
<affects>
|
|
<package>
|
|
<name>rubygem18-rack</name>
|
|
<range><lt>1.4.5</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>rubygem19-rack</name>
|
|
<range><lt>1.4.5</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Rack developers report:</p>
|
|
<blockquote cite="http://www.ruby-forum.com/topic/4410659">
|
|
<p>Today we are proud to announce the release of Rack 1.4.5.</p>
|
|
<p>Fix CVE-2013-0263, timing attack against Rack::Session::Cookie</p>
|
|
<p>Fix CVE-2013-0262, symlink path traversal in Rack::File</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-0262</cvename>
|
|
<cvename>CVE-2013-0263</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-02-08</discovery>
|
|
<entry>2013-02-17</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="beab40bf-c1ca-4d2b-ad46-2f14bac8a968">
|
|
<topic>Ruby Activemodel Gem -- Circumvention of attr_protected</topic>
|
|
<affects>
|
|
<package>
|
|
<name>rubygem18-activemodel</name>
|
|
<range><lt>3.2.12</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>rubygem19-activemodel</name>
|
|
<range><lt>3.2.12</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Aaron Patterson reports:</p>
|
|
<blockquote cite="https://groups.google.com/forum/?fromgroups=#!topic/rubyonrails-security/AFBKNY7VSH8">
|
|
<p>The attr_protected method allows developers to specify a blacklist
|
|
of model attributes which users should not be allowed to assign to.
|
|
By using a specially crafted request, attackers could circumvent
|
|
this protection and alter values that were meant to be protected.</p>
|
|
<p>All users running an affected release should either upgrade or use
|
|
one of the work arounds immediately. Users should also consider
|
|
switching from attr_protected to the whitelist method
|
|
attr_accessible which is not vulnerable to this attack.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-0276</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-02-11</discovery>
|
|
<entry>2013-02-17</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="7fe5b84a-78eb-11e2-8441-00e0814cab4e">
|
|
<topic>jenkins -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>jenkins</name>
|
|
<range><lt>1.501</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Jenkins Security Advisory reports:</p>
|
|
<blockquote cite="https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2013-02-16">
|
|
<p>This advisory announces multiple security vulnerabilities that
|
|
were found in Jenkins core.</p>
|
|
<ol>
|
|
<li>One of the vulnerabilities allows cross-site request
|
|
forgery (CSRF) attacks on Jenkins master, which causes an user
|
|
to make unwanted actions on Jenkins. Another vulnerability
|
|
enables cross-site scripting (XSS) attacks, which has the similar
|
|
consequence. Another vulnerability allowed an attacker to bypass
|
|
the CSRF protection mechanism in place, thereby mounting more CSRF
|
|
attackes. These attacks allow an attacker without direct access to
|
|
Jenkins to mount an attack.</li>
|
|
<li>In the fourth vulnerability, a malicious user of Jenkins can trick
|
|
Jenkins into building jobs that he does not have direct access to.</li>
|
|
<li>And lastly, a vulnerability allows a malicious user of Jenkins to
|
|
mount a denial of service attack by feeding a carefully crafted
|
|
payload to Jenkins.</li>
|
|
</ol>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2013-02-16</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-02-16</discovery>
|
|
<entry>2013-02-17</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="f7809d9e-6af0-11e2-8e32-080027d768d3">
|
|
<topic>poweradmin -- multiple XSS vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>poweradmin</name>
|
|
<range><lt>2.1.6</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Multiple cross-site scripting (XSS) vulnerabilities</p>
|
|
<blockquote cite="https://www.poweradmin.org/trac/ticket/468">
|
|
<p>Multiple scripts are vulnerable to XSS attacks.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>55619</bid>
|
|
<url>http://packetstormsecurity.com/files/116698/Poweradmin-Cross-Site-Scripting.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-01-12</discovery>
|
|
<entry>2013-02-16</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="c79eb109-a754-45d7-b552-a42099eb2265">
|
|
<topic>Ruby -- Denial of Service and Unsafe Object Creation Vulnerability in JSON</topic>
|
|
<affects>
|
|
<package>
|
|
<name>ruby</name>
|
|
<range><ge>1.9,1</ge><lt>1.9.3.385,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>rubygem18-json</name>
|
|
<range><lt>1.7.7</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>rubygem19-json</name>
|
|
<range><lt>1.7.7</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>rubygem18-json_pure</name>
|
|
<range><lt>1.7.7</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>rubygem19-json_pure</name>
|
|
<range><lt>1.7.7</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Aaron Patterson reports:</p>
|
|
<blockquote cite="https://groups.google.com/forum/?fromgroups=#!topic/rubyonrails-security/4_YvCpLzL58">
|
|
<p>When parsing certain JSON documents, the JSON gem can be coerced in
|
|
to creating Ruby symbols in a target system. Since Ruby symbols
|
|
are not garbage collected, this can result in a denial of service
|
|
attack.</p>
|
|
<p>The same technique can be used to create objects in a target system
|
|
that act like internal objects. These "act alike" objects can be
|
|
used to bypass certain security mechanisms and can be used as a
|
|
spring board for SQL injection attacks in Ruby on Rails.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-0269</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-02-11</discovery>
|
|
<entry>2013-02-16</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="d3e96508-056b-4259-88ad-50dc8d1978a6">
|
|
<topic>Ruby -- XSS exploit of RDoc documentation generated by rdoc</topic>
|
|
<affects>
|
|
<package>
|
|
<name>ruby</name>
|
|
<range><ge>1.9,1</ge><lt>1.9.3.385,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>rubygem18-rdoc</name>
|
|
<range><lt>3.12.1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>rubygem19-rdoc</name>
|
|
<range><lt>3.12.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Ruby developers report:</p>
|
|
<blockquote cite="http://www.ruby-lang.org/en/news/2013/02/06/rdoc-xss-cve-2013-0256/">
|
|
<p>RDoc documentation generated by rdoc bundled with ruby are
|
|
vulnerable to an XSS exploit. All ruby users are recommended to
|
|
update ruby to newer version which includes security-fixed RDoc. If
|
|
you are publishing RDoc documentation generated by rdoc, you are
|
|
recommended to apply a patch for the documentaion or re-generate it
|
|
with security-fixed RDoc.
|
|
</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-0256</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-02-06</discovery>
|
|
<entry>2013-02-16</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="414e6a41-7204-11e2-8599-001060e06fd4">
|
|
<topic>linux-flashplugin -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>linux-f10-flashplugin</name>
|
|
<range><lt>11.2r202.262</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Adobe reports:</p>
|
|
<blockquote cite="https://www.adobe.com/support/security/bulletins/apsb13-04.html">
|
|
<p>These updates address vulnerabilities that could cause a crash
|
|
and potentially allow an attacker to take control of the affected system.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-0633</cvename>
|
|
<cvename>CVE-2013-0634</cvename>
|
|
<url>https://www.adobe.com/support/security/bulletins/apsb13-04.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-02-07</discovery>
|
|
<entry>2013-02-08</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="00b0d8cd-7097-11e2-98d9-003067c2616f">
|
|
<topic>OpenSSL -- TLS 1.1, 1.2 denial of service</topic>
|
|
<affects>
|
|
<package>
|
|
<name>openssl</name>
|
|
<range><lt>1.0.1_6</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>OpenSSL security team reports:</p>
|
|
<blockquote cite="http://www.openssl.org/news/secadv_20130205.txt">
|
|
<p>A flaw in the OpenSSL handling of CBC mode ciphersuites in TLS 1.1
|
|
and TLS 1.2 on AES-NI supporting platforms can be exploited in a
|
|
DoS attack.</p>
|
|
<p>A flaw in the OpenSSL handling of OCSP response verification can
|
|
be exploited in a denial of service attack.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-2686</cvename>
|
|
<cvename>CVE-2013-0166</cvename>
|
|
<cvename>CVE-2013-0169</cvename>
|
|
<url>http://www.openssl.org/news/secadv_20120510.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-02-05</discovery>
|
|
<entry>2013-02-06</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="8c773d7f-6cbb-11e2-b242-c8600054b392">
|
|
<topic>mysql/mariadb/percona server -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>mysql-server</name>
|
|
<range><ge>5.1</ge><lt>5.1.67</lt></range>
|
|
<range><ge>5.5</ge><lt>5.5.29</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>mariadb-server</name>
|
|
<range><ge>5.3</ge><lt>5.3.12</lt></range>
|
|
<range><ge>5.5</ge><lt>5.5.29</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>percona-server</name>
|
|
<range><ge>5.5</ge><lt>5.5.29.29.4</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>ORACLE reports:</p>
|
|
<blockquote cite="http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html">
|
|
<p>Multiple SQL injection vulnerabilities in the replication code</p>
|
|
<p>Stack-based buffer overflow</p>
|
|
<p>Heap-based buffer overflow</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-4414</cvename>
|
|
<cvename>CVE-2012-5611</cvename>
|
|
<cvename>CVE-2012-5612</cvename>
|
|
<cvename>CVE-2012-5615</cvename>
|
|
<cvename>CVE-2012-5627</cvename>
|
|
<url>https://mariadb.atlassian.net/browse/MDEV-4029</url>
|
|
<url>https://mariadb.atlassian.net/browse/MDEV-MDEV-729</url>
|
|
<url>https://mariadb.atlassian.net/browse/MDEV-MDEV-729</url>
|
|
<url>http://www.mysqlperformanceblog.com/2013/01/23/announcing-percona-server-5-5-29-29-4/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-12-01</discovery>
|
|
<entry>2013-02-01</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="ea0f45e2-6c4b-11e2-98d9-003067c2616f">
|
|
<topic>opera -- execution of arbitrary code</topic>
|
|
<affects>
|
|
<package>
|
|
<name>opera</name>
|
|
<name>opera-devel</name>
|
|
<name>linux-opera</name>
|
|
<name>linux-opera-devel</name>
|
|
<range><lt>12.13</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Opera reports:</p>
|
|
<blockquote cite="http://www.opera.com/support/kb/view/1042/">
|
|
<p>Particular DOM event manipulations can cause Opera to crash. In
|
|
some cases, this crash might occur in a way that allows execution
|
|
of arbitrary code. To inject code, additional techniques would
|
|
have to be employed.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://www.opera.com/support/kb/view/1042/</url>
|
|
<url>http://www.opera.com/support/kb/view/1043/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-01-30</discovery>
|
|
<entry>2013-02-01</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="2ea6ce3d-6afd-11e2-9d4e-bcaec524bf84">
|
|
<topic>upnp -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>upnp</name>
|
|
<range><lt>1.6.18</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Project changelog reports:</p>
|
|
<blockquote cite="http://pupnp.sourceforge.net/ChangeLog">
|
|
<p>This patch addresses three possible buffer overflows in
|
|
function unique_service_name().The three issues have the
|
|
folowing CVE numbers:</p>
|
|
<ul>
|
|
<li>CVE-2012-5958 Issue #2: Stack buffer overflow of Tempbuf</li>
|
|
<li>CVE-2012-5959 Issue #4: Stack buffer overflow of Event->UDN</li>
|
|
<li>CVE-2012-5960 Issue #8: Stack buffer overflow of Event->UDN</li>
|
|
</ul>
|
|
<p>Notice that the following issues have already been dealt by
|
|
previous work:</p>
|
|
<ul>
|
|
<li>CVE-2012-5961 Issue #1: Stack buffer overflow of Evt->UDN</li>
|
|
<li>CVE-2012-5962 Issue #3: Stack buffer overflow of Evt->DeviceType</li>
|
|
<li>CVE-2012-5963 Issue #5: Stack buffer overflow of Event->UDN</li>
|
|
<li>CVE-2012-5964 Issue #6: Stack buffer overflow of Event->DeviceType</li>
|
|
<li>CVE-2012-5965 Issue #7: Stack buffer overflow of Event->DeviceType</li>
|
|
</ul>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-5958</cvename>
|
|
<cvename>CVE-2012-5959</cvename>
|
|
<cvename>CVE-2012-5960</cvename>
|
|
<cvename>CVE-2012-5961</cvename>
|
|
<cvename>CVE-2012-5962</cvename>
|
|
<cvename>CVE-2012-5963</cvename>
|
|
<cvename>CVE-2012-5964</cvename>
|
|
<cvename>CVE-2012-5965</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-11-21</discovery>
|
|
<entry>2013-01-30</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="559e00b7-6a4d-11e2-b6b0-10bf48230856">
|
|
<topic>wordpress -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>wordpress</name>
|
|
<range><lt>3.5.1,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>zh-wordpress-zh_CN</name>
|
|
<name>zh-wordpress-zh_TW</name>
|
|
<name>de-wordpress</name>
|
|
<name>ja-wordpress</name>
|
|
<name>ru-wordpress</name>
|
|
<range><lt>3.5.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Wordpress reports:</p>
|
|
<blockquote cite="http://wordpress.org/news/2013/01/wordpress-3-5-1/">
|
|
<p>WordPress 3.5.1 also addresses the following security issues:</p>
|
|
<ul>
|
|
<li>A server-side request forgery vulnerability and remote port
|
|
scanning using pingbacks. This vulnerability, which could
|
|
potentially be used to expose information and compromise a
|
|
site, affects all previous WordPress versions. This was fixed
|
|
by the WordPress security team. We'd like to thank security
|
|
researchers <a href="http://codeseekah.com/">Gennady
|
|
Kovshenin</a> and <a href="http://www.ethicalhack3r.co.uk/">Ryan
|
|
Dewhurst</a> for reviewing our work.</li>
|
|
<li>Two instances of cross-site scripting via shortcodes and post
|
|
content. These issues were discovered by Jon Cave of the WordPress
|
|
security team.</li>
|
|
<li>A cross-site scripting vulnerability in the external library
|
|
Plupload. Thanks to the Moxiecode team for working with us on
|
|
this, and for releasing Plupload 1.5.5 to address this issue.</li>
|
|
</ul>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-0235</cvename>
|
|
<cvename>CVE-2013-0236</cvename>
|
|
<cvename>CVE-2013-0237</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-01-24</discovery>
|
|
<entry>2013-01-29</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="3886cafe-668c-11e2-94b8-1c4bd681f0cf">
|
|
<topic>django-cms -- XSS Vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>py-django-cms</name>
|
|
<range><lt>2.3.5</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Cross-site scripting (XSS) vulnerability</p>
|
|
<blockquote cite="https://www.django-cms.org/en/blog/2012/12/04/2-3-5-security-release/">
|
|
<p>Jonas Obrist reports: The security issue allows users with limited
|
|
admin access to elevate their privileges through XSS injection
|
|
using the page_attribute template tag. Only users with admin access
|
|
and the permission to edit at least one django CMS page object
|
|
could exploit this vulnerability. Websites that do not use the
|
|
page_attribute template tag are not affected.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>https://www.django-cms.org/en/blog/2012/12/04/2-3-5-security-release/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-12-04</discovery>
|
|
<entry>2013-01-25</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="8d03202c-6559-11e2-a389-00262d5ed8ee">
|
|
<topic>chromium -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>chromium</name>
|
|
<range><lt>24.0.1312.56</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Google Chrome Releases reports:</p>
|
|
<blockquote cite="http://googlechromereleases.blogspot.nl/search/label/Stable%20updates">
|
|
<p>[151008] High CVE-2013-0839: Use-after-free in canvas font
|
|
handling. Credit to Atte Kettunen of OUSPG.</p>
|
|
<p>[170532] Medium CVE-2013-0840: Missing URL validation when opening
|
|
new windows.</p>
|
|
<p>[169770] High CVE-2013-0841: Unchecked array index in content
|
|
blocking. Credit to Google Chrome Security Team (Chris Evans).</p>
|
|
<p>[166867] Medium CVE-2013-0842: Problems with NULL characters
|
|
embedded in paths. Credit to Google Chrome Security Team (Jüri
|
|
Aedla).</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-0839</cvename>
|
|
<cvename>CVE-2013-0840</cvename>
|
|
<cvename>CVE-2013-0841</cvename>
|
|
<cvename>CVE-2013-0842</cvename>
|
|
<url>http://googlechromereleases.blogspot.nl/search/label/Stable%20updates</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-01-22</discovery>
|
|
<entry>2013-01-23</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="1827f213-633e-11e2-8d93-c8600054b392">
|
|
<topic>drupal -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>drupal6</name>
|
|
<range><lt>6.28</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>drupal7</name>
|
|
<range><lt>7.19</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Drupal Security Team reports:</p>
|
|
<blockquote cite="https://drupal.org/SA-CORE-2013-001">
|
|
<p>Cross-site scripting (Various core and contributed modules)</p>
|
|
<p>Access bypass (Book module printer friendly version)</p>
|
|
<p>Access bypass (Image module)</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>https://drupal.org/SA-CORE-2013-001</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-01-16</discovery>
|
|
<entry>2013-01-20</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="1b9b199f-5efd-11e2-a1ee-c48508086173">
|
|
<topic>ettercap -- buffer overflow in target list parsing</topic>
|
|
<affects>
|
|
<package>
|
|
<name>ettercap</name>
|
|
<range><lt>0.7.4.1</lt></range>
|
|
<range><ge>0.7.5</ge><lt>0.7.5.2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Host target list parsing routine in ettercap
|
|
0.7.4-series prior to 0.7.4.1 and 0.7.5-series
|
|
is prone to the stack-based buffer overflow that
|
|
may lead to the code execution with the privileges
|
|
of the ettercap process.</p>
|
|
<p>In order to trigger this vulnerability, user or service
|
|
that use ettercap should be tricked to pass the crafted list
|
|
of targets via the "-j" option.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-0722</cvename>
|
|
<url>http://www.exploit-db.com/exploits/23945/</url>
|
|
<url>https://secunia.com/advisories/51731/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-01-07</discovery>
|
|
<entry>2013-01-16</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="d5e0317e-5e45-11e2-a113-c48508086173">
|
|
<topic>java 7.x -- security manager bypass</topic>
|
|
<affects>
|
|
<package>
|
|
<name>openjdk7</name>
|
|
<range><gt>0</gt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-sun-jdk</name>
|
|
<range><ge>7.0</ge><lt>7.11</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-sun-jre</name>
|
|
<range><ge>7.0</ge><lt>7.11</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>US CERT reports:</p>
|
|
<blockquote cite="http://www.kb.cert.org/vuls/id/625617">
|
|
<p>Java 7 Update 10 and earlier versions of Java 7 contain a
|
|
vulnerability that can allow a remote, unauthenticated
|
|
attacker to execute arbitrary code on a vulnerable
|
|
system.</p>
|
|
<p>The Java JRE plug-in provides its own Security Manager.
|
|
Typically, a web applet runs with a security manager
|
|
provided by the browser or Java Web Start plugin. Oracle's
|
|
document states, "If there is a security manager already
|
|
installed, this method first calls the security manager's
|
|
checkPermission method with a
|
|
RuntimePermission("setSecurityManager") permission to ensure
|
|
it's safe to replace the existing security manager. This may
|
|
result in throwing a SecurityException".</p>
|
|
<p>By leveraging the vulnerability in the Java Management
|
|
Extensions (JMX) MBean components, unprivileged Java code
|
|
can access restricted classes. By using that vulnerability
|
|
in conjunction with a second vulnerability involving the
|
|
Reflection API and the invokeWithArguments method of the
|
|
MethodHandle class, an untrusted Java applet can escalate
|
|
its privileges by calling the the setSecurityManager()
|
|
function to allow full privileges, without requiring code
|
|
signing. Oracle Java 7 update 10 and earlier Java 7 versions
|
|
are affected. The invokeWithArguments method was introduced
|
|
with Java 7, so therefore Java 6 is not affected.</p>
|
|
<p>This vulnerability is being attacked in the wild, and is
|
|
reported to be incorporated into exploit kits. Exploit code
|
|
for this vulnerability is also publicly available.</p>
|
|
</blockquote>
|
|
<p>Esteban Guillardoy from Immunity Inc. additionally clarifies
|
|
on the recursive reflection exploitation technique:</p>
|
|
<blockquote cite="https://partners.immunityinc.com/idocs/Java%20MBeanInstantiator.findClass%200day%20Analysis.pdf">
|
|
<p>The real issue is in the native
|
|
sun.reflect.Reflection.getCallerClass method.</p>
|
|
<p>We can see the following information in the Reflection
|
|
source code:</p>
|
|
<p>Returns the class of the method realFramesToSkip frames
|
|
up the stack (zero-based), ignoring frames associated with
|
|
java.lang.reflect.Method.invoke() and its
|
|
implementation.</p>
|
|
<p>So what is happening here is that they forgot to skip the
|
|
frames related to the new Reflection API and only the old
|
|
reflection API is taken into account.</p>
|
|
</blockquote>
|
|
<p>This exploit does not only affect Java applets, but every
|
|
piece of software that relies on the Java Security Manager for
|
|
sandboxing executable code is affected: malicious code can
|
|
totally disable Security Manager.</p>
|
|
<p>For users who are running native Web browsers with enabled
|
|
Java plugin, the workaround is to remove the java/icedtea-web
|
|
port and restart all browser instances.</p>
|
|
<p>For users who are running Linux Web browser flavors, the
|
|
workaround is either to disable the Java plugin in browser
|
|
or to upgrade linux-sun-* packages to the non-vulnerable
|
|
version.</p>
|
|
<p>It is not recommended to run untrusted applets using
|
|
appletviewer, since this may lead to the execution of the
|
|
malicious code on vulnerable versions on JDK/JRE.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-0433</cvename>
|
|
<certvu>625617</certvu>
|
|
<url>http://www.oracle.com/technetwork/topics/security/alert-cve-2013-0422-1896849.html</url>
|
|
<url>https://partners.immunityinc.com/idocs/Java%20MBeanInstantiator.findClass%200day%20Analysis.pdf</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-01-10</discovery>
|
|
<entry>2013-01-14</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="97c22a94-5b8b-11e2-b131-000c299b62e1">
|
|
<topic>nagios -- buffer overflow in history.cgi</topic>
|
|
<affects>
|
|
<package>
|
|
<name>nagios</name>
|
|
<range><lt>3.4.3_1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>full disclosure reports:</p>
|
|
<blockquote cite="http://archives.neohapsis.com/archives/fulldisclosure/2012-12/0108.html">
|
|
<p>history.cgi is vulnerable to a buffer overflow due to the use of
|
|
sprintf with user supplied data that has not been restricted in size.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-6096</cvename>
|
|
<url>http://archives.neohapsis.com/archives/fulldisclosure/2012-12/0108.html</url>
|
|
<url>http://nagios.svn.sourceforge.net/viewvc/nagios?view=revision&revision=2547</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-12-21</discovery>
|
|
<entry>2013-01-10</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="46bd747b-5b84-11e2-b06d-00262d5ed8ee">
|
|
<topic>chromium -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>chromium</name>
|
|
<range><lt>24.0.1312.52</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Google Chrome Releases reports:</p>
|
|
<blockquote cite="http://googlechromereleases.blogspot.nl/search/label/Stable%20updates">
|
|
<p>[162494] High CVE-2012-5145: Use-after-free in SVG layout. Credit
|
|
to Atte Kettunen of OUSPG.</p>
|
|
<p>[165622] High CVE-2012-5146: Same origin policy bypass with
|
|
malformed URL. Credit to Erling A Ellingsen and Subodh Iyengar,
|
|
both of Facebook.</p>
|
|
<p>[165864] High CVE-2012-5147: Use-after-free in DOM handling.
|
|
Credit to José A. Vázquez.</p>
|
|
<p>[167122] Medium CVE-2012-5148: Missing filename sanitization in
|
|
hyphenation support. Credit to Google Chrome Security Team (Justin
|
|
Schuh).</p>
|
|
<p>[166795] High CVE-2012-5149: Integer overflow in audio IPC
|
|
handling. Credit to Google Chrome Security Team (Chris Evans).</p>
|
|
<p>[165601] High CVE-2012-5150: Use-after-free when seeking video.
|
|
Credit to Google Chrome Security Team (Inferno).</p>
|
|
<p>[165538] High CVE-2012-5151: Integer overflow in PDF JavaScript.
|
|
Credit to Mateusz Jurczyk, with contribution from Gynvael Coldwind,
|
|
both of Google Security Team.</p>
|
|
<p>[165430] Medium CVE-2012-5152: Out-of-bounds read when seeking
|
|
video. Credit to Google Chrome Security Team (Inferno).</p>
|
|
<p>[164565] High CVE-2012-5153: Out-of-bounds stack access in v8.
|
|
Credit to Andreas Rossberg of the Chromium development
|
|
community.</p>
|
|
<p>[Mac only] [163208] Medium CVE-2012-5155: Missing Mac sandbox for
|
|
worker processes. Credit to Google Chrome Security Team (Julien
|
|
Tinnes).</p>
|
|
<p>[162778] High CVE-2012-5156: Use-after-free in PDF fields. Credit
|
|
to Mateusz Jurczyk, with contribution from Gynvael Coldwind, both
|
|
of Google Security Team.</p>
|
|
<p>[162776] [162156] Medium CVE-2012-5157: Out-of-bounds reads in PDF
|
|
image handling. Credit to Mateusz Jurczyk, with contribution from
|
|
Gynvael Coldwind, both of Google Security Team.</p>
|
|
<p>[162153] High CVE-2013-0828: Bad cast in PDF root handling. Credit
|
|
to Mateusz Jurczyk, with contribution from Gynvael Coldwind, both
|
|
of Google Security Team.</p>
|
|
<p>[162114] High CVE-2013-0829: Corruption of database metadata
|
|
leading to incorrect file access. Credit to Google Chrome Security
|
|
Team (Jüri Aedla).</p>
|
|
<p>[161836] Low CVE-2013-0831: Possible path traversal from extension
|
|
process. Credit to Google Chrome Security Team (Tom Sepez).</p>
|
|
<p>[160380] Medium CVE-2013-0832: Use-after-free with printing.
|
|
Credit to Google Chrome Security Team (Cris Neckar).</p>
|
|
<p>[154485] Medium CVE-2013-0833: Out-of-bounds read with printing.
|
|
Credit to Google Chrome Security Team (Cris Neckar).</p>
|
|
<p>[154283] Medium CVE-2013-0834: Out-of-bounds read with glyph
|
|
handling. Credit to Google Chrome Security Team (Cris Neckar).</p>
|
|
<p>[152921] Low CVE-2013-0835: Browser crash with geolocation. Credit
|
|
to Arthur Gerkis.</p>
|
|
<p>[150545] High CVE-2013-0836: Crash in v8 garbage collection.
|
|
Credit to Google Chrome Security Team (Cris Neckar).</p>
|
|
<p>[145363] Medium CVE-2013-0837: Crash in extension tab handling.
|
|
Credit to Tom Nielsen.</p>
|
|
<p>[Linux only] [143859] Low CVE-2013-0838: Tighten permissions on
|
|
shared memory segments. Credit to Google Chrome Security Team
|
|
(Chris Palmer).</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-5145</cvename>
|
|
<cvename>CVE-2012-5146</cvename>
|
|
<cvename>CVE-2012-5147</cvename>
|
|
<cvename>CVE-2012-5148</cvename>
|
|
<cvename>CVE-2012-5149</cvename>
|
|
<cvename>CVE-2012-5150</cvename>
|
|
<cvename>CVE-2012-5151</cvename>
|
|
<cvename>CVE-2012-5152</cvename>
|
|
<cvename>CVE-2012-5153</cvename>
|
|
<cvename>CVE-2012-5155</cvename>
|
|
<cvename>CVE-2012-5156</cvename>
|
|
<cvename>CVE-2012-5157</cvename>
|
|
<cvename>CVE-2013-0828</cvename>
|
|
<cvename>CVE-2013-0829</cvename>
|
|
<cvename>CVE-2013-0831</cvename>
|
|
<cvename>CVE-2013-0832</cvename>
|
|
<cvename>CVE-2013-0833</cvename>
|
|
<cvename>CVE-2013-0834</cvename>
|
|
<cvename>CVE-2013-0835</cvename>
|
|
<cvename>CVE-2013-0836</cvename>
|
|
<cvename>CVE-2013-0837</cvename>
|
|
<cvename>CVE-2013-0838</cvename>
|
|
<url>http://googlechromereleases.blogspot.nl/search/label/Stable%20updates</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-01-10</discovery>
|
|
<entry>2013-01-11</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="a4ed6632-5aa9-11e2-8fcb-c8600054b392">
|
|
<topic>mozilla -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>firefox</name>
|
|
<range><gt>11.0,1</gt><lt>17.0.2,1</lt></range>
|
|
<range><lt>10.0.12,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-firefox</name>
|
|
<range><lt>17.0.2,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-seamonkey</name>
|
|
<range><lt>2.15</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-thunderbird</name>
|
|
<range><lt>17.0.2</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>seamonkey</name>
|
|
<range><lt>2.15</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>thunderbird</name>
|
|
<range><gt>11.0</gt><lt>17.0.2</lt></range>
|
|
<range><lt>10.0.12</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>libxul</name>
|
|
<range><gt>1.9.2.*</gt><lt>10.0.12</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>ca_root_nss</name>
|
|
<range><lt>3.14.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Mozilla Project reports:</p>
|
|
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
|
|
<p>MFSA 2013-01 Miscellaneous memory safety hazards (rv:18.0/
|
|
rv:10.0.12 / rv:17.0.2)</p>
|
|
<p>MFSA 2013-02 Use-after-free and buffer overflow issues found using
|
|
Address Sanitizer</p>
|
|
<p>MFSA 2013-03 Buffer Overflow in Canvas</p>
|
|
<p>MFSA 2013-04 URL spoofing in addressbar during page loads</p>
|
|
<p>MFSA 2013-05 Use-after-free when displaying table with many
|
|
columns and column groups</p>
|
|
<p>MFSA 2013-06 Touch events are shared across iframes</p>
|
|
<p>MFSA 2013-07 Crash due to handling of SSL on threads</p>
|
|
<p>MFSA 2013-08 AutoWrapperChanger fails to keep objects alive during
|
|
garbage collection</p>
|
|
<p>MFSA 2013-09 Compartment mismatch with quickstubs returned values</p>
|
|
<p>MFSA 2013-10 Event manipulation in plugin handler to bypass
|
|
same-origin policy</p>
|
|
<p>MFSA 2013-11 Address space layout leaked in XBL objects</p>
|
|
<p>MFSA 2013-12 Buffer overflow in Javascript string concatenation</p>
|
|
<p>MFSA 2013-13 Memory corruption in XBL with XML bindings containing
|
|
SVG</p>
|
|
<p>MFSA 2013-14 Chrome Object Wrapper (COW) bypass through changing
|
|
prototype</p>
|
|
<p>MFSA 2013-15 Privilege escalation through plugin objects</p>
|
|
<p>MFSA 2013-16 Use-after-free in serializeToStream</p>
|
|
<p>MFSA 2013-17 Use-after-free in ListenerManager</p>
|
|
<p>MFSA 2013-18 Use-after-free in Vibrate</p>
|
|
<p>MFSA 2013-19 Use-after-free in Javascript Proxy objects</p>
|
|
<p>MFSA 2013-20 Mis-issued TURKTRUST certificates</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-5829</cvename>
|
|
<cvename>CVE-2013-0743</cvename>
|
|
<cvename>CVE-2013-0744</cvename>
|
|
<cvename>CVE-2013-0745</cvename>
|
|
<cvename>CVE-2013-0746</cvename>
|
|
<cvename>CVE-2013-0747</cvename>
|
|
<cvename>CVE-2013-0748</cvename>
|
|
<cvename>CVE-2013-0749</cvename>
|
|
<cvename>CVE-2013-0750</cvename>
|
|
<cvename>CVE-2013-0751</cvename>
|
|
<cvename>CVE-2013-0752</cvename>
|
|
<cvename>CVE-2013-0753</cvename>
|
|
<cvename>CVE-2013-0754</cvename>
|
|
<cvename>CVE-2013-0755</cvename>
|
|
<cvename>CVE-2013-0756</cvename>
|
|
<cvename>CVE-2013-0757</cvename>
|
|
<cvename>CVE-2013-0758</cvename>
|
|
<cvename>CVE-2013-0759</cvename>
|
|
<cvename>CVE-2013-0760</cvename>
|
|
<cvename>CVE-2013-0761</cvename>
|
|
<cvename>CVE-2013-0762</cvename>
|
|
<cvename>CVE-2013-0763</cvename>
|
|
<cvename>CVE-2013-0764</cvename>
|
|
<cvename>CVE-2013-0766</cvename>
|
|
<cvename>CVE-2013-0767</cvename>
|
|
<cvename>CVE-2013-0768</cvename>
|
|
<cvename>CVE-2013-0769</cvename>
|
|
<cvename>CVE-2013-0770</cvename>
|
|
<cvename>CVE-2013-0771</cvename>
|
|
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-01.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-02.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-03.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-04.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-05.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-06.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-07.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-08.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-09.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-10.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-11.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-12.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-13.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-14.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-15.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-16.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-17.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-18.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-19.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2013/mfsa2013-20.html</url>
|
|
<url>http://www.mozilla.org/security/known-vulnerabilities/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-01-08</discovery>
|
|
<entry>2013-01-09</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="ca5d3272-59e3-11e2-853b-00262d5ed8ee">
|
|
<topic>rubygem-rails -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>rubygem-rails</name>
|
|
<range><lt>3.2.11</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>rubygem-actionpack</name>
|
|
<range><lt>3.2.11</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>rubygem-activerecord</name>
|
|
<range><lt>3.2.11</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>rubygem-activesupport</name>
|
|
<range><lt>3.2.11</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Ruby on Rails team reports:</p>
|
|
<blockquote cite="http://weblog.rubyonrails.org/2013/1/8/Rails-3-2-11-3-1-10-3-0-19-and-2-3-15-have-been-released/">
|
|
<p>Two high-risk vulnerabilities have been discovered:</p>
|
|
<p>(CVE-2013-0155) There is a vulnerability when Active Record is
|
|
used in conjunction with JSON parameter parsing.</p>
|
|
<p>Due to the way Active Record interprets parameters in combination
|
|
with the way that JSON parameters are parsed, it is possible for an
|
|
attacker to issue unexpected database queries with "IS NULL" or
|
|
empty "WHERE" clauses. This issue does not let an attacker insert
|
|
arbitrary values into an SQL query, however they can cause the
|
|
query to check for NULL or eliminate a WHERE clause when most users
|
|
would not expect it.</p>
|
|
<p>(CVE-2013-0156) There are multiple weaknesses in the parameter
|
|
parsing code for Ruby on Rails which allows attackers to bypass
|
|
authentication systems, inject arbitrary SQL, inject and execute
|
|
arbitrary code, or perform a DoS attack on a Rails application.</p>
|
|
<p>The parameter parsing code of Ruby on Rails allows applications to
|
|
automatically cast values from strings to certain data types.
|
|
Unfortunately the type casting code supported certain conversions
|
|
which were not suitable for performing on user-provided data
|
|
including creating Symbols and parsing YAML. These unsuitable
|
|
conversions can be used by an attacker to compromise a Rails
|
|
application.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2013-0155</cvename>
|
|
<cvename>CVE-2013-0156</cvename>
|
|
<url>http://weblog.rubyonrails.org/2013/1/8/Rails-3-2-11-3-1-10-3-0-19-and-2-3-15-have-been-released/</url>
|
|
<url>https://groups.google.com/forum/?fromgroups#!topic/rubyonrails-security/t1WFuuQyavI</url>
|
|
<url>https://groups.google.com/forum/?fromgroups#!topic/rubyonrails-security/61bkgvnSGTQ</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-01-08</discovery>
|
|
<entry>2013-01-08</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="b4051b52-58fa-11e2-853b-00262d5ed8ee">
|
|
<topic>rubygem-rails -- SQL injection vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>rubygem-rails</name>
|
|
<range><lt>3.2.10</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Ruby on Rails team reports:</p>
|
|
<blockquote cite="https://groups.google.com/forum/?fromgroups=#!topic/rubyonrails-security/DCNTNp_qjFM">
|
|
<p>There is a SQL injection vulnerability in Active Record in ALL
|
|
versions. Due to the way dynamic finders in Active Record extract
|
|
options from method parameters, a method parameter can mistakenly
|
|
be used as a scope. Carefully crafted requests can use the scope
|
|
to inject arbitrary SQL.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-5664</cvename>
|
|
<url>https://groups.google.com/forum/?fromgroups=#!topic/rubyonrails-security/DCNTNp_qjFM</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-01-02</discovery>
|
|
<entry>2013-01-07</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="3a65d33b-5950-11e2-b66b-00e0814cab4e">
|
|
<topic>jenkins -- HTTP access to the server to retrieve the master cryptographic key</topic>
|
|
<affects>
|
|
<package>
|
|
<name>jenkins</name>
|
|
<range><lt>1.498</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Jenkins Security Advisory reports:</p>
|
|
<blockquote cite="https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2013-01-04">
|
|
<p>This advisory announces a security vulnerability that was found
|
|
in Jenkins core.</p>
|
|
<p>An attacker can then use this master cryptographic key to mount
|
|
remote code execution attack against the Jenkins master, or
|
|
impersonate arbitrary users in making REST API calls.</p>
|
|
<p>There are several factors that mitigate some of these problems
|
|
that may apply to specific installations.</p>
|
|
<ul>
|
|
<li>The particular attack vector is only applicable on Jenkins
|
|
instances that have slaves attached to them, and allow
|
|
anonymous read access.</li>
|
|
<li>Jenkins allows users to re-generate the API tokens. Those
|
|
re-generated API tokens cannot be impersonated by the
|
|
attacker.</li>
|
|
</ul>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2013-01-04</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-01-04</discovery>
|
|
<entry>2013-01-08</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="1b769b72-582b-11e2-b66b-00e0814cab4e">
|
|
<topic>django -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>django</name>
|
|
<range><lt>1.4.3</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>django13</name>
|
|
<range><lt>1.3.5</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Django Project reports:</p>
|
|
<blockquote cite="https://www.djangoproject.com/weblog/2012/dec/10/security/">
|
|
<ol>
|
|
<li>
|
|
<p>Host header poisoning</p>
|
|
<p>Several earlier Django security releases focused on the issue of
|
|
poisoning the HTTP Host header, causing Django to generate URLs
|
|
pointing to arbitrary, potentially-malicious domains.</p>
|
|
<p>In response to further input received and reports of continuing
|
|
issues following the previous release, we're taking additional
|
|
steps to tighten Host header validation. Rather than attempt to
|
|
accommodate all features HTTP supports here, Django's Host header
|
|
validation attempts to support a smaller, but far more common, subset:</p>
|
|
<ul>
|
|
<li>Hostnames must consist of characters [A-Za-z0-9] plus hyphen
|
|
('-') or dot ('.').</li>
|
|
<li>IP addresses -- both IPv4 and IPv6 -- are permitted.</li>
|
|
<li>Port, if specified, is numeric.</li>
|
|
</ul>
|
|
<p>Any deviation from this will now be rejected, raising the exception
|
|
django.core.exceptions.SuspiciousOperation.</p>
|
|
</li>
|
|
<li>
|
|
<p>Redirect poisoning</p>
|
|
<p>Also following up on a previous issue: in July of this year, we made
|
|
changes to Django's HTTP redirect classes, performing additional
|
|
validation of the scheme of the URL to redirect to (since, both
|
|
within Django's own supplied applications and many third-party
|
|
applications, accepting a user-supplied redirect target is a common
|
|
pattern).</p>
|
|
<p>Since then, two independent audits of the code turned up further
|
|
potential problems. So, similar to the Host-header issue, we are
|
|
taking steps to provide tighter validation in response to reported
|
|
problems (primarily with third-party applications, but to a certain
|
|
extent also within Django itself). This comes in two parts:</p>
|
|
<ol>
|
|
<li>A new utility function, django.utils.http.is_safe_url, is
|
|
added; this function takes a URL and a hostname, and checks
|
|
that the URL is either relative, or if absolute matches the
|
|
supplied hostname. This function is intended for use whenever
|
|
user-supplied redirect targets are accepted, to ensure that
|
|
such redirects cannot lead to arbitrary third-party sites.</li>
|
|
<li>All of Django's own built-in views -- primarily in the
|
|
authentication system -- which allow user-supplied redirect
|
|
targets now use is_safe_url to validate the supplied URL.</li>
|
|
</ol>
|
|
</li>
|
|
</ol>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>https://www.djangoproject.com/weblog/2012/dec/10/security/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-12-10</discovery>
|
|
<entry>2013-01-06</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="1ae613c3-5728-11e2-9483-14dae938ec40">
|
|
<topic>freetype -- Multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>freetype2</name>
|
|
<range><lt>2.4.11</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The FreeType Project reports:</p>
|
|
<blockquote cite="http://sourceforge.net/projects/freetype/files/freetype2/2.4.11/README/view">
|
|
<p>Some vulnerabilities in the BDF implementation have been fixed.
|
|
Users of this font format should upgrade.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://sourceforge.net/projects/freetype/files/freetype2/2.4.11/README/view</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-12-20</discovery>
|
|
<entry>2013-01-05</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="a264b1b0-5726-11e2-9483-14dae938ec40">
|
|
<topic>moinmoin -- Multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>moinmoin</name>
|
|
<range><lt>1.9.6</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>MoinMoin developers report the following vulnerabilities
|
|
as fixed in version 1.9.6:</p>
|
|
<blockquote cite="http://hg.moinmo.in/moin/1.9/raw-file/1.9.6/docs/CHANGES">
|
|
<ul>
|
|
<li>remote code execution vulnerability in
|
|
twikidraw/anywikidraw action,</li>
|
|
<li>path traversal vulnerability in AttachFile action,</li>
|
|
<li>XSS issue, escape page name in rss link.</li>
|
|
</ul>
|
|
</blockquote>
|
|
<p>CVE entries at MITRE furher clarify:</p>
|
|
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=2012-6081">
|
|
<p>Multiple unrestricted file upload vulnerabilities in the
|
|
(1) twikidraw (action/twikidraw.py) and (2) anywikidraw
|
|
(action/anywikidraw.py) actions in MoinMoin before 1.9.6
|
|
allow remote authenticated users with write permissions to
|
|
execute arbitrary code by uploading a file with an
|
|
executable extension, then accessing it via a direct request
|
|
to the file in an unspecified directory, as exploited in the
|
|
wild in July 2012.</p>
|
|
</blockquote>
|
|
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=2012-6080">
|
|
<p>Directory traversal vulnerability in the
|
|
_do_attachment_move function in the AttachFile action
|
|
(action/AttachFile.py) in MoinMoin 1.9.3 through 1.9.5
|
|
allows remote attackers to overwrite arbitrary files via a
|
|
.. (dot dot) in a file name.</p>
|
|
</blockquote>
|
|
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=2012-6082">
|
|
<p>Cross-site scripting (XSS) vulnerability in the rsslink
|
|
function in theme/__init__.py in MoinMoin 1.9.5 allows
|
|
remote attackers to inject arbitrary web script or HTML
|
|
via the page name in a rss link.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-6081</cvename>
|
|
<cvename>CVE-2012-6080</cvename>
|
|
<cvename>CVE-2012-6082</cvename>
|
|
<url>http://hg.moinmo.in/moin/1.9/raw-file/1.9.6/docs/CHANGES</url>
|
|
<url>http://www.debian.org/security/2012/dsa-2593</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-12-29</discovery>
|
|
<entry>2013-01-05</entry>
|
|
<modified>2013-01-06</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="f7c87a8a-55d5-11e2-a255-c8600054b392">
|
|
<topic>asterisk -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>asterisk11</name>
|
|
<range><gt>11.*</gt><lt>11.1.2</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>asterisk10</name>
|
|
<range><gt>10.*</gt><lt>10.11.1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>asterisk18</name>
|
|
<range><gt>1.8.*</gt><lt>1.8.19.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Asterisk project reports:</p>
|
|
<blockquote cite="https://www.asterisk.org/security">
|
|
<p>Crashes due to large stack allocations when using TCP</p>
|
|
<p>Denial of Service Through Exploitation of Device State Caching</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-5976</cvename>
|
|
<cvename>CVE-2012-5977</cvename>
|
|
<url>http://downloads.digium.com/pub/security/AST-2012-014.html</url>
|
|
<url>http://downloads.digium.com/pub/security/AST-2012-015.html</url>
|
|
<url>https://www.asterisk.org/security</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2013-01-02</discovery>
|
|
<entry>2013-01-03</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="4108cc57-54d7-11e2-9483-14dae938ec40">
|
|
<topic>ircd-ratbox and charybdis -- remote DoS vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>ircd-ratbox</name>
|
|
<range><gt>2.*</gt><lt>3.0.8</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>charybdis</name>
|
|
<range><lt>3.4.2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>atheme.org reports:</p>
|
|
<blockquote cite="http://www.ratbox.org/ASA-2012-12-31.txt">
|
|
<p>All versions of Charybdis are vulnerable to a remotely-triggered
|
|
crash bug caused by code originating from ircd-ratbox 2.0.
|
|
(Incidentally, this means all versions since ircd-ratbox 2.0 are
|
|
also vulnerable.)</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://www.ratbox.org/ASA-2012-12-31.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-12-31</discovery>
|
|
<entry>2013-01-02</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="101f0aae-52d1-11e2-87fe-f4ce46b9ace8">
|
|
<topic>puppet -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>puppet</name>
|
|
<range><gt>2.6.*</gt><lt>2.6.17</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>puppet -- multiple vulnerabilities</p>
|
|
<blockquote cite="http://projects.puppetlabs.com/projects/puppet/wiki/Release_Notes#2.6.17">
|
|
<p>Arbitrary file read on the puppet master from authenticated clients (high). It is possible to construct an HTTP get request from an authenticated client with a valid certificate that will return the contents of an arbitrary file on the Puppet master that the master has read-access to.</p>
|
|
<p>Arbitrary file delete/D.O.S on Puppet Master from authenticated clients (high). Given a Puppet master with the "Delete" directive allowed in auth.conf for an authenticated host, an attacker on that host can send a specially crafted Delete request that can cause an arbitrary file deletion on the Puppet master, potentially causing a denial of service attack. Note that this vulnerability does *not* exist in Puppet as configured by default.</p>
|
|
<p>Insufficient input validation for agent hostnames (low). An attacker could trick the administrator into signing an attacker's certificate rather than the intended one by constructing specially crafted certificate requests containing specific ANSI control sequences. It is possible to use the sequences to rewrite the order of text displayed to an administrator such that display of an invalid certificate and valid certificate are transposed. If the administrator signs the attacker's certificate, the attacker can then man-in-the-middle the agent.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-3864</cvename>
|
|
<cvename>CVE-2012-3865</cvename>
|
|
<cvename>CVE-2012-3867</cvename>
|
|
<url>http://projects.puppetlabs.com/projects/puppet/wiki/Release_Notes#2.6.17</url>
|
|
<url>http://puppetlabs.com/security/cve/cve-2012-3864/</url>
|
|
<url>http://puppetlabs.com/security/cve/cve-2012-3865/</url>
|
|
<url>http://puppetlabs.com/security/cve/cve-2012-3867/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-07-10</discovery>
|
|
<entry>2012-12-30</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="13320091-52a6-11e2-a289-1c4bd681f0cf">
|
|
<topic>otrs -- XSS vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>otrs</name>
|
|
<range><lt>3.1.11</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>OTRS Security Advisory reports:</p>
|
|
<blockquote cite="http://www.otrs.com/open-source/community-news/security-advisories/security-advisory-2012-03/">
|
|
<p>This advisory covers vulnerabilities discovered in the OTRS core
|
|
system. This is a variance of the XSS vulnerability, where an attacker could
|
|
send a specially prepared HTML email to OTRS which would cause JavaScript code
|
|
to be executed in your browser while displaying the email. In this case this is
|
|
achieved by using javascript source attributes with whitespaces.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-4751</cvename>
|
|
<url>http://www.otrs.com/en/open-source/community-news/security-advisories/security-advisory-2012-03/</url>
|
|
<url>http://www.kb.cert.org/vuls/id/603276</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-10-16</discovery>
|
|
<entry>2012-12-30</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="95a69d1a-52a5-11e2-a289-1c4bd681f0cf">
|
|
<topic>otrs -- XSS vulnerability in Firefox and Opera</topic>
|
|
<affects>
|
|
<package>
|
|
<name>otrs</name>
|
|
<range><lt>3.1.10</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>OTRS Security Advisory reports:</p>
|
|
<blockquote cite="http://www.otrs.com/open-source/community-news/security-advisories/security-advisory-2012-02/">
|
|
<p>This advisory covers vulnerabilities discovered in the OTRS core
|
|
system. This is a variance of the XSS vulnerability, where an attacker could
|
|
send a specially prepared HTML email to OTRS which would cause JavaScript code
|
|
to be executed in your browser while displaying the email in Firefox and Opera.
|
|
In this case this is achieved with an invalid HTML structure with nested tags.
|
|
</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-4600</cvename>
|
|
<url>http://www.otrs.com/open-source/community-news/security-advisories/security-advisory-2012-02/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-08-30</discovery>
|
|
<entry>2012-12-30</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="49a6026a-52a3-11e2-a289-1c4bd681f0cf">
|
|
<topic>otrs -- XSS vulnerability in Internet Explorer</topic>
|
|
<affects>
|
|
<package>
|
|
<name>otrs</name>
|
|
<range><lt>3.1.9</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>OTRS Security Advisory reports:</p>
|
|
<blockquote cite="http://www.otrs.com/open-source/community-news/security-advisories/security-advisory-2012-01/">
|
|
<p>This advisory covers vulnerabilities discovered in the OTRS core
|
|
system. Due to the XSS vulnerability in Internet Explorer an attacker could send
|
|
a specially prepared HTML email to OTRS which would cause JavaScript code to be
|
|
executed in your Internet Explorer while displaying the email.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-2582</cvename>
|
|
<url>http://www.otrs.com/open-source/community-news/security-advisories/security-advisory-2012-01/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-08-22</discovery>
|
|
<entry>2012-12-30</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="c37de843-488e-11e2-a5c9-0019996bc1f7">
|
|
<topic>squid -- denial of service</topic>
|
|
<affects>
|
|
<package>
|
|
<name>squid</name>
|
|
<range><lt>2.7.9_4</lt></range>
|
|
<range><ge>3.1</ge><lt>3.1.23</lt></range>
|
|
<range><ge>3.2</ge><lt>3.2.6</lt></range>
|
|
<range><ge>3.3</ge><lt>3.3.0.3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Squid developers report:</p>
|
|
<blockquote cite="http://www.squid-cache.org/Advisories/SQUID-2012_1.txt">
|
|
<p>Due to missing input validation Squid cachemgr.cgi tool
|
|
is vulnerable to a denial of service attack when processing
|
|
specially crafted requests.</p>
|
|
<p>This problem allows any client able to reach the
|
|
cachemgr.cgi to perform a denial of service attack on the
|
|
service host.</p>
|
|
<p>The nature of the attack may cause secondary effects
|
|
through resource consumption on the host server.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-5643</cvename>
|
|
<cvename>CVE-2013-0189</cvename>
|
|
<url>http://www.squid-cache.org/Advisories/SQUID-2012_1.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-12-17</discovery>
|
|
<entry>2012-12-28</entry>
|
|
<modified>2013-05-02</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="85f33a8d-492f-11e2-aa75-003067c2616f">
|
|
<topic>opera -- execution of arbitrary code</topic>
|
|
<affects>
|
|
<package>
|
|
<name>opera</name>
|
|
<name>opera-devel</name>
|
|
<name>linux-opera</name>
|
|
<name>linux-opera-devel</name>
|
|
<range><lt>12.12</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Opera reports:</p>
|
|
<blockquote cite="http://www.opera.com/support/kb/view/1038/">
|
|
<p>When loading GIF images into memory, Opera should allocate the
|
|
correct amount of memory to store that image. Specially crafted
|
|
image files can cause Opera to allocate the wrong amount of memory.
|
|
Subsequent data may then overwrite unrelated memory with
|
|
attacker-controlled data. This can lead to a crash, which may also
|
|
execute that data as code.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://www.opera.com/support/kb/view/1038/</url>
|
|
<url>http://www.opera.com/support/kb/view/1039/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-12-18</discovery>
|
|
<entry>2012-12-18</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="1657a3e6-4585-11e2-a396-10bf48230856">
|
|
<topic>linux-flashplugin -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>linux-f10-flashplugin</name>
|
|
<range><lt>11.2r202.258</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Adobe reports:</p>
|
|
<blockquote cite="https://www.adobe.com/support/security/bulletins/apsb12-27.html">
|
|
<p>These updates address vulnerabilities that could cause a crash
|
|
and potentially allow an attacker to take control of the affected system.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-5676</cvename>
|
|
<cvename>CVE-2012-5677</cvename>
|
|
<cvename>CVE-2012-5678</cvename>
|
|
<url>https://www.adobe.com/support/security/bulletins/apsb12-27.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-12-11</discovery>
|
|
<entry>2012-12-14</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="51f84e28-444e-11e2-8306-00262d5ed8ee">
|
|
<topic>chromium -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>chromium</name>
|
|
<range><lt>23.0.1271.97</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Google Chrome Releases reports:</p>
|
|
<blockquote cite="http://googlechromereleases.blogspot.nl/search/label/Stable%20updates">
|
|
<p>[158204] High CVE-2012-5139: Use-after-free with visibility
|
|
events. Credit to Chamal de Silva.</p>
|
|
<p>[159429] High CVE-2012-5140: Use-after-free in URL loader. Credit
|
|
to Chamal de Silva.</p>
|
|
<p>[160456] Medium CVE-2012-5141: Limit Chromoting client plug-in
|
|
instantiation. Credit to Google Chrome Security Team (Jüri
|
|
Aedla).</p>
|
|
<p>[160803] Critical CVE-2012-5142: Crash in history navigation.
|
|
Credit to Michal Zalewski of Google Security Team.</p>
|
|
<p>[160926] Medium CVE-2012-5143: Integer overflow in PPAPI image
|
|
buffers. Credit to Google Chrome Security Team (Cris Neckar).</p>
|
|
<p>[161639] High CVE-2012-5144: Stack corruption in AAC decoding.
|
|
Credit to pawlkt.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-5139</cvename>
|
|
<cvename>CVE-2012-5140</cvename>
|
|
<cvename>CVE-2012-5141</cvename>
|
|
<cvename>CVE-2012-5142</cvename>
|
|
<cvename>CVE-2012-5143</cvename>
|
|
<cvename>CVE-2012-5144</cvename>
|
|
<url>http://googlechromereleases.blogspot.nl/search/label/Stable%20updates</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-12-11</discovery>
|
|
<entry>2012-12-12</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="953911fe-51ef-11e2-8e34-0022156e8794">
|
|
<topic>tomcat -- bypass of CSRF prevention filter</topic>
|
|
<affects>
|
|
<package>
|
|
<name>tomcat6</name>
|
|
<range><ge>6.0.0</ge><le>6.0.35</le></range>
|
|
</package>
|
|
<package>
|
|
<name>tomcat7</name>
|
|
<range><ge>7.0.0</ge><le>7.0.31</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Apache Software Foundation reports:</p>
|
|
<blockquote cite="http://tomcat.apache.org/security-7.html">
|
|
<p>The CSRF prevention filter could be bypassed if a request was made to a
|
|
protected resource without a session identifier present in the request.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-4431</cvename>
|
|
<url>http://tomcat.apache.org/security-6.html</url>
|
|
<url>http://tomcat.apache.org/security-7.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-12-04</discovery>
|
|
<entry>2012-12-04</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="134acaa2-51ef-11e2-8e34-0022156e8794">
|
|
<topic>tomcat -- denial of service</topic>
|
|
<affects>
|
|
<package>
|
|
<name>tomcat6</name>
|
|
<range><ge>6.0.0</ge><le>6.0.35</le></range>
|
|
</package>
|
|
<package>
|
|
<name>tomcat7</name>
|
|
<range><ge>7.0.0</ge><le>7.0.27</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Apache Software Foundation reports:</p>
|
|
<blockquote cite="http://tomcat.apache.org/security-7.html">
|
|
<p>When using the NIO connector with sendfile and HTTPS enabled, if a
|
|
client breaks the connection while reading the response an infinite loop
|
|
is entered leading to a denial of service.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-4534</cvename>
|
|
<url>http://tomcat.apache.org/security-6.html</url>
|
|
<url>http://tomcat.apache.org/security-7.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-12-04</discovery>
|
|
<entry>2012-12-04</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="f599dfc4-3ec2-11e2-8ae1-001a8056d0b5">
|
|
<topic>tomcat -- bypass of security constraints</topic>
|
|
<affects>
|
|
<package>
|
|
<name>tomcat6</name>
|
|
<range><ge>6.0.0</ge><le>6.0.35</le></range>
|
|
</package>
|
|
<package>
|
|
<name>tomcat7</name>
|
|
<range><ge>7.0.0</ge><le>7.0.29</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Apache Software Foundation reports:</p>
|
|
<blockquote cite="http://tomcat.apache.org/security-7.html">
|
|
<p>When using FORM authentication it was possible to bypass the security
|
|
constraint checks in the FORM authenticator by appending
|
|
"/j_security_check" to the end of the URL if some other component
|
|
(such as the Single-Sign-On valve) had called request.setUserPrincipal()
|
|
before the call to FormAuthenticator#authenticate().</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-3546</cvename>
|
|
<url>http://tomcat.apache.org/security-6.html</url>
|
|
<url>http://tomcat.apache.org/security-7.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-12-04</discovery>
|
|
<entry>2012-12-04</entry>
|
|
<modified>2012-12-29</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="2892a8e2-3d68-11e2-8e01-0800273fe665">
|
|
<topic>dns/bind9* -- servers using DNS64 can be crashed by a crafted query</topic>
|
|
<affects>
|
|
<package>
|
|
<name>bind99</name>
|
|
<range><lt>9.9.2.1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>bind99-base</name>
|
|
<range><lt>9.9.2.1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>bind98</name>
|
|
<range><lt>9.8.4.1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>bind98-base</name>
|
|
<range><lt>9.8.4.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>ISC reports:</p>
|
|
<blockquote cite="https://kb.isc.org/article/AA-00828">
|
|
<p>BIND 9 nameservers using the DNS64 IPv6 transition mechanism are
|
|
vulnerable to a software defect that allows a crafted query to
|
|
crash the server with a REQUIRE assertion failure. Remote
|
|
exploitation of this defect can be achieved without extensive
|
|
effort, resulting in a denial-of-service (DoS) vector against
|
|
affected servers.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-5688</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-11-27</discovery>
|
|
<entry>2012-12-04</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="f524d8e0-3d83-11e2-807a-080027ef73ec">
|
|
<topic>bogofilter -- heap corruption by invalid base64 input</topic>
|
|
<affects>
|
|
<package> <name>bogofilter</name> <range><lt>1.2.3</lt></range> </package>
|
|
<package> <name>bogofilter-sqlite</name> <range><lt>1.2.3</lt></range> </package>
|
|
<package> <name>bogofilter-tc</name> <range><lt>1.2.3</lt></range> </package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>David Relson reports:</p>
|
|
<blockquote cite="https://bogofilter.svn.sourceforge.net/svnroot/bogofilter/trunk/bogofilter/NEWS">
|
|
<p>Fix a heap corruption in base64 decoder on invalid input.
|
|
Analysis and patch by Julius Plenz, [FU Berlin, Germany].</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-5468</cvename>
|
|
<url>http://bogofilter.sourceforge.net/security/bogofilter-SA-2012-01</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-10-17</discovery>
|
|
<entry>2012-12-03</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="5af51ae9-3acd-11e2-a4eb-00262d5ed8ee">
|
|
<topic>chromium -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>chromium</name>
|
|
<range><lt>23.0.1271.95</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Google Chrome Releases reports:</p>
|
|
<blockquote cite="http://googlechromereleases.blogspot.nl/search/label/Stable%20updates">
|
|
<p>[161564] High CVE-2012-5138: Incorrect file path handling. Credit
|
|
to Google Chrome Security Team (Jüri Aedla).</p>
|
|
<p>[162835] High CVE-2012-5137: Use-after-free in media source
|
|
handling. Credit to Pinkie Pie.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-5137</cvename>
|
|
<cvename>CVE-2012-5138</cvename>
|
|
<url>http://googlechromereleases.blogspot.nl/search/label/Stable%20updates</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-11-29</discovery>
|
|
<entry>2012-11-30</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="aa4f86af-3172-11e2-ad21-20cf30e32f6d">
|
|
<topic>YUI JavaScript library -- JavaScript injection exploits in Flash components</topic>
|
|
<affects>
|
|
<package>
|
|
<name>yahoo-ui</name>
|
|
<range><le>2.8.2</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The YUI team reports:</p>
|
|
<blockquote cite="http://yuilibrary.com/support/20121030-vulnerability/">
|
|
<h1>Vulnerability in YUI 2.4.0 through YUI 2.9.0</h1>
|
|
<p>A XSS vulnerability has been discovered in some YUI 2 .swf files
|
|
from versions 2.4.0 through 2.9.0. This defect allows JavaScript
|
|
injection exploits to be created against domains that host affected
|
|
YUI .swf files.</p>
|
|
<p>If your site loads YUI 2 from a CDN (yui.yahooapis.com,
|
|
ajax.googleapis.com, etc.) and not from your own domain, you
|
|
are not affected. YUI 3 is not affected by this issue.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-5881</cvename>
|
|
<cvename>CVE-2012-5882</cvename>
|
|
<url>http://yuilibrary.com/support/20121030-vulnerability/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-10-30</discovery>
|
|
<entry>2012-11-27</entry>
|
|
<modified>2012-11-29</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="4d64fc61-3878-11e2-a4eb-00262d5ed8ee">
|
|
<topic>chromium -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>chromium</name>
|
|
<range><lt>23.0.1271.91</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Google Chrome Releases reports:</p>
|
|
<blockquote cite="http://googlechromereleases.blogspot.nl/search/label/Stable%20updates">
|
|
<p>[156567] High CVE-2012-5133: Use-after-free in SVG filters. Credit
|
|
to miaubiz.</p>
|
|
<p>[148638] Medium CVE-2012-5130: Out-of-bounds read in Skia. Credit
|
|
to Atte Kettunen of OUSPG.</p>
|
|
<p>[155711] Low CVE-2012-5132: Browser crash with chunked encoding.
|
|
Credit to Attila Szász.</p>
|
|
<p>[158249] High CVE-2012-5134: Buffer underflow in libxml. Credit to
|
|
Google Chrome Security Team (Jüri Aedla).</p>
|
|
<p>[159165] Medium CVE-2012-5135: Use-after-free with printing.
|
|
Credit to Fermin Serna of Google Security Team.</p>
|
|
<p>[159829] Medium CVE-2012-5136: Bad cast in input element handling.
|
|
Credit to Google Chrome Security Team (Inferno).</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-5130</cvename>
|
|
<cvename>CVE-2012-5132</cvename>
|
|
<cvename>CVE-2012-5133</cvename>
|
|
<cvename>CVE-2012-5134</cvename>
|
|
<cvename>CVE-2012-5135</cvename>
|
|
<cvename>CVE-2012-5136</cvename>
|
|
<url>http://googlechromereleases.blogspot.nl/search/label/Stable%20updates</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-11-26</discovery>
|
|
<entry>2012-11-27</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="5536c8e4-36b3-11e2-a633-902b343deec9">
|
|
<topic>FreeBSD -- Linux compatibility layer input validation error</topic>
|
|
<affects>
|
|
<package>
|
|
<name>FreeBSD</name>
|
|
<range><ge>7.4</ge><lt>7.4_11</lt></range>
|
|
<range><ge>8.3</ge><lt>8.3_5</lt></range>
|
|
<range><ge>9.0</ge><lt>9.0_5</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Problem description:</p>
|
|
<blockquote cite="http://www.freebsd.org/security/advisories/FreeBSD-SA-12:08.linux.asc">
|
|
<p>A programming error in the handling of some Linux system calls
|
|
may result in memory locations being accessed without proper
|
|
validation.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<freebsdsa>SA-12:08.linux</freebsdsa>
|
|
<cvename>CVE-2012-4576</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-11-22</discovery>
|
|
<entry>2012-11-24</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="f115f693-36b2-11e2-a633-902b343deec9">
|
|
<topic>FreeBSD -- Insufficient message length validation for EAP-TLS messages</topic>
|
|
<affects>
|
|
<package>
|
|
<name>FreeBSD</name>
|
|
<range><ge>8.3</ge><lt>8.3_5</lt></range>
|
|
<range><ge>9.0</ge><lt>9.0_5</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Problem description:</p>
|
|
<blockquote cite="http://www.freebsd.org/security/advisories/FreeBSD-SA-12:07.hostapd.asc">
|
|
<p>The internal authentication server of hostapd does not
|
|
sufficiently validate the message length field of EAP-TLS
|
|
messages.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<freebsdsa>SA-12:07.hostapd</freebsdsa>
|
|
<cvename>CVE-2012-4445</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-11-22</discovery>
|
|
<entry>2012-11-24</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="4b79538b-a450-11e2-9898-001060e06fd4">
|
|
<topic>FreeBSD -- Multiple Denial of Service vulnerabilities with named(8)</topic>
|
|
<affects>
|
|
<package>
|
|
<name>FreeBSD</name>
|
|
<range><ge>7.4</ge><lt>7.4_11</lt></range>
|
|
<range><ge>8.3</ge><lt>8.3_5</lt></range>
|
|
<range><ge>9.0</ge><lt>9.0_5</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Problem description:</p>
|
|
<blockquote cite="http://www.freebsd.org/security/advisories/FreeBSD-SA-12:06.bind.asc">
|
|
<p>The BIND daemon would crash when a query is made on a resource
|
|
record with RDATA that exceeds 65535 bytes.</p>
|
|
<p>The BIND daemon would lock up when a query is made on specific
|
|
combinations of RDATA.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<freebsdsa>SA-12:06.bind</freebsdsa>
|
|
<cvename>CVE-2012-4244</cvename>
|
|
<cvename>CVE-2012-5166</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-11-22</discovery>
|
|
<entry>2012-11-24</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="0925716f-34e2-11e2-aa75-003067c2616f">
|
|
<topic>opera -- execution of arbitrary code</topic>
|
|
<affects>
|
|
<package>
|
|
<name>opera</name>
|
|
<name>opera-devel</name>
|
|
<name>linux-opera</name>
|
|
<name>linux-opera-devel</name>
|
|
<range><lt>12.11</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Opera reports:</p>
|
|
<blockquote cite="http://www.opera.com/support/kb/view/1036/">
|
|
<p>When requesting pages using HTTP, Opera temporarily stores the
|
|
response in a buffer. In some cases, Opera may incorrectly allocate
|
|
too little space for a buffer, and may then store too much of the
|
|
response in that buffer. This causes a buffer overflow, which in
|
|
turn can lead to a memory corruption and crash. It is possible to
|
|
use this crash to execute the overflowing data as code, which may
|
|
be controlled by an attacking site.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://www.opera.com/support/kb/view/1036/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-11-19</discovery>
|
|
<entry>2012-11-22</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="1cd3ca42-33e6-11e2-a255-5404a67eef98">
|
|
<topic>lighttpd -- remote DoS in header parsing</topic>
|
|
<affects>
|
|
<package>
|
|
<name>lighttpd</name>
|
|
<range><gt>1.4.30</gt><lt>1.4.32</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Lighttpd security advisory reports:</p>
|
|
<blockquote cite="http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2012_01.txt">
|
|
<p>Certain Connection header values will trigger an endless loop, for example:
|
|
"Connection: TE,,Keep-Alive"</p>
|
|
<p>On receiving such value, lighttpd will enter an endless loop,
|
|
detecting an empty token but not incrementing the current string
|
|
position, and keep reading the ',' again and again.</p>
|
|
<p>This bug was introduced in 1.4.31, when we fixed an "invalid read"
|
|
bug (it would try to read the byte before the string if it started
|
|
with ',', although the value wasn't actually used).</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-5533</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-11-17</discovery>
|
|
<entry>2012-11-21</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="d23119df-335d-11e2-b64c-c8600054b392">
|
|
<topic>mozilla -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>firefox</name>
|
|
<range><gt>11.0,1</gt><lt>17.0,1</lt></range>
|
|
<range><lt>10.0.11,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-firefox</name>
|
|
<range><lt>10.0.11,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-seamonkey</name>
|
|
<range><lt>2.14</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-thunderbird</name>
|
|
<range><lt>10.0.11</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>seamonkey</name>
|
|
<range><lt>2.14</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>thunderbird</name>
|
|
<range><gt>11.0</gt><lt>17.0</lt></range>
|
|
<range><lt>10.0.11</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>libxul</name>
|
|
<range><gt>1.9.2.*</gt><lt>10.0.11</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Mozilla Project reports:</p>
|
|
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
|
|
<p>MFSA 2012-91 Miscellaneous memory safety hazards (rv:17.0/
|
|
rv:10.0.11)</p>
|
|
<p>MFSA 2012-92 Buffer overflow while rendering GIF images</p>
|
|
<p>MFSA 2012-93 evalInSanbox location context incorrectly applied</p>
|
|
<p>MFSA 2012-94 Crash when combining SVG text on path with CSS</p>
|
|
<p>MFSA 2012-95 Javascript: URLs run in privileged context on New Tab
|
|
page</p>
|
|
<p>MFSA 2012-96 Memory corruption in str_unescape</p>
|
|
<p>MFSA 2012-97 XMLHttpRequest inherits incorrect principal within
|
|
sandbox</p>
|
|
<p>MFSA 2012-98 Firefox installer DLL hijacking</p>
|
|
<p>MFSA 2012-99 XrayWrappers exposes chrome-only properties when not
|
|
in chrome compartment</p>
|
|
<p>MFSA 2012-100 Improper security filtering for cross-origin
|
|
wrappers</p>
|
|
<p>MFSA 2012-101 Improper character decoding in HZ-GB-2312 charset</p>
|
|
<p>MFSA 2012-102 Script entered into Developer Toolbar runs with
|
|
chrome privileges</p>
|
|
<p>MFSA 2012-103 Frames can shadow top.location</p>
|
|
<p>MFSA 2012-104 CSS and HTML injection through Style Inspector</p>
|
|
<p>MFSA 2012-105 Use-after-free and buffer overflow issues found</p>
|
|
<p>MFSA 2012-106 Use-after-free, buffer overflow, and memory
|
|
corruption issues found using Address Sanitizer</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-4201</cvename>
|
|
<cvename>CVE-2012-4202</cvename>
|
|
<cvename>CVE-2012-4203</cvename>
|
|
<cvename>CVE-2012-4204</cvename>
|
|
<cvename>CVE-2012-4205</cvename>
|
|
<cvename>CVE-2012-4206</cvename>
|
|
<cvename>CVE-2012-4207</cvename>
|
|
<cvename>CVE-2012-4208</cvename>
|
|
<cvename>CVE-2012-4209</cvename>
|
|
<cvename>CVE-2012-4210</cvename>
|
|
<cvename>CVE-2012-4212</cvename>
|
|
<cvename>CVE-2012-4213</cvename>
|
|
<cvename>CVE-2012-4214</cvename>
|
|
<cvename>CVE-2012-4215</cvename>
|
|
<cvename>CVE-2012-4216</cvename>
|
|
<cvename>CVE-2012-4217</cvename>
|
|
<cvename>CVE-2012-4218</cvename>
|
|
<cvename>CVE-2012-5829</cvename>
|
|
<cvename>CVE-2012-5830</cvename>
|
|
<cvename>CVE-2012-5833</cvename>
|
|
<cvename>CVE-2012-5835</cvename>
|
|
<cvename>CVE-2012-5836</cvename>
|
|
<cvename>CVE-2012-5837</cvename>
|
|
<cvename>CVE-2012-5838</cvename>
|
|
<cvename>CVE-2012-5839</cvename>
|
|
<cvename>CVE-2012-5840</cvename>
|
|
<cvename>CVE-2012-5841</cvename>
|
|
<cvename>CVE-2012-5842</cvename>
|
|
<cvename>CVE-2012-5843</cvename>
|
|
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-90.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-91.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-92.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-93.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-94.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-95.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-96.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-97.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-98.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-99.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-100.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-101.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-102.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-103.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-104.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-105.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-106.html</url>
|
|
<url>http://www.mozilla.org/security/known-vulnerabilities/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-11-20</discovery>
|
|
<entry>2012-11-20</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="81826d12-317a-11e2-9186-406186f3d89d">
|
|
<topic>weechat -- Arbitrary shell command execution via scripts</topic>
|
|
<affects>
|
|
<package>
|
|
<name>weechat</name>
|
|
<range><ge>0.3.0</ge><lt>0.3.9.2</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>weechat-devel</name>
|
|
<range><lt>20121118</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Sebastien Helleu reports:</p>
|
|
<blockquote cite="http://weechat.org/security/">
|
|
<p>Untrusted command for function hook_process could lead to
|
|
execution of commands, because of shell expansions.</p>
|
|
<p>Workaround with a non-patched version: remove/unload all scripts
|
|
calling function hook_process (for maximum safety).</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://weechat.org/security/</url>
|
|
<url>https://savannah.nongnu.org/bugs/?37764</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-11-15</discovery>
|
|
<entry>2012-11-18</entry>
|
|
<modified>2012-11-18</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="2b841f88-2e8d-11e2-ad21-20cf30e32f6d">
|
|
<topic>bugzilla -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>bugzilla</name>
|
|
<range><ge>3.6.0</ge><lt>3.6.12</lt></range>
|
|
<range><ge>4.0.0</ge><lt>4.0.9</lt></range>
|
|
<range><ge>4.2.0</ge><lt>4.2.4</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<h1>A Bugzilla Security Advisory reports:</h1>
|
|
<blockquote cite="http://www.bugzilla.org/security/3.6.11/">
|
|
<p>The following security issues have been discovered in
|
|
Bugzilla:</p>
|
|
<h1>Information Leak</h1>
|
|
<p>If the visibility of a custom field is controlled by a product
|
|
or a component of a product you cannot see, their names are
|
|
disclosed in the JavaScript code generated for this custom field
|
|
despite they should remain confidential.</p>
|
|
<p>Calling the User.get method with a 'groups' argument leaks the
|
|
existence of the groups depending on whether an error is thrown
|
|
or not. This method now also throws an error if the user calling
|
|
this method does not belong to these groups (independently of
|
|
whether the groups exist or not).</p>
|
|
<p>Trying to mark an attachment in a bug you cannot see as obsolete
|
|
discloses its description in the error message. The description
|
|
of the attachment is now removed from the error message.</p>
|
|
<h1>Cross-Site Scripting</h1>
|
|
<p>Due to incorrectly filtered field values in tabular reports,
|
|
it is possible to inject code leading to XSS.</p>
|
|
<p>A vulnerability in swfstore.swf from YUI2 allows JavaScript
|
|
injection exploits to be created against domains that host this
|
|
affected YUI .swf file.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-4199</cvename>
|
|
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=731178</url>
|
|
<cvename>CVE-2012-4198</cvename>
|
|
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=781850</url>
|
|
<cvename>CVE-2012-4197</cvename>
|
|
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=802204</url>
|
|
<cvename>CVE-2012-4189</cvename>
|
|
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=790296</url>
|
|
<cvename>CVE-2012-5881</cvename>
|
|
<cvename>CVE-2012-5882</cvename>
|
|
<cvename>CVE-2012-5883</cvename>
|
|
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=808845</url>
|
|
<url>http://yuilibrary.com/support/20121030-vulnerability/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-11-13</discovery>
|
|
<entry>2012-11-14</entry>
|
|
<modified>2012-11-27</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="79818ef9-2d10-11e2-9160-00262d5ed8ee">
|
|
<topic>typo3 -- Multiple vulnerabilities in TYPO3 Core</topic>
|
|
<affects>
|
|
<package>
|
|
<name>typo3</name>
|
|
<range><ge>4.5.0</ge><lt>4.5.21</lt></range>
|
|
<range><ge>4.6.0</ge><lt>4.6.14</lt></range>
|
|
<range><ge>4.7.0</ge><lt>4.7.6</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Typo Security Team reports:</p>
|
|
<blockquote cite="http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2012-005/">
|
|
<p>TYPO3 Backend History Module - Due to missing encoding of user
|
|
input, the history module is susceptible to SQL Injection and
|
|
Cross-Site Scripting. A valid backend login is required to exploit
|
|
this vulnerability. Credits go to Thomas Worm who discovered and
|
|
reported the issue.</p>
|
|
<p>TYPO3 Backend API - Failing to properly HTML-encode user input the
|
|
tree render API (TCA-Tree) is susceptible to Cross-Site Scripting.
|
|
TYPO3 Versions below 6.0 does not make us of this API, thus is not
|
|
exploitable, if no third party extension is installed which uses
|
|
this API. A valid backend login is required to exploit this
|
|
vulnerability. Credits go to Richard Brain who discovered and
|
|
reported the issue.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2012-005/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-11-08</discovery>
|
|
<entry>2012-11-12</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="a537b449-2b19-11e2-b339-90e6ba652cce">
|
|
<topic>DomainKeys Identified Mail (DKIM) Verifiers may inappropriately convey message trust</topic>
|
|
<affects>
|
|
<package>
|
|
<name>opendkim</name>
|
|
<range><lt>2.7.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>US-CERT reports:</p>
|
|
<blockquote cite="http://www.kb.cert.org/vuls/id/268267">
|
|
<p>DomainKeys Identified Mail (DKIM) Verifiers may
|
|
inappropriately convey message trust when messages are
|
|
signed using test or small bit signing keys.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<certvu>268267</certvu>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-10-24</discovery>
|
|
<entry>2012-11-12</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="e02c572f-2af0-11e2-bb44-003067b2972c">
|
|
<topic>weechat -- Crash or freeze when decoding IRC colors in strings</topic>
|
|
<affects>
|
|
<package>
|
|
<name>weechat</name>
|
|
<range><ge>0.3.6</ge><lt>0.3.9.1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>weechat-devel</name>
|
|
<range><ge>20110614</ge><lt>20121110</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Sebastien Helleu reports:</p>
|
|
<blockquote cite="https://savannah.nongnu.org/bugs/?37704">
|
|
<p>A buffer overflow is causing a crash or freeze of WeeChat when
|
|
decoding IRC colors in strings.</p>
|
|
<p>Workaround for a non-patched version:
|
|
/set irc.network.colors_receive off</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-5854</cvename>
|
|
<freebsdpr>ports/173513</freebsdpr>
|
|
<url>http://weechat.org/security/</url>
|
|
<url>https://savannah.nongnu.org/bugs/?37704</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-11-09</discovery>
|
|
<entry>2012-11-10</entry>
|
|
<modified>2012-11-13</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="5e647ca3-2aea-11e2-b745-001fd0af1a4c">
|
|
<topic>ruby -- Hash-flooding DoS vulnerability for ruby 1.9</topic>
|
|
<affects>
|
|
<package>
|
|
<name>ruby</name>
|
|
<range><ge>1.9</ge><lt>1.9.3.327</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The official ruby site reports:</p>
|
|
<blockquote cite="http://www.ruby-lang.org/en/news/2012/11/09/ruby19-hashdos-cve-2012-5371/">
|
|
<p>Carefully crafted sequence of strings can cause a denial of service
|
|
attack on the service that parses the sequence to create a Hash
|
|
object by using the strings as keys. For instance, this
|
|
vulnerability affects web application that parses the JSON data
|
|
sent from untrusted entity.</p>
|
|
<p>This vulnerability is similar to CVS-2011-4815 for ruby 1.8.7. ruby
|
|
1.9 versions were using modified MurmurHash function but it's
|
|
reported that there is a way to create sequence of strings that
|
|
collide their hash values each other. This fix changes the Hash
|
|
function of String object from the MurmurHash to SipHash 2-4.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-5371</cvename>
|
|
<url>http://www.ruby-lang.org/en/news/2012/11/09/ruby19-hashdos-cve-2012-5371/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-11-10</discovery>
|
|
<entry>2012-11-10</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="152e4c7e-2a2e-11e2-99c7-00a0d181e71d">
|
|
<topic>tomcat -- authentication weaknesses</topic>
|
|
<affects>
|
|
<package>
|
|
<name>tomcat</name>
|
|
<range><gt>5.5.0</gt><lt>5.5.36</lt></range>
|
|
<range><gt>6.0.0</gt><lt>6.0.36</lt></range>
|
|
<range><gt>7.0.0</gt><lt>7.0.30</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Apache Software Foundation reports:</p>
|
|
<blockquote cite="http://tomcat.apache.org/security.html">
|
|
<p>Three weaknesses in Tomcat's implementation of DIGEST
|
|
authentication were identified and resolved:</p>
|
|
<ul>
|
|
<li> Tomcat tracked client rather than server nonces and nonce count.</li>
|
|
<li> When a session ID was present, authentication was bypassed.</li>
|
|
<li> The user name and password were not checked before when indicating
|
|
that a nonce was stale.</li>
|
|
</ul>
|
|
<p>These issues reduced the security of DIGEST authentication making
|
|
replay attacks possible in some circumstances.</p>
|
|
<p>The first issue was identified by Tilmann Kuhn. The second and third
|
|
issues were identified by the Tomcat security team during the code
|
|
review resulting from the first issue.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-3439</cvename>
|
|
<url>http://tomcat.apache.org/security.html</url>
|
|
<url>http://tomcat.apache.org/security-5.html</url>
|
|
<url>http://tomcat.apache.org/security-6.html</url>
|
|
<url>http://tomcat.apache.org/security-7.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-11-05</discovery>
|
|
<entry>2012-11-08</entry>
|
|
<modified>2012-11-09</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="4ca26574-2a2c-11e2-99c7-00a0d181e71d">
|
|
<topic>tomcat -- Denial of Service</topic>
|
|
<affects>
|
|
<package>
|
|
<name>tomcat</name>
|
|
<range><gt>6.0.0</gt><lt>6.0.36</lt></range>
|
|
<range><gt>7.0.0</gt><lt>7.0.28</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Apache Software Foundation reports:</p>
|
|
<blockquote cite="http://tomcat.apache.org/security.html">
|
|
<p>The checks that limited the permitted size of request headers were
|
|
implemented too late in the request parsing process for the HTTP NIO
|
|
connector. This enabled a malicious user to trigger an
|
|
OutOfMemoryError by sending a single request with very large
|
|
headers. This issue was identified by Josh Spiewak.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-2733</cvename>
|
|
<url>http://tomcat.apache.org/security.html</url>
|
|
<url>http://tomcat.apache.org/security-6.html</url>
|
|
<url>http://tomcat.apache.org/security-7.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-11-05</discovery>
|
|
<entry>2012-11-08</entry>
|
|
<modified>2012-11-09</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="4b8b748e-2a24-11e2-bb44-003067b2972c">
|
|
<topic>linux-flashplugin -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>linux-f10-flashplugin</name>
|
|
<range><le>11.2r202.243</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Adobe reports:</p>
|
|
<blockquote cite="https://www.adobe.com/support/security/bulletins/apsb12-22.html">
|
|
<p>These vulnerabilities could cause a crash and potentially allow an attacker to take control of the affected system.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-5274</cvename>
|
|
<cvename>CVE-2012-5275</cvename>
|
|
<cvename>CVE-2012-5276</cvename>
|
|
<cvename>CVE-2012-5277</cvename>
|
|
<cvename>CVE-2012-5278</cvename>
|
|
<cvename>CVE-2012-5279</cvename>
|
|
<cvename>CVE-2012-5280</cvename>
|
|
<url>https://www.adobe.com/support/security/bulletins/apsb12-24.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-10-08</discovery>
|
|
<entry>2012-11-02</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="209c068d-28be-11e2-9160-00262d5ed8ee">
|
|
<topic>chromium -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>chromium</name>
|
|
<range><lt>23.0.1271.64</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Google Chrome Releases reports:</p>
|
|
<blockquote cite="http://googlechromereleases.blogspot.nl/search/label/Stable%20updates">
|
|
<p>[157079] Medium CVE-2012-5127: Integer overflow leading to
|
|
out-of-bounds read in WebP handling. Credit to Phil Turnbull.</p>
|
|
<p>[Linux 64-bit only] [150729] Medium CVE-2012-5120: Out-of-bounds
|
|
array access in v8. Credit to Atte Kettunen of OUSPG.</p>
|
|
<p>[143761] High CVE-2012-5116: Use-after-free in SVG filter
|
|
handling. Credit to miaubiz.</p>
|
|
<p>[Mac OS only] [149717] High CVE-2012-5118: Integer bounds check
|
|
issue in GPU command buffers. Credit to miaubiz.</p>
|
|
<p>[154055] High CVE-2012-5121: Use-after-free in video layout.
|
|
Credit to Atte Kettunen of OUSPG.</p>
|
|
<p>[145915] Low CVE-2012-5117: Inappropriate load of SVG subresource
|
|
in img context. Credit to Felix Gröbert of the Google Security
|
|
Team.</p>
|
|
<p>[149759] Medium CVE-2012-5119: Race condition in Pepper buffer
|
|
handling. Credit to Fermin Serna of the Google Security Team.</p>
|
|
<p>[154465] Medium CVE-2012-5122: Bad cast in input handling. Credit
|
|
to Google Chrome Security Team (Inferno).</p>
|
|
<p>[154590] [156826] Medium CVE-2012-5123: Out-of-bounds reads in
|
|
Skia. Credit to Google Chrome Security Team (Inferno).</p>
|
|
<p>[155323] High CVE-2012-5124: Memory corruption in texture handling.
|
|
Credit to Al Patrick of the Chromium development community.</p>
|
|
<p>[156051] Medium CVE-2012-5125: Use-after-free in extension tab
|
|
handling. Credit to Alexander Potapenko of the Chromium development
|
|
community.</p>
|
|
<p>[156366] Medium CVE-2012-5126: Use-after-free in plug-in
|
|
placeholder handling. Credit to Google Chrome Security Team
|
|
(Inferno).</p>
|
|
<p>[157124] High CVE-2012-5128: Bad write in v8. Credit to Google
|
|
Chrome Security Team (Cris Neckar).</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-5127</cvename>
|
|
<cvename>CVE-2012-5120</cvename>
|
|
<cvename>CVE-2012-5116</cvename>
|
|
<cvename>CVE-2012-5118</cvename>
|
|
<cvename>CVE-2012-5121</cvename>
|
|
<cvename>CVE-2012-5117</cvename>
|
|
<cvename>CVE-2012-5119</cvename>
|
|
<cvename>CVE-2012-5122</cvename>
|
|
<cvename>CVE-2012-5123</cvename>
|
|
<cvename>CVE-2012-5124</cvename>
|
|
<cvename>CVE-2012-5125</cvename>
|
|
<cvename>CVE-2012-5126</cvename>
|
|
<cvename>CVE-2012-5128</cvename>
|
|
<url>http://googlechromereleases.blogspot.nl/search/label/Stable%20updates</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-11-06</discovery>
|
|
<entry>2012-11-07</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="38daea4f-2851-11e2-9483-14dae938ec40">
|
|
<topic>opera -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>opera</name>
|
|
<name>opera-devel</name>
|
|
<name>linux-opera</name>
|
|
<name>linux-opera-devel</name>
|
|
<range><lt>12.10</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Opera reports:</p>
|
|
<blockquote cite="http://www.opera.com/support/kb/view/1030/">
|
|
<p>CORS (Cross-Origin Resource Sharing) allows web pages to retrieve
|
|
the contents of pages from other sites, with their permission,
|
|
as they would appear for the current user.
|
|
When requests are made in this way, the browser should only allow
|
|
the page content to be retrieved if the target site sends the
|
|
correct headers that give permission for their contents to be
|
|
used in this way. Specially crafted requests may trick Opera
|
|
into thinking that the target site has given permission when it
|
|
had not done so. This can result in the contents of any target page
|
|
being revealed to untrusted sites, including any
|
|
sensitive information or session IDs contained within the
|
|
source of those pages.</p>
|
|
</blockquote>
|
|
<p>Also reported are vulnerabilities involving SVG graphics and XSS.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://www.opera.com/support/kb/view/1030/</url>
|
|
<url>http://www.opera.com/support/kb/view/1031/</url>
|
|
<url>http://www.opera.com/support/kb/view/1033/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-11-06</discovery>
|
|
<entry>2012-11-06</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="36533a59-2770-11e2-bb44-003067b2972c">
|
|
<topic>linux-flashplugin -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>linux-f10-flashplugin</name>
|
|
<range><le>11.2r202.238</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Adobe reports:</p>
|
|
<blockquote cite="https://www.adobe.com/support/security/bulletins/apsb12-22.html">
|
|
<p>These vulnerabilities could cause a crash and potentially allow an attacker to take control of the affected system.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-5248</cvename>
|
|
<cvename>CVE-2012-5249</cvename>
|
|
<cvename>CVE-2012-5250</cvename>
|
|
<cvename>CVE-2012-5251</cvename>
|
|
<cvename>CVE-2012-5252</cvename>
|
|
<cvename>CVE-2012-5253</cvename>
|
|
<cvename>CVE-2012-5254</cvename>
|
|
<cvename>CVE-2012-5255</cvename>
|
|
<cvename>CVE-2012-5256</cvename>
|
|
<cvename>CVE-2012-5257</cvename>
|
|
<cvename>CVE-2012-5258</cvename>
|
|
<cvename>CVE-2012-5259</cvename>
|
|
<cvename>CVE-2012-5260</cvename>
|
|
<cvename>CVE-2012-5261</cvename>
|
|
<cvename>CVE-2012-5262</cvename>
|
|
<cvename>CVE-2012-5263</cvename>
|
|
<cvename>CVE-2012-5264</cvename>
|
|
<cvename>CVE-2012-5265</cvename>
|
|
<cvename>CVE-2012-5266</cvename>
|
|
<cvename>CVE-2012-5267</cvename>
|
|
<cvename>CVE-2012-5269</cvename>
|
|
<cvename>CVE-2012-5270</cvename>
|
|
<cvename>CVE-2012-5271</cvename>
|
|
<cvename>CVE-2012-5272</cvename>
|
|
<cvename>CVE-2012-5285</cvename>
|
|
<cvename>CVE-2012-5286</cvename>
|
|
<cvename>CVE-2012-5287</cvename>
|
|
<cvename>CVE-2012-5673</cvename>
|
|
<cvename>CVE-2012-2034</cvename>
|
|
<cvename>CVE-2012-2035</cvename>
|
|
<cvename>CVE-2012-2036</cvename>
|
|
<cvename>CVE-2012-2037</cvename>
|
|
<cvename>CVE-2012-2038</cvename>
|
|
<cvename>CVE-2012-2039</cvename>
|
|
<cvename>CVE-2012-2040</cvename>
|
|
<url>https://www.adobe.com/support/security/bulletins/apsb12-22.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-10-08</discovery>
|
|
<entry>2012-11-02</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="65539c54-2517-11e2-b9d6-20cf30e32f6d">
|
|
<topic>apache22 -- several vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>apache22</name>
|
|
<range><gt>2.2.0</gt><lt>2.2.23</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>apache22-event-mpm</name>
|
|
<range><gt>2.2.0</gt><lt>2.2.23</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>apache22-itk-mpm</name>
|
|
<range><gt>2.2.0</gt><lt>2.2.23</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>apache22-peruser-mpm</name>
|
|
<range><gt>2.2.0</gt><lt>2.2.23</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>apache22-worker-mpm</name>
|
|
<range><gt>2.2.0</gt><lt>2.2.23</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<h1>Apache HTTP SERVER PROJECT reports:</h1>
|
|
<blockquote cite="http://httpd.apache.org/security/vulnerabilities_22.html">
|
|
<h1>low: XSS in mod_negotiation when untrusted uploads are supported CVE-2012-2687</h1>
|
|
<p>Possible XSS for sites which use mod_negotiation and
|
|
allow untrusted uploads to locations which have MultiViews enabled.</p>
|
|
<h1>low: insecure LD_LIBRARY_PATH handling CVE-2012-0883</h1>
|
|
<p>This issue was already fixed in port version 2.2.22_5</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-2687</cvename>
|
|
<cvename>CVE-2012-0833</cvename><!-- already fixed in r301849 -->
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-09-13</discovery>
|
|
<entry>2012-11-02</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="ec89dc70-2515-11e2-8eda-000a5e1e33c6">
|
|
<topic>webmin -- potential XSS attack via real name field</topic>
|
|
<affects>
|
|
<package>
|
|
<name>webmin</name>
|
|
<range><lt>1.600_1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The webmin updates site reports</p>
|
|
<blockquote cite="http://www.webmin.com/updates.html">
|
|
<p>Module: Change Passwords; Version: 1.600; Problem: Fix for potential XSS attack
|
|
via real name field; Solution: New module.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://www.webmin.com/updates.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-11-02</discovery>
|
|
<entry>2012-11-02</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="3decc87d-2498-11e2-b0c7-000d601460a4">
|
|
<topic>ruby -- Unintentional file creation caused by inserting an illegal NUL character</topic>
|
|
<affects>
|
|
<package>
|
|
<name>ruby</name>
|
|
<range><gt>1.9.3,1</gt><lt>1.9.3.286,1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The official ruby site reports:</p>
|
|
<blockquote cite="http://www.ruby-lang.org/en/news/2012/10/12/poisoned-NUL-byte-vulnerability/">
|
|
<p>A vulnerability was found that file creation routines can create
|
|
unintended files by strategically inserting NUL(s) in file paths.
|
|
This vulnerability has been reported as CVE-2012-4522.</p>
|
|
<p>Ruby can handle arbitrary binary patterns as Strings, including
|
|
NUL chars. On the other hand OSes and other libraries tend not.
|
|
They usually treat a NUL as an End of String mark. So to interface
|
|
them with Ruby, NUL chars should properly be avoided.</p>
|
|
<p>However methods like IO#open did not check the filename passed to
|
|
them, and just passed those strings to lower layer routines. This
|
|
led to create unintentional files.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-4522</cvename>
|
|
<url>http://www.ruby-lang.org/en/news/2012/10/12/poisoned-NUL-byte-vulnerability/</url>
|
|
<url>https://access.redhat.com/security/cve/CVE-2012-4522/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-10-12</discovery>
|
|
<entry>2012-11-01</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="2a093853-2495-11e2-b0c7-000d601460a4">
|
|
<topic>ruby -- $SAFE escaping vulnerability about Exception#to_s/NameError#to_s</topic>
|
|
<affects>
|
|
<package>
|
|
<name>ruby</name>
|
|
<range><gt>1.8.7,1</gt><lt>1.8.7.371,1</lt></range>
|
|
<range><gt>1.9.3,1</gt><lt>1.9.3.286,1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The official ruby site reports:</p>
|
|
<blockquote cite="http://www.ruby-lang.org/en/news/2012/10/12/cve-2012-4464-cve-2012-4466/">
|
|
<p>Vulnerabilities found for Exception#to_s, NameError#to_s, and
|
|
name_err_mesg_to_s() which is Ruby interpreter-internal API. A
|
|
malicious user code can bypass $SAFE check by utilizing one of
|
|
those security holes.</p>
|
|
<p>Ruby's $SAFE mechanism enables untrusted user codes to run in
|
|
$SAFE >= 4 mode. This is a kind of sandboxing so some operations
|
|
are restricted in that mode to protect other data outside the
|
|
sandbox.</p>
|
|
<p>The problem found was around this mechanism. Exception#to_s,
|
|
NameError#to_s, and name_err_mesg_to_s() interpreter-internal API
|
|
was not correctly handling the $SAFE bits so a String object which
|
|
is not tainted can destructively be marked as tainted using them.
|
|
By using this an untrusted code in a sandbox can modify a
|
|
formerly-untainted string destructively.</p>
|
|
<p>Ruby 1.8 once had a similar security issue. It fixed
|
|
Exception#to_s and NameError#to_s, but name_err_mesg_to_str() issue
|
|
survived previous security fix</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-4464</cvename>
|
|
<cvename>CVE-2012-4466</cvename>
|
|
<url>http://www.ruby-lang.org/en/news/2012/10/12/cve-2012-4464-cve-2012-4466/</url>
|
|
<url>https://access.redhat.com/security/cve/CVE-2012-4464/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-08-21</discovery>
|
|
<entry>2012-11-01</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="4b738d54-2427-11e2-9817-c8600054b392">
|
|
<topic>RT -- Multiple Vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>rt40</name>
|
|
<range><ge>4.0</ge><lt>4.0.8</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>rt38</name>
|
|
<range><lt>3.8.15</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>BestPractical report:</p>
|
|
<blockquote cite="http://blog.bestpractical.com/2012/10/security-vulnerabilities-in-rt.html">
|
|
<p>All versions of RT are vulnerable to an email header injection
|
|
attack. Users with ModifySelf or AdminUser can cause RT to add
|
|
arbitrary headers or content to outgoing mail. Depending on the
|
|
scrips that are configured, this may be be leveraged for information
|
|
leakage or phishing.</p>
|
|
<p>RT 4.0.0 and above and RTFM 2.0.0 and above contain a vulnerability
|
|
due to lack of proper rights checking, allowing any privileged user
|
|
to create Articles in any class.</p>
|
|
<p>All versions of RT with cross-site-request forgery (CSRF)
|
|
protection (RT 3.8.12 and above, RT 4.0.6 and above, and any
|
|
instances running the security patches released 2012-05-22) contain
|
|
a vulnerability which incorrectly allows though CSRF requests which
|
|
toggle ticket bookmarks.</p>
|
|
<p>All versions of RT are vulnerable to a confused deputy attack on
|
|
the user. While not strictly a CSRF attack, users who are not logged
|
|
in who are tricked into following a malicious link may, after
|
|
supplying their credentials, be subject to an attack which leverages
|
|
their credentials to modify arbitrary state. While users who were
|
|
logged in would have observed the CSRF protection page, users who
|
|
were not logged in receive no such warning due to the intervening
|
|
login process. RT has been extended to notify users of pending
|
|
actions during the login process.</p>
|
|
<p>RT 3.8.0 and above are susceptible to a number of vulnerabilities
|
|
concerning improper signing or encryption of messages using GnuPG;
|
|
if GnuPG is not enabled, none of the following affect you.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-4730</cvename>
|
|
<cvename>CVE-2012-4731</cvename>
|
|
<cvename>CVE-2012-4732</cvename>
|
|
<cvename>CVE-2012-4734</cvename>
|
|
<cvename>CVE-2012-4735</cvename>
|
|
<cvename>CVE-2012-4884</cvename>
|
|
<url>http://blog.bestpractical.com/2012/10/security-vulnerabilities-in-rt.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-10-26</discovery>
|
|
<entry>2012-11-01</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="2adc3e78-22d1-11e2-b9f0-d0df9acfd7e5">
|
|
<topic>drupal7 -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>drupal7</name>
|
|
<range><lt>7.16</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Drupal Security Team reports:</p>
|
|
<blockquote cite="http://drupal.org/node/1815912">
|
|
<ol>
|
|
<li>
|
|
<p>Arbitrary PHP code execution</p>
|
|
<p>A bug in the installer code was identified that allows an attacker
|
|
to re-install Drupal using an external database server under certain
|
|
transient conditions. This could allow the attacker to execute
|
|
arbitrary PHP code on the original server.</p>
|
|
</li>
|
|
<li>
|
|
<p>Information disclosure - OpenID module</p>
|
|
<p>For sites using the core OpenID module, an information disclosure
|
|
vulnerability was identified that allows an attacker to read files
|
|
on the local filesystem by attempting to log in to the site using a
|
|
malicious OpenID server.</p>
|
|
</li>
|
|
</ol>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://drupal.org/node/1815912</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-10-17</discovery>
|
|
<entry>2012-10-31</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="6b3b1b97-207c-11e2-a03f-c8600054b392">
|
|
<topic>mozilla -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>firefox</name>
|
|
<range><gt>11.0,1</gt><lt>16.0.2,1</lt></range>
|
|
<range><lt>10.0.10,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-firefox</name>
|
|
<range><lt>10.0.10,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-seamonkey</name>
|
|
<range><lt>2.13.2</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-thunderbird</name>
|
|
<range><lt>10.0.10</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>seamonkey</name>
|
|
<range><lt>2.13.2</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>thunderbird</name>
|
|
<range><gt>11.0</gt><lt>16.0.2</lt></range>
|
|
<range><lt>10.0.10</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>libxul</name>
|
|
<range><gt>1.9.2.*</gt><lt>10.0.10</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Mozilla Project reports:</p>
|
|
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
|
|
<p>MFSA 2012-90 Fixes for Location object issues</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-4194</cvename>
|
|
<cvename>CVE-2012-4195</cvename>
|
|
<cvename>CVE-2012-4196</cvename>
|
|
<url>http://www.mozilla.org/security/known-vulnerabilities/</url>
|
|
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-90.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-10-26</discovery>
|
|
<entry>2012-10-27</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="b0f3ab1f-1f3b-11e2-8fe9-0022156e8794">
|
|
<topic>Exim -- remote code execution</topic>
|
|
<affects>
|
|
<package>
|
|
<name>exim</name>
|
|
<range><ge>4.70</ge><lt>4.80.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>This vulnerability affects Exim instances built with DKIM
|
|
enabled (this is the default for FreeBSD Exim port) and running
|
|
verification of DKIM signatures on the incoming mail
|
|
messages.</p>
|
|
<p>Phil Penncock reports:</p>
|
|
<blockquote cite="https://lists.exim.org/lurker/message/20121026.080330.74b9147b.en.html">
|
|
<p>This is a SECURITY release, addressing a CRITICAL remote
|
|
code execution flaw in versions of Exim between 4.70 and
|
|
4.80 inclusive, when built with DKIM support (the default).</p>
|
|
<p>This security vulnerability can be exploited by anyone
|
|
who can send email from a domain for which they control the
|
|
DNS.</p>
|
|
<p>You are not vulnerable if you built Exim with DISABLE_DKIM
|
|
or if you put this at the start of an ACL plumbed into
|
|
acl_smtp_connect or acl_smtp_rcpt:</p>
|
|
<pre>warn control = dkim_disable_verify</pre>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-5671</cvename>
|
|
<url>https://lists.exim.org/lurker/message/20121026.080330.74b9147b.en.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-10-25</discovery>
|
|
<entry>2012-10-26</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="5f326d75-1db9-11e2-bc8f-d0df9acfd7e5">
|
|
<topic>django -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>django</name>
|
|
<range><lt>1.4.2</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>django13</name>
|
|
<range><lt>1.3.4</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Django Project reports:</p>
|
|
<blockquote cite="https://www.djangoproject.com/weblog/2012/oct/17/security/">
|
|
<ol>
|
|
<li>
|
|
<p>Host header poisoning</p>
|
|
<p>Some parts of Django -- independent of end-user-written applications
|
|
-- make use of full URLs, including domain name, which are generated
|
|
from the HTTP Host header. Some attacks against this are beyond Django's
|
|
ability to control, and require the web server to be properly configured;
|
|
Django's documentation has for some time contained notes advising users
|
|
on such configuration.</p>
|
|
<p>Django's own built-in parsing of the Host header is, however, still
|
|
vulnerable, as was reported to us recently. The Host header parsing
|
|
in Django 1.3 and Django 1.4 -- specifically, django.http.HttpRequest.get_host()
|
|
-- was incorrectly handling username/password information in the header.
|
|
Thus, for example, the following Host header would be accepted by Django when
|
|
running on "validsite.com":</p>
|
|
<p>Host: validsite.com:random@evilsite.com</p>
|
|
<p>Using this, an attacker can cause parts of Django -- particularly the
|
|
password-reset mechanism -- to generate and display arbitrary URLs to users.</p>
|
|
<p>To remedy this, the parsing in HttpRequest.get_host() is being modified; Host
|
|
headers which contain potentially dangerous content (such as username/password
|
|
pairs) now raise the exception django.core.exceptions.SuspiciousOperation.</p>
|
|
</li>
|
|
<li>
|
|
<p>Documentation of HttpOnly cookie option</p>
|
|
<p>As of Django 1.4, session cookies are always sent with the HttpOnly flag, which
|
|
provides some additional protection from cross-site scripting attacks by denying
|
|
client-side scripts access to the session cookie.</p>
|
|
<p>Though not directly a security issue in Django, it has been reported that the
|
|
Django 1.4 documentation incorrectly described this change, by claiming that this
|
|
was now the default for all cookies set by the HttpResponse.set_cookie() method.</p>
|
|
<p>The Django documentation has been updated to reflect that this only applies to the
|
|
session cookie. Users of Django are encouraged to review their use of set_cookie()
|
|
to ensure that the HttpOnly flag is being set or unset appropriately.</p>
|
|
</li>
|
|
</ol>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-4520</cvename>
|
|
<url>https://www.djangoproject.com/weblog/2012/oct/17/security/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-10-17</discovery>
|
|
<entry>2012-10-24</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="a7706414-1be7-11e2-9aad-902b343deec9">
|
|
<topic>Wireshark -- Multiple Vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>wireshark</name>
|
|
<range><le>1.8.2_1</le></range>
|
|
</package>
|
|
<package>
|
|
<name>wireshark-lite</name>
|
|
<range><le>1.8.2_1</le></range>
|
|
</package>
|
|
<package>
|
|
<name>tshark</name>
|
|
<range><le>1.8.2_1</le></range>
|
|
</package>
|
|
<package>
|
|
<name>tshark-lite</name>
|
|
<range><le>1.8.2_1</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Wireshark reports:</p>
|
|
<blockquote cite="http://www.wireshark.org/docs/relnotes/wireshark-1.8.3.html">
|
|
<p>The HSRP dissector could go into an infinite loop.</p>
|
|
<p>The PPP dissector could abort.</p>
|
|
<p>Martin Wilck discovered an infinite loop in the DRDA
|
|
dissector.</p>
|
|
<p>Laurent Butti discovered a buffer overflow in the LDP
|
|
dissector.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-5237</cvename>
|
|
<cvename>CVE-2012-5238</cvename>
|
|
<cvename>CVE-2012-5239</cvename>
|
|
<cvename>CVE-2012-5240</cvename>
|
|
<url>http://www.wireshark.org/security/wnpa-sec-2012-26.html</url>
|
|
<url>http://www.wireshark.org/security/wnpa-sec-2012-27.html</url>
|
|
<url>http://www.wireshark.org/security/wnpa-sec-2012-28.html</url>
|
|
<url>http://www.wireshark.org/security/wnpa-sec-2012-29.html</url>
|
|
<url>http://www.wireshark.org/docs/relnotes/wireshark-1.8.3.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-10-02</discovery>
|
|
<entry>2012-10-22</entry>
|
|
<modified>2013-06-19</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="57652765-18aa-11e2-8382-00a0d181e71d">
|
|
<topic>xlockmore -- local exploit</topic>
|
|
<affects>
|
|
<package>
|
|
<name>xlockmore</name>
|
|
<name>ja-xlockmore</name>
|
|
<range><lt>5.40_1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Ignatios Souvatzis of NetBSD reports:</p>
|
|
<blockquote cite="http://www.openwall.com/lists/oss-security/2012/10/17/10">
|
|
<p>Due to an error in the dclock screensaver in xlockmore, users who
|
|
explicitly use this screensaver or a random mix of screensavers using
|
|
something like "xlockmore -mode random" may have their screen unlocked
|
|
unexpectedly at a random time.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-4524</cvename>
|
|
<mlist>http://www.openwall.com/lists/oss-security/2012/10/17/10</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-10-17</discovery>
|
|
<entry>2012-10-17</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="e11955ca-187c-11e2-be36-00215af774f0">
|
|
<topic>xinetd -- attackers can bypass access restrictions if tcpmux-servers service enabled</topic>
|
|
<affects>
|
|
<package>
|
|
<name>xinetd</name>
|
|
<range><lt>2.3.15</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Thomas Swan reports:</p>
|
|
<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=790940">
|
|
<p>xinetd allows for services to be configured with the TCPMUX
|
|
or TCPMUXPLUS service types, which makes those services
|
|
available on port 1, as per RFC 1078 [1], if the tcpmux-server
|
|
service is enabled. When the tcpmux-server service is enabled,
|
|
xinetd would expose _all_ enabled services via the tcpmux port,
|
|
instead of just the configured service(s). This could allow
|
|
a remote attacker to bypass firewall restrictions and access
|
|
services via the tcpmux port.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-0862</cvename>
|
|
<url>https://bugzilla.redhat.com/show_bug.cgi?id=790940</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-02-15</discovery>
|
|
<entry>2012-10-17</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="ec34d0c2-1799-11e2-b4ab-000c29033c32">
|
|
<topic>Zend Framework -- Multiple vulnerabilities via XXE injection</topic>
|
|
<affects>
|
|
<package>
|
|
<name>ZendFramework</name>
|
|
<range><lt>1.11.13</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Zend Framework team reports:</p>
|
|
<blockquote cite="http://framework.zend.com/security/advisory/ZF2012-01">
|
|
<p>The XmlRpc package of Zend Framework is vulnerable to XML
|
|
eXternal Entity Injection attacks (both server and client).
|
|
The SimpleXMLElement class (SimpleXML PHP extension) is used
|
|
in an insecure way to parse XML data. External entities can be
|
|
specified by adding a specific DOCTYPE element to XML-RPC
|
|
requests. By exploiting this vulnerability an application may be
|
|
coerced to open arbitrary files and/or TCP connections.</p>
|
|
<p>Additionally, the Zend_Dom, Zend_Feed, Zend_Soap, and
|
|
Zend_XmlRpc components are vulnerable to XML Entity Expansion
|
|
(XEE) vectors, leading to Denial of Service vectors. XEE attacks
|
|
occur when the XML DOCTYPE declaration includes XML entity
|
|
definitions that contain either recursive or circular references;
|
|
this leads to CPU and memory consumption, making Denial of
|
|
Service exploits trivial to implement.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-3363</cvename>
|
|
<url>https://www.sec-consult.com/files/20120626-0_zend_framework_xxe_injection.txt</url>
|
|
<url>http://framework.zend.com/security/advisory/ZF2012-01</url>
|
|
<url>http://framework.zend.com/security/advisory/ZF2012-02</url>
|
|
<url>http://www.openwall.com/lists/oss-security/2012/06/26/2</url>
|
|
<url>https://secunia.com/advisories/49665/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-06-26</discovery>
|
|
<entry>2012-10-16</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="f94befcd-1289-11e2-a25e-525400272390">
|
|
<topic>gitolite -- path traversal vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>gitolite</name>
|
|
<range><ge>3.01</ge><le>3.04</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Sitaram Chamarty reports:</p>
|
|
<blockquote cite="https://groups.google.com/forum/#!topic/gitolite/K9SnQNhCQ-0/discussion">
|
|
<p>I'm sorry to say there is a potential path traversal vulnerability in
|
|
v3. Thanks to Stephane Chazelas for finding it and alerting me.</p>
|
|
<p>Can it affect you? This can only affect you if you are using wild
|
|
card repos, *and* at least one of your patterns allows the string
|
|
"../" to match multiple times.</p>
|
|
<p>How badly can it affect you? A malicious user who *also* has the
|
|
ability to create arbitrary files in, say, /tmp (e.g., he has his own
|
|
userid on the same box), can compromise the entire "git" user.
|
|
Otherwise the worst he can do is create arbitrary repos in /tmp.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-4506</cvename>
|
|
<mlist msgid="CAMK1S_jotna+d_X2C-+es-M28i1aUBcsNeiXxwJ63EshQ8ht6w@mail.gmail.com">https://groups.google.com/forum/#!topic/gitolite/K9SnQNhCQ-0/discussion</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-10-09</discovery>
|
|
<entry>2012-10-15</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="ef417da3-1640-11e2-999b-e0cb4e266481">
|
|
<topic>phpMyAdmin -- Multiple XSS due to unescaped HTML output in Trigger, Procedure and Event pages and Fetching the version information from a non-SSL site is vulnerable to a MITM attack</topic>
|
|
<affects>
|
|
<package>
|
|
<name>phpMyAdmin</name>
|
|
<range><ge>3.5</ge><lt>3.5.3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The phpMyAdmin development team reports:</p>
|
|
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2012-6.php">
|
|
<p>When creating/modifying a trigger, event or procedure
|
|
with a crafted name, it is possible to trigger an XSS.</p>
|
|
</blockquote>
|
|
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2012-7.php">
|
|
<p>To display information about the current phpMyAdmin
|
|
version on the main page, a piece of JavaScript is fetched
|
|
from the phpmyadmin.net website in non-SSL mode. A
|
|
man-in-the-middle could modify this script on the wire to
|
|
cause mischief.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-5339</cvename>
|
|
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2012-6.php</url>
|
|
<cvename>CVE-2012-5368</cvename>
|
|
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2012-7.php</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-10-08</discovery>
|
|
<entry>2012-10-14</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="09e83f7f-1326-11e2-afe3-00262d5ed8ee">
|
|
<topic>chromium -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>chromium</name>
|
|
<range><lt>22.0.1229.94</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Google Chrome Releases reports:</p>
|
|
<blockquote cite="http://googlechromereleases.blogspot.nl/search/label/Stable%20updates">
|
|
<p>[154983][154987] Critical CVE-2012-5112: SVG use-after-free and
|
|
IPC arbitrary file write. Credit to Pinkie Pie.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-5112</cvename>
|
|
<url>http://googlechromereleases.blogspot.nl/search/label/Stable%20updates</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-10-10</discovery>
|
|
<entry>2012-10-10</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="6e5a9afd-12d3-11e2-b47d-c8600054b392">
|
|
<topic>mozilla -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>firefox</name>
|
|
<range><gt>11.0,1</gt><lt>16.0.1,1</lt></range>
|
|
<range><lt>10.0.9,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-firefox</name>
|
|
<range><lt>10.0.9,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-seamonkey</name>
|
|
<range><lt>2.13.1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-thunderbird</name>
|
|
<range><lt>10.0.9</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>seamonkey</name>
|
|
<range><lt>2.13.1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>thunderbird</name>
|
|
<range><gt>11.0</gt><lt>16.0.1</lt></range>
|
|
<range><lt>10.0.9</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>libxul</name>
|
|
<range><gt>1.9.2.*</gt><lt>10.0.9</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Mozilla Project reports:</p>
|
|
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
|
|
<p> MFSA 2012-74 Miscellaneous memory safety hazards (rv:16.0/
|
|
rv:10.0.8)</p>
|
|
<p>MFSA 2012-75 select element persistance allows for attacks</p>
|
|
<p>MFSA 2012-76 Continued access to initial origin after setting
|
|
document.domain</p>
|
|
<p>MFSA 2012-77 Some DOMWindowUtils methods bypass security checks</p>
|
|
<p>MFSA 2012-78 Reader Mode pages have chrome privileges</p>
|
|
<p>MFSA 2012-79 DOS and crash with full screen and history navigation</p>
|
|
<p>MFSA 2012-80 Crash with invalid cast when using instanceof
|
|
operator</p>
|
|
<p>MFSA 2012-81 GetProperty function can bypass security checks</p>
|
|
<p>MFSA 2012-82 top object and location property accessible by
|
|
plugins</p>
|
|
<p>MFSA 2012-83 Chrome Object Wrapper (COW) does not disallow acces
|
|
to privileged functions or properties</p>
|
|
<p>MFSA 2012-84 Spoofing and script injection through location.hash</p>
|
|
<p>MFSA 2012-85 Use-after-free, buffer overflow, and out of bounds
|
|
read issues found using Address Sanitizer</p>
|
|
<p>MFSA 2012-86 Heap memory corruption issues found using Address
|
|
Sanitizer</p>
|
|
<p>MFSA 2012-87 Use-after-free in the IME State Manager</p>
|
|
<p>MFSA 2012-88 Miscellaneous memory safety hazards (rv:16.0.1)</p>
|
|
<p>MFSA 2012-89 defaultValue security checks not applied</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-3982</cvename>
|
|
<cvename>CVE-2012-3983</cvename>
|
|
<cvename>CVE-2012-3984</cvename>
|
|
<cvename>CVE-2012-3985</cvename>
|
|
<cvename>CVE-2012-3986</cvename>
|
|
<cvename>CVE-2012-3987</cvename>
|
|
<cvename>CVE-2012-3988</cvename>
|
|
<cvename>CVE-2012-3989</cvename>
|
|
<cvename>CVE-2012-3990</cvename>
|
|
<cvename>CVE-2012-3991</cvename>
|
|
<cvename>CVE-2012-3992</cvename>
|
|
<cvename>CVE-2012-3993</cvename>
|
|
<cvename>CVE-2012-3994</cvename>
|
|
<cvename>CVE-2012-3995</cvename>
|
|
<cvename>CVE-2012-4179</cvename>
|
|
<cvename>CVE-2012-4180</cvename>
|
|
<cvename>CVE-2012-4181</cvename>
|
|
<cvename>CVE-2012-4182</cvename>
|
|
<cvename>CVE-2012-4183</cvename>
|
|
<cvename>CVE-2012-4184</cvename>
|
|
<cvename>CVE-2012-4186</cvename>
|
|
<cvename>CVE-2012-4187</cvename>
|
|
<cvename>CVE-2012-4188</cvename>
|
|
<cvename>CVE-2012-4190</cvename>
|
|
<cvename>CVE-2012-4191</cvename>
|
|
<cvename>CVE-2012-4192</cvename>
|
|
<cvename>CVE-2012-4193</cvename>
|
|
<url>http://www.mozilla.org/security/known-vulnerabilities/</url>
|
|
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-74.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-75.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-76.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-77.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-78.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-79.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-80.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-81.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-82.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-83.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-84.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-85.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-86.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-87.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-88.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-89.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-10-09</discovery>
|
|
<entry>2012-10-10</entry>
|
|
<modified>2012-10-11</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="57a700f9-12c0-11e2-9f86-001d923933b6">
|
|
<topic>dns/bind9* -- crash on deliberately constructed combination of records</topic>
|
|
<affects>
|
|
<package>
|
|
<name>bind99</name>
|
|
<range><lt>9.9.1.4</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>bind99-base</name>
|
|
<range><lt>9.9.1.4</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>bind98</name>
|
|
<range><lt>9.8.3.4</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>bind98-base</name>
|
|
<range><lt>9.8.3.4</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>bind97</name>
|
|
<range><lt>9.7.6.4</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>bind97-base</name>
|
|
<range><lt>9.7.6.4</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>bind96</name>
|
|
<range><lt>9.6.3.1.ESV.R7.4</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>bind96-base</name>
|
|
<range><lt>9.6.3.1.ESV.R7.4</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>ISC reports:</p>
|
|
<blockquote cite="https://kb.isc.org/article/AA-00801/">
|
|
<p>A deliberately constructed combination of records could cause named
|
|
to hang while populating the additional section of a response.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-5166</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-09-26</discovery>
|
|
<entry>2012-10-10</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="e6161b65-1187-11e2-afe3-00262d5ed8ee">
|
|
<topic>chromium -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>chromium</name>
|
|
<range><lt>22.0.1229.92</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Google Chrome Releases reports:</p>
|
|
<blockquote cite="http://googlechromereleases.blogspot.nl/search/label/Stable%20updates">
|
|
<p>[138208] High CVE-2012-2900: Crash in Skia text rendering. Credit
|
|
to Atte Kettunen of OUSPG.</p>
|
|
<p>[147499] Critical CVE-2012-5108: Race condition in audio device
|
|
handling. Credit to Atte Kettunen of OUSPG.</p>
|
|
<p>[148692] Medium CVE-2012-5109: OOB read in ICU regex. Credit to
|
|
Arthur Gerkis.</p>
|
|
<p>[151449] Medium CVE-2012-5110: Out-of-bounds read in compositor.
|
|
Credit to Google Chrome Security Team (Inferno).</p>
|
|
<p>[151895] Low CVE-2012-5111: Plug-in crash monitoring was missing
|
|
for Pepper plug-ins. Credit to Google Chrome Security Team (Chris
|
|
Evans).</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-2900</cvename>
|
|
<cvename>CVE-2012-5108</cvename>
|
|
<cvename>CVE-2012-5109</cvename>
|
|
<cvename>CVE-2012-5110</cvename>
|
|
<cvename>CVE-2012-5111</cvename>
|
|
<url>http://googlechromereleases.blogspot.nl/search/label/Stable%20updates</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-10-08</discovery>
|
|
<entry>2012-10-08</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="dee44ba9-08ab-11e2-a044-d0df9acfd7e5">
|
|
<topic>OpenX -- SQL injection vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>openx</name>
|
|
<range><lt>2.8.10</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/50598/">
|
|
<p>A vulnerability has been discovered in OpenX, which can be
|
|
exploited by malicious people to conduct SQL injection
|
|
attacks.</p>
|
|
<p>Input passed via the "xajaxargs" parameter to
|
|
www/admin/updates-history.php (when "xajax" is set to
|
|
"expandOSURow") is not properly sanitised in e.g. the
|
|
"queryAuditBackupTablesByUpgradeId()" function
|
|
(lib/OA/Upgrade/DB_UpgradeAuditor.php) before being used in SQL
|
|
queries. This can be exploited to manipulate SQL queries by
|
|
injecting arbitrary SQL code.</p>
|
|
<p>The vulnerability is confirmed in version 2.8.9. Prior versions
|
|
may also be affected.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://secunia.com/advisories/50598/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-09-14</discovery>
|
|
<entry>2012-09-27</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="5bae2ab4-0820-11e2-be5f-00262d5ed8ee">
|
|
<topic>chromium -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>chromium</name>
|
|
<range><lt>22.0.1229.79</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Google Chrome Releases reports:</p>
|
|
<blockquote cite="http://googlechromereleases.blogspot.nl/search/label/Stable%20updates">
|
|
<p>[143439] High CVE-2012-2889: UXSS in frame handling. Credit to
|
|
Sergey Glazunov.</p>
|
|
<p>[143437] High CVE-2012-2886: UXSS in v8 bindings. Credit to Sergey
|
|
Glazunov.</p>
|
|
<p>[139814] High CVE-2012-2881: DOM tree corruption with plug-ins.
|
|
Credit to Chamal de Silva.</p>
|
|
<p>[135432] High CVE-2012-2876: Buffer overflow in SSE2 optimizations.
|
|
Credit to Atte Kettunen of OUSPG.</p>
|
|
<p>[140803] High CVE-2012-2883: Out-of-bounds write in Skia. Credit to
|
|
Atte Kettunen of OUSPG.</p>
|
|
<p>[143609] High CVE-2012-2887: Use-after-free in onclick handling.
|
|
Credit to Atte Kettunen of OUSPG.</p>
|
|
<p>[143656] High CVE-2012-2888: Use-after-free in SVG text references.
|
|
Credit to miaubiz.</p>
|
|
<p>[144899] High CVE-2012-2894: Crash in graphics context handling.
|
|
Credit to Slawomir Blazek.</p>
|
|
<p>[137707] Medium CVE-2012-2877: Browser crash with extensions and
|
|
modal dialogs. Credit to Nir Moshe.</p>
|
|
<p>[139168] Low CVE-2012-2879: DOM topology corruption. Credit to
|
|
pawlkt.</p>
|
|
<p>[141651] Medium CVE-2012-2884: Out-of-bounds read in Skia. Credit
|
|
to Atte Kettunen of OUSPG.</p>
|
|
<p>[132398] High CVE-2012-2874: Out-of-bounds write in Skia. Credit to
|
|
Google Chrome Security Team (Inferno).</p>
|
|
<p>[134955] [135488] [137106] [137288] [137302] [137547] [137556]
|
|
[137606] [137635] [137880] [137928] [144579] [145079] [145121]
|
|
[145163] [146462] Medium CVE-2012-2875: Various lower severity
|
|
issues in the PDF viewer. Credit to Mateusz Jurczyk of Google
|
|
Security Team, with contributions by Gynvael Coldwind of Google
|
|
Security Team.</p>
|
|
<p>[137852] High CVE-2012-2878: Use-after-free in plug-in handling.
|
|
Credit to Fermin Serna of Google Security Team.</p>
|
|
<p>[139462] Medium CVE-2012-2880: Race condition in plug-in paint
|
|
buffer. Credit to Google Chrome Security Team (Cris Neckar).</p>
|
|
<p>[140647] High CVE-2012-2882: Wild pointer in OGG container
|
|
handling. Credit to Google Chrome Security Team (Inferno).</p>
|
|
<p>[142310] Medium CVE-2012-2885: Possible double free on exit. Credit
|
|
to the Chromium development community.</p>
|
|
<p>[143798] [144072] [147402] High CVE-2012-2890: Use-after-free in
|
|
PDF viewer. Credit to Mateusz Jurczyk of Google Security Team, with
|
|
contributions by Gynvael Coldwind of Google Security Team.</p>
|
|
<p>[144051] Low CVE-2012-2891: Address leak over IPC. Credit to Lei
|
|
Zhang of the Chromium development community.</p>
|
|
<p>[144704] Low CVE-2012-2892: Pop-up block bypass. Credit to Google
|
|
Chrome Security Team (Cris Neckar).</p>
|
|
<p>[144799] High CVE-2012-2893: Double free in XSL transforms. Credit
|
|
to Google Chrome Security Team (Cris Neckar).</p>
|
|
<p>[145029] [145157] [146460] High CVE-2012-2895: Out-of-bounds writes
|
|
in PDF viewer. Credit to Mateusz Jurczyk of Google Security Team,
|
|
with contributions by Gynvael Coldwind of Google Security Team.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-2889</cvename>
|
|
<cvename>CVE-2012-2886</cvename>
|
|
<cvename>CVE-2012-2881</cvename>
|
|
<cvename>CVE-2012-2876</cvename>
|
|
<cvename>CVE-2012-2883</cvename>
|
|
<cvename>CVE-2012-2887</cvename>
|
|
<cvename>CVE-2012-2888</cvename>
|
|
<cvename>CVE-2012-2894</cvename>
|
|
<cvename>CVE-2012-2877</cvename>
|
|
<cvename>CVE-2012-2879</cvename>
|
|
<cvename>CVE-2012-2884</cvename>
|
|
<cvename>CVE-2012-2874</cvename>
|
|
<cvename>CVE-2012-2875</cvename>
|
|
<cvename>CVE-2012-2878</cvename>
|
|
<cvename>CVE-2012-2880</cvename>
|
|
<cvename>CVE-2012-2882</cvename>
|
|
<cvename>CVE-2012-2885</cvename>
|
|
<cvename>CVE-2012-2890</cvename>
|
|
<cvename>CVE-2012-2891</cvename>
|
|
<cvename>CVE-2012-2892</cvename>
|
|
<cvename>CVE-2012-2893</cvename>
|
|
<cvename>CVE-2012-2895</cvename>
|
|
<url>http://googlechromereleases.blogspot.nl/search/label/Stable%20updates</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-09-25</discovery>
|
|
<entry>2012-09-26</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="73efb1b7-07ec-11e2-a391-000c29033c32">
|
|
<topic>eperl -- Remote code execution</topic>
|
|
<affects>
|
|
<package>
|
|
<name>eperl</name>
|
|
<range><le>2.2.14_4</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>David Madison reports:</p>
|
|
<blockquote cite="http://www.shmoo.com/mail/bugtraq/jun01/msg00286.shtml">
|
|
<p>ePerl is a multipurpose Perl filter and interpreter program
|
|
for Unix systems. The ePerl preprocessor contains an input
|
|
validation error. The preprocessor allows foreign data to be
|
|
"safely" included using the 'sinclude' directive.</p>
|
|
<p>The problem occurs when a file referenced by a 'sinclude'
|
|
directive contains a 'include' directive; the contents of
|
|
the file referred to by the second directive will be loaded
|
|
and executed.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2001-0733</cvename>
|
|
<url>http://www.shmoo.com/mail/bugtraq/jun01/msg00286.shtml</url>
|
|
<bid>2912</bid>
|
|
<url>http://xforce.iss.net/xforce/xfdb/6743</url>
|
|
<url>http://osvdb.org/show/osvdb/1880</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2001-06-21</discovery>
|
|
<entry>2012-09-26</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="98690c45-0361-11e2-a391-000c29033c32">
|
|
<topic>ImageMagick and GraphicsMagick -- DoS via specially crafted PNG file</topic>
|
|
<affects>
|
|
<package>
|
|
<name>ImageMagick</name>
|
|
<name>ImageMagick-nox11</name>
|
|
<range><le>6.7.8.6</le></range>
|
|
</package>
|
|
<package>
|
|
<name>GraphicsMagick</name>
|
|
<name>GraphicsMagick-nox11</name>
|
|
<range><ge>1.3.0</ge><le>1.3.16</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Kurt Seifried reports:</p>
|
|
<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=844105">
|
|
<p>There is an issue in ImageMagick that is also present in
|
|
GraphicsMagick. CVE-2011-3026 deals with libpng memory
|
|
allocation, and limitations have been added so that a bad PNG
|
|
can't cause the system to allocate a lot of memory and a
|
|
denial of service. However on further investigation of
|
|
ImageMagick, Tom Lane found that PNG malloc function
|
|
(Magick_png_malloc) in turn calls AcquireMagickMemory with an
|
|
improper size argument.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-3438</cvename>
|
|
<url>https://bugzilla.redhat.com/show_bug.cgi?id=844105</url>
|
|
<bid>54716</bid>
|
|
<url>http://secunia.com/advisories/50090</url>
|
|
<url>http://xforce.iss.net/xforce/xfdb/77259</url>
|
|
<url>http://osvdb.org/show/osvdb/84323</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-07-28</discovery>
|
|
<entry>2012-09-20</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="ec255bd8-02c6-11e2-92d1-000d601460a4">
|
|
<topic>php5-sqlite -- open_basedir bypass</topic>
|
|
<affects>
|
|
<package>
|
|
<name>php5-sqlite</name>
|
|
<range><ge>5.2</ge><lt>5.2.17_11</lt></range>
|
|
<range><ge>5.3</ge><lt>5.3.15</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>php52-sqlite</name>
|
|
<range><lt>5.2.17_11</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>php53-sqlite</name>
|
|
<range><lt>5.3.15</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>MITRE CVE team reports:</p>
|
|
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3365">
|
|
<p>The SQLite functionality in PHP before 5.3.15 allows remote
|
|
attackers to bypass the open_basedir protection mechanism via
|
|
unspecified vectors.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-3365</cvename>
|
|
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3365</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-06-14</discovery>
|
|
<entry>2012-09-19</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="9b2a5e88-02b8-11e2-92d1-000d601460a4">
|
|
<topic>php5 -- Denial of Service in php_date_parse_tzfile()</topic>
|
|
<affects>
|
|
<package>
|
|
<name>php5</name>
|
|
<range><ge>5.2</ge><lt>5.2.17_11</lt></range>
|
|
<range><ge>5.3</ge><lt>5.3.9</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>php52</name>
|
|
<range><lt>5.2.17_11</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>php53</name>
|
|
<range><lt>5.3.9</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>MITRE CVE team reports:</p>
|
|
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0789">
|
|
<p>Memory leak in the timezone functionality in PHP before 5.3.9
|
|
allows remote attackers to cause a denial of service (memory
|
|
consumption) by triggering many strtotime function calls, which are
|
|
not properly handled by the php_date_parse_tzfile cache.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-0789</cvename>
|
|
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0789</url>
|
|
<url>https://bugs.php.net/bug.php?id=53502</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-12-08</discovery>
|
|
<entry>2012-09-19</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="53a0ddef-0208-11e2-8afa-0024e830109b">
|
|
<topic>dns/bind9* -- Several vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>bind99</name>
|
|
<range><lt>9.9.1.3</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>bind98</name>
|
|
<range><lt>9.8.3.3</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>bind97</name>
|
|
<range><lt>9.7.6.3</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>bind96</name>
|
|
<range><lt>9.6.3.1.ESV.R7.3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>ISC reports:</p>
|
|
<blockquote cite="https://kb.isc.org/article/AA-00788">
|
|
<p>Prevents a crash when queried for a record whose RDATA exceeds
|
|
65535 bytes.</p>
|
|
<p>Prevents a crash when validating caused by using "Bad cache" data
|
|
before it has been initialized.</p>
|
|
<p>ISC_QUEUE handling for recursive clients was updated to address
|
|
a race condition that could cause a memory leak. This rarely
|
|
occurred with UDP clients, but could be a significant problem
|
|
for a server handling a steady rate of TCP queries.</p>
|
|
<p>A condition has been corrected where improper handling of
|
|
zero-length RDATA could cause undesirable behavior, including
|
|
termination of the named process.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url/>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-09-12</discovery>
|
|
<entry>2012-09-18</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="d846af5b-00f4-11e2-b6d0-00e0814cab4e">
|
|
<topic>jenkins -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>jenkins</name>
|
|
<range><lt>1.482</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Jenkins Security Advisory reports:</p>
|
|
<blockquote cite="https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2012-09-17">
|
|
<p>This advisory announces security vulnerabilities that were found
|
|
in Jenkins core and several plugins.</p>
|
|
<ol>
|
|
<li>The first vulnerability in Jenkins core allows unprivileged
|
|
users to insert data into Jenkins master, which can lead to
|
|
remote code execution. For this vulnerability to be exploited,
|
|
the attacker must have an HTTP access to a Jenkins master, and
|
|
he must have a read access to Jenkins.</li>
|
|
<li>The second vulnerability in Jenkins core is a cross-site
|
|
scripting vulnerability. This allows an attacker to craft an URL
|
|
that points to Jenkins, and if a legitimate user clicks this link,
|
|
and the attacker will be able to hijack the user session.</li>
|
|
<li>The third vulnerability is a cross-site scripting vulnerability
|
|
in the Violations plugin</li>
|
|
<li>The fourth vulnerability is a cross-site scripting vulnerability
|
|
in The Continuous Integration Game plugin</li>
|
|
</ol>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2012-09-17</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-09-17</discovery>
|
|
<entry>2012-09-17</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="62f36dfd-ff56-11e1-8821-001b2134ef46">
|
|
<topic>vlc -- arbitrary code execution in Real RTSP and MMS support</topic>
|
|
<affects>
|
|
<package>
|
|
<name>vlc</name>
|
|
<range><lt>2.0.1,3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Jean-Baptiste Kempf, on behalf of the VideoLAN project reports:</p>
|
|
<blockquote cite="http://www.videolan.org/security/sa1201.html">
|
|
<p>If successful, a malicious third party could crash the VLC
|
|
media player process. Arbitrary code execution could be possible
|
|
on some systems.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://www.videolan.org/security/sa1201.html</url>
|
|
<url>http://www.videolan.org/security/sa1202.html</url>
|
|
<cvename>CVE-2012-1775</cvename>
|
|
<cvename>CVE-2012-1776</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-03-12</discovery>
|
|
<entry>2012-09-15</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="143f6932-fedb-11e1-ad4a-003067b2972c">
|
|
<topic>bacula -- Console ACL Bypass</topic>
|
|
<affects>
|
|
<package>
|
|
<name>bacula</name>
|
|
<range><lt>5.2.11</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<blockquote cite="https://secunia.com/advisories/50535/">
|
|
<p>A security issue has been reported in Bacula, which can be
|
|
exploited by malicious users to bypass certain security
|
|
restrictions.</p>
|
|
<p>The security issue is caused due to an error within the implementation
|
|
of console ACLs, which can be exploited to gain access to certain
|
|
restricted functionality and e.g. dump resources.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-4430</cvename>
|
|
<url>http://www.bacula.org/git/cgit.cgi/bacula/commit/?id=67debcecd3d530c429e817e1d778e79dcd1db905</url>
|
|
<url>https://secunia.com/advisories/50535/</url>
|
|
<url>http://sourceforge.net/projects/bacula/files/bacula/5.2.11/ReleaseNotes/view</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-09-12</discovery>
|
|
<entry>2012-09-15</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="178ba4ea-fd40-11e1-b2ae-001fd0af1a4c">
|
|
<topic>mod_pagespeed -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>mod_pagespeed</name>
|
|
<range><lt>0.10.22.6</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Google Reports:</p>
|
|
<blockquote cite="https://developers.google.com/speed/docs/mod_pagespeed/announce-0.10.22.6">
|
|
<p>mod_pagespeed 0.10.22.6 is a security update that fixes two
|
|
critical issues that affect earlier versions:</p>
|
|
<ul>
|
|
<li>CVE-2012-4001, a problem with validation of own host name.</li>
|
|
<li>CVE-2012-4360, a cross-site scripting attack, which affects versions starting from 0.10.19.1.</li>
|
|
</ul>
|
|
<p>The effect of the first problem is that it is possible to confuse
|
|
mod_pagespeed about its own host name, and to trick it into
|
|
fetching resources from other machines. This could be an issue if
|
|
the HTTP server has access to machines that are not otherwise
|
|
publicly visible.</p>
|
|
<p>The second problem would permit a hostile third party to execute
|
|
JavaScript in users' browsers in context of the domain running
|
|
mod_pagespeed, which could permit interception of users' cookies or
|
|
data on the site.</p>
|
|
<p>Because of the severity of the two problems, users are strongly
|
|
encouraged to update immediately.</p>
|
|
<p>Behavior Changes in the Update:</p>
|
|
<p>As part of the fix to the first issue, mod_pagespeed will not fetch
|
|
resources from machines other than localhost if they are not
|
|
explicitly mentioned in the configuration. This means that if you
|
|
need resources on the server's domain to be handled by some other
|
|
system, you'll need to explicitly use ModPagespeedMapOriginDomain
|
|
or ModPagespeedDomain to authorize that.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-4001</cvename>
|
|
<cvename>CVE-2012-4360</cvename>
|
|
<url>https://developers.google.com/speed/docs/mod_pagespeed/announce-0.10.22.6</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-09-12</discovery>
|
|
<entry>2012-09-12</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="3bbbe3aa-fbeb-11e1-8bd8-0022156e8794">
|
|
<topic>freeradius -- arbitrary code execution for TLS-based authentication</topic>
|
|
<affects>
|
|
<package>
|
|
<name>freeradius</name>
|
|
<range><ge>2.1.10</ge><lt>2.1.12_2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>freeRADIUS security team reports:</p>
|
|
<blockquote cite="http://freeradius.org/security.html">
|
|
<p>Overflow in EAP-TLS for 2.1.10, 2.1.11 and 2.1.12.</p>
|
|
<p>The issue was found by Timo Warns, and communicated to
|
|
security@freeradius.org. A sample exploit for the issue was
|
|
included in the notification.</p>
|
|
<p>The vulnerability was created in commit a368a6f4f4aaf on
|
|
August 18, 2010. Vulnerable versions include 2.1.10, 2.1.11,
|
|
and 2.1.12. Also anyone running the git "master" branch
|
|
after August 18, 2010 is vulnerable.</p>
|
|
<p>All sites using TLS-based EAP methods and the above
|
|
versions are vulnerable. The only configuration change which
|
|
can avoid the issue is to disable EAP-TLS, EAP-TTLS, and
|
|
PEAP.</p>
|
|
<p>An external attacker can use this vulnerability to
|
|
over-write the stack frame of the RADIUS server, and cause
|
|
it to crash. In addition, more sophisticated attacks may
|
|
gain additional privileges on the system running the RADIUS
|
|
server.</p>
|
|
<p>This attack does not require local network access to the
|
|
RADIUS server. It can be done by an attacker through a WiFi
|
|
Access Point, so long as the Access Point is configured to
|
|
use 802.1X authentication with the RADIUS server.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-3547</cvename>
|
|
<url>http://freeradius.org/security.html</url>
|
|
<url>http://www.pre-cert.de/advisories/PRE-SA-2012-06.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-09-10</discovery>
|
|
<entry>2012-09-11</entry>
|
|
<modified>2012-09-11</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="c1e5f35e-f93d-11e1-b07f-00235a5f2c9a">
|
|
<topic>emacs -- remote code execution vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>emacs</name>
|
|
<range><gt>24.*</gt><lt>24.2</lt></range>
|
|
<range><gt>23.*</gt><le>23.4_2</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Chong Yidong reports:</p>
|
|
<blockquote cite="http://www.openwall.com/lists/oss-security/2012/08/13/1">
|
|
<p>Paul Ling has found a security flaw in the file-local
|
|
variables code in GNU Emacs.</p>
|
|
<p>When the Emacs user option `enable-local-variables' is
|
|
set to `:safe' (the default value is t), Emacs should
|
|
automatically refuse to evaluate `eval' forms in file-local
|
|
variable sections. Due to the bug, Emacs instead
|
|
automatically evaluates such `eval' forms. Thus, if the user
|
|
changes the value of `enable-local-variables' to `:safe',
|
|
visiting a malicious file can cause automatic execution of
|
|
arbitrary Emacs Lisp code with the permissions of the
|
|
user.</p>
|
|
<p>The bug is present in Emacs 23.2, 23.3, 23.4, and
|
|
24.1.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>54969</bid>
|
|
<cvename>CVE-2012-3479</cvename>
|
|
<url>https://lists.gnu.org/archive/html/emacs-devel/2012-08/msg00802.html</url>
|
|
<url>http://debbugs.gnu.org/cgi/bugreport.cgi?bug=12155</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-08-13</discovery>
|
|
<entry>2012-09-08</entry>
|
|
<modified>2013-05-13</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="30149157-f926-11e1-95cd-001fd0af1a4c">
|
|
<topic>wordpress -- multiple unspecified privilege escalation bugs</topic>
|
|
<affects>
|
|
<package>
|
|
<name>wordpress</name>
|
|
<range><lt>3.4.2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Wordpress reports:</p>
|
|
<blockquote cite="http://wordpress.org/news/2012/09/wordpress-3-4-2/">
|
|
<p>Version 3.4.2 also fixes a few security issues and contains some
|
|
security hardening. The vulnerabilities included potential
|
|
privilege escalation and a bug that affects multisite installs with
|
|
untrusted users. These issues were discovered and fixed by the
|
|
WordPress security team.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://wordpress.org/news/2012/09/wordpress-3-4-2/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-09-06</discovery>
|
|
<entry>2012-09-07</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="4a8a98ab-f745-11e1-8bd8-0022156e8794">
|
|
<topic>moinmoin -- cross-site scripting via RST parser</topic>
|
|
<affects>
|
|
<package>
|
|
<name>moinmoin</name>
|
|
<range><lt>1.9.4</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>MITRE CVE team reports:</p>
|
|
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1058">
|
|
<p>Cross-site scripting (XSS) vulnerability in the
|
|
reStructuredText (rst) parser in parser/text_rst.py in
|
|
MoinMoin before 1.9.4, when docutils is installed or when
|
|
"format rst" is set, allows remote attackers to inject
|
|
arbitrary web script or HTML via a javascript: URL in the
|
|
refuri attribute.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>46476</bid>
|
|
<cvename>CVE-2011-1058</cvename>
|
|
<url>http://moinmo.in/SecurityFixes</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-02-21</discovery>
|
|
<entry>2012-09-05</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="4f99e2ef-f725-11e1-8bd8-0022156e8794">
|
|
<topic>moinmoin -- wrong processing of group membership</topic>
|
|
<affects>
|
|
<package>
|
|
<name>moinmoin</name>
|
|
<range><ge>1.9</ge><lt>1.9.4_1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>MoinMoin developers report:</p>
|
|
<blockquote cite="http://hg.moinmo.in/moin/1.9/rev/7b9f39289e16">
|
|
<p>If you have group NAMES containing "All" or "Known" or
|
|
"Trusted", they behaved wrong until now (they erroneously
|
|
included All/Known/Trusted users even if you did not list
|
|
them as members), but will start working correctly with this
|
|
changeset.</p>
|
|
<p>E.g. AllFriendsGroup:</p>
|
|
<ul>
|
|
<li>JoeDoe</li>
|
|
</ul>
|
|
<p>AllFriendsGroup will now (correctly) include only JoeDoe.
|
|
It (erroneously) contained all users (including JoeDoe)
|
|
before.</p>
|
|
<p>E.g. MyTrustedFriendsGroup:</p>
|
|
<ul>
|
|
<li>JoeDoe</li>
|
|
</ul>
|
|
<p>MyTrustedFriendsGroup will now (correctly) include only
|
|
JoeDoe. It (erroneously) contained all trusted users and
|
|
JoeDoe before.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-4404</cvename>
|
|
<url>http://hg.moinmo.in/moin/1.9/rev/7b9f39289e16</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-09-03</discovery>
|
|
<entry>2012-09-05</entry>
|
|
<modified>2012-09-11</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="918f38cd-f71e-11e1-8bd8-0022156e8794">
|
|
<topic>php5 -- header splitting attack via carriage-return character</topic>
|
|
<affects>
|
|
<package>
|
|
<name>php5</name>
|
|
<range><ge>5.2</ge><lt>5.2.17_11</lt></range>
|
|
<range><ge>5.3</ge><lt>5.3.11</lt></range>
|
|
<range><ge>5.4</ge><lt>5.4.1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>php52</name>
|
|
<range><lt>5.2.17_11</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>php53</name>
|
|
<range><lt>5.3.11</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Rui Hirokawa reports:</p>
|
|
<blockquote cite="https://bugs.php.net/bug.php?id=60227">
|
|
<p>As of PHP 5.1.2, header() can no longer be used to send
|
|
multiple response headers in a single call to prevent the
|
|
HTTP Response Splitting Attack. header() only checks the
|
|
linefeed (LF, 0x0A) as line-end marker, it doesn't check the
|
|
carriage-return (CR, 0x0D).</p>
|
|
<p>However, some browsers including Google Chrome, IE also
|
|
recognize CR as the line-end.</p>
|
|
<p>The current specification of header() still has the
|
|
vulnerability against the HTTP header splitting attack.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2011-1398</cvename>
|
|
<url>https://bugs.php.net/bug.php?id=60227</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-11-06</discovery>
|
|
<entry>2012-09-05</entry>
|
|
<modified>2012-09-19</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="b50913ce-f4a7-11e1-b135-003067b2972c">
|
|
<topic>bitcoin -- denial of service</topic>
|
|
<affects>
|
|
<package>
|
|
<name>bitcoin</name>
|
|
<range><lt>0.6.3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<blockquote cite="https://bitcointalk.org/?topic=88734">
|
|
<p>A unspecified denial-of-service attack that could cause the
|
|
bitcoin process to become unresponsive was found.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-3789</cvename>
|
|
<url>https://bitcointalk.org/?topic=88734</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-07-20</discovery>
|
|
<entry>2012-09-02</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="6ad18fe5-f469-11e1-920d-20cf30e32f6d">
|
|
<topic>bugzilla -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>bugzilla</name>
|
|
<range><ge>3.6.0</ge><lt>3.6.11</lt></range>
|
|
<range><ge>4.0.0</ge><lt>4.0.8</lt></range>
|
|
<range><ge>4.2.0</ge><lt>4.2.3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<h1>A Bugzilla Security Advisory reports:</h1>
|
|
<blockquote cite="http://www.bugzilla.org/security/3.6.10/">
|
|
<p>The following security issues have been discovered in
|
|
Bugzilla:</p>
|
|
<h1>LDAP Injection</h1>
|
|
<p>When the user logs in using LDAP, the username is not
|
|
escaped when building the uid=$username filter which is
|
|
used to query the LDAP directory. This could potentially
|
|
lead to LDAP injection.</p>
|
|
<h1>Directory Browsing</h1>
|
|
<p>Extensions are not protected against directory browsing
|
|
and users can access the source code of the templates
|
|
which may contain sensitive data.
|
|
Directory browsing is blocked in Bugzilla 4.3.3 only,
|
|
because it requires a configuration change in the Apache
|
|
httpd.conf file to allow local .htaccess files to use
|
|
Options -Indexes. To not break existing installations,
|
|
this fix has not been backported to stable branches.
|
|
The access to templates is blocked for all supported
|
|
branches except the old 3.6 branch, because this branch
|
|
doesn't have .htaccess in the bzr repository and cannot
|
|
be fixed easily for existing installations without
|
|
potentially conflicting with custom changes.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-3981</cvename>
|
|
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=785470</url>
|
|
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=785522</url>
|
|
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=785511</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-08-30</discovery>
|
|
<entry>2012-09-01</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="342176a8-f464-11e1-8bd8-0022156e8794">
|
|
<topic>GNU gatekeeper -- denial of service</topic>
|
|
<affects>
|
|
<package>
|
|
<name>gatekeeper</name>
|
|
<range><lt>3.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Jan Willamowius reports:</p>
|
|
<blockquote cite="http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-3534">
|
|
<p>GNU Gatekeeper before 3.1 does not limit the number
|
|
of connections to the status port, which allows remote
|
|
attackers to cause a denial of service (connection and
|
|
thread consumption) via a large number of connections.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-3534</cvename>
|
|
<url>http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-3534</url>
|
|
<url>http://www.openwall.com/lists/oss-security/2012/08/25/4</url>
|
|
<url>http://www.gnugk.org/gnugk-3.1.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-08-15</discovery>
|
|
<entry>2012-09-01</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="7c0fecd6-f42f-11e1-b17b-000c2977ec30">
|
|
<topic>mediawiki -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>mediawiki</name>
|
|
<range><ge>1.19</ge><lt>1.19.2</lt></range>
|
|
<range><ge>1.18</ge><lt>1.18.5</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Mediawiki reports:</p>
|
|
<blockquote cite="http://lists.wikimedia.org/pipermail/mediawiki-announce/2012-August/000119.html">
|
|
<p>(Bug 39700) Wikipedia administrator Writ Keeper discovered
|
|
a stored XSS (HTML injection) vulnerability. This was
|
|
possible due to the handling of link text on File: links for
|
|
nonexistent files. MediaWiki 1.16 and later is affected.</p>
|
|
<p>(Bug 39180) User Fomafix reported several DOM-based XSS
|
|
vulnerabilities, made possible by a combination of loose
|
|
filtering of the uselang parameter, and JavaScript gadgets
|
|
on various language Wikipedias.</p>
|
|
<p>(Bug 39180) During internal review, it was discovered that
|
|
CSRF tokens, available via the api, were not protected with
|
|
X-Frame-Options headers. This could lead to a CSRF vulnerability
|
|
if the API response is embedded in an external website using
|
|
using an iframe.</p>
|
|
<p>(Bug 39824) During internal review, it was discovered extensions
|
|
were not always allowed to prevent the account creation action.
|
|
This allowed users blocked by the GlobalBlocking extension to
|
|
create accounts.</p>
|
|
<p>(Bug 39184) During internal review, it was discovered that
|
|
password data was always saved to the local MediaWiki database
|
|
even if authentication was handled by an extension, such as LDAP.
|
|
This could allow a compromised MediaWiki installation to leak
|
|
information about user's LDAP passwords. Additionally, in situations
|
|
when an authentication plugin returned false in its strict
|
|
function, this would allow old passwords to be used for accounts
|
|
that did not exist in the external system, indefinitely.</p>
|
|
<p>(Bug 39823) During internal review, it was discovered that metadata
|
|
about blocks, hidden by a user with suppression rights, was visible
|
|
to administrators.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>https://bugzilla.wikimedia.org/show_bug.cgi?id=39700</url>
|
|
<url>https://bugzilla.wikimedia.org/show_bug.cgi?id=37587</url>
|
|
<url>https://bugzilla.wikimedia.org/show_bug.cgi?id=39180</url>
|
|
<url>https://bugzilla.wikimedia.org/show_bug.cgi?id=39824</url>
|
|
<url>https://bugzilla.wikimedia.org/show_bug.cgi?id=39184</url>
|
|
<url>https://bugzilla.wikimedia.org/show_bug.cgi?id=39823</url>
|
|
<cvename>CVE-2012-4377</cvename>
|
|
<cvename>CVE-2012-4378</cvename>
|
|
<cvename>CVE-2012-4379</cvename>
|
|
<cvename>CVE-2012-4380</cvename>
|
|
<cvename>CVE-2012-4381</cvename>
|
|
<cvename>CVE-2012-4382</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-08-27</discovery>
|
|
<entry>2012-09-01</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="5415f1b3-f33d-11e1-8bd8-0022156e8794">
|
|
<topic>wireshark -- denial of service in DRDA dissector</topic>
|
|
<affects>
|
|
<package>
|
|
<name>wireshark</name>
|
|
<range><ge>1.5</ge><lt>1.8.2_1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>wireshark-lite</name>
|
|
<range><ge>1.5</ge><lt>1.8.2_1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>tshark</name>
|
|
<range><ge>1.5</ge><lt>1.8.2_1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>tshark-lite</name>
|
|
<range><ge>1.5</ge><lt>1.8.2_1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>RedHat security team reports:</p>
|
|
<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=849926">
|
|
<p>A denial of service flaw was found in the way Distributed
|
|
Relational Database Architecture (DRDA) dissector of
|
|
Wireshark, a network traffic analyzer, performed processing
|
|
of certain DRDA packet capture files. A remote attacker
|
|
could create a specially-crafted capture file that, when
|
|
opened could lead to wireshark executable to consume
|
|
excessive amount of CPU time and hang with an infinite
|
|
loop.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-3548</cvename>
|
|
<url>https://bugzilla.redhat.com/show_bug.cgi?id=849926</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-08-21</discovery>
|
|
<entry>2012-08-31</entry>
|
|
<modified>2012-09-05</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="ee68923d-f2f5-11e1-8014-00262d5ed8ee">
|
|
<topic>chromium -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>chromium</name>
|
|
<range><lt>21.0.1180.89</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Google Chrome Releases reports:</p>
|
|
<blockquote cite="http://googlechromereleases.blogspot.nl/search/label/Stable%20updates">
|
|
<p>[121347] Medium CVE-2012-2865: Out-of-bounds read in line breaking.
|
|
Credit to miaubiz.</p>
|
|
<p>[134897] High CVE-2012-2866: Bad cast with run-ins. Credit to
|
|
miaubiz.</p>
|
|
<p>[135485] Low CVE-2012-2867: Browser crash with SPDY.</p>
|
|
<p>[136881] Medium CVE-2012-2868: Race condition with workers and XHR.
|
|
Credit to miaubiz.</p>
|
|
<p>[137778] High CVE-2012-2869: Avoid stale buffer in URL loading.
|
|
Credit to Fermin Serna of the Google Security Team.</p>
|
|
<p>[138672] [140368] Low CVE-2012-2870: Lower severity memory
|
|
management issues in XPath. Credit to Nicolas Gregoire.</p>
|
|
<p>[138673] High CVE-2012-2871: Bad cast in XSL transforms. Credit to
|
|
Nicolas Gregoire.</p>
|
|
<p>[142956] Medium CVE-2012-2872: XSS in SSL interstitial. Credit to
|
|
Emmanuel Bronshtein.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-2865</cvename>
|
|
<cvename>CVE-2012-2866</cvename>
|
|
<cvename>CVE-2012-2867</cvename>
|
|
<cvename>CVE-2012-2868</cvename>
|
|
<cvename>CVE-2012-2869</cvename>
|
|
<cvename>CVE-2012-2870</cvename>
|
|
<cvename>CVE-2012-2871</cvename>
|
|
<cvename>CVE-2012-2872</cvename>
|
|
<url>http://googlechromereleases.blogspot.nl/search/label/Stable%20updates</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-08-30</discovery>
|
|
<entry>2012-08-30</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="4c53f007-f2ed-11e1-a215-14dae9ebcf89">
|
|
<topic>asterisk -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>asterisk</name>
|
|
<range><gt>10.*</gt><lt>10.7.1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>asterisk18</name>
|
|
<range><gt>1.8.*</gt><lt>1.8.15.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Asterisk project reports:</p>
|
|
<blockquote cite="https://www.asterisk.org/security">
|
|
<p>Asterisk Manager User Unauthorized Shell Access</p>
|
|
<p>ACL rules ignored when placing outbound calls by certain IAX2
|
|
users</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-2186</cvename>
|
|
<cvename>CVE-2012-4737</cvename>
|
|
<url>http://downloads.digium.com/pub/security/AST-2012-012.html</url>
|
|
<url>http://downloads.digium.com/pub/security/AST-2012-013.html</url>
|
|
<url>https://www.asterisk.org/security</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-08-30</discovery>
|
|
<entry>2012-08-30</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="2b8cad90-f289-11e1-a215-14dae9ebcf89">
|
|
<topic>mozilla -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>firefox</name>
|
|
<range><gt>11.0,1</gt><lt>15.0,1</lt></range>
|
|
<range><lt>10.0.7,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-firefox</name>
|
|
<range><lt>10.0.7,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-seamonkey</name>
|
|
<range><lt>2.12</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-thunderbird</name>
|
|
<range><lt>10.0.7</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>seamonkey</name>
|
|
<range><lt>2.12</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>thunderbird</name>
|
|
<range><gt>11.0</gt><lt>15.0</lt></range>
|
|
<range><lt>10.0.7</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>libxul</name>
|
|
<range><gt>1.9.2.*</gt><lt>10.0.7</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Mozilla Project reports:</p>
|
|
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
|
|
<p>MFSA 2012-57 Miscellaneous memory safety hazards (rv:15.0/
|
|
rv:10.0.7)</p>
|
|
<p>MFSA 2012-58 Use-after-free issues found using Address
|
|
Sanitizer</p>
|
|
<p>MFSA 2012-59 Location object can be shadowed using
|
|
Object.defineProperty</p>
|
|
<p>MFSA 2012-60 Escalation of privilege through about:newtab</p>
|
|
<p>MFSA 2012-61 Memory corruption with bitmap format images with
|
|
negative height</p>
|
|
<p>MFSA 2012-62 WebGL use-after-free and memory corruption</p>
|
|
<p>MFSA 2012-63 SVG buffer overflow and use-after-free issues</p>
|
|
<p>MFSA 2012-64 Graphite 2 memory corruption</p>
|
|
<p>MFSA 2012-65 Out-of-bounds read in format-number in XSLT</p>
|
|
<p>MFSA 2012-66 HTTPMonitor extension allows for remote debugging
|
|
without explicit activation</p>
|
|
<p>MFSA 2012-67 Installer will launch incorrect executable following
|
|
new installation</p>
|
|
<p>MFSA 2012-68 DOMParser loads linked resources in extensions when
|
|
parsing text/html</p>
|
|
<p>MFSA 2012-69 Incorrect site SSL certificate data display</p>
|
|
<p>MFSA 2012-70 Location object security checks bypassed by chrome
|
|
code</p>
|
|
<p>MFSA 2012-71 Insecure use of __android_log_print</p>
|
|
<p>MFSA 2012-72 Web console eval capable of executing
|
|
chrome-privileged code</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-1956</cvename>
|
|
<cvename>CVE-2012-1970</cvename>
|
|
<cvename>CVE-2012-1971</cvename>
|
|
<cvename>CVE-2012-1972</cvename>
|
|
<cvename>CVE-2012-1973</cvename>
|
|
<cvename>CVE-2012-1974</cvename>
|
|
<cvename>CVE-2012-1975</cvename>
|
|
<cvename>CVE-2012-1976</cvename>
|
|
<cvename>CVE-2012-3956</cvename>
|
|
<cvename>CVE-2012-3957</cvename>
|
|
<cvename>CVE-2012-3958</cvename>
|
|
<cvename>CVE-2012-3959</cvename>
|
|
<cvename>CVE-2012-3960</cvename>
|
|
<cvename>CVE-2012-3961</cvename>
|
|
<cvename>CVE-2012-3962</cvename>
|
|
<cvename>CVE-2012-3963</cvename>
|
|
<cvename>CVE-2012-3964</cvename>
|
|
<cvename>CVE-2012-3965</cvename>
|
|
<cvename>CVE-2012-3966</cvename>
|
|
<cvename>CVE-2012-3967</cvename>
|
|
<cvename>CVE-2012-3968</cvename>
|
|
<cvename>CVE-2012-3969</cvename>
|
|
<cvename>CVE-2012-3970</cvename>
|
|
<cvename>CVE-2012-3971</cvename>
|
|
<cvename>CVE-2012-3972</cvename>
|
|
<cvename>CVE-2012-3973</cvename>
|
|
<cvename>CVE-2012-3974</cvename>
|
|
<cvename>CVE-2012-3975</cvename>
|
|
<cvename>CVE-2012-3976</cvename>
|
|
<cvename>CVE-2012-3978</cvename>
|
|
<cvename>CVE-2012-3979</cvename>
|
|
<cvename>CVE-2012-3980</cvename>
|
|
<url>http://www.mozilla.org/security/known-vulnerabilities/</url>
|
|
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-57.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-58.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-59.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-60.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-61.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-62.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-63.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-64.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-65.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-66.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-67.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-68.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-69.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-70.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-71.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-72.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-08-28</discovery>
|
|
<entry>2012-08-30</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="6dd5e45c-f084-11e1-8d0f-406186f3d89d">
|
|
<topic>coppermine -- Multiple vulnerabilites</topic>
|
|
<affects>
|
|
<package>
|
|
<name>coppermine</name>
|
|
<range><lt>1.5.20</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Coppermine Team reports:</p>
|
|
<blockquote cite="http://forum.coppermine-gallery.net/index.php/topic,74682.0.html">
|
|
<p>The release covers several path disclosure vulnerabilities. If
|
|
unpatched, it's possible to generate an error that will reveal the
|
|
full path of the script. A remote user can determine the full path
|
|
to the web root directory and other potentially sensitive
|
|
information. Furthermore, the release covers a recently discovered
|
|
XSS vulnerability that allows (if unpatched) a malevolent visitor to
|
|
include own script routines under certain conditions.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-1613</cvename>
|
|
<cvename>CVE-2012-1614</cvename>
|
|
<mlist>http://seclists.org/oss-sec/2012/q2/11</mlist>
|
|
<url>http://forum.coppermine-gallery.net/index.php/topic,74682.0.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-03-29</discovery>
|
|
<entry>2012-08-30</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="16846d1e-f1de-11e1-8bd8-0022156e8794">
|
|
<topic>Java 1.7 -- security manager bypass</topic>
|
|
<affects>
|
|
<package>
|
|
<name>openjdk</name>
|
|
<range><ge>7.0</ge><lt>7.6.24_1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-sun-jdk</name>
|
|
<range><ge>7.0</ge><lt>7.7</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-sun-jre</name>
|
|
<range><ge>7.0</ge><lt>7.7</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>US-CERT reports:</p>
|
|
<blockquote cite="http://www.kb.cert.org/vuls/id/636312">
|
|
<p>Oracle Java Runtime Environment (JRE) 1.7 contains a
|
|
vulnerability that may allow an applet to call
|
|
setSecurityManager in a way that allows setting of arbitrary
|
|
permissions.</p>
|
|
<p>By leveraging the public, privileged getField() function,
|
|
an untrusted Java applet can escalate its privileges by
|
|
calling the setSecurityManager() function to allow full
|
|
privileges, without requiring code signing.</p>
|
|
<p>This vulnerability is being actively exploited in the
|
|
wild, and exploit code is publicly available.</p>
|
|
</blockquote>
|
|
<p>This exploit does not only affect Java applets, but every
|
|
piece of software that relies on the Java Security Manager for
|
|
sandboxing executable code is affected: malicious code can
|
|
totally disable Security Manager.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-4681</cvename>
|
|
<certvu>636312</certvu>
|
|
<url>http://www.deependresearch.org/2012/08/java-7-vulnerability-analysis.html</url>
|
|
<url>http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2012-August/020065.html</url>
|
|
<url>http://www.oracle.com/technetwork/topics/security/alert-cve-2012-4681-1835715.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-08-27</discovery>
|
|
<entry>2012-08-30</entry>
|
|
<modified>2012-08-31</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="18ce9a90-f269-11e1-be53-080027ef73ec">
|
|
<topic>fetchmail -- chosen plaintext attack against SSL CBC initialization vectors</topic>
|
|
<affects>
|
|
<package>
|
|
<name>fetchmail</name>
|
|
<range><ge>6.3.9</ge><lt>6.3.22</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Matthias Andree reports:</p>
|
|
<blockquote cite="http://www.fetchmail.info/fetchmail-SA-2012-01.txt">
|
|
<p>Fetchmail version 6.3.9 enabled "all SSL workarounds" (SSL_OP_ALL)
|
|
which contains a switch to disable a countermeasure against certain
|
|
attacks against block ciphers that permit guessing the
|
|
initialization vectors, providing that an attacker can make the
|
|
application (fetchmail) encrypt some data for him -- which is not
|
|
easily the case.</p>
|
|
<p>Stream ciphers (such as RC4) are unaffected.</p>
|
|
<p>Credits to Apple Product Security for reporting this.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2011-3389</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-01-19</discovery>
|
|
<entry>2012-08-30</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="c906e0a4-efa6-11e1-8fbf-001b77d09812">
|
|
<topic>roundcube -- cross-site scripting in HTML email messages</topic>
|
|
<affects>
|
|
<package>
|
|
<name>roundcube</name>
|
|
<range><ge>0.8.0,1</ge><lt>0.8.1,1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>RoundCube branch 0.8.x prior to the version 0.8.1 is prone
|
|
to the cross-scripting attack (XSS) originating from incoming
|
|
HTML e-mails: due to the lack of proper sanitization
|
|
of JavaScript code inside the "href" attribute, sender
|
|
could launch XSS attack when recipient opens the message
|
|
in RoundCube interface.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-3508</cvename>
|
|
<url>http://trac.roundcube.net/wiki/Changelog</url>
|
|
<url>http://trac.roundcube.net/ticket/1488613</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-08-14</discovery>
|
|
<entry>2012-08-27</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="aa4d3d73-ef17-11e1-b593-00269ef07d24">
|
|
<topic>Calligra, KOffice -- input validation failure</topic>
|
|
<affects>
|
|
<package>
|
|
<name>koffice</name>
|
|
<range><le>1.6.3_18,2</le></range>
|
|
</package>
|
|
<package>
|
|
<name>koffice-kde4</name>
|
|
<range><le>2.3.3_7</le></range>
|
|
</package>
|
|
<package>
|
|
<name>calligra</name>
|
|
<range><lt>2.5.0</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>KDE Security Advisory reports:</p>
|
|
<blockquote cite="http://www.kde.org/info/security/advisory-20120810-1.txt">
|
|
<p>A flaw has been found which can allow malicious code to take
|
|
advantage of an input validation failure in the Microsoft import
|
|
filter in Calligra and KOffice. Exploitation can allow the attacker
|
|
to gain control of the running process and execute code on its
|
|
behalf.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-3455</cvename>
|
|
<cvename>CVE-2012-3456</cvename>
|
|
<url>http://www.kde.org/info/security/advisory-20120810-1.txt</url>
|
|
<url>http://media.blackhat.com/bh-us-12/Briefings/C_Miller/BH_US_12_Miller_NFC_attack_surface_WP.pdf</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-08-10</discovery>
|
|
<entry>2012-08-26</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="ce680f0a-eea6-11e1-8bd8-0022156e8794">
|
|
<topic>squidclamav -- cross-site scripting in default virus warning pages</topic>
|
|
<affects>
|
|
<package>
|
|
<name>squidclamav</name>
|
|
<range><lt>5.8</lt></range>
|
|
<range><ge>6.0</ge><lt>6.7</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>SquidClamav developers report:</p>
|
|
<blockquote cite="http://squidclamav.darold.net/news.html">
|
|
<p>This release fix several security issues by escaping CGI
|
|
parameters.</p>
|
|
</blockquote>
|
|
<p>Prior to versions 6.7 and 5.8, CGI script clwarn.cgi was not
|
|
properly sanitizing input variables, so they could be used to
|
|
inject arbitrary strings to the generated page, leading
|
|
to the cross-site scripting attacks.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-4667</cvename>
|
|
<url>http://squidclamav.darold.net/news.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-07-24</discovery>
|
|
<entry>2012-08-25</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="8defa0f9-ee8a-11e1-8bd8-0022156e8794">
|
|
<topic>squidclamav -- Denial of Service</topic>
|
|
<affects>
|
|
<package>
|
|
<name>squidclamav</name>
|
|
<range><lt>5.7_1</lt></range>
|
|
<range><ge>6.0</ge><lt>6.7</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>SquidClamav developers report:</p>
|
|
<blockquote cite="http://squidclamav.darold.net/news.html">
|
|
<p>Add a workaround for a squidGuard bug that unescape
|
|
the URL and send it back unescaped. This result in garbage
|
|
staying into pipe of the system command call and could crash
|
|
squidclamav on next read or return false information.
|
|
This is specially true with URL containing the %0D or %0A
|
|
character.</p>
|
|
</blockquote>
|
|
<p>This vulnerability can be triggered only in configurations
|
|
where external chained URL checker is configured via
|
|
"squidguard" directive.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-3501</cvename>
|
|
<url>http://squidclamav.darold.net/news.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-07-24</discovery>
|
|
<entry>2012-08-25</entry>
|
|
<modified>2012-09-04</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="a7975581-ee26-11e1-8bd8-0022156e8794">
|
|
<topic>inn -- plaintext command injection into encrypted channel</topic>
|
|
<affects>
|
|
<package>
|
|
<name>inn</name>
|
|
<range><lt>2.5.2_2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>INN developers report:</p>
|
|
<blockquote cite="https://www.isc.org/software/inn/2.5.3article">
|
|
<p>Fixed a possible plaintext command injection during the
|
|
negotiation of a TLS layer. The vulnerability detailed
|
|
in CVE-2011-0411 affects the STARTTLS and AUTHINFO SASL
|
|
commands. nnrpd now resets its read buffer upon
|
|
a successful negotiation of a TLS layer. It prevents
|
|
malicious commands, sent unencrypted, from being executed
|
|
in the new encrypted state of the session.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-3523</cvename>
|
|
<cvename>CVE-2011-0411</cvename>
|
|
<url>https://www.isc.org/software/inn/2.5.3article</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-08-14</discovery>
|
|
<entry>2012-08-25</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="4d1d2f6d-ec94-11e1-8bd8-0022156e8794">
|
|
<topic>jabberd -- domain spoofing in server dialback protocol</topic>
|
|
<affects>
|
|
<package>
|
|
<name>jabberd</name>
|
|
<range><lt>2.2.16_2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>XMPP Standards Foundation reports:</p>
|
|
<blockquote cite="http://xmpp.org/resources/security-notices/server-dialback/">
|
|
<p>Some implementations of the XMPP Server Dialback protocol
|
|
(RFC 3920/XEP-0220) have not been checking dialback
|
|
responses to ensure that validated results are correlated
|
|
with requests.</p>
|
|
<p>An attacking server could spoof one or more domains in
|
|
communicating with a vulnerable server implementation,
|
|
thereby avoiding the protections built into the Server
|
|
Dialback protocol.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-3525</cvename>
|
|
<url>http://xmpp.org/resources/security-notices/server-dialback/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-08-21</discovery>
|
|
<entry>2012-08-23</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="a4598875-ec91-11e1-8bd8-0022156e8794">
|
|
<topic>rssh -- configuration restrictions bypass</topic>
|
|
<affects>
|
|
<package>
|
|
<name>rssh</name>
|
|
<range><lt>2.3.3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Derek Martin (rssh maintainer) reports:</p>
|
|
<blockquote cite="http://www.pizzashack.org/rssh/security.shtml">
|
|
<p>John Barber reported a problem where, if the system
|
|
administrator misconfigures rssh by providing too few access
|
|
bits in the configuration file, the user will be given
|
|
default permissions (scp) to the entire system, potentially
|
|
circumventing any configured chroot. Fixing this required a
|
|
behavior change: in the past, using rssh without a config
|
|
file would give all users default access to use scp on an
|
|
unchrooted system. In order to correct the reported bug,
|
|
this feature has been eliminated, and you must now have a
|
|
valid configuration file. If no config file exists, all
|
|
users will be locked out.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://www.pizzashack.org/rssh/security.shtml</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-08-01</discovery>
|
|
<entry>2012-08-22</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="65b25acc-e63b-11e1-b81c-001b77d09812">
|
|
<topic>rssh -- arbitrary command execution</topic>
|
|
<affects>
|
|
<package>
|
|
<name>rssh</name>
|
|
<range><lt>2.3.4</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Derek Martin (rssh maintainer) reports:</p>
|
|
<blockquote cite="http://sourceforge.net/mailarchive/message.php?msg_id=29235647">
|
|
<p>Henrik Erkkonen has discovered that, through clever
|
|
manipulation of environment variables on the ssh command
|
|
line, it is possible to circumvent rssh. As far as I can
|
|
tell, there is no way to effect a root compromise, except of
|
|
course if the root account is the one you're attempting to
|
|
protect with rssh...</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>53430</bid>
|
|
<cvename>CVE-2012-3478</cvename>
|
|
<url>http://sourceforge.net/mailarchive/message.php?msg_id=29235647</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-05-08</discovery>
|
|
<entry>2012-08-22</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="c651c898-e90d-11e1-b230-0024e830109b">
|
|
<topic>libotr -- buffer overflows</topic>
|
|
<affects>
|
|
<package>
|
|
<name>libotr</name>
|
|
<range><lt>3.2.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>OTR developers report:</p>
|
|
<blockquote cite="http://lists.cypherpunks.ca/pipermail/otr-dev/2012-July/001347.html">
|
|
<p>The otrl_base64_otr_decode() function and similar functions within OTR
|
|
suffer from buffer overflows in the case of malformed input;
|
|
specifically if a message of the format of "?OTR:===." is received
|
|
then a zero-byte allocation is performed without a similar correlation
|
|
between the subsequent base64 decoding write, as such it becomes
|
|
possible to write between zero and three bytes incorrectly to the
|
|
heap, albeit only with a value of '='.</p>
|
|
<p>Because this code path is highly utilized, specifically in the
|
|
reception of instant messages over pidgin or similar, this
|
|
vulnerability is considered severe even though in many platforms and
|
|
circumstances the bug would yield an unexploitable state and result
|
|
simply in denial of service.</p>
|
|
<p>The developers of OTR promptly fixed the errors and users of OTR are
|
|
advised to upgrade the software at the next release cycle.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-3461</cvename>
|
|
<url>http://lists.cypherpunks.ca/pipermail/otr-dev/2012-July/001347.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-07-27</discovery>
|
|
<entry>2012-08-18</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="0f62be39-e8e0-11e1-bea0-002354ed89bc">
|
|
<topic>OpenTTD -- Denial of Service</topic>
|
|
<affects>
|
|
<package>
|
|
<name>openttd</name>
|
|
<range><le>1.2.1</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>OpenTTD reports:</p>
|
|
<blockquote cite="http://security.openttd.org/en/CVE-2012-3436">
|
|
<p>Denial of service (server) using ships on half tiles and
|
|
landscaping.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-3436</cvename>
|
|
<url>http://security.openttd.org/en/CVE-2012-3436</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-07-25</discovery>
|
|
<entry>2012-08-18</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="4cdfe875-e8d6-11e1-bea0-002354ed89bc">
|
|
<topic>Wireshark -- Multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>wireshark</name>
|
|
<range><lt>1.8.2</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>wireshark-lite</name>
|
|
<range><lt>1.8.2</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>tshark</name>
|
|
<range><lt>1.8.2</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>tshark-lite</name>
|
|
<range><lt>1.8.2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Wireshark reports:</p>
|
|
<blockquote cite="http://www.wireshark.org/docs/relnotes/wireshark-1.8.2.html">
|
|
<p>It may be possible to make Wireshark crash by injecting a
|
|
malformed packet onto the wire or by convincing someone to read a
|
|
malformed packet trace file.</p>
|
|
<p>It may be possible to make Wireshark consume excessive CPU
|
|
resources by injecting a malformed packet onto the wire or by
|
|
convincing someone to read a malformed packet trace file.</p>
|
|
<p>The PPP dissector could crash.</p>
|
|
<p>The NFS dissector could use excessive amounts of CPU.</p>
|
|
<p>The DCP ETSI dissector could trigger a zero division.</p>
|
|
<p>The MongoDB dissector could go into a large loop.</p>
|
|
<p>The XTP dissector could go into an infinite loop.</p>
|
|
<p>The ERF dissector could overflow a buffer.</p>
|
|
<p>The AFP dissector could go into a large loop.</p>
|
|
<p>The RTPS2 dissector could overflow a buffer.</p>
|
|
<p>The GSM RLC MAC dissector could overflow a buffer.</p>
|
|
<p>The CIP dissector could exhaust system memory.</p>
|
|
<p>The STUN dissector could crash.</p>
|
|
<p>The EtherCAT Mailbox dissector could abort.</p>
|
|
<p>The CTDB dissector could go into a large loop.</p>
|
|
<p>The pcap-ng file parser could trigger a zero division.</p>
|
|
<p>The Ixia IxVeriWave file parser could overflow a buffer.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-4048</cvename>
|
|
<cvename>CVE-2012-4049</cvename>
|
|
<cvename>CVE-2012-4285</cvename>
|
|
<cvename>CVE-2012-4286</cvename>
|
|
<cvename>CVE-2012-4287</cvename>
|
|
<cvename>CVE-2012-4288</cvename>
|
|
<cvename>CVE-2012-4289</cvename>
|
|
<cvename>CVE-2012-4290</cvename>
|
|
<cvename>CVE-2012-4291</cvename>
|
|
<cvename>CVE-2012-4292</cvename>
|
|
<cvename>CVE-2012-4293</cvename>
|
|
<cvename>CVE-2012-4294</cvename>
|
|
<cvename>CVE-2012-4295</cvename>
|
|
<cvename>CVE-2012-4296</cvename>
|
|
<cvename>CVE-2012-4297</cvename>
|
|
<cvename>CVE-2012-4298</cvename>
|
|
<url>http://www.wireshark.org/security/wnpa-sec-2012-11.html</url>
|
|
<url>http://www.wireshark.org/security/wnpa-sec-2012-12.html</url>
|
|
<url>http://www.wireshark.org/security/wnpa-sec-2012-13.html</url>
|
|
<url>http://www.wireshark.org/security/wnpa-sec-2012-14.html</url>
|
|
<url>http://www.wireshark.org/security/wnpa-sec-2012-15.html</url>
|
|
<url>http://www.wireshark.org/security/wnpa-sec-2012-16.html</url>
|
|
<url>http://www.wireshark.org/security/wnpa-sec-2012-17.html</url>
|
|
<url>http://www.wireshark.org/security/wnpa-sec-2012-18.html</url>
|
|
<url>http://www.wireshark.org/security/wnpa-sec-2012-19.html</url>
|
|
<url>http://www.wireshark.org/security/wnpa-sec-2012-20.html</url>
|
|
<url>http://www.wireshark.org/security/wnpa-sec-2012-21.html</url>
|
|
<url>http://www.wireshark.org/security/wnpa-sec-2012-22.html</url>
|
|
<url>http://www.wireshark.org/security/wnpa-sec-2012-23.html</url>
|
|
<url>http://www.wireshark.org/security/wnpa-sec-2012-24.html</url>
|
|
<url>http://www.wireshark.org/security/wnpa-sec-2012-25.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-07-22</discovery>
|
|
<entry>2012-08-18</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="07234e78-e899-11e1-b38d-0023ae8e59f0">
|
|
<topic>databases/postgresql*-server -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>postgresql-server</name>
|
|
<range><gt>8.3.*</gt><lt>8.3.20</lt></range>
|
|
<range><gt>8.4.*</gt><lt>8.4.13</lt></range>
|
|
<range><gt>9.0.*</gt><lt>9.0.9</lt></range>
|
|
<range><gt>9.1.*</gt><lt>9.1.5</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The PostgreSQL Global Development Group reports:</p>
|
|
<blockquote cite="http://www.postgresql.org/about/news/1407/">
|
|
<p>The PostgreSQL Global Development Group today released
|
|
security updates for all active branches of the PostgreSQL
|
|
database system, including versions 9.1.5, 9.0.9, 8.4.13 and
|
|
8.3.20. This update patches security holes associated with
|
|
libxml2 and libxslt, similar to those affecting other open
|
|
source projects. All users are urged to update their
|
|
installations at the first available opportunity</p>
|
|
<p>Users who are relying on the built-in XML functionality to
|
|
validate external DTDs will need to implement a workaround, as
|
|
this security patch disables that functionality. Users who are
|
|
using xslt_process() to fetch documents or stylesheets from
|
|
external URLs will no longer be able to do so. The PostgreSQL
|
|
project regrets the need to disable both of these features in
|
|
order to maintain our security standards. These security issues
|
|
with XML are substantially similar to issues patched recently
|
|
by the Webkit (CVE-2011-1774), XMLsec (CVE-2011-1425) and PHP5
|
|
(CVE-2012-0057) projects.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-3488</cvename>
|
|
<cvename>CVE-2012-3489</cvename>
|
|
<url>http://www.postgresql.org/about/news/1407/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-08-17</discovery>
|
|
<entry>2012-08-17</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="db1d3340-e83b-11e1-999b-e0cb4e266481">
|
|
<topic>phpMyAdmin -- Multiple XSS in Table operations, Database structure, Trigger and Visualize GIS data pages</topic>
|
|
<affects>
|
|
<package>
|
|
<name>phpMyAdmin</name>
|
|
<range><lt>3.5.2.2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The phpMyAdmin development team reports:</p>
|
|
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2012-4.php">
|
|
<p>Using a crafted table name, it was possible to produce a
|
|
XSS : 1) On the Database Structure page, creating a new
|
|
table with a crafted name 2) On the Database Structure page,
|
|
using the Empty and Drop links of the crafted table name 3)
|
|
On the Table Operations page of a crafted table, using the
|
|
'Empty the table (TRUNCATE)' and 'Delete the table (DROP)'
|
|
links 4) On the Triggers page of a database containing
|
|
tables with a crafted name, when opening the 'Add Trigger'
|
|
popup 5) When creating a trigger for a table with a crafted
|
|
name, with an invalid definition. Having crafted data in a
|
|
database table, it was possible to produce a XSS : 6) When
|
|
visualizing GIS data, having a crafted label name.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-4345</cvename>
|
|
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2012-4.php</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-08-12</discovery>
|
|
<entry>2012-08-17</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="48bcb4b2-e708-11e1-a59d-000d601460a4">
|
|
<topic>typo3 -- Multiple vulernabilities in TYPO3 Core</topic>
|
|
<affects>
|
|
<package>
|
|
<name>typo3</name>
|
|
<range><ge>4.5.0</ge><lt>4.5.19</lt></range>
|
|
<range><ge>4.6.0</ge><lt>4.6.12</lt></range>
|
|
<range><ge>4.7.0</ge><lt>4.7.4</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Typo Security Team reports:</p>
|
|
<blockquote cite="https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2012-004/">
|
|
<p>It has been discovered that TYPO3 Core is vulnerable to Cross-Site
|
|
Scripting, Information Disclosure, Insecure Unserialize leading to
|
|
Arbitrary Code Execution.</p>
|
|
<p>TYPO3 Backend Help System - Due to a missing signature (HMAC) for a
|
|
parameter in the view_help.php file, an attacker could unserialize
|
|
arbitrary objects within TYPO3. We are aware of a working exploit,
|
|
which can lead to arbitrary code execution. A valid backend user
|
|
login or multiple successful cross site request forgery attacks are
|
|
required to exploit this vulnerability.</p>
|
|
<p>TYPO3 Backend - Failing to properly HTML-encode user input in
|
|
several places, the TYPO3 backend is susceptible to Cross-Site
|
|
Scripting. A valid backend user is required to exploit these
|
|
vulnerabilities.</p>
|
|
<p>TYPO3 Backend - Accessing the configuration module discloses the
|
|
Encryption Key. A valid backend user with access to the
|
|
configuration module is required to exploit this vulnerability.</p>
|
|
<p>TYPO3 HTML Sanitizing API - By not removing several HTML5
|
|
JavaScript events, the API method t3lib_div::RemoveXSS() fails to
|
|
filter specially crafted HTML injections, thus is susceptible to
|
|
Cross-Site Scripting. Failing to properly encode for JavaScript the
|
|
API method t3lib_div::quoteJSvalue(), it is susceptible to Cross-Site
|
|
Scripting.</p>
|
|
<p>TYPO3 Install Tool - Failing to properly sanitize user input, the
|
|
Install Tool is susceptible to Cross-Site Scripting.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2012-004/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-08-15</discovery>
|
|
<entry>2012-08-15</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="83f9e943-e664-11e1-a66d-080027ef73ec">
|
|
<topic>fetchmail -- two vulnerabilities in NTLM authentication</topic>
|
|
<affects>
|
|
<package>
|
|
<name>fetchmail</name>
|
|
<range><ge>5.0.8</ge><lt>6.3.21_1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Matthias Andree reports:</p>
|
|
<blockquote cite="http://www.fetchmail.info/fetchmail-SA-2012-02.txt">
|
|
<p>With NTLM support enabled, fetchmail might mistake a server-side
|
|
error message during NTLM protocol exchange for protocol data,
|
|
leading to a SIGSEGV.</p>
|
|
<p>Also, with a carefully crafted NTLM challenge, a malicious server
|
|
might cause fetchmail to read from a bad memory location, betraying
|
|
confidential data. It is deemed hard, although not impossible, to
|
|
steal other accounts' data.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-3482</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-08-12</discovery>
|
|
<entry>2012-08-14</entry>
|
|
<modified>2012-08-27</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="55b498e2-e56c-11e1-bbd5-001c25e46b1d">
|
|
<topic>Several vulnerabilities found in IcedTea-Web</topic>
|
|
<affects>
|
|
<package>
|
|
<name>icedtea-web</name>
|
|
<range><lt>1.2.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The IcedTea project team reports:</p>
|
|
<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=840592">
|
|
<p>CVE-2012-3422: Use of uninitialized instance pointers</p>
|
|
<p>An uninitialized pointer use flaw was found in IcedTea-Web web
|
|
browser plugin. A malicious web page could use this flaw make
|
|
IcedTea-Web browser plugin pass invalid pointer to a web browser.
|
|
Depending on the browser used, it may cause the browser to crash
|
|
or possibly execute arbitrary code.</p>
|
|
<p>The get_cookie_info() and get_proxy_info() call
|
|
getFirstInTableInstance() with the instance_to_id_map hash as
|
|
a parameter. If instance_to_id_map is empty (which can happen
|
|
when plugin was recently removed), getFirstInTableInstance()
|
|
returns an uninitialized pointer.</p>
|
|
</blockquote>
|
|
<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=841345">
|
|
<p>CVE-2012-3423: Incorrect handling of non 0-terminated strings</p>
|
|
<p>It was discovered that the IcedTea-Web web browser plugin
|
|
incorrectly assumed that all strings provided by browser are NUL
|
|
terminated, which is not guaranteed by the NPAPI (Netscape Plugin
|
|
Application Programming Interface). When used in a browser that
|
|
does not NUL terminate NPVariant NPStrings, this could lead to
|
|
buffer over-read or over-write, resulting in possible information
|
|
leak, crash, or code execution.</p>
|
|
<p>Mozilla browsers currently NUL terminate strings, however recent
|
|
Chrome versions are known not to provide NUL terminated data.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-3422</cvename>
|
|
<cvename>CVE-2012-3423</cvename>
|
|
<mlist>http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2012-July/019580.html</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-07-31</discovery>
|
|
<entry>2012-08-13</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="a14dee30-e3d7-11e1-a084-50e5492bd3dc">
|
|
<topic>libcloud -- possible SSL MITM due to invalid regexp used to validate target server hostname</topic>
|
|
<affects>
|
|
<package>
|
|
<name>py-libcloud</name>
|
|
<range><lt>0.11.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The libcloud development team reports:</p>
|
|
<blockquote cite="http://libcloud.apache.org/security.html">
|
|
<p>When establishing a secure (SSL / TLS) connection to a target server an invalid regular
|
|
expression has been used for performing the hostname verification. Subset instead of the
|
|
full target server hostname has been marked an an acceptable match for the given hostname.
|
|
For example, certificate with a hostname field of "aexample.com" was considered a valid
|
|
certificate for domain "example.com".</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-3446</cvename>
|
|
<url>http://seclists.org/fulldisclosure/2012/Aug/55</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-08-01</discovery>
|
|
<entry>2012-08-11</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="aca0d7e0-e38a-11e1-999b-e0cb4e266481">
|
|
<topic>phpMyAdmin -- Path disclosure due to missing library</topic>
|
|
<affects>
|
|
<package>
|
|
<name>phpMyAdmin</name>
|
|
<range><lt>3.5.2.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The phpMyAdmin development team reports:</p>
|
|
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2012-3.php">
|
|
<p>The show_config_errors.php script does not include a
|
|
library, so an error message shows the full path of this
|
|
file, leading to possible further attacks.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-4219</cvename>
|
|
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2012-3.php</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-08-03</discovery>
|
|
<entry>2012-08-11</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="60bbe12c-e2c1-11e1-a8ca-00262d5ed8ee">
|
|
<topic>chromium -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>chromium</name>
|
|
<range><lt>21.0.1180.75</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Google Chrome Releases reports:</p>
|
|
<blockquote cite="http://googlechromereleases.blogspot.nl/search/label/Stable%20updates">
|
|
<p>[136643] [137721] [137957] High CVE-2012-2862: Use-after-free in
|
|
PDF viewer. Credit to Mateusz Jurczyk of Google Security Team, with
|
|
contributions by Gynvael Coldwind of Google Security Team.</p>
|
|
<p>[136968] [137361] High CVE-2012-2863: Out-of-bounds writes in PDF
|
|
viewer. Credit to Mateusz Jurczyk of Google Security Team, with
|
|
contributions by Gynvael Coldwind of Google Security Team.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-2862</cvename>
|
|
<cvename>CVE-2012-2863</cvename>
|
|
<url>http://googlechromereleases.blogspot.com/search/label/Stable%20updates</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-08-08</discovery>
|
|
<entry>2012-08-10</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="ce84e136-e2f6-11e1-a8ca-00262d5ed8ee">
|
|
<topic>chromium -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>chromium</name>
|
|
<range><lt>21.0.1180.60</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Google Chrome Releases reports:</p>
|
|
<blockquote cite="http://googlechromereleases.blogspot.nl/search/label/Stable%20updates">
|
|
<p>[Linux only] [125225] Medium CVE-2012-2846: Cross-process
|
|
interference in renderers. Credit to Google Chrome Security Team
|
|
(Julien Tinnes).</p>
|
|
<p>[127522] Low CVE-2012-2847: Missing re-prompt to user upon
|
|
excessive downloads. Credit to Matt Austin of Aspect Security.</p>
|
|
<p>[127525] Medium CVE-2012-2848: Overly broad file access granted
|
|
after drag+drop. Credit to Matt Austin of Aspect Security.</p>
|
|
<p>[128163] Low CVE-2012-2849: Off-by-one read in GIF decoder. Credit
|
|
to Atte Kettunen of OUSPG.</p>
|
|
<p>[130251] [130592] [130611] [131068] [131237] [131252] [131621]
|
|
[131690] [132860] Medium CVE-2012-2850: Various lower severity
|
|
issues in the PDF viewer. Credit to Mateusz Jurczyk of Google
|
|
Security Team, with contributions by Gynvael Coldwind of Google
|
|
Security Team.</p>
|
|
<p>[132585] [132694] [132861] High CVE-2012-2851: Integer overflows in
|
|
PDF viewer. Credit to Mateusz Jurczyk of Google Security Team, with
|
|
contributions by Gynvael Coldwind of Google Security Team.</p>
|
|
<p>[134028] High CVE-2012-2852: Use-after-free with bad object linkage
|
|
in PDF. Credit to Alexey Samsonov of Google.</p>
|
|
<p>[134101] Medium CVE-2012-2853: webRequest can interfere with the
|
|
Chrome Web Store. Credit to Trev of Adblock.</p>
|
|
<p>[134519] Low CVE-2012-2854: Leak of pointer values to WebUI
|
|
renderers. Credit to Nasko Oskov of the Chromium development
|
|
community.</p>
|
|
<p>[134888] High CVE-2012-2855: Use-after-free in PDF viewer. Credit
|
|
to Mateusz Jurczyk of Google Security Team, with contributions by
|
|
Gynvael Coldwind of Google Security Team.</p>
|
|
<p>[134954] [135264] High CVE-2012-2856: Out-of-bounds writes in PDF
|
|
viewer. Credit to Mateusz Jurczyk of Google Security Team, with
|
|
contributions by Gynvael Coldwind of Google Security Team.</p>
|
|
<p>[136235] High CVE-2012-2857: Use-after-free in CSS DOM. Credit to
|
|
Arthur Gerkis.</p>
|
|
<p>[136894] High CVE-2012-2858: Buffer overflow in WebP decoder.
|
|
Credit to Juri Aedla.</p>
|
|
<p>[Linux only] [137541] Critical CVE-2012-2859: Crash in tab
|
|
handling. Credit to Jeff Roberts of Google Security Team.</p>
|
|
<p>[137671] Medium CVE-2012-2860: Out-of-bounds access when clicking
|
|
in date picker. Credit to Chamal de Silva.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-2846</cvename>
|
|
<cvename>CVE-2012-2847</cvename>
|
|
<cvename>CVE-2012-2848</cvename>
|
|
<cvename>CVE-2012-2849</cvename>
|
|
<cvename>CVE-2012-2850</cvename>
|
|
<cvename>CVE-2012-2851</cvename>
|
|
<cvename>CVE-2012-2852</cvename>
|
|
<cvename>CVE-2012-2853</cvename>
|
|
<cvename>CVE-2012-2854</cvename>
|
|
<cvename>CVE-2012-2855</cvename>
|
|
<cvename>CVE-2012-2856</cvename>
|
|
<cvename>CVE-2012-2857</cvename>
|
|
<cvename>CVE-2012-2858</cvename>
|
|
<cvename>CVE-2012-2859</cvename>
|
|
<cvename>CVE-2012-2860</cvename>
|
|
<url>http://googlechromereleases.blogspot.com/search/label/Stable%20updates</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-07-31</discovery>
|
|
<entry>2012-08-10</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="2092a45b-e2f6-11e1-a8ca-00262d5ed8ee">
|
|
<topic>www/chromium -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>chromium</name>
|
|
<range><lt>20.0.1132.57</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Google Chrome Releases reports:</p>
|
|
<blockquote cite="http://googlechromereleases.blogspot.nl/search/label/Stable%20updates">
|
|
<p>[129898] High CVE-2012-2842: Use-after-free in counter handling.
|
|
Credit to miaubiz.</p>
|
|
<p>[130595] High CVE-2012-2843: Use-after-free in layout height
|
|
tracking. Credit to miaubiz.</p>
|
|
<p>[133450] High CVE-2012-2844: Bad object access with JavaScript in
|
|
PDF. Credit to Alexey Samsonov of Google.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-2842</cvename>
|
|
<cvename>CVE-2012-2843</cvename>
|
|
<cvename>CVE-2012-2844</cvename>
|
|
<url>http://googlechromereleases.blogspot.com/search/label/Stable%20updates</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-07-11</discovery>
|
|
<entry>2012-08-10</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="31db9a18-e289-11e1-a57d-080027a27dbf">
|
|
<topic>rubygem-rails -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>rubygem-rails</name>
|
|
<range><lt>3.2.8</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>rubygem-actionpack</name>
|
|
<range><lt>3.2.8</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>rubygem-activesupport</name>
|
|
<range><lt>3.2.8</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Rails core team reports:</p>
|
|
<blockquote cite="http://weblog.rubyonrails.org/2012/8/9/ann-rails-3-2-8-has-been-released/">
|
|
<p>This version contains three important security fixes, please upgrade immediately.</p>
|
|
<p>One of security fixes impacts all users and is related to HTML escaping code. The
|
|
other two fixes impacts people using select_tag's prompt option and strip_tags
|
|
helper from ActionPack.</p>
|
|
<p>CVE-2012-3463 Potential XSS Vulnerability in select_tag prompt.</p>
|
|
<p>CVE-2012-3464 Potential XSS Vulnerability in the HTML escaping code.</p>
|
|
<p>CVE-2012-3465 XSS Vulnerability in strip_tags.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-3463</cvename>
|
|
<cvename>CVE-2012-3464</cvename>
|
|
<cvename>CVE-2012-3465</cvename>
|
|
<url>https://groups.google.com/d/msg/rubyonrails-security/fV3QUToSMSw/eHBSFOUYHpYJ</url>
|
|
<url>https://groups.google.com/d/msg/rubyonrails-security/kKGNeMrnmiY/r2yM7xy-G48J</url>
|
|
<url>https://groups.google.com/d/msg/rubyonrails-security/FgVEtBajcTY/tYLS1JJTu38J</url>
|
|
<url>http://weblog.rubyonrails.org/2012/8/9/ann-rails-3-2-8-has-been-released/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-08-08</discovery>
|
|
<entry>2012-08-10</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="8675efd5-e22c-11e1-a808-002354ed89bc">
|
|
<topic>sudosh -- buffer overflow</topic>
|
|
<affects>
|
|
<package>
|
|
<name>sudosh2</name>
|
|
<range><le>1.0.2</le></range>
|
|
</package>
|
|
<package>
|
|
<name>sudosh3</name>
|
|
<range><le>3.2.0_2</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>ISS reports:</p>
|
|
<blockquote cite="http://xforce.iss.net/xforce/xfdb/55903">
|
|
<p>sudosh2 and sudosh3 are vulnerable to a stack-based buffer
|
|
overflow, caused by improper bounds checking by the replay()
|
|
function. By persuading a victim to replay a specially-crafted
|
|
recorded sudo session, a local attacker could overflow a buffer
|
|
and execute arbitrary code on the system with elevated privileges
|
|
or cause the application to crash.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://xforce.iss.net/xforce/xfdb/55903</url>
|
|
<url>http://secunia.com/advisories/38349</url>
|
|
<url>http://secunia.com/advisories/38292</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-01-17</discovery>
|
|
<entry>2012-08-09</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="0f020b7b-e033-11e1-90a2-000c299b62e1">
|
|
<topic>FreeBSD -- named(8) DNSSEC validation Denial of Service</topic>
|
|
<affects>
|
|
<package>
|
|
<name>FreeBSD</name>
|
|
<range><ge>7.4</ge><lt>7.4_10</lt></range>
|
|
<range><ge>8.1</ge><lt>8.1_13</lt></range>
|
|
<range><ge>8.2</ge><lt>8.2_10</lt></range>
|
|
<range><ge>8.3</ge><lt>8.3_4</lt></range>
|
|
<range><ge>9.0</ge><lt>9.0_4</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Problem description:</p>
|
|
<blockquote cite="http://security.freebsd.org/advisories/FreeBSD-SA-12:05.bind.asc">
|
|
<p>BIND 9 stores a cache of query names that are known to be failing
|
|
due to misconfigured name servers or a broken chain of trust.
|
|
Under high query loads, when DNSSEC validation is active, it is
|
|
possible for a condition to arise in which data from this cache of
|
|
failing queries could be used before it was fully initialized,
|
|
triggering an assertion failure.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<freebsdsa>SA-12:05.bind</freebsdsa>
|
|
<cvename>CVE-2012-3817</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-07-24</discovery>
|
|
<entry>2012-08-07</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="36235c38-e0a8-11e1-9f4d-002354ed89bc">
|
|
<topic>automake -- Insecure 'distcheck' recipe granted world-writable distdir</topic>
|
|
<affects>
|
|
<package>
|
|
<name>automake</name>
|
|
<range><ge>1.5.0</ge><lt>1.12.2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>GNU reports:</p>
|
|
<blockquote cite="https://lists.gnu.org/archive/html/automake/2012-07/msg00023.html">
|
|
<p>The recipe of the 'distcheck' target granted temporary
|
|
world-write permissions on the extracted distdir. This introduced
|
|
a locally exploitable race condition for those who run "make
|
|
distcheck" with a non-restrictive umask (e.g., 022) in a directory
|
|
that was accessible by others. A successful exploit would result
|
|
in arbitrary code execution with the privileges of the user
|
|
running "make distcheck".</p>
|
|
<p>It is important to stress that this vulnerability impacts not only
|
|
the Automake package itself, but all packages with
|
|
Automake-generated makefiles. For an effective fix it is necessary
|
|
to regenerate the Makefile.in files with a fixed Automake
|
|
version.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-3386</cvename>
|
|
<url>https://lists.gnu.org/archive/html/automake/2012-07/msg00023.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-07-09</discovery>
|
|
<entry>2012-08-06</entry>
|
|
<modified>2012-08-25</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="dbf338d0-dce5-11e1-b655-14dae9ebcf89">
|
|
<topic>mozilla -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>firefox</name>
|
|
<range><gt>11.0,1</gt><lt>14.0.1,1</lt></range>
|
|
<range><lt>10.0.6,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-firefox</name>
|
|
<range><lt>10.0.6,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-seamonkey</name>
|
|
<range><lt>2.11</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-thunderbird</name>
|
|
<range><lt>10.0.6</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>seamonkey</name>
|
|
<range><lt>2.11</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>thunderbird</name>
|
|
<range><gt>11.0</gt><lt>14.0</lt></range>
|
|
<range><lt>10.0.6</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>libxul</name>
|
|
<range><gt>1.9.2.*</gt><lt>10.0.6</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Mozilla Project reports:</p>
|
|
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
|
|
<p>MFSA 2012-42 Miscellaneous memory safety hazards (rv:14.0/
|
|
rv:10.0.6)</p>
|
|
<p>MFSA 2012-43 Incorrect URL displayed in addressbar through drag and
|
|
drop</p>
|
|
<p>MFSA 2012-44 Gecko memory corruption</p>
|
|
<p>MFSA 2012-45 Spoofing issue with location</p>
|
|
<p>MFSA 2012-46 XSS through data: URLs</p>
|
|
<p>MFSA 2012-47 Improper filtering of javascript in HTML feed-view</p>
|
|
<p>MFSA 2012-48 use-after-free in nsGlobalWindow::PageHidden</p>
|
|
<p>MFSA 2012-49 Same-compartment Security Wrappers can be bypassed</p>
|
|
<p>MFSA 2012-50 Out of bounds read in QCMS</p>
|
|
<p>MFSA 2012-51 X-Frame-Options header ignored when duplicated</p>
|
|
<p>MFSA 2012-52 JSDependentString::undepend string conversion results
|
|
in memory corruption</p>
|
|
<p>MFSA 2012-53 Content Security Policy 1.0 implementation errors
|
|
cause data leakage</p>
|
|
<p>MFSA 2012-54 Clickjacking of certificate warning page</p>
|
|
<p>MFSA 2012-55 feed: URLs with an innerURI inherit security context
|
|
of page</p>
|
|
<p>MFSA 2012-56 Code execution through javascript: URLs</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-1949</cvename>
|
|
<cvename>CVE-2012-1950</cvename>
|
|
<cvename>CVE-2012-1951</cvename>
|
|
<cvename>CVE-2012-1952</cvename>
|
|
<cvename>CVE-2012-1953</cvename>
|
|
<cvename>CVE-2012-1954</cvename>
|
|
<cvename>CVE-2012-1955</cvename>
|
|
<cvename>CVE-2012-1957</cvename>
|
|
<cvename>CVE-2012-1958</cvename>
|
|
<cvename>CVE-2012-1959</cvename>
|
|
<cvename>CVE-2012-1960</cvename>
|
|
<cvename>CVE-2012-1961</cvename>
|
|
<cvename>CVE-2012-1962</cvename>
|
|
<cvename>CVE-2012-1963</cvename>
|
|
<cvename>CVE-2012-1964</cvename>
|
|
<cvename>CVE-2012-1965</cvename>
|
|
<cvename>CVE-2012-1966</cvename>
|
|
<cvename>CVE-2012-1967</cvename>
|
|
<url>http://www.mozilla.org/security/known-vulnerabilities/</url>
|
|
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-42.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-43.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-44.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-45.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-46.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-47.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-48.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-49.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-50.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-51.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-52.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-53.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-54.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-55.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-56.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-07-17</discovery>
|
|
<entry>2012-08-02</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="de2bc01f-dc44-11e1-9f4d-002354ed89bc">
|
|
<topic>Apache -- Insecure LD_LIBRARY_PATH handling</topic>
|
|
<affects>
|
|
<package>
|
|
<name>apache</name>
|
|
<range><le>2.2.22_5</le></range>
|
|
</package>
|
|
<package>
|
|
<name>apache-event</name>
|
|
<range><le>2.2.22_5</le></range>
|
|
</package>
|
|
<package>
|
|
<name>apache-itk</name>
|
|
<range><le>2.2.22_5</le></range>
|
|
</package>
|
|
<package>
|
|
<name>apache-peruser</name>
|
|
<range><le>2.2.22_5</le></range>
|
|
</package>
|
|
<package>
|
|
<name>apache-worker</name>
|
|
<range><le>2.2.22_5</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Apache reports:</p>
|
|
<blockquote cite="http://httpd.apache.org/security/vulnerabilities_24.html">
|
|
<p>Insecure handling of LD_LIBRARY_PATH was found that could lead to
|
|
the current working directory to be searched for DSOs. This could
|
|
allow a local user to execute code as root if an administrator runs
|
|
apachectl from an untrusted directory.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-0883</cvename>
|
|
<url>http://httpd.apache.org/security/vulnerabilities_24.html</url>
|
|
<url>http://www.apache.org/dist/httpd/CHANGES_2.4.2</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-03-02</discovery>
|
|
<entry>2012-08-01</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="f01292a0-db3c-11e1-a84b-00e0814cab4e">
|
|
<topic>django -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>py26-django</name>
|
|
<name>py27-django</name>
|
|
<range><ge>1.4</ge><lt>1.4.1</lt></range>
|
|
<range><ge>1.3</ge><lt>1.3.2</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>py26-django-devel</name>
|
|
<name>py27-django-devel</name>
|
|
<range><lt>20120731,1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Django project reports:</p>
|
|
<blockquote cite="https://www.djangoproject.com/weblog/2012/jul/30/security-releases-issued/">
|
|
<p>Today the Django team is issuing multiple releases --
|
|
Django 1.3.2 and Django 1.4.1 -- to remedy security issues
|
|
reported to us:</p>
|
|
<ul>
|
|
<li>Cross-site scripting in authentication views</li>
|
|
<li>Denial-of-service in image validation</li>
|
|
<li>Denial-of-service via get_image_dimensions()</li>
|
|
</ul>
|
|
<p>All users are encouraged to upgrade Django immediately.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-3442</cvename>
|
|
<cvename>CVE-2012-3443</cvename>
|
|
<cvename>CVE-2012-3444</cvename>
|
|
<url>https://www.djangoproject.com/weblog/2012/jul/30/security-releases-issued/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-07-30</discovery>
|
|
<entry>2012-07-31</entry>
|
|
<modified>2012-08-02</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="58253655-d82c-11e1-907c-20cf30e32f6d">
|
|
<topic>bugzilla -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>bugzilla</name>
|
|
<range><ge>3.6.0</ge><lt>3.6.10</lt></range>
|
|
<range><ge>4.0.0</ge><lt>4.0.7</lt></range>
|
|
<range><ge>4.2.0</ge><lt>4.2.2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<h1>A Bugzilla Security Advisory reports:</h1>
|
|
<blockquote cite="http://www.bugzilla.org/security/3.6.9/">
|
|
<p>The following security issues have been discovered in
|
|
Bugzilla:</p>
|
|
<h1>Information Leak</h1>
|
|
<p>Versions: 4.1.1 to 4.2.1, 4.3.1</p>
|
|
<p>In HTML bugmails, all bug IDs and attachment IDs are
|
|
linkified, and hovering these links displays a tooltip
|
|
with the bug summary or the attachment description if
|
|
the user is allowed to see the bug or attachment.
|
|
But when validating user permissions when generating the
|
|
email, the permissions of the user who edited the bug were
|
|
taken into account instead of the permissions of the
|
|
addressee. This means that confidential information could
|
|
be disclosed to the addressee if the other user has more
|
|
privileges than the addressee.
|
|
Plain text bugmails are not affected as bug and attachment
|
|
IDs are not linkified.</p>
|
|
<h1>Information Leak</h1>
|
|
<p>Versions: 2.17.5 to 3.6.9, 3.7.1 to 4.0.6, 4.1.1 to
|
|
4.2.1, 4.3.1</p>
|
|
<p>The description of a private attachment could be visible
|
|
to a user who hasn't permissions to access this attachment
|
|
if the attachment ID is mentioned in a public comment in
|
|
a bug that the user can see.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-1968</cvename>
|
|
<cvename>CVE-2012-1969</cvename>
|
|
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=777398</url>
|
|
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=777586</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-07-26</discovery>
|
|
<entry>2012-07-27</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="17f369dc-d7e7-11e1-90a2-000c299b62e1">
|
|
<topic>nsd -- Denial of Service</topic>
|
|
<affects>
|
|
<package>
|
|
<name>nsd</name>
|
|
<range><lt>3.2.13</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Tom Hendrikx reports:</p>
|
|
<blockquote cite="http://www.nlnetlabs.nl/downloads/CVE-2012-2979.txt">
|
|
<p>It is possible to crash (SIGSEGV) a NSD child server process by
|
|
sending it a DNS packet from any host on the internet and the per
|
|
zone stats build option is enabled. A crashed child process will
|
|
automatically be restarted by the parent process, but an attacker
|
|
may keep the NSD server occupied restarting child processes by
|
|
sending it a stream of such packets effectively preventing the
|
|
NSD server to serve.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-2979</cvename>
|
|
<url>http://www.nlnetlabs.nl/downloads/CVE-2012-2979.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-07-27</discovery>
|
|
<entry>2012-07-27</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="ae2fa87c-4bca-4138-8be1-67ce2a19b3a8">
|
|
<topic>rubygem-actionpack -- Denial of Service</topic>
|
|
<affects>
|
|
<package>
|
|
<name>rubygem-actionpack</name>
|
|
<range><lt>3.2.7</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<blockquote cite="https://groups.google.com/forum/?fromgroups#!topic/rubyonrails-security/vxJjrc15qYM">
|
|
<p>There is a DoS vulnerability in Action Pack digest authentication
|
|
handling in authenticate_or_request_with_http_digest.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-3424</cvename>
|
|
<url>https://groups.google.com/forum/?fromgroups#!topic/rubyonrails-security/vxJjrc15qYM</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-07-26</discovery>
|
|
<entry>2012-07-26</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="cdc4ff0e-d736-11e1-8221-e0cb4e266481">
|
|
<topic>p5-RT-Authen-ExternalAuth -- privilege escalation</topic>
|
|
<affects>
|
|
<package>
|
|
<name>p5-RT-Authen-ExternalAuth</name>
|
|
<range><lt>0.11</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The RT development team reports:</p>
|
|
<blockquote cite="http://blog.bestpractical.com/2012/07/security-vulnerabilities-in-three-commonly-deployed-rt-extensions.html">
|
|
<p>RT::Authen::ExternalAuth 0.10 and below (for all versions
|
|
of RT) are vulnerable to an escalation of privilege attack
|
|
where the URL of a RSS feed of the user can be used to
|
|
acquire a fully logged-in session as that user.
|
|
CVE-2012-2770 has been assigned to this vulnerability.</p>
|
|
<p>Users of RT 3.8.2 and above should upgrade to
|
|
RT::Authen::ExternalAuth 0.11, which resolves this
|
|
vulnerability.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://blog.bestpractical.com/2012/07/security-vulnerabilities-in-three-commonly-deployed-rt-extensions.html</url>
|
|
<cvename>CVE-2012-2770</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-07-25</discovery>
|
|
<entry>2012-07-26</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="c7fa3618-d5ff-11e1-90a2-000c299b62e1">
|
|
<topic>isc-dhcp -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>isc-dhcp41-server</name>
|
|
<range><lt>4.1.e_5,2</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>isc-dhcp42-server</name>
|
|
<range><lt>4.2.4_1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>ISC reports:</p>
|
|
<blockquote cite="https://www.isc.org/announcement/bind-and-dhcp-security-updates-released">
|
|
<p>An unexpected client identifier parameter can cause the ISC DHCP
|
|
daemon to segmentation fault when running in DHCPv6 mode,
|
|
resulting in a denial of service to further client requests. In
|
|
order to exploit this condition, an attacker must be able to send
|
|
requests to the DHCP server.</p>
|
|
<p>An error in the handling of malformed client identifiers can cause
|
|
a DHCP server running affected versions (see "Impact") to enter a
|
|
state where further client requests are not processed and the
|
|
server process loops endlessly, consuming all available CPU
|
|
cycles.
|
|
Under normal circumstances this condition should not be
|
|
triggered, but a non-conforming or malicious client could
|
|
deliberately trigger it in a vulnerable server. In order to
|
|
exploit this condition an attacker must be able to send requests
|
|
to the DHCP server.</p>
|
|
<p>Two memory leaks have been found and fixed in ISC DHCP. Both are
|
|
reproducible when running in DHCPv6 mode (with the -6 command-line
|
|
argument.) The first leak is confirmed to only affect servers
|
|
operating in DHCPv6 mode, but based on initial code analysis the
|
|
second may theoretically affect DHCPv4 servers (though this has
|
|
not been demonstrated.)</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-3570</cvename>
|
|
<cvename>CVE-2012-3571</cvename>
|
|
<cvename>CVE-2012-3954</cvename>
|
|
<url>https://kb.isc.org/article/AA-00714</url>
|
|
<url>https://kb.isc.org/article/AA-00712</url>
|
|
<url>https://kb.isc.org/article/AA-00737</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-07-24</discovery>
|
|
<entry>2012-07-25</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="0bc67930-d5c3-11e1-bef6-0024e81297ae">
|
|
<topic>dns/bind9* -- Heavy DNSSEC Validation Load Can Cause a 'Bad Cache' Assertion Failure</topic>
|
|
<affects>
|
|
<package>
|
|
<name>bind99</name>
|
|
<range><lt>9.9.1.2</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>bind98</name>
|
|
<range><lt>9.8.3.2</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>bind97</name>
|
|
<range><lt>9.7.6.2</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>bind96</name>
|
|
<range><lt>9.6.3.1.ESV.R7.2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>ISC reports:</p>
|
|
<blockquote cite="https://kb.isc.org/article/AA-00729">
|
|
<p>High numbers of queries with DNSSEC validation enabled can
|
|
cause an assertion failure in named, caused by using a 'bad cache'
|
|
data structure before it has been initialized.</p>
|
|
<p>BIND 9 stores a cache of query names that are known to be failing due
|
|
to misconfigured name servers or a broken chain of trust. Under high query
|
|
loads when DNSSEC validation is active, it is possible for a condition
|
|
to arise in which data from this cache of failing queries could be used
|
|
before it was fully initialized, triggering an assertion failure.</p>
|
|
<p>This bug cannot be encountered unless your server is doing DNSSEC
|
|
validation.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-3817</cvename>
|
|
<url>https://kb.isc.org/article/AA-00729</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-07-24</discovery>
|
|
<entry>2012-07-24</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="748aa89f-d529-11e1-82ab-001fd0af1a4c">
|
|
<topic>rubygem-activerecord -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>rubygem-activemodel</name>
|
|
<range><lt>3.2.4</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>rubygem-activerecord -- multiple vulernabilities</p>
|
|
<blockquote>
|
|
<p>Due to the way Active Record interprets parameters in
|
|
combination with the way that Rack parses query parameters, it
|
|
is possible for an attacker to issue unexpected database
|
|
queries with "IS NULL" where clauses. This issue does *not*
|
|
let an attacker insert arbitrary values into an SQL query,
|
|
however they can cause the query to check for NULL where most
|
|
users wouldn't expect it.</p>
|
|
<p>Due to the way Active Record handles nested query parameters,
|
|
an attacker can use a specially crafted request to inject some
|
|
forms of SQL into your application's SQL queries.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-2660</cvename>
|
|
<cvename>CVE-2012-2661</cvename>
|
|
<url>https://groups.google.com/forum/?fromgroups#!topic/rubyonrails-security/8SA-M3as7A8</url>
|
|
<url>https://groups.google.com/forum/?fromgroups#!topic/rubyonrails-security/dUaiOOGWL1k</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-05-31</discovery>
|
|
<entry>2012-07-23</entry>
|
|
<modified>2012-07-23</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="bdab0acd-d4cd-11e1-8a1c-14dae9ebcf89">
|
|
<topic>php -- potential overflow in _php_stream_scandir</topic>
|
|
<affects>
|
|
<package>
|
|
<name>php5</name>
|
|
<range><gt>5.4</gt><lt>5.4.5</lt></range>
|
|
<range><ge>5.3</ge><lt>5.3.15</lt></range>
|
|
<range><ge>5.2</ge><lt>5.2.17_10</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>php53</name>
|
|
<range><lt>5.3.15</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>php52</name>
|
|
<range><lt>5.2.17_10</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The PHP Development Team reports:</p>
|
|
<blockquote cite="http://www.php.net/archive/2012.php#id2012-07-19-1">
|
|
<p>The release of PHP 5.4.15 and 5.4.5 fix a potential overflow in
|
|
_php_stream_scandir</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-2688</cvename>
|
|
<url>http://www.php.net/archive/2012.php#id2012-07-19-1</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-07-19</discovery>
|
|
<entry>2012-07-23</entry>
|
|
<modified>2013-01-15</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="ce82bfeb-d276-11e1-92c6-14dae938ec40">
|
|
<topic>dns/nsd -- DoS vulnerability from non-standard DNS packet</topic>
|
|
<affects>
|
|
<package>
|
|
<name>nsd</name>
|
|
<range><lt>3.2.11_2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Marek Vavrusa and Lubos Slovak report:</p>
|
|
<blockquote cite="http://www.nlnetlabs.nl/downloads/CVE-2012-2978.txt">
|
|
<p>It is possible to crash (SIGSEGV) a NSD child server process
|
|
by sending it a non-standard DNS packet from any host on the
|
|
internet. A crashed child process will automatically be restarted
|
|
by the parent process, but an attacker may keep the NSD server
|
|
occupied restarting child processes by sending it a stream of
|
|
such packets effectively preventing the NSD server to serve.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-2978</cvename>
|
|
<freebsdpr>ports/170024</freebsdpr>
|
|
<url>http://www.nlnetlabs.nl/downloads/CVE-2012-2978.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-07-19</discovery>
|
|
<entry>2012-07-20</entry>
|
|
<modified>2012-07-21</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="a460035e-d111-11e1-aff7-001fd056c417">
|
|
<topic>libjpeg-turbo -- heap-based buffer overflow</topic>
|
|
<affects>
|
|
<package>
|
|
<name>libjpeg-turbo</name>
|
|
<range><lt>1.2.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<blockquote cite="http://sourceforge.net/projects/libjpeg-turbo/files/1.2.1/README.txt">
|
|
<p>The Changelog for version 1.2.1 says: Fixed a regression caused by
|
|
1.2.0[6] in which decompressing corrupt JPEG images (specifically,
|
|
images in which the component count was erroneously set to a large
|
|
value) would cause libjpeg-turbo to segfault.</p>
|
|
</blockquote>
|
|
<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=826849">
|
|
<p>A Heap-based buffer overflow was found in the way libjpeg-turbo
|
|
decompressed certain corrupt JPEG images in which the component count
|
|
was erroneously set to a large value. An attacker could create a
|
|
specially-crafted JPEG image that, when opened, could cause an
|
|
application using libpng to crash or, possibly, execute arbitrary code
|
|
with the privileges of the user running the application.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-2806</cvename>
|
|
<url>http://sourceforge.net/projects/libjpeg-turbo/files/1.2.1/README.txt</url>
|
|
<url>https://bugzilla.redhat.com/show_bug.cgi?id=826849</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-05-31</discovery>
|
|
<entry>2012-07-18</entry>
|
|
<modified>2012-07-19</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="2fe4b57f-d110-11e1-ac76-10bf48230856">
|
|
<topic>Dokuwiki -- cross site scripting vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>dokuwiki</name>
|
|
<range><lt>20120125_2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia Research reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/49196/">
|
|
<p>Secunia Research has discovered a vulnerability in DokuWiki, which can
|
|
be exploited by malicious people to conduct cross-site scripting
|
|
attacks.</p>
|
|
<p>Input passed to the "ns" POST parameter in lib/exe/ajax.php (when "call"
|
|
is set to "medialist" and "do" is set to "media") is not properly
|
|
sanitised within the "tpl_mediaFileList()" function in inc/template.php
|
|
before being returned to the user. This can be exploited to execute
|
|
arbitrary HTML and script code in a user's browser session in context
|
|
of an affected site.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://secunia.com/advisories/49196/</url>
|
|
<cvename>CVE-2012-0283</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-07-13</discovery>
|
|
<entry>2012-07-18</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="3a6960ef-c8a8-11e1-9924-001fd0af1a4c">
|
|
<topic>puppet -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>puppet</name>
|
|
<range><gt>2.7.*</gt><lt>2.7.18</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>puppet -- multiple vulnerabilities</p>
|
|
<blockquote cite="http://projects.puppetlabs.com/projects/puppet/wiki/Release_Notes#2.7.18">
|
|
<p>Arbitrary file read on the puppet master from authenticated
|
|
clients (high). It is possible to construct an HTTP get request
|
|
from an authenticated client with a valid certificate that will
|
|
return the contents of an arbitrary file on the Puppet master
|
|
that the master has read-access to.</p>
|
|
<p>Arbitrary file delete/D.O.S on Puppet Master from authenticated
|
|
clients (high). Given a Puppet master with the "Delete"
|
|
directive allowed in auth.conf for an authenticated host, an
|
|
attacker on that host can send a specially crafted Delete
|
|
request that can cause an arbitrary file deletion on the Puppet
|
|
master, potentially causing a denial of service attack. Note
|
|
that this vulnerability does *not* exist in Puppet as
|
|
configured by default.</p>
|
|
<p>The last_run_report.yaml is world readable (medium). The most
|
|
recent Puppet run report is stored on the Puppet master with
|
|
world-readable permissions. The report file contains the
|
|
context diffs of any changes to configuration on an agent,
|
|
which may contain sensitive information that an attacker can
|
|
then access. The last run report is overwritten with every
|
|
Puppet run.</p>
|
|
<p>Arbitrary file read on the Puppet master by an agent (medium).
|
|
This vulnerability is dependent upon vulnerability
|
|
"last_run_report.yml is world readable" above. By creating a
|
|
hard link of a Puppet-managed file to an arbitrary file that
|
|
the Puppet master can read, an attacker forces the contents to
|
|
be written to the puppet run summary. The context diff is
|
|
stored in last_run_report.yaml, which can then be accessed by
|
|
the attacker.</p>
|
|
<p>Insufficient input validation for agent hostnames (low). An
|
|
attacker could trick the administrator into signing an
|
|
attacker's certificate rather than the intended one by
|
|
constructing specially crafted certificate requests containing
|
|
specific ANSI control sequences. It is possible to use the
|
|
sequences to rewrite the order of text displayed to an
|
|
administrator such that display of an invalid certificate and
|
|
valid certificate are transposed. If the administrator signs
|
|
the attacker's certificate, the attacker can then
|
|
man-in-the-middle the agent.</p>
|
|
<p>Agents with certnames of IP addresses can be impersonated
|
|
(low). If an authenticated host with a certname of an IP
|
|
address changes IP addresses, and a second host assumes the
|
|
first host's former IP address, the second host will be treated
|
|
by the puppet master as the first one, giving the second host
|
|
access to the first host's catalog. Note: This will not be
|
|
fixed in Puppet versions prior to the forthcoming 3.x. Instead,
|
|
with this announcement IP-based authentication in Puppet < 3.x
|
|
is deprecated.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-3864</cvename>
|
|
<cvename>CVE-2012-3865</cvename>
|
|
<cvename>CVE-2012-3866</cvename>
|
|
<cvename>CVE-2012-3867</cvename>
|
|
<url>http://projects.puppetlabs.com/projects/puppet/wiki/Release_Notes#2.7.18</url>
|
|
<url>http://puppetlabs.com/security/cve/cve-2012-3864/</url>
|
|
<url>http://puppetlabs.com/security/cve/cve-2012-3865/</url>
|
|
<url>http://puppetlabs.com/security/cve/cve-2012-3866/</url>
|
|
<url>http://puppetlabs.com/security/cve/cve-2012-3867/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-07-05</discovery>
|
|
<entry>2012-07-10</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="4c1ac2dd-c788-11e1-be25-14dae9ebcf89">
|
|
<topic>asterisk -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>asterisk</name>
|
|
<range><gt>10.*</gt><lt>10.5.2</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>asterisk18</name>
|
|
<range><gt>1.8.*</gt><lt>1.8.13.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Asterisk project reports:</p>
|
|
<blockquote cite="https://www.asterisk.org/security">
|
|
<p>Possible resource leak on uncompleted re-invite transactions.</p>
|
|
<p>Remote crash vulnerability in voice mail application.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-3812</cvename>
|
|
<url>http://downloads.digium.com/pub/security/AST-2012-010.html</url>
|
|
<url>http://downloads.digium.com/pub/security/AST-2012-011.html</url>
|
|
<url>https://www.asterisk.org/security</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-07-05</discovery>
|
|
<entry>2012-07-06</entry>
|
|
<modified>2012-08-30</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="c28ee9cd-916e-4dcf-8ed3-e97e5846db6c">
|
|
<topic>typo3 -- Cross-Site Scripting Vulnerability in TYPO3 Core</topic>
|
|
<affects>
|
|
<package>
|
|
<name>typo3</name>
|
|
<range><ge>4.5</ge><lt>4.5.17</lt></range>
|
|
<range><ge>4.6</ge><lt>4.6.10</lt></range>
|
|
<range><ge>4.7</ge><lt>4.7.2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Typo3 Security Report (TYPO3-CORE-SA-2012-003):</p>
|
|
<blockquote cite="https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2012-003/">
|
|
<p>TYPO3 bundles and uses an external JavaScript and Flash Upload Library
|
|
called swfupload. TYPO3 can be configured to use this Flash uploader.
|
|
Input passed via the "movieName" parameter to swfupload.swf is not
|
|
properly sanitised before being used in a call to
|
|
"ExternalInterface.call()". This can be exploited to execute arbitrary
|
|
script code in a user's browser session in context of an affected site.
|
|
The existance of the swfupload library is sufficient to be vulnerable
|
|
to the reported problem.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://secunia.com/advisories/49780/</url>
|
|
<url>https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2012-003/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-07-04</discovery>
|
|
<entry>2012-07-06</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="fd8bac56-c444-11e1-864b-001cc0877741">
|
|
<topic>phpList -- SQL injection and XSS vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>phplist</name>
|
|
<range><le>2.10.17</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Zero Science Lab reports:</p>
|
|
<blockquote cite="http://www.zeroscience.mk/en/vulnerabilities/ZSL-2012-5081.php">
|
|
<p>Input passed via the parameter 'sortby' is not properly
|
|
sanitised before being returned to the user or used in SQL queries.
|
|
This can be exploited to manipulate SQL queries by injecting
|
|
arbitrary SQL code. The param 'num' is vulnerable to a XSS issue
|
|
where the attacker can execute arbitrary HTML and script code in
|
|
a user's browser session in context of an affected site.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-2740</cvename>
|
|
<cvename>CVE-2012-2741</cvename>
|
|
<bid>52657</bid>
|
|
<url>https://www.phplist.com/?lid=567</url>
|
|
<url>http://www.zeroscience.mk/en/vulnerabilities/ZSL-2012-5081.php</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-03-21</discovery>
|
|
<entry>2012-07-02</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="ff922811-c096-11e1-b0f4-00262d5ed8ee">
|
|
<topic>chromium -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>chromium</name>
|
|
<range><lt>20.0.1132.43</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Google Chrome Releases reports:</p>
|
|
<blockquote cite="http://googlechromereleases.blogspot.nl/search/label/Stable%20updates">
|
|
<p>[118633] Low CVE-2012-2815: Leak of iframe fragment id. Credit to
|
|
Elie Bursztein of Google.</p>
|
|
<p>[120222] High CVE-2012-2817: Use-after-free in table section
|
|
handling. Credit to miaubiz.</p>
|
|
<p>[120944] High CVE-2012-2818: Use-after-free in counter layout.
|
|
Credit to miaubiz.</p>
|
|
<p>[120977] High CVE-2012-2819: Crash in texture handling. Credit to
|
|
Ken "gets" Russell of the Chromium development community.</p>
|
|
<p>[121926] Medium CVE-2012-2820: Out-of-bounds read in SVG filter
|
|
handling. Credit to Atte Kettunen of OUSPG.</p>
|
|
<p>[122925] Medium CVE-2012-2821: Autofill display problem. Credit to
|
|
"simonbrown60".</p>
|
|
<p>[various] Medium CVE-2012-2822: Misc. lower severity OOB read
|
|
issues in PDF. Credit to awesome ASAN and various Googlers (Kostya
|
|
Serebryany, Evgeniy Stepanov, Mateusz Jurczyk, Gynvael Coldwind).</p>
|
|
<p>[124356] High CVE-2012-2823: Use-after-free in SVG resource
|
|
handling. Credit to miaubiz.</p>
|
|
<p>[125374] High CVE-2012-2824: Use-after-free in SVG painting.
|
|
Credit to miaubiz.</p>
|
|
<p>[128688] Medium CVE-2012-2826: Out-of-bounds read in texture
|
|
conversion. Credit to Google Chrome Security Team (Inferno).</p>
|
|
<p>[Mac only] [129826] Low CVE-2012-2827: Use-after-free in Mac UI.
|
|
Credit to the Chromium development community (Dharani Govindan).</p>
|
|
<p>[129857] High CVE-2012-2828: Integer overflows in PDF. Credit to
|
|
Mateusz Jurczyk of Google Security Team and Google Chrome Security
|
|
Team (Chris Evans).</p>
|
|
<p>[129947] High CVE-2012-2829: Use-after-free in first-letter
|
|
handling. Credit to miaubiz.</p>
|
|
<p>[129951] High CVE-2012-2830: Wild pointer in array value setting.
|
|
Credit to miaubiz.</p>
|
|
<p>[130356] High CVE-2012-2831: Use-after-free in SVG reference
|
|
handling. Credit to miaubiz.</p>
|
|
<p>[131553] High CVE-2012-2832: Uninitialized pointer in PDF image
|
|
codec. Credit to Mateusz Jurczyk of Google Security Team.</p>
|
|
<p>[132156] High CVE-2012-2833: Buffer overflow in PDF JS API. Credit
|
|
to Mateusz Jurczyk of Google Security Team.</p>
|
|
<p>[132779] High CVE-2012-2834: Integer overflow in Matroska
|
|
container. Credit to Juri Aedla.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-2815</cvename>
|
|
<cvename>CVE-2012-2817</cvename>
|
|
<cvename>CVE-2012-2818</cvename>
|
|
<cvename>CVE-2012-2819</cvename>
|
|
<cvename>CVE-2012-2820</cvename>
|
|
<cvename>CVE-2012-2821</cvename>
|
|
<cvename>CVE-2012-2822</cvename>
|
|
<cvename>CVE-2012-2823</cvename>
|
|
<cvename>CVE-2012-2824</cvename>
|
|
<cvename>CVE-2012-2826</cvename>
|
|
<cvename>CVE-2012-2827</cvename>
|
|
<cvename>CVE-2012-2828</cvename>
|
|
<cvename>CVE-2012-2829</cvename>
|
|
<cvename>CVE-2012-2830</cvename>
|
|
<cvename>CVE-2012-2831</cvename>
|
|
<cvename>CVE-2012-2832</cvename>
|
|
<cvename>CVE-2012-2833</cvename>
|
|
<cvename>CVE-2012-2834</cvename>
|
|
<url>http://googlechromereleases.blogspot.com/search/label/Stable%20updates</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-06-26</discovery>
|
|
<entry>2012-06-27</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="aed44c4e-c067-11e1-b5e0-000c299b62e1">
|
|
<topic>FreeBSD -- Privilege escalation when returning from kernel</topic>
|
|
<affects>
|
|
<package>
|
|
<name>FreeBSD</name>
|
|
<range><ge>7.4</ge><lt>7.4_9</lt></range>
|
|
<range><ge>8.1</ge><lt>8.1_12</lt></range>
|
|
<range><ge>8.2</ge><lt>8.2_9</lt></range>
|
|
<range><ge>8.3</ge><lt>8.3_3</lt></range>
|
|
<range><ge>9.0</ge><lt>9.0_3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Problem description:</p>
|
|
<blockquote cite="http://security.freebsd.org/advisories/FreeBSD-SA-12:04.sysret.asc">
|
|
<p>FreeBSD/amd64 runs on CPUs from different vendors. Due to varying
|
|
behaviour of CPUs in 64 bit mode a sanity check of the kernel may be
|
|
insufficient when returning from a system call.</p>
|
|
<p>Successful exploitation of the problem can lead to local kernel privilege
|
|
escalation, kernel data corruption and/or crash.
|
|
To exploit this vulnerability, an attacker must be able to run code with user
|
|
privileges on the target system.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<freebsdsa>SA-12:04.sysret</freebsdsa>
|
|
<cvename>CVE-2012-0217</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-06-12</discovery>
|
|
<entry>2012-06-27</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="fc5231b6-c066-11e1-b5e0-000c299b62e1">
|
|
<topic>FreeBSD -- Incorrect handling of zero-length RDATA fields in named(8)</topic>
|
|
<affects>
|
|
<package>
|
|
<name>FreeBSD</name>
|
|
<range><ge>7.4</ge><lt>7.4_9</lt></range>
|
|
<range><ge>8.1</ge><lt>8.1_11</lt></range>
|
|
<range><ge>8.2</ge><lt>8.2_9</lt></range>
|
|
<range><ge>8.3</ge><lt>8.3_3</lt></range>
|
|
<range><ge>9.0</ge><lt>9.0_3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Problem description:</p>
|
|
<blockquote cite="http://security.freebsd.org/advisories/FreeBSD-SA-12:03.bind.asc">
|
|
<p>The named(8) server does not properly handle DNS resource records where
|
|
the RDATA field is zero length, which may cause various issues for the
|
|
servers handling them.</p>
|
|
<p>Resolving servers may crash or disclose some portion of memory to the
|
|
client. Authoritative servers may crash on restart after transferring a
|
|
zone containing records with zero-length RDATA fields. These would
|
|
result in a denial of service, or leak of sensitive information.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<freebsdsa>SA-12:03.bind</freebsdsa>
|
|
<cvename>CVE-2012-1667</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-06-12</discovery>
|
|
<entry>2012-06-27</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="185ff22e-c066-11e1-b5e0-000c299b62e1">
|
|
<topic>FreeBSD -- Incorrect crypt() hashing</topic>
|
|
<affects>
|
|
<package>
|
|
<name>FreeBSD</name>
|
|
<range><ge>7.4</ge><lt>7.4_8</lt></range>
|
|
<range><ge>8.1</ge><lt>8.1_10</lt></range>
|
|
<range><ge>8.2</ge><lt>8.2_8</lt></range>
|
|
<range><ge>8.3</ge><lt>8.3_2</lt></range>
|
|
<range><ge>9.0</ge><lt>9.0_2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Problem description:</p>
|
|
<blockquote cite="http://security.freebsd.org/advisories/FreeBSD-SA-12:02.crypt.asc">
|
|
<p>There is a programming error in the DES implementation used in crypt()
|
|
when handling input which contains characters that can not be represented
|
|
with 7-bit ASCII.</p>
|
|
<p>When the input contains characters with only the most significant bit set
|
|
(0x80), that character and all characters after it will be ignored.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<freebsdsa>SA-12:02.crypt</freebsdsa>
|
|
<cvename>CVE-2012-2143</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-05-30</discovery>
|
|
<entry>2012-06-27</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="2ae114de-c064-11e1-b5e0-000c299b62e1">
|
|
<topic>FreeBSD -- OpenSSL multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>FreeBSD</name>
|
|
<range><ge>7.4</ge><lt>7.4_8</lt></range>
|
|
<range><ge>8.1</ge><lt>8.1_10</lt></range>
|
|
<range><ge>8.2</ge><lt>8.2_8</lt></range>
|
|
<range><ge>8.3</ge><lt>8.3_2</lt></range>
|
|
<range><ge>9.0</ge><lt>9.0_2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Problem description:</p>
|
|
<blockquote cite="http://security.freebsd.org/advisories/FreeBSD-SA-12:01.openssl.asc">
|
|
<p>OpenSSL fails to clear the bytes used as block cipher padding in SSL 3.0
|
|
records when operating as a client or a server that accept SSL 3.0
|
|
handshakes. As a result, in each record, up to 15 bytes of uninitialized
|
|
memory may be sent, encrypted, to the SSL peer. This could include
|
|
sensitive contents of previously freed memory. [CVE-2011-4576]</p>
|
|
<p>OpenSSL support for handshake restarts for server gated cryptography (SGC)
|
|
can be used in a denial-of-service attack. [CVE-2011-4619]</p>
|
|
<p>If an application uses OpenSSL's certificate policy checking when
|
|
verifying X509 certificates, by enabling the X509_V_FLAG_POLICY_CHECK
|
|
flag, a policy check failure can lead to a double-free. [CVE-2011-4109]</p>
|
|
<p>A weakness in the OpenSSL PKCS #7 code can be exploited using
|
|
Bleichenbacher's attack on PKCS #1 v1.5 RSA padding also known as the
|
|
million message attack (MMA). [CVE-2012-0884]</p>
|
|
<p>The asn1_d2i_read_bio() function, used by the d2i_*_bio and d2i_*_fp
|
|
functions, in OpenSSL contains multiple integer errors that can cause
|
|
memory corruption when parsing encoded ASN.1 data. This error can occur
|
|
on systems that parse untrusted ASN.1 data, such as X.509 certificates
|
|
or RSA public keys. [CVE-2012-2110]</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<freebsdsa>SA-12:01.openssl</freebsdsa>
|
|
<cvename>CVE-2011-4576</cvename>
|
|
<cvename>CVE-2011-4619</cvename>
|
|
<cvename>CVE-2011-4109</cvename>
|
|
<cvename>CVE-2012-0884</cvename>
|
|
<cvename>CVE-2012-2110</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-05-03</discovery>
|
|
<entry>2012-06-27</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="f45c0049-be72-11e1-a284-0023ae8e59f0">
|
|
<topic>pycrypto -- vulnerable ElGamal key generation</topic>
|
|
<affects>
|
|
<package>
|
|
<name>py-pycrypto</name>
|
|
<range><ge>2.5</ge><lt>2.6</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Dwayne C. Litzenberger of PyCrypto reports:</p>
|
|
<blockquote cite="http://lists.dlitz.net/pipermail/pycrypto/2012q2/000587.html">
|
|
<p>In the ElGamal schemes (for both encryption and signatures), g is
|
|
supposed to be the generator of the entire Z^*_p group. However, in
|
|
PyCrypto 2.5 and earlier, g is more simply the generator of a random
|
|
sub-group of Z^*_p.</p>
|
|
<p>The result is that the signature space (when the key is used for
|
|
signing) or the public key space (when the key is used for encryption)
|
|
may be greatly reduced from its expected size of log(p) bits, possibly
|
|
down to 1 bit (the worst case if the order of g is 2).</p>
|
|
<p>While it has not been confirmed, it has also been suggested that an
|
|
attacker might be able to use this fact to determine the private key.</p>
|
|
<p>Anyone using ElGamal keys should generate new keys as soon as
|
|
practical.</p>
|
|
<p>Any additional information about this bug will be tracked at
|
|
https://bugs.launchpad.net/pycrypto/+bug/985164</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-2417</cvename>
|
|
<url>http://lists.dlitz.net/pipermail/pycrypto/2012q2/000587.html</url>
|
|
<url>https://bugs.launchpad.net/pycrypto/+bug/985164</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-05-24</discovery>
|
|
<entry>2012-06-24</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="f46c4c6a-ba25-11e1-806a-001143cd36d8">
|
|
<topic>joomla -- Privilege Escalation</topic>
|
|
<affects>
|
|
<package>
|
|
<name>joomla</name>
|
|
<range><lt>2.5.5</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Joomla! reported a Core Privilege Escalation::</p>
|
|
<blockquote cite="http://developer.joomla.org/security/news/470-20120601-core-privilege-escalation.html">
|
|
<p>Inadequate checking leads to possible user privilege escalation..</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://developer.joomla.org/security/news/470-20120601-core-privilege-escalation.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-04-29</discovery>
|
|
<entry>2012-06-19</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="eb12ebee-b7af-11e1-b5e0-000c299b62e1">
|
|
<topic>clamav -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>clamav</name>
|
|
<range><lt>0.97.5</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>clamav-devel</name>
|
|
<range><lt>20120612</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>MITRE Advisories report:</p>
|
|
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1419">
|
|
<p>The TAR parser allows remote attackers to bypass malware detection
|
|
via a POSIX TAR file with an initial [aliases] character sequence.</p>
|
|
</blockquote>
|
|
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1457">
|
|
<p>The TAR parser allows remote attackers to bypass malware detection
|
|
via a TAR archive entry with a length field that exceeds the total
|
|
TAR file size.</p>
|
|
</blockquote>
|
|
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1458">
|
|
<p>The Microsoft CHM file parser allows remote attackers to bypass
|
|
malware detection via a crafted reset interval in the LZXC header
|
|
of a CHM file.</p>
|
|
</blockquote>
|
|
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1459">
|
|
<p>The TAR file parser allows remote attackers to bypass malware
|
|
detection via a TAR archive entry with a length field
|
|
corresponding to that entire entry, plus part of the header ofxi
|
|
the next entry.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-1419</cvename>
|
|
<cvename>CVE-2012-1457</cvename>
|
|
<cvename>CVE-2012-1458</cvename>
|
|
<cvename>CVE-2012-1459</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-03-19</discovery>
|
|
<entry>2012-06-16</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="3c8d1e5b-b673-11e1-be25-14dae9ebcf89">
|
|
<topic>asterisk -- remote crash vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>asterisk10</name>
|
|
<range><gt>10.*</gt><lt>10.5.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Asterisk project reports:</p>
|
|
<blockquote cite="https://www.asterisk.org/security">
|
|
<p>Skinny Channel Driver Remote Crash Vulnerability.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-3553</cvename>
|
|
<url>http://downloads.digium.com/pub/security/AST-2012-009.html</url>
|
|
<url>https://www.asterisk.org/security</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-06-14</discovery>
|
|
<entry>2012-06-14</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="5140dc69-b65e-11e1-9425-001b21614864">
|
|
<topic>ImageMagick -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>ImageMagick</name>
|
|
<name>ImageMagick-nox11</name>
|
|
<range><lt>6.7.6.4</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>ImageMagick reports:</p>
|
|
<blockquote cite="http://www.cert.fi/en/reports/2012/vulnerability635606.html">
|
|
<p>Three vulnerabilities have been identified in ImageMagick's
|
|
handling of JPEG and TIFF files. With these vulnerabilities, it is
|
|
possible to cause a denial of service situation in the target
|
|
system.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-0259</cvename>
|
|
<cvename>CVE-2012-0260</cvename>
|
|
<cvename>CVE-2012-1798</cvename>
|
|
<url>http://www.imagemagick.org/discourse-server/viewtopic.php?f=4&t=20629</url>
|
|
<url>http://www.cert.fi/en/reports/2012/vulnerability635606.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-03-28</discovery>
|
|
<entry>2012-06-14</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="55587adb-b49d-11e1-8df1-0004aca374af">
|
|
<topic>mantis -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>mantis</name>
|
|
<range><lt>1.2.11</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Mantis reports:</p>
|
|
<blockquote cite="http://www.openwall.com/lists/oss-security/2012/06/09/1">
|
|
<p>Roland Becker and Damien Regad (MantisBT developers) found that
|
|
any user able to report issues via the SOAP interface could also
|
|
modify any bugnotes (comments) created by other users. In a
|
|
default/typical MantisBT installation, SOAP API is enabled and any
|
|
user can sign up to report new issues. This vulnerability therefore
|
|
impacts upon many public facing MantisBT installations.</p>
|
|
<p>Roland Becker (MantisBT developer) found that the
|
|
delete_attachments_threshold permission was not being checked when
|
|
a user attempted to delete an attachment from an issue. The more
|
|
generic update_bug_threshold permission was being checked instead.
|
|
MantisBT administrators may have been under the false impression
|
|
that their configuration of the delete_attachments_threshold was
|
|
successfully preventing unwanted users from deleting
|
|
attachments.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-2691</cvename>
|
|
<cvename>CVE-2012-2692</cvename>
|
|
<mlist>http://www.openwall.com/lists/oss-security/2012/06/09/1</mlist>
|
|
<mlist>http://sourceforge.net/mailarchive/forum.php?thread_name=1339229952.28538.22%40d.hx.id.au&forum_name=mantisbt-dev</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-06-09</discovery>
|
|
<entry>2012-06-12</entry>
|
|
<modified>2012-06-13</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="38195f00-b215-11e1-8132-003067b2972c">
|
|
<topic>linux-flashplugin -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>linux-f10-flashplugin</name>
|
|
<range><lt>11.2r202.236</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Adobe reports:</p>
|
|
<blockquote cite="http://www.adobe.com/support/security/bulletins/apsb12-14.html">
|
|
<p>These vulnerabilities could cause a crash and potentially allow an attacker to take control of the affected system.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-2034</cvename>
|
|
<cvename>CVE-2012-2035</cvename>
|
|
<cvename>CVE-2012-2036</cvename>
|
|
<cvename>CVE-2012-2037</cvename>
|
|
<cvename>CVE-2012-2038</cvename>
|
|
<cvename>CVE-2012-2039</cvename>
|
|
<cvename>CVE-2012-2040</cvename>
|
|
<url>http://www.adobe.com/support/security/bulletins/apsb12-14.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-06-08</discovery>
|
|
<entry>2012-06-09</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="bfecf7c1-af47-11e1-9580-4061862b8c22">
|
|
<topic>mozilla -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>firefox</name>
|
|
<range><gt>11.0,1</gt><lt>13.0,1</lt></range>
|
|
<range><lt>10.0.5,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-firefox</name>
|
|
<range><lt>10.0.5,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-seamonkey</name>
|
|
<range><lt>2.10</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-thunderbird</name>
|
|
<range><lt>10.0.5</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>seamonkey</name>
|
|
<range><lt>2.10</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>thunderbird</name>
|
|
<range><gt>11.0</gt><lt>13.0</lt></range>
|
|
<range><lt>10.0.5</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>libxul</name>
|
|
<range><gt>1.9.2.*</gt><lt>10.0.5</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Mozilla Project reports:</p>
|
|
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
|
|
<p>MFSA 2012-34 Miscellaneous memory safety hazards (rv:13.0/ rv:10.0.5)</p>
|
|
<p>MFSA 2012-36 Content Security Policy inline-script bypass</p>
|
|
<p>MFSA 2012-37 Information disclosure though Windows file shares and shortcut files</p>
|
|
<p>MFSA 2012-38 Use-after-free while replacing/inserting a node in a document</p>
|
|
<p>MFSA 2012-39 NSS parsing errors with zero length items</p>
|
|
<p>MFSA 2012-40 Buffer overflow and use-after-free issues found using Address Sanitizer</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2011-3101</cvename>
|
|
<cvename>CVE-2012-0441</cvename>
|
|
<cvename>CVE-2012-1938</cvename>
|
|
<cvename>CVE-2012-1939</cvename>
|
|
<cvename>CVE-2012-1937</cvename>
|
|
<cvename>CVE-2012-1940</cvename>
|
|
<cvename>CVE-2012-1941</cvename>
|
|
<cvename>CVE-2012-1944</cvename>
|
|
<cvename>CVE-2012-1945</cvename>
|
|
<cvename>CVE-2012-1946</cvename>
|
|
<cvename>CVE-2012-1947</cvename>
|
|
<url>http://www.mozilla.org/security/known-vulnerabilities/</url>
|
|
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-34.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-36.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-37.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-38.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-39.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-40.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-06-05</discovery>
|
|
<entry>2012-06-05</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="1e14d46f-af1f-11e1-b242-00215af774f0">
|
|
<topic>quagga -- BGP OPEN denial of service vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>quagga</name>
|
|
<range><le>0.99.20.1</le></range>
|
|
</package>
|
|
<package>
|
|
<name>quagga-re</name>
|
|
<range><lt>0.99.17.10</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>CERT reports:</p>
|
|
<blockquote cite="http://www.kb.cert.org/vuls/id/962587">
|
|
<p>If a pre-configured BGP peer sends a specially-crafted OPEN
|
|
message with a malformed ORF capability TLV, Quagga bgpd process
|
|
will erroneously try to consume extra bytes from the input packet
|
|
buffer. The process will detect a buffer overrun attempt before
|
|
it happens and immediately terminate with an error message. All
|
|
BGP sessions established by the attacked router will be closed
|
|
and its BGP routing disrupted.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-1820</cvename>
|
|
<url>http://www.kb.cert.org/vuls/id/962587</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-06-04</discovery>
|
|
<entry>2012-06-05</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="de6d8290-aef7-11e1-898f-14dae938ec40">
|
|
<topic>mail/sympa* -- Multiple vulnerabilities in Sympa archive management</topic>
|
|
<affects>
|
|
<package>
|
|
<name>sympa</name>
|
|
<range><lt>6.0.7</lt></range>
|
|
<range><gt>6.1.*</gt><lt>6.1.11</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>David Verdin reports:</p>
|
|
<blockquote cite="http://www.sympa.org/security_advisories#security_breaches_in_archives_management">
|
|
<p>Multiple vulnerabilities have been discovered in Sympa archive
|
|
management that allow to skip the scenario-based authorization
|
|
mechanisms.</p>
|
|
<p>This vulnerability allows the attacker to:</p>
|
|
<ul>
|
|
<li>display the archives management page ('arc_manage')</li>
|
|
<li>download the list's archives</li>
|
|
<li>delete the list's archives</li>
|
|
</ul>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://www.sympa.org/security_advisories#security_breaches_in_archives_management</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-05-15</discovery>
|
|
<entry>2012-06-05</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="1ecc0d3f-ae8e-11e1-965b-0024e88a8c98">
|
|
<topic>dns/bind9* -- zero-length RDATA can cause named to terminate, reveal memory</topic>
|
|
<affects>
|
|
<package>
|
|
<name>bind99</name>
|
|
<range><lt>9.9.1.1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>bind98</name>
|
|
<range><lt>9.8.3.1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>bind97</name>
|
|
<range><lt>9.7.6.1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>bind96</name>
|
|
<range><lt>9.6.3.1.ESV.R7.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>ISC reports:</p>
|
|
<blockquote cite="http://www.isc.org/software/bind/advisories/cve-2012-1667">
|
|
<p>Processing of DNS resource records where the rdata field is zero length
|
|
may cause various issues for the servers handling them.</p>
|
|
<p>Processing of these records may lead to unexpected outcomes. Recursive
|
|
servers may crash or disclose some portion of memory to the client.
|
|
Secondary servers may crash on restart after transferring a zone
|
|
containing these records. Master servers may corrupt zone data if the
|
|
zone option "auto-dnssec" is set to "maintain". Other unexpected
|
|
problems that are not listed here may also be encountered.</p>
|
|
<p>Impact: This issue primarily affects recursive nameservers.
|
|
Authoritative nameservers will only be impacted if an administrator
|
|
configures experimental record types with no data. If the server is
|
|
configured this way, then secondaries can crash on restart after
|
|
transferring that zone. Zone data on the master can become corrupted if
|
|
the zone with those records has named configured to manage the DNSSEC
|
|
key rotation.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-1667</cvename>
|
|
<url>http://www.isc.org/software/bind/advisories/cve-2012-1667</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-06-04</discovery>
|
|
<entry>2012-06-04</entry>
|
|
<modified>2012-06-06</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="a8864f8f-aa9e-11e1-a284-0023ae8e59f0">
|
|
<topic>databases/postgresql*-server -- crypt vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>postgresql-server</name>
|
|
<range><gt>8.3.*</gt><lt>8.3.18_1</lt></range>
|
|
<range><gt>8.4.*</gt><lt>8.4.11_1</lt></range>
|
|
<range><gt>9.0.*</gt><lt>9.0.7_2</lt></range>
|
|
<range><gt>9.1.*</gt><lt>9.1.3_1</lt></range>
|
|
<range><gt>9.2.*</gt><lt>9.2.b1_1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The PostgreSQL Global Development Group reports:</p>
|
|
<blockquote cite="http://www.postgresql.org/about/news/1397/">
|
|
<p>Today the PHP, OpenBSD and FreeBSD communities announced updates to
|
|
patch a security hole involving their crypt() hashing algorithms. This
|
|
issue is described in CVE-2012-2143. This vulnerability also affects a
|
|
minority of PostgreSQL users, and will be fixed in an update release on
|
|
June 4, 2012.</p>
|
|
<p>Affected users are those who use the crypt(text, text) function
|
|
with DES encryption in the optional pg_crypto module. Passwords
|
|
affected are those that contain characters that cannot be
|
|
represented with 7-bit ASCII. If a password contains a character
|
|
that has the most significant bit set (0x80), and DES encryption
|
|
is used, that character and all characters after it will be ignored.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-2143</cvename>
|
|
<url>http://www.postgresql.org/about/news/1397/</url>
|
|
<url>http://git.postgresql.org/gitweb/?p=postgresql.git;a=patch;h=932ded2ed51e8333852e370c7a6dad75d9f236f9</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-05-30</discovery>
|
|
<entry>2012-05-30</entry>
|
|
<modified>2012-05-31</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="47f13540-c4cb-4971-8dc6-28d0dabfd9cd">
|
|
<topic>nut -- upsd can be remotely crashed</topic>
|
|
<affects>
|
|
<package>
|
|
<name>nut</name>
|
|
<range><ge>2.4.0</ge><le>2.6.3</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Networkupstools project reports:</p>
|
|
<blockquote cite="http://trac.networkupstools.org/projects/nut/changeset/3633">
|
|
<p>NUT server (upsd), from versions 2.4.0 to 2.6.3, are exposed to
|
|
crashes when receiving random data from the network.</p>
|
|
<p>This issue is related to the way NUT parses characters, especially
|
|
from the network. Non printable characters were missed from strings
|
|
operation (such as strlen), but still copied to the buffer, causing
|
|
an overflow.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-2944</cvename>
|
|
<url>http://www.mail-archive.com/debian-bugs-dist@lists.debian.org/msg1027934.html</url>
|
|
<url>http://trac.networkupstools.org/projects/nut/changeset/3633</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-05-30</discovery>
|
|
<entry>2012-05-30</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="359f615d-a9e1-11e1-8a66-14dae9ebcf89">
|
|
<topic>asterisk -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>asterisk16</name>
|
|
<range><gt>1.6.*</gt><le>1.6.2.24</le></range>
|
|
</package>
|
|
<package>
|
|
<name>asterisk18</name>
|
|
<range><gt>1.8.*</gt><lt>1.8.12.1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>asterisk10</name>
|
|
<range><gt>10.*</gt><lt>10.4.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Asterisk project reports:</p>
|
|
<blockquote cite="https://www.asterisk.org/security">
|
|
<p>Remote crash vulnerability in IAX2 channel driver.</p>
|
|
<p>Skinny Channel Driver Remote Crash Vulnerability</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-2947</cvename>
|
|
<url>http://downloads.digium.com/pub/security/AST-2012-007.html</url>
|
|
<cvename>CVE-2012-2948</cvename>
|
|
<url>http://downloads.digium.com/pub/security/AST-2012-008.html</url>
|
|
<url>https://www.asterisk.org/security</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-05-29</discovery>
|
|
<entry>2012-05-29</entry>
|
|
<modified>2012-05-29</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="219d0bfd-a915-11e1-b519-00262d5ed8ee">
|
|
<topic>chromium -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>chromium</name>
|
|
<range><lt>19.0.1084.52</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Google Chrome Releases reports:</p>
|
|
<blockquote cite="http://googlechromereleases.blogspot.com/search/label/Stable%20updates">
|
|
<p>[117409] High CVE-2011-3103: Crashes in v8 garbage collection.
|
|
Credit to the Chromium development community (Brett Wilson).</p>
|
|
<p>[118018] Medium CVE-2011-3104: Out-of-bounds read in Skia. Credit
|
|
to Google Chrome Security Team (Inferno).</p>
|
|
<p>[120912] High CVE-2011-3105: Use-after-free in first-letter
|
|
handling. Credit to miaubiz.</p>
|
|
<p>[122654] Critical CVE-2011-3106: Browser memory corruption with
|
|
websockets over SSL. Credit to the Chromium development community
|
|
(Dharani Govindan).</p>
|
|
<p>[124625] High CVE-2011-3107: Crashes in the plug-in JavaScript
|
|
bindings. Credit to the Chromium development community (Dharani
|
|
Govindan).</p>
|
|
<p>[125159] Critical CVE-2011-3108: Use-after-free in browser cache.
|
|
Credit to "efbiaiinzinz".</p>
|
|
<p>[Linux only] [126296] High CVE-2011-3109: Bad cast in GTK UI.
|
|
Credit to Micha Bartholome.</p>
|
|
<p>[126337] [126343] [126378] [127349] [127819] [127868] High
|
|
CVE-2011-3110: Out of bounds writes in PDF. Credit to Mateusz
|
|
Jurczyk of the Google Security Team, with contributions by Gynvael
|
|
Coldwind of the Google Security Team.</p>
|
|
<p>[126414] Medium CVE-2011-3111: Invalid read in v8. Credit to
|
|
Christian Holler.</p>
|
|
<p>[127331] High CVE-2011-3112: Use-after-free with invalid encrypted
|
|
PDF. Credit to Mateusz Jurczyk of the Google Security Team, with
|
|
contributions by Gynvael Coldwind of the Google Security Team.</p>
|
|
<p>[127883] High CVE-2011-3113: Invalid cast with colorspace handling
|
|
in PDF. Credit to Mateusz Jurczyk of the Google Security Team, with
|
|
contributions by Gynvael Coldwind of the Google Security Team.</p>
|
|
<p>[128014] High CVE-2011-3114: Buffer overflows with PDF functions.
|
|
Credit to Google Chrome Security Team (scarybeasts).</p>
|
|
<p>[128018] High CVE-2011-3115: Type corruption in v8. Credit to
|
|
Christian Holler.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2011-3103</cvename>
|
|
<cvename>CVE-2011-3104</cvename>
|
|
<cvename>CVE-2011-3105</cvename>
|
|
<cvename>CVE-2011-3106</cvename>
|
|
<cvename>CVE-2011-3107</cvename>
|
|
<cvename>CVE-2011-3108</cvename>
|
|
<cvename>CVE-2011-3110</cvename>
|
|
<cvename>CVE-2011-3111</cvename>
|
|
<cvename>CVE-2011-3112</cvename>
|
|
<cvename>CVE-2011-3113</cvename>
|
|
<cvename>CVE-2011-3114</cvename>
|
|
<cvename>CVE-2011-3115</cvename>
|
|
<url>http://googlechromereleases.blogspot.com/search/label/Stable%20updates</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-05-23</discovery>
|
|
<entry>2012-05-28</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="617959ce-a5f6-11e1-a284-0023ae8e59f0">
|
|
<topic>haproxy -- buffer overflow</topic>
|
|
<affects>
|
|
<package>
|
|
<name>haproxy</name>
|
|
<range><lt>1.4.21</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>HAProxy reports:</p>
|
|
<blockquote cite="http://haproxy.1wt.eu/news.html">
|
|
<p>A flaw was reported in HAProxy where, due to a boundary error
|
|
when copying data into the trash buffer, an external attacker could
|
|
cause a buffer overflow. Exploiting this flaw could lead to the
|
|
execution of arbitrary code, however it requires non-default settings
|
|
for the global.tune.bufsize configuration option (must be set to a
|
|
value greater than the default), and also that header rewriting is
|
|
enabled (via, for example, the regrep or rsprep directives).
|
|
This flaw is reported against 1.4.20, prior versions may also be
|
|
affected.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-2391</cvename>
|
|
<url>https://secunia.com/advisories/49261/</url>
|
|
<url>http://haproxy.1wt.eu/download/1.4/src/CHANGELOG</url>
|
|
<url>http://haproxy.1wt.eu/git?p=haproxy-1.4.git;a=commit;h=30297cb17147a8d339eb160226bcc08c91d9530b</url>
|
|
<url>http://haproxy.1wt.eu/news.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-05-21</discovery>
|
|
<entry>2012-05-24</entry>
|
|
<modified>2012-05-29</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="e0a969e4-a512-11e1-90b4-e0cb4e266481">
|
|
<topic>RT -- Multiple Vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>rt40</name>
|
|
<range><ge>4.0</ge><lt>4.0.6</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>rt38</name>
|
|
<range><lt>3.8.12</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>BestPractical report:</p>
|
|
<blockquote cite="http://blog.bestpractical.com/2012/05/security-vulnerabilities-in-rt.html">
|
|
<p>Internal audits of the RT codebase have uncovered a
|
|
number of security vulnerabilities in RT. We are releasing
|
|
versions 3.8.12 and 4.0.6 to resolve these vulnerabilities,
|
|
as well as patches which apply atop all released versions of
|
|
3.8 and 4.0.</p>
|
|
<p>The vulnerabilities addressed by 3.8.12, 4.0.6, and the
|
|
below patches include the following:</p>
|
|
<p>The previously released tool to upgrade weak password
|
|
hashes as part of CVE-2011-0009 was an incomplete fix and
|
|
failed to upgrade passwords of disabled users.</p>
|
|
<p>RT versions 3.0 and above contain a number of cross-site
|
|
scripting (XSS) vulnerabilities which allow an attacker to
|
|
run JavaScript with the user's credentials. CVE-2011-2083 is
|
|
assigned to this vulnerability.</p>
|
|
<p>RT versions 3.0 and above are vulnerable to multiple
|
|
information disclosure vulnerabilities. This includes the
|
|
ability for privileged users to expose users' previous
|
|
password hashes -- this vulnerability is particularly
|
|
dangerous given RT's weak hashing previous to the fix in
|
|
CVE-2011-0009. A separate vulnerability allows privileged
|
|
users to obtain correspondence history for any ticket in
|
|
RT. CVE-2011-2084 is assigned to this vulnerability.</p>
|
|
<p>All publicly released versions of RT are vulnerable to
|
|
cross-site request forgery (CSRF). CVE-2011-2085 is assigned
|
|
to this vulnerability.</p>
|
|
<p>We have also added a separate configuration option
|
|
($RestrictLoginReferrer) to prevent login CSRF, a different
|
|
class of CSRF attack.</p>
|
|
<p>RT versions 3.6.1 and above are vulnerable to a remote
|
|
execution of code vulnerability if the optional VERP
|
|
configuration options ($VERPPrefix and $VERPDomain) are
|
|
enabled. RT 3.8.0 and higher are vulnerable to a limited
|
|
remote execution of code which can be leveraged for
|
|
privilege escalation. RT 4.0.0 and above contain a
|
|
vulnerability in the global $DisallowExecuteCode option,
|
|
allowing sufficiently privileged users to still execute code
|
|
even if RT was configured to not allow it. CVE-2011-4458 is
|
|
assigned to this set of vulnerabilities.</p>
|
|
<p>RT versions 3.0 and above may, under some circumstances,
|
|
still respect rights that a user only has by way of a
|
|
currently-disabled group. CVE-2011-4459 is assigned to this
|
|
vulnerability.</p>
|
|
<p>RT versions 2.0 and above are vulnerable to a SQL
|
|
injection attack, which allow privileged users to obtain
|
|
arbitrary information from the database. CVE-2011-4460 is
|
|
assigned to this vulnerability.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2011-0009</cvename>
|
|
<cvename>CVE-2011-2082</cvename>
|
|
<cvename>CVE-2011-2083</cvename>
|
|
<cvename>CVE-2011-2084</cvename>
|
|
<cvename>CVE-2011-2085</cvename>
|
|
<cvename>CVE-2011-4458</cvename>
|
|
<cvename>CVE-2011-4459</cvename>
|
|
<cvename>CVE-2011-4460</cvename>
|
|
<url>http://blog.bestpractical.com/2012/05/security-vulnerabilities-in-rt.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-05-22</discovery>
|
|
<entry>2012-05-23</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="78c39232-a345-11e1-9d81-d0df9acfd7e5">
|
|
<topic>sympa -- Multiple Security Bypass Vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>sympa</name>
|
|
<range><lt>6.1.11</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia team reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/49045/">
|
|
<p>Multiple vulnerabilities have been reported in Sympa, which can be
|
|
exploited by malicious people to bypass certain security
|
|
restrictions.</p>
|
|
<p>The vulnerabilities are caused due to the application allowing
|
|
access to archive functions without checking credentials. This can
|
|
be exploited to create, download, and delete an archive.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-2352</cvename>
|
|
<url>http://secunia.com/advisories/49045/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-05-14</discovery>
|
|
<entry>2012-05-21</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="495b46fd-a30f-11e1-82c9-d0df9acfd7e5">
|
|
<topic>foswiki -- Script Insertion Vulnerability via unchecked user registration fields</topic>
|
|
<affects>
|
|
<package>
|
|
<name>foswiki</name>
|
|
<range><lt>1.1.5</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Foswiki team reports:</p>
|
|
<blockquote cite="http://foswiki.org/Support/SecurityAlert-CVE-2012-1004">
|
|
<p>When a new user registers, the new user can add arbitrary HTML and
|
|
script code into the user topic which is generated by the
|
|
RegistrationAgent via standard registration fields such as
|
|
"FirstName" or "OrganisationName".</p>
|
|
<p>By design, Foswiki's normal editing features allow arbitrary HTML
|
|
markup, including script code, to be inserted into any topic anyway,
|
|
assuming the authenticated user has CHANGE permission - which is the
|
|
case on many Foswiki sites. However, the assumption that only
|
|
authenticated users with CHANGE permission may create script content
|
|
is false if new users exploit the vulnerability detailed in this
|
|
alert to manipulate the registration agent into creating that
|
|
content for them.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-1004</cvename>
|
|
<url>http://foswiki.org/Support/SecurityAlert-CVE-2012-1004</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-04-13</discovery>
|
|
<entry>2012-05-21</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="b8ae4659-a0da-11e1-a294-bcaec565249c">
|
|
<topic>libxml2 -- An off-by-one out-of-bounds write by XPointer</topic>
|
|
<affects>
|
|
<package>
|
|
<name>libxml2</name>
|
|
<range><lt>2.7.8_3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Google chrome team reports:</p>
|
|
<blockquote cite="http://googlechromereleases.blogspot.com/2012/05/stable-channel-update.html">
|
|
<p>An off-by-one out-of-bounds write flaw was found in the way libxml, a library
|
|
for providing XML and HTML support, evaluated certain XPointer parts (XPointer
|
|
is used by libxml to include only the part from the returned XML document, that
|
|
can be accessed using the XPath expression given with the XPointer). A remote
|
|
attacker could provide a specially-crafted XML file, which once opened in an
|
|
application, linked against libxml, would lead to that application crash, or,
|
|
potentially arbitrary code execution with the privileges of the user running
|
|
the application.</p>
|
|
<p>Note: The flaw to be exploited requires the particular application, linked
|
|
against libxml, to use the XPointer evaluation functionality.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2011-3202</cvename>
|
|
<url>http://googlechromereleases.blogspot.com/2012/05/stable-channel-update.html</url>
|
|
<url>https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-3102</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-05-15</discovery>
|
|
<entry>2012-05-18</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="f5f00804-a03b-11e1-a284-0023ae8e59f0">
|
|
<topic>inspircd -- buffer overflow</topic>
|
|
<affects>
|
|
<package>
|
|
<name>inspircd</name>
|
|
<range><ge>1.2</ge><lt>1.2.9</lt></range>
|
|
<range><ge>2.0</ge><lt>2.0.5_2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>InspIRCd reports:</p>
|
|
<blockquote cite="http://inspircd.github.com/">
|
|
<p>InspIRCd contains a heap corruption vulnerability that exists in the
|
|
dns.cpp code. The res[] buffer is allocated on the heap and can be
|
|
overflowed. The res[] buffer can be exploited during its deallocation.
|
|
The number of overflowed bytes can be controlled with DNS compression
|
|
features.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-1836</cvename>
|
|
<url>http://inspircd.github.com/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-03-19</discovery>
|
|
<entry>2012-05-17</entry>
|
|
<modified>2012-06-21</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="aa71daaa-9f8c-11e1-bd0a-0082a0c18826">
|
|
<topic>pidgin-otr -- format string vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>pidgin-otr</name>
|
|
<range><lt>3.2.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The authors report:</p>
|
|
<blockquote cite="http://www.cypherpunks.ca/otr/">
|
|
<p>Versions 3.2.0 and earlier of the pidgin-otr plugin contain
|
|
a format string security flaw. This flaw could potentially be
|
|
exploited by a remote attacker to cause arbitrary code to be
|
|
executed on the user's machine.</p>
|
|
<p>The flaw is in pidgin-otr, not in libotr. Other applications
|
|
that use libotr are not affected.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-2369</cvename>
|
|
<url>http://www.cypherpunks.ca/otr/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-05-16</discovery>
|
|
<entry>2012-05-16</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="b3435b68-9ee8-11e1-997c-002354ed89bc">
|
|
<topic>sudo -- netmask vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>sudo</name>
|
|
<range><le>1.8.4_1</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Todd Miller reports:</p>
|
|
<blockquote cite="http://www.sudo.ws/sudo/alerts/netmask.html">
|
|
<p>Sudo supports granting access to commands on a per-host basis.
|
|
The host specification may be in the form of a host name, a
|
|
netgroup, an IP address, or an IP network (an IP address with an
|
|
associated netmask).</p>
|
|
<p>When IPv6 support was added to sudo, a bug was introduced that
|
|
caused the IPv6 network matching code to be called when an IPv4
|
|
network address does not match. Depending on the value of the
|
|
uninitialized portion of the IPv6 address, it is possible for the
|
|
IPv4 network number to match when it should not. This bug only
|
|
affects IP network matching and does not affect simple IP address
|
|
matching.</p>
|
|
<p>The reported configuration that exhibited the bug was an
|
|
LDAP-based sudo installation where the sudoRole object contained
|
|
multiple sudoHost entries, each containing a different IPv4
|
|
network. File-based sudoers should be affected as well as the
|
|
same matching code is used.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-2337</cvename>
|
|
<url>http://www.sudo.ws/sudo/alerts/netmask.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-05-16</discovery>
|
|
<entry>2012-05-16</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="dba5d1c9-9f29-11e1-b511-003067c2616f">
|
|
<topic>OpenSSL -- DTLS and TLS 1.1, 1.2 denial of service</topic>
|
|
<affects>
|
|
<package>
|
|
<name>openssl</name>
|
|
<range><lt>1.0.1_2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>OpenSSL security team reports:</p>
|
|
<blockquote cite="http://www.openssl.org/news/secadv_20120510.txt">
|
|
<p>A flaw in the OpenSSL handling of CBC mode ciphersuites in TLS 1.1, 1.2 and
|
|
DTLS can be exploited in a denial of service attack on both clients and
|
|
servers.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-2333</cvename>
|
|
<url>http://www.openssl.org/news/secadv_20120510.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-05-10</discovery>
|
|
<entry>2012-05-10</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="1449af37-9eba-11e1-b9c1-00262d5ed8ee">
|
|
<topic>chromium -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>chromium</name>
|
|
<range><lt>19.0.1084.46</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Google Chrome Releases reports:</p>
|
|
<blockquote cite="http://googlechromereleases.blogspot.com/search/label/Stable%20updates">
|
|
<p>[112983] Low CVE-2011-3083: Browser crash with video + FTP. Credit
|
|
to Aki Helin of OUSPG.</p>
|
|
<p>[113496] Low CVE-2011-3084: Load links from internal pages in their
|
|
own process. Credit to Brett Wilson of the Chromium development
|
|
community.</p>
|
|
<p>[118374] Medium CVE-2011-3085: UI corruption with long autofilled
|
|
values. Credit to "psaldorn".</p>
|
|
<p>[118642] High CVE-2011-3086: Use-after-free with style element.
|
|
Credit to Arthur Gerkis.</p>
|
|
<p>[118664] Low CVE-2011-3087: Incorrect window navigation. Credit to
|
|
Charlie Reis of the Chromium development community.</p>
|
|
<p>[120648] Medium CVE-2011-3088: Out-of-bounds read in hairline
|
|
drawing. Credit to Aki Helin of OUSPG.</p>
|
|
<p>[120711] High CVE-2011-3089: Use-after-free in table handling.
|
|
Credit to miaubiz.</p>
|
|
<p>[121223] Medium CVE-2011-3090: Race condition with workers. Credit
|
|
to Arthur Gerkis.</p>
|
|
<p>[121734] High CVE-2011-3091: Use-after-free with indexed DB. Credit
|
|
to Google Chrome Security Team (Inferno).</p>
|
|
<p>[122337] High CVE-2011-3092: Invalid write in v8 regex. Credit to
|
|
Christian Holler.</p>
|
|
<p>[122585] Medium CVE-2011-3093: Out-of-bounds read in glyph
|
|
handling. Credit to miaubiz.</p>
|
|
<p>[122586] Medium CVE-2011-3094: Out-of-bounds read in Tibetan
|
|
handling. Credit to miaubiz.</p>
|
|
<p>[123481] High CVE-2011-3095: Out-of-bounds write in OGG container.
|
|
Credit to Hannu Heikkinen.</p>
|
|
<p>[Linux only] [123530] Low CVE-2011-3096: Use-after-free in GTK
|
|
omnibox handling. Credit to Arthur Gerkis.</p>
|
|
<p>[123733] [124182] High CVE-2011-3097: Out-of-bounds write in
|
|
sampled functions with PDF. Credit to Kostya Serebryany of Google
|
|
and Evgeniy Stepanov of Google.</p>
|
|
<p>[124479] High CVE-2011-3099: Use-after-free in PDF with corrupt
|
|
font encoding name. Credit to Mateusz Jurczyk of Google Security
|
|
Team and Gynvael Coldwind of Google Security Team.</p>
|
|
<p>[124652] Medium CVE-2011-3100: Out-of-bounds read drawing dash
|
|
paths. Credit to Google Chrome Security Team (Inferno).</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2011-3083</cvename>
|
|
<cvename>CVE-2011-3084</cvename>
|
|
<cvename>CVE-2011-3085</cvename>
|
|
<cvename>CVE-2011-3086</cvename>
|
|
<cvename>CVE-2011-3087</cvename>
|
|
<cvename>CVE-2011-3088</cvename>
|
|
<cvename>CVE-2011-3089</cvename>
|
|
<cvename>CVE-2011-3090</cvename>
|
|
<cvename>CVE-2011-3091</cvename>
|
|
<cvename>CVE-2011-3092</cvename>
|
|
<cvename>CVE-2011-3093</cvename>
|
|
<cvename>CVE-2011-3094</cvename>
|
|
<cvename>CVE-2011-3095</cvename>
|
|
<cvename>CVE-2011-3096</cvename>
|
|
<cvename>CVE-2011-3097</cvename>
|
|
<cvename>CVE-2011-3099</cvename>
|
|
<cvename>CVE-2011-3100</cvename>
|
|
<url>http://googlechromereleases.blogspot.com/search/label/Stable%20updates</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-05-15</discovery>
|
|
<entry>2012-05-15</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="6601127c-9e09-11e1-b5e0-000c299b62e1">
|
|
<topic>socat -- Heap-based buffer overflow</topic>
|
|
<affects>
|
|
<package>
|
|
<name>socat</name>
|
|
<range><lt>1.7.2.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The socat development team reports:</p>
|
|
<blockquote cite="http://www.dest-unreach.org/socat/contrib/socat-secadv3.html">
|
|
<p>This vulnerability can be exploited when socat is invoked with the
|
|
READLINE address (this is usually only used interactively) without
|
|
option "prompt" and without option "noprompt" and an attacker succeeds
|
|
to provide malicious data to the other (arbitrary) address that is then
|
|
transferred by socat to the READLINE address for output.</p>
|
|
<p>Successful exploitation may allow an attacker to execute arbitrary
|
|
code with the privileges of the socat process.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-0219</cvename>
|
|
<url>www.dest-unreach.org/socat/contrib/socat-secadv3.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-05-14</discovery>
|
|
<entry>2012-05-14</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="59b68b1e-9c78-11e1-b5e0-000c299b62e1">
|
|
<topic>php -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>php5</name>
|
|
<range><gt>5.4</gt><lt>5.4.3</lt></range>
|
|
<range><lt>5.3.13</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>php53</name>
|
|
<range><lt>5.3.13</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>php52</name>
|
|
<range><lt>5.2.17_9</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The PHP Development Team reports:</p>
|
|
<blockquote cite="http://www.php.net/archive/2012.php#id2012-05-08-1">
|
|
<p>The release of PHP 5.4.13 and 5.4.3 complete a fix for the
|
|
vulnerability in CGI-based setups as originally described in
|
|
CVE-2012-1823. (CVE-2012-2311)</p>
|
|
<p>Note: mod_php and php-fpm are not vulnerable to this attack.</p>
|
|
<p>PHP 5.4.3 fixes a buffer overflow vulnerability in the
|
|
apache_request_headers() (CVE-2012-2329).</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-1823</cvename>
|
|
<cvename>CVE-2012-2311</cvename>
|
|
<cvename>CVE-2012-2329</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-05-08</discovery>
|
|
<entry>2012-05-12</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="64f8b72d-9c4e-11e1-9c94-000bcdf0a03b">
|
|
<topic>libpurple -- Invalid memory dereference in the XMPP protocol plug-in by processing serie of specially-crafted file transfer requests</topic>
|
|
<affects>
|
|
<package>
|
|
<name>libpurple</name>
|
|
<range><lt>2.10.4</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Pidgin reports:</p>
|
|
<blockquote cite="http://pidgin.im/news/security/?id=62">
|
|
<p>A series of specially crafted file transfer requests can cause clients to reference invalid memory. The user must have accepted one of the file transfer requests.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-2214</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-05-06</discovery>
|
|
<entry>2012-05-12</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="0d3547ab-9b69-11e1-bdb1-525401003090">
|
|
<topic>PivotX -- 'ajaxhelper.php' Cross Site Scripting Vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>pivotx</name>
|
|
<range><le>2.3.2</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>High-Tech Bridge reports:</p>
|
|
<blockquote cite="https://www.htbridge.com/advisory/HTB23087">
|
|
<p>Input passed via the "file" GET parameter to
|
|
/pivotx/ajaxhelper.php is not properly sanitised before
|
|
being returned to the user. This can be exploited to
|
|
execute arbitrary HTML and script code in administrator's
|
|
browser session in context of the affected website.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>52159</bid>
|
|
<cvename>CVE-2012-2274</cvename>
|
|
<url>https://www.htbridge.com/advisory/HTB23087</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-05-09</discovery>
|
|
<entry>2012-05-12</entry>
|
|
<modified>2012-05-14</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="b91234e7-9a8b-11e1-b666-001636d274f3">
|
|
<topic>NVIDIA UNIX driver -- access to arbitrary system memory</topic>
|
|
<affects>
|
|
<package>
|
|
<name>nvidia-driver</name>
|
|
<range><gt>173.14.35_2</gt><lt>295.71</lt></range>
|
|
<range><gt>96.43.20_3</gt><lt>173.14.35</lt></range>
|
|
<range><gt>71.86.15_3</gt><lt>96.43.20_2</lt></range>
|
|
<range><lt>71.86.15_2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>NVIDIA Unix security team reports:</p>
|
|
<blockquote cite="http://nvidia.custhelp.com/app/answers/detail/a_id/3109">
|
|
<p>Security vulnerability CVE-2012-0946 in the NVIDIA UNIX driver
|
|
was disclosed to NVIDIA on March 20th, 2012. The vulnerability
|
|
makes it possible for an attacker who has read and write access
|
|
to the GPU device nodes to reconfigure GPUs to gain access to
|
|
arbitrary system memory. NVIDIA is not aware of any reports of
|
|
this vulnerability, outside of the disclosure which was made
|
|
privately to NVIDIA.</p>
|
|
<p>NVIDIA has identified the root cause of the vulnerability and
|
|
has released updated drivers which close it. [NVIDIA encourages]
|
|
all users with Geforce 8 or newer, G80 Quadro or newer, and all
|
|
Tesla GPUs to update their drivers to 295.40 or later.</p>
|
|
</blockquote>
|
|
<p>Later, it was additionally discovered that similar exploit could
|
|
be achieved through remapping of VGA window:</p>
|
|
<blockquote cite="http://nvidia.custhelp.com/app/answers/detail/a_id/3140">
|
|
<p>NVIDIA received notification of a security exploit that uses
|
|
NVIDIA UNIX device files to map and program registers to redirect
|
|
the VGA window. Through the VGA window, the exploit can access
|
|
any region of physical system memory. This arbitrary memory
|
|
access can be further exploited, for example, to escalate user
|
|
privileges.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-0946</cvename>
|
|
<cvename>CVE-2012-4225</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-03-20</discovery>
|
|
<entry>2012-05-10</entry>
|
|
<modified>2012-09-12</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="3d55b961-9a2e-11e1-a2ef-001fd0af1a4c">
|
|
<topic>rubygem-mail -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>rubygem-mail</name>
|
|
<range><lt>2.4.4</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>rubygem-mail -- multiple vulnerabilities</p>
|
|
<blockquote cite="http://seclists.org/oss-sec/2012/q2/190">
|
|
<p>Two issues were fixed. They are a file system traversal in file_delivery method and arbitrary command execution when using exim or sendmail from the command line.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-2139</cvename>
|
|
<cvename>CVE-2012-2140</cvename>
|
|
<url>http://seclists.org/oss-sec/2012/q2/190</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-03-14</discovery>
|
|
<entry>2012-05-09</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="a1d0911f-987a-11e1-a2ef-001fd0af1a4c">
|
|
<topic>node -- private information disclosure</topic>
|
|
<affects>
|
|
<package>
|
|
<name>node</name>
|
|
<name>node-devel</name>
|
|
<range><lt>0.6.17</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Private information disclosure</p>
|
|
<blockquote cite="http://blog.nodejs.org/2012/05/07/http-server-security-vulnerability-please-upgrade-to-0-6-17/">
|
|
<p>An attacker can cause private information disclosure.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://blog.nodejs.org/2012/05/07/http-server-security-vulnerability-please-upgrade-to-0-6-17/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-04-17</discovery>
|
|
<entry>2012-05-07</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="725ab25a-987b-11e1-a2ef-001fd0af1a4c">
|
|
<topic>p5-Config-IniFiles -- unsafe temporary file creation</topic>
|
|
<affects>
|
|
<package>
|
|
<name>p5-Config-IniFiles</name>
|
|
<range><lt>2.71</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Unsafe Temporary file creation</p>
|
|
<blockquote cite="https://bitbucket.org/shlomif/perl-config-inifiles/changeset/a08fa26f4f59">
|
|
<p>Config::IniFiles used a predictable name for its temporary
|
|
file without opening it correctly.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-2451</cvename>
|
|
<url>https://bitbucket.org/shlomif/perl-config-inifiles/changeset/a08fa26f4f59</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-05-02</discovery>
|
|
<entry>2012-05-07</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="60de13d5-95f0-11e1-806a-001143cd36d8">
|
|
<topic>php -- vulnerability in certain CGI-based setups</topic>
|
|
<affects>
|
|
<package>
|
|
<name>php5</name>
|
|
<range><gt>5.4</gt><lt>5.4.2</lt></range>
|
|
<range><lt>5.3.12</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>php53</name>
|
|
<range><lt>5.3.12</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>php4</name>
|
|
<range><lt>4.4.10</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>php52</name>
|
|
<range><lt>5.2.17_8</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>php development team reports:</p>
|
|
<blockquote cite="http://www.php.net/archive/2012.php#id2012-05-03-1">
|
|
<p>Security Enhancements and Fixes in PHP 5.3.12:</p>
|
|
<ul>
|
|
<li>Initial fix for cgi-bin ?-s cmdarg parse issue
|
|
(CVE-2012-1823)</li>
|
|
</ul>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-1823</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-05-03</discovery>
|
|
<entry>2012-05-05</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="18dffa02-946a-11e1-be9d-000c29cc39d3">
|
|
<topic>WebCalendar -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>WebCalendar-devel</name>
|
|
<range><le>1.2.4</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Hanno Boeck reports:</p>
|
|
<blockquote cite="http://www.openwall.com/lists/oss-security/2012/04/28/1">
|
|
<p>Fixes [are now available] for various security vulnerabilities
|
|
including LFI (local file inclusion), XSS (cross site scripting)
|
|
and others.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-1495</cvename>
|
|
<cvename>CVE-2012-1496</cvename>
|
|
<url>http://packetstormsecurity.org/files/112332/WebCalendar-1.2.4-Remote-Code-Execution.html</url>
|
|
<url>http://packetstormsecurity.org/files/112323/WebCalendar-1.2.4-Pre-Auth-Remote-Code-Injection.html</url>
|
|
<url>http://archives.neohapsis.com/archives/bugtraq/2012-04/0182.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-04-28</discovery>
|
|
<entry>2012-05-02</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="94c0ac4f-9388-11e1-b242-00262d5ed8ee">
|
|
<topic>chromium -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>chromium</name>
|
|
<range><lt>18.0.1025.168</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Google Chrome Releases reports:</p>
|
|
<blockquote cite="http://googlechromereleases.blogspot.com/search/label/Stable%20updates">
|
|
<p>[106413] High CVE-2011-3078: Use after free in floats handling.
|
|
Credit to Google Chrome Security Team (Marty Barbella) and
|
|
independent later discovery by miaubiz.</p>
|
|
<p>[117627] Medium CVE-2011-3079: IPC validation failure. Credit to
|
|
PinkiePie.</p>
|
|
<p>[121726] Medium CVE-2011-3080: Race condition in sandbox IPC.
|
|
Credit to Willem Pinckaers of Matasano.</p>
|
|
<p>[121899] High CVE-2011-3081: Use after free in floats handling.
|
|
Credit to miaubiz.</p>
|
|
<p>[117110] High CVE-2012-1521: Use after free in xml parser. Credit
|
|
to Google Chrome Security Team (SkyLined) and independent later
|
|
discovery by wushi of team509 reported through iDefense VCP
|
|
(V-874rcfpq7z).</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2011-3078</cvename>
|
|
<cvename>CVE-2011-3079</cvename>
|
|
<cvename>CVE-2011-3080</cvename>
|
|
<cvename>CVE-2011-3081</cvename>
|
|
<cvename>CVE-2012-1521</cvename>
|
|
<url>http://googlechromereleases.blogspot.com/search/label/Stable%20updates</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-04-30</discovery>
|
|
<entry>2012-05-01</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="2cde1892-913e-11e1-b44c-001fd0af1a4c">
|
|
<topic>php -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>php53</name>
|
|
<range><lt>5.3.11</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>php5</name>
|
|
<range><lt>5.3.11</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>php development team reports:</p>
|
|
<blockquote cite="http://www.php.net/archive/2012.php#id2012-04-26-1">
|
|
<p>Security Enhancements for both PHP 5.3.11 and PHP 5.4.1:</p>
|
|
<ul>
|
|
<li>Insufficient validating of upload name leading to corrupted $_FILES indices. (CVE-2012-1172) </li>
|
|
<li>Add open_basedir checks to readline_write_history and readline_read_history.</li>
|
|
</ul>
|
|
<p>Security Enhancements for both PHP 5.3.11 only:</p>
|
|
<ul>
|
|
<li>Regression in magic_quotes_gpc fix for CVE-2012-0831.</li>
|
|
</ul>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-0831</cvename>
|
|
<cvename>CVE-2012-1172</cvename>
|
|
<url>http://www.php.net/archive/2012.php#id2012-04-26-1</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-03-01</discovery>
|
|
<entry>2012-04-28</entry>
|
|
<modified>2012-05-04</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="0fa15e08-92ec-11e1-a94a-00215c6a37bb">
|
|
<topic>samba -- incorrect permission checks vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>samba34</name>
|
|
<range><gt>3.4.*</gt><lt>3.4.17</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>samba35</name>
|
|
<range><gt>3.5.*</gt><lt>3.5.15</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>samba36</name>
|
|
<range><gt>3.6.*</gt><lt>3.6.5</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Samba project reports:</p>
|
|
<blockquote cite="http://www.samba.org/samba/security/CVE-2012-2111">
|
|
<p>Samba versions 3.4.x to 3.6.4 inclusive are affected
|
|
by a vulnerability that allows arbitrary users to modify
|
|
privileges on a file server.</p>
|
|
<p>Security checks were incorrectly applied to the Local
|
|
Security Authority (LSA) remote proceedure calls (RPC)
|
|
CreateAccount, OpenAccount, AddAccountRights and
|
|
RemoveAccountRights allowing any authenticated user
|
|
to modify the privileges database.</p>
|
|
<p>This is a serious error, as it means that authenticated
|
|
users can connect to the LSA and grant themselves the
|
|
"take ownership" privilege. This privilege is used by the
|
|
smbd file server to grant the ability to change ownership
|
|
of a file or directory which means users could take ownership
|
|
of files or directories they do not own.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-2111</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-04-30</discovery>
|
|
<entry>2012-04-30</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="b428e6b3-926c-11e1-8d7b-003067b2972c">
|
|
<topic>portupgrade-devel -- lack of distfile checksums</topic>
|
|
<affects>
|
|
<package>
|
|
<name>portupgrade-devel</name>
|
|
<range><lt>0,3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Ports security team reports:</p>
|
|
<p>The portupgrade-devel port fetched directly from a git
|
|
respository without checking against a known good
|
|
SHA hash. This means that it is possible that packages
|
|
built using this port may not match the one vetted
|
|
by the maintainer. Users are advised to rebuild
|
|
portupgrade-devel from known good sources.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<mlist>http://web.archiveorange.com/archive/v/6ETvLYPz7CfFT9tiHKiI</mlist>
|
|
<mlist>http://www.freebsd.org/cgi/getmsg.cgi?fetch=100677+0+/usr/local/www/db/text/2012/cvs-ports/20120506.cvs-ports</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-04-30</discovery>
|
|
<entry>2012-04-30</entry>
|
|
<modified>2012-05-06</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="5d85976a-9011-11e1-b5e0-000c299b62e1">
|
|
<topic>net-snmp -- Remote DoS</topic>
|
|
<affects>
|
|
<package>
|
|
<name>net-snmp</name>
|
|
<range><lt>5.7.1_7</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Red Hat Security Response Team reports:</p>
|
|
<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=815813">
|
|
<p>An array index error, leading to out-of heap-based buffer read flaw was
|
|
found in the way the net-snmp agent performed lookups in the
|
|
extension table. When certain MIB subtrees were handled by the
|
|
extend directive, a remote attacker (having read privileges to the
|
|
subntree) could use this flaw to cause a denial of service condition
|
|
via an SNMP GET request involving a non-existent extension table
|
|
entry.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-2141</cvename>
|
|
<url>https://bugzilla.redhat.com/show_bug.cgi?id=815813</url>
|
|
<url>http://www.openwall.com/lists/oss-security/2012/04/26/2</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-04-26</discovery>
|
|
<entry>2012-04-27</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="380e8c56-8e32-11e1-9580-4061862b8c22">
|
|
<topic>mozilla -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>firefox</name>
|
|
<range><gt>11.0,1</gt><lt>12.0,1</lt></range>
|
|
<range><lt>10.0.4,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-firefox</name>
|
|
<range><lt>10.0.4,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-seamonkey</name>
|
|
<range><lt>2.9</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-thunderbird</name>
|
|
<range><lt>10.0.4</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>seamonkey</name>
|
|
<range><lt>2.9</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>thunderbird</name>
|
|
<range><gt>11.0</gt><lt>12.0</lt></range>
|
|
<range><lt>10.0.4</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>libxul</name>
|
|
<range><gt>1.9.2.*</gt><lt>10.0.4</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Mozilla Project reports:</p>
|
|
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
|
|
<p>MFSA 2012-20 Miscellaneous memory safety hazards (rv:12.0/ rv:10.0.4)</p>
|
|
<p>MFSA 2012-21 Multiple security flaws fixed in FreeType v2.4.9</p>
|
|
<p>MFSA 2012-22 use-after-free in IDBKeyRange</p>
|
|
<p>MFSA 2012-23 Invalid frees causes heap corruption in gfxImageSurface</p>
|
|
<p>MFSA 2012-24 Potential XSS via multibyte content processing errors</p>
|
|
<p>MFSA 2012-25 Potential memory corruption during font rendering using cairo-dwrite</p>
|
|
<p>MFSA 2012-26 WebGL.drawElements may read illegal video memory due to FindMaxUshortElement error</p>
|
|
<p>MFSA 2012-27 Page load short-circuit can lead to XSS</p>
|
|
<p>MFSA 2012-28 Ambiguous IPv6 in Origin headers may bypass webserver access restrictions</p>
|
|
<p>MFSA 2012-29 Potential XSS through ISO-2022-KR/ISO-2022-CN decoding issues</p>
|
|
<p>MFSA 2012-30 Crash with WebGL content using textImage2D</p>
|
|
<p>MFSA 2012-31 Off-by-one error in OpenType Sanitizer</p>
|
|
<p>MFSA 2012-32 HTTP Redirections and remote content can be read by javascript errors</p>
|
|
<p>MFSA 2012-33 Potential site identity spoofing when loading RSS and Atom feeds</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2011-1187</cvename>
|
|
<cvename>CVE-2011-3062</cvename>
|
|
<cvename>CVE-2012-0467</cvename>
|
|
<cvename>CVE-2012-0468</cvename>
|
|
<cvename>CVE-2012-0469</cvename>
|
|
<cvename>CVE-2012-0470</cvename>
|
|
<cvename>CVE-2012-0471</cvename>
|
|
<cvename>CVE-2012-0472</cvename>
|
|
<cvename>CVE-2012-0473</cvename>
|
|
<cvename>CVE-2012-0474</cvename>
|
|
<cvename>CVE-2012-0475</cvename>
|
|
<cvename>CVE-2012-0477</cvename>
|
|
<cvename>CVE-2012-0478</cvename>
|
|
<cvename>CVE-2012-0479</cvename>
|
|
<cvename>CVE-2012-1126</cvename>
|
|
<cvename>CVE-2012-1127</cvename>
|
|
<cvename>CVE-2012-1128</cvename>
|
|
<cvename>CVE-2012-1129</cvename>
|
|
<cvename>CVE-2012-1130</cvename>
|
|
<cvename>CVE-2012-1131</cvename>
|
|
<cvename>CVE-2012-1132</cvename>
|
|
<cvename>CVE-2012-1133</cvename>
|
|
<cvename>CVE-2012-1134</cvename>
|
|
<cvename>CVE-2012-1135</cvename>
|
|
<cvename>CVE-2012-1136</cvename>
|
|
<cvename>CVE-2012-1137</cvename>
|
|
<cvename>CVE-2012-1138</cvename>
|
|
<cvename>CVE-2012-1139</cvename>
|
|
<cvename>CVE-2012-1140</cvename>
|
|
<cvename>CVE-2012-1141</cvename>
|
|
<cvename>CVE-2012-1142</cvename>
|
|
<cvename>CVE-2012-1143</cvename>
|
|
<cvename>CVE-2012-1144</cvename>
|
|
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-20.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-21.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-22.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-23.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-24.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-25.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-26.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-27.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-28.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-29.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-30.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-31.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-32.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-33.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-04-24</discovery>
|
|
<entry>2012-04-24</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="a04247f1-8d9c-11e1-93c7-00215c6a37bb">
|
|
<topic>Dokuwiki -- cross site scripting vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>dokuwiki</name>
|
|
<range><lt>20120125_1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Andy Webber reports:</p>
|
|
<blockquote cite="http://bugs.dokuwiki.org/index.php?do=details&task_id=2487">
|
|
<p>Add User appears to be vulnerable to Cross Site Request Forgery (CSRF/XSRF).</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-2128</cvename>
|
|
<cvename>CVE-2012-2129</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-04-17</discovery>
|
|
<entry>2012-04-23</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="1c5abbe2-8d7f-11e1-a374-14dae9ebcf89">
|
|
<topic>asterisk -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>asterisk16</name>
|
|
<range><gt>1.6.*</gt><lt>1.6.2.24</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>asterisk18</name>
|
|
<range><gt>1.8.*</gt><lt>1.8.11.1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>asterisk10</name>
|
|
<range><gt>10.*</gt><lt>10.3.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Asterisk project reports:</p>
|
|
<blockquote cite="https://www.asterisk.org/security">
|
|
<p>Remote Crash Vulnerability in SIP Channel Driver</p>
|
|
<p>Heap Buffer Overflow in Skinny Channel Driver</p>
|
|
<p>Asterisk Manager User Unauthorized Shell Access</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://downloads.digium.com/pub/security/AST-2012-004.html</url>
|
|
<cvename>CVE-2012-2414</cvename>
|
|
<url>http://downloads.digium.com/pub/security/AST-2012-005.html</url>
|
|
<cvename>CVE-2012-2415</cvename>
|
|
<url>http://downloads.digium.com/pub/security/AST-2012-006.html</url>
|
|
<cvename>CVE-2012-2416</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-04-23</discovery>
|
|
<entry>2012-04-23</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="b384cc5b-8d56-11e1-8d7b-003067b2972c">
|
|
<topic>wordpress -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>wordpress</name>
|
|
<range><lt>3.3.2,1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Wordpress reports:</p>
|
|
<blockquote cite="https://codex.wordpress.org/Version_3.3.2">
|
|
<p>External code has been updated to
|
|
non-vulnerable versions.
|
|
In addition the following bugs have been fixed:</p>
|
|
<ul>
|
|
<li>Limited privilege escalation where a site administrator could
|
|
deactivate network-wide plugins when running a WordPress network under
|
|
particular circumstances.</li>
|
|
<li>Cross-site scripting vulnerability when making URLs
|
|
clickable.</li>
|
|
<li>Cross-site scripting vulnerabilities in redirects after posting
|
|
comments in older browsers, and when filtering URLs.</li>
|
|
</ul>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-2399</cvename>
|
|
<cvename>CVE-2012-2400</cvename>
|
|
<cvename>CVE-2012-2401</cvename>
|
|
<cvename>CVE-2012-2402</cvename>
|
|
<cvename>CVE-2012-2403</cvename>
|
|
<cvename>CVE-2012-2404</cvename>
|
|
<url>https://codex.wordpress.org/Version_3.3.2</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-04-20</discovery>
|
|
<entry>2012-04-23</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="7184f92e-8bb8-11e1-8d7b-003067b2972c">
|
|
<topic>OpenSSL -- integer conversions result in memory corruption</topic>
|
|
<affects>
|
|
<package>
|
|
<name>openssl</name>
|
|
<range><lt>1.0.1_1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>OpenSSL security team reports:</p>
|
|
<blockquote cite="http://www.openssl.org/news/secadv_20120419.txt">
|
|
<p>A potentially exploitable vulnerability has been discovered in the OpenSSL
|
|
function asn1_d2i_read_bio.
|
|
Any application which uses BIO or FILE based functions to read untrusted DER
|
|
format data is vulnerable. Affected functions are of the form d2i_*_bio or
|
|
d2i_*_fp, for example d2i_X509_bio or d2i_PKCS12_fp.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-2110</cvename>
|
|
<mlist msgid="20120419103522.GN30784@cmpxchg8b.com">http://marc.info/?l=full-disclosure&m=133483221408243</mlist>
|
|
<url>http://www.openssl.org/news/secadv_20120419.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-04-19</discovery>
|
|
<entry>2012-04-21</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="09c87973-8b9d-11e1-b393-20cf30e32f6d">
|
|
<topic>bugzilla -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>bugzilla</name>
|
|
<range><ge>3.6.0</ge><lt>3.6.9</lt></range>
|
|
<range><ge>4.0.0</ge><lt>4.0.6</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<h1>A Bugzilla Security Advisory reports:</h1>
|
|
<blockquote cite="http://www.bugzilla.org/security/3.6.8/">
|
|
<p>The following security issues have been discovered in
|
|
Bugzilla:</p>
|
|
<h1>Unauthorized Access</h1>
|
|
<p>Due to a lack of proper validation of the X-FORWARDED-FOR
|
|
header of an authentication request, an attacker could bypass
|
|
the current lockout policy used for protection against brute-
|
|
force password discovery. This vulnerability can only be
|
|
exploited if the 'inbound_proxies' parameter is set.</p>
|
|
<h1>Cross Site Scripting</h1>
|
|
<p>A JavaScript template used by buglist.cgi could be used
|
|
by a malicious script to permit an attacker to gain access
|
|
to some information about bugs he would not normally be
|
|
allowed to see, using the victim's credentials. To be
|
|
exploitable, the victim must be logged in when visiting
|
|
the attacker's malicious page.</p>
|
|
<p>All affected installations are encouraged to upgrade as soon
|
|
as possible.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-0465</cvename>
|
|
<cvename>CVE-2012-0466</cvename>
|
|
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=728639</url>
|
|
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=745397</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-04-18</discovery>
|
|
<entry>2012-04-21</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="67516177-88ec-11e1-9a10-0023ae8e59f0">
|
|
<topic>typo -- Cross-Site Scripting</topic>
|
|
<affects>
|
|
<package>
|
|
<name>typo3</name>
|
|
<range><ge>4.6.0</ge><le>4.6.7</le></range>
|
|
<range><ge>4.5.0</ge><le>4.5.14</le></range>
|
|
<range><ge>4.4.0</ge><le>4.4.14</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Typo Security Team reports:</p>
|
|
<blockquote cite="https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2012-002/">
|
|
<p>Failing to properly encode the output, the default TYPO3
|
|
Exception Handler is susceptible to Cross-Site Scripting. We
|
|
are not aware of a possibility to exploit this vulnerability
|
|
without third party extensions being installed that put user
|
|
input in exception messages. However, it has come to our
|
|
attention that extensions using the extbase MVC framework can
|
|
be used to exploit this vulnerability if these extensions
|
|
accept objects in controller actions.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-2112</cvename>
|
|
<url>https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2012-002/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-04-17</discovery>
|
|
<entry>2012-04-18</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="0c14dfa7-879e-11e1-a2a0-00500802d8f7">
|
|
<topic>nginx -- Buffer overflow in the ngx_http_mp4_module</topic>
|
|
<affects>
|
|
<package>
|
|
<name>nginx</name>
|
|
<range><lt>1.0.15</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>nginx-devel</name>
|
|
<range><lt>1.1.19</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The nginx project reports:</p>
|
|
<blockquote cite="http://nginx.org/en/security_advisories.html">
|
|
<p>Buffer overflow in the ngx_http_mp4_module</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-2089</cvename>
|
|
<url>http://nginx.org/en/security_advisories.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-04-12</discovery>
|
|
<entry>2012-04-16</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="c80a3d93-8632-11e1-a374-14dae9ebcf89">
|
|
<topic>phpmyfaq -- Remote PHP Code Execution Vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>phpmyfaq</name>
|
|
<range><lt>2.7.5</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The phpMyFAQ project reports:</p>
|
|
<blockquote cite="http://www.phpmyfaq.de/advisory_2011-10-25.php">
|
|
<p>The bundled ImageManager library allows injection of arbitrary
|
|
PHP code to execute arbitrary PHP code and upload malware and
|
|
trojan horses.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://www.phpmyfaq.de/advisory_2012-04-14.php</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-04-14</discovery>
|
|
<entry>2012-04-14</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="607d2108-a0e4-423a-bf78-846f2a8f01b0">
|
|
<topic>puppet -- Multiple Vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>puppet</name>
|
|
<range><gt>2.7.*</gt><lt>2.7.12_1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<blockquote cite="http://puppetlabs.com/security/">
|
|
<p>Multiple vulnerabilities exist in puppet that can result in
|
|
arbitrary code execution, arbitrary file read access, denial of
|
|
service, and arbitrary file write access. Please review the
|
|
details in each of the CVEs for additional information.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-1906</cvename>
|
|
<cvename>CVE-2012-1986</cvename>
|
|
<cvename>CVE-2012-1987</cvename>
|
|
<cvename>CVE-2012-1988</cvename>
|
|
<cvename>CVE-2012-1989</cvename>
|
|
<url>http://puppetlabs.com/security/cve/cve-2012-1906/</url>
|
|
<url>http://puppetlabs.com/security/cve/cve-2012-1986/</url>
|
|
<url>http://puppetlabs.com/security/cve/cve-2012-1987/</url>
|
|
<url>http://puppetlabs.com/security/cve/cve-2012-1988/</url>
|
|
<url>http://puppetlabs.com/security/cve/cve-2012-1989/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-03-26</discovery>
|
|
<entry>2012-04-10</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="baf37cd2-8351-11e1-894e-00215c6a37bb">
|
|
<topic>samba -- "root" credential remote code execution</topic>
|
|
<affects>
|
|
<package>
|
|
<name>samba34</name>
|
|
<range><gt>3.4.*</gt><lt>3.4.16</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>samba35</name>
|
|
<range><gt>3.5.*</gt><lt>3.5.14</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>samba36</name>
|
|
<range><gt>3.6.*</gt><lt>3.6.4</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Samba development team reports:</p>
|
|
<blockquote cite="http://www.samba.org/samba/security/CVE-2012-1182">
|
|
<p>Samba versions 3.6.3 and all versions previous to this
|
|
are affected by a vulnerability that allows remote code
|
|
execution as the "root" user from an anonymous connection.</p>
|
|
<p>As this does not require an authenticated connection it
|
|
is the most serious vulnerability possible in a program,
|
|
and users and vendors are encouraged to patch their Samba
|
|
installations immediately.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-1182</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-04-10</discovery>
|
|
<entry>2012-04-10</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="7f448dc1-82ca-11e1-b393-20cf30e32f6d">
|
|
<topic>bugzilla Cross-Site Request Forgery</topic>
|
|
<affects>
|
|
<package>
|
|
<name>bugzilla</name>
|
|
<range><ge>4.0.0</ge><lt>4.0.5</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A Bugzilla Security Advisory reports:</p>
|
|
<blockquote cite="http://www.bugzilla.org/security/4.0.4/">
|
|
<p>The following security issues have been discovered in
|
|
Bugzilla:</p>
|
|
<ul>
|
|
<li>Due to a lack of validation of the enctype form attribute
|
|
when making POST requests to xmlrpc.cgi, a possible CSRF
|
|
vulnerability was discovered. If a user visits an HTML page
|
|
with some malicious HTML code in it, an attacker could make
|
|
changes to a remote Bugzilla installation on behalf of the
|
|
victim's account by using the XML-RPC API on a site running
|
|
mod_perl. Sites running under mod_cgi are not affected.
|
|
Also, the user would have had to be already logged in to the
|
|
target site for the vulnerability to work.</li>
|
|
</ul>
|
|
<p>All affected installations are encouraged to upgrade as soon
|
|
as possible.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-0453</cvename>
|
|
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=725663</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-02-22</discovery>
|
|
<entry>2012-04-10</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="20923a0d-82ba-11e1-8d7b-003067b2972c">
|
|
<topic>linux-flashplugin -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>linux-f10-flashplugin</name>
|
|
<range><lt>11.2r202.228</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Adobe reports:</p>
|
|
<blockquote cite="https://www.adobe.com/support/security/bulletins/apsb12-07.html">
|
|
<p>Multiple Priority 2 vulnerabilities could cause a crash and
|
|
potentially allow an attacker to take control of the affected
|
|
system.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-0724</cvename>
|
|
<cvename>CVE-2012-0725</cvename>
|
|
<cvename>CVE-2012-0772</cvename>
|
|
<cvename>CVE-2012-0773</cvename>
|
|
<url>https://www.adobe.com/support/security/bulletins/apsb12-07.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-04-05</discovery>
|
|
<entry>2012-04-10</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="262b92fe-81c8-11e1-8899-001ec9578670">
|
|
<topic>png -- memory corruption/possible remote code execution</topic>
|
|
<affects>
|
|
<package>
|
|
<name>png</name>
|
|
<range><lt>1.4.11</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The PNG project reports:</p>
|
|
<blockquote cite="http://www.libpng.org/pub/png/libpng.html">
|
|
<p>libpng fails to correctly handle malloc() failures for text
|
|
chunks (in png_set_text_2()), which can lead to memory
|
|
corruption and the possibility of remote code execution.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2011-3048</cvename>
|
|
<url>http://www.libpng.org/pub/png/libpng.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-03-29</discovery>
|
|
<entry>2012-04-08</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="462e2d6c-8017-11e1-a571-bcaec565249c">
|
|
<topic>freetype -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>freetype2</name>
|
|
<range><lt>2.4.9</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Freetype project reports:</p>
|
|
<blockquote cite="https://sourceforge.net/projects/freetype/files/freetype2/2.4.9/README/view">
|
|
<p>Multiple vulnerabilities exist in freetype that can result in
|
|
application crashes and remote code execution. Please review
|
|
the details in each of the CVEs for additional information.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-1126</cvename>
|
|
<cvename>CVE-2012-1127</cvename>
|
|
<cvename>CVE-2012-1128</cvename>
|
|
<cvename>CVE-2012-1129</cvename>
|
|
<cvename>CVE-2012-1130</cvename>
|
|
<cvename>CVE-2012-1131</cvename>
|
|
<cvename>CVE-2012-1132</cvename>
|
|
<cvename>CVE-2012-1133</cvename>
|
|
<cvename>CVE-2012-1134</cvename>
|
|
<cvename>CVE-2012-1135</cvename>
|
|
<cvename>CVE-2012-1136</cvename>
|
|
<cvename>CVE-2012-1137</cvename>
|
|
<cvename>CVE-2012-1138</cvename>
|
|
<cvename>CVE-2012-1139</cvename>
|
|
<cvename>CVE-2012-1140</cvename>
|
|
<cvename>CVE-2012-1141</cvename>
|
|
<cvename>CVE-2012-1142</cvename>
|
|
<cvename>CVE-2012-1143</cvename>
|
|
<cvename>CVE-2012-1144</cvename>
|
|
<url>https://sourceforge.net/projects/freetype/files/freetype2/2.4.9/README/view</url>
|
|
<url>https://bugzilla.redhat.com/show_bug.cgi?id=806270</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-03-08</discovery>
|
|
<entry>2012-04-06</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="49314321-7fd4-11e1-9582-001b2134ef46">
|
|
<topic>mutt-devel -- failure to check SMTP TLS server certificate</topic>
|
|
<affects>
|
|
<package>
|
|
<name>mutt-devel</name>
|
|
<range><lt>1.5.21_4</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Dave B reports on Full Disclosure:</p>
|
|
<blockquote cite="http://seclists.org/fulldisclosure/2011/Mar/87">
|
|
<p>It seems that mutt fails to check the validity of a SMTP
|
|
servers certificate during a TLS connection. [...]
|
|
This means that an attacker could potentially MITM a
|
|
mutt user connecting to their SMTP server even when the
|
|
user has forced a TLS connection.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2011-1429</cvename>
|
|
<url>http://seclists.org/fulldisclosure/2011/Mar/87</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-03-08</discovery>
|
|
<entry>2012-04-06</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="057130e6-7f61-11e1-8a43-00262d5ed8ee">
|
|
<topic>chromium -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>chromium</name>
|
|
<range><lt>18.0.1025.151</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Google Chrome Releases reports:</p>
|
|
<blockquote cite="http://googlechromereleases.blogspot.com/search/label/Stable%20updates">
|
|
<p>[106577] Medium CVE-2011-3066: Out-of-bounds read in Skia clipping. Credit to miaubiz.</p>
|
|
<p>[117583] Medium CVE-2011-3067: Cross-origin iframe replacement.
|
|
Credit to Sergey Glazunov.</p>
|
|
<p>[117698] High CVE-2011-3068: Use-after-free in run-in handling.
|
|
Credit to miaubiz.</p>
|
|
<p>[117728] High CVE-2011-3069: Use-after-free in line box handling.
|
|
Credit to miaubiz.</p>
|
|
<p>[118185] High CVE-2011-3070: Use-after-free in v8 bindings. Credit
|
|
to Google Chrome Security Team (SkyLined).</p>
|
|
<p>[118273] High CVE-2011-3071: Use-after-free in HTMLMediaElement.
|
|
Credit to pa_kt, reporting through HP TippingPoint ZDI
|
|
(ZDI-CAN-1528).</p>
|
|
<p>[118467] Low CVE-2011-3072: Cross-origin violation parenting pop-up
|
|
window. Credit to Sergey Glazunov.</p>
|
|
<p>[118593] High CVE-2011-3073: Use-after-free in SVG resource
|
|
handling. Credit to Arthur Gerkis.</p>
|
|
<p>[119281] Medium CVE-2011-3074: Use-after-free in media handling.
|
|
Credit to Slawomir Blazek.</p>
|
|
<p>[119525] High CVE-2011-3075: Use-after-free applying style command.
|
|
Credit to miaubiz.</p>
|
|
<p>[120037] High CVE-2011-3076: Use-after-free in focus handling.
|
|
Credit to miaubiz.</p>
|
|
<p>[120189] Medium CVE-2011-3077: Read-after-free in script bindings.
|
|
Credit to Google Chrome Security Team (Inferno).</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2011-3066</cvename>
|
|
<cvename>CVE-2011-3067</cvename>
|
|
<cvename>CVE-2011-3068</cvename>
|
|
<cvename>CVE-2011-3069</cvename>
|
|
<cvename>CVE-2011-3070</cvename>
|
|
<cvename>CVE-2011-3071</cvename>
|
|
<cvename>CVE-2011-3072</cvename>
|
|
<cvename>CVE-2011-3073</cvename>
|
|
<cvename>CVE-2011-3074</cvename>
|
|
<cvename>CVE-2011-3075</cvename>
|
|
<cvename>CVE-2011-3076</cvename>
|
|
<cvename>CVE-2011-3077</cvename>
|
|
<url>http://googlechromereleases.blogspot.com/search/label/Stable%20updates</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-04-05</discovery>
|
|
<entry>2012-04-05</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="7289214f-7c55-11e1-ab3b-000bcdf0a03b">
|
|
<topic>libpurple -- Remote DoS via an MSN OIM message that lacks UTF-8 encoding</topic>
|
|
<affects>
|
|
<package>
|
|
<name>libpurple</name>
|
|
<range><lt>2.10.2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>US-CERT reports:</p>
|
|
<blockquote cite="http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-1178">
|
|
<p>The msn_oim_report_to_user function in oim.c in the MSN protocol
|
|
plugin in libpurple in Pidgin before 2.10.2 allows remote servers
|
|
to cause a denial of service (application crash) via an OIM message
|
|
that lacks UTF-8 encoding.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-1178</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-03-15</discovery>
|
|
<entry>2012-04-01</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="a81161d2-790f-11e1-ac16-e0cb4e266481">
|
|
<topic>phpMyAdmin -- Path disclosure due to missing verification of file presence</topic>
|
|
<affects>
|
|
<package>
|
|
<name>phpMyAdmin</name>
|
|
<range><gt>3.4</gt><lt>3.4.10.2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The phpMYAdmin development team reports:</p>
|
|
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2012-2.php">
|
|
<p>The show_config_errors.php scripts did not validate the presence
|
|
of the configuration file, so an error message shows the full path
|
|
of this file, leading to possible further attacks. For the error
|
|
messages to be displayed, php.ini's error_reporting must be set to
|
|
E_ALL and display_errors must be On (these settings are not
|
|
recommended on a production server in the PHP manual).</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-1902</cvename>
|
|
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2012-2.php</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-03-28</discovery>
|
|
<entry>2012-03-28</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="b8f0a391-7910-11e1-8a43-00262d5ed8ee">
|
|
<topic>chromium -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>chromium</name>
|
|
<range><lt>18.0.1025.142</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Google Chrome Releases reports:</p>
|
|
<blockquote cite="http://googlechromereleases.blogspot.com/search/label/Stable%20updates">
|
|
<p>[109574] Medium CVE-2011-3058: Bad interaction possibly leading to
|
|
XSS in EUC-JP. Credit to Masato Kinugawa.</p>
|
|
<p>[112317] Medium CVE-2011-3059: Out-of-bounds read in SVG text
|
|
handling. Credit to Arthur Gerkis.</p>
|
|
<p>[114056] Medium CVE-2011-3060: Out-of-bounds read in text fragment
|
|
handling. Credit to miaubiz.</p>
|
|
<p>[116398] Medium CVE-2011-3061: SPDY proxy certificate checking
|
|
error. Credit to Leonidas Kontothanassis of Google.</p>
|
|
<p>[116524] High CVE-2011-3062: Off-by-one in OpenType Sanitizer.
|
|
Credit to Mateusz Jurczyk of the Google Security Team.</p>
|
|
<p>[117417] Low CVE-2011-3063: Validate navigation requests from the
|
|
renderer more carefully. Credit to kuzzcc, Sergey Glazunov,
|
|
PinkiePie and scarybeasts (Google Chrome Security Team).</p>
|
|
<p>[117471] High CVE-2011-3064: Use-after-free in SVG clipping. Credit to Atte Kettunen of OUSPG.</p>
|
|
<p>[117588] High CVE-2011-3065: Memory corruption in Skia. Credit to
|
|
Omair.</p>
|
|
<p>[117794] Medium CVE-2011-3057: Invalid read in v8. Credit to
|
|
Christian Holler.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2011-3057</cvename>
|
|
<cvename>CVE-2011-3058</cvename>
|
|
<cvename>CVE-2011-3059</cvename>
|
|
<cvename>CVE-2011-3060</cvename>
|
|
<cvename>CVE-2011-3061</cvename>
|
|
<cvename>CVE-2011-3062</cvename>
|
|
<cvename>CVE-2011-3063</cvename>
|
|
<cvename>CVE-2011-3064</cvename>
|
|
<cvename>CVE-2011-3065</cvename>
|
|
<url>http://googlechromereleases.blogspot.com/search/label/Stable%20updates</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-03-28</discovery>
|
|
<entry>2012-03-28</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="60f81af3-7690-11e1-9423-00235a5f2c9a">
|
|
<topic>raptor/raptor2 -- XXE in RDF/XML File Interpretation</topic>
|
|
<affects>
|
|
<package>
|
|
<name>raptor2</name>
|
|
<range><lt>2.0.7</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>raptor</name>
|
|
<range><lt>1.4.21_2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Timothy D. Morgan reports:</p>
|
|
<blockquote cite="http://www.vsecurity.com/resources/advisory/20120324-1/">
|
|
<p>In December 2011, VSR identified a vulnerability in multiple open
|
|
source office products (including OpenOffice, LibreOffice, KOffice,
|
|
and AbiWord) due to unsafe interpretation of XML files with custom
|
|
entity declarations. Deeper analysis revealed that the
|
|
vulnerability was caused by acceptance of external entities by the
|
|
libraptor library, which is used by librdf and is in turn used by
|
|
these office products.</p>
|
|
<p>In the context of office applications, these vulnerabilities could
|
|
allow for XML External Entity (XXE) attacks resulting in file theft
|
|
and a loss of user privacy when opening potentially malicious ODF
|
|
documents. For other applications which depend on librdf or
|
|
libraptor, potentially serious consequences could result from
|
|
accepting RDF/XML content from untrusted sources, though the impact
|
|
may vary widely depending on the context.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-0037</cvename>
|
|
<url>http://seclists.org/fulldisclosure/2012/Mar/281</url>
|
|
<url>http://www.vsecurity.com/resources/advisory/20120324-1/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-03-24</discovery>
|
|
<entry>2012-03-25</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="42a2c82a-75b9-11e1-89b4-001ec9578670">
|
|
<topic>quagga -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>quagga</name>
|
|
<range><lt>0.99.20.1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>quagga-re</name>
|
|
<range><lt>0.99.17.8</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>CERT reports:</p>
|
|
<blockquote cite="http://www.kb.cert.org/vuls/id/551715">
|
|
<p>The ospfd implementation of OSPF in Quagga allows a remote
|
|
attacker (on a local network segment with OSPF enabled) to cause
|
|
a denial of service (daemon aborts due to an assert) with a
|
|
malformed OSPF LS-Update message.</p>
|
|
<p>The ospfd implementation of OSPF in Quagga allows a remote
|
|
attacker (on a local network segment with OSPF enabled) to cause
|
|
a denial of service (daemon crash) with a malformed OSPF Network-
|
|
LSA message.</p>
|
|
<p>The bgpd implementation of BGP in Quagga allows remote attackers
|
|
to cause a denial of service (daemon aborts due to an assert) via
|
|
BGP Open message with an invalid AS4 capability.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-0249</cvename>
|
|
<cvename>CVE-2012-0250</cvename>
|
|
<cvename>CVE-2012-0255</cvename>
|
|
<url>http://www.kb.cert.org/vuls/id/551715</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-03-23</discovery>
|
|
<entry>2012-03-24</entry>
|
|
<modified>2012-03-26</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="acab2f88-7490-11e1-865f-00e0814cab4e">
|
|
<topic>Apache Traffic Server -- heap overflow vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>trafficserver</name>
|
|
<range><lt>3.0.4</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>CERT-FI reports:</p>
|
|
<blockquote cite="https://www.cert.fi/en/reports/2012/vulnerability612884.html">
|
|
<p>A heap overflow vulnerability has been found in the HTTP
|
|
(Hypertext Transfer Protocol) protocol handling of Apache
|
|
Traffic Server. The vulnerability allows an attacker to cause
|
|
a denial of service or potentially to execute his own code by
|
|
sending a specially modified HTTP message to an affected
|
|
server.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-0256</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-03-22</discovery>
|
|
<entry>2012-03-24</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="330106da-7406-11e1-a1d7-00262d5ed8ee">
|
|
<topic>chromium -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>chromium</name>
|
|
<range><lt>17.0.963.83</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Google Chrome Releases reports:</p>
|
|
<blockquote cite="http://googlechromereleases.blogspot.com/search/label/Stable%20updates">
|
|
<p>[113902] High CVE-2011-3050: Use-after-free with first-letter
|
|
handling. Credit to miaubiz.</p>
|
|
<p>[116162] High CVE-2011-3045: libpng integer issue from upstream.
|
|
Credit to Glenn Randers-Pehrson of the libpng project.</p>
|
|
<p>[116461] High CVE-2011-3051: Use-after-free in CSS cross-fade
|
|
handling. Credit to Arthur Gerkis.</p>
|
|
<p>[116637] High CVE-2011-3052: Memory corruption in WebGL canvas
|
|
handling. Credit to Ben Vanik of Google.</p>
|
|
<p>[116746] High CVE-2011-3053: Use-after-free in block splitting.
|
|
Credit to miaubiz.</p>
|
|
<p>[117418] Low CVE-2011-3054: Apply additional isolations to webui
|
|
privileges. Credit to Sergey Glazunov.</p>
|
|
<p>[117736] Low CVE-2011-3055: Prompt in the browser native UI for
|
|
unpacked extension installation. Credit to PinkiePie.</p>
|
|
<p>[117550] High CVE-2011-3056: Cross-origin violation with "magic
|
|
iframe". Credit to Sergey Glazunov.</p>
|
|
<p>[117794] Medium CVE-2011-3057: Invalid read in v8. Credit to
|
|
Christian Holler.</p>
|
|
<p>[108648] Low CVE-2011-3049: Extension web request API can
|
|
interfere with system requests. Credit to Michael Gundlach.
|
|
Fixed in an earlier release.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2011-3045</cvename>
|
|
<cvename>CVE-2011-3049</cvename>
|
|
<cvename>CVE-2011-3050</cvename>
|
|
<cvename>CVE-2011-3051</cvename>
|
|
<cvename>CVE-2011-3052</cvename>
|
|
<cvename>CVE-2011-3053</cvename>
|
|
<cvename>CVE-2011-3054</cvename>
|
|
<cvename>CVE-2011-3055</cvename>
|
|
<cvename>CVE-2011-3056</cvename>
|
|
<cvename>CVE-2011-3057</cvename>
|
|
<url>http://googlechromereleases.blogspot.com/search/label/Stable%20updates</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-03-21</discovery>
|
|
<entry>2012-03-22</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="2e7e9072-73a0-11e1-a883-001cc0a36e12">
|
|
<topic>libtasn1 -- ASN.1 length decoding vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>libtasn1</name>
|
|
<range><lt>2.12</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>gnutls</name>
|
|
<range><lt>2.12.18</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>gnutls-devel</name>
|
|
<range><gt>2.99</gt><lt>3.0.16</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Mu Dynamics, Inc. reports:</p>
|
|
<blockquote cite="http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/5959">
|
|
<p>Various functions using the ASN.1 length decoding logic in
|
|
Libtasn1 were incorrectly assuming that the return value from
|
|
asn1_get_length_der is always less than the length of the
|
|
enclosing ASN.1 structure, which is only true for valid
|
|
structures and not for intentionally corrupt or otherwise
|
|
buggy structures.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-1569</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-03-20</discovery>
|
|
<entry>2012-03-21</entry>
|
|
<modified>2012-03-24</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="aecee357-739e-11e1-a883-001cc0a36e12">
|
|
<topic>gnutls -- possible overflow/Denial of service vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>gnutls</name>
|
|
<range><lt>2.12.18</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>gnutls-devel</name>
|
|
<range><gt>2.99</gt><lt>3.0.15</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Mu Dynamics, Inc. reports:</p>
|
|
<blockquote cite="http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/5959">
|
|
<p>The block cipher decryption logic in GnuTLS assumed that a
|
|
record containing any data which was a multiple of the block
|
|
size was valid for further decryption processing, leading to
|
|
a heap corruption vulnerability.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-1573</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-03-20</discovery>
|
|
<entry>2012-03-21</entry>
|
|
<modified>2012-03-24</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="0d530174-6eef-11e1-afd6-14dae9ebcf89">
|
|
<topic>asterisk -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>asterisk14</name>
|
|
<range><gt>1.4.*</gt><lt>1.4.44</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>asterisk16</name>
|
|
<range><gt>1.6.*</gt><lt>1.6.2.23</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>asterisk18</name>
|
|
<range><gt>1.8.*</gt><lt>1.8.10.1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>asterisk10</name>
|
|
<range><gt>10.*</gt><lt>10.2.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Asterisk project reports:</p>
|
|
<blockquote cite="https://www.asterisk.org/security">
|
|
<p>Stack Buffer Overflow in HTTP Manager</p>
|
|
<p>Remote Crash Vulnerability in Milliwatt Application</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://downloads.asterisk.org/pub/security/AST-2012-002.html</url>
|
|
<url>http://downloads.asterisk.org/pub/security/AST-2012-003.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-03-15</discovery>
|
|
<entry>2012-03-15</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="60eb344e-6eb1-11e1-8ad7-00e0815b8da8">
|
|
<topic>OpenSSL -- CMS and S/MIME Bleichenbacher attack</topic>
|
|
<affects>
|
|
<package>
|
|
<name>openssl</name>
|
|
<range><lt>1.0.0_10</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The OpenSSL Team reports:</p>
|
|
<blockquote cite="http://www.openssl.org/news/secadv_20120312.txt">
|
|
<p>A weakness in the OpenSSL CMS and PKCS #7 code can be exploited
|
|
using Bleichenbacher's attack on PKCS #1 v1.5 RSA padding
|
|
also known as the million message attack (MMA).</p>
|
|
<p>Only users of CMS, PKCS #7, or S/MIME decryption operations are
|
|
affected. A successful attack needs on average 2^20 messages. In
|
|
practice only automated systems will be affected as humans will
|
|
not be willing to process this many messages.</p>
|
|
<p>SSL/TLS applications are *NOT* affected by this problem since
|
|
the SSL/TLS code does not use the PKCS#7 or CMS decryption
|
|
code.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-0884</cvename>
|
|
<url>http://www.openssl.org/news/secadv_20120312.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-03-12</discovery>
|
|
<entry>2012-03-15</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="29194cb8-6e9f-11e1-8376-f0def16c5c1b">
|
|
<topic>nginx -- potential information leak</topic>
|
|
<affects>
|
|
<package>
|
|
<name>nginx</name>
|
|
<range><lt>1.0.14,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>nginx-devel</name>
|
|
<range><lt>1.1.17</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>nginx development team reports:</p>
|
|
<blockquote cite="http://nginx.net/CHANGES">
|
|
<p>Matthew Daley recently discovered a security problem
|
|
which may lead to a disclosure of previously freed memory
|
|
on specially crafted response from an upstream server,
|
|
potentially resulting in sensitive information leak.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://nginx.net/CHANGES</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-03-15</discovery>
|
|
<entry>2012-03-15</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="a1050b8b-6db3-11e1-8b37-0011856a6e37">
|
|
<topic>mozilla -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>firefox</name>
|
|
<range><gt>4.0,1</gt><lt>10.0.3,1</lt></range>
|
|
<range><ge>3.6.*,1</ge><lt>3.6.28</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-firefox</name>
|
|
<range><lt>10.0.3,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-seamonkey</name>
|
|
<range><lt>2.8</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-thunderbird</name>
|
|
<range><lt>10.0.3</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>seamonkey</name>
|
|
<range><lt>2.8</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>thunderbird</name>
|
|
<range><gt>4.0</gt><lt>10.0.3</lt></range>
|
|
<range><gt>3.1.*</gt><lt>3.1.20</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>libxul</name>
|
|
<range><gt>1.9.2.*</gt><lt>1.9.2.28</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Mozilla Project reports:</p>
|
|
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
|
|
<p>MFSA 2012-13 XSS with Drag and Drop and Javascript: URL</p>
|
|
<p>MFSA 2012-14 SVG issues found with Address Sanitizer</p>
|
|
<p>MFSA 2012-15 XSS with multiple Content Security Policy headers</p>
|
|
<p>MFSA 2012-16 Escalation of privilege with Javascript: URL as home page</p>
|
|
<p>MFSA 2012-17 Crash when accessing keyframe cssText after dynamic modification</p>
|
|
<p>MFSA 2012-18 window.fullScreen writeable by untrusted content</p>
|
|
<p>MFSA 2012-19 Miscellaneous memory safety hazards (rv:11.0/ rv:10.0.3 / rv:1.9.2.28)</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-0451</cvename>
|
|
<cvename>CVE-2012-0455</cvename>
|
|
<cvename>CVE-2012-0456</cvename>
|
|
<cvename>CVE-2012-0457</cvename>
|
|
<cvename>CVE-2012-0458</cvename>
|
|
<cvename>CVE-2012-0459</cvename>
|
|
<cvename>CVE-2012-0460</cvename>
|
|
<cvename>CVE-2012-0461</cvename>
|
|
<cvename>CVE-2012-0462</cvename>
|
|
<cvename>CVE-2012-0463</cvename>
|
|
<cvename>CVE-2012-0464</cvename>
|
|
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-13.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-14.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-15.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-16.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-17.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-18.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-19.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-03-13</discovery>
|
|
<entry>2012-03-14</entry>
|
|
<modified>2012-03-18</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="6d329b64-6bbb-11e1-9166-001e4f0fb9b1">
|
|
<topic>portaudit -- auditfile remote code execution</topic>
|
|
<affects>
|
|
<package>
|
|
<name>portaudit</name>
|
|
<range><lt>0.6.0</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Michael Gmelin and Jörg Scheinert has reported a remote
|
|
command execution vulnerability in portaudit.</p>
|
|
<p>An attacker who can get the user to use a specially crafted
|
|
audit file will be able to run commands on the users system,
|
|
with the privileges of the user running running portaudit
|
|
(often root).</p>
|
|
<p>The attack could e.g. happen through DNS hijacking or a man
|
|
in the middle attack.</p>
|
|
<p>Note that if the user has set up portaudit to run from
|
|
periodic this attack could happen without direct user
|
|
interaction.</p>
|
|
<p>In the FreeBSD Ports Collection (bsd.port.mk) the check for
|
|
vulnerable ports at install-time directly operates on the
|
|
auditfile and has the same vulnerability as portaudit. As
|
|
the Ports Collection infrastructure does not have a version
|
|
number just be sure to have a Ports Collection new enough to
|
|
contain the fix for portaudit. Note that this is <em>only</em>
|
|
a problem for users which has portaudit installed, as they will
|
|
not have the audit database installed or downloaded
|
|
otherwise.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://cvsweb.FreeBSD.org/ports/ports-mgmt/portaudit/Makefile#rev1.30</url>
|
|
<url>http://cvsweb.FreeBSD.org/ports/Mk/bsd.port.mk#rev1.707</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-03-11</discovery>
|
|
<entry>2012-03-11</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="ab1f515d-6b69-11e1-8288-00262d5ed8ee">
|
|
<topic>chromium -- Errant plug-in load and GPU process memory corruption</topic>
|
|
<affects>
|
|
<package>
|
|
<name>chromium</name>
|
|
<range><lt>17.0.963.79</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Google Chrome Releases reports:</p>
|
|
<blockquote cite="http://googlechromereleases.blogspot.com/search/label/Stable%20updates">
|
|
<p>[117620] [117656] Critical CVE-2011-3047: Errant plug-in load and
|
|
GPU process memory corruption. Credit to PinkiePie.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2011-3047</cvename>
|
|
<url>http://googlechromereleases.blogspot.com/search/label/Stable%20updates</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-03-10</discovery>
|
|
<entry>2012-03-11</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="9da3834b-6a50-11e1-91af-003067b2972c">
|
|
<topic>linux-flashplugin -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>linux-f10-flashplugin</name>
|
|
<range><lt>11.1r102.63</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<blockquote cite="https://www.adobe.com/support/security/bulletins/apsb12-05.html">
|
|
<p>These vulnerabilities could cause a crash and potentially allow
|
|
an attacker to take control of the affected system.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-0768</cvename>
|
|
<cvename>CVE-2012-0769</cvename>
|
|
<url>https://www.adobe.com/support/security/bulletins/apsb12-05.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-03-05</discovery>
|
|
<entry>2012-03-09</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="1015e1fe-69ce-11e1-8288-00262d5ed8ee">
|
|
<topic>chromium -- cross-site scripting vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>chromium</name>
|
|
<range><lt>17.0.963.78</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Google Chrome Releases reports:</p>
|
|
<blockquote cite="http://googlechromereleases.blogspot.com/search/label/Stable%20updates">
|
|
<p>[117226] [117230] Critical CVE-2011-3046: UXSS and bad history
|
|
navigation. Credit to Sergey Glazunov.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2011-3046</cvename>
|
|
<url>http://googlechromereleases.blogspot.com/search/label/Stable%20updates</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-03-08</discovery>
|
|
<entry>2012-03-09</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="9448a82f-6878-11e1-865f-00e0814cab4e">
|
|
<topic>jenkins -- XSS vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>jenkins</name>
|
|
<range><lt>1.453</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Jenkins Security Advisory reports:</p>
|
|
<blockquote cite="https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2012-03-05">
|
|
<p>An XSS vulnerability was found in Jenkins core, which allows an
|
|
attacker to inject malicious HTMLs to pages served by Jenkins.
|
|
This allows an attacker to escalate his privileges by hijacking
|
|
sessions of other users. This vulnerability affects all
|
|
versions.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2012-03-05</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-03-05</discovery>
|
|
<entry>2012-03-07</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="99aef698-66ed-11e1-8288-00262d5ed8ee">
|
|
<topic>chromium -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>chromium</name>
|
|
<range><lt>17.0.963.65</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Google Chrome Releases reports:</p>
|
|
<blockquote cite="http://googlechromereleases.blogspot.com/search/label/Stable%20updates">
|
|
<p>[105867] High CVE-2011-3031: Use-after-free in v8 element wrapper.
|
|
Credit to Chamal de Silva.</p>
|
|
<p>[108037] High CVE-2011-3032: Use-after-free in SVG value handling.
|
|
Credit to Arthur Gerkis.</p>
|
|
<p>[108406] [115471] High CVE-2011-3033: Buffer overflow in the Skia
|
|
drawing library. Credit to Aki Helin of OUSPG.</p>
|
|
<p>[111748] High CVE-2011-3034: Use-after-free in SVG document
|
|
handling. Credit to Arthur Gerkis.</p>
|
|
<p>[112212] High CVE-2011-3035: Use-after-free in SVG use handling.
|
|
Credit to Arthur Gerkis.</p>
|
|
<p>[113258] High CVE-2011-3036: Bad cast in line box handling. Credit
|
|
to miaubiz.</p>
|
|
<p>[113439] [114924] [115028] High CVE-2011-3037: Bad casts in
|
|
anonymous block splitting. Credit to miaubiz.</p>
|
|
<p>[113497] High CVE-2011-3038: Use-after-free in multi-column
|
|
handling. Credit to miaubiz.</p>
|
|
<p>[113707] High CVE-2011-3039: Use-after-free in quote handling.
|
|
Credit to miaubiz.</p>
|
|
<p>[114054] High CVE-2011-3040: Out-of-bounds read in text handling.
|
|
Credit to miaubiz.</p>
|
|
<p>[114068] High CVE-2011-3041: Use-after-free in class attribute
|
|
handling. Credit to miaubiz.</p>
|
|
<p>[114219] High CVE-2011-3042: Use-after-free in table section
|
|
handling. Credit to miaubiz.</p>
|
|
<p>[115681] High CVE-2011-3043: Use-after-free in flexbox with floats.
|
|
Credit to miaubiz.</p>
|
|
<p>[116093] High CVE-2011-3044: Use-after-free with SVG animation
|
|
elements. Credit to Arthur Gerkis.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2011-3031</cvename>
|
|
<cvename>CVE-2011-3032</cvename>
|
|
<cvename>CVE-2011-3033</cvename>
|
|
<cvename>CVE-2011-3034</cvename>
|
|
<cvename>CVE-2011-3035</cvename>
|
|
<cvename>CVE-2011-3036</cvename>
|
|
<cvename>CVE-2011-3037</cvename>
|
|
<cvename>CVE-2011-3038</cvename>
|
|
<cvename>CVE-2011-3039</cvename>
|
|
<cvename>CVE-2011-3040</cvename>
|
|
<cvename>CVE-2011-3041</cvename>
|
|
<cvename>CVE-2011-3042</cvename>
|
|
<cvename>CVE-2011-3043</cvename>
|
|
<cvename>CVE-2011-3044</cvename>
|
|
<url>http://googlechromereleases.blogspot.com/search/label/Stable%20updates</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-03-04</discovery>
|
|
<entry>2012-03-05</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="eba70db4-6640-11e1-98af-00262d8b701d">
|
|
<topic>dropbear -- arbitrary code execution</topic>
|
|
<affects>
|
|
<package>
|
|
<name>dropbear</name>
|
|
<range><ge>0.51</ge><lt>2012.55</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Dropbear project reports:</p>
|
|
<blockquote cite="http://xforce.iss.net/xforce/xfdb/73444">
|
|
<p>Dropbear SSH Server could allow a remote authenticated attacker
|
|
to execute arbitrary code on the system, caused by a use-after-
|
|
free error. If a command restriction is enforced, an attacker
|
|
could exploit this vulnerability to execute arbitrary code on
|
|
the system with root privileges.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>52159</bid>
|
|
<cvename>CVE-2012-0920</cvename>
|
|
<url>http://secunia.com/advisories/48147</url>
|
|
<url>http://xforce.iss.net/xforce/xfdb/73444</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-02-22</discovery>
|
|
<entry>2012-03-04</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="46aeba13-64a1-11e1-bc16-0023ae8e59f0">
|
|
<topic>openx -- undisclosed security issue</topic>
|
|
<affects>
|
|
<package>
|
|
<name>openx</name>
|
|
<range><lt>2.8.9</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>OpenX does not provide information about vulnerabilities beyond their
|
|
existence.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://blog.openx.org/12/security-matters-3</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-12-01</discovery>
|
|
<entry>2012-03-02</entry>
|
|
<modified>2012-07-08</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="174b8864-6237-11e1-be18-14dae938ec40">
|
|
<topic>databases/postgresql*-client -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>postgresql-client</name>
|
|
<range><lt>8.3.18</lt></range>
|
|
<range><ge>8.4</ge><lt>8.4.11</lt></range>
|
|
<range><ge>9</ge><lt>9.0.7</lt></range>
|
|
<range><ge>9.1</ge><lt>9.1.3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The PostgreSQL Global Development Group reports:</p>
|
|
<blockquote cite="http://www.postgresql.org/about/news/1377/">
|
|
<p>These vulnerabilities could allow users to define triggers that
|
|
execute functions on which the user does not have EXECUTE
|
|
permission, allow SSL certificate spoofing and allow line breaks
|
|
in object names to be exploited to execute code when loading a
|
|
pg_dump file.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-0866</cvename>
|
|
<cvename>CVE-2012-0867</cvename>
|
|
<cvename>CVE-2012-0868</cvename>
|
|
<url>http://www.postgresql.org/about/news/1377/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-02-27</discovery>
|
|
<entry>2012-02-28</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="f63bf080-619d-11e1-91af-003067b2972c">
|
|
<topic>linux-flashplugin -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>linux-f10-flashplugin</name>
|
|
<range><lt>11.1r102.62</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<blockquote cite="https://www.adobe.com/support/security/bulletins/apsb12-03.html">
|
|
<p>These vulnerabilities could cause a crash and potentially allow
|
|
an attacker to take control of the affected system.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-0751</cvename>
|
|
<cvename>CVE-2012-0752</cvename>
|
|
<cvename>CVE-2012-0753</cvename>
|
|
<cvename>CVE-2012-0754</cvename>
|
|
<cvename>CVE-2012-0755</cvename>
|
|
<cvename>CVE-2012-0756</cvename>
|
|
<cvename>CVE-2012-0767</cvename>
|
|
<url>https://www.adobe.com/support/security/bulletins/apsb12-03.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-02-15</discovery>
|
|
<entry>2012-02-27</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="57f1a624-6197-11e1-b98c-bcaec565249c">
|
|
<topic>libxml2 -- heap buffer overflow</topic>
|
|
<affects>
|
|
<package>
|
|
<name>libxml2</name>
|
|
<range><lt>2.7.8_2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Google chrome team reports:</p>
|
|
<blockquote cite="http://googlechromereleases.blogspot.com/2012/01/stable-channel-update.html">
|
|
<p>Heap-based buffer overflow in libxml2, allows remote attackers
|
|
to cause a denial of service or possibly have unspecified other
|
|
impact via unknown vectors.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2011-3919</cvename>
|
|
<url>http://googlechromereleases.blogspot.com/2012/01/stable-channel-update.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-01-05</discovery>
|
|
<entry>2012-02-27</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="ba51c2f7-5b43-11e1-8288-00262d5ed8ee">
|
|
<topic>plib -- remote code execution via buffer overflow</topic>
|
|
<affects>
|
|
<package>
|
|
<name>torcs</name>
|
|
<range><lt>1.3.3</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>plib</name>
|
|
<range><le>1.8.5_3</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/47297/">
|
|
<p>A vulnerability has been discovered in PLIB, which can be
|
|
exploited by malicious people to compromise an application using
|
|
the library.</p>
|
|
<p>The vulnerability is caused due to a boundary error within the
|
|
"ulSetError()" function (src/util/ulError.cxx) when creating the
|
|
error message, which can be exploited to overflow a static
|
|
buffer.</p>
|
|
<p>Successful exploitation allows the execution of arbitrary code
|
|
but requires that the attacker can e.g. control the content of
|
|
an overly long error message passed to the "ulSetError()"
|
|
function.</p>
|
|
<p>The vulnerability is confirmed in version 1.8.5. Other versions
|
|
may also be affected.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2011-4620</cvename>
|
|
<url>http://secunia.com/advisories/47297/</url>
|
|
<url>http://torcs.sourceforge.net/index.php?name=News&file=article&sid=79</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-12-21</discovery>
|
|
<entry>2012-02-19</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="fdd1c316-5a3d-11e1-8d3e-e0cb4e266481">
|
|
<topic>phpMyAdmin -- XSS in replication setup</topic>
|
|
<affects>
|
|
<package>
|
|
<name>phpMyAdmin</name>
|
|
<range><gt>3.4</gt><lt>3.4.10.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The phpMyAdmin development team reports:</p>
|
|
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2012-1.php">
|
|
<p>It was possible to conduct XSS using a crafted database name.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-1190</cvename>
|
|
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2012-1.php</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-02-18</discovery>
|
|
<entry>2012-02-18</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="da317bc9-59a6-11e1-bc16-0023ae8e59f0">
|
|
<topic>piwik -- xss and click-jacking issues</topic>
|
|
<affects>
|
|
<package>
|
|
<name>piwik</name>
|
|
<range><lt>1.7</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Piwik Team reports:</p>
|
|
<blockquote cite="http://piwik.org/blog/2012/02/7775/">
|
|
<p>We would like to thank the following security researchers for
|
|
their responsible disclosure of XSS and click-jacking issues:
|
|
Piotr Duszynski, Sergey Markov, Mauro Gentile.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>"http://piwik.org/blog/2012/02/7775/"</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-02-16</discovery>
|
|
<entry>2012-02-16</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="d7dbd2db-599c-11e1-a2fb-14dae9ebcf89">
|
|
<topic>mozilla -- heap-buffer overflow</topic>
|
|
<affects>
|
|
<package>
|
|
<name>firefox</name>
|
|
<range><ge>10.0,1</ge><lt>10.0.2,1</lt></range>
|
|
<range><ge>3.6.*,1</ge><lt>3.6.27</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-firefox</name>
|
|
<range><ge>10.0,1</ge><lt>10.0.2,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-seamonkey</name>
|
|
<range><ge>2.7</ge><lt>2.7.2</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-thunderbird</name>
|
|
<range><ge>10.0</ge><lt>10.0.2</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>seamonkey</name>
|
|
<range><ge>2.7</ge><lt>2.7.2</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>thunderbird</name>
|
|
<range><ge>10.0</ge><lt>10.0.2</lt></range>
|
|
<range><gt>3.1.*</gt><lt>3.1.19</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Mozilla Project reports:</p>
|
|
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
|
|
<p>MFSA 2012-11 libpng integer overflow</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2011-3026</cvename>
|
|
<url>https://www.mozilla.org/security/announce/2012/mfsa2012-11.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-02-16</discovery>
|
|
<entry>2012-02-17</entry>
|
|
<modified>2012-03-18</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="2f5ff968-5829-11e1-8288-00262d5ed8ee">
|
|
<topic>chromium -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>chromium</name>
|
|
<range><lt>17.0.963.56</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Google Chrome Releases reports:</p>
|
|
<blockquote cite="http://googlechromereleases.blogspot.com/search/label/Stable%20updates">
|
|
<p>[105803] High CVE-2011-3015: Integer overflows in PDF codecs.
|
|
Credit to Google Chrome Security Team (scarybeasts).</p>
|
|
<p>[106336] Medium CVE-2011-3016: Read-after-free with counter nodes.
|
|
Credit to miaubiz.</p>
|
|
<p>[108695] High CVE-2011-3017: Possible use-after-free in database
|
|
handling. Credit to miaubiz.</p>
|
|
<p>[110172] High CVE-2011-3018: Heap overflow in path rendering.
|
|
Credit to Aki Helin of OUSPG.</p>
|
|
<p>[110849] High CVE-2011-3019: Heap buffer overflow in MKV handling.
|
|
Credit to Google Chrome Security Team (scarybeasts) and Mateusz
|
|
Jurczyk of the Google Security Team.</p>
|
|
<p>[111575] Medium CVE-2011-3020: Native client validator error.
|
|
Credit to Nick Bray of the Chromium development community.</p>
|
|
<p>[111779] High CVE-2011-3021: Use-after-free in subframe loading.
|
|
Credit to Arthur Gerkis.</p>
|
|
<p>[112236] Medium CVE-2011-3022: Inappropriate use of http for
|
|
translation script. Credit to Google Chrome Security Team (Jorge
|
|
Obes).</p>
|
|
<p>[112259] Medium CVE-2011-3023: Use-after-free with drag and drop.
|
|
Credit to pa_kt.</p>
|
|
<p>[112451] Low CVE-2011-3024: Browser crash with empty x509
|
|
certificate. Credit to chrometot.</p>
|
|
<p>[112670] Medium CVE-2011-3025: Out-of-bounds read in h.264
|
|
parsing. Credit to Slawomir Blazek.</p>
|
|
<p>[112822] High CVE-2011-3026: Integer overflow / truncation in
|
|
libpng. Credit to Juri Aedla.</p>
|
|
<p>[112847] Medium CVE-2011-3027: Bad cast in column handling.
|
|
Credit to miaubiz.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2011-3015</cvename>
|
|
<cvename>CVE-2011-3016</cvename>
|
|
<cvename>CVE-2011-3017</cvename>
|
|
<cvename>CVE-2011-3018</cvename>
|
|
<cvename>CVE-2011-3019</cvename>
|
|
<cvename>CVE-2011-3020</cvename>
|
|
<cvename>CVE-2011-3021</cvename>
|
|
<cvename>CVE-2011-3022</cvename>
|
|
<cvename>CVE-2011-3023</cvename>
|
|
<cvename>CVE-2011-3024</cvename>
|
|
<cvename>CVE-2011-3025</cvename>
|
|
<cvename>CVE-2011-3026</cvename>
|
|
<cvename>CVE-2011-3027</cvename>
|
|
<url>http://googlechromereleases.blogspot.com/search/label/Stable%20updates</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-02-15</discovery>
|
|
<entry>2012-02-15</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="b4f8be9e-56b2-11e1-9fb7-003067b2972c">
|
|
<topic>Python -- DoS via malformed XML-RPC / HTTP POST request</topic>
|
|
<affects>
|
|
<package>
|
|
<name>python32</name>
|
|
<range><le>3.2.2_2</le></range>
|
|
</package>
|
|
<package>
|
|
<name>python31</name>
|
|
<range><le>3.1.4_2</le></range>
|
|
</package>
|
|
<package>
|
|
<name>python27</name>
|
|
<range><le>2.7.2_3</le></range>
|
|
</package>
|
|
<package>
|
|
<name>python26</name>
|
|
<range><le>2.6.7_2</le></range>
|
|
</package>
|
|
<package>
|
|
<name>python25</name>
|
|
<range><le>2.5.6_2</le></range>
|
|
</package>
|
|
<package>
|
|
<name>python24</name>
|
|
<range><le>2.4.5_8</le></range>
|
|
</package>
|
|
<package>
|
|
<name>pypy</name>
|
|
<!-- note that it also affects 1.8 but we do not yet have
|
|
this version in ports. -->
|
|
<range><le>1.7</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Jan Lieskovsky reports,</p>
|
|
<blockquote cite="http://bugs.python.org/issue14001">
|
|
<p>A denial of service flaw was found in the way Simple XML-RPC
|
|
Server module of Python processed client connections, that were
|
|
closed prior the complete request body has been received. A
|
|
remote attacker could use this flaw to cause Python Simple
|
|
XML-RPC based server process to consume excessive amount of
|
|
CPU.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-0845</cvename>
|
|
<url>http://bugs.python.org/issue14001</url>
|
|
<url>https://bugzilla.redhat.com/show_bug.cgi?id=789790</url>
|
|
<url>https://bugs.pypy.org/issue1047</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-02-13</discovery>
|
|
<entry>2012-02-14</entry>
|
|
<modified>2012-02-26</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="2b20fd5f-552e-11e1-9fb7-003067b2972c">
|
|
<topic>WebCalendar -- Persistent XSS</topic>
|
|
<affects>
|
|
<package>
|
|
<name>WebCalendar</name>
|
|
<range><le>1.2.4</le></range>
|
|
</package>
|
|
<package>
|
|
<name>WebCalendar-devel</name>
|
|
<range><le>1.2.4</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>tom reports,</p>
|
|
<blockquote cite="http://seclists.org/bugtraq/2012/Jan/128">
|
|
<p>There is no sanitation on the input of the location variable
|
|
allowing for persistent XSS.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-0846</cvename>
|
|
<url>http://sourceforge.net/tracker/?func=detail&aid=3472745&group_id=3870&atid=103870</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-01-11</discovery>
|
|
<entry>2012-02-12</entry>
|
|
<modified>2012-02-13</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="eba9aa94-549c-11e1-b6b7-0011856a6e37">
|
|
<topic>mozilla -- use after free in nsXBLDocumentInfo::ReadPrototypeBindings</topic>
|
|
<affects>
|
|
<package>
|
|
<name>firefox</name>
|
|
<range><ge>10.0,1</ge><lt>10.0.1,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-firefox</name>
|
|
<range><ge>10.0,1</ge><lt>10.0.1,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-seamonkey</name>
|
|
<range><ge>2.7</ge><lt>2.7.1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-thunderbird</name>
|
|
<range><ge>10.0</ge><lt>10.0.1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>seamonkey</name>
|
|
<range><ge>2.7</ge><lt>2.7.1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>thunderbird</name>
|
|
<range><ge>10.0</ge><lt>10.0.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Mozilla Project reports:</p>
|
|
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
|
|
<p>MFSA 2012-10 use after free in nsXBLDocumentInfo::ReadPrototypeBindings</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-0452</cvename>
|
|
<url>https://www.mozilla.org/security/announce/2012/mfsa2012-10.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-02-10</discovery>
|
|
<entry>2012-02-11</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="1c4cab30-5468-11e1-9fb7-003067b2972c">
|
|
<topic>bip -- buffer overflow</topic>
|
|
<affects>
|
|
<package>
|
|
<name>bip</name>
|
|
<range><le>0.8.8</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Julien Tinnes reports,</p>
|
|
<blockquote cite="https://projects.duckcorp.org/issues/269">
|
|
<p>Bip doesn't check if fd is equal or larger than FD_SETSIZE.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-0806</cvename>
|
|
<url>https://projects.duckcorp.org/projects/bip/repository/revisions/222a33cb84a2e52ad55a88900b7895bf9dd0262c</url>
|
|
<url>https://projects.duckcorp.org/issues/269</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-01-07</discovery>
|
|
<entry>2012-02-11</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="039d057e-544e-11e1-9fb7-003067b2972c">
|
|
<topic>surf -- private information disclosure</topic>
|
|
<affects>
|
|
<package>
|
|
<name>surf</name>
|
|
<range><le>0.4.1</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>surf does not protect its cookie jar against access read access from
|
|
other local users</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-0842</cvename>
|
|
<url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=659296</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-02-10</discovery>
|
|
<entry>2012-02-11</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="7c769c89-53c2-11e1-8e52-00163e22ef61">
|
|
<topic>glpi -- remote attack via crafted POST request</topic>
|
|
<affects>
|
|
<package>
|
|
<name>glpi</name>
|
|
<range><lt>0.80.2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The GLPI project reports:</p>
|
|
<blockquote cite="http://www.glpi-project.org/spip.php?page=annonce&id_breve=237&lang=en">
|
|
<p>The autocompletion functionality in GLPI before 0.80.2 does not
|
|
blacklist certain username and password fields, which allows
|
|
remote attackers to obtain sensitive information via a crafted
|
|
POST request.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://www.glpi-project.org/spip.php?page=annonce&id_breve=237&lang=en</url>
|
|
<url>https://forge.indepnet.net/issues/3017</url>
|
|
<cvename>CVE-2011-2720</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-07-20</discovery>
|
|
<entry>2012-02-10</entry>
|
|
<modified>2013-06-19</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="fe1976c2-5317-11e1-9e99-00262d5ed8ee">
|
|
<topic>chromium -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>chromium</name>
|
|
<range><lt>17.0.963.46</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Google Chrome Releases reports:</p>
|
|
<blockquote cite="http://googlechromereleases.blogspot.com/search/label/Stable%20updates">
|
|
<p>[73478] Low CVE-2011-3953: Avoid clipboard monitoring after paste
|
|
event. Credit to Daniel Cheng of the Chromium development
|
|
community.</p>
|
|
<p>[92550] Low CVE-2011-3954: Crash with excessive database usage.
|
|
Credit to Collin Payne.</p>
|
|
<p>[93106] High CVE-2011-3955: Crash aborting an IndexDB transaction.
|
|
Credit to David Grogan of the Chromium development community.</p>
|
|
<p>[103630] Low CVE-2011-3956: Incorrect handling of sandboxed origins
|
|
inside extensions. Credit to Devdatta Akhawe, UC Berkeley.</p>
|
|
<p>[104056] High CVE-2011-3957: Use-after-free in PDF garbage
|
|
collection. Credit to Aki Helin of OUSPG.</p>
|
|
<p>[105459] High CVE-2011-3958: Bad casts with column spans. Credit
|
|
to miaubiz.</p>
|
|
<p>[106441] High CVE-2011-3959: Buffer overflow in locale handling.
|
|
Credit to Aki Helin of OUSPG.</p>
|
|
<p>[108416] Medium CVE-2011-3960: Out-of-bounds read in audio
|
|
decoding. Credit to Aki Helin of OUSPG.</p>
|
|
<p>[108871] Critical CVE-2011-3961: Race condition after crash of
|
|
utility process. Credit to Shawn Goertzen.</p>
|
|
<p>[108901] Medium CVE-2011-3962: Out-of-bounds read in path clipping.
|
|
Credit to Aki Helin of OUSPG.</p>
|
|
<p>[109094] Medium CVE-2011-3963: Out-of-bounds read in PDF fax image
|
|
handling. Credit to Atte Kettunen of OUSPG.</p>
|
|
<p>[109245] Low CVE-2011-3964: URL bar confusion after drag + drop.
|
|
Credit to Code Audit Labs of VulnHunt.com.</p>
|
|
<p>[109664] Low CVE-2011-3965: Crash in signature check. Credit to
|
|
Slawomir Blazek.</p>
|
|
<p>[109716] High CVE-2011-3966: Use-after-free in stylesheet error
|
|
handling. Credit to Aki Helin of OUSPG.</p>
|
|
<p>[109717] Low CVE-2011-3967: Crash with unusual certificate. Credit
|
|
to Ben Carrillo.</p>
|
|
<p>[109743] High CVE-2011-3968: Use-after-free in CSS handling.
|
|
Credit to Arthur Gerkis.</p>
|
|
<p>[110112] High CVE-2011-3969: Use-after-free in SVG layout. Credit
|
|
to Arthur Gerkis.</p>
|
|
<p>[110277] Medium CVE-2011-3970: Out-of-bounds read in libxslt.
|
|
Credit to Aki Helin of OUSPG.</p>
|
|
<p>[110374] High CVE-2011-3971: Use-after-free with mousemove events.
|
|
Credit to Arthur Gerkis.</p>
|
|
<p>[110559] Medium CVE-2011-3972: Out-of-bounds read in shader
|
|
translator. Credit to Google Chrome Security Team (Inferno).</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2011-3953</cvename>
|
|
<cvename>CVE-2011-3954</cvename>
|
|
<cvename>CVE-2011-3955</cvename>
|
|
<cvename>CVE-2011-3956</cvename>
|
|
<cvename>CVE-2011-3957</cvename>
|
|
<cvename>CVE-2011-3958</cvename>
|
|
<cvename>CVE-2011-3959</cvename>
|
|
<cvename>CVE-2011-3960</cvename>
|
|
<cvename>CVE-2011-3961</cvename>
|
|
<cvename>CVE-2011-3962</cvename>
|
|
<cvename>CVE-2011-3963</cvename>
|
|
<cvename>CVE-2011-3964</cvename>
|
|
<cvename>CVE-2011-3965</cvename>
|
|
<cvename>CVE-2011-3966</cvename>
|
|
<cvename>CVE-2011-3967</cvename>
|
|
<cvename>CVE-2011-3968</cvename>
|
|
<cvename>CVE-2011-3969</cvename>
|
|
<cvename>CVE-2011-3970</cvename>
|
|
<cvename>CVE-2011-3971</cvename>
|
|
<cvename>CVE-2011-3972</cvename>
|
|
<url>http://googlechromereleases.blogspot.com/search/label/Stable%20updates</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-02-08</discovery>
|
|
<entry>2012-02-09</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="10720fe8-51e0-11e1-91c1-00215c6a37bb">
|
|
<topic>drupal -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>drupal6</name>
|
|
<range><lt>6.23</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>drupal7</name>
|
|
<range><lt>7.11</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Drupal development team reports:</p>
|
|
<blockquote cite="http://drupal.org/node/1425084">
|
|
<h3>Cross Site Request Forgery vulnerability in Aggregator
|
|
module</h3>
|
|
<p>CVE: CVE-2012-0826</p>
|
|
<p>An XSRF vulnerability can force an aggregator feed to update.
|
|
Since some services are rate-limited (e.g. Twitter limits
|
|
requests to 150 per hour) this could lead to a denial of
|
|
service.</p>
|
|
<p>This issue affects Drupal 6.x and 7.x.</p>
|
|
<h3>OpenID not verifying signed attributes in SREG and AX</h3>
|
|
<p>CVE: CVE-2012-0825</p>
|
|
<p>A group of security researchers identified a flaw in how some
|
|
OpenID relying parties implement Attribute Exchange (AX). Not
|
|
verifying that attributes being passed through AX have been
|
|
signed could allow an attacker to modify users' information.</p>
|
|
<p>This issue affects Drupal 6.x and 7.x.</p>
|
|
<h3>Access bypass in File module</h3>
|
|
<p>CVE: CVE-2012-0827</p>
|
|
<p>When using private files in combination with certain field
|
|
access modules, the File module will allow users to download
|
|
the file even if they do not have access to view the field it
|
|
was attached to.</p>
|
|
<p>This issue affects Drupal 7.x only.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-0825</cvename>
|
|
<cvename>CVE-2012-0826</cvename>
|
|
<cvename>CVE-2012-0827</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-02-01</discovery>
|
|
<entry>2012-02-07</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="309542b5-50b9-11e1-b0d8-00151735203a">
|
|
<topic>bugzilla -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>bugzilla</name>
|
|
<range><ge>2.4.*</ge><lt>3.6.8</lt></range>
|
|
<range><ge>4.0.*</ge><lt>4.0.4</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A Bugzilla Security Advisory reports:</p>
|
|
<blockquote cite="http://www.bugzilla.org/security/3.4.12/">
|
|
<p>The following security issues have been discovered in
|
|
Bugzilla:</p>
|
|
<ul>
|
|
<li>Account Impersonation:
|
|
When a user creates a new account, Bugzilla doesn't correctly
|
|
reject email addresses containing non-ASCII characters, which
|
|
could be used to impersonate another user account. Such email
|
|
addresses could look visually identical to other valid email
|
|
addresses, and an attacker could try to confuse other users
|
|
and be added to bugs he shouldn't have access to.</li>
|
|
<li>Cross-Site Request Forgery:
|
|
Due to a lack of validation of the Content-Type head when
|
|
making POST requests to jsonrpc.cgi, a possible CSRF
|
|
vulnerability was discovered. If a user visits an HTML page
|
|
with some malicious JS code in it, an attacker could make
|
|
changes to a remote Bugzilla installation on behalf of the
|
|
victim's account by using the JSON-RPC API. The user would
|
|
have had to be already logged in to the target site for the
|
|
vulnerability to work.</li>
|
|
</ul>
|
|
<p>All affected installations are encouraged to upgrade as soon as
|
|
possible.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-0448</cvename>
|
|
<cvename>CVE-2012-0440</cvename>
|
|
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=714472</url>
|
|
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=718319</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-01-31</discovery>
|
|
<entry>2012-02-06</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="3fd040be-4f0b-11e1-9e32-0025900931f8">
|
|
<topic>php -- arbitrary remote code execution vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>php5</name>
|
|
<range><ge>5.3.9</ge><lt>5.3.10</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/47806/">
|
|
<p>A vulnerability has been reported in PHP, which can be exploited
|
|
by malicious people to compromise a vulnerable system.</p>
|
|
<p>The vulnerability is caused due to a logic error within the
|
|
"php_register_variable_ex()" function (php_variables.c) when
|
|
hashing form posts and updating a hash table, which can be
|
|
exploited to execute arbitrary code.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-0830</cvename>
|
|
<url>http://www.php.net/archive/2012.php#id2012-02-02-1</url>
|
|
<url>http://secunia.com/advisories/47806/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-02-02</discovery>
|
|
<entry>2012-02-04</entry>
|
|
<modified>2012-02-06</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="6e7ad1d7-4e27-11e1-8e12-90e6ba8a36a2">
|
|
<topic>mathopd -- directory traversal vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>mathopd</name>
|
|
<range><lt>1.5p7</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Michiel Boland reports:</p>
|
|
<blockquote cite="http://www.mathopd.org/security.html">
|
|
<p>The software has a vulnerability that could lead to directory
|
|
traversal if the '*' construct for mass virtual hosting is
|
|
used.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<mlist msgid="4F2AFEF2.5040708@boland.org">http://www.mail-archive.com/mathopd%40mathopd.org/msg00392.html</mlist>
|
|
<url>http://www.mathopd.org/security.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-02-02</discovery>
|
|
<entry>2012-02-03</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="4b7dbfab-4c6b-11e1-bc16-0023ae8e59f0">
|
|
<topic>apache -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>apache</name>
|
|
<range><gt>2.*</gt><lt>2.2.22</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>CVE MITRE reports:</p>
|
|
<blockquote cite="http://httpd.apache.org/security/vulnerabilities_22.html">
|
|
<p>An exposure was found when using mod_proxy in reverse proxy
|
|
mode. In certain configurations using RewriteRule with proxy
|
|
flag or ProxyPassMatch, a remote attacker could cause the reverse
|
|
proxy to connect to an arbitrary server, possibly disclosing
|
|
sensitive information from internal web servers not directly
|
|
accessible to attacker.</p>
|
|
<p>Integer overflow in the ap_pregsub function in server/util.c in
|
|
the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x through
|
|
2.2.21, when the mod_setenvif module is enabled, allows local
|
|
users to gain privileges via a .htaccess file with a crafted
|
|
SetEnvIf directive, in conjunction with a crafted HTTP request
|
|
header, leading to a heap-based buffer overflow.</p>
|
|
<p>An additional exposure was found when using mod_proxy in
|
|
reverse proxy mode. In certain configurations using RewriteRule
|
|
with proxy flag or ProxyPassMatch, a remote attacker could cause
|
|
the reverse proxy to connect to an arbitrary server, possibly
|
|
disclosing sensitive information from internal web servers
|
|
not directly accessible to attacker.</p>
|
|
<p>A flaw was found in mod_log_config. If the '%{cookiename}C' log
|
|
format string is in use, a remote attacker could send a specific
|
|
cookie causing a crash. This crash would only be a denial of
|
|
service if using a threaded MPM.</p>
|
|
<p>A flaw was found in the handling of the scoreboard. An
|
|
unprivileged child process could cause the parent process to
|
|
crash at shutdown rather than terminate cleanly.</p>
|
|
<p>A flaw was found in the default error response for status code
|
|
400. This flaw could be used by an attacker to expose
|
|
"httpOnly" cookies when no custom ErrorDocument is specified.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2011-3368</cvename>
|
|
<cvename>CVE-2011-3607</cvename>
|
|
<cvename>CVE-2011-4317</cvename>
|
|
<cvename>CVE-2012-0021</cvename>
|
|
<cvename>CVE-2012-0031</cvename>
|
|
<cvename>CVE-2012-0053</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-10-05</discovery>
|
|
<entry>2012-01-31</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="0a9e2b72-4cb7-11e1-9146-14dae9ebcf89">
|
|
<topic>mozilla -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>firefox</name>
|
|
<range><gt>4.0,1</gt><lt>10.0,1</lt></range>
|
|
<range><ge>3.6.*,1</ge><lt>3.6.26</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-firefox</name>
|
|
<range><lt>10.0,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-seamonkey</name>
|
|
<range><lt>2.7</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-thunderbird</name>
|
|
<range><lt>10.0</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>seamonkey</name>
|
|
<range><lt>2.7</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>thunderbird</name>
|
|
<range><gt>4.0</gt><lt>10.0</lt></range>
|
|
<range><gt>3.1.*</gt><lt>3.1.18</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Mozilla Project reports:</p>
|
|
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
|
|
<p>MFSA 2012-01 Miscellaneous memory safety hazards (rv:10.0/
|
|
rv:1.9.2.26)</p>
|
|
<p>MFSA 2012-02 Overly permissive IPv6 literal syntax</p>
|
|
<p>MFSA 2012-03 iframe element exposed across domains via name
|
|
attribute</p>
|
|
<p>MFSA 2012-04 Child nodes from nsDOMAttribute still accessible
|
|
after removal of nodes</p>
|
|
<p>MFSA 2012-05 Frame scripts calling into untrusted objects bypass
|
|
security checks</p>
|
|
<p>MFSA 2012-06 Uninitialized memory appended when encoding icon
|
|
images may cause information disclosure</p>
|
|
<p>MFSA 2012-07 Potential Memory Corruption When Decoding Ogg Vorbis
|
|
files</p>
|
|
<p>MFSA 2012-08 Crash with malformed embedded XSLT stylesheets</p>
|
|
<p>MFSA 2012-09 Firefox Recovery Key.html is saved with unsafe
|
|
permission</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-0442</cvename>
|
|
<cvename>CVE-2012-0443</cvename>
|
|
<cvename>CVE-2011-3670</cvename>
|
|
<cvename>CVE-2012-0445</cvename>
|
|
<cvename>CVE-2011-3659</cvename>
|
|
<cvename>CVE-2012-0446</cvename>
|
|
<cvename>CVE-2012-0447</cvename>
|
|
<cvename>CVE-2012-0449</cvename>
|
|
<cvename>CVE-2012-0450</cvename>
|
|
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-01.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-02.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-03.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-04.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-05.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-06.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-07.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-08.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2012/mfsa2012-09.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-01-31</discovery>
|
|
<entry>2012-02-01</entry>
|
|
<modified>2012-03-18</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="7c920bb7-4b5f-11e1-9f47-00e0815b8da8">
|
|
<topic>sudo -- format string vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>sudo</name>
|
|
<range><ge>1.8.0</ge><lt>1.8.3_2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Todd Miller reports:</p>
|
|
<blockquote cite="http://www.gratisoft.us/sudo/alerts/sudo_debug.html">
|
|
<p>Sudo 1.8.0 introduced simple debugging support that was primarily
|
|
intended for use when developing policy or I/O logging plugins.
|
|
The sudo_debug() function contains a flaw where the program name
|
|
is used as part of the format string passed to the fprintf()
|
|
function. The program name can be controlled by the caller,
|
|
either via a symbolic link or, on some systems, by setting argv[0]
|
|
when executing sudo.</p>
|
|
<p>Using standard format string vulnerability exploitation
|
|
techniques it is possible to leverage this bug to achieve root
|
|
privileges.</p>
|
|
<p>Exploitation of the bug does not require that the attacker be
|
|
listed in the sudoers file. As such, we strongly suggest that
|
|
affected sites upgrade from affected sudo versions as soon as
|
|
possible.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-0809</cvename>
|
|
<url>http://www.gratisoft.us/sudo/alerts/sudo_debug.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-01-30</discovery>
|
|
<entry>2012-01-30</entry>
|
|
<modified>2012-01-31</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="e51d5b1a-4638-11e1-9f47-00e0815b8da8">
|
|
<topic>FreeBSD -- pam_ssh() does not validate service names</topic>
|
|
<affects>
|
|
<package>
|
|
<name>FreeBSD</name>
|
|
<range><ge>7.3</ge><lt>7.3_9</lt></range>
|
|
<range><ge>7.4</ge><lt>7.4_5</lt></range>
|
|
<range><ge>8.1</ge><lt>8.1_7</lt></range>
|
|
<range><ge>8.2</ge><lt>8.2_5</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<blockquote cite="http://security.freebsd.org/advisories/FreeBSD-SA-11:10.pam.asc">
|
|
<h1>Problem Description:</h1>
|
|
<p>Some third-party applications, including KDE's kcheckpass command,
|
|
allow the user to specify the name of the policy on the command
|
|
line. Since OpenPAM treats the policy name as a path relative to
|
|
/etc/pam.d or /usr/local/etc/pam.d, users who are permitted to run
|
|
such an application can craft their own policies and cause the
|
|
application to load and execute their own modules.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<freebsdsa>SA-11:10.pam</freebsdsa>
|
|
<cvename>CVE-2011-4122</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-12-23</discovery>
|
|
<entry>2012-01-29</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="eda151d8-4638-11e1-9f47-00e0815b8da8">
|
|
<topic>FreeBSD -- pam_ssh improperly grants access when user account has unencrypted SSH private keys</topic>
|
|
<affects>
|
|
<package>
|
|
<name>FreeBSD</name>
|
|
<range><ge>7.3</ge><lt>7.3_9</lt></range>
|
|
<range><ge>7.4</ge><lt>7.4_5</lt></range>
|
|
<range><ge>8.1</ge><lt>8.1_7</lt></range>
|
|
<range><ge>8.2</ge><lt>8.2_5</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<blockquote cite="http://security.freebsd.org/advisories/FreeBSD-SA-11:09.pam_ssh.asc">
|
|
<h1>Problem Description:</h1>
|
|
<p>The OpenSSL library call used to decrypt private keys ignores the
|
|
passphrase argument if the key is not encrypted. Because the
|
|
pam_ssh module only checks whether the passphrase provided by the
|
|
user is null, users with unencrypted SSH private keys may
|
|
successfully authenticate themselves by providing a dummy
|
|
passphrase.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<freebsdsa>SA-11:09.pam_ssh</freebsdsa>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-12-23</discovery>
|
|
<entry>2012-01-29</entry>
|
|
<modified>2013-06-18</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="f56390a4-4638-11e1-9f47-00e0815b8da8">
|
|
<topic>FreeBSD -- Buffer overflow in handling of UNIX socket addresses</topic>
|
|
<affects>
|
|
<package>
|
|
<name>FreeBSD</name>
|
|
<range><ge>7.3</ge><lt>7.3_8</lt></range>
|
|
<range><ge>7.4</ge><lt>7.4_4</lt></range>
|
|
<range><ge>8.1</ge><lt>8.1_6</lt></range>
|
|
<range><ge>8.2</ge><lt>8.2_4</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<blockquote cite="http://security.freebsd.org/advisories/FreeBSD-SA-11:05.unix.asc">
|
|
<h1>Problem Description:</h1>
|
|
<p>When a UNIX-domain socket is attached to a location using the
|
|
bind(2) system call, the length of the provided path is not
|
|
validated. Later, when this address was returned via other system
|
|
calls, it is copied into a fixed-length buffer.</p>
|
|
<p>Linux uses a larger socket address structure for UNIX-domain
|
|
sockets than FreeBSD, and the FreeBSD's linux emulation code did
|
|
not translate UNIX-domain socket addresses into the correct size
|
|
of structure.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<freebsdsa>SA-11:05.unix</freebsdsa>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-09-28</discovery>
|
|
<entry>2012-01-29</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="fee94342-4638-11e1-9f47-00e0815b8da8">
|
|
<topic>FreeBSD -- errors handling corrupt compress file in compress(1) and gzip(1)</topic>
|
|
<affects>
|
|
<package>
|
|
<name>FreeBSD</name>
|
|
<range><ge>7.3</ge><lt>7.3_7</lt></range>
|
|
<range><ge>7.4</ge><lt>7.4_3</lt></range>
|
|
<range><ge>8.1</ge><lt>8.1_5</lt></range>
|
|
<range><ge>8.2</ge><lt>8.2_3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<blockquote cite="http://security.freebsd.org/advisories/FreeBSD-SA-11:04.compress.asc">
|
|
<h1>Problem Description:</h1>
|
|
<p>The code used to decompress a file created by compress(1) does not
|
|
do sufficient boundary checks on compressed code words, allowing
|
|
reference beyond the decompression table, which may result in a
|
|
stack overflow or an infinite loop when the decompressor encounters
|
|
a corrupted file.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<freebsdsa>SA-11:04.compress</freebsdsa>
|
|
<cvename>CVE-2011-2895</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-09-28</discovery>
|
|
<entry>2012-01-29</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="87261557-a450-11e2-9898-001060e06fd4">
|
|
<topic>FreeBSD -- Network ACL mishandling in mountd(8)</topic>
|
|
<affects>
|
|
<package>
|
|
<name>FreeBSD</name>
|
|
<range><ge>7.3</ge><lt>7.3_5</lt></range>
|
|
<range><ge>7.4</ge><lt>7.4_1</lt></range>
|
|
<range><ge>8.1</ge><lt>8.1_3</lt></range>
|
|
<range><ge>8.2</ge><lt>8.2_1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<blockquote cite="http://security.freebsd.org/advisories/FreeBSD-SA-11:01.mountd.asc">
|
|
<h1>Problem Description:</h1>
|
|
<p>While parsing the exports(5) table, a network mask in the form of
|
|
"-network=netname/prefixlength" results in an incorrect network mask
|
|
being computed if the prefix length is not a multiple of 8.</p>
|
|
<p>For example, specifying the ACL for an export as "-network
|
|
192.0.2.0/23" would result in a netmask of 255.255.127.0 being used
|
|
instead of the correct netmask of 255.255.254.0.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<freebsdsa>SA-11:01.mountd</freebsdsa>
|
|
<cvename>CVE-2011-1739</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-04-20</discovery>
|
|
<entry>2012-01-29</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="93688f8f-4935-11e1-89b4-001ec9578670">
|
|
<topic>postfixadmin -- Multiple Vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>postfixadmin</name>
|
|
<range><lt>2.3.5</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Postfix Admin Team reports:</p>
|
|
<blockquote cite="http://sourceforge.net/projects/postfixadmin/forums/forum/676076/topic/4977778">
|
|
<p>Multiple XSS vulnerabilities exist:<br/>
|
|
- XSS with $_GET[domain] in templates/menu.php and
|
|
edit-vacation<br/>
|
|
- XSS in some create-domain input fields<br/>
|
|
- XSS in create-alias and edit-alias error message<br/>
|
|
- XSS (by values stored in the database) in fetchmail list
|
|
view, list-domain and list-virtual</p>
|
|
<p>Multiple SQL injection issues exist:<br/>
|
|
- SQL injection in pacrypt() (if $CONF[encrypt] ==
|
|
'mysql_encrypt')<br/>
|
|
- SQL injection in backup.php - the dump was not mysql_escape()d,
|
|
therefore users could inject SQL (for example in the vacation message)
|
|
which will be executed when restoring the database dump.
|
|
WARNING: database dumps created with backup.php from 2.3.4 or older
|
|
might contain malicious SQL. Double-check before using them!</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-0811</cvename>
|
|
<cvename>CVE-2012-0812</cvename>
|
|
<url>http://sourceforge.net/projects/postfixadmin/forums/forum/676076/topic/4977778</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-01-27</discovery>
|
|
<entry>2012-01-27</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="e465159c-4817-11e1-89b4-001ec9578670">
|
|
<topic>mpack -- Information disclosure</topic>
|
|
<affects>
|
|
<package>
|
|
<name>mpack</name>
|
|
<range><lt>1.6_3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The oss-security list reports:</p>
|
|
<blockquote cite="http://openwall.com/lists/oss-security/2011/12/31/1">
|
|
<p>Incorrect permissions on temporary files can lead to
|
|
information disclosure.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2011-4919</cvename>
|
|
<url>http://openwall.com/lists/oss-security/2011/12/31/1</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-12-31</discovery>
|
|
<entry>2012-01-26</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="fa2f386f-4814-11e1-89b4-001ec9578670">
|
|
<topic>acroread9 -- Multiple Vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>acroread9</name>
|
|
<range><lt>9.4.7</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Adobe Security Team reports:</p>
|
|
<blockquote cite="http://www.adobe.com/support/security/advisories/apsa11-04.html">
|
|
<p>An unspecified vulnerability in the U3D component allows
|
|
remote attackers to execute arbitrary code (or cause a denial
|
|
of service attack) via unknown vectors.</p>
|
|
</blockquote>
|
|
<blockquote cite="http://www.adobe.com/support/security/bulletins/apsb11-24.html">
|
|
<p>A heap-based buffer overflow allows attackers to execute
|
|
arbitrary code via unspecified vectors.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2011-2462</cvename>
|
|
<cvename>CVE-2011-1353</cvename>
|
|
<cvename>CVE-2011-2431</cvename>
|
|
<cvename>CVE-2011-2432</cvename>
|
|
<cvename>CVE-2011-2433</cvename>
|
|
<cvename>CVE-2011-2434</cvename>
|
|
<cvename>CVE-2011-2435</cvename>
|
|
<cvename>CVE-2011-2436</cvename>
|
|
<cvename>CVE-2011-2437</cvename>
|
|
<cvename>CVE-2011-2438</cvename>
|
|
<cvename>CVE-2011-2439</cvename>
|
|
<cvename>CVE-2011-2440</cvename>
|
|
<cvename>CVE-2011-2441</cvename>
|
|
<cvename>CVE-2011-2442</cvename>
|
|
<url>http://www.adobe.com/support/security/bulletins/apsb11-24.html</url>
|
|
<url>http://www.adobe.com/support/security/advisories/apsa11-04.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-12-07</discovery>
|
|
<entry>2012-01-26</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="33d73d59-4677-11e1-88cd-00262d5ed8ee">
|
|
<topic>chromium -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>chromium</name>
|
|
<range><lt>16.0.912.77</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Google Chrome Releases reports:</p>
|
|
<blockquote cite="http://googlechromereleases.blogspot.com/search/label/Stable%20updates">
|
|
<p>[106484] High CVE-2011-3924: Use-after-free in DOM selections.
|
|
Credit to Arthur Gerkis.</p>
|
|
<p>[108461] High CVE-2011-3928: Use-after-free in DOM handling.
|
|
Credit to wushi of team509 reported through ZDI (ZDI-CAN-1415).</p>
|
|
<p>[108605] High CVE-2011-3927: Uninitialized value in Skia. Credit
|
|
to miaubiz.</p>
|
|
<p>[109556] High CVE-2011-3926: Heap-buffer-overflow in tree builder.
|
|
Credit to Arthur Gerkis.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2011-3924</cvename>
|
|
<cvename>CVE-2011-3926</cvename>
|
|
<cvename>CVE-2011-3927</cvename>
|
|
<cvename>CVE-2011-3928</cvename>
|
|
<url>http://googlechromereleases.blogspot.com/search/label/Stable%20updates</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-01-23</discovery>
|
|
<entry>2012-01-24</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="3ebb2dc8-4609-11e1-9f47-00e0815b8da8">
|
|
<topic>Wireshark -- Multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>wireshark</name>
|
|
<range><ge>1.4</ge><lt>1.4.11</lt></range>
|
|
<range><ge>1.6.0</ge><lt>1.6.5</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>wireshark-lite</name>
|
|
<range><ge>1.4</ge><lt>1.4.11</lt></range>
|
|
<range><ge>1.6.0</ge><lt>1.6.5</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>tshark</name>
|
|
<range><ge>1.4</ge><lt>1.4.11</lt></range>
|
|
<range><ge>1.6.0</ge><lt>1.6.5</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>tshark-lite</name>
|
|
<range><ge>1.4</ge><lt>1.4.11</lt></range>
|
|
<range><ge>1.6.0</ge><lt>1.6.5</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Wireshark reports:</p>
|
|
<blockquote cite="http://www.wireshark.org/docs/relnotes/wireshark-1.6.5.html">
|
|
<p>Laurent Butti discovered that Wireshark failed to properly check
|
|
record sizes for many packet capture file formats</p>
|
|
<p>Wireshark could dereference a NULL pointer and crash.</p>
|
|
<p>The RLC dissector could overflow a buffer.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-0041</cvename>
|
|
<cvename>CVE-2012-0066</cvename>
|
|
<cvename>CVE-2012-0067</cvename>
|
|
<cvename>CVE-2012-0068</cvename>
|
|
<url>http://www.wireshark.org/security/wnpa-sec-2012-01.html</url>
|
|
<url>http://www.wireshark.org/security/wnpa-sec-2012-02.html</url>
|
|
<url>http://www.wireshark.org/security/wnpa-sec-2012-03.html</url>
|
|
<url>https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6663</url>
|
|
<url>https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6666</url>
|
|
<url>https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6667</url>
|
|
<url>https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6668</url>
|
|
<url>https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6669</url>
|
|
<url>https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6670</url>
|
|
<url>https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6634</url>
|
|
<url>https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6391</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-01-10</discovery>
|
|
<entry>2012-01-23</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="7d2336c2-4607-11e1-9f47-00e0815b8da8">
|
|
<topic>spamdyke -- Buffer Overflow Vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>spamdyke</name>
|
|
<range><lt>4.3.0</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://www.spamdyke.org/documentation/Changelog.txt">
|
|
<p>Fixed a number of very serious errors in the usage of
|
|
snprintf()/vsnprintf().</p>
|
|
<p>The return value was being used as the length of the string
|
|
printed into the buffer, but the return value really indicates
|
|
the length of the string that *could* be printed if the buffer
|
|
were of infinite size. Because the returned value could be
|
|
larger than the buffer's size, this meant remotely exploitable
|
|
buffer overflows were possible, depending on spamdyke's
|
|
configuration.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-0802</cvename>
|
|
<url>https://secunia.com/advisories/47548/</url>
|
|
<url>http://www.spamdyke.org/documentation/Changelog.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-01-15</discovery>
|
|
<entry>2012-01-23</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="5c5f19ce-43af-11e1-89b4-001ec9578670">
|
|
<topic>OpenSSL -- DTLS Denial of Service</topic>
|
|
<affects>
|
|
<package>
|
|
<name>openssl</name>
|
|
<range><lt>1.0.0_9</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The OpenSSL Team reports:</p>
|
|
<blockquote cite="http://www.openssl.org/news/secadv_20120118.txt">
|
|
<p>A flaw in the fix to CVE-2011-4108 can be exploited in a
|
|
denial of service attack. Only DTLS applications using OpenSSL
|
|
1.0.0f and 0.9.8s are affected.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-0050</cvename>
|
|
<url>http://www.openssl.org/news/secadv_20120118.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-01-18</discovery>
|
|
<entry>2012-01-20</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="dd698b76-42f7-11e1-a1b6-14dae9ebcf89">
|
|
<topic>asterisk -- SRTP Video Remote Crash Vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>asterisk18</name>
|
|
<range><lt>1.8.8.2</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>asterisk10</name>
|
|
<range><lt>10.0.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Asterisk project reports:</p>
|
|
<blockquote cite="http://downloads.asterisk.org/pub/security/AST-2012-001.html">
|
|
<p>An attacker attempting to negotiate a secure video stream can
|
|
crash Asterisk if video support has not been enabled and the
|
|
res_srtp Asterisk module is loaded.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://downloads.asterisk.org/pub/security/AST-2012-001.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-01-15</discovery>
|
|
<entry>2012-01-20</entry>
|
|
<modified>2013-06-19</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="7f5ccb1d-439b-11e1-bc16-0023ae8e59f0">
|
|
<topic>tomcat -- Denial of Service</topic>
|
|
<affects>
|
|
<package>
|
|
<name>tomcat</name>
|
|
<range><gt>5.5.0</gt><lt>5.5.35</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>tomcat</name>
|
|
<range><gt>6.0.0</gt><lt>6.0.34</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>tomcat</name>
|
|
<range><gt>7.0.0</gt><lt>7.0.23</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Tomcat security team reports:</p>
|
|
<blockquote cite="http://tomcat.apache.org/security-5.html#Fixed_in_Apache_Tomcat_5.5.35">
|
|
<p>Analysis of the recent hash collision vulnerability identified
|
|
unrelated inefficiencies with Apache Tomcat's handling of large
|
|
numbers of parameters and parameter values. These inefficiencies
|
|
could allow an attacker, via a specially crafted request, to
|
|
cause large amounts of CPU to be used which in turn could create
|
|
a denial of service. The issue was addressed by modifying the
|
|
Tomcat parameter handling code to efficiently process large
|
|
numbers of parameters and parameter values.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-0022</cvename>
|
|
<url>http://tomcat.apache.org/security-5.html#Fixed_in_Apache_Tomcat_5.5.35</url>
|
|
<url>http://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.34</url>
|
|
<url>http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.23</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-10-21</discovery>
|
|
<entry>2012-01-17</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="1ac858b0-3fae-11e1-a127-0013d3ccd9df">
|
|
<topic>OpenTTD -- Denial of service (server) via slow read attack</topic>
|
|
<affects>
|
|
<package>
|
|
<name>openttd</name>
|
|
<range><ge>0.3.5</ge><lt>1.1.5</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The OpenTTD Team reports:</p>
|
|
<blockquote cite="http://security.openttd.org/en/CVE-2012-0049">
|
|
<p>Using a slow read type attack it is possible to prevent anyone
|
|
from joining a server with virtually no resources. Once
|
|
downloading the map no other downloads of the map can start, so
|
|
downloading really slowly will prevent others from joining.
|
|
This can be further aggravated by the pause-on-join setting in
|
|
which case the game is paused and the players cannot continue
|
|
the game during such an attack. This attack requires that the
|
|
user is not banned and passes the authorization to the server,
|
|
although for many servers there is no server password and thus
|
|
authorization is easy.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-0049</cvename>
|
|
<url>http://security.openttd.org/en/CVE-2012-0049</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-01-06</discovery>
|
|
<entry>2012-01-16</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="91be81e7-3fea-11e1-afc7-2c4138874f7d">
|
|
<topic>Multiple implementations -- DoS via hash algorithm collision</topic>
|
|
<affects>
|
|
<package>
|
|
<name>jruby</name>
|
|
<range><lt>1.6.5.1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>ruby</name>
|
|
<name>ruby+nopthreads</name>
|
|
<name>ruby+nopthreads+oniguruma</name>
|
|
<name>ruby+oniguruma</name>
|
|
<range><lt>1.8.7.357,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>rubygem-rack</name>
|
|
<range><lt>1.3.6,3</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>v8</name>
|
|
<range><lt>3.8.5</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>redis</name>
|
|
<range><le>2.4.6</le></range>
|
|
</package>
|
|
<package>
|
|
<name>node</name>
|
|
<range><lt>0.6.7</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>oCERT reports:</p>
|
|
<blockquote cite="http://www.ocert.org/advisories/ocert-2011-003.html">
|
|
<p>A variety of programming languages suffer from a denial-of-service
|
|
(DoS) condition against storage functions of key/value pairs in
|
|
hash data structures, the condition can be leveraged by exploiting
|
|
predictable collisions in the underlying hashing algorithms.</p>
|
|
<p>The issue finds particular exposure in web server applications
|
|
and/or frameworks. In particular, the lack of sufficient limits
|
|
for the number of parameters in POST requests in conjunction with
|
|
the predictable collision properties in the hashing functions of
|
|
the underlying languages can render web applications vulnerable
|
|
to the DoS condition. The attacker, using specially crafted HTTP
|
|
requests, can lead to a 100% of CPU usage which can last up to
|
|
several hours depending on the targeted application and server
|
|
performance, the amplification effect is considerable and
|
|
requires little bandwidth and time on the attacker side.</p>
|
|
<p>The condition for predictable collisions in the hashing functions
|
|
has been reported for the following language implementations:
|
|
Java, JRuby, PHP, Python, Rubinius, Ruby. In the case of the
|
|
Ruby language, the 1.9.x branch is not affected by the
|
|
predictable collision condition since this version includes a
|
|
randomization of the hashing function.</p>
|
|
<p>The vulnerability outlined in this advisory is practically
|
|
identical to the one reported in 2003 and described in the paper
|
|
Denial of Service via Algorithmic Complexity Attacks which
|
|
affected the Perl language.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2011-4838</cvename>
|
|
<cvename>CVE-2011-4815</cvename>
|
|
<cvename>CVE-2011-5036</cvename>
|
|
<cvename>CVE-2011-5037</cvename>
|
|
<url>http://www.ocert.org/advisories/ocert-2011-003.html</url>
|
|
<url>http://www.nruns.com/_downloads/advisory28122011.pdf</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-12-28</discovery>
|
|
<entry>2012-01-16</entry>
|
|
<modified>2012-01-20</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="ea2ddc49-3e8e-11e1-8095-5404a67eef98">
|
|
<topic>ffmpeg -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>ffmpeg</name>
|
|
<range><lt>0.7.11,1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Ubuntu Security Notice USN-1320-1 reports:</p>
|
|
<blockquote cite="http://www.ubuntu.com/usn/usn-1320-1">
|
|
<p>Phillip Langlois discovered that FFmpeg incorrectly handled
|
|
certain malformed QDM2 streams. If a user were tricked into opening
|
|
a crafted QDM2 stream file, an attacker could cause a denial of
|
|
service via application crash, or possibly execute arbitrary code
|
|
with the privileges of the user invoking the program.
|
|
(CVE-2011-4351)</p>
|
|
<p>Phillip Langlois discovered that FFmpeg incorrectly handled
|
|
certain malformed VP3 streams. If a user were tricked into opening
|
|
a crafted file, an attacker could cause a denial of service via
|
|
application crash, or possibly execute arbitrary code with the
|
|
privileges of the user invoking the program. (CVE-2011-4352)</p>
|
|
<p>Phillip Langlois discovered that FFmpeg incorrectly handled
|
|
certain malformed VP5 and VP6 streams. If a user were tricked into
|
|
opening a crafted file, an attacker could cause a denial of service
|
|
via application crash, or possibly execute arbitrary code with the
|
|
privileges of the user invoking the program. (CVE-2011-4353)</p>
|
|
<p>It was discovered that FFmpeg incorrectly handled certain
|
|
malformed VMD files. If a user were tricked into opening a crafted
|
|
VMD file, an attacker could cause a denial of service via
|
|
application crash, or possibly execute arbitrary code with the
|
|
privileges of the user invoking the program. (CVE-2011-4364)</p>
|
|
<p>Phillip Langlois discovered that FFmpeg incorrectly handled
|
|
certain malformed SVQ1 streams. If a user were tricked into opening
|
|
a crafted SVQ1 stream file, an attacker could cause a denial of
|
|
service via application crash, or possibly execute arbitrary code
|
|
with the privileges of the user invoking the program.
|
|
(CVE-2011-4579)</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2011-4351</cvename>
|
|
<cvename>CVE-2011-4352</cvename>
|
|
<cvename>CVE-2011-4353</cvename>
|
|
<cvename>CVE-2011-4364</cvename>
|
|
<cvename>CVE-2011-4579</cvename>
|
|
<url>http://www.ubuntu.com/usn/usn-1320-1</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-09-14</discovery>
|
|
<entry>2012-01-14</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="78cc8a46-3e56-11e1-89b4-001ec9578670">
|
|
<topic>OpenSSL -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>openssl</name>
|
|
<range><lt>1.0.0_8</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The OpenSSL Team reports:</p>
|
|
<blockquote cite="http://openssl.org/news/secadv_20120104.txt">
|
|
<p>6 security flaws have been fixed in OpenSSL 1.0.0f:</p>
|
|
<p>If X509_V_FLAG_POLICY_CHECK is set in OpenSSL 0.9.8,
|
|
then a policy check failure can lead to a double-free.</p>
|
|
<p>OpenSSL prior to 1.0.0f and 0.9.8s failed to clear the
|
|
bytes used as block cipher padding in SSL 3.0 records.
|
|
As a result, in each record, up to 15 bytes of
|
|
uninitialized memory may be sent, encrypted, to the SSL
|
|
peer. This could include sensitive contents of
|
|
previously freed memory.</p>
|
|
<p>RFC 3779 data can be included in certificates, and if
|
|
it is malformed, may trigger an assertion failure.
|
|
This could be used in a denial-of-service attack.</p>
|
|
<p>Support for handshake restarts for server gated
|
|
cryptograpy (SGC) can be used in a denial-of-service
|
|
attack.</p>
|
|
<p>A malicious TLS client can send an invalid set of GOST
|
|
parameters which will cause the server to crash due to
|
|
lack of error checking. This could be used in a
|
|
denial-of-service attack.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2011-4108</cvename>
|
|
<cvename>CVE-2011-4109</cvename>
|
|
<cvename>CVE-2011-4576</cvename>
|
|
<cvename>CVE-2011-4577</cvename>
|
|
<cvename>CVE-2011-4619</cvename>
|
|
<cvename>CVE-2012-0027</cvename>
|
|
<url>http://openssl.org/news/secadv_20120104.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-01-04</discovery>
|
|
<entry>2012-01-14</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="1800886c-3dde-11e1-89b4-001ec9578670">
|
|
<topic>isc-dhcp-server -- DoS in DHCPv6</topic>
|
|
<affects>
|
|
<package>
|
|
<name>isc-dhcp42-server</name>
|
|
<range><lt>4.2.3_2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>ISC reports:</p>
|
|
<blockquote cite="https://www.isc.org/software/dhcp/advisories/cve-2011-4868">
|
|
<p>Due to improper handling of a DHCPv6 lease structure, ISC DHCP
|
|
servers that are serving IPv6 address pools AND using Dynamic
|
|
DNS can encounter a segmentation fault error while updating lease
|
|
status under certain conditions.</p>
|
|
<p>The potential exists for this condition to be intentionally
|
|
triggered, resulting in effective denial of service to
|
|
clients expecting service from the affected server.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2011-4868</cvename>
|
|
<url>https://www.isc.org/software/dhcp/advisories/cve-2011-4868</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-01-13</discovery>
|
|
<entry>2012-01-13</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="3338f87c-3d5f-11e1-a00a-000c6eb41cf7">
|
|
<topic>PowerDNS -- Denial of Service Vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>powerdns</name>
|
|
<name>powerdns-devel</name>
|
|
<range><lt>3.0.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The PowerDNS Team reports:</p>
|
|
<blockquote cite="http://www.powerdns.com/news/powerdns-security-advisory-2012-01.html">
|
|
<p>Using well crafted UDP packets, one or more PowerDNS servers
|
|
could be made to enter a tight packet loop, causing temporary
|
|
denial of service.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-0206</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-01-10</discovery>
|
|
<entry>2012-01-12</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="d3921810-3c80-11e1-97e8-00215c6a37bb">
|
|
<topic>php -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>php5</name>
|
|
<name>php5-exif</name>
|
|
<range><lt>5.3.9</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>php52</name>
|
|
<range><lt>5.2.17_5</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>php52-exif</name>
|
|
<range><lt>5.2.17_6</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>php development team reports:</p>
|
|
<blockquote cite="http://www.php.net/archive/2012.php#id2012-01-11-1">
|
|
<p>Security Enhancements and Fixes in PHP 5.3.9:</p>
|
|
<ul>
|
|
<li>Added max_input_vars directive to prevent attacks
|
|
based on hash collisions. (CVE-2011-4885)</li>
|
|
<li>Fixed bug #60150 (Integer overflow during the parsing
|
|
of invalid exif header). (CVE-2011-4566)</li>
|
|
</ul>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2011-4566</cvename>
|
|
<cvename>CVE-2011-4885</cvename>
|
|
<url>http://www.nruns.com/_downloads/advisory28122011.pdf</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-12-29</discovery>
|
|
<entry>2012-01-11</entry>
|
|
<modified>2012-01-19</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="e7fd27b2-3ae9-11e1-8b5c-00262d5ed8ee">
|
|
<topic>torcs -- untrusted local library loading</topic>
|
|
<affects>
|
|
<package>
|
|
<name>torcs</name>
|
|
<range><lt>1.3.2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>TORCS News reports:</p>
|
|
<blockquote cite="http://torcs.sourceforge.net/index.php?name=News&file=article&sid=77">
|
|
<p>An insecure change to LD_LIBRARY_PATH allows loading of libraries
|
|
in directories other than the standard paths. This can be a
|
|
problem when downloading and installing untrusted content from the
|
|
Internet.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2010-3384</cvename>
|
|
<url>http://torcs.sourceforge.net/index.php?name=News&file=article&sid=77</url>
|
|
<url>http://sourceforge.net/tracker/index.php?func=detail&aid=3089384&group_id=3777&atid=103777</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-10-20</discovery>
|
|
<entry>2012-01-09</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="a47af810-3a17-11e1-a1be-00e0815b8da8">
|
|
<topic>spamdyke -- STARTTLS Plaintext Injection Vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>spamdyke</name>
|
|
<range><lt>4.2.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/47435/">
|
|
<p>The vulnerability is caused due to the TLS implementation not
|
|
properly clearing transport layer buffers when upgrading from
|
|
plaintext to ciphertext after receiving the "STARTTLS" command.
|
|
This can be exploited to insert arbitrary plaintext data (e.g.
|
|
SMTP commands) during the plaintext phase, which will then be
|
|
executed after upgrading to the TLS ciphertext phase.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2012-0070</cvename>
|
|
<url>http://secunia.com/advisories/47435/</url>
|
|
<url>http://www.spamdyke.org/documentation/Changelog.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-01-04</discovery>
|
|
<entry>2012-01-08</entry>
|
|
<modified>2012-01-23</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="1a1aef8e-3894-11e1-8b5c-00262d5ed8ee">
|
|
<topic>chromium -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>chromium</name>
|
|
<range><lt>16.0.912.75</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Google Chrome Releases reports:</p>
|
|
<blockquote cite="http://googlechromereleases.blogspot.com/search/label/Stable%20updates">
|
|
<p>[106672] High CVE-2011-3921: Use-after-free in animation frames.
|
|
Credit to Boris Zbarsky of Mozilla.<br/>
|
|
[107128] High CVE-2011-3919: Heap-buffer-overflow in libxml.
|
|
Credit to Juri Aedla.<br/>
|
|
[108006] High CVE-2011-3922: Stack-buffer-overflow in glyph
|
|
handling. Credit to Google Chrome Security Team (Cris
|
|
Neckar).</p>
|
|
<p>[107182] Critical CVE-2011-3925: Use-after-free in Safe Browsing
|
|
navigation. Credit to Chamal de Silva.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2011-3919</cvename>
|
|
<cvename>CVE-2011-3921</cvename>
|
|
<cvename>CVE-2011-3922</cvename>
|
|
<cvename>CVE-2011-3925</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-01-05</discovery>
|
|
<entry>2012-01-06</entry>
|
|
<modified>2012-01-23</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="0c7a3ee2-3654-11e1-b404-20cf30e32f6d">
|
|
<topic>bugzilla -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>bugzilla</name>
|
|
<range><ge>2.4.*</ge><lt>3.6.7</lt></range>
|
|
<range><ge>4.0.*</ge><lt>4.0.3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A Bugzilla Security Advisory reports:</p>
|
|
<blockquote cite="http://www.bugzilla.org/security/3.4.12/">
|
|
<p>The following security issues have been discovered in Bugzilla:</p>
|
|
<ul>
|
|
<li>Tabular and graphical reports, as well as new charts have
|
|
a debug mode which displays raw data as plain text. This
|
|
text is not correctly escaped and a crafted URL could use
|
|
this vulnerability to inject code leading to XSS.</li>
|
|
<li>The User.offer_account_by_email WebService method ignores
|
|
the user_can_create_account setting of the authentication
|
|
method and generates an email with a token in it which the
|
|
user can use to create an account. Depending on the
|
|
authentication method being active, this could allow the
|
|
user to log in using this account.
|
|
Installations where the createemailregexp parameter is
|
|
empty are not vulnerable to this issue.</li>
|
|
<li>The creation of bug reports and of attachments is not
|
|
protected by a token and so they can be created without the
|
|
consent of a user if the relevant code is embedded in an
|
|
HTML page and the user visits this page. This behavior was
|
|
intentional to let third-party applications submit new bug
|
|
reports and attachments easily. But as this behavior can be
|
|
abused by a malicious user, it has been decided to block
|
|
submissions with no valid token starting from version 4.2rc1.
|
|
Older branches are not patched to not break these third-party
|
|
applications after the upgrade.</li>
|
|
</ul>
|
|
<p>All affected installations are encouraged to upgrade as soon
|
|
as possible.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2011-3657</cvename>
|
|
<cvename>CVE-2011-3667</cvename>
|
|
<cvename>CVE-2011-3668</cvename>
|
|
<cvename>CVE-2011-3669</cvename>
|
|
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=697699</url>
|
|
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=711714</url>
|
|
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=703975</url>
|
|
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=703983</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-11-28</discovery>
|
|
<entry>2012-01-05</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="810df820-3664-11e1-8fe3-00215c6a37bb">
|
|
<topic>WordPress -- cross site scripting vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>wordpress</name>
|
|
<range><lt>3.3.1,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>de-wordpress</name>
|
|
<name>zh-wordpress-zh_CN</name>
|
|
<name>zh-wordpress-zh_TW</name>
|
|
<range><lt>3.3.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>WordPress development team reports:</p>
|
|
<blockquote cite="http://wordpress.org/news/2012/01/wordpress-3-3-1/">
|
|
<p>WordPress 3.3.1 is now available. This maintenance release
|
|
fixes 15 issues with WordPress 3.3, as well as a fix for a
|
|
cross-site scripting vulnerability that affected version 3.3.
|
|
Thanks to Joshua H., Hoang T., Stefan Zimmerman, Chris K., and
|
|
the Go Daddy security team for responsibly disclosing the bug
|
|
to our security team.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://threatpost.com/en_us/blogs/xss-bug-found-wordpress-33-010312</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2012-01-03</discovery>
|
|
<entry>2012-01-03</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="048c77df-3211-11e1-9583-14dae938ec40">
|
|
<topic>zabbix-frontend -- multiple XSS vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>zabbix-frontend</name>
|
|
<range><lt>1.8.10,2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Martina Matari reports:</p>
|
|
<blockquote cite="https://support.zabbix.com/browse/ZBX-4015">
|
|
<p>These URLs (hostgroups.php, usergrps.php) are vulnerable to
|
|
persistent XSS attacks due to improper sanitation of gname
|
|
variable when creating user and host groups.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>https://support.zabbix.com/browse/ZBX-4015</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-08-04</discovery>
|
|
<entry>2011-12-29</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="c6521b04-314b-11e1-9cf4-5404a67eef98">
|
|
<topic>lighttpd -- remote DoS in HTTP authentication</topic>
|
|
<affects>
|
|
<package>
|
|
<name>lighttpd</name>
|
|
<range><lt>1.4.30</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>US-CERT/NIST reports:</p>
|
|
<blockquote cite="http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-4362">
|
|
<p>Integer signedness error in the base64_decode function in the
|
|
HTTP authentication functionality (http_auth.c) in lighttpd 1.4
|
|
before 1.4.30 and 1.5 before SVN revision 2806 allows remote
|
|
attackers to cause a denial of service (segmentation fault)
|
|
via crafted base64 input that triggers an out-of-bounds read
|
|
with a negative index.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2011-4362</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-11-29</discovery>
|
|
<entry>2011-12-28</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="4ddc78dc-300a-11e1-a2aa-0016ce01e285">
|
|
<topic>krb5-appl -- telnetd code execution vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>FreeBSD</name>
|
|
<range><ge>7.3</ge><lt>7.3_9</lt></range>
|
|
<range><ge>7.4</ge><lt>7.4_5</lt></range>
|
|
<range><ge>8.1</ge><lt>8.1_7</lt></range>
|
|
<range><ge>8.2</ge><lt>8.2_5</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>krb5-appl</name>
|
|
<range><lt>1.0.2_1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The MIT Kerberos Team reports:</p>
|
|
<blockquote cite="http://security.FreeBSD.org/advisories/FreeBSD-SA-11:08.telnetd.asc">
|
|
<p>When an encryption key is supplied via the TELNET protocol,
|
|
its length is not validated before the key is copied into a
|
|
fixed-size buffer. Also see MITKRB5-SA-2011-008.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<freebsdsa>SA-11:08.telnetd</freebsdsa>
|
|
<cvename>CVE-2011-4862</cvename>
|
|
<url>http://security.FreeBSD.org/advisories/FreeBSD-SA-11:08.telnetd.asc</url>
|
|
<url>http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2011-008.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-12-23</discovery>
|
|
<entry>2011-12-26</entry>
|
|
<modified>2012-01-29</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="022a4c77-2da4-11e1-b356-00215c6a37bb">
|
|
<topic>proftpd -- arbitrary code execution vulnerability with chroot</topic>
|
|
<affects>
|
|
<package>
|
|
<name>FreeBSD</name>
|
|
<range><ge>7.3</ge><lt>7.3_9</lt></range>
|
|
<range><ge>7.4</ge><lt>7.4_5</lt></range>
|
|
<range><ge>8.1</ge><lt>8.1_6</lt></range>
|
|
<range><ge>8.2</ge><lt>8.2_5</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>proftpd</name>
|
|
<name>proftpd-mysql</name>
|
|
<range><lt>1.3.3g_1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>proftpd-devel</name>
|
|
<range><lt>1.3.3.r4_3,1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The FreeBSD security advisory FreeBSD-SA-11:07.chroot reports:</p>
|
|
<blockquote cite="http://security.freebsd.org/advisories/FreeBSD-SA-11:07.chroot.asc">
|
|
<p>If ftpd is configured to place a user in a chroot environment,
|
|
then an attacker who can log in as that user may be able to run
|
|
arbitrary code(...).</p>
|
|
</blockquote>
|
|
<p>Proftpd shares the same problem of a similar nature.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<freebsdsa>SA-11:07.chroot</freebsdsa>
|
|
<url>http://seclists.org/fulldisclosure/2011/Nov/452</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-11-30</discovery>
|
|
<entry>2011-12-23</entry>
|
|
<modified>2012-01-29</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="8c83145d-2c95-11e1-89b4-001ec9578670">
|
|
<topic>phpMyAdmin -- Multiple XSS</topic>
|
|
<affects>
|
|
<package>
|
|
<name>phpMyAdmin</name>
|
|
<range><gt>3.4</gt><lt>3.4.9.r1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The phpMyAdmin development team reports:</p>
|
|
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2011-19.php">
|
|
<p>Using crafted url parameters, it was possible to produce XSS on
|
|
the export panels in the server, database and table sections.</p>
|
|
</blockquote>
|
|
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2011-20.php">
|
|
<p>Crafted values entered in the setup interface can produce XSS;
|
|
also, if the config directory exists and is writeable, the XSS
|
|
payload can be saved to this directory.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2011-4780</cvename>
|
|
<cvename>CVE-2011-4782</cvename>
|
|
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2011-19.php</url>
|
|
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2011-20.php</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-12-16</discovery>
|
|
<entry>2011-12-22</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="e3ff776b-2ba6-11e1-93c6-0011856a6e37">
|
|
<topic>mozilla -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>firefox</name>
|
|
<range><gt>4.0,1</gt><lt>9.0,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-firefox</name>
|
|
<range><lt>9.0,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-seamonkey</name>
|
|
<range><lt>2.6</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-thunderbird</name>
|
|
<range><lt>9.0</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>seamonkey</name>
|
|
<range><lt>2.6</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>thunderbird</name>
|
|
<range><gt>4.0</gt><lt>9.0</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Mozilla Project reports:</p>
|
|
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
|
|
<p>MFSA 2011-53 Miscellaneous memory safety hazards (rv:9.0)</p>
|
|
<p>MFSA 2011-54 Potentially exploitable crash in the YARR regular
|
|
expression library</p>
|
|
<p>MFSA 2011-55 nsSVGValue out-of-bounds access</p>
|
|
<p>MFSA 2011-56 Key detection without JavaScript via SVG
|
|
animation</p>
|
|
<p>MFSA 2011-58 Crash scaling video to extreme sizes</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2011-3658</cvename>
|
|
<cvename>CVE-2011-3660</cvename>
|
|
<cvename>CVE-2011-3661</cvename>
|
|
<cvename>CVE-2011-3663</cvename>
|
|
<cvename>CVE-2011-3665</cvename>
|
|
<url>http://www.mozilla.org/security/announce/2011/mfsa2011-53.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2011/mfsa2011-54.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2011/mfsa2011-55.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2011/mfsa2011-56.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2011/mfsa2011-58.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-12-20</discovery>
|
|
<entry>2011-12-21</entry>
|
|
<modified>2011-12-21</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="7ba65bfd-2a40-11e1-b96e-00215af774f0">
|
|
<topic>unbound -- denial of service vulnerabilities from nonstandard redirection and denial of existence</topic>
|
|
<affects>
|
|
<package>
|
|
<name>unbound</name>
|
|
<range><lt>1.4.14</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Unbound developer reports:</p>
|
|
<blockquote cite="http://www.unbound.net/downloads/CVE-2011-4528.txt">
|
|
<p>Unbound crashes when confronted with a non-standard response
|
|
from a server for a domain. This domain produces duplicate RRs
|
|
from a certain type and is DNSSEC signed. Unbound also crashes
|
|
when confronted with a query that eventually, and under specific
|
|
circumstances, resolves to a domain that misses expected NSEC3
|
|
records.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2011-4528</cvename>
|
|
<url>http://unbound.nlnetlabs.nl/downloads/CVE-2011-4528.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-12-19</discovery>
|
|
<entry>2011-12-19</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="3c957a3e-2978-11e1-89b4-001ec9578670">
|
|
<topic>typo3 -- Remote Code Execution</topic>
|
|
<affects>
|
|
<package>
|
|
<name>typo3</name>
|
|
<range><ge>4.6</ge><lt>4.6.2</lt></range>
|
|
<range><lt>4.5.9</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The typo3 security team reports:</p>
|
|
<blockquote cite="http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2011-004/">
|
|
<p>A crafted request to a vulnerable TYPO3 installation will allow
|
|
an attacker to load PHP code from an external source and to
|
|
execute it on the TYPO3 installation.</p>
|
|
<p>This is caused by a PHP file, which is part of the workspaces
|
|
system extension, that does not validate passed arguments.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2011-4614</cvename>
|
|
<url>http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2011-004/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-12-16</discovery>
|
|
<entry>2011-12-18</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="6c7d9a35-2608-11e1-89b4-001ec9578670">
|
|
<topic>krb5 -- KDC null pointer dereference in TGS handling</topic>
|
|
<affects>
|
|
<package>
|
|
<name>krb5</name>
|
|
<range><ge>1.9</ge><lt>1.9.2_1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The MIT Kerberos Team reports:</p>
|
|
<blockquote cite="http://web.mit.edu/kerberos/www/advisories/MITKRB5-SA-2011-007.txt">
|
|
<p>In releases krb5-1.9 and later, the KDC can crash due to a NULL
|
|
pointer dereference in code that handles TGS (Ticket Granting
|
|
Service) requests. The trigger condition is trivial to produce
|
|
using unmodified client software, but requires the ability to
|
|
authenticate as a principal in the KDC's realm.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2011-1530</cvename>
|
|
<url>http://web.mit.edu/kerberos/www/advisories/MITKRB5-SA-2011-007.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-12-11</discovery>
|
|
<entry>2011-12-14</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="a4a809d8-25c8-11e1-b531-00215c6a37bb">
|
|
<topic>opera -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>opera</name>
|
|
<name>linux-opera</name>
|
|
<range><lt>11.60</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>opera-devel</name>
|
|
<range><lt>11.60,1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Opera software reports:</p>
|
|
<blockquote cite="http://www.opera.com/docs/changelogs/unix/1160/">
|
|
<ul>
|
|
<li>Fixed a moderately severe issue; details will be
|
|
disclosed at a later date</li>
|
|
<li>Fixed an issue that could allow pages to set cookies
|
|
or communicate cross-site for some top level domains;
|
|
see our <a href="http://www.opera.com/support/kb/view/1003/">advisory</a></li>
|
|
<li>Improved handling of certificate revocation corner
|
|
cases</li>
|
|
<li>Added a fix for a weakness in the SSL v3.0 and TLS 1.0
|
|
specifications, as reported by Thai Duong and Juliano Rizzo;
|
|
see our <a href="http://www.opera.com/support/kb/view/1004/">advisory</a></li>
|
|
<li>Fixed an issue where the JavaScript "in" operator
|
|
allowed leakage of cross-domain information, as reported
|
|
by David Bloom; see our <a href="http://www.opera.com/support/kb/view/1005/">advisory</a></li>
|
|
</ul>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2011-3389</cvename>
|
|
<cvename>CVE-2011-4681</cvename>
|
|
<cvename>CVE-2011-4682</cvename>
|
|
<cvename>CVE-2011-4683</cvename>
|
|
<url>http://www.opera.com/support/kb/view/1003/</url>
|
|
<url>http://www.opera.com/support/kb/view/1004/</url>
|
|
<url>http://www.opera.com/support/kb/view/1005/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-12-06</discovery>
|
|
<entry>2011-12-13</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="68ac6266-25c3-11e1-b63a-00262d5ed8ee">
|
|
<topic>chromium -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>chromium</name>
|
|
<range><lt>16.0.912.63</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Google Chrome Releases reports:</p>
|
|
<blockquote cite="http://googlechromereleases.blogspot.com/search/label/Stable%20updates">
|
|
<p>[81753] Medium CVE-2011-3903: Out-of-bounds read in regex
|
|
matching. Credit to David Holloway of the Chromium development
|
|
community.<br/>
|
|
[95465] Low CVE-2011-3905: Out-of-bounds reads in libxml. Credit to
|
|
Google Chrome Security Team (Inferno).<br/>
|
|
[98809] Medium CVE-2011-3906: Out-of-bounds read in PDF parser.
|
|
Credit to Aki Helin of OUSPG.<br/>
|
|
[99016] High CVE-2011-3907: URL bar spoofing with view-source.
|
|
Credit to Mitja Kolsek of ACROS Security.<br/>
|
|
[100863] Low CVE-2011-3908: Out-of-bounds read in SVG parsing.
|
|
Credit to Aki Helin of OUSPG.<br/>
|
|
[101010] Medium CVE-2011-3909: [64-bit only] Memory corruption in
|
|
CSS property array. Credit to Google Chrome Security Team
|
|
(scarybeasts) and Chu.<br/>
|
|
[101494] Medium CVE-2011-3910: Out-of-bounds read in YUV video
|
|
frame handling. Credit to Google Chrome Security Team (Cris
|
|
Neckar).<br/>
|
|
[101779] Medium CVE-2011-3911: Out-of-bounds read in PDF. Credit to
|
|
Google Chrome Security Team (scarybeasts) and Robert Swiecki of
|
|
the Google Security Team.<br/>
|
|
[102359] High CVE-2011-3912: Use-after-free in SVG filters. Credit
|
|
to Arthur Gerkis.<br/>
|
|
[103921] High CVE-2011-3913: Use-after-free in Range handling.
|
|
Credit to Arthur Gerkis.<br/>
|
|
[104011] High CVE-2011-3914: Out-of-bounds write in v8 i18n
|
|
handling. Credit to Slawomir Blazek.<br/>
|
|
[104529] High CVE-2011-3915: Buffer overflow in PDF font handling.
|
|
Credit to Atte Kettunen of OUSPG.<br/>
|
|
[104959] Medium CVE-2011-3916: Out-of-bounds reads in PDF cross
|
|
references. Credit to Atte Kettunen of OUSPG.<br/>
|
|
[105162] Medium CVE-2011-3917: Stack-buffer-overflow in FileWatcher.
|
|
Credit to Google Chrome Security Team (Marty Barbella).<br/>
|
|
[107258] High CVE-2011-3904: Use-after-free in bidi handling.
|
|
Credit to Google Chrome Security Team (Inferno) and miaubiz.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2011-3903</cvename>
|
|
<cvename>CVE-2011-3904</cvename>
|
|
<cvename>CVE-2011-3905</cvename>
|
|
<cvename>CVE-2011-3906</cvename>
|
|
<cvename>CVE-2011-3907</cvename>
|
|
<cvename>CVE-2011-3908</cvename>
|
|
<cvename>CVE-2011-3909</cvename>
|
|
<cvename>CVE-2011-3910</cvename>
|
|
<cvename>CVE-2011-3911</cvename>
|
|
<cvename>CVE-2011-3912</cvename>
|
|
<cvename>CVE-2011-3913</cvename>
|
|
<cvename>CVE-2011-3914</cvename>
|
|
<cvename>CVE-2011-3915</cvename>
|
|
<cvename>CVE-2011-3916</cvename>
|
|
<cvename>CVE-2011-3917</cvename>
|
|
<url>http://googlechromereleases.blogspot.com/search/label/Stable%20updates</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-12-13</discovery>
|
|
<entry>2011-12-13</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="bbd5f486-24f1-11e1-95bc-080027ef73ec">
|
|
<topic>PuTTY -- Password vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>putty</name>
|
|
<range><ge>0.59</ge><lt>0.62</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Simon Tatham reports:</p>
|
|
<blockquote cite="http://lists.tartarus.org/pipermail/putty-announce/2011/000017.html">
|
|
<p>PuTTY 0.62 fixes a security issue present in 0.59, 0.60 and 0.61.
|
|
If you log in using SSH-2 keyboard-interactive authentication
|
|
(which is the usual method used by modern servers to request a
|
|
password), the password you type was accidentally kept in PuTTY's
|
|
memory for the rest of its run, where it could be retrieved by
|
|
other processes reading PuTTY's memory, or written out to swap
|
|
files or crash dumps.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2011-4607</cvename>
|
|
<mlist>http://lists.tartarus.org/pipermail/putty-announce/2011/000017.html</mlist>
|
|
<url>http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/password-not-wiped.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-12-10</discovery>
|
|
<entry>2011-12-12</entry>
|
|
<modified>2013-08-07</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="bb389137-21fb-11e1-89b4-001ec9578670">
|
|
<topic>asterisk -- Multiple Vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>asterisk18</name>
|
|
<range><lt>1.8.7.2</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>asterisk16</name>
|
|
<range><lt>1.6.2.21</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Asterisk project reports:</p>
|
|
<blockquote cite="http://downloads.asterisk.org/pub/security/AST-2011-013.html">
|
|
<p>It is possible to enumerate SIP usernames when the general and
|
|
user/peer NAT settings differ in whether to respond to the port
|
|
a request is sent from or the port listed for responses in the
|
|
Via header.</p>
|
|
</blockquote>
|
|
<blockquote cite="http://downloads.asterisk.org/pub/security/AST-2011-014.html">
|
|
<p>When the "automon" feature is enabled in features.conf, it is
|
|
possible to send a sequence of SIP requests that cause Asterisk
|
|
to dereference a NULL pointer and crash.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2011-4597</cvename>
|
|
<cvename>CVE-2011-4598</cvename>
|
|
<url>http://downloads.asterisk.org/pub/security/AST-2011-013.html</url>
|
|
<url>http://downloads.asterisk.org/pub/security/AST-2011-014.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-12-08</discovery>
|
|
<entry>2011-12-09</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="93be487e-211f-11e1-89b4-001ec9578670">
|
|
<topic>isc-dhcp-server -- Remote DoS</topic>
|
|
<affects>
|
|
<package>
|
|
<name>isc-dhcp42-server</name>
|
|
<range><lt>4.2.3_1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>isc-dhcp41-server</name>
|
|
<range><lt>4.1.e_3,2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>ISC reports:</p>
|
|
<blockquote cite="https://www.isc.org/software/bind/advisories/cve-2011-4539">
|
|
<p>A bug exists which allows an attacker who is able to send DHCP
|
|
Request packets, either directly or through a relay, to remotely
|
|
crash an ISC DHCP server if that server is configured to evaluate
|
|
expressions using a regular expression (i.e. uses the "~=" or
|
|
"~~" comparison operators).</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2011-4539</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-12-07</discovery>
|
|
<entry>2011-12-07</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="ed536336-1c57-11e1-86f4-e0cb4e266481">
|
|
<topic>phpMyAdmin -- Multiple XSS</topic>
|
|
<affects>
|
|
<package>
|
|
<name>phpMyAdmin</name>
|
|
<range><gt>3.4</gt><lt>3.4.8.r1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The phpMyAdmin development team reports:</p>
|
|
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2011-18.php">
|
|
<p>Using crafted database names, it was possible to produce XSS
|
|
in the Database Synchronize and Database rename panels. Using
|
|
an invalid and crafted SQL query, it was possible to produce
|
|
XSS when editing a query on a table overview panel or when
|
|
using the view creation dialog. Using a crafted column type,
|
|
it was possible to produce XSS in the table search and create
|
|
index dialogs.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2011-4634</cvename>
|
|
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2011-18.php</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-11-24</discovery>
|
|
<entry>2011-12-01</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="eef56761-11eb-11e1-bb94-001c140104d4">
|
|
<topic>hiawatha -- memory leak in PreventSQLi routine</topic>
|
|
<affects>
|
|
<package>
|
|
<name>hiawatha</name>
|
|
<range><ge>7.6</ge><lt>7.8.2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Hugo Leisink reports via private mail to maintainer:</p>
|
|
<blockquote>
|
|
<p>The memory leak was introduced in version 7.6. It is in the
|
|
routing that checks for SQL injections. So, if you have set
|
|
PreventSQLi to 'no', there is no problem.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://www.hiawatha-webserver.org/changelog</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-11-18</discovery>
|
|
<entry>2011-11-18</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="90cc1494-10ac-11e1-b3ec-0024e830109b">
|
|
<topic>BIND -- Remote DOS</topic>
|
|
<affects>
|
|
<package>
|
|
<name>FreeBSD</name>
|
|
<range><ge>7.3</ge><lt>7.3_9</lt></range>
|
|
<range><ge>7.4</ge><lt>7.4_5</lt></range>
|
|
<range><ge>8.1</ge><lt>8.1_7</lt></range>
|
|
<range><ge>8.2</ge><lt>8.2_5</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>bind96</name>
|
|
<range><lt>9.6.3.1.ESV.R5.1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>bind97</name>
|
|
<range><lt>9.7.4.1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>bind98</name>
|
|
<range><lt>9.8.1.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Internet Systems Consortium reports:</p>
|
|
<blockquote cite="https://www.isc.org/software/bind/advisories/cve-2011-4313">
|
|
<p>Organizations across the Internet reported crashes interrupting
|
|
service on BIND 9 nameservers performing recursive queries.
|
|
Affected servers crashed after logging an error in query.c with
|
|
the following message: "INSIST(! dns_rdataset_isassociated(sigrdataset))"
|
|
Multiple versions were reported being affected, including all
|
|
currently supported release versions of ISC BIND 9.</p>
|
|
<p>Because it may be possible to trigger this bug even on networks
|
|
that do not allow untrusted users to access the recursive name
|
|
servers (perhaps via specially crafted e-mail messages, and/or
|
|
malicious web sites) it is recommended that ALL operators of
|
|
recursive name servers upgrade immediately.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<freebsdsa>SA-11:06.bind</freebsdsa>
|
|
<cvename>CVE-2011-4313</cvename>
|
|
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4313</url>
|
|
<url>https://www.isc.org/software/bind/advisories/cve-2011-4313</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-11-16</discovery>
|
|
<entry>2011-11-16</entry>
|
|
<modified>2012-01-29</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="d8c901ff-0f0f-11e1-902b-20cf30e32f6d">
|
|
<topic>Apache 1.3 -- mod_proxy reverse proxy exposure</topic>
|
|
<affects>
|
|
<package>
|
|
<name>apache</name>
|
|
<range><lt>1.3.43</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>apache+ssl</name>
|
|
<range><lt>1.3.43.1.59_2</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>apache+ipv6</name>
|
|
<range><lt>1.3.43</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>apache+mod_perl</name>
|
|
<range><lt>1.3.43</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>apache+mod_ssl</name>
|
|
<range><lt>1.3.41+2.8.31_4</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>apache+mod_ssl+ipv6</name>
|
|
<range><lt>1.3.41+2.8.31_4</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>ru-apache-1.3</name>
|
|
<range><lt>1.3.43+30.23_1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>ru-apache+mod_ssl</name>
|
|
<range><lt>1.3.43+30.23_1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Apache HTTP server project reports:</p>
|
|
<blockquote cite="http://httpd.apache.org/security/vulnerabilities_13.html">
|
|
<p>An exposure was found when using mod_proxy in reverse proxy mode.
|
|
In certain configurations using RewriteRule with proxy flag, a
|
|
remote attacker could cause the reverse proxy to connect to an
|
|
arbitrary server, possibly disclosing sensitive information from
|
|
internal web servers not directly accessible to attacker. There
|
|
is no patch against this issue!</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2011-3368</cvename>
|
|
<url>http://httpd.apache.org/security/vulnerabilities_13.html</url>
|
|
<url>http://seclists.org/fulldisclosure/2011/Oct/232</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-10-05</discovery>
|
|
<entry>2011-11-14</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="7fb9e739-0e6d-11e1-87cd-00235a5f2c9a">
|
|
<topic>kdeutils4 -- Directory traversal vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>kdeutils</name>
|
|
<range><ge>4.0.*</ge><lt>4.7.3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Tim Brown from Nth Dimention reports:</p>
|
|
<blockquote cite="http://seclists.org/fulldisclosure/2011/Oct/351">
|
|
<p>I recently discovered that the Ark archiving tool is vulnerable
|
|
to directory traversal via malformed. When attempts are made to
|
|
view files within the malformed Zip file in Ark's default view,
|
|
the wrong file may be displayed due to incorrect construction of
|
|
the temporary file name. Whilst this does not allow the wrong
|
|
file to be overwritten, after closing the default view, Ark will
|
|
then attempt to delete the temporary file which could result in
|
|
the deletion of the incorrect file.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2011-2725</cvename>
|
|
<url>http://seclists.org/fulldisclosure/2011/Oct/351</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-10-19</discovery>
|
|
<entry>2011-11-14</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="38560d79-0e42-11e1-902b-20cf30e32f6d">
|
|
<topic>Apache APR -- DoS vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>apr0</name>
|
|
<range><lt>0.9.20.0.9.19</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Apache Portable Runtime Project reports:</p>
|
|
<blockquote cite="http://www.apache.org/dist/apr/CHANGES-APR-0.9">
|
|
<p>Reimplement apr_fnmatch() from scratch using a non-recursive
|
|
algorithm; now has improved compliance with the fnmatch()
|
|
spec.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2011-0419</cvename>
|
|
<url>http://www.apache.org/dist/apr/Announcement0.9.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-05-19</discovery>
|
|
<entry>2011-11-13</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="1f6ee708-0d22-11e1-b5bd-14dae938ec40">
|
|
<topic>phpmyadmin -- Local file inclusion</topic>
|
|
<affects>
|
|
<package>
|
|
<name>phpMyAdmin</name>
|
|
<range><gt>3.4</gt><lt>3.4.7.1</lt></range>
|
|
<range><lt>3.3.10.5</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Jan Lieskovsky reports:</p>
|
|
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2011-17.php">
|
|
<p>Importing a specially-crafted XML file which contains an XML
|
|
entity injection permits to retrieve a local file (limited by the
|
|
privileges of the user running the web server).</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2011-4107</cvename>
|
|
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2011-17.php</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-11-10</discovery>
|
|
<entry>2011-11-12</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="0e8e1212-0ce5-11e1-849b-003067b2972c">
|
|
<topic>linux-flashplugin -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>linux-f10-flashplugin</name>
|
|
<range><lt>10.3r183.11</lt></range>
|
|
<range><gt>11</gt><lt>11.1r102.55</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Adobe Product Security Incident Response Team reports:</p>
|
|
<blockquote cite="https://www.adobe.com/support/security/bulletins/apsb11-28.html">
|
|
<p>Critical vulnerabilities have been identified in Adobe Flash
|
|
Player 11.0.1.152 and earlier versions for Windows, Macintosh,
|
|
Linux and Solaris, and Adobe Flash Player 11.0.1.153 and earlier
|
|
versions for Android.</p>
|
|
</blockquote>
|
|
<p>In addition a patch was released for users of flash10.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2011-2445</cvename>
|
|
<cvename>CVE-2011-2450</cvename>
|
|
<cvename>CVE-2011-2451</cvename>
|
|
<cvename>CVE-2011-2452</cvename>
|
|
<cvename>CVE-2011-2453</cvename>
|
|
<cvename>CVE-2011-2454</cvename>
|
|
<cvename>CVE-2011-2455</cvename>
|
|
<cvename>CVE-2011-2456</cvename>
|
|
<cvename>CVE-2011-2457</cvename>
|
|
<cvename>CVE-2011-2458</cvename>
|
|
<cvename>CVE-2011-2459</cvename>
|
|
<cvename>CVE-2011-2460</cvename>
|
|
<url>https://www.adobe.com/support/security/bulletins/apsb11-28.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-11-10</discovery>
|
|
<entry>2011-11-11</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="7be92050-a450-11e2-9898-001060e06fd4">
|
|
<topic>libxml -- Integer overflow</topic>
|
|
<affects>
|
|
<package>
|
|
<name>libxml</name>
|
|
<range><lt>1.8.17_5</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>libxml2</name>
|
|
<range><lt>2.7.8</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Integer overflow in xpath.c, allows context-dependent attackers
|
|
to to cause a denial of service (crash) and possibly execute
|
|
arbitrary code via a crafted XML file that triggers a heap-based
|
|
buffer overflow when adding a new namespace node, related to
|
|
handling of XPath expressions.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2011-1944</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-09-02</discovery>
|
|
<entry>2011-11-10</entry>
|
|
<modified>2011-11-12</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="ce4b3af8-0b7c-11e1-846b-00235409fd3e">
|
|
<topic>libxml -- Multiple use-after-free vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>libxml</name>
|
|
<range><lt>1.8.17_5</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Multiple use-after-free vulnerabilities in libxml 1.8.17 that
|
|
allow context-dependent attackers to cause a denial of service
|
|
(application crash) via crafted (1) Notation or (2) Enumeration
|
|
attribute types in an XML file.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2009-2416</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-08-03</discovery>
|
|
<entry>2011-11-10</entry>
|
|
<modified>2011-11-12</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="5a7d4110-0b7a-11e1-846b-00235409fd3e">
|
|
<topic>libxml -- Stack consumption vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>libxml</name>
|
|
<range><lt>1.8.17_5</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Stack consumption vulnerability allows context-dependent
|
|
attackers to cause a denial of service (application crash) via
|
|
a large depth of element declarations in a DTD.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2009-2414</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-08-03</discovery>
|
|
<entry>2011-11-10</entry>
|
|
<modified>2011-11-12</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="bdec8dc2-0b3b-11e1-b722-001cc0476564">
|
|
<topic>gnutls -- client session resumption vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>gnutls</name>
|
|
<range><lt>2.12.14</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The GnuTLS team reports:</p>
|
|
<blockquote cite="http://www.gnu.org/software/gnutls/security.html">
|
|
<p>GNUTLS-SA-2011-2 Possible buffer overflow/Denial of service.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2011-4128</cvename>
|
|
<url>http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/5596</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-11-08</discovery>
|
|
<entry>2011-11-10</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="6c8ad3e8-0a30-11e1-9580-4061862b8c22">
|
|
<topic>mozilla -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>firefox</name>
|
|
<range><gt>4.0,1</gt><lt>8.0,1</lt></range>
|
|
<range><gt>3.6.*,1</gt><lt>3.6.24,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>libxul</name>
|
|
<range><gt>1.9.2.*</gt><lt>1.9.2.24</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-firefox</name>
|
|
<range><lt>8.0,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-thunderbird</name>
|
|
<range><lt>8.0</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>thunderbird</name>
|
|
<range><gt>4.0</gt><lt>8.0</lt></range>
|
|
<range><lt>3.1.16</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Mozilla Project reports:</p>
|
|
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
|
|
<p>MFSA 2011-46 loadSubScript unwraps XPCNativeWrapper scope
|
|
parameter (1.9.2 branch)</p>
|
|
<p>MFSA 2011-47 Potential XSS against sites using Shift-JIS</p>
|
|
<p>MFSA 2011-48 Miscellaneous memory safety hazards (rv:8.0)</p>
|
|
<p>MFSA 2011-49 Memory corruption while profiling using Firebug</p>
|
|
<p>MFSA 2011-50 Cross-origin data theft using canvas and Windows
|
|
D2D</p>
|
|
<p>MFSA 2011-51 Cross-origin image theft on Mac with integrated
|
|
Intel GPU</p>
|
|
<p>MFSA 2011-52 Code execution via NoWaiverWrapper</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2011-3647</cvename>
|
|
<cvename>CVE-2011-3648</cvename>
|
|
<cvename>CVE-2011-3649</cvename>
|
|
<cvename>CVE-2011-3650</cvename>
|
|
<cvename>CVE-2011-3651</cvename>
|
|
<cvename>CVE-2011-3652</cvename>
|
|
<cvename>CVE-2011-3653</cvename>
|
|
<cvename>CVE-2011-3654</cvename>
|
|
<cvename>CVE-2011-3655</cvename>
|
|
<url>http://www.mozilla.org/security/announce/2011/mfsa2011-46.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2011/mfsa2011-47.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2011/mfsa2011-48.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2011/mfsa2011-49.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2011/mfsa2011-50.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2011/mfsa2011-51.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2011/mfsa2011-52.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-11-08</discovery>
|
|
<entry>2011-11-08</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="9dde9dac-08f4-11e1-af36-003067b2972c">
|
|
<topic>caml-light -- insecure use of temporary files</topic>
|
|
<affects>
|
|
<package>
|
|
<name>caml-light</name>
|
|
<range><le>0.75</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>caml-light uses mktemp() insecurely, and also does
|
|
unsafe things in /tmp during make install.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2011-4119</cvename>
|
|
<mlist msgid="20111106200911.GC13652@netbsd.org">http://seclists.org/oss-sec/2011/q4/249</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-11-02</discovery>
|
|
<entry>2011-11-06</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="54075e39-04ac-11e1-a94e-bcaec565249c">
|
|
<topic>freetype -- Some type 1 fonts handling vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>freetype2</name>
|
|
<range><lt>2.4.7</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The FreeType project reports:</p>
|
|
<blockquote cite="http://sourceforge.net/projects/freetype/files/freetype2/2.4.7/README/view">
|
|
<p>A couple of vulnerabilities in handling Type 1 fonts.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2011-3256</cvename>
|
|
<url>http://sourceforge.net/projects/freetype/files/freetype2/2.4.7/README/view</url>
|
|
<url>https://bugzilla.redhat.com/attachment.cgi?id=528829&action=diff</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-10-12</discovery>
|
|
<entry>2011-11-01</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="f08e2c15-ffc9-11e0-b0f3-bcaec565249c">
|
|
<topic>cacti -- Multiple vulnabilites</topic>
|
|
<affects>
|
|
<package>
|
|
<name>cacti</name>
|
|
<range><lt>0.8.7h</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Cacti Group reports:</p>
|
|
<blockquote cite="http://www.cacti.net/release_notes_0_8_7h.php">
|
|
<p>SQL injection issue with user login, and cross-site scripting
|
|
issues.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://www.cacti.net/release_notes_0_8_7h.php</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-09-26</discovery>
|
|
<entry>2011-10-26</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="395e0faa-ffa7-11e0-8ac4-6c626dd55a41">
|
|
<topic>phpmyfaq -- Remote PHP Code Injection Vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>phpmyfaq</name>
|
|
<range><lt>2.6.19</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The phpMyFAQ project reports:</p>
|
|
<blockquote cite="http://www.phpmyfaq.de/advisory_2011-10-25.php">
|
|
<p>The phpMyFAQ Team has learned of a serious security issue that
|
|
has been discovered in our bundled ImageManager library we use
|
|
in phpMyFAQ 2.6 and 2.7. The bundled ImageManager library
|
|
allows injection of arbitrary PHP code via POST requests.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://www.phpmyfaq.de/advisory_2011-10-25.php</url>
|
|
<url>http://forum.phpmyfaq.de/viewtopic.php?f=3&t=13402</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-10-25</discovery>
|
|
<entry>2011-10-26</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="edf47177-fe3f-11e0-a207-0014a5e3cda6">
|
|
<topic>phpLDAPadmin -- Remote PHP code injection vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>phpldapadmin</name>
|
|
<range><ge>1.2.0</ge><lt>1.2.1.1_1,1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>EgiX (n0b0d13s at gmail dot com) reports:</p>
|
|
<blockquote cite="http://packetstormsecurity.org/files/106120/phpldapadmin-inject.txt">
|
|
<p>The $sortby parameter passed to 'masort' function in file
|
|
lib/functions.php isn't properly sanitized before being used in
|
|
a call to create_function() at line 1080. This can be exploited
|
|
to inject and execute arbitrary PHP code. The only possible
|
|
attack vector is when handling the 'query_engine' command, in
|
|
which input passed through $_REQUEST['orderby'] is passed as
|
|
$sortby parameter to 'masort' function.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://packetstormsecurity.org/files/106120/phpldapadmin-inject.txt</url>
|
|
<url>http://sourceforge.net/tracker/?func=detail&aid=3417184&group_id=61828&atid=498546</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-10-23</discovery>
|
|
<entry>2011-10-24</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="6d21a287-fce0-11e0-a828-00235a5f2c9a">
|
|
<topic>kdelibs4, rekonq -- input validation failure</topic>
|
|
<affects>
|
|
<package>
|
|
<name>kdelibs</name>
|
|
<range><ge>4.0.*</ge><lt>4.7.2</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>rekonq</name>
|
|
<range><lt>0.8.0</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>KDE Security Advisory reports:</p>
|
|
<blockquote cite="http://www.kde.org/info/security/advisory-20111003-1.txt">
|
|
<p>The default rendering type for a QLabel is QLabel::AutoText,
|
|
which uses heuristics to determine whether to render the given
|
|
content as plain text or rich text. KSSL and Rekonq did not
|
|
properly force its QLabels to use QLabel::PlainText. As a result,
|
|
if given a certificate containing rich text in its fields, they
|
|
would render the rich text. Specifically, a certificate
|
|
containing a common name (CN) that has a table element will cause
|
|
the second line of the table to be displayed. This can allow
|
|
spoofing of the certificate's common name.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://www.kde.org/info/security/advisory-20111003-1.txt</url>
|
|
<url>http://www.nth-dimension.org.uk/pub/NDSA20111003.txt.asc</url>
|
|
<cvename>CVE-2011-3365</cvename>
|
|
<cvename>CVE-2011-3366</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-10-03</discovery>
|
|
<entry>2011-10-23</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="411ecb79-f9bc-11e0-a7e6-6c626dd55a41">
|
|
<topic>piwik -- unknown critical vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>piwik</name>
|
|
<range><gt>1.1</gt><lt>1.6</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/46461/">
|
|
<p>Multiple vulnerabilities with an unknown impact have been
|
|
reported in Piwik. The vulnerabilities are caused due to
|
|
unspecified errors. No further information is currently
|
|
available.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://secunia.com/advisories/46461/</url>
|
|
<url>http://piwik.org/blog/2011/10/piwik-1-6/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-10-18</discovery>
|
|
<entry>2011-10-20</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="8441957c-f9b4-11e0-a78a-bcaec565249c">
|
|
<topic>Xorg server -- two vulnerabilities in X server lock handling code</topic>
|
|
<affects>
|
|
<package>
|
|
<name>xorg-server</name>
|
|
<range><lt>1.7.7_3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Matthieu Herrb reports:</p>
|
|
<blockquote cite="http://lists.freedesktop.org/archives/xorg-announce/2011-October/001744.html">
|
|
<p>It is possible to deduce if a file exists or not by exploiting
|
|
the way that Xorg creates its lock files. This is caused by the
|
|
fact that the X server is behaving differently if the lock file
|
|
already exists as a symbolic link pointing to an existing or
|
|
non-existing file.</p>
|
|
<p>It is possible for a non-root user to set the permissions for
|
|
all users on any file or directory to 444, giving unwanted read
|
|
access or causing denies of service (by removing execute
|
|
permission). This is caused by a race between creating the lock
|
|
file and setting its access modes.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2011-4028</cvename>
|
|
<cvename>CVE-2011-4029</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-10-18</discovery>
|
|
<entry>2011-10-18</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="a95092a6-f8f1-11e0-a7ea-00215c6a37bb">
|
|
<topic>asterisk -- remote crash vulnerability in SIP channel driver</topic>
|
|
<affects>
|
|
<package>
|
|
<name>asterisk18</name>
|
|
<range><gt>1.8.*</gt><lt>1.8.7.1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>asterisk</name>
|
|
<range><gt>10.0.0.*</gt><lt>10.0.0.r1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Asterisk project reports:</p>
|
|
<blockquote cite="http://downloads.asterisk.org/pub/security/AST-2011-012.html">
|
|
<p>A remote authenticated user can cause a crash with a malformed
|
|
request due to an unitialized variable.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2011-4063</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-10-17</discovery>
|
|
<entry>2011-10-17</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="e454ca2f-f88d-11e0-b566-00163e01a509">
|
|
<topic>PivotX -- Remote File Inclusion Vulnerability of TimThumb</topic>
|
|
<affects>
|
|
<package>
|
|
<name>pivotx</name>
|
|
<range><lt>2.3.0</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The PivotX team reports:</p>
|
|
<blockquote cite="http://blog.pivotx.net/page/security">
|
|
<p>TimThumb domain name security bypass and insecure cache
|
|
handling. PivotX before 2.3.0 includes a vulnerable version
|
|
of TimThumb.</p>
|
|
</blockquote>
|
|
<blockquote cite="http://blog.pivotx.net/2011-10-14/timthumb-update-for-older-pivotx-installs">
|
|
<p>If you are still running PivotX 2.2.6, you might be vulnerable
|
|
to a security exploit, that was patched previously. Version
|
|
2.3.0 doesn't have this issue, but any older version of PivotX
|
|
might be vulnerable.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>48963</bid>
|
|
<url>https://secunia.com/advisories/45416/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-08-03</discovery>
|
|
<entry>2011-10-17</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="9bad5ab1-f3f6-11e0-8b5c-b482fe3f522d">
|
|
<topic>OpenTTD -- Multiple buffer overflows in validation of external data</topic>
|
|
<affects>
|
|
<package>
|
|
<name>openttd</name>
|
|
<range><ge>0.1.0</ge><lt>1.1.3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The OpenTTD Team reports:</p>
|
|
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3343">
|
|
<p>Multiple buffer overflows in OpenTTD before 1.1.3 allow local
|
|
users to cause a denial of service (daemon crash) or possibly
|
|
gain privileges via (1) a crafted BMP file with RLE compression
|
|
or (2) crafted dimensions in a BMP file.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2011-3343</cvename>
|
|
<url>http://security.openttd.org/en/CVE-2011-3343</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-08-25</discovery>
|
|
<entry>2011-10-16</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="78c25ed7-f3f9-11e0-8b5c-b482fe3f522d">
|
|
<topic>OpenTTD -- Buffer overflows in savegame loading</topic>
|
|
<affects>
|
|
<package>
|
|
<name>openttd</name>
|
|
<range><ge>0.1.0</ge><lt>1.1.3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The OpenTTD Team reports:</p>
|
|
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3342">
|
|
<p>Multiple buffer overflows in OpenTTD before 1.1.3 allow remote
|
|
attackers to cause a denial of service (daemon crash) or possibly
|
|
execute arbitrary code via vectors related to (1) NAME, (2) PLYR,
|
|
(3) CHTS, or (4) AIPL (aka AI config) chunk loading from a
|
|
savegame.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2011-3342</cvename>
|
|
<url>http://security.openttd.org/en/CVE-2011-3342</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-08-08</discovery>
|
|
<entry>2011-10-16</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="e77befb5-f3f9-11e0-8b5c-b482fe3f522d">
|
|
<topic>OpenTTD -- Denial of service via improperly validated commands</topic>
|
|
<affects>
|
|
<package>
|
|
<name>openttd</name>
|
|
<range><ge>0.3.5</ge><lt>1.1.3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The OpenTTD Team reports:</p>
|
|
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3341">
|
|
<p>Multiple off-by-one errors in order_cmd.cpp in OpenTTD before
|
|
1.1.3 allow remote attackers to cause a denial of service (daemon
|
|
crash) or possibly execute arbitrary code via a crafted
|
|
CMD_INSERT_ORDER command.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2011-3341</cvename>
|
|
<url>http://security.openttd.org/en/CVE-2011-3341</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-08-25</discovery>
|
|
<entry>2011-10-16</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="ab9be2c8-ef91-11e0-ad5a-00215c6a37bb">
|
|
<topic>quagga -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>quagga</name>
|
|
<range><lt>0.99.19</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>CERT-FI reports:</p>
|
|
<blockquote cite="https://www.cert.fi/en/reports/2011/vulnerability539178.html">
|
|
<p>Five vulnerabilities have been found in the BGP, OSPF, and
|
|
OSPFv3 components of Quagga. The vulnerabilities allow an
|
|
attacker to cause a denial of service or potentially to
|
|
execute his own code by sending a specially modified packets
|
|
to an affected server. Routing messages are typically accepted
|
|
from the routing peers. Exploiting these vulnerabilities may
|
|
require an established routing session (BGP peering or
|
|
OSPF/OSPFv3 adjacency) to the router.</p>
|
|
<p>The vulnerability <a href="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-3327">CVE-2011-3327</a>
|
|
is related to the extended communities handling in BGP
|
|
messages. Receiving a malformed BGP update can result
|
|
in a buffer overflow and disruption of IPv4 routing.</p>
|
|
<p>The vulnerability <a href="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-3326">CVE-2011-3326</a>
|
|
results from the handling of LSA (Link State Advertisement)
|
|
states in the OSPF service. Receiving a modified Link State
|
|
Update message with malicious state information can result in
|
|
denial of service in IPv4 routing.</p>
|
|
<p>The vulnerability <a href="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-3325">CVE-2011-3325</a>
|
|
is a denial of service vulnerability related to Hello message
|
|
handling by the OSPF service. As Hello messages are used to
|
|
initiate adjacencies, exploiting the vulnerability may be
|
|
feasible from the same broadcast domain without an established
|
|
adjacency. A malformed packet may result in denial of service
|
|
in IPv4 routing.</p>
|
|
<p>The vulnerabilities <a href="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-3324">CVE-2011-3324</a>
|
|
and <a href="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-3323">CVE-2011-3323</a>
|
|
are related to the IPv6 routing protocol (OSPFv3) implemented
|
|
in ospf6d daemon. Receiving modified Database Description and
|
|
Link State Update messages, respectively, can result in denial
|
|
of service in IPv6 routing.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2011-3323</cvename>
|
|
<cvename>CVE-2011-3324</cvename>
|
|
<cvename>CVE-2011-3325</cvename>
|
|
<cvename>CVE-2011-3326</cvename>
|
|
<cvename>CVE-2011-3327</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-09-26</discovery>
|
|
<entry>2011-10-05</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="1fade8a3-e9e8-11e0-9580-4061862b8c22">
|
|
<topic>Mozilla -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>firefox</name>
|
|
<range><gt>4.0,1</gt><lt>7.0,1</lt></range>
|
|
<range><gt>3.6.*,1</gt><lt>3.6.23,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>libxul</name>
|
|
<range><gt>1.9.2.*</gt><lt>1.9.2.23</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-firefox</name>
|
|
<range><lt>7.0,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-seamonkey</name>
|
|
<range><lt>2.4</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-thunderbird</name>
|
|
<range><lt>7.0</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>seamonkey</name>
|
|
<range><lt>2.4</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>thunderbird</name>
|
|
<range><gt>4.0</gt><lt>7.0</lt></range>
|
|
<range><lt>3.1.15</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Mozilla Project reports:</p>
|
|
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
|
|
<p>MFSA 2011-36 Miscellaneous memory safety hazards (rv:7.0 /
|
|
rv:1.9.2.23)</p>
|
|
<p>MFSA 2011-37 Integer underflow when using JavaScript RegExp</p>
|
|
<p>MFSA 2011-38 XSS via plugins and shadowed window.location
|
|
object</p>
|
|
<p>MFSA 2011-39 Defense against multiple Location headers due to
|
|
CRLF Injection</p>
|
|
<p>MFSA 2011-40 Code installation through holding down Enter</p>
|
|
<p>MFSA 2011-41 Potentially exploitable WebGL crashes</p>
|
|
<p>MFSA 2011-42 Potentially exploitable crash in the YARR regular
|
|
expression library</p>
|
|
<p>MFSA 2011-43 loadSubScript unwraps XPCNativeWrapper scope
|
|
parameter</p>
|
|
<p>MFSA 2011-44 Use after free reading OGG headers</p>
|
|
<p>MFSA 2011-45 Inferring Keystrokes from motion data</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2011-2372</cvename>
|
|
<cvename>CVE-2011-2995</cvename>
|
|
<cvename>CVE-2011-2996</cvename>
|
|
<cvename>CVE-2011-2997</cvename>
|
|
<cvename>CVE-2011-2999</cvename>
|
|
<cvename>CVE-2011-3000</cvename>
|
|
<cvename>CVE-2011-3001</cvename>
|
|
<cvename>CVE-2011-3002</cvename>
|
|
<cvename>CVE-2011-3003</cvename>
|
|
<cvename>CVE-2011-3004</cvename>
|
|
<cvename>CVE-2011-3005</cvename>
|
|
<cvename>CVE-2011-3232</cvename>
|
|
<url>http://www.mozilla.org/security/announce/2011/mfsa2011-36.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2011/mfsa2011-37.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2011/mfsa2011-38.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2011/mfsa2011-39.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2011/mfsa2011-40.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2011/mfsa2011-41.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2011/mfsa2011-42.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2011/mfsa2011-43.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2011/mfsa2011-44.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2011/mfsa2011-45.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-09-27</discovery>
|
|
<entry>2011-09-28</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="53e531a7-e559-11e0-b481-001b2134ef46">
|
|
<topic>linux-flashplugin -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>linux-flashplugin</name>
|
|
<range><le>9.0r289</le></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-f10-flashplugin</name>
|
|
<range><lt>10.3r183.10</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Adobe Product Security Incident Response Team reports:</p>
|
|
<blockquote cite="https://www.adobe.com/support/security/bulletins/apsb11-26.html">
|
|
<p>Critical vulnerabilities have been identified in Adobe Flash
|
|
Player 10.3.183.7 and earlier versions for Windows, Macintosh,
|
|
Linux and Solaris, and Adobe Flash Player 10.3.186.6 and earlier
|
|
versions for Android. These vulnerabilities could cause a crash
|
|
and potentially allow an attacker to take control of the
|
|
affected system.</p>
|
|
<p>There are reports that one of these vulnerabilities
|
|
(CVE-2011-2444) is being exploited in the wild in active
|
|
targeted attacks designed to trick the user into clicking on
|
|
a malicious link delivered in an email message. This universal
|
|
cross-site scripting issue could be used to take actions on a
|
|
user's behalf on any website or webmail provider if the user
|
|
visits a malicious website.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>https://www.adobe.com/support/security/bulletins/apsb11-26.html</url>
|
|
<cvename>CVE-2011-2426</cvename>
|
|
<cvename>CVE-2011-2427</cvename>
|
|
<cvename>CVE-2011-2428</cvename>
|
|
<cvename>CVE-2011-2429</cvename>
|
|
<cvename>CVE-2011-2430</cvename>
|
|
<cvename>CVE-2011-2444</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-06-06</discovery>
|
|
<entry>2011-09-22</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="e44fe906-df27-11e0-a333-001cc0a36e12">
|
|
<topic>phpMyAdmin -- multiple XSS vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>phpMyAdmin</name>
|
|
<range><lt>3.4.5</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>phpMyAdmin development team reports:</p>
|
|
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2011-14.php">
|
|
<p>Firstly, if a row contains javascript code, after inline
|
|
editing this row and saving, the code is executed. Secondly,
|
|
missing sanitization on the db, table and column names leads
|
|
to XSS vulnerabilities.</p>
|
|
<p>Versions 3.4.0 to 3.4.4 were found vulnerable.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2011-14.php</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-09-11</discovery>
|
|
<entry>2011-09-14</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="d01d10c7-de2d-11e0-b215-00215c6a37bb">
|
|
<topic>django -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>py23-django</name>
|
|
<name>py24-django</name>
|
|
<name>py25-django</name>
|
|
<name>py26-django</name>
|
|
<name>py27-django</name>
|
|
<name>py30-django</name>
|
|
<name>py31-django</name>
|
|
<range><ge>1.3</ge><lt>1.3.1</lt></range>
|
|
<range><ge>1.2</ge><lt>1.2.7</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>py23-django-devel</name>
|
|
<name>py24-django-devel</name>
|
|
<name>py25-django-devel</name>
|
|
<name>py26-django-devel</name>
|
|
<name>py27-django-devel</name>
|
|
<name>py30-django-devel</name>
|
|
<name>py31-django-devel</name>
|
|
<range><lt>16758,1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Django project reports:</p>
|
|
<blockquote cite="https://www.djangoproject.com/weblog/2011/sep/09/security-releases-issued/">
|
|
<p>Today the Django team is issuing multiple releases --
|
|
Django 1.2.6 and Django 1.3.1 -- to remedy security issues
|
|
reported to us. Additionally, this announcement contains
|
|
advisories for several other issues which, while not
|
|
requiring changes to Django itself, will be of concern
|
|
to users of Django.</p>
|
|
<p>All users are encouraged to upgrade Django, and to implement
|
|
the recommendations in these advisories, immediately.</p>
|
|
<h3>Session manipulation</h3>
|
|
<p>Django's session framework, django.contrib.sessions, is
|
|
configurable to use any of multiple backends for storage of
|
|
session data. One such backend, provided with Django itself,
|
|
integrates with Django's cache framework to use the cache as
|
|
storage for session data.</p>
|
|
<p>When configured in this fashion using memory-based sessions
|
|
and caching, Django sessions are stored directly in the root
|
|
namespace of the cache, using session identifiers as keys.</p>
|
|
<p>This results in a potential attack when coupled with an
|
|
application storing user-supplied data in the cache; if an
|
|
attacker can cause data to be cached using a key which is
|
|
also a valid session identifier, Django's session framework
|
|
will treat that data -- so long as it is a dictionary-like
|
|
object -- as the session, thus allowing arbitrary data to be
|
|
inserted into a session so long as the attacker knows the
|
|
session key.</p>
|
|
<h3>Denial of service attack via URLField</h3>
|
|
<p>Django's model system includes a field type -- URLField --
|
|
which validates that the supplied value is a valid URL, and if
|
|
the boolean keyword argument verify_exists is true, attempts
|
|
to validate that the supplied URL also resolves, by issuing a
|
|
request to it.</p>
|
|
<p>By default, the underlying socket libraries in Python do not
|
|
have a timeout. This can manifest as a security problem in
|
|
three different ways:</p>
|
|
<ol>
|
|
<li>An attacker can supply a slow-to-respond URL. Each request
|
|
will tie up a server process for a period of time; if the
|
|
attacker is able to make enough requests, they can tie up
|
|
all available server processes.</li>
|
|
<li>An attacker can supply a URL under his or her control, and
|
|
which will simply hold an open connection indefinitely. Due
|
|
to the lack of timeout, the Django process attempting to
|
|
verify the URL will similarly spin indefinitely. Repeating
|
|
this can easily tie up all available server processes.</li>
|
|
<li>An attacker can supply a URL under his or her control
|
|
which not only keeps the connection open, but also sends an
|
|
unending stream of random garbage data. This data will
|
|
cause the memory usage of the Django process (which will
|
|
hold the response in memory) to grow without bound, thus
|
|
consuming not only server processes but also server
|
|
memory.</li>
|
|
</ol>
|
|
<h3>URLField redirection</h3>
|
|
<p>The regular expression which validates URLs is used to check
|
|
the supplied URL before issuing a check to verify that it
|
|
exists, but if that URL issues a redirect in response to the
|
|
request, no validation of the resulting redirected URL is
|
|
performed, including basic checks for supported protocols
|
|
(HTTP, HTTPS, and FTP).</p>
|
|
<p>This creates a small window for an attacker to gain knowledge
|
|
of, for example, server layout; a redirect to a file:// URL,
|
|
for example, will tell an attacker whether a given file exists
|
|
locally on the server.</p>
|
|
<p>Additionally, although the initial request issued by Django
|
|
uses the HEAD method for HTTP/HTTPS, the request to the target
|
|
of the redirect is issued using GET. This may create further
|
|
issues for systems which implicitly trust GET requests from
|
|
the local machine/network.</p>
|
|
<h3>Host header cache poisoning</h3>
|
|
<p>In several places, Django itself -- independent of the
|
|
developer -- generates full URLs (for example, when issuing
|
|
HTTP redirects). Currently this uses the value of the HTTP
|
|
Host header from the request to construct the URL, which opens
|
|
a potential cache-poisoning vector: an attacker can submit
|
|
a request with a Host header of his or her choice, receive a
|
|
response which constructs URLs using that Host header, and --
|
|
if that response is cached -- further requests will be served
|
|
out of cache using URLs containing the attacker's host of
|
|
choice.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>https://www.djangoproject.com/weblog/2011/sep/09/security-releases-issued/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-09-09</discovery>
|
|
<entry>2011-09-13</entry>
|
|
<modified>2011-11-01</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="4ae68e7c-dda4-11e0-a906-00215c6a37bb">
|
|
<topic>roundcube -- XSS vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>roundcube</name>
|
|
<range><lt>0.5.4,1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>RoundCube development Team reports:</p>
|
|
<blockquote cite="http://sourceforge.net/news/?group_id=139281&id=302769">
|
|
<p>We just published a new release which fixes a recently
|
|
reported XSS vulnerability as an update to the stable 0.5
|
|
branch. Please update your installations with this new
|
|
version or patch them with the fix which is also published
|
|
in the downloads section or our sourceforge.net page.</p>
|
|
</blockquote>
|
|
<p>and:</p>
|
|
<blockquote cite="http://trac.roundcube.net/ticket/1488030">
|
|
<p>During one of pen-tests I found that _mbox parameter is not
|
|
properly sanitized and reflected XSS attack is possible.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2011-2937</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-08-09</discovery>
|
|
<entry>2011-09-13</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="b9f3ffa3-dd6c-11e0-b7fc-000a5e1e33c6">
|
|
<topic>libsndfile -- PAF file processing integer overflow</topic>
|
|
<affects>
|
|
<package>
|
|
<name>libsndfile</name>
|
|
<range><lt>1.0.25</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/45125/">
|
|
<p>Hossein Lotfi has discovered a vulnerability in libsndfile,
|
|
which can be exploited by malicious people to potentially
|
|
compromise an application using the library. The vulnerability
|
|
is caused due to an integer overflow error in the "paf24_init()"
|
|
function (src/paf.c) when processing Paris Audio (PAF) files.
|
|
This can be exploited to cause a heap-based buffer overflow via
|
|
a specially crafted file. Successful exploitation may allow
|
|
execution of arbitrary code. The vulnerability is confirmed in
|
|
version 1.0.24. Other versions may also be affected.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2011-2696</cvename>
|
|
<url>http://secunia.com/advisories/45125/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-07-12</discovery>
|
|
<entry>2011-09-12</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="2ecb7b20-d97e-11e0-b2e2-00215c6a37bb">
|
|
<topic>OpenSSL -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>openssl</name>
|
|
<range><ge>1.0.0</ge><lt>1.0.0_6</lt></range>
|
|
<range><ge>0.9.8</ge><lt>1.0.0</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>OpenSSL Team reports:</p>
|
|
<blockquote cite="http://openssl.org/news/secadv_20110906.txt">
|
|
<p>Two security flaws have been fixed in OpenSSL 1.0.0e</p>
|
|
<p>Under certain circumstances OpenSSL's internal certificate
|
|
verification routines can incorrectly accept a CRL whose
|
|
nextUpdate field is in the past. (CVE-2011-3207)</p>
|
|
<p>OpenSSL server code for ephemeral ECDH ciphersuites is not
|
|
thread-safe, and furthermore can crash if a client violates
|
|
the protocol by sending handshake messages in incorrect
|
|
order. (CVE-2011-3210)</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2011-3207</cvename>
|
|
<cvename>CVE-2011-3210</cvename>
|
|
<url>http://www.openssl.org/news/secadv_20110906.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-09-06</discovery>
|
|
<entry>2011-09-07</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="a83f25df-d775-11e0-8bf1-003067b2972c">
|
|
<topic>XSS issue in MantisBT</topic>
|
|
<affects>
|
|
<package>
|
|
<name>mantis</name>
|
|
<range><ge>1.2.0</ge><lt>1.2.7</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<blockquote cite="http://www.mantisbt.org/blog/?p=142">
|
|
<p>Net.Edit0r from BlACK Hat Group reported an XSS issue in
|
|
search.php. All MantisBT users (including anonymous users that
|
|
are not logged in to public bug trackers) could be impacted by
|
|
this vulnerability.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<freebsdpr>ports/160368</freebsdpr>
|
|
<cvename>CVE-2011-2938</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-08-18</discovery>
|
|
<entry>2011-09-05</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="e55f948f-d729-11e0-abd1-0017f22d6707">
|
|
<topic>security/cfs -- buffer overflow</topic>
|
|
<affects>
|
|
<package>
|
|
<name>cfs</name>
|
|
<range><le>1.4.1_6</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Debian reports:</p>
|
|
<blockquote cite="http://www.debian.org/security/2002/dsa-116">
|
|
<p>Zorgon found several buffer overflows in cfsd, a daemon that
|
|
pushes encryption services into the Unix(tm) file system.
|
|
We are not yet sure if these overflows can successfully be
|
|
exploited to gain root access to the machine running the CFS
|
|
daemon. However, since cfsd can easily be forced to die, a
|
|
malicious user can easily perform a denial of service attack
|
|
to it.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2002-0351</cvename>
|
|
<url>http://www.debian.org/security/2002/dsa-116</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2002-03-02</discovery>
|
|
<entry>2011-09-04</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="1b27af46-d6f6-11e0-89a6-080027ef73ec">
|
|
<topic>ca_root_nss -- extraction of explicitly-untrusted certificates into trust bundle</topic>
|
|
<affects>
|
|
<package>
|
|
<name>ca_root_nss</name>
|
|
<range><lt>3.12.11</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Matthias Andree reports that the ca-bundle.pl used in older
|
|
versions of the ca_root_nss FreeBSD port before 3.12.11 did not
|
|
take the Mozilla/NSS/CKBI untrusted markers into account and
|
|
would add certificates to the trust bundle that were marked
|
|
unsafe by Mozilla.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<freebsdpr>ports/160455</freebsdpr>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-09-04</discovery>
|
|
<entry>2011-09-04</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="aa5bc971-d635-11e0-b3cf-080027ef73ec">
|
|
<topic>nss/ca_root_nss -- fraudulent certificates issued by DigiNotar.nl</topic>
|
|
<affects>
|
|
<package>
|
|
<name>nss</name>
|
|
<range><lt>3.12.11</lt></range>
|
|
<!-- this builds on the assumption that 3.12.11 in ports actually
|
|
contains the CKBI 1.87 update to the built-in certificates
|
|
as commited by kwm@ on September 3rd, 2011 -->
|
|
</package>
|
|
<package>
|
|
<name>ca_root_nss</name>
|
|
<range><lt>3.12.11</lt></range>
|
|
<!-- this builds on the assumption that 3.12.11 in ports actually
|
|
contains the CKBI 1.87 update to the built-in certificates
|
|
as commited by mandree@ on September 4th, 2011 -->
|
|
</package>
|
|
<package>
|
|
<name>firefox</name>
|
|
<range><gt>3.6.*,1</gt><lt>3.6.22,1</lt></range>
|
|
<range><gt>4.0.*,1</gt><lt>6.0.2,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>seamonkey</name>
|
|
<range><lt>2.3.2</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-firefox</name>
|
|
<range><lt>3.6.22,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>thunderbird</name>
|
|
<range><gt>3.1.*</gt><lt>3.1.14</lt></range>
|
|
<range><gt>5.0.*</gt><lt>6.0.2</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-thunderbird</name>
|
|
<range><lt>3.1.14</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-seamonkey</name>
|
|
<range><lt>2.3.2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Heather Adkins, Google's Information Security Manager, reported that
|
|
Google received</p>
|
|
<blockquote cite="http://googleonlinesecurity.blogspot.com/2011/08/update-on-attempted-man-in-middle.html">
|
|
<p>[...] reports of attempted SSL man-in-the-middle (MITM)
|
|
attacks against Google users, whereby someone tried to get between
|
|
them and encrypted Google services. The people affected were
|
|
primarily located in Iran. The attacker used a fraudulent SSL
|
|
certificate issued by DigiNotar, a root certificate authority that
|
|
should not issue certificates for Google (and has since revoked
|
|
it). [...]</p>
|
|
</blockquote>
|
|
<p>VASCO Data Security International Inc., owner of DigiNotar, issued a
|
|
press statement confirming this incident:</p>
|
|
<blockquote cite="http://www.vasco.com/company/press_room/news_archive/2011/news_diginotar_reports_security_incident.aspx">
|
|
<p>On July 19th 2011, DigiNotar detected an intrusion
|
|
into its Certificate Authority (CA) infrastructure, which resulted
|
|
in the fraudulent issuance of public key certificate requests for
|
|
a number of domains, including Google.com. [...] an external
|
|
security audit concluded that all fraudulently issued certificates
|
|
were
|
|
revoked. Recently, it was discovered that at least one fraudulent
|
|
certificate had not been revoked at the time. [...]</p>
|
|
</blockquote>
|
|
<p>Mozilla, maintainer of the NSS package, from which FreeBSD derived
|
|
ca_root_nss, stated that they:</p>
|
|
<blockquote cite="https://blog.mozilla.com/security/2011/09/02/diginotar-removal-follow-up/">
|
|
<p>revoked our trust in the DigiNotar certificate authority from
|
|
all Mozilla software. This is not a temporary suspension, it is
|
|
a complete removal from our trusted root program. Complete
|
|
revocation of trust is a decision we treat with careful
|
|
consideration, and employ as a last resort.
|
|
</p><p>Three central issues informed our decision:</p>
|
|
<ol><li>Failure to notify. [...]</li>
|
|
<li>The scope of the breach remains unknown. [...]</li>
|
|
<li>The attack is not theoretical.</li></ol>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://www.vasco.com/company/press_room/news_archive/2011/news_diginotar_reports_security_incident.aspx</url>
|
|
<url>http://www.mozilla.org/security/announce/2011/mfsa2011-34.html</url>
|
|
<url>http://googleonlinesecurity.blogspot.com/2011/08/update-on-attempted-man-in-middle.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-07-19</discovery>
|
|
<entry>2011-09-03</entry>
|
|
<modified>2011-09-06</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="7f6108d2-cea8-11e0-9d58-0800279895ea">
|
|
<topic>apache -- Range header DoS vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>apache</name>
|
|
<name>apache-event</name>
|
|
<name>apache-itk</name>
|
|
<name>apache-peruser</name>
|
|
<name>apache-worker</name>
|
|
<range><gt>2.*</gt><lt>2.2.20</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Apache HTTP server project reports:</p>
|
|
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3192">
|
|
<p>A denial of service vulnerability has been found in the way
|
|
the multiple overlapping ranges are handled by Apache HTTPD
|
|
server.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2011-3192</cvename>
|
|
<url>https://people.apache.org/~dirkx/CVE-2011-3192.txt</url>
|
|
<url>https://svn.apache.org/viewvc?view=revision&revision=1161534</url>
|
|
<url>https://svn.apache.org/viewvc?view=revision&revision=1162874</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-08-24</discovery>
|
|
<entry>2011-08-30</entry>
|
|
<modified>2011-09-01</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="cdeb34e6-d00d-11e0-987e-00215c6a37bb">
|
|
<topic>stunnel -- heap corruption vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>stunnel</name>
|
|
<range><ge>4.40</ge><lt>4.42</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Michal Trojnara reports:</p>
|
|
<blockquote cite="http://www.stunnel.org/pipermail/stunnel-announce/2011-August/000059.html">
|
|
<p>Version 4.42, 2011.08.18, urgency: HIGH:</p>
|
|
<p>Fixed a heap corruption vulnerability in versions 4.40 and 4.41.
|
|
It may possibly be leveraged to perform DoS or remote code
|
|
execution attacks.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>49254</bid>
|
|
<cvename>CVE-2011-2940</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-08-25</discovery>
|
|
<entry>2011-08-26</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="75e26236-ce9e-11e0-b26a-00215c6a37bb">
|
|
<topic>phpMyAdmin -- multiple XSS vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>phpMyAdmin</name>
|
|
<range><lt>3.4.4</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The phpMyAdmin development team reports:</p>
|
|
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2011-13.php">
|
|
<p>Multiple XSS in the Tracking feature.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2011-3181</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-08-24</discovery>
|
|
<entry>2011-08-24</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="3f1df2f9-cd22-11e0-9bb2-00215c6a37bb">
|
|
<topic>PHP -- crypt() returns only the salt for MD5</topic>
|
|
<affects>
|
|
<package>
|
|
<name>php5</name>
|
|
<range><ge>5.3.7</ge><lt>5.3.7_2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>PHP development team reports:</p>
|
|
<blockquote cite="https://bugs.php.net/bug.php?id=55439">
|
|
<p>If crypt() is executed with MD5 salts, the return value
|
|
consists of the salt only. DES and BLOWFISH salts work as
|
|
expected.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>https://bugs.php.net/bug.php?id=55439</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-08-17</discovery>
|
|
<entry>2011-08-23</entry>
|
|
<modified>2011-08-30</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="057bf770-cac4-11e0-aea3-00215c6a37bb">
|
|
<topic>php -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>php5</name>
|
|
<name>php5-sockets</name>
|
|
<range><lt>5.3.7</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>PHP development team reports:</p>
|
|
<blockquote cite="http://www.php.net/ChangeLog-5.php#5.3.7">
|
|
<p>Security Enhancements and Fixes in PHP 5.3.7:</p>
|
|
<ul>
|
|
<li>Updated crypt_blowfish to 1.2. (CVE-2011-2483)</li>
|
|
<li>Fixed crash in error_log(). Reported by Mateusz
|
|
Kocielski</li>
|
|
<li>Fixed buffer overflow on overlog salt in crypt().</li>
|
|
<li>Fixed bug #54939 (File path injection vulnerability
|
|
in RFC1867 File upload filename). Reported by Krzysztof
|
|
Kotowicz. (CVE-2011-2202)</li>
|
|
<li>Fixed stack buffer overflow in socket_connect().
|
|
(CVE-2011-1938)</li>
|
|
<li>Fixed bug #54238 (use-after-free in substr_replace()).
|
|
(CVE-2011-1148)</li>
|
|
</ul>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>49241</bid>
|
|
<cvename>CVE-2011-2483</cvename>
|
|
<cvename>CVE-2011-2202</cvename>
|
|
<cvename>CVE-2011-1938</cvename>
|
|
<cvename>CVE-2011-1148</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-08-18</discovery>
|
|
<entry>2011-08-20</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="be77eff6-ca91-11e0-aea3-00215c6a37bb">
|
|
<topic>rubygem-rails -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>rubygem-rails</name>
|
|
<range><lt>3.0.10</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>SecurityFocus reports:</p>
|
|
<blockquote cite="http://www.securityfocus.com/bid/49179/discuss">
|
|
<p>Ruby on Rails is prone to multiple vulnerabilities
|
|
including SQL-injection, information-disclosure,
|
|
HTTP-header-injection, security-bypass and cross-site
|
|
scripting issues.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>49179</bid>
|
|
<url>http://groups.google.com/group/rubyonrails-security/browse_thread/thread/6a1e473744bc389b</url>
|
|
<url>http://groups.google.com/group/rubyonrails-security/browse_thread/thread/3420ac71aed312d6</url>
|
|
<url>http://groups.google.com/group/rubyonrails-security/browse_thread/thread/6ffc93bde0298768</url>
|
|
<url>http://groups.google.com/group/rubyonrails-security/browse_thread/thread/2b9130749b74ea12</url>
|
|
<url>http://groups.google.com/group/rubyonrails-security/browse_thread/thread/56bffb5923ab1195</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-08-16</discovery>
|
|
<entry>2011-08-19</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="0b53f5f7-ca8a-11e0-aea3-00215c6a37bb">
|
|
<topic>dovecot -- denial of service vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>dovecot</name>
|
|
<range><lt>1.2.17</lt></range>
|
|
<range><gt>2.0</gt><lt>2.0.13</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Timo Sirainen reports:</p>
|
|
<blockquote cite="http://dovecot.org/pipermail/dovecot/2011-May/059086.html">
|
|
<p> Fixed potential crashes and other problems when parsing header
|
|
names that contained NUL characters.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>47930</bid>
|
|
<cvename>CVE-2011-1929</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-05-25</discovery>
|
|
<entry>2011-08-19</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="86baa0d4-c997-11e0-8a8e-00151735203a">
|
|
<topic>OTRS -- Vulnerabilities in OTRS-Core allows read access to any file on local file system</topic>
|
|
<affects>
|
|
<package>
|
|
<name>otrs</name>
|
|
<range><gt>2.1.*</gt><lt>3.0.10</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>OTRS Security Advisory reports:</p>
|
|
<blockquote cite="http://otrs.org/advisory/OSA-2011-03-en/">
|
|
<ul>
|
|
<li>An attacker with valid session and admin permissions could
|
|
get read access to any file on the servers local operating
|
|
system. For this it would be needed minimum one installed
|
|
OTRS package.</li>
|
|
</ul>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2011-2746</cvename>
|
|
<url>http://otrs.org/advisory/OSA-2011-03-en/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-08-16</discovery>
|
|
<entry>2011-08-18</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="834591a9-c82f-11e0-897d-6c626dd55a41">
|
|
<topic>mozilla -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>firefox</name>
|
|
<range><gt>3.6.*,1</gt><lt>3.6.20,1</lt></range>
|
|
<range><gt>5.0.*,1</gt><lt>6.0,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>seamonkey</name>
|
|
<range><lt>2.3</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-firefox</name>
|
|
<range><lt>3.6.20,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>thunderbird</name>
|
|
<range><lt>3.1.12</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-thunderbird</name>
|
|
<range><lt>3.1.12</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Mozilla Project reports:</p>
|
|
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
|
|
<p>MFSA 2011-29 Security issues addressed in Firefox 6</p>
|
|
<p>MFSA 2011-28 Security issues addressed in Firefox 3.6.20</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://www.mozilla.org/security/announce/2011/mfsa2011-29.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2011/mfsa2011-30.html</url>
|
|
<cvename>CVE-2011-2982</cvename>
|
|
<cvename>CVE-2011-0084</cvename>
|
|
<cvename>CVE-2011-2981</cvename>
|
|
<cvename>CVE-2011-2378</cvename>
|
|
<cvename>CVE-2011-2984</cvename>
|
|
<cvename>CVE-2011-2980</cvename>
|
|
<cvename>CVE-2011-2983</cvename>
|
|
<cvename>CVE-2011-2989</cvename>
|
|
<cvename>CVE-2011-2991</cvename>
|
|
<cvename>CVE-2011-2992</cvename>
|
|
<cvename>CVE-2011-2985</cvename>
|
|
<cvename>CVE-2011-2993</cvename>
|
|
<cvename>CVE-2011-2988</cvename>
|
|
<cvename>CVE-2011-2987</cvename>
|
|
<cvename>CVE-2011-0084</cvename>
|
|
<cvename>CVE-2011-2990</cvename>
|
|
<cvename>CVE-2011-2986</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-08-16</discovery>
|
|
<entry>2011-08-16</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="56f4b3a6-c82c-11e0-a498-00215c6a37bb">
|
|
<topic>Samba -- cross site scripting and request forgery vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>samba34</name>
|
|
<range><gt>3.4.*</gt><lt>3.4.14</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>samba35</name>
|
|
<range><gt>3.5.*</gt><lt>3.5.10</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Samba security advisory reports:</p>
|
|
<blockquote cite="http://www.samba.org/samba/security/CVE-2011-2522">
|
|
<p>All current released versions of Samba are vulnerable to a
|
|
cross-site request forgery in the Samba Web Administration Tool
|
|
(SWAT). By tricking a user who is authenticated with SWAT into
|
|
clicking a manipulated URL on a different web page, it is
|
|
possible to manipulate SWAT.</p>
|
|
</blockquote>
|
|
<blockquote cite="http://www.samba.org/samba/security/CVE-2011-2694">
|
|
<p>All current released versions of Samba are vulnerable to a
|
|
cross-site scripting issue in the Samba Web Administration Tool
|
|
(SWAT). On the "Change Password" field, it is possible to insert
|
|
arbitrary content into the "user" field.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>48901</bid>
|
|
<bid>48899</bid>
|
|
<cvename>CVE-2011-2522</cvename>
|
|
<cvename>CVE-2011-2694</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-07-27</discovery>
|
|
<entry>2011-08-16</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="510b630e-c43b-11e0-916c-00e0815b8da8">
|
|
<topic>isc-dhcp-server -- server halt upon processing certain packets</topic>
|
|
<affects>
|
|
<package>
|
|
<name>isc-dhcp31-server</name>
|
|
<range><lt>3.1.ESV_1,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>isc-dhcp41-server</name>
|
|
<range><lt>4.1.e_2,2</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>isc-dhcp42-server</name>
|
|
<range><lt>4.2.2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>ISC reports:</p>
|
|
<blockquote cite="http://www.isc.org/software/dhcp/advisories/cve-2011-2748">
|
|
<p>A pair of defects cause the server to halt upon processing
|
|
certain packets. The patch is to properly discard or process
|
|
those packets.
|
|
</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2011-2748</cvename>
|
|
<cvename>CVE-2011-2749</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-08-10</discovery>
|
|
<entry>2011-08-13</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="dc8741b9-c5d5-11e0-8a8e-00151735203a">
|
|
<topic>bugzilla -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>bugzilla</name>
|
|
<range><ge>2.4.*</ge><lt>3.6.6</lt></range>
|
|
<range><ge>4.0.*</ge><lt>4.0.2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A Bugzilla Security Advisory reports:</p>
|
|
<blockquote cite="http://www.bugzilla.org/security/3.4.11/">
|
|
<p>The following security issues have been discovered in Bugzilla:</p>
|
|
<ul>
|
|
<li>Internet Explorer 8 and older, and Safari before 5.0.6 do
|
|
content sniffing when viewing a patch in "Raw Unified" mode,
|
|
which could trigger a cross-site scripting attack due to
|
|
the execution of malicious code in the attachment.</li>
|
|
<li>It is possible to determine whether or not certain group
|
|
names exist while creating or updating bugs.</li>
|
|
<li>Attachment descriptions with a newline in them could lead
|
|
to the injection of crafted headers in email notifications sent
|
|
to the requestee or the requester when editing an attachment
|
|
flag.</li>
|
|
<li>If an attacker has access to a user's session, he can modify
|
|
that user's email address without that user being notified
|
|
of the change.</li>
|
|
<li>Temporary files for uploaded attachments are not deleted
|
|
on Windows, which could let a user with local access to
|
|
the server read them.</li>
|
|
<li>Up to Bugzilla 3.4.11, if a BUGLIST cookie is compromised,
|
|
it can be used to inject HTML code when viewing a bug report,
|
|
leading to a cross-site scripting attack.</li>
|
|
</ul>
|
|
<p>All affected installations are encouraged to upgrade as soon as
|
|
possible.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2011-2379</cvename>
|
|
<cvename>CVE-2011-2380</cvename>
|
|
<cvename>CVE-2011-2979</cvename>
|
|
<cvename>CVE-2011-2381</cvename>
|
|
<cvename>CVE-2011-2978</cvename>
|
|
<cvename>CVE-2011-2977</cvename>
|
|
<cvename>CVE-2011-2976</cvename>
|
|
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=637981</url>
|
|
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=653477</url>
|
|
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=674497</url>
|
|
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=657158</url>
|
|
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=670868</url>
|
|
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=660502</url>
|
|
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=660053</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-08-04</discovery>
|
|
<entry>2011-08-13</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="879b0242-c5b6-11e0-abd1-0017f22d6707">
|
|
<topic>dtc -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>dtc</name>
|
|
<range><lt>0.32.9</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Ansgar Burchardt reports:</p>
|
|
<blockquote cite="http://www.debian.org/security/2011/dsa-2179">
|
|
<p>Ansgar Burchardt discovered several vulnerabilities in DTC, a
|
|
web control panel for admin and accounting hosting services:
|
|
The bw_per_moth.php graph contains an SQL injection
|
|
vulnerability; insufficient checks in bw_per_month.php can lead
|
|
to bandwidth usage information disclosure; after a registration,
|
|
passwords are sent in cleartext email messages and Authenticated
|
|
users could delete accounts using an obsolete interface which
|
|
was incorrectly included in the package.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2011-0434</cvename>
|
|
<cvename>CVE-2011-0435</cvename>
|
|
<cvename>CVE-2011-0436</cvename>
|
|
<cvename>CVE-2011-0437</cvename>
|
|
<url>http://www.debian.org/security/2011/dsa-2179</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-03-02</discovery>
|
|
<entry>2011-08-13</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="304409c3-c3ef-11e0-8aa5-485d60cb5385">
|
|
<topic>libXfont -- possible local privilege escalation</topic>
|
|
<affects>
|
|
<package>
|
|
<name>libXfont</name>
|
|
<range><lt>1.4.4_1,1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Tomas Hoger reports:</p>
|
|
<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=725760">
|
|
<p>The compress/ LZW decompress implentation does not correctly
|
|
handle compressed streams that contain code words that were not
|
|
yet added to the decompression table. This may lead to
|
|
arbitrary memory corruption. Successfull exploitation may
|
|
possible lead to a local privilege escalation.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2011-2895</cvename>
|
|
<url>https://bugzilla.redhat.com/show_bug.cgi?id=725760</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-07-26</discovery>
|
|
<entry>2011-08-11</entry>
|
|
<modified>2012-03-13</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="5d374b01-c3ee-11e0-8aa5-485d60cb5385">
|
|
<topic>freetype2 -- execute arbitrary code or cause denial of service</topic>
|
|
<affects>
|
|
<package>
|
|
<name>freetype2</name>
|
|
<range><lt>2.4.6</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Vincent Danen reports:</p>
|
|
<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-0226">
|
|
<p>Due to an error within the t1_decoder_parse_charstrings()
|
|
function (src/psaux/t1decode.c) and can be exploited to corrupt
|
|
memory by tricking a user into processing a specially-crafted
|
|
postscript Type1 font in an application that uses the freetype
|
|
library.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2011-0226</cvename>
|
|
<url>https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-0226</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-07-19</discovery>
|
|
<entry>2011-08-11</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="2c12ae0c-c38d-11e0-8eb7-001b2134ef46">
|
|
<topic>linux-flashplugin -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>linux-flashplugin</name>
|
|
<range><le>9.0r289</le></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-f10-flashplugin</name>
|
|
<range><lt>10.3r183.5</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Adobe Product Security Incident Response Team reports:</p>
|
|
<blockquote cite="https://www.adobe.com/support/security/bulletins/apsb11-21.html">
|
|
<p>Critical vulnerabilities have been identified in Adobe Flash
|
|
Player 10.3.181.36 and earlier versions for Windows, Macintosh,
|
|
Linux and Solaris, and Adobe Flash Player 10.3.185.25 and
|
|
earlier versions for Android. These vulnerabilities could
|
|
cause a crash and potentially allow an attacker to take control
|
|
of the affected system.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2011-2130</cvename>
|
|
<cvename>CVE-2011-2134</cvename>
|
|
<cvename>CVE-2011-2135</cvename>
|
|
<cvename>CVE-2011-2136</cvename>
|
|
<cvename>CVE-2011-2137</cvename>
|
|
<cvename>CVE-2011-2138</cvename>
|
|
<cvename>CVE-2011-2139</cvename>
|
|
<cvename>CVE-2011-2140</cvename>
|
|
<cvename>CVE-2011-2414</cvename>
|
|
<cvename>CVE-2011-2415</cvename>
|
|
<cvename>CVE-2011-2416</cvename>
|
|
<cvename>CVE-2011-2417</cvename>
|
|
<cvename>CVE-2011-2425</cvename>
|
|
<url>https://www.adobe.com/support/security/bulletins/apsb11-21.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-05-13</discovery>
|
|
<entry>2011-08-10</entry>
|
|
<modified>2012-11-05</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="30cb4522-b94d-11e0-8182-485d60cb5385">
|
|
<topic>libsoup -- unintentionally allow access to entire local filesystem</topic>
|
|
<affects>
|
|
<package>
|
|
<name>libsoup</name>
|
|
<range><lt>2.32.2_3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Dan Winship reports:</p>
|
|
<blockquote cite="http://mail.gnome.org/archives/ftp-release-list/2011-July/msg00176.html">
|
|
<p>Fixed a security hole that caused some SoupServer users to
|
|
unintentionally allow accessing the entire local filesystem when
|
|
they thought they were only providing access to a single
|
|
directory.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2011-2054</cvename>
|
|
<url>http://mail.gnome.org/archives/ftp-release-list/2011-July/msg00176.html</url>
|
|
<url>https://bugzilla.gnome.org/show_bug.cgi?id=653258</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-06-23</discovery>
|
|
<entry>2011-07-28</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="d79fc873-b5f9-11e0-89b4-001ec9578670">
|
|
<topic>phpmyadmin -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>phpMyAdmin</name>
|
|
<range><lt>3.4.3.2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The phpMyAdmin development team reports:</p>
|
|
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2011-9.php">
|
|
<p>XSS in table Print view.</p>
|
|
</blockquote>
|
|
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2011-10.php">
|
|
<p>Via a crafted MIME-type transformation parameter, an attacker can
|
|
perform a local file inclusion.</p>
|
|
</blockquote>
|
|
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2011-11.php">
|
|
<p>In the 'relational schema' code a parameter was not sanitized before
|
|
being used to concatenate a class name.</p>
|
|
<p>The end result is a local file inclusion vulnerability and code
|
|
execution.</p>
|
|
</blockquote>
|
|
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2011-12.php">
|
|
<p>It was possible to manipulate the PHP session superglobal using
|
|
some of the Swekey authentication code.</p>
|
|
<p>This is very similar to PMASA-2011-5, documented in
|
|
7e4e5c53-a56c-11e0-b180-00216aa06fc2</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2011-2642</cvename>
|
|
<cvename>CVE-2011-2643</cvename>
|
|
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2011-9.php</url>
|
|
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2011-10.php</url>
|
|
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2011-11.php</url>
|
|
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2011-12.php</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-07-23</discovery>
|
|
<entry>2011-07-24</entry>
|
|
<modified>2011-07-28</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="9f14cb36-b6fc-11e0-a044-445c73746d79">
|
|
<topic>opensaml2 -- unauthenticated login</topic>
|
|
<affects>
|
|
<package>
|
|
<name>opensaml2</name>
|
|
<range><gt>0</gt><lt>2.4.3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>OpenSAML developer reports:</p>
|
|
<blockquote cite="http://shibboleth.internet2.edu/secadv/secadv_20110725.txt">
|
|
<p>The Shibboleth software relies on the OpenSAML libraries to
|
|
perform verification of signed XML messages such as attribute
|
|
queries or SAML assertions. Both the Java and C++ versions are
|
|
vulnerable to a so-called "wrapping attack" that allows a remote,
|
|
unauthenticated attacker to craft specially formed messages that
|
|
can be successfully verified, but contain arbitrary content.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2011-1411</cvename>
|
|
<mlist msgid="CA530061.113D6%cantor.2@osu.edu">https://groups.google.com/a/shibboleth.net/group/announce/browse_thread/thread/cf3e0d76afbb57d9</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-07-25</discovery>
|
|
<entry>2011-07-25</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="9a777c23-b310-11e0-832d-00215c6a37bb">
|
|
<topic>rsync -- incremental recursion memory corruption vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>rsync</name>
|
|
<range><gt>3.0</gt><lt>3.0.8</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>rsync development team reports:</p>
|
|
<blockquote cite="http://rsync.samba.org/ftp/rsync/src/rsync-3.0.8-NEWS">
|
|
<p>Fixed a data-corruption issue when preserving hard-links
|
|
without preserving file ownership, and doing deletions either
|
|
before or during the transfer (CVE-2011-1097). This
|
|
fixes some assert errors in the hard-linking code, and some
|
|
potential failed checksums (via -c) that should have matched.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2011-1097</cvename>
|
|
<url>https://bugzilla.samba.org/show_bug.cgi?id=7936</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-04-08</discovery>
|
|
<entry>2011-07-20</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="fd64188d-a71d-11e0-89b4-001ec9578670">
|
|
<topic>BIND -- Remote DoS against authoritative and recursive servers</topic>
|
|
<affects>
|
|
<package>
|
|
<name>bind96</name>
|
|
<range><lt>9.6.3.1.ESV.R4.3</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>bind97</name>
|
|
<range><lt>9.7.3.3</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>bind98</name>
|
|
<range><lt>9.8.0.4</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>ISC reports:</p>
|
|
<blockquote cite="https://www.isc.org/software/bind/advisories/cve-2011-2464">
|
|
<p>A defect in the affected BIND 9 versions allows an attacker to
|
|
remotely cause the "named" process to exit using a specially
|
|
crafted packet.</p>
|
|
<p>This defect affects both recursive and authoritative servers.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2011-2464</cvename>
|
|
<url>https://www.isc.org/software/bind/advisories/cve-2011-2464</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-07-05</discovery>
|
|
<entry>2011-07-05</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="4ccee784-a721-11e0-89b4-001ec9578670">
|
|
<topic>BIND -- Remote DoS with certain RPZ configurations</topic>
|
|
<affects>
|
|
<package>
|
|
<name>bind98</name>
|
|
<range><lt>9.8.0.4</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>ISC reports:</p>
|
|
<blockquote cite="https://www.isc.org/software/bind/advisories/cve-2011-2465">
|
|
<p>Two defects were discovered in ISC's BIND 9.8 code. These
|
|
defects only affect BIND 9.8 servers which have recursion
|
|
enabled and which use a specific feature of the software known
|
|
as Response Policy Zones (RPZ) and where the RPZ zone contains
|
|
a specific rule/action pattern.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2011-2465</cvename>
|
|
<url>https://www.isc.org/software/bind/advisories/cve-2011-2465</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-07-05</discovery>
|
|
<entry>2011-07-05</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="7e4e5c53-a56c-11e0-b180-00216aa06fc2">
|
|
<topic>phpmyadmin -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>phpMyAdmin</name>
|
|
<range><lt>3.4.3.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The phpMyAdmin development team reports:</p>
|
|
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2011-5.php">
|
|
<p>It was possible to manipulate the PHP session superglobal using
|
|
some of the Swekey authentication code. This could open a path
|
|
for other attacks.</p>
|
|
</blockquote>
|
|
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2011-6.php">
|
|
<p>An unsanitized key from the Servers array is written in a comment
|
|
of the generated config. An attacker can modify this key by
|
|
modifying the SESSION superglobal array. This allows the attacker
|
|
to close the comment and inject code.</p>
|
|
</blockquote>
|
|
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2011-7.php">
|
|
<p>Through a possible bug in PHP running on Windows systems a NULL
|
|
byte can truncate the pattern string allowing an attacker to
|
|
inject the /e modifier causing the preg_replace function to
|
|
execute its second argument as PHP code.</p>
|
|
</blockquote>
|
|
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2011-8.php">
|
|
<p>Fixed filtering of a file path in the MIME-type transformation
|
|
code, which allowed for directory traversal.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2011-2505</cvename>
|
|
<cvename>CVE-2011-2506</cvename>
|
|
<cvename>CVE-2011-2507</cvename>
|
|
<cvename>CVE-2011-2508</cvename>
|
|
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2011-5.php</url>
|
|
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2011-6.php</url>
|
|
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2011-7.php</url>
|
|
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2011-8.php</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-07-02</discovery>
|
|
<entry>2011-07-03</entry>
|
|
<modified>2011-07-28</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="40544e8c-9f7b-11e0-9bec-6c626dd55a41">
|
|
<topic>Asterisk -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>asterisk14</name>
|
|
<range><gt>1.4.*</gt><lt>1.4.41.2</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>asterisk16</name>
|
|
<range><gt>1.6.*</gt><lt>1.6.2.18.2</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>asterisk18</name>
|
|
<range><gt>1.8.*</gt><lt>1.8.4.4</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Asterisk Development Team reports:</p>
|
|
<blockquote cite="http://www.asterisk.org/node/51650">
|
|
<p>AST-2011-008: If a remote user sends a SIP packet containing a
|
|
NULL, Asterisk assumes available data extends past the null to
|
|
the end of the packet when the buffer is actually truncated when
|
|
copied. This causes SIP header parsing to modify data past the
|
|
end of the buffer altering unrelated memory structures. This
|
|
vulnerability does not affect TCP/TLS connections.</p>
|
|
<p>AST-2011-009: A remote user sending a SIP packet containing a
|
|
Contact header with a missing left angle bracket causes Asterisk
|
|
to access a null pointer.</p>
|
|
<p>AST-2011-010: A memory address was inadvertently transmitted
|
|
over the network via IAX2 via an option control frame and the
|
|
remote party would try to access it.</p>
|
|
<p>Possible enumeration of SIP users due to differing
|
|
authentication responses.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2011-2529</cvename>
|
|
<cvename>CVE-2011-2535</cvename>
|
|
<cvename>CVE-2011-2536</cvename>
|
|
<url>http://downloads.asterisk.org/pub/security/AST-2011-008.html</url>
|
|
<url>http://downloads.asterisk.org/pub/security/AST-2011-009.html</url>
|
|
<url>http://downloads.asterisk.org/pub/security/AST-2011-010.html</url>
|
|
<url>http://downloads.asterisk.org/pub/security/AST-2011-011.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-06-24</discovery>
|
|
<entry>2011-06-25</entry>
|
|
<modified>2011-06-29</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="01d3ab7d-9c43-11e0-bc0f-0014a5e3cda6">
|
|
<topic>ejabberd -- remote denial of service vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>ejabberd</name>
|
|
<range><lt>2.1.7</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>It's reported in CVE advisory that:</p>
|
|
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1753">
|
|
<p>expat_erl.c in ejabberd before 2.1.7 and 3.x before
|
|
3.0.0-alpha-3, and exmpp before 0.9.7, does not properly detect
|
|
recursion during entity expansion, which allows remote attackers
|
|
to cause a denial of service (memory and CPU consumption) via a
|
|
crafted XML document containing a large number of nested entity
|
|
references, a similar issue to CVE-2003-1564.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2011-1753</cvename>
|
|
<url>http://www.ejabberd.im/ejabberd-2.1.7</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-04-27</discovery>
|
|
<entry>2011-06-24</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="dfe40cff-9c3f-11e0-9bec-6c626dd55a41">
|
|
<topic>mozilla -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>firefox</name>
|
|
<range><gt>3.5.*,1</gt><lt>3.5.20,1</lt></range>
|
|
<range><gt>3.6.*,1</gt><lt>3.6.18,1</lt></range>
|
|
<range><gt>4.0.*,1</gt><lt>5.0,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-firefox</name>
|
|
<range><lt>3.6.18,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>thunderbird</name>
|
|
<range><lt>3.1.11</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-thunderbird</name>
|
|
<range><lt>3.1.11</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Mozilla Project reports:</p>
|
|
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
|
|
<p>MFSA 2011-19 Miscellaneous memory safety hazards
|
|
(rv:3.0/1.9.2.18)</p>
|
|
<p>MFSA 2011-20 Use-after-free vulnerability when viewing XUL
|
|
document with script disabled</p>
|
|
<p>MFSA 2011-21 Memory corruption due to multipart/x-mixed-replace
|
|
images</p>
|
|
<p>MFSA 2011-22 Integer overflow and arbitrary code execution in
|
|
Array.reduceRight()</p>
|
|
<p>MFSA 2011-23 Multiple dangling pointer vulnerabilities</p>
|
|
<p>MFSA 2011-24 Cookie isolation error</p>
|
|
<p>MFSA 2011-25 Stealing of cross-domain images using WebGL
|
|
textures</p>
|
|
<p>MFSA 2011-26 Multiple WebGL crashes</p>
|
|
<p>MFSA 2011-27 XSS encoding hazard with inline SVG</p>
|
|
<p>MFSA 2011-28 Non-whitelisted site can trigger xpinstall</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://www.mozilla.org/security/announce/2011/mfsa2011-19.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2011/mfsa2011-20.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2011/mfsa2011-21.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2011/mfsa2011-22.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2011/mfsa2011-23.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2011/mfsa2011-24.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2011/mfsa2011-25.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2011/mfsa2011-26.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2011/mfsa2011-27.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2011/mfsa2011-28.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-06-21</discovery>
|
|
<entry>2011-06-21</entry>
|
|
<modified>2011-06-23</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="bfdbc7ec-9c3f-11e0-9bec-6c626dd55a41">
|
|
<topic>Samba -- Denial of service - memory corruption</topic>
|
|
<affects>
|
|
<package>
|
|
<name>samba34</name>
|
|
<range><gt>3.4.*</gt><lt>3.4.12</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>samba35</name>
|
|
<range><gt>3.5.*</gt><lt>3.5.7</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Samba team reports:</p>
|
|
<blockquote cite="http://www.samba.org/samba/security/CVE-2011-0719.html">
|
|
<p>Samba is vulnerable to a denial of service, caused by a memory
|
|
corruption error related to missing range checks on file
|
|
descriptors being used in the "FD_SET" macro. By performing a
|
|
select on a bad file descriptor set, a remote attacker could
|
|
exploit this vulnerability to cause the application to crash or
|
|
possibly execute arbitrary code on the system.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2011-0719</cvename>
|
|
<url>http://www.samba.org/samba/security/CVE-2011-0719.html</url>
|
|
<url>http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0719</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-02-28</discovery>
|
|
<entry>2011-06-21</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="23c8423e-9bff-11e0-8ea2-0019d18c446a">
|
|
<topic>Piwik -- remote command execution vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>piwik</name>
|
|
<range><ge>1.2</ge><lt>1.5</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Piwik security advisory reports:</p>
|
|
<blockquote cite="http://piwik.org/blog/2011/06/piwik-1-5-security-advisory/">
|
|
<p>The Piwik 1.5 release addresses a critical security
|
|
vulnerability, which affect all Piwik users that have let
|
|
granted some access to the "anonymous" user.</p>
|
|
<p>Piwik contains a remotely exploitable vulnerability that could
|
|
allow a remote attacker to execute arbitrary code. Only
|
|
installations that have granted untrusted view access to their
|
|
stats (ie. grant "view" access to a website to anonymous) are
|
|
at risk.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<freebsdpr>ports/158084</freebsdpr>
|
|
<url>http://piwik.org/blog/2011/06/piwik-1-5-security-advisory/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-06-21</discovery>
|
|
<entry>2011-06-21</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="0b535cd0-9b90-11e0-800a-00215c6a37bb">
|
|
<topic>Dokuwiki -- cross site scripting vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>dokuwiki</name>
|
|
<range><lt>20110525a</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Dokuwiki reports:</p>
|
|
<blockquote cite="http://www.freelists.org/post/dokuwiki/Hotfix-Release-20110525a-Rincewind">
|
|
<p>We just released a Hotfix Release "2011-05-25a Rincewind".
|
|
It contains the following changes:</p>
|
|
<p>Security fix for a Cross Site Scripting vulnerability.
|
|
Malicious users could abuse DokuWiki's RSS embedding mechanism
|
|
to create links containing arbitrary JavaScript. Note: this
|
|
security problem is present in at least Anteater and Rincewind
|
|
but probably in older releases as well.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://www.freelists.org/post/dokuwiki/Hotfix-Release-20110525a-Rincewind</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-06-14</discovery>
|
|
<entry>2011-06-20</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="55a528e8-9787-11e0-b24a-001b2134ef46">
|
|
<topic>linux-flashplugin -- remote code execution vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>linux-flashplugin</name>
|
|
<range><le>9.0r289</le></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-f10-flashplugin</name>
|
|
<range><lt>10.3r181.26</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Adobe Product Security Incident Response Team reports:</p>
|
|
<blockquote cite="http://www.adobe.com/support/security/bulletins/apsb11-18.html">
|
|
<p>A critical vulnerability has been identified in Adobe Flash
|
|
Player 10.3.181.23 and earlier versions for Windows, Macintosh,
|
|
Linux and Solaris, and Adobe Flash Player 10.3.185.23 and
|
|
earlier versions for Android. This memory corruption
|
|
vulnerability (CVE-2011-2110) could cause a crash and
|
|
potentially allow an attacker to take control of the affected
|
|
system. There are reports that this vulnerability is being
|
|
exploited in the wild in targeted attacks via malicious Web
|
|
pages.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2011-2110</cvename>
|
|
<url>http://www.adobe.com/support/security/bulletins/apsb11-18.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-05-13</discovery>
|
|
<entry>2011-06-15</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="3145faf1-974c-11e0-869e-000c29249b2e">
|
|
<topic>ikiwiki -- tty hijacking via ikiwiki-mass-rebuild</topic>
|
|
<affects>
|
|
<package>
|
|
<name>ikiwiki</name>
|
|
<range><lt>3.20110608</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The IkiWiki development team reports:</p>
|
|
<blockquote cite="http://ikiwiki.info/security/#index40h2">
|
|
<p>Ludwig Nussel discovered a way for users to hijack root's tty
|
|
when ikiwiki-mass-rebuild was run. Additionally, there was
|
|
some potential for information disclosure via symlinks.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2011-1408</cvename>
|
|
<url>http://ikiwiki.info/security/#index40h2</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-06-08</discovery>
|
|
<entry>2011-06-15</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="57573136-920e-11e0-bdc9-001b2134ef46">
|
|
<topic>linux-flashplugin -- cross-site scripting vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>linux-flashplugin</name>
|
|
<range><le>9.0r289</le></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-f10-flashplugin</name>
|
|
<range><lt>10.3r181.22</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Adobe Product Security Incident Response Team reports:</p>
|
|
<blockquote cite="http://www.adobe.com/support/security/bulletins/apsb11-13.html">
|
|
<p>An important vulnerability has been identified in Adobe
|
|
Flash Player 10.3.181.16 and earlier versions for Windows,
|
|
Macintosh, Linux and Solaris, and Adobe Flash Player
|
|
10.3.185.22 and earlier versions for Android. This universal
|
|
cross-site scripting vulnerability (CVE-2011-2107) could be
|
|
used to take actions on a user's behalf on any website or
|
|
webmail provider, if the user visits a malicious website.
|
|
There are reports that this vulnerability is being exploited
|
|
in the wild in active targeted attacks designed to trick
|
|
the user into clicking on a malicious link delivered in an
|
|
email message.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2011-2107</cvename>
|
|
<url>http://www.adobe.com/support/security/bulletins/apsb11-13.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-05-13</discovery>
|
|
<entry>2011-06-08</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="1e1421f0-8d6f-11e0-89b4-001ec9578670">
|
|
<topic>BIND -- Large RRSIG RRsets and Negative Caching DoS</topic>
|
|
<affects>
|
|
<package>
|
|
<name>bind9-sdb-ldap</name>
|
|
<name>bind9-sdb-postgresql</name>
|
|
<range><lt>9.4.3.4</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>bind96</name>
|
|
<range><lt>9.6.3.1.ESV.R4.1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>bind97</name>
|
|
<range><lt>9.7.3.1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>bind98</name>
|
|
<range><lt>9.8.0.2</lt></range>
|
|
</package>
|
|
<system>
|
|
<name>FreeBSD</name>
|
|
<range><gt>7.3</gt><lt>7.3_6</lt></range>
|
|
<range><gt>7.4</gt><lt>7.4_2</lt></range>
|
|
<range><gt>8.1</gt><lt>8.1_4</lt></range>
|
|
<range><gt>8.2</gt><lt>8.2_2</lt></range>
|
|
</system>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>ISC reports:</p>
|
|
<blockquote cite="http://www.isc.org/software/bind/advisories/cve-2011-1910">
|
|
<p>A BIND 9 DNS server set up to be a caching resolver is
|
|
vulnerable to a user querying a domain with very large resource
|
|
record sets (RRSets) when trying to negatively cache a response.
|
|
This can cause the BIND 9 DNS server (named process) to crash.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2011-1910</cvename>
|
|
<freebsdsa>SA-11:02.bind</freebsdsa>
|
|
<url>http://www.isc.org/software/bind/advisories/cve-2011-1910</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-05-26</discovery>
|
|
<entry>2011-06-04</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="f7d838f2-9039-11e0-a051-080027ef73ec">
|
|
<topic>fetchmail -- STARTTLS denial of service</topic>
|
|
<affects>
|
|
<package>
|
|
<name>fetchmail</name>
|
|
<range><lt>6.3.20</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Matthias Andree reports:</p>
|
|
<blockquote cite="http://www.fetchmail.info/fetchmail-SA-2011-01.txt">
|
|
<p>Fetchmail version 5.9.9 introduced STLS support for POP3,
|
|
version 6.0.0 added STARTTLS for IMAP. However, the actual
|
|
S(TART)TLS-initiated in-band SSL/TLS negotiation was not guarded
|
|
by a timeout.</p>
|
|
<p>Depending on the operating system defaults as to TCP stream
|
|
keepalive mode, fetchmail hangs in excess of one week after
|
|
sending STARTTLS were observed if the connection failed without
|
|
notifying the operating system, for instance, through network
|
|
outages or hard server crashes.</p>
|
|
<p>A malicious server that does not respond, at the network level,
|
|
after acknowledging fetchmail's STARTTLS or STLS request, can
|
|
hold fetchmail in this protocol state, and thus render fetchmail
|
|
unable to complete the poll, or proceed to the next server,
|
|
effecting a denial of service.</p>
|
|
<p>SSL-wrapped mode on dedicated ports was unaffected by this
|
|
problem, so can be used as a workaround.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2011-1947</cvename>
|
|
<url>http://www.fetchmail.info/fetchmail-SA-2011-01.txt</url>
|
|
<url>https://gitorious.org/fetchmail/fetchmail/commit/7dc67b8cf06f74aa57525279940e180c99701314</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-04-28</discovery>
|
|
<entry>2011-06-06</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="34ce5817-8d56-11e0-b5a2-6c626dd55a41">
|
|
<topic>asterisk -- Remote crash vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>asterisk18</name>
|
|
<range><gt>1.8.*</gt><lt>1.8.4.2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Asterisk Development Team reports:</p>
|
|
<blockquote cite="http://lists.digium.com/pipermail/asterisk-announce/2011-June/000325.html">
|
|
<p>If a remote user initiates a SIP call and the recipient picks
|
|
up, the remote user can reply with a malformed Contact header
|
|
that Asterisk will improperly handle and cause a crash due to a
|
|
segmentation fault.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2011-2216</cvename>
|
|
<url>http://downloads.asterisk.org/pub/security/AST-2011-007.pdf</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-06-02</discovery>
|
|
<entry>2011-06-02</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="e27a1af3-8d21-11e0-a45d-001e8c75030d">
|
|
<topic>Subversion -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>subversion</name>
|
|
<range><lt>1.6.17</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>subversion-freebsd</name>
|
|
<range><lt>1.6.17</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Subversion team reports:</p>
|
|
<blockquote cite="http://subversion.apache.org/security/CVE-2011-1752-advisory.txt">
|
|
<p>Subversion's mod_dav_svn Apache HTTPD server module will
|
|
dereference a NULL pointer if asked to deliver baselined WebDAV
|
|
resources.</p>
|
|
<p>This can lead to a DoS. An exploit has been tested, and tools
|
|
or users have been observed triggering this problem in the
|
|
wild.</p>
|
|
</blockquote>
|
|
<blockquote cite="http://subversion.apache.org/security/CVE-2011-1783-advisory.txt">
|
|
<p>Subversion's mod_dav_svn Apache HTTPD server module may in
|
|
certain scenarios enter a logic loop which does not exit and
|
|
which allocates memory in each iteration, ultimately exhausting
|
|
all the available memory on the server.</p>
|
|
<p>This can lead to a DoS. There are no known instances of this
|
|
problem being observed in the wild, but an exploit has been
|
|
tested.</p>
|
|
</blockquote>
|
|
<blockquote cite="http://subversion.apache.org/security/CVE-2011-1921-advisory.txt">
|
|
<p>Subversion's mod_dav_svn Apache HTTPD server module may leak to
|
|
remote users the file contents of files configured to be
|
|
unreadable by those users.</p>
|
|
<p>There are no known instances of this problem being observed in
|
|
the wild, but an exploit has been tested.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2011-1752</cvename>
|
|
<cvename>CVE-2011-1783</cvename>
|
|
<cvename>CVE-2011-1921</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-05-28</discovery>
|
|
<entry>2011-06-02</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="1acf9ec5-877d-11e0-b937-001372fd0af2">
|
|
<topic>drupal6 -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>drupal6</name>
|
|
<range><lt>6.22</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Drupal Team reports:</p>
|
|
<blockquote cite="http://drupal.org/node/1168756">
|
|
<p>A reflected cross site scripting vulnerability was discovered
|
|
in Drupal's error handler. Drupal displays PHP errors in the
|
|
messages area, and a specially crafted URL can cause malicious
|
|
scripts to be injected into the message. The issue can be
|
|
mitigated by disabling on-screen error display at admin /
|
|
settings / error-reporting. This is the recommended setting
|
|
for production sites.</p>
|
|
<p>When using re-colorable themes, color inputs are not sanitized.
|
|
Malicious color values can be used to insert arbitrary CSS and
|
|
script code. Successful exploitation requires the "Administer
|
|
themes" permission.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://drupal.org/node/1168756</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-05-25</discovery>
|
|
<entry>2011-05-26</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="e4833927-86e5-11e0-a6b4-000a5e1e33c6">
|
|
<topic>Erlang -- ssh library uses a weak random number generator</topic>
|
|
<affects>
|
|
<package>
|
|
<name>erlang</name>
|
|
<range><lt>r14b03</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>US-CERT reports:</p>
|
|
<blockquote cite="http://www.kb.cert.org/vuls/id/178990">
|
|
<p>The Erlang/OTP ssh library implements a number of
|
|
cryptographic operations that depend on cryptographically
|
|
strong random numbers. Unfortunately the RNG used by the
|
|
library is not cryptographically strong, and is further
|
|
weakened by the use of predictable seed material. The RNG
|
|
(Wichman-Hill) is not mixed with an entropy source.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2011-0766</cvename>
|
|
<url>http://www.erlang.org/download/otp_src_R14B03.readme</url>
|
|
<url>https://github.com/erlang/otp/commit/f228601de45c5b53241b103af6616453c50885a5</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-05-25</discovery>
|
|
<entry>2011-05-25</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="dc96ac1f-86b1-11e0-9e85-00215af774f0">
|
|
<topic>Unbound -- an empty error packet handling assertion failure</topic>
|
|
<affects>
|
|
<package>
|
|
<name>unbound</name>
|
|
<range><lt>1.4.10</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Unbound developer reports:</p>
|
|
<blockquote cite="http://unbound.nlnetlabs.nl/downloads/CVE-2011-1922.txt">
|
|
<p>NLnet Labs was notified of an error in Unbound's code-path
|
|
for error replies which is triggered under special conditions.
|
|
The error causes the program to abort.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2011-1922</cvename>
|
|
<url>http://unbound.nlnetlabs.nl/downloads/CVE-2011-1922.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-05-25</discovery>
|
|
<entry>2011-05-25</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="115a1389-858e-11e0-a76c-000743057ca2">
|
|
<topic>Pubcookie Login Server -- XSS vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>pubcookie-login-server</name>
|
|
<range><lt>3.3.2d</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Nathan Dors, Pubcookie Project reports:</p>
|
|
<blockquote cite="http://pubcookie.org/news/20070606-login-secadv.html">
|
|
<p>A new non-persistent XSS vulnerability was found in the
|
|
Pubcookie login server's compiled binary "index.cgi" CGI
|
|
program. The CGI program mishandles untrusted data when
|
|
printing responses to the browser. This makes the program
|
|
vulnerable to carefully crafted requests containing script
|
|
or HTML. If an attacker can lure an unsuspecting user to
|
|
visit carefully staged content, the attacker can use it to
|
|
redirect the user to his or her local Pubcookie login page
|
|
and attempt to exploit the XSS vulnerability.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://pubcookie.org/news/20070606-login-secadv.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-05-25</discovery>
|
|
<entry>2011-05-23</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="1ca8228f-858d-11e0-a76c-000743057ca2">
|
|
<topic>mod_pubcookie -- Empty Authentication Security Advisory</topic>
|
|
<affects>
|
|
<package>
|
|
<name>ap20-mod_pubcookie</name>
|
|
<range><ge>3.1.0</ge><lt>3.3.2b</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Nathan Dors, Pubcookie Project reports:</p>
|
|
<blockquote cite="http://pubcookie.org/news/20061106-empty-auth-secadv.html">
|
|
<p>An Abuse of Functionality vulnerability in the Pubcookie
|
|
authentication process was found. This vulnerability allows an
|
|
attacker to appear as if he or she were authenticated using an
|
|
empty userid when such a userid isn't expected. Unauthorized
|
|
access to web content and applications may result where access
|
|
is restricted to users who can authenticate successfully but
|
|
where no additional authorization is performed after
|
|
authentication.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://pubcookie.org/news/20061106-empty-auth-secadv.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-10-04</discovery>
|
|
<entry>2011-05-23</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="7af2fb85-8584-11e0-96b7-00300582f9fc">
|
|
<topic>ViewVC -- user-reachable override of cvsdb row limit</topic>
|
|
<affects>
|
|
<package>
|
|
<name>viewvc</name>
|
|
<range><lt>1.1.11</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>ViewVC.org reports:</p>
|
|
<blockquote cite="http://viewvc.tigris.org/source/browse/viewvc/trunk/CHANGES?r1=2536&r2=2574">
|
|
<p>Security fix: remove user-reachable override of cvsdb row limit.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://viewvc.tigris.org/source/browse/*checkout*/viewvc/branches/1.1.x/CHANGES</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-05-17</discovery>
|
|
<entry>2011-05-23</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="99a5590c-857e-11e0-96b7-00300582f9fc">
|
|
<topic>Apache APR -- DoS vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>apr1</name>
|
|
<range><lt>1.4.5.1.3.12</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Apache Portable Runtime Project reports:</p>
|
|
<blockquote cite="http://www.apache.org/dist/apr/CHANGES-APR-1.4">
|
|
<p>A flaw was discovered in the apr_fnmatch() function in the
|
|
Apache Portable Runtime (APR) library 1.4.4 (or any backported
|
|
versions that contained the upstream fix for CVE-2011-0419).
|
|
This could cause httpd workers to enter a hung state (100% CPU
|
|
utilization).</p>
|
|
<p>apr-util 1.3.11 could cause crashes with httpd's
|
|
mod_authnz_ldap in some situations.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>47929</bid>
|
|
<cvename>CVE-2011-1928</cvename>
|
|
<cvename>CVE-2011-0419</cvename>
|
|
<url>http://www.apache.org/dist/apr/Announcement1.x.html</url>
|
|
<url>https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-1928</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-05-19</discovery>
|
|
<entry>2011-05-23</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="d226626c-857f-11e0-95cc-001b2134ef46">
|
|
<topic>linux-flashplugin -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>linux-flashplugin</name>
|
|
<range><le>9.0r289</le></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-f10-flashplugin</name>
|
|
<range><lt>10.3r181.14</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Adobe Product Security Incident Response Team reports:</p>
|
|
<blockquote cite="http://www.adobe.com/support/security/bulletins/apsb11-12.html">
|
|
<p>Critical vulnerabilities have been identified in Adobe Flash
|
|
Player 10.2.159.1 and earlier versions (Adobe Flash Player
|
|
10.2.154.28 and earlier for Chrome users) for Windows,
|
|
Macintosh, Linux and Solaris, and Adobe Flash Player 10.2.157.51
|
|
and earlier versions for Android. These vulnerabilities could
|
|
cause the application to crash and could potentially allow an
|
|
attacker to take control of the affected system. There are
|
|
reports of malware attempting to exploit one of the
|
|
vulnerabilities, CVE-2011-0627, in the wild via a Flash (.swf)
|
|
file embedded in a Microsoft Word (.doc) or Microsoft Excel
|
|
(.xls) file delivered as an email attachment targeting the
|
|
Windows platform. However, to date, Adobe has not obtained a
|
|
sample that successfully completes an attack.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2011-0579</cvename>
|
|
<cvename>CVE-2011-0618</cvename>
|
|
<cvename>CVE-2011-0619</cvename>
|
|
<cvename>CVE-2011-0620</cvename>
|
|
<cvename>CVE-2011-0621</cvename>
|
|
<cvename>CVE-2011-0622</cvename>
|
|
<cvename>CVE-2011-0623</cvename>
|
|
<cvename>CVE-2011-0624</cvename>
|
|
<cvename>CVE-2011-0625</cvename>
|
|
<cvename>CVE-2011-0626</cvename>
|
|
<cvename>CVE-2011-0627</cvename>
|
|
<url>http://www.adobe.com/support/security/bulletins/apsb11-12.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-01-20</discovery>
|
|
<entry>2011-05-23</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="e666498a-852a-11e0-8f78-080027ef73ec">
|
|
<topic>Opera -- code injection vulnerability through broken frameset handling</topic>
|
|
<affects>
|
|
<package><name>opera</name><range><lt>11.11</lt></range></package>
|
|
<package><name>opera-devel</name><range><lt>11.11</lt></range></package>
|
|
<package><name>linux-opera</name><range><lt>11.11</lt></range></package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Opera Software ASA reports:</p>
|
|
<blockquote cite="http://www.opera.com/docs/changelogs/unix/1111/">
|
|
<p>Fixed an issue with framesets that could allow execution of
|
|
arbitrary code, as reported by an anonymous contributor working
|
|
with the SecuriTeam Secure Disclosure program.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://www.opera.com/docs/changelogs/unix/1111/</url>
|
|
<url>http://www.opera.com/support/kb/view/992/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-05-18</discovery>
|
|
<entry>2011-05-23</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="1495f931-8522-11e0-a1c1-00215c6a37bb">
|
|
<topic>pureftpd -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>pure-ftpd</name>
|
|
<range><lt>1.0.32</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Pure-FTPd development team reports:</p>
|
|
<blockquote cite="http://www.pureftpd.org/project/pure-ftpd/news">
|
|
<p>Support for braces expansion in directory listings has been
|
|
disabled -- Cf. CVE-2011-0418.</p>
|
|
<p>Fix a STARTTLS flaw similar to Postfix's CVE-2011-0411.
|
|
If you're using TLS, upgrading is recommended.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>46767</bid>
|
|
<cvename>CVE-2011-0418</cvename>
|
|
<cvename>CVE-2011-1575</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-04-01</discovery>
|
|
<entry>2011-05-23</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="36594c54-7be7-11e0-9838-0022156e8794">
|
|
<topic>Exim -- remote code execution and information disclosure</topic>
|
|
<affects>
|
|
<package>
|
|
<name>exim</name>
|
|
<range><ge>4.70</ge><lt>4.76</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Release notes for Exim 4.76 says:</p>
|
|
<blockquote cite="ftp://ftp.exim.org/pub/exim/ChangeLogs/ChangeLog-4.76">
|
|
<p>Bugzilla 1106: CVE-2011-1764 - DKIM log line was subject to
|
|
a format-string attack -- SECURITY: remote arbitrary code
|
|
execution.</p>
|
|
<p>DKIM signature header parsing was double-expanded, second
|
|
time unintentionally subject to list matching rules, letting
|
|
the header cause arbitrary Exim lookups (of items which can
|
|
occur in lists, *not* arbitrary string expansion). This
|
|
allowed for information disclosure.</p>
|
|
</blockquote>
|
|
<p>Also, impact assessment was redone shortly after the original
|
|
announcement:</p>
|
|
<blockquote cite="https://lists.exim.org/lurker/message/20110512.102909.8136175a.en.html">
|
|
<p>Further analysis revealed that the second security was
|
|
more severe than I realised at the time that I wrote the
|
|
announcement. The second security issue has been assigned
|
|
CVE-2011-1407 and is also a remote code execution flaw.
|
|
For clarity: both issues were introduced with 4.70.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2011-1764</cvename>
|
|
<cvename>CVE-2011-1407</cvename>
|
|
<mlist msgid="20110512102909.GA58484@redoubt.spodhuis.org">https://lists.exim.org/lurker/message/20110512.102909.8136175a.en.html</mlist>
|
|
<url>http://bugs.exim.org/show_bug.cgi?id=1106</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-05-10</discovery>
|
|
<entry>2011-05-14</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="00b296b6-7db1-11e0-96b7-00300582f9fc">
|
|
<topic>Apache APR -- DoS vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>apr1</name>
|
|
<range><lt>1.4.4.1.3.11</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Apache Portable Runtime Project reports:</p>
|
|
<blockquote cite="http://www.apache.org/dist/apr/CHANGES-APR-1.4">
|
|
<p>Note especially a security fix to APR 1.4.4, excessive CPU
|
|
consumption was possible due to an unconstrained, recursive
|
|
invocation of apr_fnmatch, as apr_fnmatch processed '*' wildcards.
|
|
Reimplement apr_fnmatch() from scratch using a non-recursive
|
|
algorithm now has improved compliance with the fnmatch() spec.
|
|
(William Rowe)</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2011-0419</cvename>
|
|
<url>http://www.apache.org/dist/apr/Announcement1.x.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-05-10</discovery>
|
|
<entry>2011-05-12</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="34e8ccf5-7d71-11e0-9d83-000c29cc39d3">
|
|
<topic>Zend Framework -- potential SQL injection when using PDO_MySql</topic>
|
|
<affects>
|
|
<package>
|
|
<name>ZendFramework</name>
|
|
<range><lt>1.11.6</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Zend Framework team reports:</p>
|
|
<blockquote cite="http://framework.zend.com/security/advisory/ZF2011-02">
|
|
<p>Developers using non-ASCII-compatible encodings in conjunction
|
|
with the MySQL PDO driver of PHP may be vulnerable to SQL
|
|
injection attacks. Developers using ASCII-compatible encodings
|
|
like UTF8 or latin1 are not affected by this PHP issue.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://framework.zend.com/security/advisory/ZF2011-02</url>
|
|
<url>http://zend-framework-community.634137.n4.nabble.com/Zend-Framework-1-11-6-and-1-10-9-released-td3503741.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-05-06</discovery>
|
|
<entry>2011-05-13</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="3fadb7c6-7b0a-11e0-89b4-001ec9578670">
|
|
<topic>mediawiki -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>mediawiki</name>
|
|
<range><lt>1.16.5</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Mediawiki reports:</p>
|
|
<blockquote cite="http://lists.wikimedia.org/pipermail/mediawiki-announce/2011-May/000098.html">
|
|
<p>(Bug 28534) XSS vulnerability for IE 6 clients. This is the
|
|
third attempt at fixing bug 28235.</p>
|
|
<p>(Bug 28639) Potential privilege escalation when
|
|
$wgBlockDisablesLogin is enabled.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>https://bugzilla.wikimedia.org/show_bug.cgi?id=28534</url>
|
|
<url>https://bugzilla.wikimedia.org/show_bug.cgi?id=28639</url>
|
|
<url>http://lists.wikimedia.org/pipermail/mediawiki-announce/2011-May/000098.html</url>
|
|
<url>http://svn.wikimedia.org/svnroot/mediawiki/tags/REL1_16_5/phase3/RELEASE-NOTES</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-04-14</discovery>
|
|
<entry>2011-05-12</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="3eb2c100-738b-11e0-89f4-001e90d46635">
|
|
<topic>Postfix -- memory corruption vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>postfix</name>
|
|
<name>postfix-base</name>
|
|
<range><ge>2.8.*,1</ge><lt>2.8.3,1</lt></range>
|
|
<range><ge>2.7.*,1</ge><lt>2.7.4,1</lt></range>
|
|
<range><ge>2.6.*,1</ge><lt>2.6.10,1</lt></range>
|
|
<range><ge>2.5.*,2</ge><lt>2.5.13,2</lt></range>
|
|
<range><le>2.4.16,1</le></range>
|
|
</package>
|
|
<package>
|
|
<name>postfix-current</name>
|
|
<name>postfix-current-base</name>
|
|
<range><lt>2.9.20110501,4</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Postfix SMTP server has a memory corruption error, when the
|
|
Cyrus SASL library is used with authentication mechanisms other
|
|
than PLAIN and LOGIN (ANONYMOUS is not affected, but should not
|
|
be used for other reasons). This memory corruption is known to
|
|
result in a program crash (SIGSEV).</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2011-1720</cvename>
|
|
<url>http://www.postfix.org/CVE-2011-1720.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-05-09</discovery>
|
|
<entry>2011-05-09</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="04b7d46c-7226-11e0-813a-6c626dd55a41">
|
|
<topic>Mozilla -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>firefox</name>
|
|
<range><gt>3.6.*,1</gt><lt>3.6.17,1</lt></range>
|
|
<range><gt>3.5.*,1</gt><lt>3.5.19,1</lt></range>
|
|
<range><gt>4.0.*,1</gt><lt>4.0.1,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>libxul</name>
|
|
<range><gt>1.9.2.*</gt><lt>1.9.2.17</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-firefox</name>
|
|
<range><lt>3.6.17,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-firefox-devel</name>
|
|
<range><lt>3.5.19</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-seamonkey</name>
|
|
<range><gt>2.0.*</gt><lt>2.0.14</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>seamonkey</name>
|
|
<range><gt>2.0.*</gt><lt>2.0.14</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Mozilla Project reports:</p>
|
|
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
|
|
<p>MFSA 2011-12 Miscellaneous memory safety hazards</p>
|
|
<p>MFSA 2011-13 Multiple dangling pointer vulnerabilities</p>
|
|
<p>MFSA 2011-14 Information stealing via form history</p>
|
|
<p>MFSA 2011-15 Escalation of privilege through Java Embedding Plugin</p>
|
|
<p>MFSA 2011-16 Directory traversal in resource: protocol</p>
|
|
<p>MFSA 2011-17 WebGLES vulnerabilities</p>
|
|
<p>MFSA 2011-18 XSLT generate-id() function heap address leak</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://www.mozilla.org/security/announce/2011/mfsa2011-12.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2011/mfsa2011-13.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2011/mfsa2011-14.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2011/mfsa2011-15.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2011/mfsa2011-16.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2011/mfsa2011-17.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2011/mfsa2011-18.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-04-28</discovery>
|
|
<entry>2011-04-29</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="3c7d565a-6c64-11e0-813a-6c626dd55a41">
|
|
<topic>Asterisk -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>asterisk14</name>
|
|
<range><gt>1.4.*</gt><lt>1.4.40.1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>asterisk16</name>
|
|
<range><gt>1.6.*</gt><lt>1.6.2.17.3</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>asterisk18</name>
|
|
<range><gt>1.8.*</gt><lt>1.8.3.3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Asterisk Development Team reports:</p>
|
|
<blockquote cite="http://lists.digium.com/pipermail/asterisk-announce/2011-April/000316.html">
|
|
<p>It is possible for a user of the Asterisk Manager Interface to
|
|
bypass a security check and execute shell commands when they
|
|
should not have that ability. Sending the "Async" header with
|
|
the "Application" header during an Originate action, allows
|
|
authenticated manager users to execute shell commands. Only
|
|
users with the "system" privilege should be able to do this.</p>
|
|
<p>On systems that have the Asterisk Manager Interface, Skinny, SIP
|
|
over TCP, or the built in HTTP server enabled, it is possible for
|
|
an attacker to open as many connections to asterisk as he wishes.
|
|
This will cause Asterisk to run out of available file descriptors
|
|
and stop processing any new calls. Additionally, disk space can
|
|
be exhausted as Asterisk logs failures to open new file
|
|
descriptors.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2011-1507</cvename>
|
|
<url>http://downloads.asterisk.org/pub/security/AST-2011-005.pdf</url>
|
|
<url>http://downloads.asterisk.org/pub/security/AST-2011-006.pdf</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-04-21</discovery>
|
|
<entry>2011-04-21</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="6a4bfe75-692a-11e0-bce7-001eecdd401a">
|
|
<topic>VLC -- Heap corruption in MP4 demultiplexer</topic>
|
|
<affects>
|
|
<package>
|
|
<name>vlc</name>
|
|
<range><ge>1.0.0</ge><lt>1.1.9</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>VideoLAN project reports:</p>
|
|
<blockquote cite="http://www.videolan.org/security/sa1103.html">
|
|
<p>When parsing some MP4 (MPEG-4 Part 14) files, insufficient
|
|
buffer size might lead to corruption of the heap.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://www.videolan.org/security/sa1103.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-04-07</discovery>
|
|
<entry>2011-04-17</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="32b05547-6913-11e0-bdc4-001b2134ef46">
|
|
<topic>linux-flashplugin -- remote code execution vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>linux-flashplugin</name>
|
|
<range><le>9.0r289</le></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-f10-flashplugin</name>
|
|
<range><lt>10.2r159.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Adobe Product Security Incident Response Team reports:</p>
|
|
<blockquote cite="http://www.adobe.com/support/security/advisories/apsa11-02.html">
|
|
<p>A critical vulnerability exists in Flash Player 10.2.153.1
|
|
and earlier versions (Adobe Flash Player 10.2.154.25 and
|
|
earlier for Chrome users) for Windows, Macintosh, Linux
|
|
and Solaris, Adobe Flash Player 10.2.156.12 and earlier
|
|
versions for Android, and the Authplay.dll component that
|
|
ships with Adobe Reader and Acrobat X (10.0.2) and earlier
|
|
10.x and 9.x versions for Windows and Macintosh operating
|
|
systems.</p>
|
|
<p>This vulnerability (CVE-2011-0611) could cause a crash
|
|
and potentially allow an attacker to take control of the
|
|
affected system. There are reports that this vulnerability
|
|
is being exploited in the wild in targeted attacks via a
|
|
malicious Web page or a Flash (.swf) file embedded in a
|
|
Microsoft Word (.doc) or Microsoft Excel (.xls) file
|
|
delivered as an email attachment, targeting the Windows
|
|
platform. At this time, Adobe is not aware of any attacks
|
|
via PDF targeting Adobe Reader and Acrobat. Adobe Reader
|
|
X Protected Mode mitigations would prevent an exploit of
|
|
this kind from executing.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2011-0611</cvename>
|
|
<url>http://www.adobe.com/support/security/advisories/apsa11-02.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-01-20</discovery>
|
|
<entry>2011-04-17</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="bf171509-68dd-11e0-afe6-0003ba02bf30">
|
|
<topic>rt -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>rt36</name>
|
|
<range><lt>3.6.11</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>rt38</name>
|
|
<range><lt>3.8.10</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Best Practical reports:</p>
|
|
<blockquote cite="http://blog.bestpractical.com/2011/04/security-vulnerabilities-in-rt.html">
|
|
<p>In the process of preparing the release of RT 4.0.0, we performed
|
|
an extensive security audit of RT's source code. During this
|
|
audit, several vulnerabilities were found which affect earlier
|
|
releases of RT.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2011-1685</cvename>
|
|
<cvename>CVE-2011-1686</cvename>
|
|
<cvename>CVE-2011-1687</cvename>
|
|
<cvename>CVE-2011-1688</cvename>
|
|
<cvename>CVE-2011-1689</cvename>
|
|
<cvename>CVE-2011-1690</cvename>
|
|
<url>http://secunia.com/advisories/44189</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-04-14</discovery>
|
|
<entry>2011-04-17</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="6a3c3e5c-66cb-11e0-a116-c535f3aa24f0">
|
|
<topic>krb5 -- MITKRB5-SA-2011-004, kadmind invalid pointer free() [CVE-2011-0285]</topic>
|
|
<affects>
|
|
<package>
|
|
<name>krb5</name>
|
|
<range><ge>1.7</ge><lt>1.7.2</lt></range>
|
|
<range><ge>1.8</ge><lt>1.8.4</lt></range>
|
|
<range><eq>1.9</eq></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>An advisory published by the MIT Kerberos team says:</p>
|
|
<blockquote cite="http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2011-004.txt">
|
|
<p>The password-changing capability of the MIT krb5 administration
|
|
daemon (kadmind) has a bug that can cause it to attempt to free()
|
|
an invalid pointer under certain error conditions. This can cause
|
|
the daemon to crash or induce the execution of arbitrary code
|
|
(which is believed to be difficult). No exploit that executes
|
|
arbitrary code is known to exist, but it is easy to trigger a
|
|
denial of service manually.</p>
|
|
<p>Some platforms detect attempted freeing of invalid pointers and
|
|
protectively terminate the process, preventing arbitrary code
|
|
execution on those platforms.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2011-0285</cvename>
|
|
<url>http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2011-004.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-04-12</discovery>
|
|
<entry>2011-04-14</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="7edac52a-66cd-11e0-9398-5d45f3aa24f0">
|
|
<topic>krb5 -- MITKRB5-SA-2011-003, KDC vulnerable to double-free when PKINIT enabled</topic>
|
|
<affects>
|
|
<package>
|
|
<name>krb5</name>
|
|
<range><ge>1.7</ge><lt>1.7.2</lt></range>
|
|
<range><ge>1.8</ge><lt>1.8.4</lt></range>
|
|
<range><eq>1.9</eq></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>An advisory published by the MIT Kerberos team says:</p>
|
|
<blockquote cite="http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2011-003.txt">
|
|
<p>The MIT Kerberos 5 Key Distribution Center (KDC) daemon is
|
|
vulnerable to a double-free condition if the Public Key
|
|
Cryptography for Initial Authentication (PKINIT) capability is
|
|
enabled, resulting in daemon crash or arbitrary code execution
|
|
(which is believed to be difficult).</p>
|
|
<p>An unauthenticated remote attacker can induce a double-free
|
|
event, causing the KDC daemon to crash (denial of service),
|
|
or to execute arbitrary code. Exploiting a double-free event
|
|
to execute arbitrary code is believed to be difficult.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2011-0284</cvename>
|
|
<url>http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2011-003.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-03-15</discovery>
|
|
<entry>2011-04-14</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="4ab413ea-66ce-11e0-bf05-d445f3aa24f0">
|
|
<topic>krb5 -- MITKRB5-SA-2011-002, KDC vulnerable to hang when using LDAP back end</topic>
|
|
<affects>
|
|
<package>
|
|
<name>krb5</name>
|
|
<range><ge>1.7</ge><lt>1.7.2</lt></range>
|
|
<range><ge>1.8</ge><le>1.8.4</le></range>
|
|
<range><eq>1.9</eq></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>An advisory published by the MIT Kerberos team says:</p>
|
|
<blockquote cite="http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2011-002.txt">
|
|
<p>The MIT krb5 Key Distribution Center (KDC) daemon is vulnerable
|
|
to denial of service attacks from unauthenticated remote
|
|
attackers. CVE-2011-0281 and CVE-2011-0282 occur only in KDCs
|
|
using LDAP back ends, but CVE-2011-0283 occurs in all krb5-1.9
|
|
KDCs.</p>
|
|
<p>Exploit code is not known to exist, but the vulnerabilities are
|
|
easy to trigger manually. The trigger for CVE-2011-0281 has
|
|
already been disclosed publicly, but that fact might not be
|
|
obvious to casual readers of the message in which it was
|
|
disclosed. The triggers for CVE-2011-0282 and CVE-2011-0283
|
|
have not yet been disclosed publicly, but they are also
|
|
trivial.</p>
|
|
<p>CVE-2011-0281: An unauthenticated remote attacker can cause a KDC
|
|
configured with an LDAP back end to become completely unresponsive
|
|
until restarted.</p>
|
|
<p>CVE-2011-0282: An unauthenticated remote attacker can cause a KDC
|
|
configured with an LDAP back end to crash with a null pointer
|
|
dereference.</p>
|
|
<p>CVE-2011-0283: An unauthenticated remote attacker can cause a
|
|
krb5-1.9 KDC with any back end to crash with a null pointer
|
|
dereference.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2011-0281</cvename>
|
|
<cvename>CVE-2011-0282</cvename>
|
|
<cvename>CVE-2011-0283</cvename>
|
|
<url>http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2011-002.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-02-08</discovery>
|
|
<entry>2011-04-14</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="64f24a1e-66cf-11e0-9deb-f345f3aa24f0">
|
|
<topic>krb5 -- MITKRB5-SA-2011-001, kpropd denial of service</topic>
|
|
<affects>
|
|
<package>
|
|
<name>krb5</name>
|
|
<range><ge>1.7</ge><lt>1.7.2</lt></range>
|
|
<range><ge>1.8</ge><lt>1.8.4</lt></range>
|
|
<range><eq>1.9</eq></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>An advisory published by the MIT Kerberos team says:</p>
|
|
<blockquote cite="http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2011-001.txt">
|
|
<p>The MIT krb5 KDC database propagation daemon (kpropd) is
|
|
vulnerable to a denial-of-service attack triggered by invalid
|
|
network input. If a kpropd worker process receives invalid
|
|
input that causes it to exit with an abnormal status, it can
|
|
cause the termination of the listening process that spawned it,
|
|
preventing the slave KDC it was running on from receiving
|
|
database updates from the master KDC.</p>
|
|
<p>Exploit code is not known to exist, but the vulnerabilities are
|
|
easy to trigger manually.</p>
|
|
<p>An unauthenticated remote attacker can cause kpropd running in
|
|
standalone mode (the "-S" option) to terminate its listening
|
|
process, preventing database propagations to the KDC host on
|
|
which it was running. Configurations where kpropd runs in
|
|
incremental propagation mode ("iprop") or as an inetd server
|
|
are not affected.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2010-4022</cvename>
|
|
<url>http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2011-001.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-02-08</discovery>
|
|
<entry>2011-04-14</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="2eccb24f-61c0-11e0-b199-0015f2db7bde">
|
|
<topic>xrdb -- root hole via rogue hostname</topic>
|
|
<affects>
|
|
<package>
|
|
<name>xrdb</name>
|
|
<range><lt>1.0.6_1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Matthias Hopf reports:</p>
|
|
<blockquote cite="http://lists.freedesktop.org/archives/xorg-announce/2011-April/001636.html">
|
|
<p>By crafting hostnames with shell escape characters, arbitrary
|
|
commands can be executed in a root environment when a display
|
|
manager reads in the resource database via xrdb.</p>
|
|
<p>These specially crafted hostnames can occur in two environments:</p>
|
|
<p>Systems are affected are: systems set their hostname via DHCP,
|
|
and the used DHCP client allows setting of hostnames with illegal
|
|
characters. And systems that allow remote logins via xdmcp.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2011-0465</cvename>
|
|
<url>http://lists.freedesktop.org/archives/xorg-announce/2011-April/001636.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-04-05</discovery>
|
|
<entry>2011-04-14</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="a4372a68-652c-11e0-a25a-00151735203a">
|
|
<topic>OTRS -- Several XSS attacks possible</topic>
|
|
<affects>
|
|
<package>
|
|
<name>otrs</name>
|
|
<range><gt>2.3.*</gt><lt>3.0.7</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>OTRS Security Advisory reports:</p>
|
|
<blockquote cite="http://otrs.org/advisory/OSA-2011-01-en/">
|
|
<ul>
|
|
<li>Several XSS attacks possible:
|
|
An attacker could trick a logged in user to following a prepared
|
|
URL inside of the OTRS system which causes a page to be shown that
|
|
possibly includes malicious !JavaScript code because of incorrect
|
|
escaping during the generation of the HTML page.</li>
|
|
</ul>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2011-1518</cvename>
|
|
<url>http://otrs.org/advisory/OSA-2011-01-en/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-03-12</discovery>
|
|
<entry>2011-04-12</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="7e69f00d-632a-11e0-9f3a-001d092480a4">
|
|
<topic>isc-dhcp-client -- dhclient does not strip or escape shell meta-characters</topic>
|
|
<affects>
|
|
<package>
|
|
<name>isc-dhcp31-client</name>
|
|
<range><lt>3.1.ESV_1,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>isc-dhcp41-client</name>
|
|
<range><lt>4.1.e,2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>ISC reports:</p>
|
|
<blockquote cite="http://www.isc.org/software/dhcp/advisories/cve-2011-0997">
|
|
<p>ISC dhclient did not strip or escape certain shell meta-characters
|
|
in responses from the dhcp server (like hostname) before passing the
|
|
responses on to dhclient-script. Depending on the script and OS,
|
|
this can result in execution of exploit code on the client.
|
|
</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2011-0997</cvename>
|
|
<certvu>107886</certvu>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-04-05</discovery>
|
|
<entry>2011-04-10</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="b9281fb9-61b2-11e0-b1ce-0019d1a7ece2">
|
|
<topic>tinyproxy -- ACL lists ineffective when range is configured</topic>
|
|
<affects>
|
|
<package>
|
|
<name>tinyproxy</name>
|
|
<range><lt>1.8.2_2,1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>When including a line to allow a network of IP addresses, the access to tinyproxy
|
|
56 is actually allowed for all IP addresses.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2011-1499</cvename>
|
|
<url>https://banu.com/bugzilla/show_bug.cgi?id=90</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-05-18</discovery>
|
|
<entry>2011-04-08</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="b2a40507-5c88-11e0-9e85-00215af774f0">
|
|
<topic>quagga -- two DoS vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>quagga</name>
|
|
<range><lt>0.99.17_6</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Quagga developers report:</p>
|
|
<blockquote cite="http://www.quagga.net/news2.php?y=2011&m=3&d=21#id1300723200">
|
|
<p>Quagga 0.99.18 has been released.
|
|
This release fixes 2 denial of services in bgpd, which can be
|
|
remotely triggered by malformed AS-Pathlimit or Extended-Community
|
|
attributes. These issues have been assigned CVE-2010-1674 and
|
|
CVE-2010-1675. Support for AS-Pathlimit has been removed with this
|
|
release.
|
|
</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2010-1674</cvename>
|
|
<cvename>CVE-2010-1675</cvename>
|
|
<url>http://www.quagga.net/news2.php?y=2011&m=3&d=21#id1300723200</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-04-30</discovery>
|
|
<entry>2011-04-01</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="c6fbd447-59ed-11e0-8d04-0015f2db7bde">
|
|
<topic>gdm -- privilege escalation vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>gdm</name>
|
|
<range><lt>2.30.5_2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Sebastian Krahmer reports:</p>
|
|
<blockquote cite="http://mail.gnome.org/archives/distributor-list/2011-March/msg00008.html">
|
|
<p>It was discovered that the GNOME Display Manager (gdm) cleared the cache
|
|
directory, which is owned by an unprivileged user, with the privileges of the
|
|
root user. A race condition exists in gdm where a local user could take
|
|
advantage of this by writing to the cache directory between ending the session
|
|
and the signal to clean up the session, which could lead to the execution of
|
|
arbitrary code as the root user.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2011-0727</cvename>
|
|
<url>http://mail.gnome.org/archives/distributor-list/2011-March/msg00008.html</url>
|
|
<url>https://bugzilla.redhat.com/show_bug.cgi?id=688323</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-03-28</discovery>
|
|
<entry>2011-03-29</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="fe853666-56ce-11e0-9668-001fd0d616cf">
|
|
<topic>php -- ZipArchive segfault with FL_UNCHANGED on empty archive</topic>
|
|
<affects>
|
|
<package>
|
|
<name>php5-zip</name>
|
|
<range><lt>5.3.6</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>US-CERT/NIST reports:</p>
|
|
<blockquote cite="http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-0421">
|
|
<p>The _zip_name_locate function in zip_name_locate.c in the Zip extension
|
|
in PHP before 5.3.6 does not properly handle a ZIPARCHIVE::FL_UNCHANGED
|
|
argument, which might allow context-dependent attackers to cause a
|
|
denial of service (application crash) via an empty ZIP archive that is
|
|
processed with a (1) locateName or (2) statName operation.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2011-0421</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-03-20</discovery>
|
|
<entry>2011-03-25</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="cc3bfec6-56cd-11e0-9668-001fd0d616cf">
|
|
<topic>php -- crash on crafted tag in exif</topic>
|
|
<affects>
|
|
<package>
|
|
<name>php5-exif</name>
|
|
<range><lt>5.3.6</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>US-CERT/NIST reports:</p>
|
|
<blockquote cite="http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-0708">
|
|
<p>exif.c in the Exif extension in PHP before 5.3.6 on 64-bit platforms
|
|
performs an incorrect cast, which allows remote attackers to cause a
|
|
denial of service (application crash) via an image with a crafted
|
|
Image File Directory (IFD) that triggers a buffer over-read.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2011-0708</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-03-20</discovery>
|
|
<entry>2011-03-25</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="501ee07a-5640-11e0-985a-001b2134ef46">
|
|
<topic>linux-flashplugin -- remote code execution vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>linux-flashplugin</name>
|
|
<range><le>9.0r289</le></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-f8-flashplugin</name>
|
|
<name>linux-f10-flashplugin</name>
|
|
<range><lt>10.2r153</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Adobe Product Security Incident Response Team reports:</p>
|
|
<blockquote cite="http://www.adobe.com/support/security/advisories/apsa11-01.html">
|
|
<p>A critical vulnerability exists in Adobe Flash Player
|
|
10.2.152.33 and earlier versions (Adobe Flash Player
|
|
10.2.154.18 and earlier for Chrome users) for Windows,
|
|
Macintosh, Linux and Solaris operating systems, Adobe
|
|
Flash Player 10.1.106.16 and earlier versions for Android,
|
|
and the Authplay.dll component that ships with Adobe Reader
|
|
and Acrobat X (10.0.1) and earlier 10.x and 9.x versions of
|
|
Reader and Acrobat for Windows and Macintosh operating systems.</p>
|
|
<p>This vulnerability (CVE-2011-0609) could cause a crash and
|
|
potentially allow an attacker to take control of the affected
|
|
system. There are reports that this vulnerability is being
|
|
exploited in the wild in targeted attacks via a Flash (.swf)
|
|
file embedded in a Microsoft Excel (.xls) file delivered as
|
|
an email attachment.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2011-0609</cvename>
|
|
<url>http://www.adobe.com/support/security/advisories/apsa11-01.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-01-20</discovery>
|
|
<entry>2011-03-24</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="b2f09169-55af-11e0-9d6f-000f20797ede">
|
|
<topic>mozilla -- update to HTTPS certificate blacklist</topic>
|
|
<affects>
|
|
<package>
|
|
<name>firefox</name>
|
|
<range><gt>3.6.*,1</gt><lt>3.6.16,1</lt></range>
|
|
<range><gt>3.5.*,1</gt><lt>3.5.18,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>libxul</name>
|
|
<range><gt>1.9.2.*</gt><lt>1.9.2.16</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-firefox</name>
|
|
<range><lt>3.6.16,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-firefox-devel</name>
|
|
<range><lt>3.5.18</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-seamonkey</name>
|
|
<range><gt>2.0.*</gt><lt>2.0.13</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>seamonkey</name>
|
|
<range><gt>2.0.*</gt><lt>2.0.13</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Mozilla Project reports:</p>
|
|
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
|
|
<p>MFSA 2011-11 Update to HTTPS certificate blacklist</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://www.mozilla.org/security/announce/2011/mfsa2011-11.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-03-22</discovery>
|
|
<entry>2011-03-24</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="14a6f516-502f-11e0-b448-bbfa2731f9c7">
|
|
<topic>postfix -- plaintext command injection with SMTP over TLS</topic>
|
|
<affects>
|
|
<package>
|
|
<name>postfix</name>
|
|
<name>postfix-base</name>
|
|
<range><ge>2.7.*,1</ge><lt>2.7.3,1</lt></range>
|
|
<range><ge>2.6.*,1</ge><lt>2.6.9,1</lt></range>
|
|
<range><ge>2.5.*,2</ge><lt>2.5.12,2</lt></range>
|
|
<range><ge>2.4.*,1</ge><lt>2.4.16,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>postfix-current</name>
|
|
<name>postfix-current-base</name>
|
|
<range><lt>2.9.20100120,4</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Wietse Venema has discovered a software flaw that allows
|
|
an attacker to inject client commands into an SMTP session
|
|
during the unprotected plaintext SMTP protocol phase, such
|
|
that the server will execute those commands during the SMTP-
|
|
over-TLS protocol phase when all communication is supposed
|
|
to be protected.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2011-0411</cvename>
|
|
<url>http://www.postfix.org/CVE-2011-0411.html</url>
|
|
<url>http://secunia.com/advisories/43646/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-03-07</discovery>
|
|
<entry>2011-03-19</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="b13414c9-50ba-11e0-975a-000c29cc39d3">
|
|
<topic>hiawatha -- integer overflow in Content-Length header parsing</topic>
|
|
<affects>
|
|
<package>
|
|
<name>hiawatha</name>
|
|
<range><lt>7.4_1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Hugo Leisink reports:</p>
|
|
<blockquote cite="http://www.hiawatha-webserver.org/weblog/16">
|
|
<p>A bug has been found in version 7.4 of the Hiawatha webserver,
|
|
which could lead to a server crash. This is caused by an integer
|
|
overflow in the routine that reads the HTTP request. A too large
|
|
value of the Content-Length HTTP header results in an overflow.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://www.hiawatha-webserver.org/weblog/16</url>
|
|
<url>http://secunia.com/advisories/43660/</url>
|
|
<url>http://securityvulns.com/Zdocument902.html</url>
|
|
<url>http://packetstormsecurity.org/files/99021/Hiawatha-WebServer-7.4-Denial-Of-Service.html</url>
|
|
<url>http://seclists.org/bugtraq/2011/Mar/65</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-02-25</discovery>
|
|
<entry>2011-03-17</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="bfe9c75e-5028-11e0-b2d2-00215c6a37bb">
|
|
<topic>asterisk -- Multiple Vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>asterisk16</name>
|
|
<range><gt>1.6.*</gt><lt>1.6.2.17.1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>asterisk18</name>
|
|
<range><gt>1.8.*</gt><lt>1.8.3.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Asterisk Development Team reports:</p>
|
|
<blockquote cite="http://www.venturevoip.com/news.php?rssid=2521">
|
|
<p>The releases of Asterisk 1.6.1.23, 1.6.2.17.1, and 1.8.3.1
|
|
resolve two issues:</p>
|
|
<ul>
|
|
<li>Resource exhaustion in Asterisk Manager Interface
|
|
(AST-2011-003)</li>
|
|
<li>Remote crash vulnerability in TCP/TLS server
|
|
(AST-2011-004)</li>
|
|
</ul>
|
|
<p>The issues and resolutions are described in the AST-2011-003
|
|
and AST-2011-004 security advisories.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://downloads.asterisk.org/pub/security/AST-2011-003.html</url>
|
|
<url>http://downloads.asterisk.org/pub/security/AST-2011-004.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-03-01</discovery>
|
|
<entry>2011-03-16</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="8b986a05-4dbe-11e0-8b9a-02e0184b8d35">
|
|
<topic>avahi -- denial of service</topic>
|
|
<affects>
|
|
<package>
|
|
<name>avahi</name>
|
|
<name>avahi-app</name>
|
|
<name>avahi-autoipd</name>
|
|
<name>avahi-gtk</name>
|
|
<name>avahi-libdns</name>
|
|
<name>avahi-qt3</name>
|
|
<name>avahi-qt4</name>
|
|
<name>avahi-sharp</name>
|
|
<range><lt>0.6.29</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Avahi developers reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/43361/">
|
|
<p>A vulnerability has been reported in Avahi, which can be exploited
|
|
by malicious people to cause a DoS (Denial of Service).
|
|
The vulnerability is caused due to an error when processing certain
|
|
UDP packets, which can be exploited to trigger an infinite loop by
|
|
e.g. sending an empty packet to port 5353/UDP.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2011-1002</cvename>
|
|
<cvename>CVE-2010-2244</cvename>
|
|
<url>http://secunia.com/advisories/43361/</url>
|
|
<url>https://bugzilla.redhat.com/show_bug.cgi?id=667187</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-02-21</discovery>
|
|
<entry>2011-03-13</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="64691c49-4b22-11e0-a226-00e0815b8da8">
|
|
<topic>mailman -- XSS vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>mailman</name>
|
|
<range><lt>2.1.14_1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>CVE reports:</p>
|
|
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0707">
|
|
<p>Multiple cross-site scripting (XSS) vulnerabilities in
|
|
Cgi/confirm.py in GNU Mailman 2.1.14 and earlier allow remote
|
|
attackers to inject arbitrary web script or HTML via the (1)
|
|
full name or (2) username field in a confirmation message.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2011-0707</cvename>
|
|
<url>http://mail.python.org/pipermail/mailman-announce/2011-February/000157.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-02-13</discovery>
|
|
<entry>2011-03-10</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="cf96cd8d-48fb-11e0-98a6-0050569b2d21">
|
|
<topic>redmine -- XSS vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>redmine</name>
|
|
<range><gt>1.0</gt><lt>1.1.2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Jean-Philippe Lang reports:</p>
|
|
<blockquote cite="http://www.redmine.org/news/53">
|
|
<p>This maintenance release for 1.1.x users includes
|
|
13 bug fixes since 1.1.1 and a security fix (XSS
|
|
vulnerability affecting all Redmine versions from
|
|
1.0.1 to 1.1.1).
|
|
</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://www.redmine.org/news/53</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-03-07</discovery>
|
|
<entry>2011-03-07</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="e27ca763-4721-11e0-bdc4-001e8c75030d">
|
|
<topic>subversion -- remote HTTP DoS vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>subversion</name>
|
|
<range><ge>1.6</ge><le>1.6.15</le></range>
|
|
<range><ge>1.5</ge><le>1.6.9</le></range>
|
|
</package>
|
|
<package>
|
|
<name>subversion-freebsd</name>
|
|
<range><ge>1.6</ge><le>1.6.15</le></range>
|
|
<range><ge>1.5</ge><le>1.6.9</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Subversion project reports:</p>
|
|
<blockquote cite="http://subversion.apache.org/security/CVE-2011-0715-advisory.txt">
|
|
<p>Subversion HTTP servers up to 1.5.9 (inclusive) or 1.6.15 (inclusive)
|
|
are vulnerable to a remotely triggerable NULL-pointer dereference.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2011-0715</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-02-27</discovery>
|
|
<entry>2011-03-05</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="45f102cd-4456-11e0-9580-4061862b8c22">
|
|
<topic>mozilla -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>firefox</name>
|
|
<range><gt>3.6.*,1</gt><lt>3.6.14,1</lt></range>
|
|
<range><gt>3.5.*,1</gt><lt>3.5.17,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>libxul</name>
|
|
<range><gt>1.9.2.*</gt><lt>1.9.2.14</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-firefox</name>
|
|
<range><lt>3.6.14,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-firefox-devel</name>
|
|
<range><lt>3.5.17</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-seamonkey</name>
|
|
<range><gt>2.0.*</gt><lt>2.0.12</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-thunderbird</name>
|
|
<range><ge>3.1</ge><lt>3.1.8</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>seamonkey</name>
|
|
<range><gt>2.0.*</gt><lt>2.0.12</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>thunderbird</name>
|
|
<range><lt>3.1.8</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Mozilla Project reports:</p>
|
|
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
|
|
<p>MFSA 2011-01 Miscellaneous memory safety hazards (rv:1.9.2.14/ 1.9.1.17)</p>
|
|
<p>MFSA 2011-02 Recursive eval call causes confirm dialogs to evaluate to true</p>
|
|
<p>MFSA 2011-03 Use-after-free error in JSON.stringify</p>
|
|
<p>MFSA 2011-04 Buffer overflow in JavaScript upvarMap</p>
|
|
<p>MFSA 2011-05 Buffer overflow in JavaScript atom map</p>
|
|
<p>MFSA 2011-06 Use-after-free error using Web Workers</p>
|
|
<p>MFSA 2011-07 Memory corruption during text run construction (Windows)</p>
|
|
<p>MFSA 2011-08 ParanoidFragmentSink allows javascript: URLs in chrome documents</p>
|
|
<p>MFSA 2011-09 Crash caused by corrupted JPEG image</p>
|
|
<p>MFSA 2011-10 CSRF risk with plugins and 307 redirects</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2010-1585</cvename>
|
|
<cvename>CVE-2011-0051</cvename>
|
|
<cvename>CVE-2011-0053</cvename>
|
|
<cvename>CVE-2011-0054</cvename>
|
|
<cvename>CVE-2011-0055</cvename>
|
|
<cvename>CVE-2011-0056</cvename>
|
|
<cvename>CVE-2011-0057</cvename>
|
|
<cvename>CVE-2011-0058</cvename>
|
|
<cvename>CVE-2011-0059</cvename>
|
|
<cvename>CVE-2011-0061</cvename>
|
|
<cvename>CVE-2011-0062</cvename>
|
|
<url>https://www.mozilla.org/security/announce/2011/mfsa2011-01.html</url>
|
|
<url>https://www.mozilla.org/security/announce/2011/mfsa2011-02.html</url>
|
|
<url>https://www.mozilla.org/security/announce/2011/mfsa2011-03.html</url>
|
|
<url>https://www.mozilla.org/security/announce/2011/mfsa2011-04.html</url>
|
|
<url>https://www.mozilla.org/security/announce/2011/mfsa2011-05.html</url>
|
|
<url>https://www.mozilla.org/security/announce/2011/mfsa2011-06.html</url>
|
|
<url>https://www.mozilla.org/security/announce/2011/mfsa2011-07.html</url>
|
|
<url>https://www.mozilla.org/security/announce/2011/mfsa2011-08.html</url>
|
|
<url>https://www.mozilla.org/security/announce/2011/mfsa2011-09.html</url>
|
|
<url>https://www.mozilla.org/security/announce/2011/mfsa2011-10.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-03-01</discovery>
|
|
<entry>2011-03-01</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="be3dfe33-410b-11e0-9e02-00215c6a37bb">
|
|
<topic>openldap -- two security bypass vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>openldap-server</name>
|
|
<range><gt>2.4.0</gt><lt>2.4.24</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/43331/">
|
|
<p>Two vulnerabilities have been reported in
|
|
OpenLDAP, which can be exploited by malicious
|
|
people to bypass certain security restrictions.</p>
|
|
<p>The vulnerabilities are reported in versions
|
|
prior to 2.4.24.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://secunia.com/advisories/43331/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-02-14</discovery>
|
|
<entry>2011-02-25</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="65d16342-3ec8-11e0-9df7-001c42d23634">
|
|
<topic>asterisk -- Exploitable Stack and Heap Array Overflows</topic>
|
|
<affects>
|
|
<package>
|
|
<name>asterisk14</name>
|
|
<range><gt>1.4.*</gt><lt>1.4.39.2</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>asterisk16</name>
|
|
<range><gt>1.6.*</gt><lt>1.6.2.16.2</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>asterisk18</name>
|
|
<range><gt>1.8.*</gt><lt>1.8.2.4</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Asterisk Development Team reports:</p>
|
|
<blockquote cite="http://lists.digium.com/pipermail/asterisk-announce/2011-February/000302.html">
|
|
<p>The releases of Asterisk 1.4.39.2, 1.6.1.22, 1.6.2.16.2, and
|
|
1.8.2.4 resolve an issue that when decoding UDPTL packets, multiple
|
|
heap based arrays can be made to overflow by specially
|
|
crafted packets. Systems configured for T.38 pass through or
|
|
termination are vulnerable. The issue and resolution are described
|
|
in the AST-2011-002 security advisory.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://downloads.asterisk.org/pub/security/AST-2011-002.html</url>
|
|
<url>http://secunia.com/advisories/43429/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-02-21</discovery>
|
|
<entry>2011-02-22</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="ae0e5835-3cad-11e0-b654-00215c6a37bb">
|
|
<topic>PivotX -- administrator password reset vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>pivotx</name>
|
|
<range><lt>2.2.4</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>US CERT reports:</p>
|
|
<blockquote cite="http://www.kb.cert.org/vuls/id/175068">
|
|
<p>PivotX contains a vulnerability that allows an
|
|
attacker to change the password of any account
|
|
just by guessing the username. Version 2.2.4 has
|
|
been reported to not be affected.
|
|
This vulnerability is being exploited in the wild
|
|
and users should immediately upgrade to 2.2.5 or
|
|
later. Mitigation steps for users that have been
|
|
compromised have been posted to the <a href="http://forum.pivotx.net/viewtopic.php?f=2&t=1967">PivotX
|
|
Support Community</a>.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2011-1035</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-02-18</discovery>
|
|
<entry>2011-02-20</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="553ec4ed-38d6-11e0-94b1-000c29ba66d2">
|
|
<topic>tomcat -- Cross-site scripting vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>tomcat</name>
|
|
<range><gt>5.5.0</gt><lt>5.5.32</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>tomcat</name>
|
|
<range><gt>6.0.0</gt><lt>6.0.30</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>tomcat</name>
|
|
<range><gt>7.0.0</gt><lt>7.0.6</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Tomcat security team reports:</p>
|
|
<blockquote cite="http://tomcat.apache.org/security-5.html#Fixed_in_Apache_Tomcat_5.5.32">
|
|
<p>The HTML Manager interface displayed web applciation
|
|
provided data, such as display names, without filtering.
|
|
A malicious web application could trigger script execution
|
|
by an administartive user when viewing the manager pages.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2011-0013</cvename>
|
|
<url>http://tomcat.apache.org/security-5.html#Fixed_in_Apache_Tomcat_5.5.32</url>
|
|
<url>http://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.30</url>
|
|
<url>http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.6</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-11-12</discovery>
|
|
<entry>2011-02-15</entry>
|
|
<modified>2011-09-30</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="cd68ff50-362b-11e0-ad36-00215c6a37bb">
|
|
<topic>phpMyAdmin -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>phpMyAdmin</name>
|
|
<range><lt>3.3.9.2</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>phpMyAdmin211</name>
|
|
<range><lt>2.11.11.3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>phpMyAdmin team reports:</p>
|
|
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2011-2.php">
|
|
<p>It was possible to create a bookmark which would be executed
|
|
unintentionally by other users.</p>
|
|
</blockquote>
|
|
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2011-1.php">
|
|
<p>When the files README, ChangeLog or LICENSE have been removed
|
|
from their original place (possibly by the distributor), the
|
|
scripts used to display these files can show their full path,
|
|
leading to possible further attacks.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2011-2.php</url>
|
|
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2011-1.php</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-02-08</discovery>
|
|
<entry>2011-02-11</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="4a3482da-3624-11e0-b995-001b2134ef46">
|
|
<topic>linux-flashplugin -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>linux-flashplugin</name>
|
|
<range><le>9.0r289</le></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-f8-flashplugin</name>
|
|
<name>linux-f10-flashplugin</name>
|
|
<range><lt>10.2r152</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Adobe Product Security Incident Response Team reports:</p>
|
|
<blockquote cite="http://www.adobe.com/support/security/bulletins/apsb11-02.html">
|
|
<p>Critical vulnerabilities have been identified in
|
|
Adobe Flash Player 10.1.102.64 and earlier versions for
|
|
Windows, Macintosh, Linux, and Solaris. These vulnerabilities
|
|
could cause the application to crash and could potentially
|
|
allow an attacker to take control of the affected system.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2011-0558</cvename>
|
|
<cvename>CVE-2011-0559</cvename>
|
|
<cvename>CVE-2011-0560</cvename>
|
|
<cvename>CVE-2011-0561</cvename>
|
|
<cvename>CVE-2011-0571</cvename>
|
|
<cvename>CVE-2011-0572</cvename>
|
|
<cvename>CVE-2011-0573</cvename>
|
|
<cvename>CVE-2011-0574</cvename>
|
|
<cvename>CVE-2011-0575</cvename>
|
|
<cvename>CVE-2011-0577</cvename>
|
|
<cvename>CVE-2011-0578</cvename>
|
|
<cvename>CVE-2011-0607</cvename>
|
|
<cvename>CVE-2011-0608</cvename>
|
|
<url>http://www.adobe.com/support/security/bulletins/apsb11-02.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-02-08</discovery>
|
|
<entry>2011-02-11</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="53bde960-356b-11e0-8e81-0022190034c0">
|
|
<topic>mupdf -- Remote System Access</topic>
|
|
<affects>
|
|
<package>
|
|
<name>mupdf</name>
|
|
<range><lt>0.8</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/43020/">
|
|
<p>The vulnerability is caused due to an error within the
|
|
"closedctd()" function in fitz/filt_dctd.c when processing PDF
|
|
files containing certain malformed JPEG images. This can be
|
|
exploited to cause a stack corruption by e.g. tricking a user
|
|
into opening a specially crafted PDF file.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>46027</bid>
|
|
<url>http://secunia.com/advisories/43020/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-01-26</discovery>
|
|
<entry>2011-02-10</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="1cae628c-3569-11e0-8e81-0022190034c0">
|
|
<topic>rubygem-mail -- Remote Arbitrary Shell Command Injection Vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>rubygem-mail</name>
|
|
<range><lt>2.2.15</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/43077/">
|
|
<p>Input passed via an email from address is not properly sanitised
|
|
in the "deliver()" function (lib/mail/network/delivery_methods/sendmail.rb)
|
|
before being used as a command line argument. This can be exploited
|
|
to inject arbitrary shell commands.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>46021</bid>
|
|
<cvename>CVE-2011-0739</cvename>
|
|
<url>http://secunia.com/advisories/43077/</url>
|
|
<url>http://groups.google.com/group/mail-ruby/browse_thread/thread/e93bbd05706478dd?pli=1</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-01-25</discovery>
|
|
<entry>2011-02-10</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="7c492ea2-3566-11e0-8e81-0022190034c0">
|
|
<topic>plone -- Remote Security Bypass</topic>
|
|
<affects>
|
|
<package>
|
|
<name>plone</name>
|
|
<range><ge>2.5</ge><lt>3</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>plone3</name>
|
|
<range><ge>3</ge><le>3.3</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Plone developer reports:</p>
|
|
<blockquote cite="http://plone.org/products/plone/security/advisories/cve-2011-0720">
|
|
<p>This is an escalation of privileges attack that can be used by
|
|
anonymous users to gain access to a Plone site's administration
|
|
controls, view unpublished content, create new content and modify a
|
|
site's skin. The sandbox protecting access to the underlying
|
|
system is still in place, and it does not grant access to other
|
|
applications running on the same Zope instance.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>46102</bid>
|
|
<cvename>CVE-2011-0720</cvename>
|
|
<url>http://plone.org/products/plone/security/advisories/cve-2011-0720</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-02-02</discovery>
|
|
<entry>2011-02-10</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="44ccfab0-3564-11e0-8e81-0022190034c0">
|
|
<topic>exim -- local privilege escalation</topic>
|
|
<affects>
|
|
<package>
|
|
<name>exim</name>
|
|
<name>exim-ldap</name>
|
|
<name>exim-ldap2</name>
|
|
<name>exim-mysql</name>
|
|
<name>exim-postgresql</name>
|
|
<name>exim-sa-exim</name>
|
|
<range><lt>4.74</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>exim.org reports:</p>
|
|
<blockquote cite="ftp://ftp.exim.org/pub/exim/ChangeLogs/ChangeLog-4.74">
|
|
<p>CVE-2011-0017 - check return value of setuid/setgid. This is a
|
|
privilege escalation vulnerability whereby the Exim run-time user
|
|
can cause root to append content of the attacker's choosing to
|
|
arbitrary files.
|
|
</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2011-0017</cvename>
|
|
<url>ftp://ftp.exim.org/pub/exim/ChangeLogs/ChangeLog-4.74</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-01-31</discovery>
|
|
<entry>2011-02-10</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="f2b43905-3545-11e0-8e81-0022190034c0">
|
|
<topic>openoffice.org -- Multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>openoffice.org</name>
|
|
<range><lt>3.3.0</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>OpenOffice.org Security Team reports:</p>
|
|
<blockquote cite="http://www.openoffice.org/security/bulletin.html">
|
|
<p>Fixed in OpenOffice.org 3.3</p>
|
|
<ul>
|
|
<li><a href="http://www.openoffice.org/security/cves/CVE-2010-2935_CVE-2010-2936.html">
|
|
CVE-2010-2935 / CVE-2010-2936</a>: Security Vulnerability in OpenOffice.org related to PowerPoint document processing</li>
|
|
<li><a href="http://www.openoffice.org/security/cves/CVE-2010-3450.html">
|
|
CVE-2010-3450</a>: Security Vulnerability in OpenOffice.org related to Extensions and filter package files</li>
|
|
<li><a href="http://www.openoffice.org/security/cves/CVE-2010-3451_CVE-2010-3452.html">
|
|
CVE-2010-3451 / CVE-2010-3452</a>: Security Vulnerability in OpenOffice.org related to RTF document processing </li>
|
|
<li><a href="http://www.openoffice.org/security/cves/CVE-2010-3453_CVE-2010-3454.html">
|
|
CVE-2010-3453 / CVE-2010-3454</a>: Security Vulnerability in OpenOffice.org related to Word document processing </li>
|
|
<li><a href="http://www.openoffice.org/security/cves/CVE-2010-3689.html">
|
|
CVE-2010-3689</a>: Insecure LD_LIBRARY_PATH usage in OpenOffice.org shell scripts </li>
|
|
<li><a href="http://www.openoffice.org/security/cves/CVE-2010-3702_CVE-2010-3704.html">
|
|
CVE-2010-3702 / CVE-2010-3704</a>: Security Vulnerability in OpenOffice.org's PDF Import extension resulting from 3rd party library XPDF</li>
|
|
<li><a href="http://www.openoffice.org/security/cves/CVE-2010-4008_CVE-2010-4494.html">
|
|
CVE-2010-4008 / CVE-2010-4494</a>: Possible Security Vulnerability in OpenOffice.org resulting from 3rd party library LIBXML2 </li>
|
|
<li><a href="http://www.openoffice.org/security/cves/CVE-2010-4253.html">
|
|
CVE-2010-4253</a>: Security Vulnerability in OpenOffice.org related to PNG file processing </li>
|
|
<li><a href="http://www.openoffice.org/security/cves/CVE-2010-4643.html">
|
|
CVE-2010-4643</a>: Security Vulnerability in OpenOffice.org related to TGA file processing </li>
|
|
</ul>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://www.openoffice.org/security/bulletin.html</url>
|
|
<url>http://secunia.com/advisories/40775/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-08-04</discovery>
|
|
<entry>2011-02-10</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="35ecdcbe-3501-11e0-afcd-0015f2db7bde">
|
|
<topic>webkit-gtk2 -- Multiple vurnabilities.</topic>
|
|
<affects>
|
|
<package>
|
|
<name>webkit-gtk2</name>
|
|
<range><lt>1.2.7</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Gustavo Noronha Silva reports:</p>
|
|
<blockquote cite="http://permalink.gmane.org/gmane.os.opendarwin.webkit.gtk/405">
|
|
<p>This release has essentially security fixes. Refer to the
|
|
WebKit/gtk/NEWS file inside the tarball for details. We would like
|
|
to thank the Red Hat security team (Huzaifa Sidhpurwala in
|
|
particular) and Michael Gilbert from Debian for their help in
|
|
checking (and pushing!) security issues affecting the WebKitGTK+
|
|
stable branch for this release.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2010-2901</cvename>
|
|
<cvename>CVE-2010-4040</cvename>
|
|
<cvename>CVE-2010-4042</cvename>
|
|
<cvename>CVE-2010-4199</cvename>
|
|
<cvename>CVE-2010-4492</cvename>
|
|
<cvename>CVE-2010-4493</cvename>
|
|
<cvename>CVE-2010-4578</cvename>
|
|
<cvename>CVE-2011-0482</cvename>
|
|
<cvename>CVE-2011-0778</cvename>
|
|
<url>https://bugs.webkit.org/show_bug.cgi?id=48328</url>
|
|
<url>https://bugs.webkit.org/show_bug.cgi?id=50710</url>
|
|
<url>https://bugs.webkit.org/show_bug.cgi?id=50840</url>
|
|
<url>https://bugs.webkit.org/show_bug.cgi?id=50932</url>
|
|
<url>https://bugs.webkit.org/show_bug.cgi?id=51993</url>
|
|
<url>https://bugs.webkit.org/show_bug.cgi?id=53265</url>
|
|
<url>https://bugs.webkit.org/show_bug.cgi?id=53276</url>
|
|
<url>http://permalink.gmane.org/gmane.os.opendarwin.webkit.gtk/405</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-02-08</discovery>
|
|
<entry>2011-02-10</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="ce6ce2f8-34ac-11e0-8103-00215c6a37bb">
|
|
<topic>awstats -- arbitrary commands execution vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>awstats</name>
|
|
<range><lt>7.0,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>awstats-devel</name>
|
|
<range><gt>0</gt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Awstats change log reports:</p>
|
|
<blockquote cite="http://awstats.sourceforge.net/docs/awstats_changelog.txt">
|
|
<ul>
|
|
<li>Security fix (Traverse directory of LoadPlugin)</li>
|
|
<li>Security fix (Limit config to defined directory
|
|
to avoid access to external config file via a nfs
|
|
or webdav link).</li>
|
|
</ul>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2010-4367</cvename>
|
|
<url>http://www.exploitdevelopment.com/Vulnerabilities/2010-WEB-001.html</url>
|
|
<url>http://awstats.sourceforge.net/docs/awstats_changelog.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-05-01</discovery>
|
|
<entry>2011-02-10</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="2eda0c54-34ab-11e0-8103-00215c6a37bb">
|
|
<topic>opera -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>opera</name>
|
|
<name>opera-devel</name>
|
|
<name>linux-opera</name>
|
|
<range><lt>11.01</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Opera reports:</p>
|
|
<blockquote cite="http://www.opera.com/docs/changelogs/unix/1101/">
|
|
<p>Opera 11.01 is a recommended upgrade offering security and
|
|
stability enhancements.</p>
|
|
<p>The following security vulnerabilities have been fixed:</p>
|
|
<ul>
|
|
<li>Removed support for "<code>javascript:</code>" URLs in
|
|
CSS -o-link values, to make it easier for sites to filter
|
|
untrusted CSS.</li>
|
|
<li>Fixed an issue where large form inputs could allow
|
|
execution of arbitrary code, as reported by Jordi Chancel;
|
|
see our <a href="http://www.opera.com/support/kb/view/982/">advisory</a>.</li>
|
|
<li>Fixed an issue which made it possible to carry out
|
|
clickjacking attacks against internal opera: URLs;
|
|
see our <a href="http://www.opera.com/support/kb/view/983/">advisory</a>.</li>
|
|
<li>Fixed issues which allowed web pages to gain limited
|
|
access to files on the user's computer; see our
|
|
<a href="http://www.opera.com/support/kb/view/984/">advisory</a>.</li>
|
|
<li>Fixed an issue where email passwords were not immediately
|
|
deleted when deleting private data; see our
|
|
<a href="http://www.opera.com/support/kb/view/986/">advisory</a>.</li>
|
|
</ul>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2011-0450</cvename>
|
|
<cvename>CVE-2011-0681</cvename>
|
|
<cvename>CVE-2011-0682</cvename>
|
|
<cvename>CVE-2011-0683</cvename>
|
|
<cvename>CVE-2011-0684</cvename>
|
|
<cvename>CVE-2011-0685</cvename>
|
|
<cvename>CVE-2011-0686</cvename>
|
|
<cvename>CVE-2011-0687</cvename>
|
|
<url>http://www.opera.com/support/kb/view/982/</url>
|
|
<url>http://www.opera.com/support/kb/view/983/</url>
|
|
<url>http://www.opera.com/support/kb/view/984/</url>
|
|
<url>http://secunia.com/advisories/43023</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-01-26</discovery>
|
|
<entry>2011-02-10</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="bd760627-3493-11e0-8103-00215c6a37bb">
|
|
<topic>django -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>py23-django</name>
|
|
<name>py24-django</name>
|
|
<name>py25-django</name>
|
|
<name>py26-django</name>
|
|
<name>py27-django</name>
|
|
<name>py30-django</name>
|
|
<name>py31-django</name>
|
|
<range><gt>1.2</gt><lt>1.2.5</lt></range>
|
|
<range><gt>1.1</gt><lt>1.1.4</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>py23-django-devel</name>
|
|
<name>py24-django-devel</name>
|
|
<name>py25-django-devel</name>
|
|
<name>py26-django-devel</name>
|
|
<name>py27-django-devel</name>
|
|
<name>py30-django-devel</name>
|
|
<name>py31-django-devel</name>
|
|
<range><lt>15470,1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Django project reports:</p>
|
|
<blockquote cite="http://www.djangoproject.com/weblog/2011/feb/08/security/">
|
|
<p>Today the Django team is issuing multiple releases --
|
|
Django 1.2.5 and Django 1.1.4 -- to remedy three security
|
|
issues reported to us. All users of affected versions of
|
|
Django are urged to upgrade immediately.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://www.djangoproject.com/weblog/2011/feb/08/security/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-02-08</discovery>
|
|
<entry>2011-02-09</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="8d04cfbd-344d-11e0-8669-0025222482c5">
|
|
<topic>mediawiki -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>mediawiki</name>
|
|
<range><lt>1.16.2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Medawiki reports:</p>
|
|
<blockquote cite="http://lists.wikimedia.org/pipermail/mediawiki-announce/2011-February/000095.html">
|
|
<p>An arbitrary script inclusion vulnerability was discovered. The
|
|
vulnerability only allows execution of files with names ending in
|
|
".php" which are already present in the local filesystem. Only servers
|
|
running Microsoft Windows and possibly Novell Netware are affected.
|
|
Despite these mitigating factors, all users are advised to upgrade,
|
|
since there is a risk of complete server compromise. MediaWiki 1.8.0
|
|
and later is affected.</p>
|
|
<p>Security researcher mghack discovered a CSS injection
|
|
vulnerability. For Internet Explorer and similar browsers, this is
|
|
equivalent to an XSS vulnerability, that is to say, it allows the
|
|
compromise of wiki user accounts. For other browsers, it allows private
|
|
data such as IP addresses and browsing patterns to be sent to a malicious
|
|
external web server. It affects all versions of MediaWiki. All users are
|
|
advised to upgrade.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2011-0047</cvename>
|
|
<url>https://bugzilla.wikimedia.org/show_bug.cgi?id=27094</url>
|
|
<url>https://bugzilla.wikimedia.org/show_bug.cgi?id=27093</url>
|
|
<url>http://svn.wikimedia.org/svnroot/mediawiki/tags/REL1_16_2/phase3/RELEASE-NOTES</url>
|
|
<url>http://lists.wikimedia.org/pipermail/mediawiki-announce/2011-February/000095.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-02-01</discovery>
|
|
<entry>2011-02-09</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="8c93e997-30e0-11e0-b300-485d605f4717">
|
|
<topic>wordpress -- SQL injection vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>wordpress</name>
|
|
<range><lt>3.0.2,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>de-wordpress</name>
|
|
<name>zh-wordpress-zh_CN</name>
|
|
<name>zh-wordpress-zh_TW</name>
|
|
<range><lt>3.0.2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Vendor reports:</p>
|
|
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4257">
|
|
<p>SQL injection vulnerability in the do_trackbacks function in
|
|
wp-includes/comment.php in WordPress before 3.0.2 allows remote
|
|
authenticated users to execute arbitrary SQL commands via the Send
|
|
Trackbacks field.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2010-4257</cvename>
|
|
<url>http://www.cvedetails.com/cve/CVE-2010-4257/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-11-16</discovery>
|
|
<entry>2011-02-05</entry>
|
|
<modified>2011-02-09</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="f9258873-2ee2-11e0-afcd-0015f2db7bde">
|
|
<topic>vlc -- Insufficient input validation in MKV demuxer</topic>
|
|
<affects>
|
|
<package>
|
|
<name>vlc</name>
|
|
<range><lt>1.1.7</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>VLC team reports:</p>
|
|
<blockquote cite="http://www.videolan.org/security/sa1102.html">
|
|
<p>When parsing an invalid MKV (Matroska or WebM) file, input
|
|
validation are insufficient.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://www.videolan.org/security/sa1102.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-01-26</discovery>
|
|
<entry>2011-02-02</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="8015600f-2c80-11e0-9cc1-00163e5bf4f9">
|
|
<topic>maradns -- denial of service when resolving a long DNS hostname</topic>
|
|
<affects>
|
|
<package>
|
|
<name>maradns</name>
|
|
<range><lt>1.4.06</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>MaraDNS developer Sam Trenholme reports:</p>
|
|
<blockquote cite="http://samiam.org/blog/20110129.html">
|
|
<p>... a mistake in allocating an array of integers, allocating it
|
|
in bytes instead of sizeof(int) units. This resulted in a buffer
|
|
being too small, allowing it to be overwritten. The impact of this
|
|
programming error is that MaraDNS can be crashed by sending
|
|
MaraDNS a single "packet of death". Since the data placed in the
|
|
overwritten array can not be remotely controlled (it is a list of
|
|
increasing integers), there is no way to increase privileges
|
|
exploiting this bug.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>45966</bid>
|
|
<cvename>CVE-2011-0520</cvename>
|
|
<url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=610834</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-01-23</discovery>
|
|
<entry>2011-01-31</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="dc9f8335-2b3b-11e0-a91b-00e0815b8da8">
|
|
<topic>isc-dhcp-server -- DHCPv6 crash</topic>
|
|
<affects>
|
|
<package>
|
|
<name>isc-dhcp41-server</name>
|
|
<range><le>4.1.2,1</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>ISC reports:</p>
|
|
<blockquote cite="http://www.isc.org/software/dhcp/advisories/cve-2011-0413">
|
|
<p>When the DHCPv6 server code processes a message for an address
|
|
that was previously declined and internally tagged as abandoned
|
|
it can trigger an assert failure resulting in the server crashing.
|
|
This could be used to crash DHCPv6 servers remotely. This issue
|
|
only affects DHCPv6 servers. DHCPv4 servers are unaffected.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2011-0413</cvename>
|
|
<url>http://www.isc.org/software/dhcp/advisories/cve-2011-0413</url>
|
|
<url>http://www.kb.cert.org/vuls/id/686084</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-01-26</discovery>
|
|
<entry>2011-01-28</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="c8c927e5-2891-11e0-8f26-00151735203a">
|
|
<topic>bugzilla -- multiple serious vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>bugzilla</name>
|
|
<range><ge>2.14.*</ge><lt>3.6.4</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A Bugzilla Security Advisory reports:</p>
|
|
<blockquote cite="http://www.bugzilla.org/security/3.2.9/">
|
|
<p>This advisory covers three security issues that have recently been
|
|
fixed in the Bugzilla code:</p>
|
|
<ul>
|
|
<li>A weakness in Bugzilla could allow a user to gain unauthorized
|
|
access to another Bugzilla account.</li>
|
|
<li>A weakness in the Perl CGI.pm module allows injecting HTTP
|
|
headers and content to users via several pages in Bugzilla.</li>
|
|
<li>If you put a harmful "javascript:" or "data:" URL into
|
|
Bugzilla's "URL" field, then there are multiple situations in
|
|
which Bugzilla will unintentionally make that link clickable.</li>
|
|
<li>Various pages lack protection against cross-site request
|
|
forgeries.</li>
|
|
</ul>
|
|
<p>All affected installations are encouraged to upgrade as soon as
|
|
possible.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>25425</bid>
|
|
<cvename>CVE-2010-4568</cvename>
|
|
<cvename>CVE-2010-2761</cvename>
|
|
<cvename>CVE-2010-4411</cvename>
|
|
<cvename>CVE-2010-4572</cvename>
|
|
<cvename>CVE-2010-4567</cvename>
|
|
<cvename>CVE-2010-0048</cvename>
|
|
<cvename>CVE-2011-0046</cvename>
|
|
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=621591</url>
|
|
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=619594</url>
|
|
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=591165</url>
|
|
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=621572</url>
|
|
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=619588</url>
|
|
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=628034</url>
|
|
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=621090</url>
|
|
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=621105</url>
|
|
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=621107</url>
|
|
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=621108</url>
|
|
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=621109</url>
|
|
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=621110</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-01-24</discovery>
|
|
<entry>2011-01-25</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="7580f00e-280c-11e0-b7c8-00215c6a37bb">
|
|
<topic>dokuwiki -- multiple privilege escalation vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>dokuwiki</name>
|
|
<range><lt>20101107a</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Dokuwiki reports:</p>
|
|
<blockquote cite="http://bugs.dokuwiki.org/index.php?do=details&task_id=2136">
|
|
<p>This security update fixes problems in the XMLRPC
|
|
interface where ACLs where not checked correctly
|
|
sometimes, making it possible to access and write
|
|
information that should not have been accessible/writable.
|
|
This only affects users who have enabled the XMLRPC
|
|
interface (default is off) and have enabled XMLRPC
|
|
access for users who can't access/write all content
|
|
anyway (default is nobody, see <a href="http://www.dokuwiki.org/config:xmlrpcuser">http://www.dokuwiki.org/config:xmlrpcuser</a>
|
|
for details).</p>
|
|
<p>This update also includes a fix for a problem in
|
|
the general ACL checking function that could be exploited
|
|
to gain access to restricted pages and media files in rare
|
|
conditions (when you had rights for an id you could get
|
|
the same rights on ids where one character has been
|
|
replaced by a ".").</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://bugs.dokuwiki.org/index.php?do=details&task_id=2136</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-01-16</discovery>
|
|
<entry>2011-01-24</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="5ab9fb2a-23a5-11e0-a835-0003ba02bf30">
|
|
<topic>asterisk -- Exploitable Stack Buffer Overflow</topic>
|
|
<affects>
|
|
<package>
|
|
<name>asterisk14</name>
|
|
<range><gt>1.4.*</gt><lt>1.4.39.1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>asterisk16</name>
|
|
<range><gt>1.6.*</gt><lt>1.6.2.16.1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>asterisk18</name>
|
|
<range><gt>1.8.*</gt><lt>1.8.2.2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Asterisk Development Team reports:</p>
|
|
<blockquote cite="http://lists.digium.com/pipermail/asterisk-announce/2011-January/000297.html">
|
|
<p>The releases of Asterisk 1.4.38.1, 1.4.39.1, 1.6.1.21, 1.6.2.15.1,
|
|
1.6.2.16.2, 1.8.1.2, and 1.8.2.1 resolve an issue when forming an
|
|
outgoing SIP request while in pedantic mode, which can cause a stack
|
|
buffer to be made to overflow if supplied with carefully crafted
|
|
caller ID information. The issue and resolution are described in the
|
|
AST-2011-001 security advisory.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://downloads.asterisk.org/pub/security/AST-2011-001.pdf</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-01-18</discovery>
|
|
<entry>2011-01-19</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="2c2d4e83-2370-11e0-a91b-00e0815b8da8">
|
|
<topic>tarsnap -- cryptographic nonce reuse</topic>
|
|
<affects>
|
|
<package>
|
|
<name>tarsnap</name>
|
|
<range><ge>1.0.22</ge><le>1.0.27</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Colin Percival reports:</p>
|
|
<blockquote cite="http://www.daemonology.net/blog/2011-01-18-tarsnap-critical-security-bug.html">
|
|
<p>In versions 1.0.22 through 1.0.27 of Tarsnap, the CTR nonce value
|
|
is not incremented after each chunk is encrypted. (The CTR counter
|
|
is correctly incremented after each 16 bytes of data was processed,
|
|
but this counter is reset to zero for each new chunk.)</p>
|
|
<p>Note that since the Tarsnap client-server protocol is encrypted,
|
|
being able to intercept Tarsnap client-server traffic does not
|
|
provide an attacker with access to the data.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://www.daemonology.net/blog/2011-01-18-tarsnap-critical-security-bug.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-01-18</discovery>
|
|
<entry>2011-01-19</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="4c017345-1d89-11e0-bbee-0014a5e3cda6">
|
|
<topic>MoinMoin -- cross-site scripting vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>moinmoin</name>
|
|
<range><lt>1.9.3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The MoinMoin developers reports:</p>
|
|
<blockquote cite="http://hg.moinmo.in/moin/1.9/raw-file/1.9.3/docs/CHANGES">
|
|
<p>Fix XSS in Despam action (CVE-2010-0828)</p>
|
|
</blockquote>
|
|
<blockquote cite="http://moinmo.in/MoinMoinBugs/1.9.2UnescapedInputForThemeAddMsg">
|
|
<p>Fix XSS issues</p>
|
|
<ul>
|
|
<li>by escaping template name in messages</li>
|
|
<li>by fixing other places that had similar issues</li>
|
|
</ul>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>39110</bid>
|
|
<cvename>CVE-2010-0828</cvename>
|
|
<url>http://hg.moinmo.in/moin/1.9/raw-file/1.9.3/docs/CHANGES</url>
|
|
<url>http://moinmo.in/MoinMoinBugs/1.9.2UnescapedInputForThemeAddMsg</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-04-05</discovery>
|
|
<entry>2011-01-11</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="38bdf10e-2293-11e0-bfa4-001676740879">
|
|
<topic>tor -- remote code execution and crash</topic>
|
|
<affects>
|
|
<package>
|
|
<name>tor</name>
|
|
<range><lt>0.2.1.29</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>tor-devel</name>
|
|
<range><lt>0.2.2.21.a</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Tor Project reports:</p>
|
|
<blockquote cite="http://archives.seul.org/or/announce/Jan-2011/msg00000.html">
|
|
<p>A remote heap overflow vulnerability that can allow remote
|
|
code execution. Other fixes address a variety of assert and crash
|
|
bugs, most of which we think are hard to exploit remotely.
|
|
All Tor users should upgrade.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>45832</bid>
|
|
<cvename>CVE-2011-0427</cvename>
|
|
<freebsdpr>ports/154099</freebsdpr>
|
|
<mlist msgid="20110117155813.GG3300@moria.seul.org">http://archives.seul.org/or/announce/Jan-2011/msg00000.html</mlist>
|
|
<url>https://gitweb.torproject.org/tor.git/blob/release-0.2.1:/ChangeLog</url>
|
|
<url>https://gitweb.torproject.org/tor.git/blob/release-0.2.2:/ChangeLog</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-01-15</discovery>
|
|
<entry>2011-01-17</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="908f4cf2-1e8b-11e0-a587-001b77d09812">
|
|
<topic>sudo -- local privilege escalation</topic>
|
|
<affects>
|
|
<package>
|
|
<name>sudo</name>
|
|
<range><ge>1.7.0</ge><lt>1.7.4.5</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Todd Miller reports:</p>
|
|
<blockquote cite="http://www.sudo.ws/sudo/alerts/runas_group_pw.html">
|
|
<p>Beginning with sudo version 1.7.0 it has been possible
|
|
to grant permission to run a command using a specified
|
|
group via sudo's -g option (run as group), if allowed by
|
|
the sudoers file. A flaw exists in sudo's password
|
|
checking logic that allows a user to run a command
|
|
with only the group changed without being prompted
|
|
for a password.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2011-0010</cvename>
|
|
<url>http://www.sudo.ws/sudo/alerts/runas_group_pw.html</url>
|
|
<url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=609641</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-01-11</discovery>
|
|
<entry>2011-01-13</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="71612099-1e93-11e0-a587-001b77d09812">
|
|
<topic>subversion -- multiple DoS</topic>
|
|
<affects>
|
|
<package>
|
|
<name>subversion</name>
|
|
<range><lt>1.6.15</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>subversion-freebsd</name>
|
|
<range><lt>1.6.15</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Entry for CVE-2010-4539 says:</p>
|
|
<blockquote cite="http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-4539">
|
|
<p>The walk function in repos.c in the mod_dav_svn module
|
|
for the Apache HTTP Server, as distributed in Apache
|
|
Subversion before 1.6.15, allows remote authenticated
|
|
users to cause a denial of service (NULL pointer
|
|
dereference and daemon crash) via vectors that trigger
|
|
the walking of SVNParentPath collections.</p>
|
|
</blockquote>
|
|
<p>Entry for CVE-2010-4644 says:</p>
|
|
<blockquote cite="http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-4644">
|
|
<p>Multiple memory leaks in rev_hunt.c in Apache Subversion
|
|
before 1.6.15 allow remote authenticated users to cause
|
|
a denial of service (memory consumption and daemon crash)
|
|
via the -g option to the blame command.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>45655</bid>
|
|
<cvename>CVE-2010-4539</cvename>
|
|
<cvename>CVE-2010-4644</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-01-02</discovery>
|
|
<entry>2011-01-13</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="2b6ed5c7-1a7f-11e0-b61d-000c29d1636d">
|
|
<topic>php -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>php5</name>
|
|
<range><lt>5.3.5</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>php52</name>
|
|
<range><lt>5.2.17</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>PHP developers reports:</p>
|
|
<blockquote cite="http://www.php.net/releases/5_3_5.php">
|
|
<p>Security Enhancements and Fixes in PHP 5.3.5:</p>
|
|
<ul>
|
|
<li>Fixed bug #53632 (PHP hangs on numeric value
|
|
2.2250738585072011e-308). (CVE-2010-4645)</li>
|
|
</ul>
|
|
</blockquote>
|
|
<blockquote cite="http://www.php.net/releases/5_2_17.php">
|
|
<p>Security Enhancements and Fixes in PHP 5.2.17:</p>
|
|
<ul>
|
|
<li>Fixed bug #53632 (PHP hangs on numeric value
|
|
2.2250738585072011e-308). (CVE-2010-4645)</li>
|
|
</ul>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2010-4645</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-01-06</discovery>
|
|
<entry>2011-01-09</entry>
|
|
<modified>2011-01-09</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="e4fcf020-0447-11e0-becc-0022156e8794">
|
|
<topic>exim -- local privilege escalation</topic>
|
|
<affects>
|
|
<package>
|
|
<name>exim</name>
|
|
<range><lt>4.73</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>David Woodhouse reports:</p>
|
|
<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=661756#c3">
|
|
<p>Secondly a privilege escalation where the trusted 'exim'
|
|
user is able to tell Exim to use arbitrary config files,
|
|
in which further ${run ...} commands will be invoked as
|
|
root.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2010-4345</cvename>
|
|
<url>http://www.exim.org/lurker/message/20101209.022730.dbb6732d.en.html</url>
|
|
<url>https://bugzilla.redhat.com/show_bug.cgi?id=661756#c3</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-12-10</discovery>
|
|
<entry>2011-01-08</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="e177c410-1943-11e0-9d1c-000c29ba66d2">
|
|
<topic>mediawiki -- Clickjacking vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>mediawiki</name>
|
|
<range><gt>1.16</gt><lt>1.16.1</lt></range>
|
|
<range><gt>1.15</gt><lt>1.15.5_1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Clickjacking vulnerabilities:</p>
|
|
<blockquote cite="https://bugzilla.wikimedia.org/show_bug.cgi?id=26561">
|
|
<p>Clickjacking is a type of vulnerability discovered in 2008, which
|
|
is similar to CSRF. The attack involves displaying the target webpage
|
|
in a iframe embedded in a malicious website. Using CSS, the submit button
|
|
of the form on the targeit webpage is made invisible, and then overlaid
|
|
with some button or link on the malicious website that encourages
|
|
the user to click on it.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>https://bugzilla.wikimedia.org/show_bug.cgi?id=26561</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2011-01-04</discovery>
|
|
<entry>2011-01-06</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="06a12e26-142e-11e0-bea2-0015f2db7bde">
|
|
<topic>webkit-gtk2 -- Multiple vulnabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>webkit-gtk2</name>
|
|
<range><lt>1.2.6</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Gustavo Noronha Silva reports:</p>
|
|
<blockquote cite="http://gitorious.org/webkitgtk/stable/blobs/master/WebKit/gtk/NEWS">
|
|
<p>The patches to fix the following CVEs are included with help
|
|
from Huzaifa Sidhpurwala from the Red Hat security team.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2010-1791</cvename>
|
|
<cvename>CVE-2010-3812</cvename>
|
|
<cvename>CVE-2010-3813</cvename>
|
|
<cvename>CVE-2010-4197</cvename>
|
|
<cvename>CVE-2010-4198</cvename>
|
|
<cvename>CVE-2010-4204</cvename>
|
|
<cvename>CVE-2010-4206</cvename>
|
|
<cvename>CVE-2010-4577</cvename>
|
|
<url>http://gitorious.org/webkitgtk/stable/blobs/master/WebKit/gtk/NEWS</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-12-28</discovery>
|
|
<entry>2010-12-30</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="14a37474-1383-11e0-8a58-00215c6a37bb">
|
|
<topic>django -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>py23-django</name>
|
|
<name>py24-django</name>
|
|
<name>py25-django</name>
|
|
<name>py26-django</name>
|
|
<name>py27-django</name>
|
|
<name>py30-django</name>
|
|
<name>py31-django</name>
|
|
<range><gt>1.2</gt><lt>1.2.4</lt></range>
|
|
<range><gt>1.1</gt><lt>1.1.3</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>py23-django-devel</name>
|
|
<name>py24-django-devel</name>
|
|
<name>py25-django-devel</name>
|
|
<name>py26-django-devel</name>
|
|
<name>py27-django-devel</name>
|
|
<name>py30-django-devel</name>
|
|
<name>py31-django-devel</name>
|
|
<range><lt>15032,1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Django project reports:</p>
|
|
<blockquote cite="http://www.djangoproject.com/weblog/2010/dec/22/security/">
|
|
<p>Today the Django team is issuing multiple releases
|
|
-- Django 1.2.4, Django 1.1.3 and Django 1.3 beta 1 --
|
|
to remedy two security issues reported to us. All users
|
|
of affected versions of Django are urged to upgrade
|
|
immediately.</p>
|
|
<h3>Information leakage in Django administrative interface</h3>
|
|
<p>The Django administrative interface, django.contrib.admin
|
|
supports filtering of displayed lists of objects by fields
|
|
on the corresponding models, including across database-level
|
|
relationships. This is implemented by passing lookup arguments
|
|
in the querystring portion of the URL, and options on the
|
|
ModelAdmin class allow developers to specify particular
|
|
fields or relationships which will generate automatic links
|
|
for filtering.</p>
|
|
<h3>Denial-of-service attack in password-reset mechanism</h3>
|
|
<p>Django's bundled authentication framework,
|
|
django.contrib.auth, offers views which allow users to
|
|
reset a forgotten password. The reset mechanism involves
|
|
generating a one-time token composed from the user's ID,
|
|
the timestamp of the reset request converted to a base36
|
|
integer, and a hash derived from the user's current password
|
|
hash (which will change once the reset is complete, thus
|
|
invalidating the token).</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>45562</bid>
|
|
<bid>45563</bid>
|
|
<url>https://bugzilla.redhat.com/show_bug.cgi?id=665373</url>
|
|
<url>http://secunia.com/advisories/42715/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-12-22</discovery>
|
|
<entry>2010-12-29</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="ff8b419a-0ffa-11e0-becc-0022156e8794">
|
|
<topic>Drupal Views plugin -- cross-site scripting</topic>
|
|
<affects>
|
|
<package>
|
|
<name>drupal6-views</name>
|
|
<range><lt>2.12</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Drupal security team reports:</p>
|
|
<blockquote cite="http://drupal.org/node/999380">
|
|
<p>The Views module provides a flexible method for Drupal site
|
|
designers to control how lists and tables of content are
|
|
presented. Under certain circumstances, Views could display
|
|
parts of the page path without escaping, resulting in a
|
|
relected Cross Site Scripting (XSS) vulnerability. An attacker
|
|
could exploit this to gain full administrative access.</p>
|
|
<p>Mitigating factors: This vulnerability only occurs with a
|
|
specific combination of configuration options for a specific
|
|
View, but this combination is used in the default Views
|
|
provided by some additional modules. A malicious user would
|
|
need to get an authenticated administrative user to visit a
|
|
specially crafted URL.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2010-4521</cvename>
|
|
<url>http://drupal.org/node/999380</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-12-15</discovery>
|
|
<entry>2010-12-28</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="584c506d-0e98-11e0-b59b-0050569b2d21">
|
|
<topic>redmine -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>redmine</name>
|
|
<range><lt>1.0.5</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Jean-Philippe Lang reports:</p>
|
|
<blockquote cite="http://www.redmine.org/news/49">
|
|
<p>This release also fixes 3 security issues reported by
|
|
joernchen of Phenoelit:</p>
|
|
<ul>
|
|
<li>logged in users may be able to access private data
|
|
(affected versions: 1.0.x)</li>
|
|
<li>persistent XSS vulnerability in textile formatter
|
|
(affected versions: all previous releases)</li>
|
|
<li>remote command execution in bazaar repository adapter
|
|
(affected versions: 0.9.x, 1.0.x)</li>
|
|
</ul>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://www.redmine.org/news/49</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-12-23</discovery>
|
|
<entry>2010-12-23</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="4bd33bc5-0cd6-11e0-bfa4-001676740879">
|
|
<topic>tor -- remote crash and potential remote code execution</topic>
|
|
<affects>
|
|
<package>
|
|
<name>tor</name>
|
|
<range><lt>0.2.1.28</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>tor-devel</name>
|
|
<range><lt>0.2.2.20-alpha</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Tor Project reports:</p>
|
|
<blockquote cite="http://archives.seul.org/or/announce/Dec-2010/msg00000.html">
|
|
<p>Remotely exploitable bug that could be used to crash instances
|
|
of Tor remotely by overflowing on the heap. Remote-code execution
|
|
hasn't been confirmed, but can't be ruled out. Everyone should
|
|
upgrade.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>45500</bid>
|
|
<cvename>CVE-2010-1676</cvename>
|
|
<freebsdpr>ports/153326</freebsdpr>
|
|
<mlist msgid="20101220135830.GU3300@moria.seul.org">http://archives.seul.org/or/announce/Dec-2010/msg00000.html</mlist>
|
|
<mlist msgid="20101220141526.GS3255@moria.seul.org">http://archives.seul.org/or/talk/Dec-2010/msg00167.html</mlist>
|
|
<url>https://gitweb.torproject.org/tor.git/blob/release-0.2.1:/ChangeLog</url>
|
|
<url>https://gitweb.torproject.org/tor.git/blob/release-0.2.2:/ChangeLog</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-12-17</discovery>
|
|
<entry>2010-12-22</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="d560b346-08a2-11e0-bcca-0050568452ac">
|
|
<topic>YUI JavaScript library -- JavaScript injection exploits in Flash components</topic>
|
|
<affects>
|
|
<package>
|
|
<name>yahoo-ui</name>
|
|
<range><lt>2.8.2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The YUI team reports:</p>
|
|
<blockquote cite="http://yuilibrary.com/support/2.8.2/">
|
|
<p>A security-related defect was introduced in the YUI 2 Flash
|
|
component infrastructure beginning with the YUI 2.4.0 release.
|
|
This defect allows JavaScript injection exploits to be created
|
|
against domains that host affected YUI .swf files.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2010-4207</cvename>
|
|
<cvename>CVE-2010-4208</cvename>
|
|
<cvename>CVE-2010-4209</cvename>
|
|
<url>http://www.yuiblog.com/blog/2010/10/25/yui-2-8-2-security-update/</url>
|
|
<url>http://secunia.com/advisories/41955</url>
|
|
<url>http://www.openwall.com/lists/oss-security/2010/11/07/1</url>
|
|
<url>http://yuilibrary.com/support/2.8.2/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-10-25</discovery>
|
|
<entry>2010-12-15</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="2a41233d-10e7-11e0-becc-0022156e8794">
|
|
<topic>php-zip -- multiple Denial of Service vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>php5-zip</name>
|
|
<range><lt>5.3.4</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>php52-zip</name>
|
|
<range><lt>5.2.15</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The following DoS conditions in Zip extension
|
|
were fixed in PHP 5.3.4 and PHP 5.2.15:</p>
|
|
<ul>
|
|
<li>
|
|
<blockquote cite="http://www.php.net/releases/5_3_4.php">
|
|
<p>Fixed crash in zip extract method (possible
|
|
CWE-170).</p>
|
|
</blockquote>
|
|
</li>
|
|
<li>
|
|
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3709">
|
|
<p>The ZipArchive::getArchiveComment function
|
|
in PHP 5.2.x through 5.2.14 and 5.3.x through 5.3.3
|
|
allows context-dependent attackers to cause a denial
|
|
of service (NULL pointer dereference and application
|
|
crash) via a crafted ZIP archive.</p>
|
|
</blockquote>
|
|
</li>
|
|
</ul>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2010-3709</cvename>
|
|
<url>http://www.php.net/releases/5_3_4.php</url>
|
|
<url>http://www.php.net/releases/5_2_15.php</url>
|
|
<url>http://securityreason.com/achievement_securityalert/90</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-12-13</discovery>
|
|
<entry>2011-01-13</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="c623f058-10e7-11e0-becc-0022156e8794">
|
|
<topic>php-filter -- Denial of Service</topic>
|
|
<affects>
|
|
<package>
|
|
<name>php5-filter</name>
|
|
<range><lt>5.3.4</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>php52-filter</name>
|
|
<range><lt>5.2.15</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The following DoS condition in filter extension
|
|
was fixed in PHP 5.3.4 and PHP 5.2.15:</p>
|
|
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3710">
|
|
<p>Stack consumption vulnerability in the filter_var
|
|
function in PHP 5.2.x through 5.2.14 and 5.3.x through
|
|
5.3.3, when FILTER_VALIDATE_EMAIL mode is used, allows
|
|
remote attackers to cause a denial of service (memory
|
|
consumption and application crash) via a long e-mail
|
|
address string.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2010-3710</cvename>
|
|
<url>http://www.php.net/releases/5_3_4.php</url>
|
|
<url>http://www.php.net/releases/5_2_15.php</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-12-13</discovery>
|
|
<entry>2011-01-13</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="1a0704e7-0edf-11e0-becc-0022156e8794">
|
|
<topic>php-imap -- Denial of Service</topic>
|
|
<affects>
|
|
<package>
|
|
<name>php5-imap</name>
|
|
<range><lt>5.3.4</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>php52-imap</name>
|
|
<range><lt>5.2.15</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The following DoS condition in IMAP extension
|
|
was fixed in PHP 5.3.4 and PHP 5.2.15:</p>
|
|
<blockquote cite="http://securitytracker.com/alerts/2010/Nov/1024761.html">
|
|
<p>A remote user can send specially crafted IMAP user name
|
|
or password data to trigger a double free memory error
|
|
in 'ext/imap/php_imap.c' and cause the target service
|
|
to crash.</p>
|
|
<p>It may be possible to execute arbitrary code.
|
|
However, code execution was not confirmed.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2010-4150</cvename>
|
|
<url>http://www.php.net/releases/5_3_4.php</url>
|
|
<url>http://www.php.net/releases/5_2_15.php</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-12-13</discovery>
|
|
<entry>2011-01-13</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="da3d381b-0ee6-11e0-becc-0022156e8794">
|
|
<topic>pecl-phar -- format string vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>pecl-phar</name>
|
|
<range><ge>0</ge></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Entry for CVE-2010-2094 says:</p>
|
|
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2094">
|
|
<p>Multiple format string vulnerabilities in the phar
|
|
extension in PHP 5.3 before 5.3.2 allow context-dependent
|
|
attackers to obtain sensitive information (memory
|
|
contents) and possibly execute arbitrary code via a
|
|
crafted phar:// URI that is not properly handled by the
|
|
(1) phar_stream_flush, (2) phar_wrapper_unlink,
|
|
(3) phar_parse_url, or (4) phar_wrapper_open_url functions
|
|
in ext/phar/stream.c; and the (5) phar_wrapper_open_dir
|
|
function in ext/phar/dirstream.c, which triggers errors
|
|
in the php_stream_wrapper_log_error function.</p>
|
|
</blockquote>
|
|
<p>PECL source code for PHAR extension shares the same code,
|
|
so it is vulnerable too.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2010-2094</cvename>
|
|
<url>http://php-security.org/2010/05/14/mops-2010-024-php-phar_stream_flush-format-string-vulnerability/index.html</url>
|
|
<url>http://php-security.org/2010/05/14/mops-2010-025-php-phar_wrapper_open_dir-format-string-vulnerability/index.htm</url>
|
|
<url>http://php-security.org/2010/05/14/mops-2010-026-php-phar_wrapper_unlink-format-string-vulnerability/index.htm</url>
|
|
<url>http://php-security.org/2010/05/14/mops-2010-027-php-phar_parse_url-format-string-vulnerabilities/index.htm</url>
|
|
<url>http://php-security.org/2010/05/14/mops-2010-028-php-phar_wrapper_open_url-format-string-vulnerabilities/index.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-12-13</discovery>
|
|
<entry>2011-01-13</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="3761df02-0f9c-11e0-becc-0022156e8794">
|
|
<topic>php -- NULL byte poisoning</topic>
|
|
<affects>
|
|
<package>
|
|
<name>php5</name>
|
|
<range><lt>5.3.4</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>php52</name>
|
|
<range><lt>5.2.17_12</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>PHP-specific version of NULL-byte poisoning was briefly
|
|
described by ShAnKaR:</p>
|
|
<blockquote cite="http://www.securityfocus.com/archive/1/archive/1/445788/100/0/threaded">
|
|
<p>Poison NULL byte vulnerability for perl CGI applications
|
|
was described in
|
|
<a href="http://artofhacking.com/files/phrack/phrack55/P55-07.TXT">[1]</a>.
|
|
ShAnKaR noted, that same vulnerability also affects
|
|
different PHP applications.</p>
|
|
</blockquote>
|
|
<p>PHP developers report that branch 5.3 received a fix:</p>
|
|
<blockquote cite="http://www.php.net/releases/5_3_4.php">
|
|
<p>Paths with NULL in them (foo\0bar.txt) are now considered
|
|
as invalid (CVE-2006-7243).</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2006-7243</cvename>
|
|
<url>http://www.securityfocus.com/archive/1/archive/1/445788/100/0/threaded</url>
|
|
<url>http://artofhacking.com/files/phrack/phrack55/P55-07.TXT</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-12-10</discovery>
|
|
<entry>2011-01-13</entry>
|
|
<modified>2012-11-25</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="73634294-0fa7-11e0-becc-0022156e8794">
|
|
<topic>php -- open_basedir bypass</topic>
|
|
<affects>
|
|
<package>
|
|
<name>php5</name>
|
|
<range><lt>5.3.4</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>php52</name>
|
|
<range><lt>5.2.15</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>MITRE reports:</p>
|
|
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3436">
|
|
<p>fopen_wrappers.c in PHP 5.3.x through 5.3.3 might allow
|
|
remote attackers to bypass open_basedir restrictions via
|
|
vectors related to the length of a filename.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>44723</bid>
|
|
<cvename>CVE-2010-3436</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-12-10</discovery>
|
|
<entry>2011-01-13</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="f3148a05-0fa7-11e0-becc-0022156e8794">
|
|
<topic>php -- corruption of $GLOBALS and $this variables via extract() method</topic>
|
|
<affects>
|
|
<package>
|
|
<name>php5</name>
|
|
<range><lt>5.3.4</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>php52</name>
|
|
<range><lt>5.2.15</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Off-by-one error in the sanity validator for the extract()
|
|
method allowed attackers to replace the values of $GLOBALS
|
|
and $this when mode EXTR_OVERWRITE was used.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://www.mail-archive.com/php-cvs@lists.php.net/msg47722.html</url>
|
|
<url>http://www.php.net/releases/5_2_15.php</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-12-10</discovery>
|
|
<entry>2011-01-13</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="b2a6fc0e-070f-11e0-a6e9-00215c6a37bb">
|
|
<cancelled/>
|
|
</vuln>
|
|
|
|
<vuln vid="1d8ff4a2-0445-11e0-8e32-000f20797ede">
|
|
<topic>mozilla -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>firefox</name>
|
|
<range><gt>3.6.*,1</gt><lt>3.6.13,1</lt></range>
|
|
<range><gt>3.5.*,1</gt><lt>3.5.16,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>libxul</name>
|
|
<range><gt>1.9.2.*</gt><lt>1.9.2.13</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-firefox</name>
|
|
<range><lt>3.6.13,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-firefox-devel</name>
|
|
<range><lt>3.5.16</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-seamonkey</name>
|
|
<range><gt>2.0.*</gt><lt>2.0.11</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-thunderbird</name>
|
|
<range><ge>3.1</ge><lt>3.1.7</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>seamonkey</name>
|
|
<range><gt>2.0.*</gt><lt>2.0.11</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>thunderbird</name>
|
|
<range><ge>3.0</ge><lt>3.0.11</lt></range>
|
|
<range><ge>3.1</ge><lt>3.1.7</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Mozilla Project reports:</p>
|
|
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
|
|
<p>MFSA 2010-74 Miscellaneous memory safety hazards (rv:1.9.2.13/ 1.9.1.16)</p>
|
|
<p>MFSA 2010-75 Buffer overflow while line breaking after document.write with long string</p>
|
|
<p>MFSA 2010-76 Chrome privilege escalation with window.open and isindex element</p>
|
|
<p>MFSA 2010-77 Crash and remote code execution using HTML tags inside a XUL tree</p>
|
|
<p>MFSA 2010-78 Add support for OTS font sanitizer</p>
|
|
<p>MFSA 2010-79 Java security bypass from LiveConnect loaded via data: URL meta refresh</p>
|
|
<p>MFSA 2010-80 Use-after-free error with nsDOMAttribute MutationObserver</p>
|
|
<p>MFSA 2010-81 Integer overflow vulnerability in NewIdArray</p>
|
|
<p>MFSA 2010-82 Incomplete fix for CVE-2010-0179</p>
|
|
<p>MFSA 2010-83 Location bar SSL spoofing using network error page</p>
|
|
<p>MFSA 2010-84 XSS hazard in multiple character encodings</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2010-3766</cvename>
|
|
<cvename>CVE-2010-3767</cvename>
|
|
<cvename>CVE-2010-3768</cvename>
|
|
<cvename>CVE-2010-3769</cvename>
|
|
<cvename>CVE-2010-3770</cvename>
|
|
<cvename>CVE-2010-3771</cvename>
|
|
<cvename>CVE-2010-3772</cvename>
|
|
<cvename>CVE-2010-3773</cvename>
|
|
<cvename>CVE-2010-3774</cvename>
|
|
<cvename>CVE-2010-3775</cvename>
|
|
<cvename>CVE-2010-3776</cvename>
|
|
<cvename>CVE-2010-3777</cvename>
|
|
<cvename>CVE-2010-3778</cvename>
|
|
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-74.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-75.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-76.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-77.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-78.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-79.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-80.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-81.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-82.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-83.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-84.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-12-09</discovery>
|
|
<entry>2010-12-10</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="4ccbd40d-03f7-11e0-bf50-001a926c7637">
|
|
<topic>krb5 -- client impersonation vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>krb5</name>
|
|
<range><ge>1.7.0</ge><lt>1.7.2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The MIT Kerberos team reports:</p>
|
|
<blockquote cite="http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-007.txt">
|
|
<p>MIT krb5 KDC may issue tickets not requested
|
|
by a client, based on an attacker-chosen KrbFastArmoredReq.</p>
|
|
<p>An authenticated remote attacker that controls a legitimate service
|
|
principal could obtain a valid service ticket to itself containing
|
|
valid KDC-generated authorization data for a client whose TGS-REQ it
|
|
has intercepted. The attacker could then use this ticket for
|
|
S4U2Proxy to impersonate the targeted client even if the client
|
|
never authenticated to the subverted service. The vulnerable
|
|
configuration is believed to be rare.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>45122</bid>
|
|
<cvename>CVE-2010-4021</cvename>
|
|
<url>http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-007.txt</url>
|
|
<url>http://osvdb.org/69607</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-11-30</discovery>
|
|
<entry>2010-12-09</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="1d193bba-03f6-11e0-bf50-001a926c7637">
|
|
<topic>krb5 -- RFC 3961 key-derivation checksum handling vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>krb5</name>
|
|
<range><ge>1.8.0</ge><le>1.8.3</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The MIT Kerberos team reports:</p>
|
|
<blockquote cite="http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-007.txt">
|
|
<p>MIT krb5 (releases incorrectly accepts RFC 3961
|
|
key-derivation checksums using RC4 keys when verifying AD-SIGNEDPATH
|
|
and AD-KDC-ISSUED authorization data.</p>
|
|
<p>An authenticated remote attacker that controls a legitimate service
|
|
principal has a 1/256 chance of forging the AD-SIGNEDPATH signature
|
|
if the TGT key is RC4, allowing it to use self-generated "evidence"
|
|
tickets for S4U2Proxy, instead of tickets obtained from the user or
|
|
with S4U2Self. Configurations using RC4 for the TGT key are
|
|
believed to be rare.</p>
|
|
<p>An authenticated remote attacker has a 1/256 chance of forging
|
|
AD-KDC-ISSUED signatures on authdata elements in tickets having
|
|
an RC4 service key, resulting in privilege escalation against
|
|
a service that relies on these signatures. There are no known
|
|
uses of the KDC-ISSUED authdata container at this time.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>45117</bid>
|
|
<cvename>CVE-2010-4020</cvename>
|
|
<url>http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-007.txt</url>
|
|
<url>http://osvdb.org/69608</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-11-30</discovery>
|
|
<entry>2010-12-09</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="9f971cea-03f5-11e0-bf50-001a926c7637">
|
|
<topic>krb5 -- unkeyed PAC checksum handling vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>krb5</name>
|
|
<range><ge>1.7.0</ge><lt>1.7.2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The MIT Kerberos team reports:</p>
|
|
<blockquote cite="http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-007.txt">
|
|
<p>MIT krb5 incorrectly accepts an unkeyed checksum for PAC
|
|
signatures.</p>
|
|
<p>An authenticated remote attacker can forge PACs if using a KDC that
|
|
does not filter client-provided PAC data. This can result in
|
|
privilege escalation against a service that relies on PAC contents
|
|
to make authorization decisions.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>45116</bid>
|
|
<cvename>CVE-2010-1324</cvename>
|
|
<url>http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-007.txt</url>
|
|
<url>http://osvdb.org/69609</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-11-30</discovery>
|
|
<entry>2010-12-09</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="0d57c1d9-03f4-11e0-bf50-001a926c7637">
|
|
<topic>krb5 -- multiple checksum handling vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>krb5</name>
|
|
<range><ge>1.7.0</ge><lt>1.7.2</lt></range>
|
|
<range><ge>1.8.0</ge><le>1.8.3</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The MIT Kerberos team reports:</p>
|
|
<blockquote cite="http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-007.txt">
|
|
<p>MIT krb incorrectly accepts an unkeyed
|
|
checksum with DES session keys for version 2 (RFC 4121)
|
|
of the GSS-API krb5 mechanism.</p>
|
|
<p>An unauthenticated remote attacker can forge GSS tokens that are
|
|
intended to be integrity-protected but unencrypted, if the targeted
|
|
pre-existing application session uses a DES session key.</p>
|
|
<p>MIT krb5 KDC incorrectly accepts RFC
|
|
3961 key-derivation checksums using RC4 keys when verifying the
|
|
req-checksum in a KrbFastArmoredReq.</p>
|
|
<p>An unauthenticated remote attacker has a 1/256 chance of swapping a
|
|
client-issued KrbFastReq into a different KDC-REQ, if the armor
|
|
key is RC4. The consequences are believed to be minor.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>45116</bid>
|
|
<cvename>CVE-2010-1324</cvename>
|
|
<url>http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-007.txt</url>
|
|
<url>http://osvdb.org/69609</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-11-30</discovery>
|
|
<entry>2010-12-09</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="11bbccbc-03ee-11e0-bcdb-001fc61c2a55">
|
|
<topic>krb5 -- multiple checksum handling vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>krb5</name>
|
|
<range><ge>1.3.0</ge><lt>1.7.2</lt></range>
|
|
<range><ge>1.8.0</ge><le>1.8.3</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The MIT Kerberos team reports:</p>
|
|
<blockquote cite="http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-007.txt">
|
|
<p>MIT krb5 clients incorrectly accept an unkeyed checksums
|
|
in the SAM-2 preauthentication challenge.</p>
|
|
<p>An unauthenticated remote attacker could alter a SAM-2 challenge,
|
|
affecting the prompt text seen by the user or the kind of response
|
|
sent to the KDC. Under some circumstances, this can negate the
|
|
incremental security benefit of using a single-use authentication
|
|
mechanism token.</p>
|
|
<p>MIT krb5 incorrectly accepts RFC 3961 key-derivation checksums
|
|
using RC4 keys when verifying KRB-SAFE messages.</p>
|
|
<p>An unauthenticated remote attacker has a 1/256 chance of forging
|
|
KRB-SAFE messages in an application protocol if the targeted
|
|
pre-existing session uses an RC4 session key. Few application
|
|
protocols use KRB-SAFE messages.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>45118</bid>
|
|
<cvename>CVE-2010-1323</cvename>
|
|
<url>http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-007.txt</url>
|
|
<url>http://osvdb.org/69610</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-11-30</discovery>
|
|
<entry>2010-12-09</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="6887828f-0229-11e0-b84d-00262d5ed8ee">
|
|
<topic>chromium -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>chromium</name>
|
|
<range><lt>15.0.874.121</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Google Chrome Releases reports:</p>
|
|
<blockquote cite="http://googlechromereleases.blogspot.com/search/label/Stable%20updates">
|
|
<p>Fixed in 15.0.874.121:<br/>
|
|
[103259] High CVE-2011-3900: Out-of-bounds write in v8. Credit to
|
|
Christian Holler.</p>
|
|
|
|
<p>Fixed in 15.0.874.120:<br/>
|
|
[100465] High CVE-2011-3892: Double free in Theora decoder. Credit
|
|
to Aki Helin of OUSPG.<br/>
|
|
[100492] [100543] Medium CVE-2011-3893: Out of bounds reads in MKV
|
|
and Vorbis media handlers. Credit to Aki Helin of OUSPG.<br/>
|
|
[101172] High CVE-2011-3894: Memory corruption regression in VP8
|
|
decoding. Credit to Andrew Scherkus of the Chromium development
|
|
community.<br/>
|
|
[101458] High CVE-2011-3895: Heap overflow in Vorbis decoder.
|
|
Credit to Aki Helin of OUSPG.<br/>
|
|
[101624] High CVE-2011-3896: Buffer overflow in shader variable
|
|
mapping. Credit to Ken "strcpy" Russell of the Chromium
|
|
development community.<br/>
|
|
[102242] High CVE-2011-3897: Use-after-free in editing. Credit to
|
|
pa_kt reported through ZDI (ZDI-CAN-1416).<br/>
|
|
[102461] Low CVE-2011-3898: Failure to ask for permission to run
|
|
applets in JRE7. Credit to Google Chrome Security Team (Chris
|
|
Evans).</p>
|
|
|
|
<p>Fixed in 15.0.874.102:<br/>
|
|
[86758] High CVE-2011-2845: URL bar spoof in history handling.
|
|
Credit to Jordi Chancel.<br/>
|
|
[88949] Medium CVE-2011-3875: URL bar spoof with drag+drop of URLs.
|
|
Credit to Jordi Chancel.<br/>
|
|
[90217] Low CVE-2011-3876: Avoid stripping whitespace at the end of
|
|
download filenames. Credit to Marc Novak.<br/>
|
|
[91218] Low CVE-2011-3877: XSS in appcache internals page. Credit
|
|
to Google Chrome Security Team (Tom Sepez) plus independent
|
|
discovery by Juho Nurminen.<br/>
|
|
[94487] Medium CVE-2011-3878: Race condition in worker process
|
|
initialization. Credit to miaubiz.<br/>
|
|
[95374] Low CVE-2011-3879: Avoid redirect to chrome scheme URIs.
|
|
Credit to Masato Kinugawa.<br/>
|
|
[95992] Low CVE-2011-3880: Don't permit as a HTTP header delimiter.
|
|
Credit to Vladimir Vorontsov, ONsec company.<br/>
|
|
[96047] [96885] [98053] [99512] [99750] High CVE-2011-3881:
|
|
Cross-origin policy violations. Credit to Sergey Glazunov.<br/>
|
|
[96292] High CVE-2011-3882: Use-after-free in media buffer handling.
|
|
Credit to Google Chrome Security Team (Inferno).<br/>
|
|
[96902] High CVE-2011-3883: Use-after-free in counter handling.
|
|
Credit to miaubiz.<br/>
|
|
[97148] High CVE-2011-3884: Timing issues in DOM traversal. Credit
|
|
to Brian Ryner of the Chromium development community.<br/>
|
|
[97599] [98064] [98556] [99294] [99880] [100059] High CVE-2011-3885:
|
|
Stale style bugs leading to use-after-free. Credit to
|
|
miaubiz.<br/>
|
|
[98773] [99167] High CVE-2011-3886: Out of bounds writes in v8.
|
|
Credit to Christian Holler.<br/>
|
|
[98407] Medium CVE-2011-3887: Cookie theft with javascript URIs.
|
|
Credit to Sergey Glazunov.<br/>
|
|
[99138] High CVE-2011-3888: Use-after-free with plug-in and editing.
|
|
Credit to miaubiz.<br/>
|
|
[99211] High CVE-2011-3889: Heap overflow in Web Audio. Credit to
|
|
miaubiz.<br/>
|
|
[99553] High CVE-2011-3890: Use-after-free in video source handling.
|
|
Credit to Ami Fischman of the Chromium development community.<br/>
|
|
[100332] High CVE-2011-3891: Exposure of internal v8 functions.
|
|
Credit to Steven Keuchel of the Chromium development community
|
|
plus independent discovery by Daniel Divricean.</p>
|
|
|
|
<p>Fixed in 14.0.835.202:<br/>
|
|
[93788] High CVE-2011-2876: Use-after-free in text line box
|
|
handling. Credit to miaubiz.<br/>
|
|
[95072] High CVE-2011-2877: Stale font in SVG text handling. Credit
|
|
to miaubiz.<br/>
|
|
[95671] High CVE-2011-2878: Inappropriate cross-origin access to the
|
|
window prototype. Credit to Sergey Glazunov.<br/>
|
|
[96150] High CVE-2011-2879: Lifetime and threading issues in audio
|
|
node handling. Credit to Google Chrome Security Team
|
|
(Inferno).<br/>
|
|
[97451] [97520] [97615] High CVE-2011-2880: Use-after-free in the v8
|
|
bindings. Credit to Sergey Glazunov.<br/>
|
|
[97784] High CVE-2011-2881: Memory corruption with v8 hidden
|
|
objects. Credit to Sergey Glazunov.<br/>
|
|
[98089] Critical CVE-2011-3873: Memory corruption in shader
|
|
translator. Credit to Zhenyao Mo of the Chromium development
|
|
community.</p>
|
|
|
|
<p>Fixed in 14.0.835.163:<br/>
|
|
[49377] High CVE-2011-2835: Race condition in the certificate cache. Credit to Ryan Sleevi of the Chromium development community.<br/>
|
|
[51464] Low CVE-2011-2836: Infobar the Windows Media Player plug-in
|
|
to avoid click-free access to the system Flash. Credit to
|
|
electronixtar.<br/>
|
|
[Linux only] [57908] Low CVE-2011-2837: Use PIC / pie compiler
|
|
flags. Credit to wbrana.<br/>
|
|
[75070] Low CVE-2011-2838: Treat MIME type more authoritatively when
|
|
loading plug-ins. Credit to Michal Zalewski of the Google Security
|
|
Team.<br/>
|
|
[76771] High CVE-2011-2839: Crash in v8 script object wrappers.
|
|
Credit to Kostya Serebryany of the Chromium development
|
|
community.<br/>
|
|
[78427] [83031] Low CVE-2011-2840: Possible URL bar spoofs with
|
|
unusual user interaction. Credit to kuzzcc.<br/>
|
|
[78639] High CVE-2011-2841: Garbage collection error in PDF. Credit
|
|
to Mario Gomes.<br/>
|
|
[82438] Medium CVE-2011-2843: Out-of-bounds read with media buffers.
|
|
Credit to Kostya Serebryany of the Chromium development
|
|
community.<br/>
|
|
[85041] Medium CVE-2011-2844: Out-of-bounds read with mp3 files.
|
|
Credit to Mario Gomes.<br/>
|
|
[89219] High CVE-2011-2846: Use-after-free in unload event handling.
|
|
Credit to Arthur Gerkis.<br/>
|
|
[89330] High CVE-2011-2847: Use-after-free in document loader.
|
|
Credit to miaubiz.<br/>
|
|
[89564] Medium CVE-2011-2848: URL bar spoof with forward button.
|
|
Credit to Jordi Chancel.<br/>
|
|
[89795] Low CVE-2011-2849: Browser NULL pointer crash with
|
|
WebSockets. Credit to Arthur Gerkis.<br/>
|
|
[89991] Medium CVE-2011-3234: Out-of-bounds read in box handling.
|
|
Credit to miaubiz.<br/>
|
|
[90134] Medium CVE-2011-2850: Out-of-bounds read with Khmer
|
|
characters. Credit to miaubiz.<br/>
|
|
[90173] Medium CVE-2011-2851: Out-of-bounds read in video handling.
|
|
Credit to Google Chrome Security Team (Inferno).<br/>
|
|
[91120] High CVE-2011-2852: Off-by-one in v8. Credit to Christian
|
|
Holler.<br/>
|
|
[91197] High CVE-2011-2853: Use-after-free in plug-in handling.
|
|
Credit to Google Chrome Security Team (SkyLined).<br/>
|
|
[92651] [94800] High CVE-2011-2854: Use-after-free in ruby / table
|
|
style handing. Credit to Slawomir Blazek, and independent later
|
|
discoveries by miaubiz and Google Chrome Security Team
|
|
(Inferno).<br/>
|
|
[92959] High CVE-2011-2855: Stale node in stylesheet handling.
|
|
Credit to Arthur Gerkis.<br/>
|
|
[93416] High CVE-2011-2856: Cross-origin bypass in v8. Credit to
|
|
Daniel Divricean.<br/>
|
|
[93420] High CVE-2011-2857: Use-after-free in focus controller.
|
|
Credit to miaubiz.<br/>
|
|
[93472] High CVE-2011-2834: Double free in libxml XPath handling.
|
|
Credit to Yang Dingning from NCNIPC, Graduate University of
|
|
Chinese Academy of Sciences.<br/>
|
|
[93497] Medium CVE-2011-2859: Incorrect permissions assigned to
|
|
non-gallery pages. Credit to Bernhard "Bruhns" Brehm of Recurity
|
|
Labs.<br/>
|
|
[93587] High CVE-2011-2860: Use-after-free in table style handling.
|
|
Credit to miaubiz.<br/>
|
|
[93596] Medium CVE-2011-2861: Bad string read in PDF. Credit to Aki
|
|
Helin of OUSPG.<br/>
|
|
[93906] High CVE-2011-2862: Unintended access to v8 built-in
|
|
objects. Credit to Sergey Glazunov.<br/>
|
|
[95563] Medium CVE-2011-2864: Out-of-bounds read with Tibetan
|
|
characters. Credit to Google Chrome Security Team (Inferno).<br/>
|
|
[95625] Medium CVE-2011-2858: Out-of-bounds read with triangle
|
|
arrays. Credit to Google Chrome Security Team (Inferno).<br/>
|
|
[95917] Low CVE-2011-2874: Failure to pin a self-signed cert for a
|
|
session. Credit to Nishant Yadant of VMware and Craig Chamberlain
|
|
(@randomuserid).<br/>
|
|
High CVE-2011-2875: Type confusion in v8 object sealing. Credit to
|
|
Christian Holler.</p>
|
|
|
|
<p>Fixed in 13.0.782.215:<br/>
|
|
[89402] High CVE-2011-2821: Double free in libxml XPath handling.
|
|
Credit to Yang Dingning from NCNIPC, Graduate University of
|
|
Chinese Academy of Sciences.<br/>
|
|
[82552] High CVE-2011-2823: Use-after-free in line box handling.
|
|
Credit to Google Chrome Security Team (SkyLined) and independent
|
|
later discovery by miaubiz.<br/>
|
|
[88216] High CVE-2011-2824: Use-after-free with counter nodes.
|
|
Credit to miaubiz.<br/>
|
|
[88670] High CVE-2011-2825: Use-after-free with custom fonts. Credit
|
|
to wushi of team509 reported through ZDI (ZDI-CAN-1283), plus
|
|
indepdendent later discovery by miaubiz.<br/>
|
|
[87453] High CVE-2011-2826: Cross-origin violation with empty
|
|
origins. Credit to Sergey Glazunov.<br/>
|
|
[90668] High CVE-2011-2827: Use-after-free in text searching. Credit
|
|
to miaubiz.<br/>
|
|
[91517] High CVE-2011-2828: Out-of-bounds write in v8. Credit to
|
|
Google Chrome Security Team (SkyLined).<br/>
|
|
[32-bit only] [91598] High CVE-2011-2829: Integer overflow in
|
|
uniform arrays. Credit to Sergey Glazunov.<br/>
|
|
[Linux only] [91665] High CVE-2011-2839: Buggy memset() in PDF.
|
|
Credit to Aki Helin of OUSPG.</p>
|
|
|
|
<p>Fixed in 13.0.782.107:<br/>
|
|
[75821] Medium CVE-2011-2358: Always confirm an extension install
|
|
via a browser dialog. Credit to Sergey Glazunov.<br/>
|
|
[78841] High CVE-2011-2359: Stale pointer due to bad line box
|
|
tracking in rendering. Credit to miaubiz and Martin Barbella.<br/>
|
|
[79266] Low CVE-2011-2360: Potential bypass of dangerous file
|
|
prompt. Credit to kuzzcc.<br/>
|
|
[79426] Low CVE-2011-2361: Improve designation of strings in the
|
|
basic auth dialog. Credit to kuzzcc.<br/>
|
|
[Linux only] [81307] Medium CVE-2011-2782: File permissions error
|
|
with drag and drop. Credit to Evan Martin of the Chromium
|
|
development community.<br/>
|
|
[83273] Medium CVE-2011-2783: Always confirm a developer mode NPAPI
|
|
extension install via a browser dialog. Credit to Sergey
|
|
Glazunov.<br/>
|
|
[83841] Low CVE-2011-2784: Local file path disclosure via GL
|
|
program log. Credit to kuzzcc.<br/>
|
|
[84402] Low CVE-2011-2785: Sanitize the homepage URL in extensions.
|
|
Credit to kuzzcc.<br/>
|
|
[84600] Low CVE-2011-2786: Make sure the speech input bubble is
|
|
always on-screen. Credit to Olli Pettay of Mozilla.<br/>
|
|
[84805] Medium CVE-2011-2787: Browser crash due to GPU lock
|
|
re-entrancy issue. Credit to kuzzcc.<br/>
|
|
[85559] Low CVE-2011-2788: Buffer overflow in inspector
|
|
serialization. Credit to Mikolaj Malecki.<br/>
|
|
[85808] Medium CVE-2011-2789: Use after free in Pepper plug-in
|
|
instantiation. Credit to Mario Gomes and kuzzcc.<br/>
|
|
[86502] High CVE-2011-2790: Use-after-free with floating styles.
|
|
Credit to miaubiz.<br/>
|
|
[86900] High CVE-2011-2791: Out-of-bounds write in ICU. Credit to
|
|
Yang Dingning from NCNIPC, Graduate University of Chinese Academy
|
|
of Sciences.<br/>
|
|
[87148] High CVE-2011-2792: Use-after-free with float removal.
|
|
Credit to miaubiz.<br/>
|
|
[87227] High CVE-2011-2793: Use-after-free in media selectors.
|
|
Credit to miaubiz.<br/>
|
|
[87298] Medium CVE-2011-2794: Out-of-bounds read in text iteration.
|
|
Credit to miaubiz.<br/>
|
|
[87339] Medium CVE-2011-2795: Cross-frame function leak. Credit to
|
|
Shih Wei-Long.<br/>
|
|
[87548] High CVE-2011-2796: Use-after-free in Skia. Credit to Google
|
|
Chrome Security Team (Inferno) and Kostya Serebryany of the
|
|
Chromium development community.<br/>
|
|
[87729] High CVE-2011-2797: Use-after-free in resource caching.
|
|
Credit to miaubiz.<br/>
|
|
[87815] Low CVE-2011-2798: Prevent a couple of internal schemes from
|
|
being web accessible. Credit to sirdarckcat of the Google Security
|
|
Team.<br/>
|
|
[87925] High CVE-2011-2799: Use-after-free in HTML range handling.
|
|
Credit to miaubiz.<br/>
|
|
[88337] Medium CVE-2011-2800: Leak of client-side redirect target.
|
|
Credit to Juho Nurminen.<br/>
|
|
[88591] High CVE-2011-2802: v8 crash with const lookups. Credit to
|
|
Christian Holler.<br/>
|
|
[88827] Medium CVE-2011-2803: Out-of-bounds read in Skia paths.
|
|
Credit to Google Chrome Security Team (Inferno).<br/>
|
|
[88846] High CVE-2011-2801: Use-after-free in frame loader. Credit
|
|
to miaubiz.<br/>
|
|
[88889] High CVE-2011-2818: Use-after-free in display box rendering.
|
|
Credit to Martin Barbella.<br/>
|
|
[89142] High CVE-2011-2804: PDF crash with nested functions. Credit
|
|
to Aki Helin of OUSPG.<br/>
|
|
[89520] High CVE-2011-2805: Cross-origin script injection. Credit to
|
|
Sergey Glazunov.<br/>
|
|
[90222] High CVE-2011-2819: Cross-origin violation in base URI
|
|
handling. Credit to Sergey Glazunov.</p>
|
|
|
|
<p>Fixed in 12.0.742.112:<br/>
|
|
[77493] Medium CVE-2011-2345: Out-of-bounds read in NPAPI string
|
|
handling. Credit to Philippe Arteau.<br/>
|
|
[84355] High CVE-2011-2346: Use-after-free in SVG font handling.
|
|
Credit to miaubiz.<br/>
|
|
[85003] High CVE-2011-2347: Memory corruption in CSS parsing. Credit
|
|
to miaubiz.<br/>
|
|
[85102] High CVE-2011-2350: Lifetime and re-entrancy issues in the
|
|
HTML parser. Credit to miaubiz.<br/>
|
|
[85177] High CVE-2011-2348: Bad bounds check in v8. Credit to Aki
|
|
Helin of OUSPG.<br/>
|
|
[85211] High CVE-2011-2351: Use-after-free with SVG use element.
|
|
Credit to miaubiz.<br/>
|
|
[85418] High CVE-2011-2349: Use-after-free in text selection. Credit
|
|
to miaubiz.</p>
|
|
|
|
<p>Fixed in 12.0.742.91:<br/>
|
|
[73962] [79746] High CVE-2011-1808: Use-after-free due to integer
|
|
issues in float handling. Credit to miaubiz.<br/>
|
|
[75496] Medium CVE-2011-1809: Use-after-free in accessibility
|
|
support. Credit to Google Chrome Security Team (SkyLined).<br/>
|
|
[75643] Low CVE-2011-1810: Visit history information leak in CSS.
|
|
Credit to Jesse Mohrland of Microsoft and Microsoft Vulnerability
|
|
Research (MSVR).<br/>
|
|
[76034] Low CVE-2011-1811: Browser crash with lots of form
|
|
submissions. Credit to "DimitrisV22".<br/>
|
|
[77026] Medium CVE-2011-1812: Extensions permission bypass. Credit
|
|
to kuzzcc.<br/>
|
|
[78516] High CVE-2011-1813: Stale pointer in extension framework.
|
|
Credit to Google Chrome Security Team (Inferno).<br/>
|
|
[79362] Medium CVE-2011-1814: Read from uninitialized pointer.
|
|
Credit to Eric Roman of the Chromium development community.<br/>
|
|
[79862] Low CVE-2011-1815: Extension script injection into new tab
|
|
page. Credit to kuzzcc.<br/>
|
|
[80358] Medium CVE-2011-1816: Use-after-free in developer tools.
|
|
Credit to kuzzcc.<br/>
|
|
[81916] Medium CVE-2011-1817: Browser memory corruption in history
|
|
deletion. Credit to Collin Payne.<br/>
|
|
[81949] High CVE-2011-1818: Use-after-free in image loader. Credit
|
|
to miaubiz.<br/>
|
|
[83010] Medium CVE-2011-1819: Extension injection into chrome://
|
|
pages. Credit to Vladislavas Jarmalis, plus subsequent
|
|
independent discovery by Sergey Glazunov.<br/>
|
|
[83275] High CVE-2011-2332: Same origin bypass in v8. Credit to
|
|
Sergey Glazunov.<br/>
|
|
[83743] High CVE-2011-2342: Same origin bypass in DOM. Credit to
|
|
Sergey Glazunov.</p>
|
|
|
|
<p>Fixed in 11.0.696.71:<br/>
|
|
[72189] Low CVE-2011-1801: Pop-up blocker bypass. Credit to Chamal
|
|
De Silva.<br/>
|
|
[82546] High CVE-2011-1804: Stale pointer in floats rendering.
|
|
Credit to Martin Barbella.<br/>
|
|
[82873] Critical CVE-2011-1806: Memory corruption in GPU command
|
|
buffer. Credit to Google Chrome Security Team (Cris Neckar).<br/>
|
|
[82903] Critical CVE-2011-1807: Out-of-bounds write in blob
|
|
handling. Credit to Google Chrome Security Team (Inferno) and
|
|
Kostya Serebryany of the Chromium development community.</p>
|
|
|
|
<p>Fixed in 11.0.696.68:<br/>
|
|
[64046] High CVE-2011-1799: Bad casts in Chromium WebKit glue.
|
|
Credit to Google Chrome Security Team (SkyLined).<br/>
|
|
[80608] High CVE-2011-1800: Integer overflows in SVG filters.
|
|
Credit to Google Chrome Security Team (Cris Neckar).</p>
|
|
|
|
<p>Fixed in 11.0.696.57:<br/>
|
|
[61502] High CVE-2011-1303: Stale pointer in floating object
|
|
handling. Credit to Scott Hess of the Chromium development
|
|
community and Martin Barbella.<br/>
|
|
[70538] Low CVE-2011-1304: Pop-up block bypass via plug-ins. Credit
|
|
to Chamal De Silva.<br/>
|
|
[Linux / Mac only] [70589] Medium CVE-2011-1305: Linked-list race
|
|
in database handling. Credit to Kostya Serebryany of the
|
|
Chromium development community.<br/>
|
|
[71586] Medium CVE-2011-1434: Lack of thread safety in MIME
|
|
handling. Credit to Aki Helin.<br/>
|
|
[72523] Medium CVE-2011-1435: Bad extension with "tabs" permission
|
|
can capture local files. Credit to Cole Snodgrass.<br/>
|
|
[Linux only] [72910] Low CVE-2011-1436: Possible browser crash due
|
|
to bad interaction with X. Credit to miaubiz.<br/>
|
|
[73526] High CVE-2011-1437: Integer overflows in float rendering.
|
|
Credit to miaubiz.<br/>
|
|
[74653] High CVE-2011-1438: Same origin policy violation with
|
|
blobs. Credit to kuzzcc.<br/>
|
|
[Linux only] [74763] High CVE-2011-1439: Prevent interference
|
|
between renderer processes. Credit to Julien Tinnes of the
|
|
Google Security Team.<br/>
|
|
[75186] High CVE-2011-1440: Use-after-free with <ruby> tag
|
|
and CSS. Credit to Jose A. Vazquez.<br/>
|
|
[75347] High CVE-2011-1441: Bad cast with floating select lists.
|
|
Credit to Michael Griffiths.<br/>
|
|
[75801] High CVE-2011-1442: Corrupt node trees with mutation events.
|
|
Credit to Sergey Glazunov and wushi of team 509.<br/>
|
|
[76001] High CVE-2011-1443: Stale pointers in layering code. Credit
|
|
to Martin Barbella.<br/>
|
|
[Linux only] [76542] High CVE-2011-1444: Race condition in sandbox
|
|
launcher. Credit to Dan Rosenberg.<br/>
|
|
Medium CVE-2011-1445: Out-of-bounds read in SVG. Credit to wushi of
|
|
team509.<br/>
|
|
[76666] [77507] [78031] High CVE-2011-1446: Possible URL bar spoofs
|
|
with navigation errors and interrupted loads. Credit to
|
|
kuzzcc.<br/>
|
|
[76966] High CVE-2011-1447: Stale pointer in drop-down list
|
|
handling. Credit to miaubiz.<br/>
|
|
[77130] High CVE-2011-1448: Stale pointer in height calculations.
|
|
Credit to wushi of team509.<br/>
|
|
[77346] High CVE-2011-1449: Use-after-free in WebSockets. Credit to
|
|
Marek Majkowski.<br/>
|
|
Low CVE-2011-1450: Dangling pointers in file dialogs. Credit to
|
|
kuzzcc.<br/>
|
|
[77463] High CVE-2011-1451: Dangling pointers in DOM id map. Credit
|
|
to Sergey Glazunov.<br/>
|
|
[77786] Medium CVE-2011-1452: URL bar spoof with redirect and manual
|
|
reload. Credit to Jordi Chancel.<br/>
|
|
[79199] High CVE-2011-1454: Use-after-free in DOM id handling.
|
|
Credit to Sergey Glazunov.<br/>
|
|
[79361] Medium CVE-2011-1455: Out-of-bounds read with
|
|
multipart-encoded PDF. Credit to Eric Roman of the Chromium
|
|
development community.<br/>
|
|
[79364] High CVE-2011-1456: Stale pointers with PDF forms. Credit to
|
|
Eric Roman of the Chromium development community.</p>
|
|
|
|
<p>Fixed in 10.0.648.205:<br/>
|
|
[75629] Critical CVE-2011-1301: Use-after-free in the GPU process.
|
|
Credit to Google Chrome Security Team (Inferno).<br/>
|
|
[78524] Critical CVE-2011-1302: Heap overflow in the GPU process.
|
|
Credit to Christoph Diehl.</p>
|
|
|
|
<p>Fixed in 10.0.648.204:<br/>
|
|
[72517] High CVE-2011-1291: Buffer error in base string handling.
|
|
Credit to Alex Turpin.<br/>
|
|
[73216] High CVE-2011-1292: Use-after-free in the frame loader.
|
|
Credit to Slawomir Blazek.<br/>
|
|
[73595] High CVE-2011-1293: Use-after-free in HTMLCollection.
|
|
Credit to Sergey Glazunov.<br/>
|
|
[74562] High CVE-2011-1294: Stale pointer in CSS handling.
|
|
Credit to Sergey Glazunov.<br/>
|
|
[74991] High CVE-2011-1295: DOM tree corruption with broken node
|
|
parentage. Credit to Sergey Glazunov.<br/>
|
|
[75170] High CVE-2011-1296: Stale pointer in SVG text handling.
|
|
Credit to Sergey Glazunov.</p>
|
|
|
|
<p>Fixed in 10.0.648.133:<br/>
|
|
[75712] High Memory corruption in style handling.
|
|
Credit to Vincenzo Iozzo, Ralf Philipp Weinmann and Willem
|
|
Pinckaers reported through ZDI.</p>
|
|
|
|
<p>Fixed in 10.0.648.127:<br/>
|
|
[42765] Low Possible to navigate or close the top location in a
|
|
sandboxed frame. Credit to sirdarckcat of the Google Security
|
|
Team.<br/>
|
|
[Linux only] [49747] Low Work around an X server bug and crash with
|
|
long messages. Credit to Louis Lang.<br/>
|
|
[Linux only] [66962] Low Possible browser crash with parallel
|
|
print()s. Credit to Aki Helin of OUSPG.<br/>
|
|
[69187] Medium Cross-origin error message leak. Credit to Daniel
|
|
Divricean.<br/>
|
|
[69628] High Memory corruption with counter nodes. Credit to Martin
|
|
Barbella.<br/>
|
|
[70027] High Stale node in box layout. Credit to Martin
|
|
Barbella.<br/>
|
|
[70336] Medium Cross-origin error message leak with workers. Credit
|
|
to Daniel Divricean.<br/>
|
|
[70442] High Use after free with DOM URL handling. Credit to Sergey
|
|
Glazunov.<br/>
|
|
[Linux only] [70779] Medium Out of bounds read handling unicode
|
|
ranges. Credit to miaubiz.<br/>
|
|
[70877] High Same origin policy bypass in v8. Credit to Daniel
|
|
Divricean.<br/>
|
|
[70885] [71167] Low Pop-up blocker bypasses. Credit to Chamal de
|
|
Silva.<br/>
|
|
[71763] High Use-after-free in document script lifetime handling.
|
|
Credit to miaubiz.<br/>
|
|
[71788] High Out-of-bounds write in the OGG container. Credit to
|
|
Google Chrome Security Team (SkyLined); plus subsequent
|
|
independent discovery by David Weston of Microsoft and MSVR.<br/>
|
|
[72028] High Stale pointer in table painting. Credit to Martin
|
|
Barbella.<br/>
|
|
[73026] High Use of corrupt out-of-bounds structure in video code.
|
|
Credit to Tavis Ormandy of the Google Security Team.<br/>
|
|
[73066] High Crash with the DataView object. Credit to Sergey
|
|
Glazunov.<br/>
|
|
[73134] High Bad cast in text rendering. Credit to miaubiz.<br/>
|
|
[73196] High Stale pointer in WebKit context code. Credit to Sergey
|
|
Glazunov.<br/>
|
|
[73716] Low Leak of heap address in XSLT. Credit to Google Chrome
|
|
Security Team (Chris Evans).<br/>
|
|
[73746] High Stale pointer with SVG cursors. Credit to Sergey
|
|
Glazunov.<br/>
|
|
[74030] High DOM tree corruption with attribute handling. Credit to
|
|
Sergey Glazunov.<br/>
|
|
[74662] High Corruption via re-entrancy of RegExp code. Credit to
|
|
Christian Holler.<br/>
|
|
[74675] High Invalid memory access in v8. Credit to Christian
|
|
Holler.</p>
|
|
|
|
<p>Fixed in 9.0.597.107:<br/>
|
|
[54262] High URL bar spoof. Credit to Jordi Chancel.<br/>
|
|
[63732] High Crash with javascript dialogs. Credit to Sergey
|
|
Radchenko.<br/>
|
|
[68263] High Stylesheet node stale pointer. Credit to Sergey
|
|
Glazunov.<br/>
|
|
[68741] High Stale pointer with key frame rule. Credit to Sergey
|
|
Glazunov.<br/>
|
|
[70078] High Crash with forms controls. Credit to Stefan van
|
|
Zanden.<br/>
|
|
[70244] High Crash in SVG rendering. Credit to Slawomir Blazek.<br/>
|
|
[64-bit Linux only] [70376] Medium Out-of-bounds read in pickle
|
|
deserialization. Credit to Evgeniy Stepanov of the Chromium
|
|
development community.<br/>
|
|
[71114] High Stale node in table handling. Credit to Martin
|
|
Barbella.<br/>
|
|
[71115] High Stale pointer in table rendering. Credit to Martin
|
|
Barbella.<br/>
|
|
[71296] High Stale pointer in SVG animations. Credit to
|
|
miaubiz.<br/>
|
|
[71386] High Stale nodes in XHTML. Credit to wushi of team509.<br/>
|
|
[71388] High Crash in textarea handling. Credit to wushi of
|
|
team509.<br/>
|
|
[71595] High Stale pointer in device orientation. Credit to Sergey
|
|
Glazunov.<br/>
|
|
[71717] Medium Out-of-bounds read in WebGL. Credit to miaubiz.<br/>
|
|
[71855] High Integer overflow in textarea handling. Credit to
|
|
miaubiz.<br/>
|
|
[71960] Medium Out-of-bounds read in WebGL. Credit to Google Chrome
|
|
Security Team (Inferno).<br/>
|
|
[72214] High Accidental exposure of internal extension functions.
|
|
Credit to Tavis Ormandy of the Google Security Team.<br/>
|
|
[72437] High Use-after-free with blocked plug-ins. Credit to Chamal
|
|
de Silva.<br/>
|
|
[73235] High Stale pointer in layout. Credit to Martin Barbella.</p>
|
|
|
|
<p>Fixed in 9.0.597.94:<br/>
|
|
[67234] High Stale pointer in animation event handling. Credit to
|
|
Rik Cabanier.<br/>
|
|
[68120] High Use-after-free in SVG font faces. Credit to
|
|
miaubiz.<br/>
|
|
[69556] High Stale pointer with anonymous block handling. Credit to
|
|
Martin Barbella.<br/>
|
|
[69970] Medium Out-of-bounds read in plug-in handling. Credit to
|
|
Bill Budge of Google.<br/>
|
|
[70456] Medium Possible failure to terminate process on
|
|
out-of-memory condition. Credit to David Warren of CERT/CC.</p>
|
|
|
|
<p>Fixed in 9.0.597.84:<br/>
|
|
[Mac only] [42989] Low Minor sandbox leak via stat(). Credit to
|
|
Daniel Cheng of the Chromium development community.<br/>
|
|
[55831] High Use-after-free in image loading. Credit to Aki
|
|
Helin of OUSPG.<br/>
|
|
[59081] Low Apply some restrictions to cross-origin drag + drop.
|
|
Credit to Google Chrome Security Team (SkyLined) and the Google
|
|
Security Team (Michal Zalewski, David Bloom).<br/>
|
|
[62791] Low Browser crash with extension with missing key. Credit
|
|
to Brian Kirchoff.<br/>
|
|
[64051] High Crashing when printing in PDF event handler. Credit to
|
|
Aki Helin of OUSPG.<br/>
|
|
[65669] Low Handle merging of autofill profiles more gracefully.
|
|
Credit to Google Chrome Security Team (Inferno).<br/>
|
|
[Mac only] [66931] Low Work around a crash in the Mac OS 10.5 SSL
|
|
libraries. Credit to Dan Morrison.<br/>
|
|
[68244] Low Browser crash with bad volume setting. Credit to
|
|
Matthew Heidermann.<br/>
|
|
[69195] Critical Race condition in audio handling. Credit to the
|
|
gamers of Reddit!</p>
|
|
|
|
<p>Fixed in 8.0.552.237:<br/>
|
|
[58053] Medium Browser crash in extensions notification handling.
|
|
Credit to Eric Roman of the Chromium development community.<br/>
|
|
[65764] High Bad pointer handling in node iteration. Credit to
|
|
Sergey Glazunov.<br/>
|
|
[66334] High Crashes when printing multi-page PDFs. Credit to
|
|
Google Chrome Security Team (Chris Evans).<br/>
|
|
[66560] High Stale pointer with CSS + canvas. Credit to Sergey
|
|
Glazunov.<br/>
|
|
[66748] High Stale pointer with CSS + cursors. Credit to Jan
|
|
Tosovsk.<br/>
|
|
[67100] High Use after free in PDF page handling. Credit to Google
|
|
Chrome Security Team (Chris Evans).<br/>
|
|
[67208] High Stack corruption after PDF out-of-memory condition.
|
|
Credit to Jared Allar of CERT.<br/>
|
|
[67303] High Bad memory access with mismatched video frame sizes.
|
|
Credit to Aki Helin of OUSPG; plus independent discovery by
|
|
Google Chrome Security Team (SkyLined) and David Warren of
|
|
CERT.<br/>
|
|
[67363] High Stale pointer with SVG use element. Credited
|
|
anonymously; plus indepdent discovery by miaubiz.<br/>
|
|
[67393] Medium Uninitialized pointer in the browser triggered by
|
|
rogue extension. Credit to kuzzcc.<br/>
|
|
[68115] High Vorbis decoder buffer overflows. Credit to David
|
|
Warren of CERT.<br/>
|
|
[68170] High Buffer overflow in PDF shading. Credit to Aki Helin of
|
|
OUSPG.<br/>
|
|
[68178] High Bad cast in anchor handling. Credit to Sergey
|
|
Glazunov.<br/>
|
|
[68181] High Bad cast in video handling. Credit to Sergey
|
|
Glazunov.<br/>
|
|
[68439] High Stale rendering node after DOM node removal. Credit to
|
|
Martin Barbella; plus independent discovery by Google Chrome
|
|
Security Team (SkyLined).<br/>
|
|
[68666] Critical Stale pointer in speech handling. Credit to Sergey
|
|
Glazunov.</p>
|
|
|
|
<p>Fixed in 8.0.552.224:<br/>
|
|
[64-bit Linux only] [56449] High Bad validation for message
|
|
deserialization on 64-bit builds. Credit to Lei Zhang of the
|
|
Chromium development community.<br/>
|
|
[60761] Medium Bad extension can cause browser crash in tab
|
|
handling. Credit to kuzzcc.<br/>
|
|
[63529] Low Browser crash with NULL pointer in web worker handling.
|
|
Credit to Nathan Weizenbaum of Google.<br/>
|
|
[63866] Medium Out-of-bounds read in CSS parsing. Credit to Chris
|
|
Rohlf.<br/>
|
|
[64959] High Stale pointers in cursor handling. Credit to Slawomir
|
|
Blazek and Sergey Glazunov.</p>
|
|
|
|
<p>Fixed in 8.0.552.215:<br/>
|
|
[17655] Low Possible pop-up blocker bypass. Credit to Google Chrome
|
|
Security Team (SkyLined).<br/>
|
|
[55745] Medium Cross-origin video theft with canvas. Credit to
|
|
Nirankush Panchbhai and Microsoft Vulnerability Research
|
|
(MSVR).<br/>
|
|
[56237] Low Browser crash with HTML5 databases. Credit to Google
|
|
Chrome Security Team (Inferno).<br/>
|
|
[58319] Low Prevent excessive file dialogs, possibly leading to
|
|
browser crash. Credit to Cezary Tomczak (gosu.pl).<br/>
|
|
[59554] High Use after free in history handling. Credit to Stefan
|
|
Troger.<br/>
|
|
[Linux / Mac] [59817] Medium Make sure the "dangerous file types"
|
|
list is uptodate with the Windows platforms. Credit to Billy Rios
|
|
of the Google Security Team.<br/>
|
|
[61701] Low Browser crash with HTTP proxy authentication. Credit to
|
|
Mohammed Bouhlel.<br/>
|
|
[61653] Medium Out-of-bounds read regression in WebM video support.
|
|
Credit to Google Chrome Security Team (Chris Evans), based on
|
|
earlier testcases from Mozilla and Microsoft (MSVR).<br/>
|
|
[62127] High Crash due to bad indexing with malformed video. Credit
|
|
to miaubiz.<br/>
|
|
[62168] Medium Possible browser memory corruption via malicious
|
|
privileged extension. Credit to kuzzcc.<br/>
|
|
[62401] High Use after free with SVG animations. Credit to Slawomir
|
|
Blazek.<br/>
|
|
[63051] Medium Use after free in mouse dragging event handling.
|
|
Credit to kuzzcc.<br/>
|
|
[63444] High Double free in XPath handling. Credit to Yang Dingning
|
|
from NCNIPC, Graduate University of Chinese Academy of Sciences.</p>
|
|
|
|
<p>Fixed in 7.0.517.44:<br/>
|
|
[51602] High Use-after-free in text editing. Credit to David Bloom
|
|
of the Google Security Team, Google Chrome Security Team (Inferno)
|
|
and Google Chrome Security Team (Cris Neckar).<br/>
|
|
[55257] High Memory corruption with enormous text area. Credit to
|
|
wushi of team509.<br/>
|
|
[58657] High Bad cast with the SVG use element. Credit to the
|
|
kuzzcc.<br/>
|
|
[58731] High Invalid memory read in XPath handling. Credit to Bui
|
|
Quang Minh from Bkis (www.bkis.com).<br/>
|
|
[58741] High Use-after-free in text control selections. Credit to
|
|
"vkouchna".<br/>
|
|
[Linux only] [59320] High Integer overflows in font handling. Credit
|
|
to Aki Helin of OUSPG.<br/>
|
|
[60055] High Memory corruption in libvpx. Credit to Christoph
|
|
Diehl.<br/>
|
|
[60238] High Bad use of destroyed frame object. Credit to various
|
|
developers, including "gundlach".<br/>
|
|
[60327] [60769] [61255] High Type confusions with event objects.
|
|
Credit to "fam.lam" and Google Chrome Security Team
|
|
(Inferno).<br/>
|
|
[60688] High Out-of-bounds array access in SVG handling. Credit to
|
|
wushi of team509.</p>
|
|
|
|
<p>Fixed in 7.0.517.43:<br/>
|
|
[48225] [51727] Medium Possible autofill / autocomplete profile
|
|
spamming. Credit to Google Chrome Security Team (Inferno).<br/>
|
|
[48857] High Crash with forms. Credit to the Chromium development
|
|
community.<br/>
|
|
[50428] Critical Browser crash with form autofill. Credit to the
|
|
Chromium development community.<br/>
|
|
[51680] High Possible URL spoofing on page unload. Credit to kuzzcc;
|
|
plus independent discovery by Jordi Chancel.<br/>
|
|
[53002] Low Pop-up block bypass. Credit to kuzzcc.<br/>
|
|
[53985] Medium Crash on shutdown with Web Sockets. Credit to the
|
|
Chromium development community.<br/>
|
|
[Linux only] [54132] Low Bad construction of PATH variable. Credit
|
|
to Dan Rosenberg, Virtual Security Research.<br/>
|
|
[54500] High Possible memory corruption with animated GIF. Credit to
|
|
Simon Schaak.<br/>
|
|
[Linux only] [54794] High Failure to sandbox worker processes on
|
|
Linux. Credit to Google Chrome Security Team (Chris Evans).<br/>
|
|
[56451] High Stale elements in an element map. Credit to Michal
|
|
Zalewski of the Google Security Team.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://googlechromereleases.blogspot.com/search/label/Stable%20updates</url>
|
|
<cvename>CVE-2011-1290</cvename>
|
|
<cvename>CVE-2011-1291</cvename>
|
|
<cvename>CVE-2011-1292</cvename>
|
|
<cvename>CVE-2011-1293</cvename>
|
|
<cvename>CVE-2011-1294</cvename>
|
|
<cvename>CVE-2011-1295</cvename>
|
|
<cvename>CVE-2011-1296</cvename>
|
|
<cvename>CVE-2011-1301</cvename>
|
|
<cvename>CVE-2011-1302</cvename>
|
|
<cvename>CVE-2011-1303</cvename>
|
|
<cvename>CVE-2011-1304</cvename>
|
|
<cvename>CVE-2011-1305</cvename>
|
|
<cvename>CVE-2011-1434</cvename>
|
|
<cvename>CVE-2011-1435</cvename>
|
|
<cvename>CVE-2011-1436</cvename>
|
|
<cvename>CVE-2011-1437</cvename>
|
|
<cvename>CVE-2011-1438</cvename>
|
|
<cvename>CVE-2011-1439</cvename>
|
|
<cvename>CVE-2011-1440</cvename>
|
|
<cvename>CVE-2011-1441</cvename>
|
|
<cvename>CVE-2011-1442</cvename>
|
|
<cvename>CVE-2011-1443</cvename>
|
|
<cvename>CVE-2011-1444</cvename>
|
|
<cvename>CVE-2011-1445</cvename>
|
|
<cvename>CVE-2011-1446</cvename>
|
|
<cvename>CVE-2011-1447</cvename>
|
|
<cvename>CVE-2011-1448</cvename>
|
|
<cvename>CVE-2011-1449</cvename>
|
|
<cvename>CVE-2011-1450</cvename>
|
|
<cvename>CVE-2011-1451</cvename>
|
|
<cvename>CVE-2011-1452</cvename>
|
|
<cvename>CVE-2011-1454</cvename>
|
|
<cvename>CVE-2011-1455</cvename>
|
|
<cvename>CVE-2011-1456</cvename>
|
|
<cvename>CVE-2011-1799</cvename>
|
|
<cvename>CVE-2011-1800</cvename>
|
|
<cvename>CVE-2011-1801</cvename>
|
|
<cvename>CVE-2011-1804</cvename>
|
|
<cvename>CVE-2011-1806</cvename>
|
|
<cvename>CVE-2011-1807</cvename>
|
|
<cvename>CVE-2011-1808</cvename>
|
|
<cvename>CVE-2011-1809</cvename>
|
|
<cvename>CVE-2011-1810</cvename>
|
|
<cvename>CVE-2011-1811</cvename>
|
|
<cvename>CVE-2011-1812</cvename>
|
|
<cvename>CVE-2011-1813</cvename>
|
|
<cvename>CVE-2011-1814</cvename>
|
|
<cvename>CVE-2011-1815</cvename>
|
|
<cvename>CVE-2011-1816</cvename>
|
|
<cvename>CVE-2011-1817</cvename>
|
|
<cvename>CVE-2011-1818</cvename>
|
|
<cvename>CVE-2011-1819</cvename>
|
|
<cvename>CVE-2011-2332</cvename>
|
|
<cvename>CVE-2011-2342</cvename>
|
|
<cvename>CVE-2011-2345</cvename>
|
|
<cvename>CVE-2011-2346</cvename>
|
|
<cvename>CVE-2011-2347</cvename>
|
|
<cvename>CVE-2011-2348</cvename>
|
|
<cvename>CVE-2011-2349</cvename>
|
|
<cvename>CVE-2011-2350</cvename>
|
|
<cvename>CVE-2011-2351</cvename>
|
|
<cvename>CVE-2011-2358</cvename>
|
|
<cvename>CVE-2011-2359</cvename>
|
|
<cvename>CVE-2011-2360</cvename>
|
|
<cvename>CVE-2011-2361</cvename>
|
|
<cvename>CVE-2011-2782</cvename>
|
|
<cvename>CVE-2011-2783</cvename>
|
|
<cvename>CVE-2011-2784</cvename>
|
|
<cvename>CVE-2011-2785</cvename>
|
|
<cvename>CVE-2011-2786</cvename>
|
|
<cvename>CVE-2011-2787</cvename>
|
|
<cvename>CVE-2011-2788</cvename>
|
|
<cvename>CVE-2011-2789</cvename>
|
|
<cvename>CVE-2011-2790</cvename>
|
|
<cvename>CVE-2011-2791</cvename>
|
|
<cvename>CVE-2011-2792</cvename>
|
|
<cvename>CVE-2011-2793</cvename>
|
|
<cvename>CVE-2011-2794</cvename>
|
|
<cvename>CVE-2011-2795</cvename>
|
|
<cvename>CVE-2011-2796</cvename>
|
|
<cvename>CVE-2011-2797</cvename>
|
|
<cvename>CVE-2011-2798</cvename>
|
|
<cvename>CVE-2011-2799</cvename>
|
|
<cvename>CVE-2011-2800</cvename>
|
|
<cvename>CVE-2011-2801</cvename>
|
|
<cvename>CVE-2011-2802</cvename>
|
|
<cvename>CVE-2011-2803</cvename>
|
|
<cvename>CVE-2011-2804</cvename>
|
|
<cvename>CVE-2011-2805</cvename>
|
|
<cvename>CVE-2011-2818</cvename>
|
|
<cvename>CVE-2011-2819</cvename>
|
|
<cvename>CVE-2011-2821</cvename>
|
|
<cvename>CVE-2011-2823</cvename>
|
|
<cvename>CVE-2011-2824</cvename>
|
|
<cvename>CVE-2011-2825</cvename>
|
|
<cvename>CVE-2011-2826</cvename>
|
|
<cvename>CVE-2011-2827</cvename>
|
|
<cvename>CVE-2011-2828</cvename>
|
|
<cvename>CVE-2011-2829</cvename>
|
|
<cvename>CVE-2011-2834</cvename>
|
|
<cvename>CVE-2011-2835</cvename>
|
|
<cvename>CVE-2011-2836</cvename>
|
|
<cvename>CVE-2011-2837</cvename>
|
|
<cvename>CVE-2011-2838</cvename>
|
|
<cvename>CVE-2011-2839</cvename>
|
|
<cvename>CVE-2011-2840</cvename>
|
|
<cvename>CVE-2011-2841</cvename>
|
|
<cvename>CVE-2011-2842</cvename>
|
|
<cvename>CVE-2011-2843</cvename>
|
|
<cvename>CVE-2011-2844</cvename>
|
|
<cvename>CVE-2011-2845</cvename>
|
|
<cvename>CVE-2011-2846</cvename>
|
|
<cvename>CVE-2011-2847</cvename>
|
|
<cvename>CVE-2011-2848</cvename>
|
|
<cvename>CVE-2011-2849</cvename>
|
|
<cvename>CVE-2011-2850</cvename>
|
|
<cvename>CVE-2011-2851</cvename>
|
|
<cvename>CVE-2011-2852</cvename>
|
|
<cvename>CVE-2011-2853</cvename>
|
|
<cvename>CVE-2011-2854</cvename>
|
|
<cvename>CVE-2011-2855</cvename>
|
|
<cvename>CVE-2011-2856</cvename>
|
|
<cvename>CVE-2011-2857</cvename>
|
|
<cvename>CVE-2011-2858</cvename>
|
|
<cvename>CVE-2011-2859</cvename>
|
|
<cvename>CVE-2011-2860</cvename>
|
|
<cvename>CVE-2011-2861</cvename>
|
|
<cvename>CVE-2011-2862</cvename>
|
|
<cvename>CVE-2011-2864</cvename>
|
|
<cvename>CVE-2011-2874</cvename>
|
|
<cvename>CVE-2011-2875</cvename>
|
|
<cvename>CVE-2011-2876</cvename>
|
|
<cvename>CVE-2011-2877</cvename>
|
|
<cvename>CVE-2011-2878</cvename>
|
|
<cvename>CVE-2011-2879</cvename>
|
|
<cvename>CVE-2011-2880</cvename>
|
|
<cvename>CVE-2011-2881</cvename>
|
|
<cvename>CVE-2011-3234</cvename>
|
|
<cvename>CVE-2011-3873</cvename>
|
|
<cvename>CVE-2011-3873</cvename>
|
|
<cvename>CVE-2011-3875</cvename>
|
|
<cvename>CVE-2011-3876</cvename>
|
|
<cvename>CVE-2011-3877</cvename>
|
|
<cvename>CVE-2011-3878</cvename>
|
|
<cvename>CVE-2011-3879</cvename>
|
|
<cvename>CVE-2011-3880</cvename>
|
|
<cvename>CVE-2011-3881</cvename>
|
|
<cvename>CVE-2011-3882</cvename>
|
|
<cvename>CVE-2011-3883</cvename>
|
|
<cvename>CVE-2011-3884</cvename>
|
|
<cvename>CVE-2011-3885</cvename>
|
|
<cvename>CVE-2011-3886</cvename>
|
|
<cvename>CVE-2011-3887</cvename>
|
|
<cvename>CVE-2011-3888</cvename>
|
|
<cvename>CVE-2011-3889</cvename>
|
|
<cvename>CVE-2011-3890</cvename>
|
|
<cvename>CVE-2011-3891</cvename>
|
|
<cvename>CVE-2011-3892</cvename>
|
|
<cvename>CVE-2011-3893</cvename>
|
|
<cvename>CVE-2011-3894</cvename>
|
|
<cvename>CVE-2011-3895</cvename>
|
|
<cvename>CVE-2011-3896</cvename>
|
|
<cvename>CVE-2011-3897</cvename>
|
|
<cvename>CVE-2011-3898</cvename>
|
|
<cvename>CVE-2011-3900</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-10-19</discovery>
|
|
<entry>2010-12-07</entry>
|
|
<modified>2011-11-17</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="ed7fa1b4-ff59-11df-9759-080027284eaa">
|
|
<topic>proftpd -- Compromised source packages backdoor</topic>
|
|
<affects>
|
|
<package>
|
|
<name>proftpd</name>
|
|
<range><eq>1.3.3c_2</eq></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The ProFTPD Project team reports:</p>
|
|
<blockquote cite="http://proftpd.org/">
|
|
<p>The security issue is caused due to the distribution of compromised
|
|
ProFTPD 1.3.3c source code packages via the project's main FTP server
|
|
and all of the mirror servers, which contain a backdoor allowing
|
|
remote root access.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://sourceforge.net/mailarchive/message.php?msg_name=alpine.DEB.2.00.1012011542220.12930%40familiar.castaglia.org</url>
|
|
<url>http://secunia.com/advisories/42449</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-11-28</discovery>
|
|
<entry>2010-12-04</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="753f8185-5ba9-42a4-be02-3f55ee580093">
|
|
<topic>phpMyAdmin -- XSS attack in database search</topic>
|
|
<affects>
|
|
<package>
|
|
<name>phpMyAdmin</name>
|
|
<range><lt>3.3.8.1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>phpMyAdmin211</name>
|
|
<range><lt>2.11.11.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>phpMyAdmin team reports:</p>
|
|
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2010-8.php">
|
|
<p>It was possible to conduct a XSS attack using spoofed request on the
|
|
db search script.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<freebsdpr>ports/152685</freebsdpr>
|
|
<freebsdpr>ports/152686</freebsdpr>
|
|
<cvename>CVE-2010-4329</cvename>
|
|
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2010-8.php</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-11-29</discovery>
|
|
<entry>2010-11-30</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="f154a3c7-f7f4-11df-b617-00e0815b8da8">
|
|
<topic>isc-dhcp-server -- Empty link-address denial of service</topic>
|
|
<affects>
|
|
<package>
|
|
<name>isc-dhcp41-server</name>
|
|
<range><ge>4.1.0</ge><lt>4.1.2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>ISC reports:</p>
|
|
<blockquote cite="http://www.isc.org/software/dhcp/advisories/cve-2010-3611">
|
|
<p>If the server receives a DHCPv6 packet containing one or more
|
|
Relay-Forward messages, and none of them supply an address in the
|
|
Relay-Forward link-address field, then the server will crash. This
|
|
can be used as a single packet crash attack vector.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2010-3611</cvename>
|
|
<url>http://www.isc.org/software/dhcp/advisories/cve-2010-3611</url>
|
|
<url>http://www.kb.cert.org/vuls/id/102047</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-11-02</discovery>
|
|
<entry>2010-11-24</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="373e412e-f748-11df-96cd-0015f2db7bde">
|
|
<topic>OpenTTD -- Denial of service (server/client) via invalid read</topic>
|
|
<affects>
|
|
<package>
|
|
<name>openttd</name>
|
|
<range><ge>1.0.0</ge><lt>1.0.5</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The OpenTTD Team reports:</p>
|
|
<blockquote cite="http://security.openttd.org/en/CVE-2010-4168">
|
|
<p>When a client disconnects, without sending the "quit" or
|
|
"client error" message, the server has a chance of reading and
|
|
writing a just freed piece of memory. The writing can only
|
|
happen while the server is sending the map. Depending on what
|
|
happens directly after freeing the memory there is a chance of
|
|
segmentation fault, and thus a denial of service.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2010-4168</cvename>
|
|
<url>http://security.openttd.org/en/CVE-2010-4168</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-11-20</discovery>
|
|
<entry>2010-11-23</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="a3314314-f731-11df-a757-0011098ad87f">
|
|
<topic>horde-base -- XSS: VCARD attachments vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>horde-base</name>
|
|
<range><lt>3.3.11</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Horde team reports:</p>
|
|
<blockquote cite="http://article.gmane.org/gmane.comp.horde.announce/532">
|
|
<p>The major changes compared to Horde version 3.3.10 are:</p>
|
|
<p>* Fixed XSS vulnerability when viewing details of a vCard.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://article.gmane.org/gmane.comp.horde.announce/532</url>
|
|
<url>http://bugs.horde.org/ticket/9357</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-11-02</discovery>
|
|
<entry>2010-11-23</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="533d20e7-f71f-11df-9ae1-000bcdf0a03b">
|
|
<topic>proftpd -- remote code execution vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>proftpd</name>
|
|
<range><lt>1.3.3c</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Tippingpoint reports:</p>
|
|
<blockquote cite="http://www.zerodayinitiative.com/advisories/ZDI-10-229/">
|
|
<p>This vulnerability allows remote attackers to execute arbitrary
|
|
code on vulnerable installations of ProFTPD. Authentication is not
|
|
required to exploit this vulnerability.</p>
|
|
<p>The flaw exists within the proftpd server component which
|
|
listens by default on TCP port 21. When reading user input if a
|
|
TELNET_IAC escape sequence is encountered the process
|
|
miscalculates a buffer length counter value allowing a user
|
|
controlled copy of data to a stack buffer. A remote attacker can
|
|
exploit this vulnerability to execute arbitrary code under the
|
|
context of the proftpd process.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>44562</bid>
|
|
<cvename>CVE-2010-4221</cvename>
|
|
<url>http://www.zerodayinitiative.com/advisories/ZDI-10-229/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-11-02</discovery>
|
|
<entry>2010-11-23</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="3042c33a-f237-11df-9d02-0018fe623f2b">
|
|
<topic>openssl -- TLS extension parsing race condition</topic>
|
|
<affects>
|
|
<package>
|
|
<name>openssl</name>
|
|
<range><lt>1.0.0_2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>OpenSSL Team reports:</p>
|
|
<blockquote cite="http://openssl.org/news/secadv_20101116.txt">
|
|
<p>Rob Hulswit has found a flaw in the OpenSSL TLS server extension
|
|
code parsing which on affected servers can be exploited in a buffer
|
|
overrun attack.</p>
|
|
<p>Any OpenSSL based TLS server is vulnerable if it is multi-threaded
|
|
and uses OpenSSL's internal caching mechanism. Servers that are
|
|
multi-process and/or disable internal session caching are NOT
|
|
affected.</p>
|
|
<p>In particular the Apache HTTP server (which never uses OpenSSL
|
|
internal caching) and Stunnel (which includes its own workaround)
|
|
are NOT affected.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2010-3864</cvename>
|
|
<url>http://openssl.org/news/secadv_20101116.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-10-08</discovery>
|
|
<entry>2010-11-17</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="76b597e4-e9c6-11df-9e10-001b2134ef46">
|
|
<topic>linux-flashplugin -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>linux-flashplugin</name>
|
|
<range><lt>9.0r289</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-f8-flashplugin</name>
|
|
<name>linux-f10-flashplugin</name>
|
|
<range><lt>10.1r102</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Adobe Product Security Incident Response Team reports:</p>
|
|
<blockquote cite="http://www.adobe.com/support/security/bulletins/apsb10-26.html">
|
|
<p>Critical vulnerabilities have been identified in
|
|
Adobe Flash Player 10.1.85.3 and earlier versions for
|
|
Windows, Macintosh, Linux, and Solaris, and Adobe Flash Player
|
|
10.1.95.1 for Android. These vulnerabilities, including
|
|
CVE-2010-3654 referenced in Security Advisory APSA10-05,
|
|
could cause the application to crash and could potentially
|
|
allow an attacker to take control of the affected system.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2010-3636</cvename>
|
|
<cvename>CVE-2010-3637</cvename>
|
|
<cvename>CVE-2010-3638</cvename>
|
|
<cvename>CVE-2010-3639</cvename>
|
|
<cvename>CVE-2010-3640</cvename>
|
|
<cvename>CVE-2010-3641</cvename>
|
|
<cvename>CVE-2010-3642</cvename>
|
|
<cvename>CVE-2010-3643</cvename>
|
|
<cvename>CVE-2010-3644</cvename>
|
|
<cvename>CVE-2010-3645</cvename>
|
|
<cvename>CVE-2010-3646</cvename>
|
|
<cvename>CVE-2010-3647</cvename>
|
|
<cvename>CVE-2010-3648</cvename>
|
|
<cvename>CVE-2010-3649</cvename>
|
|
<cvename>CVE-2010-3650</cvename>
|
|
<cvename>CVE-2010-3652</cvename>
|
|
<cvename>CVE-2010-3654</cvename>
|
|
<cvename>CVE-2010-3676</cvename>
|
|
<url>http://www.adobe.com/support/security/bulletins/apsb10-26.html</url>
|
|
<url>http://www.adobe.com/support/security/advisories/apsa10-05.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-09-28</discovery>
|
|
<entry>2010-11-06</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="b2eaa7c2-e64a-11df-bc65-0022156e8794">
|
|
<topic>Wireshark -- DoS in the BER-based dissectors</topic>
|
|
<affects>
|
|
<package>
|
|
<name>wireshark</name>
|
|
<range><ge>1.3</ge><lt>1.4.1</lt></range>
|
|
<range><ge>1.0</ge><lt>1.2.12</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>wireshark-lite</name>
|
|
<range><ge>1.3</ge><lt>1.4.1</lt></range>
|
|
<range><ge>1.0</ge><lt>1.2.12</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>tshark</name>
|
|
<range><ge>1.3</ge><lt>1.4.1</lt></range>
|
|
<range><ge>1.0</ge><lt>1.2.12</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>tshark-lite</name>
|
|
<range><ge>1.3</ge><lt>1.4.1</lt></range>
|
|
<range><ge>1.0</ge><lt>1.2.12</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/41535">
|
|
<p>A vulnerability has been discovered in Wireshark, which can
|
|
be exploited by malicious people to cause a DoS (Denial of
|
|
Service).</p>
|
|
<p>The vulnerability is caused due to an infinite recursion
|
|
error in the "dissect_unknown_ber()" function in
|
|
epan/dissectors/packet-ber.c and can be exploited to cause a
|
|
stack overflow e.g. via a specially crafted SNMP packet.</p>
|
|
<p>The vulnerability is confirmed in version 1.4.0 and
|
|
reported in version 1.2.11 and prior and version 1.4.0 and
|
|
prior.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2010-3445</cvename>
|
|
<url>http://www.wireshark.org/lists/wireshark-announce/201010/msg00002.html</url>
|
|
<url>http://www.wireshark.org/lists/wireshark-announce/201010/msg00001.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-09-16</discovery>
|
|
<entry>2010-11-05</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="4ab29e12-e787-11df-adfa-00e0815b8da8">
|
|
<topic>Mailman -- cross-site scripting in web interface</topic>
|
|
<affects>
|
|
<package>
|
|
<name>mailman</name>
|
|
<range><lt>2.1.14</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/41265">
|
|
<p>Two vulnerabilities have been reported in Mailman, which
|
|
can be exploited by malicious users to conduct script
|
|
insertion attacks.</p>
|
|
<p>Certain input passed via the list descriptions is not
|
|
properly sanitised before being displayed to the user. This
|
|
can be exploited to insert arbitrary HTML and script code,
|
|
which will be executed in a user's browser session in context
|
|
of an affected site when the malicious data is being
|
|
viewed.</p>
|
|
<p>Successful exploitation requires "list owner" permissions.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>43187</bid>
|
|
<cvename>CVE-2010-3089</cvename>
|
|
<url>http://secunia.com/advisories/41265</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-09-14</discovery>
|
|
<entry>2010-11-03</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="96e776c7-e75c-11df-8f26-00151735203a">
|
|
<topic>OTRS -- Multiple XSS and denial of service vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>otrs</name>
|
|
<range><gt>2.3.*</gt><lt>2.4.9</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>OTRS Security Advisory reports:</p>
|
|
<blockquote cite="http://otrs.org/advisory/OSA-2010-02-en/">
|
|
<ul>
|
|
<li>Multiple Cross Site Scripting issues:
|
|
Missing HTML quoting allows authenticated agents or
|
|
customers to inject HTML tags. This vulnerability
|
|
allows an attacker to inject script code into the OTRS
|
|
web-interface which will be loaded and executed
|
|
in the browsers of system users.</li>
|
|
<li>Possible Denial of Service Attack:
|
|
Perl's regular expressions consume 100% CPU time
|
|
on the server if an agent or customer views an affected
|
|
article. To exploit this vulnerability the malicious user
|
|
needs to send extremely large HTML emails to your
|
|
system address.</li>
|
|
</ul>
|
|
</blockquote>
|
|
<blockquote cite="http://otrs.org/advisory/OSA-2010-03-en/">
|
|
<p>AgentTicketZoom is vulnerable to XSS attacks from HTML e-mails:</p>
|
|
<p>Whenever a customer sends an HTML e-mail and RichText is enabled
|
|
in OTRS, javascript contained in the email can do everything
|
|
in the OTRS agent interface that the agent himself could do.</p>
|
|
<p>Most relevant is that this type of exploit can be used in such
|
|
a way that the agent won't even detect he is being exploited.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2010-2080</cvename>
|
|
<cvename>CVE-2010-4071</cvename>
|
|
<url>http://otrs.org/advisory/OSA-2010-02-en/</url>
|
|
<url>http://otrs.org/advisory/OSA-2010-03-en/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-09-15</discovery>
|
|
<entry>2010-11-03</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="c223b00d-e272-11df-8e32-000f20797ede">
|
|
<topic>mozilla -- Heap buffer overflow mixing document.write and DOM insertion</topic>
|
|
<affects>
|
|
<package>
|
|
<name>firefox</name>
|
|
<range><gt>3.6.*,1</gt><lt>3.6.12,1</lt></range>
|
|
<range><gt>3.5.*,1</gt><lt>3.5.15,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>libxul</name>
|
|
<range><gt>1.9.2.*</gt><lt>1.9.2.12</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-firefox</name>
|
|
<range><lt>3.6.12,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-firefox-devel</name>
|
|
<range><lt>3.5.15</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-seamonkey</name>
|
|
<range><lt>2.0.10</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-thunderbird</name>
|
|
<range><lt>3.1.6</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>seamonkey</name>
|
|
<range><gt>2.0.*</gt><lt>2.0.10</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>thunderbird</name>
|
|
<range><ge>3.0</ge><lt>3.0.10</lt></range>
|
|
<range><ge>3.1</ge><lt>3.1.6</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Mozilla Project reports:</p>
|
|
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
|
|
<p>MFSA 2010-73 Heap buffer overflow mixing document.write and DOM insertion</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2010-3765</cvename>
|
|
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-73.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-10-27</discovery>
|
|
<entry>2010-10-28</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="aab187d4-e0f3-11df-b1ea-001999392805">
|
|
<topic>opera -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>opera</name>
|
|
<range><lt>10.63</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Opera Desktop Team reports:</p>
|
|
<blockquote cite="http://www.opera.com/docs/changelogs/unix/1063/">
|
|
<ul>
|
|
<li>Fixed an issue that allowed cross-domain checks to be bypassed,
|
|
allowing limited data theft using CSS, as reported by Isaac
|
|
Dawson.</li>
|
|
<li>Fixed an issue where manipulating the window could be used to
|
|
spoof the page address.</li>
|
|
<li>Fixed an issue with reloads and redirects that could allow
|
|
spoofing and cross-site scripting.</li>
|
|
<li>Fixed an issue that allowed private video streams to be
|
|
intercepted, as reported by Nirankush Panchbhai of Microsoft
|
|
Vulnerability Research.</li>
|
|
<li>Fixed an issue that caused JavaScript to run in the wrong
|
|
security context after manual interaction.</li>
|
|
</ul>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://www.opera.com/support/kb/view/971/</url>
|
|
<url>http://www.opera.com/support/kb/view/972/</url>
|
|
<url>http://www.opera.com/support/kb/view/973/</url>
|
|
<url>http://www.opera.com/support/kb/view/974/</url>
|
|
<url>http://www.opera.com/support/kb/view/976/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-10-12</discovery>
|
|
<entry>2010-10-26</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="0ddb57a9-da20-4e99-b048-4366092f3d31">
|
|
<topic>bzip2 -- integer overflow vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>bzip2</name>
|
|
<range><lt>1.0.6</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/41452">
|
|
<p>A vulnerability has been reported in bzip2, which can be exploited by
|
|
malicious people to cause a DoS (Denial of Service) or potentially
|
|
compromise a vulnerable system.</p>
|
|
<p>The vulnerability is caused due to an integer overflow in the
|
|
"BZ2_decompress()" function in decompress.c and can be exploited to
|
|
cause a crash or potentially execute arbitrary code.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<freebsdsa>SA-10:08.bzip2</freebsdsa>
|
|
<freebsdpr>ports/151364</freebsdpr>
|
|
<cvename>CVE-2010-0405</cvename>
|
|
<bid>43331</bid>
|
|
<mlist>http://www.openwall.com/lists/oss-security/2010/09/21/4</mlist>
|
|
<url>http://secunia.com/advisories/41452</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-09-21</discovery>
|
|
<entry>2010-10-25</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="18dc48fe-ca42-11df-aade-0050568f000c">
|
|
<topic>FreeBSD -- Integer overflow in bzip2 decompression</topic>
|
|
<affects>
|
|
<package>
|
|
<name>FreeBSD</name>
|
|
<range><gt>6.4</gt><lt>6.4_11</lt></range>
|
|
<range><gt>7.1</gt><lt>7.1_14</lt></range>
|
|
<range><gt>7.3</gt><lt>7.3_3</lt></range>
|
|
<range><gt>8.0</gt><lt>8.0_5</lt></range>
|
|
<range><gt>8.1</gt><lt>8.1_1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<h1>Problem Description:</h1>
|
|
<p>When decompressing data, the run-length encoded values are not
|
|
adequately sanity-checked, allowing for an integer overflow.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<freebsdsa>SA-10:08.bzip2</freebsdsa>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-09-20</discovery>
|
|
<entry>2010-10-24</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="7a09a8df-ca41-11df-aade-0050568f000c">
|
|
<topic>FreeBSD -- Lost mbuf flag resulting in data corruption</topic>
|
|
<affects>
|
|
<package>
|
|
<name>FreeBSD</name>
|
|
<range><gt>7.1</gt><lt>7.1_13</lt></range>
|
|
<range><gt>7.3</gt><lt>7.3_2</lt></range>
|
|
<range><gt>8.0</gt><lt>8.0_4</lt></range>
|
|
<range><gt>8.1</gt><lt>8.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<h1>Problem Description:</h1>
|
|
<p>The read-only flag is not correctly copied when a mbuf buffer
|
|
reference is duplicated. When the sendfile(2) system call is used to
|
|
transmit data over the loopback interface, this can result in the
|
|
backing pages for the transmitted file being modified, causing data
|
|
corruption.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<freebsdsa>SA-10:07.mbuf</freebsdsa>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-07-13</discovery>
|
|
<entry>2010-10-24</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="0dc91089-ca41-11df-aade-0050568f000c">
|
|
<topic>FreeBSD -- Unvalidated input in nfsclient</topic>
|
|
<affects>
|
|
<package>
|
|
<name>FreeBSD</name>
|
|
<range><gt>7.2</gt><lt>7.2_8</lt></range>
|
|
<range><gt>7.3</gt><lt>7.3_1</lt></range>
|
|
<range><gt>8.0</gt><lt>8.0_3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<h1>Problem Description:</h1>
|
|
<p>The NFS client subsystem fails to correctly validate the length of a
|
|
parameter provided by the user when a filesystem is mounted.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<freebsdsa>SA-10:06.nfsclient</freebsdsa>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-05-27</discovery>
|
|
<entry>2010-10-24</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="768cfe70-ca40-11df-aade-0050568f000c">
|
|
<topic>FreeBSD -- OPIE off-by-one stack overflow</topic>
|
|
<affects>
|
|
<package>
|
|
<name>FreeBSD</name>
|
|
<range><gt>6.4</gt><lt>6.4_10</lt></range>
|
|
<range><gt>7.1</gt><lt>7.1_12</lt></range>
|
|
<range><gt>7.2</gt><lt>7.2_8</lt></range>
|
|
<range><gt>7.3</gt><lt>7.3_1</lt></range>
|
|
<range><gt>8.0</gt><lt>8.0_3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<h1>Problem Description:</h1>
|
|
<p>A programming error in the OPIE library could allow an off-by-one
|
|
buffer overflow to write a single zero byte beyond the end of an
|
|
on-stack buffer.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<freebsdsa>SA-10:05.opie</freebsdsa>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-05-27</discovery>
|
|
<entry>2010-10-24</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="f6eb2279-ca3f-11df-aade-0050568f000c">
|
|
<topic>FreeBSD -- Insufficient environment sanitization in jail(8)</topic>
|
|
<affects>
|
|
<package>
|
|
<name>FreeBSD</name>
|
|
<range><gt>8.0</gt><lt>8.0_3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<h1>Problem Description:</h1>
|
|
<p>The jail(8) utility does not change the current working directory
|
|
while imprisoning. The current working directory can be accessed by
|
|
its descendants.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<freebsdsa>SA-10:04.jail</freebsdsa>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-05-27</discovery>
|
|
<entry>2010-10-24</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="97f09f2f-ca3f-11df-aade-0050568f000c">
|
|
<topic>FreeBSD -- ZFS ZIL playback with insecure permissions</topic>
|
|
<affects>
|
|
<package>
|
|
<name>FreeBSD</name>
|
|
<range><gt>7.1</gt><lt>7.1_10</lt></range>
|
|
<range><gt>7.2</gt><lt>7.2_6</lt></range>
|
|
<range><gt>8.0</gt><lt>8.0_2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<h1>Problem Description:</h1>
|
|
<p>When replaying setattr transaction, the replay code would set the
|
|
attributes with certain insecure defaults, when the logged
|
|
transaction did not touch these attributes.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<freebsdsa>SA-10:03.zfs</freebsdsa>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-01-06</discovery>
|
|
<entry>2010-10-24</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="48103b0a-ca3f-11df-aade-0050568f000c">
|
|
<topic>FreeBSD -- ntpd mode 7 denial of service</topic>
|
|
<affects>
|
|
<package>
|
|
<name>FreeBSD</name>
|
|
<range><gt>6.3</gt><lt>6.3_15</lt></range>
|
|
<range><gt>6.4</gt><lt>6.4_9</lt></range>
|
|
<range><gt>7.1</gt><lt>7.1_10</lt></range>
|
|
<range><gt>7.2</gt><lt>7.2_6</lt></range>
|
|
<range><gt>8.0</gt><lt>8.0_2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<h1>Problem Description:</h1>
|
|
<p>If ntpd receives a mode 7 (MODE_PRIVATE) request or error response
|
|
from a source address not listed in either a 'restrict ... noquery'
|
|
or a 'restrict ... ignore' section it will log the even and send a
|
|
mode 7 error response.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<freebsdsa>SA-10:02.ntpd</freebsdsa>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-01-06</discovery>
|
|
<entry>2010-10-24</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="e500b9bf-ca3e-11df-aade-0050568f000c">
|
|
<topic>FreeBSD -- BIND named(8) cache poisoning with DNSSEC validation</topic>
|
|
<affects>
|
|
<package>
|
|
<name>FreeBSD</name>
|
|
<range><gt>6.3</gt><lt>6.3_15</lt></range>
|
|
<range><gt>6.4</gt><lt>6.4_9</lt></range>
|
|
<range><gt>7.1</gt><lt>7.1_10</lt></range>
|
|
<range><gt>7.2</gt><lt>7.2_6</lt></range>
|
|
<range><gt>8.0</gt><lt>8.0_2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<h1>Problem Description:</h1>
|
|
<p>If a client requests DNSSEC records with the Checking Disabled (CD)
|
|
flag set, BIND may cache the unvalidated responses. These responses
|
|
may later be returned to another client that has not set the CD
|
|
flag.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<freebsdsa>SA-10:01.bind</freebsdsa>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-01-06</discovery>
|
|
<entry>2010-10-24</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="6e87b696-ca3e-11df-aade-0050568f000c">
|
|
<topic>FreeBSD -- Inappropriate directory permissions in freebsd-update(8)</topic>
|
|
<affects>
|
|
<package>
|
|
<name>FreeBSD</name>
|
|
<range><gt>6.3</gt><lt>6.3_14</lt></range>
|
|
<range><gt>6.4</gt><lt>6.4_8</lt></range>
|
|
<range><gt>7.1</gt><lt>7.1_9</lt></range>
|
|
<range><gt>7.2</gt><lt>7.2_5</lt></range>
|
|
<range><gt>8.0</gt><lt>8.0_1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<h1>Problem Description:</h1>
|
|
<p>When downloading updates to FreeBSD via 'freebsd-update fetch' or
|
|
'freebsd-update upgrade', the freebsd-update(8) utility copies
|
|
currently installed files into its working directory
|
|
(/var/db/freebsd-update by default) both for the purpose of merging
|
|
changes to configuration files and in order to be able to roll back
|
|
installed updates.</p>
|
|
<p>The default working directory used by freebsd-update(8) is normally
|
|
created during the installation of FreeBSD with permissions which
|
|
allow all local users to see its contents, and freebsd-update(8) does
|
|
not take any steps to restrict access to files stored in said
|
|
directory.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<freebsdsa>SA-09:17.freebsd-update</freebsdsa>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-12-03</discovery>
|
|
<entry>2010-10-24</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="ad08d14b-ca3d-11df-aade-0050568f000c">
|
|
<topic>FreeBSD -- Improper environment sanitization in rtld(1)</topic>
|
|
<affects>
|
|
<package>
|
|
<name>FreeBSD</name>
|
|
<range><gt>7.1</gt><lt>7.1_9</lt></range>
|
|
<range><gt>7.2</gt><lt>7.2_5</lt></range>
|
|
<range><gt>8.0</gt><lt>8.0_1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<h1>Problem Description:</h1>
|
|
<p>When running setuid programs rtld will normally remove potentially
|
|
dangerous environment variables. Due to recent changes in FreeBSD
|
|
environment variable handling code, a corrupt environment may
|
|
result in attempts to unset environment variables failing.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<freebsdsa>SA-09:16.rtld</freebsdsa>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-12-03</discovery>
|
|
<entry>2010-10-24</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="406779fd-ca3b-11df-aade-0050568f000c">
|
|
<topic>FreeBSD -- SSL protocol flaw</topic>
|
|
<affects>
|
|
<package>
|
|
<name>FreeBSD</name>
|
|
<range><gt>6.3</gt><lt>6.3_14</lt></range>
|
|
<range><gt>6.4</gt><lt>6.4_8</lt></range>
|
|
<range><gt>7.1</gt><lt>7.1_9</lt></range>
|
|
<range><gt>7.2</gt><lt>7.2_5</lt></range>
|
|
<range><gt>8.0</gt><lt>8.0_1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<h1>Problem Description:</h1>
|
|
<p>The SSL version 3 and TLS protocols support session
|
|
renegotiation without cryptographically tying the new
|
|
session parameters to the old parameters.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<freebsdsa>SA-09:15.ssl</freebsdsa>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-12-03</discovery>
|
|
<entry>2010-10-24</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="c9a6ae4a-df8b-11df-9573-00262d5ed8ee">
|
|
<topic>monotone -- remote denial of service in default setup</topic>
|
|
<affects>
|
|
<package>
|
|
<name>monotone</name>
|
|
<range><lt>0.48.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The monotone developers report:</p>
|
|
<blockquote cite="http://www.monotone.ca/NEWS">
|
|
<p>Running "mtn ''" or "mtn ls ''" doesn't cause an internal
|
|
error anymore. In monotone 0.48 and earlier this behavior
|
|
could be used to crash a server remotely (but only if it was
|
|
configured to allow execution of remote commands).</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<freebsdpr>ports/151665</freebsdpr>
|
|
<url>http://www.monotone.ca/NEWS</url>
|
|
<url>http://www.thomaskeller.biz/blog/2010/10/22/monotone-0-48-1-released-please-update-your-servers/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-10-21</discovery>
|
|
<entry>2010-10-24</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="c4f067b9-dc4a-11df-8e32-000f20797ede">
|
|
<topic>mozilla -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>firefox</name>
|
|
<range><gt>3.6.*,1</gt><lt>3.6.11,1</lt></range>
|
|
<range><gt>3.5.*,1</gt><lt>3.5.14,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>libxul</name>
|
|
<range><gt>1.9.2.*</gt><lt>1.9.2.11</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-firefox</name>
|
|
<range><lt>3.6.11,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-firefox-devel</name>
|
|
<range><lt>3.5.14</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>seamonkey</name>
|
|
<range><gt>2.0.*</gt><lt>2.0.9</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>thunderbird</name>
|
|
<range><ge>3.0</ge><lt>3.0.9</lt></range>
|
|
<range><ge>3.1</ge><lt>3.1.5</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Mozilla Project reports:</p>
|
|
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
|
|
<p>MFSA 2010-64 Miscellaneous memory safety hazards (rv:1.9.2.11/ 1.9.1.14)</p>
|
|
<p>MFSA 2010-65 Buffer overflow and memory corruption using document.write</p>
|
|
<p>MFSA 2010-66 Use-after-free error in nsBarProp</p>
|
|
<p>MFSA 2010-67 Dangling pointer vulnerability in LookupGetterOrSetter</p>
|
|
<p>MFSA 2010-68 XSS in gopher parser when parsing hrefs</p>
|
|
<p>MFSA 2010-69 Cross-site information disclosure via modal calls</p>
|
|
<p>MFSA 2010-70 SSL wildcard certificate matching IP addresses</p>
|
|
<p>MFSA 2010-71 Unsafe library loading vulnerabilities</p>
|
|
<p>MFSA 2010-72 Insecure Diffie-Hellman key exchange</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2010-3170</cvename>
|
|
<cvename>CVE-2010-3173</cvename>
|
|
<cvename>CVE-2010-3174</cvename>
|
|
<cvename>CVE-2010-3175</cvename>
|
|
<cvename>CVE-2010-3176</cvename>
|
|
<cvename>CVE-2010-3177</cvename>
|
|
<cvename>CVE-2010-3178</cvename>
|
|
<cvename>CVE-2010-3179</cvename>
|
|
<cvename>CVE-2010-3180</cvename>
|
|
<cvename>CVE-2010-3181</cvename>
|
|
<cvename>CVE-2010-3182</cvename>
|
|
<cvename>CVE-2010-3183</cvename>
|
|
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-64.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-65.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-66.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-67.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-68.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-69.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-70.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-71.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-72.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-10-19</discovery>
|
|
<entry>2010-10-20</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="e5090d2a-dbbe-11df-82f8-0015f2db7bde">
|
|
<topic>Webkit-gtk2 -- Multiple Vulnabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>webkit-gtk2</name>
|
|
<range><lt>1.2.5</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Gustavo Noronha Silva reports:</p>
|
|
<blockquote cite="http://gitorious.org/webkitgtk/stable/blobs/master/WebKit/gtk/NEWS">
|
|
<p>The patches to fix the following CVEs are included with help from
|
|
Vincent Danen and other members of the Red Hat security team:</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2010-1780</cvename>
|
|
<cvename>CVE-2010-1807</cvename>
|
|
<cvename>CVE-2010-1812</cvename>
|
|
<cvename>CVE-2010-1814</cvename>
|
|
<cvename>CVE-2010-1815</cvename>
|
|
<cvename>CVE-2010-3113</cvename>
|
|
<cvename>CVE-2010-3114</cvename>
|
|
<cvename>CVE-2010-3115</cvename>
|
|
<cvename>CVE-2010-3116</cvename>
|
|
<cvename>CVE-2010-3255</cvename>
|
|
<cvename>CVE-2010-3257</cvename>
|
|
<cvename>CVE-2010-3259</cvename>
|
|
<url>http://gitorious.org/webkitgtk/stable/blobs/master/WebKit/gtk/NEWS</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-10-01</discovery>
|
|
<entry>2010-10-19</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="dd943fbb-d0fe-11df-95a8-00219b0fc4d8">
|
|
<topic>apr -- multiple vunerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>apr1</name>
|
|
<range><lt>1.4.2.1.3.10</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>apr0</name>
|
|
<range><lt>0.9.19.0.9.19</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/41701">
|
|
<p>Multiple vulnerabilities have been reported in APR-util, which can
|
|
be exploited by malicious people to cause a DoS (Denial of
|
|
Service).</p>
|
|
<p>Two XML parsing vulnerabilities exist in the bundled version of
|
|
expat.</p>
|
|
<p>An error within the "apr_brigade_split_line()" function in
|
|
buckets/apr_brigade.c can be exploited to cause high memory
|
|
consumption.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>43673</bid>
|
|
<cvename>CVE-2009-3560</cvename>
|
|
<cvename>CVE-2009-3720</cvename>
|
|
<cvename>CVE-2010-1623</cvename>
|
|
<url>http://www.apache.org/dist/apr/CHANGES-APR-UTIL-1.3</url>
|
|
<url>http://secunia.com/advisories/41701</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-10-02</discovery>
|
|
<entry>2010-10-06</entry>
|
|
<modified>2010-10-20</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="99021f88-ca3c-11df-be21-00e018aa7788">
|
|
<topic>phpmyfaq -- cross site scripting vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>phpmyfaq</name>
|
|
<range><lt>2.6.9</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The phpMyFAQ project reports:</p>
|
|
<blockquote cite="http://www.phpmyfaq.de/advisory_2010-09-28.php">
|
|
<p>The phpMyFAQ Team has learned of a security issue that has been
|
|
discovered in phpMyFAQ 2.6.x: phpMyFAQ doesn't sanitize
|
|
some variables in different pages correctly. With a
|
|
properly crafted URL it is e.g. possible to inject
|
|
JavaScript code into the output of a page, which could
|
|
result in the leakage of domain cookies (f.e. session
|
|
identifiers)..</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<freebsdpr>ports/151055</freebsdpr>
|
|
<url>http://www.phpmyfaq.de/advisory_2010-09-28.php</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-09-28</discovery>
|
|
<entry>2010-10-02</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="e08c596e-cb28-11df-9c1b-0011098ad87f">
|
|
<topic>horde-gollem -- XSS vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>horde-gollem</name>
|
|
<range><lt>1.1.2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Horde team reports:</p>
|
|
<blockquote cite="http://article.gmane.org/gmane.comp.horde.announce/523">
|
|
<p>The major changes compared to Gollem version H3 (1.1.1) are:</p>
|
|
<p>* Fixed an XSS vulnerability in the file viewer.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://article.gmane.org/gmane.comp.horde.announce/523</url>
|
|
<url>http://git.horde.org/diff.php/gollem/docs/CHANGES?rt=horde&r1=1.114.2.55&r2=1.114.2.59&ty=h</url>
|
|
<url>http://bugs.horde.org/ticket/9191</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-08-21</discovery>
|
|
<entry>2010-09-28</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="6c4db192-cb23-11df-9c1b-0011098ad87f">
|
|
<topic>horde-imp -- XSS vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>horde-imp</name>
|
|
<range><gt>4.2,1</gt><lt>4.3.8,1</lt></range>
|
|
<range><lt>4.3.8</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Horde team reports:</p>
|
|
<blockquote cite="http://article.gmane.org/gmane.comp.horde.announce/516">
|
|
<p>Thanks to Naumann IT Security Consulting for reporting the XSS
|
|
vulnerability.</p>
|
|
<p>The major changes compared to IMP version H3 (4.3.7) are:</p>
|
|
<p>* Fixed an XSS vulnerability in the Fetchmail configuration.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://article.gmane.org/gmane.comp.horde.announce/516</url>
|
|
<url>http://git.horde.org/diff.php/imp/docs/CHANGES?rt=horde&r1=1.699.2.424&r2=1.699.2.430&ty=h</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-09-28</discovery>
|
|
<entry>2010-09-28</entry>
|
|
<modified>2011-09-23</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="8fc55043-cb1e-11df-9c1b-0011098ad87f">
|
|
<topic>horde-base -- XSS and CSRF vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>horde-base</name>
|
|
<range><lt>3.3.9</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Horde team reports:</p>
|
|
<blockquote cite="http://article.gmane.org/gmane.comp.horde.announce/515">
|
|
<p>Thanks to Naumann IT Security Consulting for reporting the XSS
|
|
vulnerability.</p>
|
|
<p>Thanks to Secunia for releasing an advisory for the new CSRF
|
|
protection in the preference interface</p>
|
|
<p>The major changes compared to Horde version 3.3.8 are:</p>
|
|
<p>* Fixed XSS vulnerability in util/icon_browser.php.</p>
|
|
<p>* Protected preference forms against CSRF attacks.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://article.gmane.org/gmane.comp.horde.announce/515</url>
|
|
<url>http://cvs.horde.org/diff.php/horde/docs/CHANGES?rt=horde&r1=1.515.2.607&r2=1.515.2.620&ty=h</url>
|
|
<url>http://secunia.com/advisories/39860/</url>
|
|
<url>http://holisticinfosec.org/content/view/145/45/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-06-03</discovery>
|
|
<entry>2010-09-28</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="80b6d6cc-c970-11df-bb18-0015587e2cc1">
|
|
<topic>openx -- remote code execution vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>openx</name>
|
|
<range><lt>2.8.7</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The OpenX project reported:</p>
|
|
<blockquote cite="http://blog.openx.org/09/security-update/">
|
|
<p>It has been brought to our attention that there is a vulnerability
|
|
in the 2.8 downloadable version of OpenX that can result in a server
|
|
running the downloaded version of OpenX being compromised.</p>
|
|
</blockquote>
|
|
<p>This vulnerability exists in the file upload functionality
|
|
and allows attackers to upload and execute PHP code of
|
|
their choice.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://blog.openx.org/09/security-update/</url>
|
|
<url>http://www.h-online.com/security/news/item/Web-sites-distribute-malware-via-hacked-OpenX-servers-1079099.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-09-14</discovery>
|
|
<entry>2010-09-26</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="e4dac715-c818-11df-a92c-0015587e2cc1">
|
|
<topic>squid -- Denial of service vulnerability in request handling</topic>
|
|
<affects>
|
|
<package>
|
|
<name>squid</name>
|
|
<range><ge>3.0.1</ge><lt>3.0.25_3</lt></range>
|
|
<range><ge>3.1.0.1</ge><lt>3.1.8</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Squid security advisory 2010:3 reports:</p>
|
|
<blockquote cite="http://www.squid-cache.org/Advisories/SQUID-2010_3.txt">
|
|
<p>Due to an internal error in string handling Squid is
|
|
vulnerable to a denial of service attack when processing
|
|
specially crafted requests.</p>
|
|
<p>This problem allows any trusted client to perform a
|
|
denial of service attack on the Squid service.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2010-3072</cvename>
|
|
<url>http://www.squid-cache.org/Advisories/SQUID-2010_3.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-08-30</discovery>
|
|
<entry>2010-09-24</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="8a34d9e6-c662-11df-b2e1-001b2134ef46">
|
|
<topic>linux-flashplugin -- remote code execution</topic>
|
|
<affects>
|
|
<package>
|
|
<name>linux-flashplugin</name>
|
|
<range><lt>9.0r283</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-f8-flashplugin</name>
|
|
<name>linux-f10-flashplugin</name>
|
|
<range><lt>10.1r85</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Adobe Product Security Incident Response Team reports:</p>
|
|
<blockquote cite="http://www.adobe.com/support/security/advisories/apsa10-03.html">
|
|
<p>A critical vulnerability exists in Adobe Flash Player
|
|
10.1.82.76 and earlier versions for Windows, Macintosh,
|
|
Linux, Solaris, and Adobe Flash Player 10.1.92.10 for
|
|
Android. This vulnerability also affects Adobe Reader
|
|
9.3.4 and earlier versions for Windows, Macintosh and
|
|
UNIX, and Adobe Acrobat 9.3.4 and earlier versions for
|
|
Windows and Macintosh. This vulnerability (CVE-2010-2884)
|
|
could cause a crash and potentially allow an attacker
|
|
to take control of the affected system. There are
|
|
reports that this vulnerability is being actively
|
|
exploited in the wild against Adobe Flash Player on
|
|
Windows. Adobe is not aware of any attacks exploiting
|
|
this vulnerability against Adobe Reader or Acrobat to
|
|
date.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2010-2884</cvename>
|
|
<url>http://www.adobe.com/support/security/advisories/apsa10-03.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-09-14</discovery>
|
|
<entry>2010-09-22</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="3ff95dd3-c291-11df-b0dc-00215c6a37bb">
|
|
<topic>django -- cross-site scripting vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>py23-django</name>
|
|
<name>py24-django</name>
|
|
<name>py25-django</name>
|
|
<name>py26-django</name>
|
|
<name>py30-django</name>
|
|
<name>py31-django</name>
|
|
<range><gt>1.2</gt><lt>1.2.2</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>py23-django-devel</name>
|
|
<name>py24-django-devel</name>
|
|
<name>py25-django-devel</name>
|
|
<name>py26-django-devel</name>
|
|
<name>py30-django-devel</name>
|
|
<name>py31-django-devel</name>
|
|
<range><lt>13698,1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Django project reports:</p>
|
|
<blockquote cite="http://www.djangoproject.com/weblog/2010/sep/08/security-release/">
|
|
<p>The provided template tag for inserting the CSRF
|
|
token into forms -- {% csrf_token %} -- explicitly
|
|
trusts the cookie value, and displays it as-is.
|
|
Thus, an attacker who is able to tamper with the
|
|
value of the CSRF cookie can cause arbitrary content
|
|
to be inserted, unescaped, into the outgoing HTML of
|
|
the form, enabling cross-site scripting (XSS) attacks.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>43116</bid>
|
|
<cvename>CVE-2010-3082</cvename>
|
|
<url>http://xforce.iss.net/xforce/xfdb/61729</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-09-13</discovery>
|
|
<entry>2010-09-17</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="9bcfd7b6-bcda-11df-9a6a-0015f2db7bde">
|
|
<topic>webkit-gtk2 -- Multiple vulnabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>webkit-gtk2</name>
|
|
<range><lt>1.2.4</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Gustavo Noronha Silva reports:</p>
|
|
<blockquote cite="http://gitorious.org/webkitgtk/stable/commit/9d07fda89aab7105962d933eef32ca15dda610d8">
|
|
<p>With help from Vincent Danen and other members of the Red Hat
|
|
security team, the following CVE's where fixed.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2010-1781</cvename>
|
|
<cvename>CVE-2010-1782</cvename>
|
|
<cvename>CVE-2010-1784</cvename>
|
|
<cvename>CVE-2010-1785</cvename>
|
|
<cvename>CVE-2010-1786</cvename>
|
|
<cvename>CVE-2010-1787</cvename>
|
|
<cvename>CVE-2010-1788</cvename>
|
|
<cvename>CVE-2010-1790</cvename>
|
|
<cvename>CVE-2010-1792</cvename>
|
|
<cvename>CVE-2010-1793</cvename>
|
|
<cvename>CVE-2010-2647</cvename>
|
|
<cvename>CVE-2010-2648</cvename>
|
|
<cvename>CVE-2010-3119</cvename>
|
|
<url>http://gitorious.org/webkitgtk/stable/commit/9d07fda89aab7105962d933eef32ca15dda610d8</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-09-7</discovery>
|
|
<entry>2010-09-10</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="f866d2af-bbba-11df-8a8d-0008743bf21a">
|
|
<topic>vim6 -- heap-based overflow while parsing shell metacharacters</topic>
|
|
<affects>
|
|
<package>
|
|
<name>vim6</name>
|
|
<name>vim6+ruby</name>
|
|
<range><ge>6.2.429</ge><lt>6.3.62</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Description for CVE-2008-3432 says:</p>
|
|
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3432">
|
|
<p>Heap-based buffer overflow in the mch_expand_wildcards
|
|
function in os_unix.c in Vim 6.2 and 6.3 allows user-assisted
|
|
attackers to execute arbitrary code via shell metacharacters
|
|
in filenames, as demonstrated by the netrw.v3 test case.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-3432</cvename>
|
|
<url>http://www.openwall.com/lists/oss-security/2008/07/15/4</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-07-31</discovery>
|
|
<entry>2010-09-09</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="4a21ce2c-bb13-11df-8e32-000f20797ede">
|
|
<topic>mozilla -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>firefox</name>
|
|
<range><gt>3.6.*,1</gt><lt>3.6.9,1</lt></range>
|
|
<range><gt>3.5.*,1</gt><lt>3.5.12,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>libxul</name>
|
|
<range><gt>1.9.2.*</gt><lt>1.9.2.9</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-firefox</name>
|
|
<range><lt>3.6.9,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-firefox-devel</name>
|
|
<range><lt>3.5.12</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>seamonkey</name>
|
|
<range><gt>2.0.*</gt><lt>2.0.7</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>thunderbird</name>
|
|
<range><ge>3.0</ge><lt>3.0.7</lt></range>
|
|
<range><ge>3.1</ge><lt>3.1.3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Mozilla Project reports:</p>
|
|
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
|
|
<p>MFSA 2010-49 Miscellaneous memory safety hazards (rv:1.9.2.9/ 1.9.1.12)</p>
|
|
<p>MFSA 2010-50 Frameset integer overflow vulnerability</p>
|
|
<p>MFSA 2010-51 Dangling pointer vulnerability using DOM plugin array</p>
|
|
<p>MFSA 2010-52 Windows XP DLL loading vulnerability</p>
|
|
<p>MFSA 2010-53 Heap buffer overflow in nsTextFrameUtils::TransformText</p>
|
|
<p>MFSA 2010-54 Dangling pointer vulnerability in nsTreeSelection</p>
|
|
<p>MFSA 2010-55 XUL tree removal crash and remote code execution</p>
|
|
<p>MFSA 2010-56 Dangling pointer vulnerability in nsTreeContentView</p>
|
|
<p>MFSA 2010-57 Crash and remote code execution in normalizeDocument</p>
|
|
<p>MFSA 2010-58 Crash on Mac using fuzzed font in data: URL</p>
|
|
<p>MFSA 2010-59 SJOW creates scope chains ending in outer object</p>
|
|
<p>MFSA 2010-60 XSS using SJOW scripted function</p>
|
|
<p>MFSA 2010-61 UTF-7 XSS by overriding document charset using object type attribute</p>
|
|
<p>MFSA 2010-62 Copy-and-paste or drag-and-drop into designMode document allows XSS</p>
|
|
<p>MFSA 2010-63 Information leak via XMLHttpRequest statusText</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2010-2762</cvename>
|
|
<cvename>CVE-2010-2763</cvename>
|
|
<cvename>CVE-2010-2764</cvename>
|
|
<cvename>CVE-2010-2765</cvename>
|
|
<cvename>CVE-2010-2766</cvename>
|
|
<cvename>CVE-2010-2767</cvename>
|
|
<cvename>CVE-2010-2768</cvename>
|
|
<cvename>CVE-2010-2769</cvename>
|
|
<cvename>CVE-2010-2770</cvename>
|
|
<cvename>CVE-2010-2760</cvename>
|
|
<cvename>CVE-2010-3131</cvename>
|
|
<cvename>CVE-2010-3166</cvename>
|
|
<cvename>CVE-2010-3167</cvename>
|
|
<cvename>CVE-2010-3168</cvename>
|
|
<cvename>CVE-2010-3169</cvename>
|
|
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-49.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-50.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-51.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-52.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-53.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-54.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-55.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-56.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-57.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-58.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-59.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-60.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-61.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-62.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-63.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-09-07</discovery>
|
|
<entry>2010-09-08</entry>
|
|
<modified>2010-09-15</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="67b514c3-ba8f-11df-8f6e-000c29a67389">
|
|
<topic>sudo -- Flaw in Runas group matching</topic>
|
|
<affects>
|
|
<package>
|
|
<name>sudo</name>
|
|
<range><ge>1.7.0</ge><lt>1.7.4.4</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Todd Miller reports:</p>
|
|
<blockquote cite="http://www.sudo.ws/sudo/alerts/runas_group.html">
|
|
<p>Beginning with sudo version 1.7.0 it has been possible to grant
|
|
permission to run a command using a specified group via sudo -g
|
|
option (run as group). A flaw exists in the logic that matches
|
|
Runas groups in the sudoers file when the -u option is also
|
|
specified (run as user). This flaw results in a positive match for
|
|
the user specified via -u so long as the group specified via -g
|
|
is allowed by the sudoers file.</p>
|
|
<p>Exploitation of the flaw requires that Sudo be configured with
|
|
sudoers entries that contain a Runas group. Entries that do not
|
|
contain a Runas group, or only contain a Runas user are not
|
|
affected.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2010-2956</cvename>
|
|
<url>http://www.sudo.ws/sudo/alerts/runas_group.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-09-07</discovery>
|
|
<entry>2010-09-07</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="29b7e3f4-b6a9-11df-ae63-f255a795cb21">
|
|
<topic>lftp -- multiple HTTP client download filename vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>lftp</name>
|
|
<range><lt>4.0.6</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The get1 command, as used by lftpget, in LFTP before 4.0.6 does
|
|
not properly validate a server-provided filename before determining
|
|
the destination filename of a download, which allows remote servers
|
|
to create or overwrite arbitrary files via a Content-Disposition
|
|
header that suggests a crafted filename, and possibly execute
|
|
arbitrary code as a consequence of writing to a dotfile in a home
|
|
directory.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2010-2251</cvename>
|
|
<url>https://bugzilla.redhat.com/show_bug.cgi?id=591580</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-06-09</discovery>
|
|
<entry>2010-09-03</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="d754b7d2-b6a7-11df-826c-e464a695cb21">
|
|
<topic>wget -- multiple HTTP client download filename vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>wget</name>
|
|
<name>wget-devel</name>
|
|
<range><le>1.12_1</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>GNU Wget version 1.12 and earlier uses a server-provided filename
|
|
instead of the original URL to determine the destination filename of
|
|
a download, which allows remote servers to create or overwrite
|
|
arbitrary files via a 3xx redirect to a URL with a .wgetrc filename
|
|
followed by a 3xx redirect to a URL with a crafted filename, and
|
|
possibly execute arbitrary code as a consequence of writing to a
|
|
dotfile in a home directory.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2010-2252</cvename>
|
|
<url>https://bugzilla.redhat.com/show_bug.cgi?id=602797</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-06-09</discovery>
|
|
<entry>2010-09-03</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="3a7c5fc4-b50c-11df-977b-ecc31dd8ad06">
|
|
<topic>p5-libwww -- possibility to remote servers to create file with a .(dot) character</topic>
|
|
<affects>
|
|
<package>
|
|
<name>p5-libwww</name>
|
|
<range><lt>5.835</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>lwp-download in libwww-perl before 5.835 does not reject downloads
|
|
to filenames that begin with a `.' (dot) character, which allows
|
|
remote servers to create or overwrite files via a 3xx redirect to a
|
|
URL with a crafted filename or a Content-Disposition header that
|
|
suggests a crafted filename, and possibly execute arbitrary code as
|
|
a consequence of writing to a dotfile in a home directory.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2010-2253</cvename>
|
|
<url>http://cpansearch.perl.org/src/GAAS/libwww-perl-5.836/Changes</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-06-09</discovery>
|
|
<entry>2010-08-31</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="167953a4-b01c-11df-9a98-0015587e2cc1">
|
|
<topic>quagga -- stack overflow and DoS vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>quagga</name>
|
|
<range><lt>0.99.17</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Red Hat security team reported two vulnerabilities:</p>
|
|
<blockquote cite="http://www.openwall.com/lists/oss-security/2010/08/24/3">
|
|
<p>A stack buffer overflow flaw was found in the way Quagga's bgpd
|
|
daemon processed Route-Refresh messages. A configured
|
|
Border Gateway Protocol (BGP) peer could send a
|
|
Route-Refresh message with specially-crafted Outbound
|
|
Route Filtering (ORF) record, which would cause the
|
|
master BGP daemon (bgpd) to crash or, possibly, execute
|
|
arbitrary code with the privileges of the user running
|
|
bgpd.</p>
|
|
<p>A NULL pointer dereference flaw was found in the way
|
|
Quagga's bgpd daemon parsed paths of autonomous systems
|
|
(AS). A configured BGP peer could send a BGP update AS
|
|
path request with unknown AS type, which could lead to
|
|
denial of service (bgpd daemon crash).</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://www.openwall.com/lists/oss-security/2010/08/24/3</url>
|
|
<url>http://www.quagga.net/news2.php?y=2010&m=8&d=19#id1282241100</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-08-24</discovery>
|
|
<entry>2010-08-25</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="8cbf4d65-af9a-11df-89b8-00151735203a">
|
|
<topic>bugzilla -- information disclosure, denial of service</topic>
|
|
<affects>
|
|
<package>
|
|
<name>bugzilla</name>
|
|
<range><gt>2.17.1</gt><lt>3.6.2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A Bugzilla Security Advisory reports:</p>
|
|
<blockquote cite="http://www.bugzilla.org/security/3.2.7/">
|
|
<ul>
|
|
<li>Remote Information Disclosure:
|
|
An unprivileged user is normally not allowed to view
|
|
other users' group membership. But boolean charts
|
|
let the user use group-based pronouns, indirectly
|
|
disclosing group membership. This security fix
|
|
restricts the use of pronouns to groups the user
|
|
belongs to.</li>
|
|
<li>Notification Bypass:
|
|
Normally, when a user is impersonated, he receives
|
|
an email informing him that he is being impersonated,
|
|
containing the identity of the impersonator. However,
|
|
it was possible to impersonate a user without this
|
|
notification being sent.</li>
|
|
<li>Remote Information Disclosure:
|
|
An error message thrown by the "Reports" and "Duplicates"
|
|
page confirmed the non-existence of products, thus
|
|
allowing users to guess confidential product names.
|
|
(Note that the "Duplicates" page was not vulnerable
|
|
in Bugzilla 3.6rc1 and above though.)</li>
|
|
<li>Denial of Service:
|
|
If a comment contained the phrases "bug X" or
|
|
"attachment X", where X was an integer larger than the
|
|
maximum 32-bit signed integer size, PostgreSQL would
|
|
throw an error, and any page containing that comment would
|
|
not be viewable. On most Bugzillas, any user can enter
|
|
a comment on any bug, so any user could have used this to
|
|
deny access to one or all bugs. Bugzillas running on
|
|
databases other than PostgreSQL are not affected.</li>
|
|
</ul>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2010-2756</cvename>
|
|
<cvename>CVE-2010-2757</cvename>
|
|
<cvename>CVE-2010-2758</cvename>
|
|
<cvename>CVE-2010-2759</cvename>
|
|
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=417048</url>
|
|
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=450013</url>
|
|
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=577139</url>
|
|
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=519835</url>
|
|
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=583690</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-08-05</discovery>
|
|
<entry>2010-08-24</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="b6069837-aadc-11df-82df-0015f2db7bde">
|
|
<topic>OpenTTD -- Denial of service (server) via infinite loop</topic>
|
|
<affects>
|
|
<package>
|
|
<name>openttd</name>
|
|
<range><ge>1.0.1</ge><lt>1.0.3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>OpenTTD project reports:</p>
|
|
<blockquote cite="http://security.openttd.org/en/CVE-2010-2534">
|
|
<p>When multiple commands are queued (at the server) for execution
|
|
in the next game tick and an client joins the server can get into
|
|
an infinite loop. With the default settings triggering this bug
|
|
is difficult (if not impossible), however the larger value of
|
|
the "frame_freq" setting is easier it is to trigger the bug.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2010-2534</cvename>
|
|
<url>http://security.openttd.org/en/CVE-2010-2534</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-06-27</discovery>
|
|
<entry>2010-08-22</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="67a1c3ae-ad69-11df-9be6-0015587e2cc1">
|
|
<topic>corkscrew -- buffer overflow vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>corkscrew</name>
|
|
<range><le>2.0</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The affected corkscrew versions use sscanf calls without proper
|
|
bounds checking. In the authentication file parsing routine
|
|
this can cause an exploitable buffer overflow condition.
|
|
A similar but issue exists in the server response code but
|
|
appears to be non-exploitable.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://people.freebsd.org/~niels/issues/corkscrew-20100821.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-08-21</discovery>
|
|
<entry>2010-08-21</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="274922b8-ad20-11df-af1f-00e0814cab4e">
|
|
<topic>phpmyadmin -- Several XSS vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>phpMyAdmin</name>
|
|
<range><lt>3.3.5.1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>phpMyAdmin211</name>
|
|
<range><lt>2.11.10.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>phpMyAdmin Team reports:</p>
|
|
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2010-5.php">
|
|
<p>It was possible to conduct a XSS attack using crafted URLs org
|
|
POST parameters on several pages.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2010-3056</cvename>
|
|
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2010-5.php</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-08-09</discovery>
|
|
<entry>2010-08-21</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="68c7187a-abd2-11df-9be6-0015587e2cc1">
|
|
<topic>slim -- insecure PATH assignment</topic>
|
|
<affects>
|
|
<package>
|
|
<name>slim</name>
|
|
<range><lt>1.3.2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>SLiM assigns logged on users a PATH in which the current
|
|
working directory ("./") is included. This PATH can allow
|
|
unintentional code execution through planted binaries and
|
|
has therefore been fixed SLiM version 1.3.2.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2010-2945</cvename>
|
|
<url>http://seclists.org/oss-sec/2010/q3/198</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-05-12</discovery>
|
|
<entry>2010-08-19</entry>
|
|
<modified>2010-08-20</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="34e0316a-aa91-11df-8c2e-001517289bf8">
|
|
<topic>ruby -- UTF-7 encoding XSS vulnerability in WEBrick</topic>
|
|
<affects>
|
|
<package>
|
|
<name>ruby</name>
|
|
<name>ruby+pthreads</name>
|
|
<name>ruby+pthreads+oniguruma</name>
|
|
<name>ruby+oniguruma</name>
|
|
<range><ge>1.8.*,1</ge><lt>1.8.7.248_3,1</lt></range>
|
|
<range><ge>1.9.*,1</ge><lt>1.9.1.430,1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The official ruby site reports:</p>
|
|
<blockquote cite="http://www.ruby-lang.org/en/news/2010/08/16/xss-in-webrick-cve-2010-0541/">
|
|
<p>WEBrick have had a cross-site scripting vulnerability that allows
|
|
an attacker to inject arbitrary script or HTML via a crafted URI.
|
|
This does not affect user agents that strictly implement HTTP/1.1,
|
|
however, some user agents do not.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>40895</bid>
|
|
<cvename>CVE-2010-0541</cvename>
|
|
<url>http://www.ruby-lang.org/en/news/2010/08/16/xss-in-webrick-cve-2010-0541/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-08-16</discovery>
|
|
<entry>2010-08-17</entry>
|
|
<modified>2010-08-20</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="b74a8076-9b1f-11df-9f58-021e8c343e76">
|
|
<topic>isolate -- local root exploit</topic>
|
|
<affects>
|
|
<package>
|
|
<name>isolate</name>
|
|
<range><lt>20100717</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<blockquote cite="http://code.google.com/p/isolate/">
|
|
<p>Isolate currently suffers from some bad security bugs! These
|
|
are local root privilege escalation bugs. Thanks to the helpful
|
|
person who reported them (email Chris if you want credit!).
|
|
We're working to fix them ASAP, but until then, isolate is
|
|
unsafe and you should uninstall it. Sorry!</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<freebsdpr>ports/148911</freebsdpr>
|
|
<url>http://code.google.com/p/isolate/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-07-29</discovery>
|
|
<entry>2010-08-13</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="e7d91a3c-a7c9-11df-870c-00242b513d7c">
|
|
<topic>vlc -- invalid id3v2 tags may lead to invalid memory dereferencing</topic>
|
|
<affects>
|
|
<package>
|
|
<name>vlc</name>
|
|
<range><gt>0.9.0,3</gt><lt>1.1.2_1,3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>VideoLAN project reports:</p>
|
|
<blockquote cite="http://www.videolan.org/security/sa1004.html">
|
|
<p>VLC fails to perform sufficient input validation when trying to
|
|
extract some meta-informations about input media through ID3v2
|
|
tags. In the failure case, VLC attempt dereference an invalid
|
|
memory address, and a crash will ensure.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2010-2937</cvename>
|
|
<url>http://www.videolan.org/security/sa1004.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-07-29</discovery>
|
|
<entry>2010-08-14</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="e19e74a4-a712-11df-b234-001b2134ef46">
|
|
<topic>linux-flashplugin -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>linux-flashplugin</name>
|
|
<range><lt>9.0r280</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-f8-flashplugin</name>
|
|
<name>linux-f10-flashplugin</name>
|
|
<range><lt>10.1r82</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Adobe Product Security Incident Response Team reports:</p>
|
|
<blockquote cite="http://www.adobe.com/support/security/bulletins/apsb10-16.html">
|
|
<p>Critical vulnerabilities have been identified in Adobe
|
|
Flash Player version 10.1.53.64 and earlier. These
|
|
vulnerabilities could cause the application to crash and
|
|
could potentially allow an attacker to take control of the
|
|
affected system.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2010-0209</cvename>
|
|
<cvename>CVE-2010-2188</cvename>
|
|
<cvename>CVE-2010-2213</cvename>
|
|
<cvename>CVE-2010-2214</cvename>
|
|
<cvename>CVE-2010-2215</cvename>
|
|
<cvename>CVE-2010-2216</cvename>
|
|
<url>http://www.adobe.com/support/security/bulletins/apsb10-16.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-01-06</discovery>
|
|
<entry>2010-08-13</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="71273c4d-a6ec-11df-8a8d-0008743bf21a">
|
|
<topic>opera -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>opera</name>
|
|
<range><lt>10.61</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Opera Destkop Team reports:</p>
|
|
<blockquote cite="http://www.opera.com/docs/changelogs/unix/1061/">
|
|
<ul>
|
|
<li>Fixed an issue where heap buffer overflow in HTML5 canvas could
|
|
be used to execute arbitrary code, as reported by Kuzzcc.</li>
|
|
<li>Fixed an issue where unexpected changes in tab focus could be
|
|
used to run programs from the Internet, as reported by Jakob Balle
|
|
and Sven Krewitt of Secunia.</li>
|
|
<li>Fixed an issue where news feed preview could subscribe to feeds
|
|
without interaction, as reported by Alexios Fakos.</li>
|
|
</ul>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://www.opera.com/support/search/view/966/</url>
|
|
<url>http://www.opera.com/support/search/view/967/</url>
|
|
<url>http://www.opera.com/support/search/view/968/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-08-12</discovery>
|
|
<entry>2010-08-13</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="c2eac2b5-9a7d-11df-8e32-000f20797ede">
|
|
<topic>firefox -- Dangling pointer crash regression from plugin parameter array fix</topic>
|
|
<affects>
|
|
<package>
|
|
<name>firefox</name>
|
|
<range><gt>3.6.*,1</gt><lt>3.6.8,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-firefox</name>
|
|
<range><lt>3.6.8,1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Mozilla Project reports:</p>
|
|
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
|
|
<p>MFSA 2010-48 Dangling pointer crash regression from plugin parameter array fix</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2010-2755</cvename>
|
|
<url>https://www.mozilla.org/security/announce/2010/mfsa2010-48.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-07-20</discovery>
|
|
<entry>2010-08-09</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="26e1c48a-9fa7-11df-81b5-00e0814cab4e">
|
|
<topic>Piwik -- Local File Inclusion Vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>piwik</name>
|
|
<range><gt>0.6</gt><lt>0.6.3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Piwik versions 0.6 through 0.6.3 are vulnerable to arbitrary,
|
|
remote file inclusion using a directory traversal pattern infinite
|
|
a crafted request for a data renderer.</p>
|
|
<blockquote cite="http://secunia.com/advisories/40703">
|
|
<p>A vulnerability has been reported in Piwik, which can before
|
|
exploited by malicious people to disclose potentially
|
|
sensitive information. Input passed to unspecified parameters
|
|
when requesting a data renderer is not properly verified before
|
|
being used to include files. This can be exploited to includes
|
|
arbitrary files from local resources via directory traversal
|
|
attacks.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2010-2786</cvename>
|
|
<url>http://secunia.com/advisories/40703</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-07-28</discovery>
|
|
<entry>2010-08-04</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="43024078-9b63-11df-8983-001d60d86f38">
|
|
<topic>libmspack -- infinite loop denial of service</topic>
|
|
<affects>
|
|
<package>
|
|
<name>libmspack</name>
|
|
<range><le>0.0.20060920</le></range>
|
|
</package>
|
|
<package>
|
|
<name>cabextract</name>
|
|
<range><lt>1.3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>There is a denial of service vulnerability in libmspack. The
|
|
libmspack code is built into cabextract, so it is also
|
|
vulnerable.</p>
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/40719/">
|
|
<p>The vulnerability is caused due to an error when copying data
|
|
from an uncompressed block (block type 0) and can be exploited
|
|
to trigger an infinite loop by tricking an application using the
|
|
library into processing specially crafted MS-ZIP archives.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://secunia.com/advisories/40719/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-07-26</discovery>
|
|
<entry>2010-07-30</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="28a7310f-9855-11df-8d36-001aa0166822">
|
|
<topic>apache -- Remote DoS bug in mod_cache and mod_dav</topic>
|
|
<affects>
|
|
<package>
|
|
<name>apache</name>
|
|
<range><ge>2.2.0</ge><lt>2.2.16</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Apache ChangeLog reports:</p>
|
|
<blockquote cite="http://www.apache.org/dist/httpd/CHANGES_2.2.16">
|
|
<p>mod_dav, mod_cache: Fix Handling of requests without a path segment.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2010-1452</cvename>
|
|
<url>http://www.apache.org/dist/httpd/CHANGES_2.2.16</url>
|
|
<url>https://issues.apache.org/bugzilla/show_bug.cgi?id=49246</url>
|
|
<url>http://svn.apache.org/viewvc?view=revision&revision=966349</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-07-21</discovery>
|
|
<entry>2010-07-26</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="827bc2b7-95ed-11df-9160-00e0815b8da8">
|
|
<topic>git -- buffer overflow vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>git</name>
|
|
<range><ge>1.5.6</ge><lt>1.7.1.1_1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Greg Brockman reports:</p>
|
|
<blockquote cite="http://www.openwall.com/lists/oss-security/2010/07/22/1">
|
|
<p>If an attacker were to create a crafted working copy where the
|
|
user runs any git command, the attacker could force execution
|
|
of arbitrary code.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2010-2542</cvename>
|
|
<url>http://git.kernel.org/?p=git/git.git;a=commit;h=3c9d0414ed2db0167e6c828b547be8fc9f88fccc</url>
|
|
<url>http://www.openwall.com/lists/oss-security/2010/07/22/1</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-07-20</discovery>
|
|
<entry>2010-07-23</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="0502c1cb-8f81-11df-a0bb-0050568452ac">
|
|
<topic>codeigniter -- file upload class vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>codeigniter</name>
|
|
<range><lt>1.7.2_1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Derek Jones reports:</p>
|
|
<blockquote cite="http://codeigniter.com/news/codeigniter_1.7.2_security_patch/">
|
|
<p>A fix has been implemented for a security flaw in
|
|
CodeIgniter 1.7.2. All applications using the File
|
|
Upload class should install the patch to ensure that
|
|
their application is not subject to a vulnerability.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://codeigniter.com/news/codeigniter_1.7.2_security_patch/</url>
|
|
<url>http://www.phpframeworks.com/news/p/16365/codeigniter-1-7-2-security-patch</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-07-12</discovery>
|
|
<entry>2010-07-21</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="8c2ea875-9499-11df-8e32-000f20797ede">
|
|
<topic>mozilla -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>firefox</name>
|
|
<range><gt>3.6.*,1</gt><lt>3.6.7,1</lt></range>
|
|
<range><gt>3.5.*,1</gt><lt>3.5.11,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-firefox</name>
|
|
<range><lt>3.6.7,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-firefox-devel</name>
|
|
<range><lt>3.5.11</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>seamonkey</name>
|
|
<range><gt>2.0.*</gt><lt>2.0.6</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>thunderbird</name>
|
|
<range><ge>3.0</ge><lt>3.0.6</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Mozilla Project reports:</p>
|
|
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
|
|
<p>MFSA 2010-34 Miscellaneous memory safety hazards (rv:1.9.2.7/ 1.9.1.11)</p>
|
|
<p>MFSA 2010-35 DOM attribute cloning remote code execution vulnerability</p>
|
|
<p>MFSA 2010-36 Use-after-free error in NodeIterator</p>
|
|
<p>MFSA 2010-37 Plugin parameter EnsureCachedAttrParamArrays remote code execution vulnerability</p>
|
|
<p>MFSA 2010-38 Arbitrary code execution using SJOW and fast native function</p>
|
|
<p>MFSA 2010-39 nsCSSValue::Array index integer overflow</p>
|
|
<p>MFSA 2010-40 nsTreeSelection dangling pointer remote code execution vulnerability</p>
|
|
<p>MFSA 2010-41 Remote code execution using malformed PNG image</p>
|
|
<p>MFSA 2010-42 Cross-origin data disclosure via Web Workers and importScripts</p>
|
|
<p>MFSA 2010-43 Same-origin bypass using canvas context</p>
|
|
<p>MFSA 2010-44 Characters mapped to U+FFFD in 8 bit encodings cause subsequent character to vanish</p>
|
|
<p>MFSA 2010-45 Multiple location bar spoofing vulnerabilities</p>
|
|
<p>MFSA 2010-46 Cross-domain data theft using CSS</p>
|
|
<p>MFSA 2010-47 Cross-origin data leakage from script filename in error messages</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2010-0654</cvename>
|
|
<cvename>CVE-2010-1205</cvename>
|
|
<cvename>CVE-2010-1206</cvename>
|
|
<cvename>CVE-2010-1207</cvename>
|
|
<cvename>CVE-2010-1208</cvename>
|
|
<cvename>CVE-2010-1209</cvename>
|
|
<cvename>CVE-2010-1210</cvename>
|
|
<cvename>CVE-2010-1211</cvename>
|
|
<cvename>CVE-2010-1212</cvename>
|
|
<cvename>CVE-2010-1213</cvename>
|
|
<cvename>CVE-2010-1214</cvename>
|
|
<cvename>CVE-2010-1215</cvename>
|
|
<cvename>CVE-2010-2751</cvename>
|
|
<cvename>CVE-2010-2752</cvename>
|
|
<cvename>CVE-2010-2753</cvename>
|
|
<cvename>CVE-2010-2754</cvename>
|
|
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-34.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-35.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-36.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-37.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-38.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-39.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-40.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-41.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-42.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-43.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-44.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-45.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-46.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-47.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-07-20</discovery>
|
|
<entry>2010-07-21</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="9a8fecef-92c0-11df-b140-0015f2db7bde">
|
|
<topic>vte -- Classic terminal title set+query attack</topic>
|
|
<affects>
|
|
<package>
|
|
<name>vte</name>
|
|
<range><lt>0.24.3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Kees Cook reports:</p>
|
|
<blockquote cite="http://www.securityfocus.com/archive/1/512388">
|
|
<p>Janne Snabb discovered that applications using VTE, such as
|
|
gnome-terminal, did not correctly filter window and icon title
|
|
request escape codes. If a user were tricked into viewing
|
|
specially crafted output in their terminal, a remote attacker
|
|
could execute arbitrary commands with user privileges.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2010-2713</cvename>
|
|
<url>http://www.securityfocus.com/archive/1/512388</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-07-15</discovery>
|
|
<entry>2010-07-18</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="19419b3b-92bd-11df-b140-0015f2db7bde">
|
|
<topic>webkit-gtk2 -- Multiple vulnabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>webkit-gtk2</name>
|
|
<range><lt>1.2.3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Gustavo Noronha reports:</p>
|
|
<blockquote cite="http://blog.kov.eti.br/?p=116">
|
|
<p>Debian's Michael Gilbert has done a great job going through all
|
|
CVEs released about WebKit, and including patches in the Debian
|
|
package. 1.2.3 includes all of the commits from trunk to fix those,
|
|
too.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2010-1386</cvename>
|
|
<cvename>CVE-2010-1392</cvename>
|
|
<cvename>CVE-2010-1405</cvename>
|
|
<cvename>CVE-2010-1407</cvename>
|
|
<cvename>CVE-2010-1416</cvename>
|
|
<cvename>CVE-2010-1417</cvename>
|
|
<cvename>CVE-2010-1418</cvename>
|
|
<cvename>CVE-2010-1421</cvename>
|
|
<cvename>CVE-2010-1422</cvename>
|
|
<cvename>CVE-2010-1501</cvename>
|
|
<cvename>CVE-2010-1664</cvename>
|
|
<cvename>CVE-2010-1665</cvename>
|
|
<cvename>CVE-2010-1758</cvename>
|
|
<cvename>CVE-2010-1759</cvename>
|
|
<cvename>CVE-2010-1760</cvename>
|
|
<cvename>CVE-2010-1761</cvename>
|
|
<cvename>CVE-2010-1762</cvename>
|
|
<cvename>CVE-2010-1767</cvename>
|
|
<cvename>CVE-2010-1770</cvename>
|
|
<cvename>CVE-2010-1771</cvename>
|
|
<cvename>CVE-2010-1772</cvename>
|
|
<cvename>CVE-2010-1773</cvename>
|
|
<cvename>CVE-2010-1774</cvename>
|
|
<cvename>CVE-2010-2264</cvename>
|
|
<url>http://blog.kov.eti.br/?p=116</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-07-16</discovery>
|
|
<entry>2010-07-18</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="ba61ce15-8a7b-11df-87ec-0050569b2d21">
|
|
<topic>redmine -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>redmine</name>
|
|
<range><lt>0.9.6</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Eric Davis reports:</p>
|
|
<blockquote cite="http://www.redmine.org/news/41">
|
|
<p>This security release addresses some security
|
|
vulnerabilities found in the advanced subversion
|
|
integration module (Redmine.pm perl script).</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://www.redmine.org/news/41</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-07-08</discovery>
|
|
<entry>2010-07-10</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="25ed4ff8-8940-11df-a339-0026189baca3">
|
|
<topic>bogofilter -- heap underrun on malformed base64 input</topic>
|
|
<affects>
|
|
<package>
|
|
<name>bogofilter</name>
|
|
<range><lt>1.2.1_2</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>bogofilter-sqlite</name>
|
|
<range><lt>1.2.1_1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>bogofilter-tc</name>
|
|
<range><lt>1.2.1_1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Julius Plenz reports:</p>
|
|
<blockquote cite="http://www.bogofilter.org/pipermail/bogofilter-dev/2010-June/003475.html">
|
|
<p>I found a bug in the base64_decode function which may cause memory
|
|
corruption when the function is executed on a malformed base64
|
|
encoded string.</p>
|
|
<p>If a string starting with an equal-sign is passed to the
|
|
base64_decode function it triggers a memory corruption that
|
|
in some cases makes bogofilter crash.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2010-2494</cvename>
|
|
<url>http://bogofilter.sourceforge.net/security/bogofilter-SA-2010-01</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-06-28</discovery>
|
|
<entry>2010-07-06</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="f1331504-8849-11df-89b8-00151735203a">
|
|
<topic>bugzilla -- information disclosure</topic>
|
|
<affects>
|
|
<package>
|
|
<name>bugzilla</name>
|
|
<range><gt>2.17.1</gt><lt>3.6.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A Bugzilla Security Advisory reports:</p>
|
|
<blockquote cite="http://www.bugzilla.org/security/3.2.6/">
|
|
<ul>
|
|
<li>Normally, information about time-tracking (estimated
|
|
hours, actual hours, hours worked, and deadlines) is
|
|
restricted to users in the "time-tracking group".
|
|
However, any user was able, by crafting their own
|
|
search URL, to search for bugs based using those
|
|
fields as criteria, thus possibly exposing sensitive
|
|
time-tracking information by a user seeing that a bug
|
|
matched their search.</li>
|
|
<li>If $use_suexec was set to "1" in the localconfig file,
|
|
then the localconfig file's permissions were set as
|
|
world-readable by checksetup.pl. This allowed any user
|
|
with local shell access to see the contents of the file,
|
|
including the database password and the site_wide_secret
|
|
variable used for CSRF protection.</li>
|
|
</ul>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2010-1204</cvename>
|
|
<cvename>CVE-2010-0180</cvename>
|
|
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=309952</url>
|
|
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=561797</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-06-24</discovery>
|
|
<entry>2010-07-05</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="8685d412-8468-11df-8d45-001d7d9eb79a">
|
|
<topic>kvirc -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>kvirc</name>
|
|
<name>kvirc-devel</name>
|
|
<range><lt>4.0.0</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Two security vulnerabilities have been discovered:</p>
|
|
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2451">
|
|
<p>Multiple format string vulnerabilities in the DCC functionality
|
|
in KVIrc 3.4 and 4.0 have unspecified impact and remote attack vectors.</p>
|
|
</blockquote>
|
|
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2452">
|
|
<p>Directory traversal vulnerability in the DCC functionality
|
|
in KVIrc 3.4 and 4.0 allows remote attackers to overwrite
|
|
arbitrary files via unknown vectors.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2010-2451</cvename>
|
|
<cvename>CVE-2010-2452</cvename>
|
|
<url>http://lists.omnikron.net/pipermail/kvirc/2010-May/000867.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-05-17</discovery>
|
|
<entry>2010-06-30</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="edef3f2f-82cf-11df-bcce-0018f3e2eb82">
|
|
<topic>png -- libpng decompression buffer overflow</topic>
|
|
<affects>
|
|
<package>
|
|
<name>png</name>
|
|
<range>
|
|
<lt>1.4.3</lt>
|
|
</range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The PNG project describes the problem in an advisory:</p>
|
|
<blockquote cite="http://www.libpng.org/pub/png/libpng.html">
|
|
<p>Several versions of libpng through 1.4.2 (and through 1.2.43
|
|
in the older series) contain a bug whereby progressive
|
|
applications such as web browsers (or the rpng2 demo app included
|
|
in libpng) could receive an extra row of image data beyond the
|
|
height reported in the header, potentially leading to an
|
|
out-of-bounds write to memory (depending on how the application
|
|
is written) and the possibility of execution of an attacker's
|
|
code with the privileges of the libpng user (including remote
|
|
compromise in the case of a libpng-based browser visiting a
|
|
hostile web site).</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>41174</bid>
|
|
<cvename>CVE-2010-1205</cvename>
|
|
<url>http://www.libpng.org/pub/png/libpng.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-03-30</discovery>
|
|
<entry>2010-06-28</entry>
|
|
<modified>2010-06-28</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="66759ce6-7530-11df-9c33-000c29ba66d2">
|
|
<topic>moodle -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>moodle</name>
|
|
<range><lt>1.9.9</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Moodle release notes report multiple vulnerabilities
|
|
which could allow cross site scripting, XSS attacks,
|
|
unauthorised deletion of attempts in some instances.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://docs.moodle.org/en/Moodle_1.9.9_release_notes</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-06-08</discovery>
|
|
<entry>2010-06-28</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="1cd87e2a-81e3-11df-81d8-00262d5ed8ee">
|
|
<topic>mDNSResponder -- corrupted stack crash when parsing bad resolv.conf</topic>
|
|
<affects>
|
|
<package>
|
|
<name>mDNSResponder</name>
|
|
<range><le>214</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Juli Mallett reports:</p>
|
|
<blockquote cite="http://www.freebsd.org/cgi/query-pr.cgi?pr=ports/147007">
|
|
<p>mdnsd will crash on some systems with a corrupt stack and once
|
|
that's fixed it will still leak a file descriptor when parsing
|
|
resolv.conf. The crash is because scanf is used with %10s for a
|
|
buffer that is only 10 chars long. The buffer size needs increased
|
|
to 11 chars to hold the trailing NUL. To fix the leak, an fclose
|
|
needs added.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<freebsdpr>ports/147007</freebsdpr>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-05-26</discovery>
|
|
<entry>2010-06-27</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="77b9f9bc-7fdf-11df-8a8d-0008743bf21a">
|
|
<topic>opera -- Data URIs can be used to allow cross-site scripting</topic>
|
|
<affects>
|
|
<package>
|
|
<name>opera</name>
|
|
<range><lt>10.11</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>opera-devel</name>
|
|
<range><le>10.20_2,1</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Opera Desktop Team reports:</p>
|
|
<blockquote cite="http://www.opera.com/support/kb/view/955/">
|
|
<p>Data URIs are allowed to run scripts that manipulate
|
|
pages from the site that directly opened them. In some cases, the opening site
|
|
is not correctly detected. In these cases, Data URIs may erroneously be able to
|
|
run scripts so that they interact with sites that did not directly cause them to
|
|
be opened.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://www.opera.com/support/kb/view/955/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-06-21</discovery>
|
|
<entry>2010-06-25</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="e02e6a4e-6b26-11df-96b2-0015587e2cc1">
|
|
<topic>cacti -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>cacti</name>
|
|
<range><lt>0.8.7f</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Multiple vulnerabilities have been reported to exist in older version of
|
|
Cacti. The release notes of Cacti 0.8.7f summarizes the problems as
|
|
follows:</p>
|
|
<blockquote cite="http://www.cacti.net/release_notes_0_8_7f.php">
|
|
<ul>
|
|
<li>SQL injection and shell escaping issues</li>
|
|
<li>Cross-site scripting issues</li>
|
|
<li>Cacti Graph Viewer SQL injection vulnerability</li>
|
|
</ul>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://php-security.org/2010/05/13/mops-2010-023-cacti-graph-viewer-sql-injection-vulnerability/index.html</url>
|
|
<url>http://www.cacti.net/release_notes_0_8_7f.php</url>
|
|
<url>http://www.bonsai-sec.com/en/research/vulnerabilities/cacti-os-command-injection-0105.php</url>
|
|
<url>http://www.vupen.com/english/advisories/2010/1204</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-05-24</discovery>
|
|
<entry>2010-06-24</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="99858b7c-7ece-11df-a007-000f20797ede">
|
|
<topic>mozilla -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>firefox</name>
|
|
<range><gt>3.6.*,1</gt><lt>3.6.4,1</lt></range>
|
|
<range><gt>3.5.*,1</gt><lt>3.5.10,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-firefox-devel</name>
|
|
<range><lt>3.5.10</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>seamonkey</name>
|
|
<range><gt>2.0.*</gt><lt>2.0.5</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>thunderbird</name>
|
|
<range><ge>3.0</ge><lt>3.0.5</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Mozilla Project reports:</p>
|
|
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
|
|
<p>MFSA 2010-33 User tracking across sites using Math.random()</p>
|
|
<p>MFSA 2010-32 Content-Disposition: attachment ignored if Content-Type: multipart also present</p>
|
|
<p>MFSA 2010-31 focus() behavior can be used to inject or steal keystrokes</p>
|
|
<p>MFSA 2010-30 Integer Overflow in XSLT Node Sorting</p>
|
|
<p>MFSA 2010-29 Heap buffer overflow in nsGenericDOMDataNode::SetTextInternal</p>
|
|
<p>MFSA 2010-28 Freed object reuse across plugin instances</p>
|
|
<p>MFSA 2010-27 Use-after-free error in nsCycleCollector::MarkRoots()</p>
|
|
<p>MFSA 2010-26 Crashes with evidence of memory corruption (rv:1.9.2.4/ 1.9.1.10)</p>
|
|
<p>MFSA 2010-25 Re-use of freed object due to scope confusion</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-5913</cvename>
|
|
<cvename>CVE-2010-0183</cvename>
|
|
<cvename>CVE-2010-1121</cvename>
|
|
<cvename>CVE-2010-1125</cvename>
|
|
<cvename>CVE-2010-1197</cvename>
|
|
<cvename>CVE-2010-1199</cvename>
|
|
<cvename>CVE-2010-1196</cvename>
|
|
<cvename>CVE-2010-1198</cvename>
|
|
<cvename>CVE-2010-1200</cvename>
|
|
<cvename>CVE-2010-1201</cvename>
|
|
<cvename>CVE-2010-1202</cvename>
|
|
<cvename>CVE-2010-1203</cvename>
|
|
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-33.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-32.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-31.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-30.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-29.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-28.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-27.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-26.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-25.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-06-22</discovery>
|
|
<entry>2010-06-23</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="25673e6e-786b-11df-a921-0245fb008c0b">
|
|
<topic>ziproxy -- security vulnerability in PNG decoder</topic>
|
|
<affects>
|
|
<package>
|
|
<name>ziproxy</name>
|
|
<range><ge>3.1.0</ge></range>
|
|
<range><lt>3.1.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Daniel Mealha Cabrita reports:</p>
|
|
<blockquote cite="http://ziproxy.sourceforge.net/#news">
|
|
<p>Fixed security vulnerability (heap-related) in PNG decoder.
|
|
(new bug from 3.1.0)</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://ziproxy.sourceforge.net/#news</url>
|
|
<mlist msgid="201006150731.30474.dancab@gmx.net">http://sourceforge.net/mailarchive/message.php?msg_name=201006150731.30474.dancab%40gmx.net</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-06-15</discovery>
|
|
<entry>2010-06-15</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="8816bf3a-7929-11df-bcce-0018f3e2eb82">
|
|
<topic>tiff -- Multiple integer overflows</topic>
|
|
<affects>
|
|
<package>
|
|
<name>tiff</name>
|
|
<range><lt>3.9.4</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-tiff</name>
|
|
<range><lt>3.9.4</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Tielei Wang:</p>
|
|
<blockquote cite="http://www.ocert.org/advisories/ocert-2009-012.html">
|
|
<p>Multiple integer overflows in inter-color spaces conversion
|
|
tools in libtiff 3.8 through 3.8.2, 3.9, and 4.0 allow
|
|
context-dependent attackers to execute arbitrary code via a
|
|
TIFF image with large (1) width and (2) height values, which
|
|
triggers a heap-based buffer overflow in the (a) cvt_whole_image
|
|
function in tiff2rgba and (b) tiffcvt function in rgb2ycbcr.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2009-2347</cvename>
|
|
<url>http://www.remotesensing.org/libtiff/v3.9.4.html</url>
|
|
<url>http://www.ocert.org/advisories/ocert-2009-012.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-05-22</discovery>
|
|
<entry>2010-06-16</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="144e524a-77eb-11df-ae06-001b2134ef46">
|
|
<topic>linux-flashplugin -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>linux-flashplugin</name>
|
|
<range><lt>9.0r277</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-f8-flashplugin</name>
|
|
<name>linux-f10-flashplugin</name>
|
|
<range><lt>10.1r53</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Adobe Product Security Incident Response Team reports:</p>
|
|
<blockquote cite="http://www.adobe.com/support/security/bulletins/apsb10-14.html">
|
|
<p>Critical vulnerabilities have been identified in Adobe
|
|
Flash Player version 10.0.45.2 and earlier. These
|
|
vulnerabilities could cause the application to crash and
|
|
could potentially allow an attacker to take control of the
|
|
affected system.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-4546</cvename>
|
|
<cvename>CVE-2009-3793</cvename>
|
|
<cvename>CVE-2010-1297</cvename>
|
|
<cvename>CVE-2010-2160</cvename>
|
|
<cvename>CVE-2010-2161</cvename>
|
|
<cvename>CVE-2010-2162</cvename>
|
|
<cvename>CVE-2010-2163</cvename>
|
|
<cvename>CVE-2010-2164</cvename>
|
|
<cvename>CVE-2010-2165</cvename>
|
|
<cvename>CVE-2010-2166</cvename>
|
|
<cvename>CVE-2010-2167</cvename>
|
|
<cvename>CVE-2010-2169</cvename>
|
|
<cvename>CVE-2010-2170</cvename>
|
|
<cvename>CVE-2010-2171</cvename>
|
|
<cvename>CVE-2010-2172</cvename>
|
|
<cvename>CVE-2010-2173</cvename>
|
|
<cvename>CVE-2010-2174</cvename>
|
|
<cvename>CVE-2010-2175</cvename>
|
|
<cvename>CVE-2010-2176</cvename>
|
|
<cvename>CVE-2010-2177</cvename>
|
|
<cvename>CVE-2010-2178</cvename>
|
|
<cvename>CVE-2010-2179</cvename>
|
|
<cvename>CVE-2010-2180</cvename>
|
|
<cvename>CVE-2010-2181</cvename>
|
|
<cvename>CVE-2010-2182</cvename>
|
|
<cvename>CVE-2010-2183</cvename>
|
|
<cvename>CVE-2010-2184</cvename>
|
|
<cvename>CVE-2010-2185</cvename>
|
|
<cvename>CVE-2010-2186</cvename>
|
|
<cvename>CVE-2010-2187</cvename>
|
|
<cvename>CVE-2010-2188</cvename>
|
|
<cvename>CVE-2010-2189</cvename>
|
|
<url>http://www.adobe.com/support/security/bulletins/apsb10-14.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-10-02</discovery>
|
|
<entry>2010-06-14</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="313da7dc-763b-11df-bcce-0018f3e2eb82">
|
|
<topic>tiff -- buffer overflow vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>tiff</name>
|
|
<range><lt>3.9.3</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-tiff</name>
|
|
<range><lt>3.9.3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Kevin Finisterre reports:</p>
|
|
<blockquote cite="http://support.apple.com/kb/HT4196">
|
|
<p>Multiple integer overflows in the handling of TIFF files may
|
|
result in a heap buffer overflow. Opening a maliciously crafted
|
|
TIFF file may lead to an unexpected application termination or
|
|
arbitrary code execution. The issues are addressed through
|
|
improved bounds checking. Credit to Kevin Finisterre of
|
|
digitalmunition.com for reporting these issues.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2010-1411</cvename>
|
|
<url>http://www.remotesensing.org/libtiff/v3.9.3.html</url>
|
|
<url>http://support.apple.com/kb/HT4196</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-04-15</discovery>
|
|
<entry>2010-06-12</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="d42e5b66-6ea0-11df-9c8d-00e0815b8da8">
|
|
<topic>sudo -- Secure path vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>sudo</name>
|
|
<range><lt>1.7.2.7</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Todd Miller reports:</p>
|
|
<blockquote cite="http://sudo.ws/sudo/alerts/secure_path.html">
|
|
<p>Most versions of the C library function getenv() return the
|
|
first instance of an environment variable to the caller. However,
|
|
some programs, notably the GNU Bourne Again SHell (bash), do
|
|
their own environment parsing and may choose the last instance
|
|
of a variable rather than the first one.</p>
|
|
<p>An attacker may manipulate the environment of the process that
|
|
executes Sudo such that a second PATH variable is present. When
|
|
Sudo runs a bash script, it is this second PATH variable that
|
|
is used by bash, regardless of whether or not Sudo has overwritten
|
|
the first instance of PATH. This may allow an attacker to
|
|
subvert the program being run under Sudo and execute commands
|
|
he/she would not otherwise be allowed to run.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2010-1646</cvename>
|
|
<url>http://sudo.ws/sudo/alerts/secure_path.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-06-02</discovery>
|
|
<entry>2010-06-02</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="b43004b8-6a53-11df-bc7b-0245fb008c0b">
|
|
<topic>ziproxy -- atypical huge picture files vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>ziproxy</name>
|
|
<range><lt>3.0.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Ziproxy 3.0.1 release fixes a security vulnerability related
|
|
to atypical huge picture files (>4GB of size once expanded).</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>40344</bid>
|
|
<cvename>CVE-2010-1513</cvename>
|
|
<url>http://ziproxy.sourceforge.net/#news</url>
|
|
<url>http://secunia.com/advisories/39941</url>
|
|
<mlist msgid="201005210019.37119.dancab@gmx.net">http://sourceforge.net/mailarchive/message.php?msg_name=201005210019.37119.dancab%40gmx.net</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-05-20</discovery>
|
|
<entry>2010-05-28</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="fc55e396-6deb-11df-8b8e-000c29ba66d2">
|
|
<topic>mediawiki -- two security vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>mediawiki</name>
|
|
<range><lt>1.15.4</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Two security vulnerabilities were discovered:</p>
|
|
<blockquote cite="http://lists.wikimedia.org/pipermail/mediawiki-announce/2010-May/000091.html">
|
|
<p>Noncompliant CSS parsing behaviour in Internet Explorer
|
|
allows attackers to construct CSS strings which are treated
|
|
as safe by previous versions of MediaWiki, but are decoded
|
|
to unsafe strings by Internet Explorer.</p>
|
|
<p>A CSRF vulnerability was discovered in our login interface.
|
|
Although regular logins are protected as of 1.15.3, it was
|
|
discovered that the account creation and password reset
|
|
reset features were not protected from CSRF. This could lead
|
|
to unauthorised access to private wikis.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://secunia.com/advisories/39922/</url>
|
|
<url>http://lists.wikimedia.org/pipermail/mediawiki-announce/2010-May/000091.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-05-28</discovery>
|
|
<entry>2010-06-02</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="fcc39d22-5777-11df-bf33-001a92771ec2">
|
|
<topic>redmine -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>redmine</name>
|
|
<range><lt>0.9.4</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Redmine release announcement reports that
|
|
several cross side scripting vulnerabilities
|
|
and a potential data disclosure vulnerability have
|
|
been fixed in the latest release.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://www.redmine.org/news/39</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-05-01</discovery>
|
|
<entry>2010-05-14</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="28022228-5a0e-11df-942d-0015587e2cc1">
|
|
<topic>wireshark -- DOCSIS dissector denial of service</topic>
|
|
<affects>
|
|
<package>
|
|
<name>wireshark</name>
|
|
<range><le>1.2.6_1</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A vulnerability found in the DOCSIS dissector can cause
|
|
Wireshark to crash when a malformed packet trace file is
|
|
opened. This means that an attacker will have to trick a
|
|
victim into opening such a trace file before being able
|
|
to crash the application</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2010-1455</cvename>
|
|
<url>http://www.wireshark.org/security/wnpa-sec-2010-03.html</url>
|
|
<url>http://www.wireshark.org/security/wnpa-sec-2010-04.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-05-05</discovery>
|
|
<entry>2010-05-07</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="c0869649-5a0c-11df-942d-0015587e2cc1">
|
|
<topic>piwik -- cross site scripting vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>piwik</name>
|
|
<range><le>0.5.5</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Piwik security advisory reports:</p>
|
|
<blockquote cite="http://piwik.org/blog/2010/04/piwik-0-6-security-advisory/">
|
|
<p>A non-persistent, cross-site scripting vulnerability
|
|
(XSS) was found in Piwik's Login form that reflected
|
|
the form_url parameter without being properly escaped
|
|
or filtered.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2010-1453</cvename>
|
|
<url>http://piwik.org/blog/2010/04/piwik-0-6-security-advisory/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-04-15</discovery>
|
|
<entry>2010-05-07</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="7132c842-58e2-11df-8d80-0015587e2cc1">
|
|
<topic>spamass-milter -- remote command execution vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>spamass-milter</name>
|
|
<range><le>0.3.1_8</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The spamassassin milter plugin contains a vulnerability
|
|
that can allow remote attackers to execute commands on
|
|
affected systems.</p>
|
|
<p>The vulnerability can be exploited trough a special-crafted
|
|
email header when the plugin was started with the '-x'
|
|
(expand) flag.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2010-1132</cvename>
|
|
<url>http://archives.neohapsis.com/archives/fulldisclosure/2010-03/0139.html</url>
|
|
<url>http://xforce.iss.net/xforce/xfdb/56732</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-03-07</discovery>
|
|
<entry>2010-05-06</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="694da5b4-5877-11df-8d80-0015587e2cc1">
|
|
<topic>mediawiki -- authenticated CSRF vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>mediawiki</name>
|
|
<range><lt>1.15.3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A MediaWiki security announcement reports:</p>
|
|
<blockquote cite="http://lists.wikimedia.org/pipermail/mediawiki-announce/2010-April/000090.html">
|
|
<p>MediaWiki was found to be vulnerable to login CSRF.
|
|
An attacker who controls a user account on the target
|
|
wiki can force the victim to log in as the attacker,
|
|
via a script on an external website.</p>
|
|
<p>If the wiki is configured to allow user scripts, say
|
|
with "$wgAllowUserJs = true" in LocalSettings.php, then
|
|
the attacker can proceed to mount a phishing-style
|
|
attack against the victim to obtain their password.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2010-1150</cvename>
|
|
<url>http://lists.wikimedia.org/pipermail/mediawiki-announce/2010-April/000090.html</url>
|
|
<url>https://bugzilla.wikimedia.org/show_bug.cgi?id=23076</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-04-07</discovery>
|
|
<entry>2010-05-05</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="0491d15a-5875-11df-8d80-0015587e2cc1">
|
|
<topic>lxr -- multiple XSS vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>lxr</name>
|
|
<range><le>0.9.6</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Dan Rosenberg reports:</p>
|
|
<blockquote cite="http://sourceforge.net/mailarchive/message.php?msg_name=E1NS2s4-0001PE-F2%403bkjzd1.ch3.sourceforge.com">
|
|
<p>There are several cross-site scripting vulnerabilities
|
|
in LXR. These vulnerabilities could allow an attacker
|
|
to execute scripts in a user's browser, steal cookies
|
|
associated with vulnerable domains, redirect the user
|
|
to malicious websites, etc.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2009-4497</cvename>
|
|
<freebsdpr>ports/146337</freebsdpr>
|
|
<url>http://secunia.com/advisories/38117</url>
|
|
<url>http://sourceforge.net/mailarchive/message.php?msg_name=E1NS2s4-0001PE-F2%403bkjzd1.ch3.sourceforge.com</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-01-05</discovery>
|
|
<entry>2010-05-05</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="752ce039-5242-11df-9139-00242b513d7c">
|
|
<topic>vlc -- unintended code execution with specially crafted data</topic>
|
|
<affects>
|
|
<package>
|
|
<name>vlc</name>
|
|
<range><lt>1.0.6</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>VideoLAN project reports:</p>
|
|
<blockquote cite="http://www.videolan.org/security/sa1003.html">
|
|
<p>VLC media player suffers from various vulnerabilities when
|
|
attempting to parse malformatted or overly long byte streams.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>39629</bid>
|
|
<url>http://www.videolan.org/security/sa1003.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-04-19</discovery>
|
|
<entry>2010-05-01</entry>
|
|
<modified>2010-05-05</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="8d10038e-515c-11df-83fb-0015587e2cc1">
|
|
<topic>joomla -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>joomla15</name>
|
|
<range><ge>1.5.1</ge><le>1.5.15</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Joomla! reported the following vulnerabilities:</p>
|
|
<blockquote cite="http://developer.joomla.org/security/news/311-20100423-core-negative-values-for-limit-and-offset.html">
|
|
<p>If a user entered a URL with a negative query limit
|
|
or offset, a PHP notice would display revealing information
|
|
about the system..</p>
|
|
</blockquote>
|
|
<blockquote cite="http://developer.joomla.org/security/news/310-20100423-core-installer-migration-script.html">
|
|
<p>The migration script in the Joomla! installer does not
|
|
check the file type being uploaded. If the installation
|
|
application is present, an attacker could use it to
|
|
upload malicious files to a server.</p>
|
|
</blockquote>
|
|
<blockquote cite="http://developer.joomla.org/security/news/309-20100423-core-sessation-fixation.html">
|
|
<p>Session id doesn't get modified when user logs in. A
|
|
remote site may be able to forward a visitor to the
|
|
Joomla! site and set a specific cookie. If the user
|
|
then logs in, the remote site can use that cookie to
|
|
authenticate as that user.</p>
|
|
</blockquote>
|
|
<blockquote cite="http://developer.joomla.org/security/news/308-20100423-core-password-reset-tokens.html">
|
|
<p>When a user requests a password reset, the reset tokens
|
|
were stored in plain text in the database. While this
|
|
is not a vulnerability in itself, it allows user accounts
|
|
to be compromised if there is an extension on the site
|
|
with an SQL injection vulnerability.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://developer.joomla.org/security/news/308-20100423-core-password-reset-tokens.html</url>
|
|
<url>http://developer.joomla.org/security/news/309-20100423-core-sessation-fixation.html</url>
|
|
<url>http://developer.joomla.org/security/news/310-20100423-core-installer-migration-script.html</url>
|
|
<url>http://developer.joomla.org/security/news/311-20100423-core-negative-values-for-limit-and-offset.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-04-23</discovery>
|
|
<entry>2010-04-26</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="5198ef84-4fdc-11df-83fb-0015587e2cc1">
|
|
<topic>cacti -- SQL injection and command execution vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>cacti</name>
|
|
<range><le>0.8.7e4</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Bonsai information security reports:</p>
|
|
<blockquote cite="http://www.bonsai-sec.com/en/research/vulnerability.php">
|
|
<p>A Vulnerability has been discovered in Cacti, which
|
|
can be exploited by any user to conduct SQL Injection
|
|
attacks. Input passed via the "export_item_id" parameter
|
|
to "templates_export.php" script is not properly sanitized
|
|
before being used in a SQL query.</p>
|
|
</blockquote>
|
|
<p>The same source also reported a command execution
|
|
vulnerability. This second issue can be exploited by
|
|
Cacti users who have the rights to modify device or
|
|
graph configurations.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2010-1431</cvename>
|
|
<freebsdpr>ports/146021</freebsdpr>
|
|
<url>http://www.bonsai-sec.com/en/research/vulnerabilities/cacti-os-command-injection-0105.php</url>
|
|
<url>http://www.bonsai-sec.com/en/research/vulnerabilities/cacti-sql-injection-0104.php</url>
|
|
<url>http://www.debian.org/security/2010/dsa-2039</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-04-21</discovery>
|
|
<entry>2010-04-24</entry>
|
|
<modified>2013-06-16</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="f6429c24-4fc9-11df-83fb-0015587e2cc1">
|
|
<topic>moodle -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>moodle</name>
|
|
<range><lt>1.9.8</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Moodle release notes report multiple vulnerabilities
|
|
which could allow remote attackers to perform, amongst
|
|
others, cross site scripting, user enumeration and SQL
|
|
injection attacks.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://docs.moodle.org/en/Moodle_1.9.8_release_notes</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-03-25</discovery>
|
|
<entry>2010-04-24</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="3383e706-4fc3-11df-83fb-0015587e2cc1">
|
|
<topic>tomcat -- information disclosure vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>tomcat</name>
|
|
<range><gt>5.5.0</gt><lt>5.5.30</lt></range>
|
|
<range><gt>6.0.0</gt><lt>6.0.27</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Apache software foundation reports:</p>
|
|
<blockquote cite="http://seclists.org/bugtraq/2010/Apr/200">
|
|
<p>The "WWW-Authenticate" header for BASIC and DIGEST
|
|
authentication includes a realm name. If a <realm-name>
|
|
element is specified for the application in web.xml it
|
|
will be used. However, a <realm-name> is not
|
|
specified then Tomcat will generate one.</p>
|
|
<p>In some circumstances this can expose the local
|
|
hostname or IP address of the machine running Tomcat.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2010-1157</cvename>
|
|
<freebsdpr>ports/146022</freebsdpr>
|
|
<url>http://seclists.org/bugtraq/2010/Apr/200</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-04-22</discovery>
|
|
<entry>2010-04-24</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="f6b6beaa-4e0e-11df-83fb-0015587e2cc1">
|
|
<cancelled/>
|
|
</vuln>
|
|
|
|
<vuln vid="86b8b655-4d1a-11df-83fb-0015587e2cc1">
|
|
<topic>krb5 -- KDC double free vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>krb5</name>
|
|
<range><ge>1.7</ge><lt>1.7.2</lt></range>
|
|
<range><ge>1.8</ge><lt>1.8.2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The MIT Kerberos team reports:</p>
|
|
<blockquote cite="http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-004.txt">
|
|
<p>An authenticated remote attacker can crash the KDC by
|
|
inducing the KDC to perform a double free. Under some
|
|
circumstances on some platforms, this could also allow
|
|
malicious code execution.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2010-1320</cvename>
|
|
<url>http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-004.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-04-20</discovery>
|
|
<entry>2010-04-21</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="a4746a86-4c89-11df-83fb-0015587e2cc1">
|
|
<topic>e107 -- code execution and XSS vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>e107</name>
|
|
<range><lt>0.7.20</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia Research reported two vulnerabilities in e107:</p>
|
|
<p>The first problem affects installations that have the
|
|
Content Manager plugin enabled. This plugin does not
|
|
sanitize the "content_heading" parameter correctly and
|
|
is therefore vulnerable to a cross site scripting attack.</p>
|
|
<p>The second vulnerability is related to the avatar upload
|
|
functionality. Images containing PHP code can be uploaded
|
|
and executed.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>39540</bid>
|
|
<cvename>CVE-2010-0996</cvename>
|
|
<cvename>CVE-2010-0997</cvename>
|
|
<freebsdpr>ports/145885</freebsdpr>
|
|
<url>http://e107.org/comment.php?comment.news.864</url>
|
|
<url>http://secunia.com/secunia_research/2010-43/</url>
|
|
<url>http://secunia.com/secunia_research/2010-44/</url>
|
|
<url>http://xforce.iss.net/xforce/xfdb/57932</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-04-15</discovery>
|
|
<entry>2010-04-20</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="09910d76-4c82-11df-83fb-0015587e2cc1">
|
|
<topic>fetchmail -- denial of service vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>fetchmail</name>
|
|
<range>
|
|
<ge>4.6.3</ge>
|
|
<le>6.3.16</le>
|
|
</range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Fetchmail developer Matthias Andree reported a vulnerability
|
|
that allows remote attackers to crash the application
|
|
when it is runs in verbose mode.</p>
|
|
<blockquote cite="http://gitorious.org/fetchmail/fetchmail/commit/ec06293">
|
|
<p>Fetchmail before release 6.3.17 did not properly
|
|
sanitize external input (mail headers and UID). When a
|
|
multi-character locale (such as UTF-8) was in use, this
|
|
could cause memory exhaustion and thus a denial of
|
|
service.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2010-1167</cvename>
|
|
<freebsdpr>ports/145857</freebsdpr>
|
|
<url>http://gitorious.org/fetchmail/fetchmail/commit/ec06293</url>
|
|
<url>http://seclists.org/oss-sec/2010/q2/76</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-04-18</discovery>
|
|
<entry>2010-04-20</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="a2c4d3d5-4c7b-11df-83fb-0015587e2cc1">
|
|
<topic>pidgin -- multiple remote denial of service vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>pidgin</name>
|
|
<range><lt>2.6.6</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>libpurple</name>
|
|
<range><lt>2.6.6</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Three denial of service vulnerabilities where found in
|
|
pidgin and allow remote attackers to crash the application.
|
|
The developers summarized these problems as follows:</p>
|
|
<blockquote cite="http://pidgin.im/news/security/?id=45">
|
|
<p>Pidgin can become unresponsive when displaying large
|
|
numbers of smileys</p>
|
|
</blockquote>
|
|
<blockquote cite="http://pidgin.im/news/security/?id=44">
|
|
<p>Certain nicknames in group chat rooms can trigger a
|
|
crash in Finch</p>
|
|
</blockquote>
|
|
<blockquote cite="http://pidgin.im/news/security/?id=43">
|
|
<p>Failure to validate all fields of an incoming message
|
|
can trigger a crash</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>38294</bid>
|
|
<cvename>CVE-2010-0277</cvename>
|
|
<cvename>CVE-2010-0420</cvename>
|
|
<cvename>CVE-2010-0423</cvename>
|
|
<url>http://pidgin.im/news/security/?id=43</url>
|
|
<url>http://pidgin.im/news/security/?id=44</url>
|
|
<url>http://pidgin.im/news/security/?id=45</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-02-18</discovery>
|
|
<entry>2010-04-20</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="4fb5d2cd-4c77-11df-83fb-0015587e2cc1">
|
|
<topic>png -- libpng decompression denial of service</topic>
|
|
<affects>
|
|
<package>
|
|
<name>png</name>
|
|
<range>
|
|
<gt>1.2.43</gt>
|
|
<lt>1.4.1</lt>
|
|
</range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A vulnerability in libpng can result in denial of service
|
|
conditions when a remote attacker tricks a victim to open
|
|
a specially-crafted PNG file.</p>
|
|
<p>The PNG project describes the problem in an advisory:</p>
|
|
<blockquote cite="http://libpng.sourceforge.net/ADVISORY-1.4.1.html">
|
|
<p>Because of the efficient compression method used in
|
|
Portable Network Graphics (PNG) files, a small PNG file
|
|
can expand tremendously, acting as a "decompression
|
|
bomb".</p>
|
|
<p>Malformed PNG chunks can consume a large amount of CPU
|
|
and wall-clock time and large amounts of memory, up to
|
|
all memory available on a system</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>38478</bid>
|
|
<certvu>576029</certvu>
|
|
<cvename>CVE-2010-0205</cvename>
|
|
<url>http://libpng.sourceforge.net/ADVISORY-1.4.1.html</url>
|
|
<url>http://secunia.com/advisories/38774</url>
|
|
<url>http://xforce.iss.net/xforce/xfdb/56661</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-02-27</discovery>
|
|
<entry>2010-04-20</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="c8c31c41-49ed-11df-83fb-0015587e2cc1">
|
|
<topic>curl -- libcurl buffer overflow vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>curl</name>
|
|
<range>
|
|
<ge>7.10.5</ge>
|
|
<lt>7.20.0</lt>
|
|
</range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The cURL project reports in a security advisory:</p>
|
|
<blockquote cite="http://curl.haxx.se/docs/adv_20100209.html">
|
|
<p>Using the affected libcurl version to download compressed
|
|
content over HTTP, an application can ask libcurl to
|
|
automatically uncompress data. When doing so, libcurl
|
|
can wrongly send data up to 64K in size to the callback
|
|
which thus is much larger than the documented maximum
|
|
size.</p>
|
|
<p>An application that blindly trusts libcurl's max limit
|
|
for a fixed buffer size or similar is then a possible
|
|
target for a buffer overflow vulnerability.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2010-0734</cvename>
|
|
<url>http://curl.haxx.se/docs/adv_20100209.html</url>
|
|
<url>http://www.debian.org/security/2010/dsa-2023</url>
|
|
<url>http://www.openwall.com/lists/oss-security/2010/02/09/5</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-02-09</discovery>
|
|
<entry>2010-04-19</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="a04a3c13-4932-11df-83fb-0015587e2cc1">
|
|
<topic>ejabberd -- queue overload denial of service vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>ejabberd</name>
|
|
<range><lt>2.1.3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Red Hat security response team reports:</p>
|
|
<blockquote cite="http://www.openwall.com/lists/oss-security/2010/01/29/1">
|
|
<p>A remotely exploitable DoS from XMPP client to ejabberd
|
|
server via too many "client2server" messages (causing the
|
|
message queue on the server to get overloaded, leading
|
|
to server crash) has been found.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>38003</bid>
|
|
<cvename>CVE-2010-0305</cvename>
|
|
<url>http://secunia.com/advisories/38337</url>
|
|
<url>http://support.process-one.net/browse/EJAB-1173</url>
|
|
<url>http://www.openwall.com/lists/oss-security/2010/01/29/1</url>
|
|
<url>http://xforce.iss.net/xforce/xfdb/56025</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-01-29</discovery>
|
|
<entry>2010-04-19</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="3b7967f1-49e8-11df-83fb-0015587e2cc1">
|
|
<topic>irssi -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>irssi</name>
|
|
<range><lt>0.8.15</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>zh-irssi</name>
|
|
<range><lt>0.8.15</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>irssi-devel</name>
|
|
<range><lt>20100325</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Two vulnerabilities have found in irssi. The first issue
|
|
could allow man-in-the-middle attacks due to a missing
|
|
comparison of SSL server hostnames and the certificate
|
|
domain names (e.g. CN).</p>
|
|
<p>A second vulnerability, related to the nick matching code,
|
|
could be triggered by remote attackers in order to crash
|
|
an irssi client when leaving a channel.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2010-1155</cvename>
|
|
<cvename>CVE-2010-1156</cvename>
|
|
<url>http://xforce.iss.net/xforce/xfdb/57790</url>
|
|
<url>http://xforce.iss.net/xforce/xfdb/57791</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-04-16</discovery>
|
|
<entry>2010-04-19</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="a30573dc-4893-11df-a5f9-001641aeabdf">
|
|
<topic>krb5 -- remote denial of service vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>krb5</name>
|
|
<range><le>1.6.3_9</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>An authenticated remote attacker can causing a denial
|
|
of service by using a newer version of the kadmin protocol
|
|
than the server supports.</p>
|
|
<p>The MIT Kerberos team also reports the cause:</p>
|
|
<blockquote cite="http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-003.txt">
|
|
<p>The Kerberos administration daemon (kadmind) can crash
|
|
due to referencing freed memory.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>39247</bid>
|
|
<cvename>CVE-2010-0629</cvename>
|
|
<url>http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-003.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-04-06</discovery>
|
|
<entry>2010-04-18</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="9ac0f9c4-492b-11df-83fb-0015587e2cc1">
|
|
<topic>krb5 -- multiple denial of service vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>krb5</name>
|
|
<range>
|
|
<ge>1.7</ge><le>1.7_2</le>
|
|
</range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Two vulnerabilities in krb5 can be used by remote
|
|
attackers in denial of service attacks. The MIT security
|
|
advisories report this as follows:</p>
|
|
<blockquote cite="http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-001.txt">
|
|
<p>An unauthenticated remote attacker can send an invalid
|
|
request to a KDC process that will cause it to crash
|
|
due to an assertion failure, creating a denial of
|
|
service.</p>
|
|
</blockquote>
|
|
<blockquote cite="http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-002.txt">
|
|
<p>An unauthenticated remote attacker could cause a GSS-API
|
|
application, including the Kerberos administration
|
|
daemon (kadmind) to crash.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>38260</bid>
|
|
<bid>38904</bid>
|
|
<cvename>CVE-2010-0283</cvename>
|
|
<cvename>CVE-2010-0628</cvename>
|
|
<url>http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-001.txt</url>
|
|
<url>http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-002.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-02-16</discovery>
|
|
<entry>2010-04-19</entry>
|
|
<modified>2013-06-16</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="5053420c-4935-11df-83fb-0015587e2cc1">
|
|
<topic>mahara -- sql injection vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>mahara</name>
|
|
<range><lt>1.1.8</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Debian security team reports:</p>
|
|
<blockquote cite="http://www.debian.org/security/2010/dsa-2030">
|
|
<p>It was discovered that mahara, an electronic portfolio,
|
|
weblog, and resume builder is not properly escaping input
|
|
when generating a unique username based on a remote user
|
|
name from a single sign-on application. An attacker can
|
|
use this to compromise the mahara database via crafted
|
|
user names.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>39253</bid>
|
|
<cvename>CVE-2010-0400</cvename>
|
|
<url>http://www.debian.org/security/2010/dsa-2030</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-04-06</discovery>
|
|
<entry>2010-04-18</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="1a9f678d-48ca-11df-85f8-000c29a67389">
|
|
<topic>sudo -- Privilege escalation with sudoedit</topic>
|
|
<affects>
|
|
<package>
|
|
<name>sudo</name>
|
|
<range><lt>1.7.2.6</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Todd Miller reports:</p>
|
|
<blockquote cite="">
|
|
<p>Sudo's command matching routine expects actual commands to include
|
|
one or more slash ('/') characters. The flaw is that sudo's path
|
|
resolution code did not add a "./" prefix to commands found in the
|
|
current working directory. This creates an ambiguity between a
|
|
"sudoedit" command found in the cwd and the "sudoedit"
|
|
pseudo-command in the sudoers file. As a result, a user may be
|
|
able to run an arbitrary command named "sudoedit" in the current
|
|
working directory. For the attack to be successful, the PATH
|
|
environment variable must include "." and may not include any other
|
|
directory that contains a "sudoedit" command.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2010-1163</cvename>
|
|
<url>http://www.sudo.ws/pipermail/sudo-announce/2010-April/000093.html</url>
|
|
<url>http://www.sudo.ws/sudo/alerts/sudoedit_escalate2.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-04-09</discovery>
|
|
<entry>2010-04-15</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="3987c5d1-47a9-11df-a0d5-0016d32f24fb">
|
|
<topic>KDM -- local privilege escalation vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>kdebase</name>
|
|
<range><le>3.5.10_6</le></range>
|
|
</package>
|
|
<package>
|
|
<name>kdebase-workspace</name>
|
|
<range><le>4.3.5_1</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>KDE Security Advisory reports:</p>
|
|
<blockquote cite="http://www.kde.org/info/security/advisory-20100413-1.txt">
|
|
<p>KDM contains a race condition that allows local attackers
|
|
to make arbitrary files on the system world-writeable.
|
|
This can happen while KDM tries to create its control
|
|
socket during user login. A local attacker with a valid
|
|
local account can under certain circumstances make use of
|
|
this vulnerability to execute arbitrary code as root.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2010-0436</cvename>
|
|
<url>http://www.kde.org/info/security/advisory-20100413-1.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-04-13</discovery>
|
|
<entry>2010-04-14</entry>
|
|
<modified>2010-04-14</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="805603a1-3e7a-11df-a5a1-0050568452ac">
|
|
<topic>dojo -- cross-site scripting and other vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>dojo</name>
|
|
<range><lt>1.4.2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Dojo Toolkit team reports:</p>
|
|
<blockquote cite="http://dojotoolkit.org/blog/post/dylan/2010/03/dojo-security-advisory/">
|
|
<p>Some PHP files did not properly escape input.</p>
|
|
<p>Some files could operate like "open redirects". A bad actor
|
|
could form an URL that looks like it came from a trusted
|
|
site, but the user would be redirected or load content from
|
|
the bad actor's site.</p>
|
|
<p>A file exposed a more serious cross-site scripting
|
|
vulnerability with the possibility of executing code on the
|
|
domain where the file exists.</p>
|
|
<p>The Dojo build process defaulted to copying over tests and
|
|
demos, which are normally not needed and just increased the
|
|
number of files that could be targets of attacks.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://dojotoolkit.org/blog/post/dylan/2010/03/dojo-security-advisory/</url>
|
|
<url>http://osdir.com/ml/bugtraq.security/2010-03/msg00133.html</url>
|
|
<url>http://packetstormsecurity.org/1003-exploits/dojo-xss.txt</url>
|
|
<url>http://secunia.com/advisories/38964</url>
|
|
<url>http://www.gdssecurity.com/l/b/2010/03/12/multiple-dom-based-xss-in-dojo-toolkit-sdk/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-03-11</discovery>
|
|
<entry>2010-04-06</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="8ad1c404-3e78-11df-a5a1-0050568452ac">
|
|
<topic>Zend Framework -- security issues in bundled Dojo library</topic>
|
|
<affects>
|
|
<package>
|
|
<name>ZendFramework</name>
|
|
<range><lt>1.10.3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Zend Framework team reports:</p>
|
|
<blockquote cite="http://framework.zend.com/security/advisory/ZF2010-07">
|
|
<p>Several files in the bundled Dojo library were identified
|
|
as having potential exploits, and the Dojo team also advised
|
|
disabling or removing any PHP scripts in the Dojo library tree
|
|
when deploying to production.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://dojotoolkit.org/blog/post/dylan/2010/03/dojo-security-advisory/</url>
|
|
<url>http://framework.zend.com/security/advisory/ZF2010-07</url>
|
|
<url>http://osdir.com/ml/bugtraq.security/2010-03/msg00133.html</url>
|
|
<url>http://packetstormsecurity.org/1003-exploits/dojo-xss.txt</url>
|
|
<url>http://secunia.com/advisories/38964</url>
|
|
<url>http://www.gdssecurity.com/l/b/2010/03/12/multiple-dom-based-xss-in-dojo-toolkit-sdk/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-04-01</discovery>
|
|
<entry>2010-04-06</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="ec8f449f-40ed-11df-9edc-000f20797ede">
|
|
<topic>firefox -- Re-use of freed object due to scope confusion</topic>
|
|
<affects>
|
|
<package>
|
|
<name>firefox</name>
|
|
<range><gt>3.6,1</gt><lt>3.6.3,1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Mozilla Project reports:</p>
|
|
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
|
|
<p>MFSA 2009-25 Re-use of freed object due to scope confusion</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2010-1121</cvename>
|
|
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-25.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-04-01</discovery>
|
|
<entry>2010-04-05</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="9ccfee39-3c3b-11df-9edc-000f20797ede">
|
|
<topic>mozilla -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>seamonkey</name>
|
|
<range><gt>2.0</gt><lt>2.0.4</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>thunderbird</name>
|
|
<range><ge>3.0</ge><lt>3.0.4</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>firefox</name>
|
|
<range><gt>3.5.*,1</gt><lt>3.5.9,1</lt></range>
|
|
<range><gt>3.*,1</gt><lt>3.0.19,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-firefox</name>
|
|
<range><lt>3.0.19,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-firefox-devel</name>
|
|
<range><lt>3.5.9</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Mozilla Project reports:</p>
|
|
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
|
|
<p>MFSA 2010-24 XMLDocument::load() doesn't check nsIContentPolicy</p>
|
|
<p>MFSA 2010-23 Image src redirect to mailto: URL opens email editor</p>
|
|
<p>MFSA 2010-22 Update NSS to support TLS renegotiation indication</p>
|
|
<p>MFSA 2010-21 Arbitrary code execution with Firebug XMLHttpRequestSpy</p>
|
|
<p>MFSA 2010-20 Chrome privilege escalation via forced URL drag and drop</p>
|
|
<p>MFSA 2010-19 Dangling pointer vulnerability in nsPluginArray</p>
|
|
<p>MFSA 2010-18 Dangling pointer vulnerability in nsTreeContentView</p>
|
|
<p>MFSA 2010-17 Remote code execution with use-after-free in nsTreeSelection</p>
|
|
<p>MFSA 2010-16 Crashes with evidence of memory corruption (rv:1.9.2.2/ 1.9.1.9/ 1.9.0.19)</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2010-0181</cvename>
|
|
<cvename>CVE-2009-3555</cvename>
|
|
<cvename>CVE-2010-0179</cvename>
|
|
<cvename>CVE-2010-0178</cvename>
|
|
<cvename>CVE-2010-0177</cvename>
|
|
<cvename>CVE-2010-0176</cvename>
|
|
<cvename>CVE-2010-0175</cvename>
|
|
<cvename>CVE-2010-0174</cvename>
|
|
<cvename>CVE-2010-0173</cvename>
|
|
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-24.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-23.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-22.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-21.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-20.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-19.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-18.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-17.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-16.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-03-30</discovery>
|
|
<entry>2010-03-30</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="e050119b-3856-11df-b2b2-002170daae37">
|
|
<topic>postgresql -- bitsubstr overflow</topic>
|
|
<affects>
|
|
<package>
|
|
<name>postgresql-server</name>
|
|
<range><ge>7.4</ge><lt>7.4.28</lt></range>
|
|
<range><ge>8.0</ge><lt>8.0.24</lt></range>
|
|
<range><ge>8.1</ge><lt>8.1.20</lt></range>
|
|
<range><ge>8.2</ge><lt>8.2.16</lt></range>
|
|
<range><ge>8.3</ge><lt>8.3.10</lt></range>
|
|
<range><ge>8.4</ge><lt>8.4.3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>BugTraq reports:</p>
|
|
<blockquote cite="http://www.securityfocus.com/bid/37973">
|
|
<p>PostgreSQL is prone to a buffer-overflow
|
|
vulnerability because the application fails to
|
|
perform adequate boundary checks on user-supplied
|
|
data.</p>
|
|
<p>Attackers can exploit this issue to execute
|
|
arbitrary code with elevated privileges or
|
|
crash the affected application.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>37973</bid>
|
|
<cvename>CVE-2010-0442</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-01-27</discovery>
|
|
<entry>2010-03-25</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="c175d72f-3773-11df-8bb8-0211d880e350">
|
|
<topic>gtar -- buffer overflow in rmt client</topic>
|
|
<affects>
|
|
<package>
|
|
<name>gtar</name>
|
|
<range><lt>1.22_3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Jakob Lell reports:</p>
|
|
<blockquote cite="http://www.agrs.tu-berlin.de/index.php?id=78327">
|
|
<p>The rmt client implementation of GNU Tar/Cpio contains
|
|
a heap-based buffer overflow which possibly allows
|
|
arbitrary code execution.</p>
|
|
<p>The problem can be exploited when using an
|
|
untrusted/compromised rmt server.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description> <references>
|
|
<cvename>CVE-2010-0624</cvename>
|
|
<url>http://www.agrs.tu-berlin.de/index.php?id=78327</url>
|
|
</references> <dates>
|
|
<discovery>2010-03-24</discovery> <entry>2010-03-24</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="5d5ed535-3653-11df-9edc-000f20797ede">
|
|
<topic>firefox -- WOFF heap corruption due to integer overflow</topic>
|
|
<affects>
|
|
<package>
|
|
<name>firefox</name>
|
|
<range><gt>3.6,1</gt><lt>3.6.2,1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Mozilla Project reports:</p>
|
|
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
|
|
<p>MFSA 2010-08 WOFF heap corruption due to integer overflow</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2010-1028</cvename>
|
|
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-08.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-03-22</discovery>
|
|
<entry>2010-03-23</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="56cfe192-329f-11df-abb2-000f20797ede">
|
|
<topic>mozilla -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>seamonkey</name>
|
|
<name>linux-seamonkey</name>
|
|
<range><lt>1.1.19</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>thunderbird</name>
|
|
<name>linux-thunderbird</name>
|
|
<range><lt>2.0.0.24</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Mozilla Project reports:</p>
|
|
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
|
|
<p>MFSA 2010-07 Fixes for potentially exploitable crashes ported to the legacy branch</p>
|
|
<p>MFSA 2010-06 Scriptable plugin execution in SeaMonkey mail</p>
|
|
<p>MFSA 2009-68 NTLM reflection vulnerability</p>
|
|
<p>MFSA 2009-62 Download filename spoofing with RTL override</p>
|
|
<p>MFSA 2009-59 Heap buffer overflow in string to number conversion</p>
|
|
<p>MFSA 2009-49 TreeColumns dangling pointer vulnerability</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2010-0161</cvename>
|
|
<cvename>CVE-2010-0163</cvename>
|
|
<cvename>CVE-2009-3075</cvename>
|
|
<cvename>CVE-2009-3072</cvename>
|
|
<cvename>CVE-2009-2463</cvename>
|
|
<cvename>CVE-2009-3385</cvename>
|
|
<cvename>CVE-2009-3983</cvename>
|
|
<cvename>CVE-2009-3376</cvename>
|
|
<cvename>CVE-2009-0689</cvename>
|
|
<cvename>CVE-2009-3077</cvename>
|
|
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-07.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-06.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2009/mfsa2009-68.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2009/mfsa2009-62.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2009/mfsa2009-59.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2009/mfsa2009-49.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-03-16</discovery>
|
|
<entry>2010-03-19</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="e39caf05-2d6f-11df-aec2-000c29ba66d2">
|
|
<topic>egroupware -- two vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>egroupware</name>
|
|
<range><lt>1.6.003</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Egroupware Team report:</p>
|
|
<blockquote cite="http://www.egroupware.org/Home?category_id=95&item=93">
|
|
<p>Nahuel Grisolia from CYBSEC S.A. Security Systems found two security
|
|
problems in EGroupware:</p>
|
|
<p>Serious remote command execution (allowing to run arbitrary command
|
|
on the web server by simply issuing a HTTP request!).</p>
|
|
<p>A reflected cross-site scripting (XSS).</p>
|
|
<p>Both require NO valid EGroupware account and work without being logged
|
|
in!</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>38609</bid>
|
|
<url>http://secunia.com/advisories/38859/</url>
|
|
<url>http://www.egroupware.org/Home?category_id=95&item=93</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-03-09</discovery>
|
|
<entry>2010-03-11</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="b3531fe1-2b03-11df-b6db-00248c9b4be7">
|
|
<topic>drupal -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>drupal5</name>
|
|
<range><lt>5.22</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>drupal6</name>
|
|
<range><lt>6.16</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Drupal Team reports:</p>
|
|
<blockquote cite="http://drupal.org/node/731710">
|
|
<p>A user-supplied value is directly output during installation
|
|
allowing a malicious user to craft a URL and perform a cross-site
|
|
scripting attack. The exploit can only be conducted on sites not yet
|
|
installed.</p>
|
|
<p>The API function drupal_goto() is susceptible to a phishing attack.
|
|
An attacker could formulate a redirect in a way that gets the Drupal
|
|
site to send the user to an arbitrarily provided URL. No user
|
|
submitted data will be sent to that URL.</p>
|
|
<p>Locale module and dependent contributed modules do not sanitize the
|
|
display of language codes, native and English language names properly.
|
|
While these usually come from a preselected list, arbitrary
|
|
administrator input is allowed. This vulnerability is mitigated by the
|
|
fact that the attacker must have a role with the 'administer
|
|
languages' permission.</p>
|
|
<p>Under certain circumstances, a user with an open session that is
|
|
blocked can maintain his/her session on the Drupal site, despite being
|
|
blocked.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://drupal.org/node/731710</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-03-03</discovery>
|
|
<entry>2010-03-08</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="018a84d0-2548-11df-b4a3-00e0815b8da8">
|
|
<topic>sudo -- Privilege escalation with sudoedit</topic>
|
|
<affects>
|
|
<package>
|
|
<name>sudo</name>
|
|
<range><lt>1.7.2.4</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Todd Miller reports:</p>
|
|
<blockquote cite="">
|
|
<p>When sudo performs its command matching, there is a special case
|
|
for pseudo-commands in the sudoers file (currently, the only
|
|
pseudo-command is sudoedit). Unlike a regular command,
|
|
pseudo-commands do not begin with a slash ('/'). The flaw is that
|
|
sudo's the matching code would only check against the list of
|
|
pseudo-commands if the user-specified command also contained no
|
|
slashes. As a result, if the user ran "sudo ./sudoedit" the normal
|
|
matching code path was followed, which uses stat(2) to verify that
|
|
the user-specified command matches the one in sudoers. In this
|
|
case, it would compare the "./sudoedit" specified by the user with
|
|
"sudoedit" from the sudoers file, resulting in a positive
|
|
match.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://www.sudo.ws/pipermail/sudo-announce/2010-February/000092.html</url>
|
|
<url>http://www.sudo.ws/sudo/alerts/sudoedit_escalate.html</url>
|
|
<url>http://secunia.com/advisories/38659</url>
|
|
<cvename>CVE-2010-0426</cvename>
|
|
<bid>38362</bid>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-01-29</discovery>
|
|
<entry>2010-03-01</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="c97d7a37-2233-11df-96dd-001b2134ef46">
|
|
<topic>openoffice.org -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>openoffice.org</name>
|
|
<range><lt>3.2.0</lt></range>
|
|
<range><ge>3.2.20010101</ge><lt>3.2.20100203</lt></range>
|
|
<range><ge>3.3.20010101</ge><lt>3.3.20100207</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>OpenOffice.org Security Team reports:</p>
|
|
<blockquote cite="http://www.openoffice.org/security/bulletin.html">
|
|
<p>Fixed in OpenOffice.org 3.2</p>
|
|
<p>CVE-2006-4339: Potential vulnerability from 3rd party
|
|
libxml2 libraries</p>
|
|
<p>CVE-2009-0217: Potential vulnerability from 3rd party
|
|
libxmlsec libraries</p>
|
|
<p>CVE-2009-2493: OpenOffice.org 3 for Windows bundles a vulnerable
|
|
version of MSVC Runtime</p>
|
|
<p>CVE-2009-2949: Potential vulnerability related to XPM file
|
|
processing</p>
|
|
<p>CVE-2009-2950: Potential vulnerability related to GIF file
|
|
processing</p>
|
|
<p>CVE-2009-3301/2: Potential vulnerability related to MS-Word
|
|
document processing</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://www.openoffice.org/security/bulletin.html</url>
|
|
<url>http://www.openoffice.org/security/cves/CVE-2006-4339.html</url>
|
|
<url>http://www.openoffice.org/security/cves/CVE-2009-0217.html</url>
|
|
<url>http://www.openoffice.org/security/cves/CVE-2009-2493.html</url>
|
|
<url>http://www.openoffice.org/security/cves/CVE-2009-2949.html</url>
|
|
<url>http://www.openoffice.org/security/cves/CVE-2009-2950.html</url>
|
|
<url>http://www.openoffice.org/security/cves/CVE-2009-3301-3302.html</url>
|
|
<cvename>CVE-2006-4339</cvename>
|
|
<cvename>CVE-2009-0217</cvename>
|
|
<cvename>CVE-2009-2493</cvename>
|
|
<cvename>CVE-2009-2949</cvename>
|
|
<cvename>CVE-2009-2950</cvename>
|
|
<cvename>CVE-2009-3301</cvename>
|
|
<cvename>CVE-2009-3302</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-08-24</discovery>
|
|
<entry>2010-02-25</entry>
|
|
<modified>2010-02-27</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="f82c85d8-1c6e-11df-abb2-000f20797ede">
|
|
<topic>mozilla -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>firefox</name>
|
|
<range><gt>3.5.*,1</gt><lt>3.5.8,1</lt></range>
|
|
<range><gt>3.*,1</gt><lt>3.0.18,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-firefox</name>
|
|
<range><lt>3.0.18,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-firefox-devel</name>
|
|
<range><lt>3.5.8</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>seamonkey</name>
|
|
<range><gt>2.0.*</gt><lt>2.0.3</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>thunderbird</name>
|
|
<range><ge>3.0</ge><lt>3.0.2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Mozilla Project reports:</p>
|
|
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
|
|
<p>MFSA 2010-05 XSS hazard using SVG document and binary Content-Type</p>
|
|
<p>MFSA 2010-04 XSS due to window.dialogArguments being readable cross-domain</p>
|
|
<p>MFSA 2010-03 Use-after-free crash in HTML parser</p>
|
|
<p>MFSA 2010-02 Web Worker Array Handling Heap Corruption Vulnerability</p>
|
|
<p>MFSA 2010-01 Crashes with evidence of memory corruption (rv:1.9.1.8/ 1.9.0.18)</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2010-0159</cvename>
|
|
<cvename>CVE-2010-0160</cvename>
|
|
<cvename>CVE-2009-1571</cvename>
|
|
<cvename>CVE-2009-3988</cvename>
|
|
<cvename>CVE-2010-0162</cvename>
|
|
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-01.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-02.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-03.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-04.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2010/mfsa2010-05.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-02-17</discovery>
|
|
<entry>2010-02-18</entry>
|
|
<modified>2010-02-28</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="1a3bd81f-1b25-11df-bd1a-002170daae37">
|
|
<topic>lighttpd -- denial of service vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>lighttpd</name>
|
|
<range><lt>1.4.26</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Lighttpd security advisory reports:</p>
|
|
<blockquote cite="http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2010_01.txt">
|
|
<p>If you send the request data very slow (e.g. sleep
|
|
0.01 after each byte), lighttpd will easily use all
|
|
available memory and die (especially for parallel
|
|
requests), allowing a DoS within minutes.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>38036</bid>
|
|
<cvename>CVE-2010-0295</cvename>
|
|
<url>http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2010_01.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-02-02</discovery>
|
|
<entry>2010-02-16</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="81d9dc0c-1988-11df-8e66-0019996bc1f7">
|
|
<topic>squid -- Denial of Service vulnerability in HTCP</topic>
|
|
<affects>
|
|
<package>
|
|
<name>squid</name>
|
|
<range><ge>2.7.1</ge><lt>2.7.7_4</lt></range>
|
|
<range><ge>3.0.1</ge><lt>3.0.24</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Squid security advisory 2010:2 reports:</p>
|
|
<blockquote cite="http://www.squid-cache.org/Advisories/SQUID-2010_2.txt">
|
|
<p>Due to incorrect processing Squid is vulnerable to a
|
|
denial of service attack when receiving specially crafted
|
|
HTCP packets.</p>
|
|
<p>This problem allows any machine to perform a denial
|
|
of service attack on the Squid service when its HTCP port
|
|
is open.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2010-0639</cvename>
|
|
<url>http://www.squid-cache.org/Advisories/SQUID-2010_2.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-02-12</discovery>
|
|
<entry>2010-02-14</entry>
|
|
<modified>2010-05-02</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="ff6519ad-18e5-11df-9bdd-001b2134ef46">
|
|
<topic>linux-flashplugin -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>linux-flashplugin</name>
|
|
<range><lt>9.0r262</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-f8-flashplugin</name>
|
|
<name>linux-f10-flashplugin</name>
|
|
<range><lt>10.0r45</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Adobe Product Security Incident Response Team reports:</p>
|
|
<blockquote cite="http://www.adobe.com/support/security/bulletins/apsb10-06.html">
|
|
<p>A critical vulnerability has been identified in Adobe
|
|
Flash Player version 10.0.42.34 and earlier. This
|
|
vulnerability (CVE-2010-0186) could subvert the domain sandbox
|
|
and make unauthorized cross-domain requests. This update also
|
|
resolves a potential Denial of Service issue (CVE-2010-0187).</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2010-0186</cvename>
|
|
<cvename>CVE-2010-0187</cvename>
|
|
<url>http://www.adobe.com/support/security/bulletins/apsb10-06.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-02-11</discovery>
|
|
<entry>2010-02-13</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="0a82ac0c-1886-11df-b0d1-0015f2db7bde">
|
|
<topic>gnome-screensaver -- Multiple monitor hotplug issues</topic>
|
|
<affects>
|
|
<package>
|
|
<name>gnome-screensaver</name>
|
|
<range><lt>2.28.3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Ray Strode reports:</p>
|
|
<blockquote cite="https://bugzilla.gnome.org/show_bug.cgi?id=609337">
|
|
<p>Under certain circumstances it is possible to circumvent the security of screen
|
|
locking functionality of gnome-screensaver by changing the systems physical
|
|
monitor configuration.</p>
|
|
</blockquote>
|
|
<blockquote cite="https://bugzilla.gnome.org/show_bug.cgi?id=609789">
|
|
<p>gnome-screensaver can lose its keyboard grab when locked, exposing the system
|
|
to intrusion by adding and removing monitors.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2010-0414</cvename>
|
|
<cvename>CVE-2010-0422</cvename>
|
|
<url>https://bugzilla.gnome.org/show_bug.cgi?id=609337</url>
|
|
<url>https://bugzilla.gnome.org/show_bug.cgi?id=609789</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-02-08</discovery>
|
|
<entry>2010-02-13</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="2a6a966f-1774-11df-b5c1-0026189baca3">
|
|
<topic>fetchmail -- heap overflow on verbose X.509 display</topic>
|
|
<affects>
|
|
<package>
|
|
<name>fetchmail</name>
|
|
<range><ge>6.3.11</ge><lt>6.3.14</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Matthias Andree reports:</p>
|
|
<blockquote cite="http://www.fetchmail.info/fetchmail-SA-2010-01.txt">
|
|
<p>In verbose mode, fetchmail prints X.509 certificate subject and
|
|
issuer information to the user, and counts and allocates a malloc()
|
|
buffer for that purpose.</p>
|
|
<p>If the material to be displayed contains characters with high bit
|
|
set and the platform treats the "char" type as signed, this can cause
|
|
a heap buffer overrun because non-printing characters are escaped as
|
|
\xFF..FFnn, where nn is 80..FF in hex.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>38088</bid>
|
|
<cvename>CVE-2010-0562</cvename>
|
|
<url>http://www.fetchmail.info/fetchmail-SA-2010-01.txt</url>
|
|
<mlist msgid="20100205014643.GA25506@merlin.emma.line.org">https://lists.berlios.de/pipermail/fetchmail-announce/2010-February/000073.html</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-02-04</discovery>
|
|
<entry>2010-02-12</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="bb0a8795-15dc-11df-bf0a-002170daae37">
|
|
<topic>wireshark -- LWRES vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>wireshark</name>
|
|
<name>wireshark-lite</name>
|
|
<range><lt>1.2.6</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Wireshark project reports:</p>
|
|
<blockquote cite="http://www.wireshark.org/security/wnpa-sec-2010-02.html">
|
|
<p>Babi discovered several buffer overflows in the
|
|
LWRES dissector.</p>
|
|
<p>It may be possible to make Wireshark crash remotely
|
|
or by convincing someone to read a malformed packet
|
|
trace file.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2010-0304</cvename>
|
|
<url>http://secunia.com/advisories/38257/</url>
|
|
<url>http://www.wireshark.org/security/wnpa-sec-2010-02.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-01-27</discovery>
|
|
<entry>2010-02-10</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="6b575419-14cf-11df-a628-001517351c22">
|
|
<topic>otrs -- SQL injection</topic>
|
|
<affects>
|
|
<package>
|
|
<name>otrs</name>
|
|
<range><lt>2.4.7</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>OTRS Security Advisory reports:</p>
|
|
<blockquote cite="http://otrs.org/advisory/OSA-2010-01-en/">
|
|
<p>Missing security quoting for SQL statements allows agents and
|
|
customers to manipulate SQL queries. So it's possible for
|
|
authenticated users to inject SQL queries
|
|
via string manipulation of statements.</p>
|
|
<p>A malicious user may be able to manipulate SQL queries to read
|
|
or modify records in the database. This way it could also be
|
|
possible to get access to more permissions (e. g. administrator
|
|
permissions).</p>
|
|
<p>To use this vulnerability the malicious user needs to have
|
|
a valid Agent- or Customer-session.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2010-0438</cvename>
|
|
<url>http://otrs.org/advisory/OSA-2010-01-en/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-02-08</discovery>
|
|
<entry>2010-02-08</entry>
|
|
<modified>2010-05-02</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="cae01d7b-110d-11df-955a-00219b0fc4d8">
|
|
<topic>apache -- Prevent chunk-size integer overflow on platforms where sizeof(int) < sizeof(long)</topic>
|
|
<affects>
|
|
<package>
|
|
<name>apache</name>
|
|
<range><lt>1.3.42</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>apache+mod_perl</name>
|
|
<range><lt>1.3.42</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>apache+ipv6</name>
|
|
<range><lt>1.3.42</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>apache_fp</name>
|
|
<range><ge>0</ge></range>
|
|
</package>
|
|
<package>
|
|
<name>ru-apache</name>
|
|
<range><lt>1.3.42+30.23</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>ru-apache+mod_ssl</name>
|
|
<range><lt>1.3.42</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>apache+ssl</name>
|
|
<range><lt>1.3.42.1.57_2</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>apache+mod_ssl</name>
|
|
<name>apache+mod_ssl+ipv6</name>
|
|
<name>apache+mod_ssl+mod_accel</name>
|
|
<name>apache+mod_ssl+mod_accel+ipv6</name>
|
|
<name>apache+mod_ssl+mod_accel+mod_deflate</name>
|
|
<name>apache+mod_ssl+mod_accel+mod_deflate+ipv6</name>
|
|
<name>apache+mod_ssl+mod_deflate</name>
|
|
<name>apache+mod_ssl+mod_deflate+ipv6</name>
|
|
<name>apache+mod_ssl+mod_snmp</name>
|
|
<name>apache+mod_ssl+mod_snmp+mod_accel</name>
|
|
<name>apache+mod_ssl+mod_snmp+mod_accel+ipv6</name>
|
|
<name>apache+mod_ssl+mod_snmp+mod_deflate</name>
|
|
<name>apache+mod_ssl+mod_snmp+mod_deflate+ipv6</name>
|
|
<name>apache+mod_ssl+mod_snmp+mod_accel+mod_deflate+ipv6</name>
|
|
<range><lt>1.3.41+2.8.27_2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Apache ChangeLog reports:</p>
|
|
<blockquote cite="http://www.apache.org/dist/httpd/CHANGES_1.3.42">
|
|
<p>Integer overflow in the ap_proxy_send_fb function in
|
|
proxy/proxy_util.c in mod_proxy in the Apache HTTP Server before
|
|
1.3.42 on 64-bit platforms allows remote origin servers to cause a
|
|
denial of service (daemon crash) or possibly execute arbitrary code
|
|
via a large chunk size that triggers a heap-based buffer overflow.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-0010</url>
|
|
<url>http://www.security-database.com/detail.php?alert=CVE-2010-0010</url>
|
|
<url>http://security-tracker.debian.org/tracker/CVE-2010-0010</url>
|
|
<url>http://www.vupen.com/english/Reference-CVE-2010-0010.php</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-06-30</discovery>
|
|
<entry>2010-02-03</entry>
|
|
<modified>2010-02-03</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="296ecb59-0f6b-11df-8bab-0019996bc1f7">
|
|
<topic>squid -- Denial of Service vulnerability in DNS handling</topic>
|
|
<affects>
|
|
<package>
|
|
<name>squid</name>
|
|
<range><ge>2.7.1</ge><lt>2.7.7_3</lt></range>
|
|
<range><ge>3.0.1</ge><lt>3.0.23</lt></range>
|
|
<range><ge>3.1.0.1</ge><lt>3.1.0.15_2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Squid security advisory 2010:1 reports:</p>
|
|
<blockquote cite="http://www.squid-cache.org/Advisories/SQUID-2010_1.txt">
|
|
<p>Due to incorrect data validation Squid is vulnerable to a denial
|
|
of service attack when processing specially crafted DNS packets.</p>
|
|
<p>This problem allows any trusted client or external server who can
|
|
determine the squid receiving port to perform a short-term denial
|
|
of service attack on the Squid service.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2010-0308</cvename>
|
|
<url>http://www.squid-cache.org/Advisories/SQUID-2010_1.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-01-14</discovery>
|
|
<entry>2010-02-01</entry>
|
|
<modified>2010-05-02</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="696053c6-0f50-11df-a628-001517351c22">
|
|
<topic>bugzilla -- information leak</topic>
|
|
<affects>
|
|
<package>
|
|
<name>bugzilla</name>
|
|
<range><gt>3.3.1</gt><lt>3.4.5</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A Bugzilla Security Advisory reports:</p>
|
|
<blockquote cite="http://www.bugzilla.org/security/3.0.10/">
|
|
<p>When moving a bug from one product to another, an intermediate
|
|
page is displayed letting you select the groups the bug should
|
|
be restricted to in the new product. However, a regression in
|
|
the 3.4.x series made it ignore all groups which are not
|
|
available in both products. As a workaround, you had to move
|
|
the bug to the new product first and then restrict it to the
|
|
desired groups, in two distinct steps, which could make the bug
|
|
temporarily public.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2009-3387</cvename>
|
|
<url>http://www.bugzilla.org/security/3.0.10/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-01-31</discovery>
|
|
<entry>2010-02-01</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="192609c8-0c51-11df-82a0-00248c9b4be7">
|
|
<topic>irc-ratbox -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>ircd-ratbox</name>
|
|
<range><lt>2.2.9</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>ircd-ratbox-devel</name>
|
|
<range><lt>3.0.6</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>SecurityFocus reports:</p>
|
|
<blockquote cite="http://www.securityfocus.com/archive/1/509201">
|
|
<p>The first affects the /quote HELP module and allows a user
|
|
to trigger an IRCD crash on some platforms.</p>
|
|
<p>The second affects the /links processing module when the
|
|
flatten_links configuration option is not enabled.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2009-4016</cvename>
|
|
<cvename>CVE-2010-0300</cvename>
|
|
<url>http://www.debian.org/security/2010/dsa-1980</url>
|
|
<url>http://lists.ratbox.org/pipermail/ircd-ratbox/2010-January/000890.html</url>
|
|
<url>http://lists.ratbox.org/pipermail/ircd-ratbox/2010-January/000891.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-01-25</discovery>
|
|
<entry>2010-01-28</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="848539dc-0458-11df-8dd7-002170daae37">
|
|
<topic>dokuwiki -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>dokuwiki</name>
|
|
<range><lt>20091225_2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Dokuwiki reports:</p>
|
|
<blockquote cite="http://bugs.splitbrain.org/index.php?do=details&task_id=1853">
|
|
<p>The plugin does no checks against cross-site request
|
|
forgeries (CSRF) which can be exploited to e.g. change
|
|
the access control rules by tricking a logged in
|
|
administrator into visiting a malicious web site.</p>
|
|
</blockquote>
|
|
<blockquote cite="http://bugs.splitbrain.org/index.php?do=details&task_id=1847">
|
|
<p>The bug allows listing the names of arbitrary file on
|
|
the webserver - not their contents. This could leak
|
|
private information about wiki pages and server structure.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2010-0288</cvename>
|
|
<cvename>CVE-2010-0287</cvename>
|
|
<cvename>CVE-2010-0289</cvename>
|
|
<url>http://bugs.splitbrain.org/index.php?do=details&task_id=1847</url>
|
|
<url>http://bugs.splitbrain.org/index.php?do=details&task_id=1853</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-01-17</discovery>
|
|
<entry>2010-01-18</entry>
|
|
<modified>2010-05-02</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="c9263916-006f-11df-94cb-0050568452ac">
|
|
<topic>Zend Framework -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>ZendFramework</name>
|
|
<range><lt>1.9.7</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Zend Framework team reports:</p>
|
|
<blockquote cite="http://framework.zend.com/security/advisory/ZF2010-06">
|
|
<p>Potential XSS or HTML Injection vector in Zend_Json.</p>
|
|
</blockquote>
|
|
<blockquote cite="http://framework.zend.com/security/advisory/ZF2010-05">
|
|
<p>Potential XSS vector in Zend_Service_ReCaptcha_MailHide.</p>
|
|
</blockquote>
|
|
<blockquote cite="http://framework.zend.com/security/advisory/ZF2010-04">
|
|
<p>Potential MIME-type Injection in Zend_File_Transfer
|
|
Executive Summary.</p>
|
|
</blockquote>
|
|
<blockquote cite="http://framework.zend.com/security/advisory/ZF2010-03">
|
|
<p>Potential XSS vector in Zend_Filter_StripTags when
|
|
comments allowed.</p>
|
|
</blockquote>
|
|
<blockquote cite="http://framework.zend.com/security/advisory/ZF2010-02">
|
|
<p>Potential XSS vector in Zend_Dojo_View_Helper_Editor.</p>
|
|
</blockquote>
|
|
<blockquote cite="http://framework.zend.com/security/advisory/ZF2010-01">
|
|
<p>Potential XSS vectors due to inconsistent encodings.</p>
|
|
</blockquote>
|
|
<blockquote cite="http://framework.zend.com/security/advisory/ZF2009-02">
|
|
<p>XSS vector in Zend_Filter_StripTags.</p>
|
|
</blockquote>
|
|
<blockquote cite="http://framework.zend.com/security/advisory/ZF2009-01">
|
|
<p>LFI vector in Zend_View::setScriptPath() and render().</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://framework.zend.com/security/advisory/ZF2010-06</url>
|
|
<url>http://framework.zend.com/security/advisory/ZF2010-05</url>
|
|
<url>http://framework.zend.com/security/advisory/ZF2010-04</url>
|
|
<url>http://framework.zend.com/security/advisory/ZF2010-03</url>
|
|
<url>http://framework.zend.com/security/advisory/ZF2010-02</url>
|
|
<url>http://framework.zend.com/security/advisory/ZF2010-01</url>
|
|
<url>http://framework.zend.com/security/advisory/ZF2009-02</url>
|
|
<url>http://framework.zend.com/security/advisory/ZF2009-01</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-12-31</discovery>
|
|
<entry>2010-01-11</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="dd8f2394-fd08-11de-b425-00215c6a37bb">
|
|
<topic>powerdns-recursor -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>powerdns-recursor</name>
|
|
<range><lt>3.1.7.2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>PowerDNS Security Advisory reports:</p>
|
|
<blockquote cite="http://doc.powerdns.com/powerdns-advisory-2010-01.html">
|
|
<p>PowerDNS Recursor up to and including 3.1.7.1 can be
|
|
brought down and probably exploited.</p>
|
|
</blockquote>
|
|
<blockquote cite="http://doc.powerdns.com/powerdns-advisory-2010-02.html">
|
|
<p>PowerDNS Recursor up to and including 3.1.7.1 can be
|
|
spoofed into accepting bogus data</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>37650</bid>
|
|
<bid>37653</bid>
|
|
<cvename>CVE-2009-4010</cvename>
|
|
<cvename>CVE-2009-4009</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2010-01-06</discovery>
|
|
<entry>2010-01-09</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="56ba8728-f987-11de-b28d-00215c6a37bb">
|
|
<topic>PEAR -- Net_Ping and Net_Traceroute remote arbitrary command injection</topic>
|
|
<affects>
|
|
<package>
|
|
<name>pear-Net_Ping</name>
|
|
<range><lt>2.4.5</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>pear-Net_Traceroute</name>
|
|
<range><lt>0.21.2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>PEAR Security Advisory reports:</p>
|
|
<blockquote cite="http://blog.pear.php.net/2009/11/14/net_traceroute-and-net_ping-security-advisory/">
|
|
<p>Multiple remote arbitrary command injections have been
|
|
found in the Net_Ping and Net_Traceroute.</p>
|
|
<p>When input from forms are used directly, the attacker
|
|
could pass variables that would allow him to execute
|
|
remote arbitrary command injections.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>37093</bid>
|
|
<bid>37094</bid>
|
|
<cvename>CVE-2009-4024</cvename>
|
|
<cvename>CVE-2009-4025</cvename>
|
|
<url>http://pear.php.net/advisory20091114-01.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-11-14</discovery>
|
|
<entry>2010-01-04</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="751823d4-f189-11de-9344-00248c9b4be7">
|
|
<topic>drupal -- multiple cross-site scripting</topic>
|
|
<affects>
|
|
<package>
|
|
<name>drupal5</name>
|
|
<range><lt>5.21</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>drupal6</name>
|
|
<range><lt>6.15</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Drupal Team reports:</p>
|
|
<blockquote cite="http://drupal.org/node/661586">
|
|
<p>The Contact module does not correctly handle certain user input
|
|
when displaying category information. Users privileged to create
|
|
contact categories can insert arbitrary HTML and script code into the
|
|
contact module administration page. Such a cross-site scripting attack
|
|
may lead to the malicious user gaining administrative access.</p>
|
|
<p>The Menu module does not correctly handle certain user input when
|
|
displaying the menu administration overview. Users privileged to
|
|
create new menus can insert arbitrary HTML and script code into the
|
|
menu module administration page. Such a cross-site scripting attack
|
|
may lead to the malicious user gaining administrative access.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2009-4370</cvename>
|
|
<url>http://drupal.org/node/661586</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-12-16</discovery>
|
|
<entry>2009-12-25</entry>
|
|
<modified>2010-05-02</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="4d6076fe-ee7a-11de-9cd0-001a926c7637">
|
|
<topic>fuser -- missing user's privileges check</topic>
|
|
<affects>
|
|
<package>
|
|
<name>fuser</name>
|
|
<range><lt>1142334561_2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Denis Barov reports:</p>
|
|
<blockquote cite="http://www.freebsd.org/cgi/query-pr.cgi?pr=ports/141852">
|
|
<p>sysutils/fuser allows user to send any signal to any process when
|
|
installed with suid bit.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://www.freebsd.org/cgi/query-pr.cgi?pr=ports/141852</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-09-15</discovery>
|
|
<entry>2009-12-21</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="4465c897-ee5c-11de-b6ef-00215c6a37bb">
|
|
<topic>monkey -- improper input validation vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>monkey</name>
|
|
<range><lt>0.9.3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Census Labs reports:</p>
|
|
<blockquote cite="http://census-labs.com/news/2009/12/14/monkey-httpd/">
|
|
<p>We have discovered a remotely exploitable
|
|
"improper input validation" vulnerability in the Monkey
|
|
web server that allows an attacker to perform denial of
|
|
service attacks by repeatedly crashing worker threads
|
|
that process HTTP requests.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://census-labs.com/news/2009/12/14/monkey-httpd/</url>
|
|
<url>http://groups.google.com/group/monkeyd/browse_thread/thread/055b4e9b83973861/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-12-14</discovery>
|
|
<entry>2009-12-21</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="39a25a63-eb5c-11de-b650-00215c6a37bb">
|
|
<topic>php -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>php5</name>
|
|
<range><lt>5.2.12</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>PHP developers reports:</p>
|
|
<blockquote cite="http://www.php.net/releases/5_2_12.php">
|
|
<p>This release focuses on improving the stability of the
|
|
PHP 5.2.x branch with over 60 bug fixes, some of which
|
|
are security related. All users of PHP 5.2 are encouraged
|
|
to upgrade to this release.</p>
|
|
<p>Security Enhancements and Fixes in PHP 5.2.12:</p>
|
|
<ul>
|
|
<li>Fixed a safe_mode bypass in tempnam() identified by
|
|
Grzegorz Stachowiak. (CVE-2009-3557, Rasmus)</li>
|
|
<li>Fixed a open_basedir bypass in posix_mkfifo()
|
|
identified by Grzegorz Stachowiak. (CVE-2009-3558, Rasmus)</li>
|
|
<li>Added "max_file_uploads" INI directive, which can
|
|
be set to limit the number of file uploads per-request
|
|
to 20 by default, to prevent possible DOS via temporary
|
|
file exhaustion, identified by Bogdan Calin.
|
|
(CVE-2009-4017, Ilia)</li>
|
|
<li>Added protection for $_SESSION from interrupt
|
|
corruption and improved "session.save_path" check,
|
|
identified by Stefan Esser. (CVE-2009-4143, Stas)</li>
|
|
<li>Fixed bug #49785 (insufficient input string
|
|
validation of htmlspecialchars()). (CVE-2009-4142,
|
|
Moriyoshi, hello at iwamot dot com)</li>
|
|
</ul>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2009-3557</cvename>
|
|
<cvename>CVE-2009-3558</cvename>
|
|
<cvename>CVE-2009-4017</cvename>
|
|
<cvename>CVE-2009-4142</cvename>
|
|
<cvename>CVE-2009-4143</cvename>
|
|
<url>http://www.php.net/releases/5_2_12.php</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-12-17</discovery>
|
|
<entry>2009-12-17</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="e7bc5600-eaa0-11de-bd9c-00215c6a37bb">
|
|
<topic>postgresql -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>postgresql-client</name>
|
|
<name>postgresql-server</name>
|
|
<range><ge>7.4</ge><lt>7.4.27</lt></range>
|
|
<range><ge>8.0</ge><lt>8.0.23</lt></range>
|
|
<range><ge>8.1</ge><lt>8.1.19</lt></range>
|
|
<range><ge>8.2</ge><lt>8.2.15</lt></range>
|
|
<range><ge>8.3</ge><lt>8.3.9</lt></range>
|
|
<range><ge>8.4</ge><lt>8.4.2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>PostgreSQL project reports:</p>
|
|
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4034">
|
|
<p>PostgreSQL 7.4.x before 7.4.27, 8.0.x before 8.0.23,
|
|
8.1.x before 8.1.19, 8.2.x before 8.2.15, 8.3.x before 8.3.9,
|
|
and 8.4.x before 8.4.2 does not properly handle a '\0' character
|
|
in a domain name in the subject's Common Name (CN) field of an
|
|
X.509 certificate, which (1) allows man-in-the-middle attackers
|
|
to spoof arbitrary SSL-based PostgreSQL servers via a crafted
|
|
server certificate issued by a legitimate Certification Authority,
|
|
and (2) allows remote attackers to bypass intended client-hostname
|
|
restrictions via a crafted client certificate issued by a legitimate
|
|
Certification Authority, a related issue to CVE-2009-2408.</p>
|
|
</blockquote>
|
|
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4136">
|
|
<p>PostgreSQL 7.4.x before 7.4.27, 8.0.x before 8.0.23,
|
|
8.1.x before 8.1.19, 8.2.x before 8.2.15, 8.3.x before 8.3.9,
|
|
and 8.4.x before 8.4.2 does not properly manage session-local
|
|
state during execution of an index function by a database
|
|
superuser, which allows remote authenticated users to gain
|
|
privileges via a table with crafted index functions, as
|
|
demonstrated by functions that modify (1) search_path or
|
|
(2) a prepared statement, a related issue to CVE-2007-6600
|
|
and CVE-2009-3230.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2009-4034</cvename>
|
|
<cvename>CVE-2009-4136</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-11-20</discovery>
|
|
<entry>2009-12-17</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="5486669e-ea9f-11de-bd9c-00215c6a37bb">
|
|
<topic>tptest -- pwd Remote Stack Buffer Overflow</topic>
|
|
<affects>
|
|
<package>
|
|
<name>tptest</name>
|
|
<range><gt>0</gt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>SecurityFocus reports:</p>
|
|
<blockquote cite="http://www.securityfocus.com/bid/33785">
|
|
<p>TPTEST is prone to a remote stack-based buffer-overflow
|
|
vulnerability. An attacker can exploit this issue to
|
|
execute arbitrary code within the context of the affected
|
|
application. Failed exploit attempts will result in a
|
|
denial-of-service condition.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>33785</bid>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-02-16</discovery>
|
|
<entry>2009-12-17</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="01c57d20-ea26-11de-bd39-00248c9b4be7">
|
|
<topic>mozilla -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>firefox</name>
|
|
<range><gt>3.5.*,1</gt><lt>3.5.6,1</lt></range>
|
|
<range><gt>3.*,1</gt><lt>3.0.16,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-firefox</name>
|
|
<range><lt>3.0.16,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>seamonkey</name>
|
|
<name>linux-seamonkey</name>
|
|
<range><lt>2.0.1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>thunderbird</name>
|
|
<range><ge>3.0</ge><lt>3.0.1</lt></range>
|
|
</package>
|
|
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Mozilla Project reports:</p>
|
|
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
|
|
<p>MFSA 2009-71 GeckoActiveXObject exception messages can be used to
|
|
enumerate installed COM objects</p>
|
|
<p>MFSA 2009-70 Privilege escalation via chrome window.opener</p>
|
|
<p>MFSA 2009-69 Location bar spoofing vulnerabilities</p>
|
|
<p>MFSA 2009-68 NTLM reflection vulnerability</p>
|
|
<p>MFSA 2009-67 Integer overflow, crash in libtheora video
|
|
library</p>
|
|
<p>MFSA 2009-66 Memory safety fixes in liboggplay media library</p>
|
|
<p>MFSA 2009-65 Crashes with evidence of memory corruption (rv:1.9.1.6/
|
|
1.9.0.16)</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2009-3388</cvename>
|
|
<cvename>CVE-2009-3389</cvename>
|
|
<cvename>CVE-2009-3979</cvename>
|
|
<cvename>CVE-2009-3980</cvename>
|
|
<cvename>CVE-2009-3981</cvename>
|
|
<cvename>CVE-2009-3982</cvename>
|
|
<cvename>CVE-2009-3983</cvename>
|
|
<cvename>CVE-2009-3984</cvename>
|
|
<cvename>CVE-2009-3985</cvename>
|
|
<cvename>CVE-2009-3986</cvename>
|
|
<url>http://www.mozilla.org/security/announce/2009/mfsa2009-71.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2009/mfsa2009-70.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2009/mfsa2009-69.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2009/mfsa2009-68.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2009/mfsa2009-67.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2009/mfsa2009-66.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2009/mfsa2009-65.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-12-16</discovery>
|
|
<entry>2009-12-16</entry>
|
|
<modified>2010-01-21</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="1b3f854b-e4bd-11de-b276-000d8787e1be">
|
|
<topic>freeradius -- remote packet of death vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>freeradius</name>
|
|
<range><lt>1.1.8</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>freeRADIUS Vulnerability Notifications reports:</p>
|
|
<blockquote cite="http://freeradius.org/security.html">
|
|
<p>2009.09.09 v1.1.7 - Anyone who can send packets to
|
|
the server can crash it by sending a Tunnel-Password
|
|
attribute in an Access-Request packet. This
|
|
vulnerability is not otherwise exploitable. We have
|
|
released 1.1.8 to correct this vulnerability.</p>
|
|
<p>This issue is similar to the previous Tunnel-Password
|
|
issue noted below. The vulnerable versions are 1.1.3
|
|
through 1.1.7. Version 2.x is not affected.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2009-3111</cvename>
|
|
<url>http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-3111</url>
|
|
<url>http://freeradius.org/security.html</url>
|
|
<url>http://www.milw0rm.com/exploits/9642</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-09-09</discovery>
|
|
<entry>2009-12-14</entry>
|
|
<modified>2009-12-14</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="bec38383-e6cb-11de-bdd4-000c2930e89b">
|
|
<topic>pligg -- Cross-Site Scripting and Cross-Site Request Forgery</topic>
|
|
<affects>
|
|
<package>
|
|
<name>pligg</name>
|
|
<range><lt>1.0.3b</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/37349">
|
|
<p>Russ McRee has discovered some vulnerabilities in Pligg, which can
|
|
be exploited by malicious people to conduct cross-site scripting and
|
|
request forgery attacks.</p>
|
|
<p>Input passed via the "Referer" HTTP header to various scripts (e.g.
|
|
admin/admin_config.php, admin/admin_modules.php, delete.php, editlink.php,
|
|
submit.php, submit_groups.php, user_add_remove_links.php, and
|
|
user_settings.php) is not properly sanitised before being returned to
|
|
the user. This can be exploited to execute arbitrary HTML and script
|
|
code in a user's browser session in context of an affected site.</p>
|
|
<p>The application allows users to perform certain actions via HTTP
|
|
requests without performing any validity checks to verify the requests.
|
|
This can be exploited to e.g. create an arbitrary user with administrative
|
|
privileges if a logged-in administrative user visits a malicious web
|
|
site.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2009-4786</cvename>
|
|
<cvename>CVE-2009-4787</cvename>
|
|
<cvename>CVE-2009-4788</cvename>
|
|
<url>http://secunia.com/advisories/37349/</url>
|
|
<url>http://www.pligg.com/blog/775/pligg-cms-1-0-3-release/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-12-02</discovery>
|
|
<entry>2009-12-12</entry>
|
|
<modified>2010-05-02</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="fcbf56dd-e667-11de-920a-00248c9b4be7">
|
|
<topic>piwik -- php code execution</topic>
|
|
<affects>
|
|
<package>
|
|
<name>piwik</name>
|
|
<range><lt>0.5.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/37649">
|
|
<p>Stefan Esser has reported a vulnerability in Piwik, which can be
|
|
exploited by malicious people to compromise a vulnerable system.</p>
|
|
<p>The vulnerability is caused due to the core/Cookie.php script using
|
|
"unserialize()" with user controlled input. This can be exploited to
|
|
e.g. execute arbitrary PHP code via the "__wakeup()" or "__destruct()"
|
|
methods of a serialized object passed via an HTTP cookie.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2009-4137</cvename>
|
|
<url>http://secunia.com/advisories/37649/</url>
|
|
<url>http://www.sektioneins.de/de/advisories/advisory-032009-piwik-cookie-unserialize-vulnerability/index.html</url>
|
|
<url>http://piwik.org/blog/2009/12/piwik-response-to-shocking-news-in-php-exploitation/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-12-10</discovery>
|
|
<entry>2009-12-11</entry>
|
|
<modified>2010-05-02</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="30211c45-e52a-11de-b5cd-00e0815b8da8">
|
|
<topic>dovecot -- Insecure directory permissions</topic>
|
|
<affects>
|
|
<package>
|
|
<name>dovecot</name>
|
|
<range><ge>1.2.*</ge><lt>1.2.8</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Dovecot author reports:</p>
|
|
<blockquote cite="http://www.dovecot.org/list/dovecot-news/2009-November/000143.html">
|
|
<p>Dovecot v1.2.x had been creating base_dir (and its parents if
|
|
necessary) with 0777 permissions. The base_dir's permissions get
|
|
changed to 0755 automatically at startup, but you may need to
|
|
chmod the parent directories manually.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2009-3897</cvename>
|
|
<bid>37084</bid>
|
|
<url>http://secunia.com/advisories/37443</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-11-20</discovery>
|
|
<entry>2009-12-10</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="3c1a672e-e508-11de-9f4a-001b2134ef46">
|
|
<topic>linux-flashplugin -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>linux-flashplugin</name>
|
|
<range><lt>9.0r260</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-f8-flashplugin</name>
|
|
<name>linux-f10-flashplugin</name>
|
|
<range><lt>10.0r42</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Adobe Product Security Incident Response Team reports:</p>
|
|
<blockquote cite="http://www.adobe.com/support/security/bulletins/apsb09-19.html">
|
|
<p>Critical vulnerabilities have been identified in Adobe
|
|
Flash Player version 10.0.32.18 and earlier. These
|
|
vulnerabilities could cause the application to crash and
|
|
could potentially allow an attacker to take control of the
|
|
affected system.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2009-3794</cvename>
|
|
<cvename>CVE-2009-3796</cvename>
|
|
<cvename>CVE-2009-3797</cvename>
|
|
<cvename>CVE-2009-3798</cvename>
|
|
<cvename>CVE-2009-3799</cvename>
|
|
<cvename>CVE-2009-3800</cvename>
|
|
<cvename>CVE-2009-3951</cvename>
|
|
<url>http://www.zerodayinitiative.com/advisories/ZDI-09-092/</url>
|
|
<url>http://www.zerodayinitiative.com/advisories/ZDI-09-093/</url>
|
|
<url>http://www.adobe.com/support/security/bulletins/apsb09-19.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-07-14</discovery>
|
|
<entry>2009-12-09</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="eab8c3bd-e50c-11de-9cd0-001a926c7637">
|
|
<topic>ruby -- heap overflow vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>ruby</name>
|
|
<range><ge>1.9.1,1</ge><lt>1.9.1.376,1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The official ruby site reports:</p>
|
|
<blockquote cite="http://www.ruby-lang.org/en/news/2009/12/07/heap-overflow-in-string/">
|
|
<p>There is a heap overflow vulnerability in String#ljust,
|
|
String#center and String#rjust. This has allowed an attacker to run
|
|
arbitrary code in some rare cases.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2009-4124</cvename>
|
|
<url>http://www.ruby-lang.org/en/news/2009/12/07/heap-overflow-in-string/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-11-30</discovery>
|
|
<entry>2009-12-09</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="714c1406-e4cf-11de-883a-003048590f9e">
|
|
<topic>rt -- Session fixation vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>rt</name>
|
|
<range><lt>3.8.6</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/37546">
|
|
<p>A vulnerability has been reported in RT, which can be exploited by
|
|
malicious people to conduct session fixation attacks.
|
|
The vulnerability is caused due to an error in the handling of
|
|
sessions and can be exploited to hijack another user's session by
|
|
tricking the user into logging in after following a specially crafted
|
|
link.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>37162</bid>
|
|
<cvename>CVE-2009-3585</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-12-01</discovery>
|
|
<entry>2009-12-09</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="5f030587-e39a-11de-881e-001aa0166822">
|
|
<topic>expat2 -- Parser crash with specially formatted UTF-8 sequences</topic>
|
|
<affects>
|
|
<package>
|
|
<name>expat2</name>
|
|
<range><lt>2.0.1_1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>CVE reports:</p>
|
|
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3720">
|
|
<p>The updatePosition function in lib/xmltok_impl.c in
|
|
libexpat in Expat 2.0.1, as used in Python, PyXML,
|
|
w3c-libwww, and other software, allows context-dependent
|
|
attackers to cause a denial of service (application crash)
|
|
via an XML document with crafted UTF-8 sequences that
|
|
trigger a buffer over-read.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2009-3720</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-01-17</discovery>
|
|
<entry>2009-12-08</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="e9fca207-e399-11de-881e-001aa0166822">
|
|
<topic>expat2 -- buffer over-read and crash</topic>
|
|
<affects>
|
|
<package>
|
|
<name>expat2</name>
|
|
<range><lt>2.0.1_1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>CVE reports:</p>
|
|
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3560">
|
|
<p>The big2_toUtf8 function in lib/xmltok.c in libexpat in
|
|
Expat 2.0.1, as used in the XML-Twig module for Perl, allows
|
|
context-dependent attackers to cause a denial of service
|
|
(application crash) via an XML document with malformed UTF-8
|
|
sequences that trigger a buffer over-read, related to the
|
|
doProlog function in lib/xmlparse.c.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2009-3560</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-10-05</discovery>
|
|
<entry>2009-12-08</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="6431c4db-deb4-11de-9078-0030843d3802">
|
|
<topic>opera -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>opera</name>
|
|
<range><lt>10.10.20091120</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-opera</name>
|
|
<range><lt>10.10</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Opera Team reports:</p>
|
|
<blockquote cite="http://www.opera.com/docs/changelogs/unix/1010/">
|
|
<ul>
|
|
<li>Fixed a heap buffer overflow in string to number conversion</li>
|
|
<li>Fixed an issue where error messages could leak onto unrelated
|
|
sites</li>
|
|
<li>Fixed a moderately severe issue, as reported by Chris Evans of
|
|
the Google Security Team; details will be disclosed at a later
|
|
date.</li>
|
|
</ul>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2009-0689</cvename>
|
|
<cvename>CVE-2009-4071</cvename>
|
|
<url>http://www.opera.com/support/kb/view/941/</url>
|
|
<url>http://www.opera.com/support/kb/view/942/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-11-23</discovery>
|
|
<entry>2009-12-01</entry>
|
|
<modified>2010-05-02</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="77c14729-dc5e-11de-92ae-02e0184b8d35">
|
|
<topic>libtool -- Library Search Path Privilege Escalation Issue</topic>
|
|
<affects>
|
|
<package>
|
|
<name>libtool</name>
|
|
<range><lt>2.2.6b</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia.com</p>
|
|
<blockquote cite="http://secunia.com/advisories/37414/">
|
|
<p>Do not attempt to load an unqualified module.la file from the
|
|
current directory (by default) since doing so is insecure and is
|
|
not compliant with the documentation.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2009-3736</cvename>
|
|
<url>http://secunia.com/advisories/37414/</url>
|
|
<url>http://lists.gnu.org/archive/html/libtool/2009-11/msg00059.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-11-25</discovery>
|
|
<entry>2009-11-28</entry>
|
|
<modified>2010-05-02</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="94edff42-d93d-11de-a434-0211d880e350">
|
|
<topic>libvorbis -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>libvorbis</name>
|
|
<range><lt>1.2.3_1,3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Ubuntu security team reports:</p>
|
|
<blockquote cite="http://www.ubuntu.com/usn/usn-861-1">
|
|
<p>It was discovered that libvorbis did not correctly
|
|
handle certain malformed vorbis files. If a user were
|
|
tricked into opening a specially crafted vorbis file
|
|
with an application that uses libvorbis, an attacker
|
|
could cause a denial of service or possibly execute
|
|
arbitrary code with the user's privileges.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-1420</cvename>
|
|
<cvename>CVE-2009-3379</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-11-24</discovery>
|
|
<entry>2009-11-24</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="92ca92c1-d859-11de-89f9-001517351c22">
|
|
<topic>bugzilla -- information leak</topic>
|
|
<affects>
|
|
<package>
|
|
<name>bugzilla</name>
|
|
<range><gt>3.3.1</gt><lt>3.4.4</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A Bugzilla Security Advisory reports:</p>
|
|
<blockquote cite="http://www.bugzilla.org/security/3.4.3/">
|
|
<p>When a bug is in a group, none of its information
|
|
(other than its status and resolution) should be visible
|
|
to users outside that group. It was discovered that
|
|
as of 3.3.2, Bugzilla was showing the alias of the bug
|
|
(a very short string used as a shortcut for looking up
|
|
the bug) to users outside of the group, if the protected
|
|
bug ended up in the "Depends On" or "Blocks" list of any
|
|
other bug.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2009-3386</cvename>
|
|
<url>http://www.bugzilla.org/security/3.4.3/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-11-18</discovery>
|
|
<entry>2009-11-23</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="04104985-d846-11de-84e4-00215af774f0">
|
|
<topic>cacti -- cross-site scripting issues</topic>
|
|
<affects>
|
|
<package>
|
|
<name>cacti</name>
|
|
<range><lt>0.8.7e4</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The cacti development team reports:</p>
|
|
<blockquote cite="http://docs.cacti.net/#cross-site_scripting_fixes">
|
|
<p>The Cross-Site Scripting patch has been posted.</p>
|
|
<p>This patch addresses cross-site scripting issues reported
|
|
by Moritz Naumann.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2009-4032</cvename>
|
|
<url>http://docs.cacti.net/#cross-site_scripting_fixes</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-11-21</discovery>
|
|
<entry>2009-11-23</entry>
|
|
<modified>2010-05-02</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="0640198a-d117-11de-b667-0030843d3802">
|
|
<topic>wordpress -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>wordpress</name>
|
|
<range><lt>2.8.6,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>de-wordpress</name>
|
|
<range><lt>2.8.6</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/37332/">
|
|
<p>The security issue is caused due to the wp_check_filetype()
|
|
function in /wp-includes/functions.php improperly validating uploaded
|
|
files. This can be exploited to execute arbitrary PHP code by
|
|
uploading a malicious PHP script with multiple extensions.</p>
|
|
<p>Successful exploitation of this vulnerability requires that Apache
|
|
is not configured to handle the mime-type for media files with an e.g.
|
|
"gif", "jpg", "png", "tif", "wmv" extension.</p>
|
|
<p>Input passed via certain parameters to press-this.php is not
|
|
properly sanitised before being displayed to the user. This can be
|
|
exploited to insert arbitrary HTML and script code, which will be
|
|
executed in a user's browser session in context of an affected site
|
|
when the malicious data is being viewed.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2009-3890</cvename>
|
|
<cvename>CVE-2009-3891</cvename>
|
|
<url>http://wordpress.org/development/2009/11/wordpress-2-8-6-security-release/</url>
|
|
<url>http://secunia.com/advisories/37332/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-11-12</discovery>
|
|
<entry>2009-11-14</entry>
|
|
<modified>2010-05-02</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="68bda678-caab-11de-a97e-be89dfd1042e">
|
|
<topic>p5-HTML-Parser -- denial of service</topic>
|
|
<affects>
|
|
<package>
|
|
<name>p5-HTML-Parser</name>
|
|
<range><lt>3.63</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>CVE reports:</p>
|
|
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3627">
|
|
<p>The decode_entities function in util.c in HTML-Parser before
|
|
3.63 allows context-dependent attackers to cause a denial of service
|
|
(infinite loop) via an incomplete SGML numeric character reference,
|
|
which triggers generation of an invalid UTF-8 character.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>36807</bid>
|
|
<cvename>CVE-2009-3627</cvename>
|
|
<url>http://secunia.com/advisories/37155</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-10-23</discovery>
|
|
<entry>2009-11-06</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="4e8344a3-ca52-11de-8ee8-00215c6a37bb">
|
|
<topic>gd -- '_gdGetColors' remote buffer overflow vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>gd</name>
|
|
<range><lt>2.0.35_2,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>php5-gd</name>
|
|
<range><lt>5.2.11_2</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>php4-gd</name>
|
|
<range><lt>4.4.9_4</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>CVE reports:</p>
|
|
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3546">
|
|
<p>The _gdGetColors function in gd_gd.c in PHP 5.2.11 and
|
|
5.3.0, and the GD Graphics Library 2.x, does not properly
|
|
verify a certain colorsTotal structure member, which might
|
|
allow remote attackers to conduct buffer overflow or buffer
|
|
over-read attacks via a crafted GD file, a different
|
|
vulnerability than CVE-2009-3293.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>36712</bid>
|
|
<cvename>CVE-2009-3546</cvename>
|
|
<url>http://secunia.com/advisories/37069</url>
|
|
<url>http://secunia.com/advisories/37080</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-10-15</discovery>
|
|
<entry>2009-11-05</entry>
|
|
<modified>2010-06-17</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="6693bad2-ca50-11de-8ee8-00215c6a37bb">
|
|
<topic>typo3 -- multiple vulnerabilities in TYPO3 Core</topic>
|
|
<affects>
|
|
<package>
|
|
<name>typo3</name>
|
|
<range><lt>4.2.10</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>TYPO3 develop team reports:</p>
|
|
<blockquote cite="http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-016/">
|
|
<p>Affected versions: TYPO3 versions 4.0.13 and below, 4.1.12
|
|
and below, 4.2.9 and below, 4.3.0beta1 and below.</p>
|
|
<p>SQL injection, Cross-site scripting (XSS), Information
|
|
disclosure, Frame hijacking, Remote shell command execution
|
|
and Insecure Install Tool authentication/session handling.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>36801</bid>
|
|
<cvename>CVE-2009-3628</cvename>
|
|
<cvename>CVE-2009-3629</cvename>
|
|
<cvename>CVE-2009-3630</cvename>
|
|
<cvename>CVE-2009-3631</cvename>
|
|
<cvename>CVE-2009-3632</cvename>
|
|
<cvename>CVE-2009-3633</cvename>
|
|
<cvename>CVE-2009-3634</cvename>
|
|
<cvename>CVE-2009-3635</cvename>
|
|
<cvename>CVE-2009-3636</cvename>
|
|
<url>http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-016/</url>
|
|
<url>http://secunia.com/advisories/37122/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-10-22</discovery>
|
|
<entry>2009-11-05</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="3149ab1c-c8b9-11de-b87b-0011098ad87f">
|
|
<topic>vlc -- stack overflow in MPA, AVI and ASF demuxer</topic>
|
|
<affects>
|
|
<package>
|
|
<name>vlc</name>
|
|
<range><ge>0.5.0</ge><lt>1.0.2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>VideoLAN reports:</p>
|
|
<blockquote cite="http://www.videolan.org/security/sa0901.html">
|
|
<p>When parsing a MP4, ASF or AVI file with an overly deep box
|
|
structure, a stack overflow might occur. It would overwrite the
|
|
return address and thus redirect the execution flow.</p>
|
|
<p>If successful, a malicious third party could trigger execution
|
|
of arbitrary code within the context of the VLC media player.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://www.videolan.org/security/sa0901.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-09-14</discovery>
|
|
<entry>2009-11-03</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="6f358f5a-c7ea-11de-a9f3-0030843d3802">
|
|
<topic>KDE -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>kdebase-runtime</name>
|
|
<range><ge>4.0.*</ge><lt>4.3.1_2</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>kdelibs</name>
|
|
<range><ge>4.0.*</ge><lt>4.3.1_5</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>oCERT reports:</p>
|
|
<blockquote cite="http://www.ocert.org/advisories/ocert-2009-015.html">
|
|
<p>Ark input sanitization errors: The KDE archiving tool, Ark,
|
|
performs insufficient validation which leads to specially crafted
|
|
archive files, using unknown MIME types, to be rendered using a KHTML
|
|
instance, this can trigger uncontrolled XMLHTTPRequests to remote
|
|
sites.</p>
|
|
<p>IO Slaves input sanitization errors: KDE protocol handlers perform
|
|
insufficient input validation, an attacker can craft malicious URI
|
|
that would trigger JavaScript execution. Additionally the 'help://'
|
|
protocol handler suffer from directory traversal. It should be noted
|
|
that the scope of this issue is limited as the malicious URIs cannot
|
|
be embedded in Internet hosted content.</p>
|
|
<p>KMail input sanitization errors: The KDE mail client, KMail, performs
|
|
insufficient validation which leads to specially crafted email
|
|
attachments, using unknown MIME types, to be rendered using a KHTML
|
|
instance, this can trigger uncontrolled XMLHTTPRequests to remote
|
|
sites.</p>
|
|
<p>The exploitation of these vulnerabilities is unlikely according to
|
|
Portcullis and KDE but the execution of active content is nonetheless
|
|
unexpected and might pose a threat.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://www.ocert.org/advisories/ocert-2009-015.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-10-30</discovery>
|
|
<entry>2009-11-02</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="2fda6bd2-c53c-11de-b157-001999392805">
|
|
<topic>opera -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>opera</name>
|
|
<range><lt>10.01.20091019</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-opera</name>
|
|
<range><lt>10.01</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Opera Team Reports:</p>
|
|
<blockquote cite="http://www.opera.com/docs/changelogs/unix/1001/">
|
|
<ul>
|
|
<li>Fixed an issue where certain domain names could allow execution
|
|
of arbitrary code, as reported by Chris Weber of Casaba Security</li>
|
|
<li>Fixed an issue where scripts can run on the feed subscription
|
|
page, as reported by Inferno</li>
|
|
</ul>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2009-3831</cvename>
|
|
<url>http://www.opera.com/support/kb/view/938/</url>
|
|
<url>http://www.opera.com/support/kb/view/939/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-10-28</discovery>
|
|
<entry>2009-10-31</entry>
|
|
<modified>2010-05-02</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="83d7d149-b965-11de-a515-0022156e8794">
|
|
<topic>Enhanced cTorrent -- stack-based overflow</topic>
|
|
<affects>
|
|
<package>
|
|
<name>ctorrent</name>
|
|
<range><lt>3.3.2_2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Securityfocus reports:</p>
|
|
<blockquote cite="http://www.securityfocus.com/bid/34584">
|
|
<p>cTorrent and dTorrent are prone to a remote buffer-overflow
|
|
vulnerability because the software fails to properly
|
|
bounds-check user-supplied input before copying it to an
|
|
insufficiently sized memory buffer.</p>
|
|
<p>Successful exploits allow remote attackers to execute
|
|
arbitrary machine code in the context of a vulnerable
|
|
application. Failed exploit attempts will likely result in
|
|
denial-of-service conditions.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>34584</bid>
|
|
<cvename>CVE-2009-1759</cvename>
|
|
<url>http://sourceforge.net/tracker/?func=detail&aid=2782875&group_id=202532&atid=981959</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-10-15</discovery>
|
|
<entry>2009-10-28</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="c87aa2d2-c3c4-11de-ab08-000f20797ede">
|
|
<topic>mozilla -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>firefox</name>
|
|
<range><gt>3.5.*,1</gt><lt>3.5.4,1</lt></range>
|
|
<range><gt>3.*,1</gt><lt>3.0.15,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-firefox</name>
|
|
<range><lt>3.0.15</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>seamonkey</name>
|
|
<name>linux-seamonkey</name>
|
|
<range><lt>2.0</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Mozilla Foundation reports:</p>
|
|
<blockquote cite="http://www.mozilla.org/security/announce/">
|
|
<p>MFSA 2009-64 Crashes with evidence of memory
|
|
corruption (rv:1.9.1.4/ 1.9.0.15)</p>
|
|
<p>MFSA 2009-63 Upgrade media libraries to fix memory
|
|
safety bugs</p>
|
|
<p>MFSA 2009-62 Download filename spoofing with RTL
|
|
override</p>
|
|
<p>MFSA 2009-61 Cross-origin data theft through
|
|
document.getSelection()</p>
|
|
<p>MFSA 2009-59 Heap buffer overflow in string to
|
|
number conversion</p>
|
|
<p>MFSA 2009-57 Chrome privilege escalation in
|
|
XPCVariant::VariantDataToJS()</p>
|
|
<p>MFSA 2009-56 Heap buffer overflow in GIF color map
|
|
parser</p>
|
|
<p>MFSA 2009-55 Crash in proxy auto-configuration
|
|
regexp parsing</p>
|
|
<p>MFSA 2009-54 Crash with recursive web-worker calls</p>
|
|
<p>MFSA 2009-53 Local downloaded file tampering</p>
|
|
<p>MFSA 2009-52 Form history vulnerable to stealing</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2009-3380</cvename>
|
|
<cvename>CVE-2009-3381</cvename>
|
|
<cvename>CVE-2009-3382</cvename>
|
|
<cvename>CVE-2009-3383</cvename>
|
|
<cvename>CVE-2009-3379</cvename>
|
|
<cvename>CVE-2009-3378</cvename>
|
|
<cvename>CVE-2009-3377</cvename>
|
|
<cvename>CVE-2009-3376</cvename>
|
|
<cvename>CVE-2009-3375</cvename>
|
|
<cvename>CVE-2009-1563</cvename>
|
|
<cvename>CVE-2009-3374</cvename>
|
|
<cvename>CVE-2009-3373</cvename>
|
|
<cvename>CVE-2009-3372</cvename>
|
|
<cvename>CVE-2009-3371</cvename>
|
|
<cvename>CVE-2009-3274</cvename>
|
|
<cvename>CVE-2009-3370</cvename>
|
|
<url>http://www.mozilla.org/security/announce/2009/mfsa2009-64.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2009/mfsa2009-63.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2009/mfsa2009-62.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2009/mfsa2009-61.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2009/mfsa2009-59.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2009/mfsa2009-57.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2009/mfsa2009-56.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2009/mfsa2009-55.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2009/mfsa2009-54.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2009/mfsa2009-53.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2009/mfsa2009-52.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-10-27</discovery>
|
|
<entry>2009-10-28</entry>
|
|
<modified>2009-12-14</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="2544f543-c178-11de-b175-001cc0377035">
|
|
<topic>elinks -- buffer overflow vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>elinks</name>
|
|
<range><lt>0.11.4</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>SecurityFocus reports:</p>
|
|
<blockquote cite="http://www.securityfocus.com/bid/36574/discuss">
|
|
<p>ELinks is prone to an off-by-one buffer-overflow vulnerability
|
|
because the application fails to accurately reference the last
|
|
element of a buffer.</p>
|
|
<p>Attackers may leverage this issue to execute arbitrary code in
|
|
the context of the application. Failed attacks will cause
|
|
denial-of-service conditions.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>36574</bid>
|
|
<cvename>CVE-2008-7224</cvename>
|
|
<mlist msgid="20080204235429.GA28006@diku.dk">http://linuxfromscratch.org/pipermail/elinks-users/2008-February/001604.html</mlist>
|
|
<url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=380347</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-07-29</discovery>
|
|
<entry>2009-10-25</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="692ab645-bf5d-11de-849b-00151797c2d4">
|
|
<topic>squidGuard -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>squidGuard</name>
|
|
<range><lt>1.4_2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>SquidGuard website reports:</p>
|
|
<blockquote cite="http://www.squidguard.org/Downloads/Patches/1.4/Readme.Patch-20091015">
|
|
<p>Patch 20091015 fixes one buffer overflow problem
|
|
in sgLog.c when overlong URLs are requested.
|
|
SquidGuard will then go into emergency mode were
|
|
no blocking occurs. This is not required in this
|
|
situation.</p>
|
|
</blockquote>
|
|
<blockquote cite="http://www.squidguard.org/Downloads/Patches/1.4/Readme.Patch-20091019">
|
|
<p>Patch 20091019 fixes two bypass problems with URLs
|
|
which length is close to the limit defined by MAX_BUF
|
|
(default: 4096) in squidGuard and MAX_URL (default:
|
|
4096 in squid 2.x and 8192 in squid 3.x) in squid.
|
|
For this kind of URLs the proxy request exceeds MAX_BUF
|
|
causing squidGuard to complain about not being able to
|
|
parse the squid request. Increasing the buffer limit
|
|
to be higher than the one defined in MAX_URL solves the
|
|
issue.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2009-3700</cvename>
|
|
<cvename>CVE-2009-3826</cvename>
|
|
<url>http://www.squidguard.org/Downloads/Patches/1.4/Readme.Patch-20091015</url>
|
|
<url>http://www.squidguard.org/Downloads/Patches/1.4/Readme.Patch-20091019</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-10-15</discovery>
|
|
<entry>2009-10-22</entry>
|
|
<modified>2010-05-06</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="8581189c-bd5f-11de-8709-0017a4cccfc6">
|
|
<topic>Xpdf -- Multiple Vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>xpdf</name>
|
|
<range><lt>3.02_11</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>SecurityFocus reports:</p>
|
|
<blockquote cite="http://www.securityfocus.com/archive/1/507261">
|
|
<p>Some vulnerabilities have been reported in Xpdf, which can be
|
|
exploited by malicious people to potentially compromise a user's
|
|
system.</p>
|
|
<p>1) Multiple integer overflows in "SplashBitmap::SplashBitmap()"
|
|
can be exploited to cause heap-based buffer overflows.</p>
|
|
<p>2) An integer overflow error in "ObjectStream::ObjectStream()"
|
|
can be exploited to cause a heap-based buffer overflow.</p>
|
|
<p>3) Multiple integer overflows in "Splash::drawImage()" can be
|
|
exploited to cause heap-based buffer overflows.</p>
|
|
<p>4) An integer overflow error in "PSOutputDev::doImageL1Sep()"
|
|
can be exploited to cause a heap-based buffer overflow when
|
|
converting a PDF document to a PS file.</p>
|
|
<p>Successful exploitation of the vulnerabilities may allow execution
|
|
of arbitrary code by tricking a user into opening a specially crafted
|
|
PDF file.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://www.securityfocus.com/archive/1/507261</url>
|
|
<url>http://secunia.com/advisories/37053/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-10-14</discovery>
|
|
<entry>2009-10-20</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="87917d6f-ba76-11de-bac2-001a4d563a0f">
|
|
<topic>django -- denial-of-service attack</topic>
|
|
<affects>
|
|
<package>
|
|
<name>py23-django</name>
|
|
<name>py24-django</name>
|
|
<name>py25-django</name>
|
|
<name>py26-django</name>
|
|
<name>py30-django</name>
|
|
<name>py31-django</name>
|
|
<range><lt>1.1.1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>py23-django-devel</name>
|
|
<name>py24-django-devel</name>
|
|
<name>py25-django-devel</name>
|
|
<name>py26-django-devel</name>
|
|
<name>py30-django-devel</name>
|
|
<name>py31-django-devel</name>
|
|
<range><lt>11603,1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Django project reports:</p>
|
|
<blockquote cite="http://www.djangoproject.com/weblog/2009/oct/09/security/">
|
|
<p>Django's forms library includes field types which perform
|
|
regular-expression-based validation of email addresses and
|
|
URLs. Certain addresses/URLs could trigger a pathological
|
|
performance case in these regular expression, resulting in
|
|
the server process/thread becoming unresponsive, and consuming
|
|
excessive CPU over an extended period of time. If deliberately
|
|
triggered, this could result in an effectively
|
|
denial-of-service attack.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2009-3695</cvename>
|
|
<url>http://www.djangoproject.com/weblog/2009/oct/09/security/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-10-09</discovery>
|
|
<entry>2009-10-16</entry>
|
|
<modified>2010-05-02</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="4769914e-b844-11de-b159-0030843d3802">
|
|
<topic>phpmyadmin -- XSS and SQL injection vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>phpMyAdmin</name>
|
|
<range><lt>3.2.2.1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>phpMyAdmin211</name>
|
|
<range><lt>2.11.9.6</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>phpMyAdmin Team reports:</p>
|
|
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2009-6.php">
|
|
<p>Cross-site scripting (XSS) vulnerability allows remote attackers to
|
|
inject arbitrary web script or HTML via a crafted MySQL table name.</p>
|
|
<p>SQL injection vulnerability allows remote attackers to inject SQL via
|
|
various interface parameters of the PDF schema generator feature.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2009-3696</cvename>
|
|
<cvename>CVE-2009-3697</cvename>
|
|
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2009-6.php</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-10-13</discovery>
|
|
<entry>2009-10-13</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="437a68cf-b752-11de-b6eb-00e0815b8da8">
|
|
<topic>php5 -- Multiple security issues</topic>
|
|
<affects>
|
|
<package>
|
|
<name>php5</name>
|
|
<range><lt>5.2.11</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Vendor reports</p>
|
|
<blockquote cite="http://www.php.net/releases/5_2_11.php">
|
|
<p>Security Enhancements and Fixes in PHP 5.2.11:
|
|
Fixed certificate validation inside
|
|
php_openssl_apply_verification_policy.
|
|
Fixed sanity check for the color index in imagecolortransparent.
|
|
Added missing sanity checks around exif processing.
|
|
Fixed bug 44683 popen crashes when an invalid mode is passed.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://www.php.net/releases/5_2_11.php</url>
|
|
<cvename>CVE-2009-3291</cvename>
|
|
<cvename>CVE-2009-3292</cvename>
|
|
<cvename>CVE-2009-3293</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-09-17</discovery>
|
|
<entry>2009-10-12</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="ebeed063-b328-11de-b6a5-0030843d3802">
|
|
<topic>virtualbox -- privilege escalation</topic>
|
|
<affects>
|
|
<package>
|
|
<name>virtualbox</name>
|
|
<range><lt>3.0.51.r22902_2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Sun reports:</p>
|
|
<blockquote cite="http://sunsolve.sun.com/search/document.do?assetkey=1-66-268188-1">
|
|
<p>A security vulnerability in the VBoxNetAdpCtl configuration tool
|
|
for certain Sun VirtualBox 3.0 packages may allow local unprivileged
|
|
users who are authorized to run VirtualBox to execute arbitrary
|
|
commands with root privileges.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2009-3692</cvename>
|
|
<url>http://sunsolve.sun.com/search/document.do?assetkey=1-66-268188-1</url>
|
|
<url>http://secunia.com/advisories/36929</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-10-07</discovery>
|
|
<entry>2009-10-07</entry>
|
|
<modified>2010-05-02</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="50383bde-b25b-11de-8c83-02e0185f8d72">
|
|
<topic>FreeBSD -- Devfs / VFS NULL pointer race condition</topic>
|
|
<affects>
|
|
<system>
|
|
<name>FreeBSD</name>
|
|
<range><gt>6.3</gt><lt>6.3_13</lt></range>
|
|
<range><gt>6.4</gt><lt>6.4_7</lt></range>
|
|
<range><gt>7.1</gt><lt>7.1_8</lt></range>
|
|
<range><gt>7.2</gt><lt>7.2_4</lt></range>
|
|
</system>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<h1>Problem Description:</h1>
|
|
<p>Due to the interaction between devfs and VFS, a race condition
|
|
exists where the kernel might dereference a NULL pointer.</p>
|
|
<h1>Impact:</h1>
|
|
<p>Successful exploitation of the race condition can lead to local
|
|
kernel privilege escalation, kernel data corruption and/or
|
|
crash.</p>
|
|
<p>To exploit this vulnerability, an attacker must be able to run
|
|
code with user privileges on the target system.</p>
|
|
<h1>Workaround:</h1>
|
|
<p>An errata note, FreeBSD-EN-09:05.null has been released
|
|
simultaneously to this advisory, and contains a kernel patch
|
|
implementing a workaround for a more broad class of
|
|
vulnerabilities. However, prior to those changes, no workaround
|
|
is available.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<freebsdsa>SA-09:14.devfs</freebsdsa>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-10-02</discovery>
|
|
<entry>2009-10-06</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="90d2e58f-b25a-11de-8c83-02e0185f8d72">
|
|
<topic>FreeBSD -- kqueue pipe race conditions</topic>
|
|
<affects>
|
|
<system>
|
|
<name>FreeBSD</name>
|
|
<range><gt>6.3</gt><lt>6.4_7</lt></range>
|
|
<range><gt>6.4</gt><lt>6.3_13</lt></range>
|
|
</system>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<h1>Problem Description</h1>
|
|
<p>A race condition exists in the pipe close() code relating
|
|
to kqueues, causing use-after-free for kernel memory, which
|
|
may lead to an exploitable NULL pointer vulnerability in the
|
|
kernel, kernel memory corruption, and other unpredictable
|
|
results.</p>
|
|
<h1>Impact:</h1>
|
|
<p>Successful exploitation of the race condition can lead to
|
|
local kernel privilege escalation, kernel data corruption
|
|
and/or crash.</p>
|
|
<p>To exploit this vulnerability, an attacker must be able to
|
|
run code on the target system.</p>
|
|
<h1>Workaround</h1>
|
|
<p>An errata notice, FreeBSD-EN-09:05.null has been released
|
|
simultaneously to this advisory, and contains a kernel patch
|
|
implementing a workaround for a more broad class of
|
|
vulnerabilities. However, prior to those changes, no
|
|
workaround is available.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<freebsdsa>SA-09:13.pipe</freebsdsa>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-10-02</discovery>
|
|
<entry>2009-10-06</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="beb6f4a8-add5-11de-8b55-0030843d3802">
|
|
<topic>mybb -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>mybb</name>
|
|
<range><lt>1.4.9</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>mybb team reports:</p>
|
|
<blockquote cite="http://blog.mybboard.net/2009/09/21/mybb-1-4-9-released-security-update/">
|
|
<p>Input passed via avatar extensions is not properly sanitised before
|
|
being used in SQL queries. This can be exploited to manipulate SQL
|
|
queries by uploading specially named avatars.</p>
|
|
<p>The script allows to sign up with usernames containing zero width
|
|
space characters, which can be exploited to e.g. conduct spoofing
|
|
attacks.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>36460</bid>
|
|
<url>http://dev.mybboard.net/issues/464</url>
|
|
<url>http://dev.mybboard.net/issues/418</url>
|
|
<url>http://secunia.com/advisories/36803</url>
|
|
<url>http://blog.mybboard.net/2009/09/21/mybb-1-4-9-released-security-update/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-09-21</discovery>
|
|
<entry>2009-09-30</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="bad1b090-a7ca-11de-873f-0030843d3802">
|
|
<topic>drupal -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>drupal5</name>
|
|
<range><lt>5.20</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>drupal6</name>
|
|
<range><lt>6.14</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Drupal Team reports:</p>
|
|
<blockquote cite="http://drupal.org/node/579482">
|
|
<p>The core OpenID module does not correctly implement Form API for
|
|
the form that allows one to link user accounts with OpenID
|
|
identifiers. A malicious user is therefore able to use cross site
|
|
request forgeries to add attacker controlled OpenID identities to
|
|
existing accounts. These OpenID identities can then be used to gain
|
|
access to the affected accounts.</p>
|
|
<p>The OpenID module is not a compliant implementation of the OpenID
|
|
Authentication 2.0 specification. An implementation error allows a
|
|
user to access the account of another user when they share the same
|
|
OpenID 2.0 provider.</p>
|
|
<p>File uploads with certain extensions are not correctly processed by
|
|
the File API. This may lead to the creation of files that are
|
|
executable by Apache. The .htaccess that is saved into the files
|
|
directory by Drupal should normally prevent execution. The files are
|
|
only executable when the server is configured to ignore the directives
|
|
in the .htaccess file.</p>
|
|
<p>Drupal doesn't regenerate the session ID when an anonymous user
|
|
follows the one time login link used to confirm email addresses and
|
|
reset forgotten passwords. This enables a malicious user to fix and
|
|
reuse the session id of a victim under certain circumstances.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://drupal.org/node/579482</url>
|
|
<url>http://secunia.com/advisories/36787/</url>
|
|
<url>http://secunia.com/advisories/36786/</url>
|
|
<url>http://secunia.com/advisories/36781/</url>
|
|
<url>http://secunia.com/advisories/36776/</url>
|
|
<url>http://secunia.com/advisories/36785/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-09-17</discovery>
|
|
<entry>2009-09-22</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="113cd7e9-a4e2-11de-84af-001195e39404">
|
|
<topic>fwbuilder -- security issue in temporary file handling</topic>
|
|
<affects>
|
|
<package>
|
|
<name>fwbuilder</name>
|
|
<range><lt>3.0.7</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Firewall Builder release notes reports:</p>
|
|
<blockquote cite="http://www.fwbuilder.org/docs/firewall_builder_release_notes.html#3.0.7">
|
|
<p>Vadim Kurland (vadim.kurland@fwbuilder.org) reports:</p>
|
|
<p>Fwbuilder and libfwbuilder 3.0.4 through to 3.0.6 generate
|
|
iptables scripts with a security issue when also used to
|
|
generate static routing configurations.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2009-4664</cvename>
|
|
<url>http://www.fwbuilder.org/docs/firewall_builder_release_notes.html#3.0.7</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-09-18</discovery>
|
|
<entry>2009-09-18</entry>
|
|
<modified>2010-05-02</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="b9ec7fe3-a38a-11de-9c6b-003048818f40">
|
|
<topic>bugzilla -- two SQL injections, sensitive data exposure</topic>
|
|
<affects>
|
|
<package>
|
|
<name>bugzilla</name>
|
|
<range><gt>3.3.1</gt><lt>3.4.2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A Bugzilla Security Advisory reports:</p>
|
|
<blockquote cite="http://www.bugzilla.org/security/3.4/">
|
|
<ul>
|
|
<li>It is possible to inject raw SQL into the Bugzilla
|
|
database via the "Bug.create" and "Bug.search" WebService
|
|
functions.</li>
|
|
<li>When a user would change his password, his new password would
|
|
be exposed in the URL field of the browser if he logged in right
|
|
after changing his password.</li>
|
|
</ul>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2009-3125</cvename>
|
|
<cvename>CVE-2009-3165</cvename>
|
|
<cvename>CVE-2009-3166</cvename>
|
|
<url>http://www.bugzilla.org/security/3.0.8/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-09-11</discovery>
|
|
<entry>2009-09-17</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="ee23aa09-a175-11de-96c0-0011098ad87f">
|
|
<topic>horde-base -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>horde-base</name>
|
|
<range><lt>3.3.5</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Horde team reports:</p>
|
|
<blockquote cite="http://cvs.horde.org/diff.php/horde/docs/CHANGES?r1=1.515.2.558&r2=1.515.2.559">
|
|
<p>An error within the form library when handling image form fields can
|
|
be exploited to overwrite arbitrary local files.</p>
|
|
<p>An error exists within the MIME Viewer library when rendering unknown
|
|
text parts. This can be exploited to execute arbitrary HTML and script
|
|
code in a user's browser session in context of an affected site if
|
|
malicious data is viewed.</p>
|
|
<p>The preferences system does not properly sanitise numeric preference
|
|
types. This can be exploited to execute arbitrary HTML and script code
|
|
in a user's browser session in contact of an affected site.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://bugs.horde.org/ticket/?id=8311</url>
|
|
<url>http://bugs.horde.org/ticket/?id=8399</url>
|
|
<url>http://secunia.com/advisories/36665/</url>
|
|
<url>http://cvs.horde.org/diff.php/horde/docs/CHANGES?r1=1.515.2.558&r2=1.515.2.559</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-05-28</discovery>
|
|
<entry>2009-09-14</entry>
|
|
<modified>2009-09-22</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="152b27f0-a158-11de-990c-e5b1d4c882e0">
|
|
<topic>nginx -- remote denial of service vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>nginx</name>
|
|
<range><lt>0.7.62</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>nginx-devel</name>
|
|
<range><lt>0.8.15</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>nginx development team reports:</p>
|
|
<blockquote cite="http://nginx.net/CHANGES">
|
|
<p>A segmentation fault might occur in worker process while
|
|
specially crafted request handling.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2009-2629</cvename>
|
|
<url>http://nginx.net/CHANGES</url>
|
|
<mlist msgid="20090914155338.GA2529@ngolde.de">http://lists.debian.org/debian-security-announce/2009/msg00205.html</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-09-14</discovery>
|
|
<entry>2009-09-14</entry>
|
|
<modified>2009-09-15</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="6e8f54af-a07d-11de-a649-000c2955660f">
|
|
<topic>ikiwiki -- insufficient blacklisting in teximg plugin</topic>
|
|
<affects>
|
|
<package>
|
|
<name>ikiwiki</name>
|
|
<range><lt>3.1415926</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The IkiWiki development team reports:</p>
|
|
<blockquote cite="http://ikiwiki.info/security/#index35h2">
|
|
<p>IkiWikis teximg plugin's blacklisting of insecure TeX commands
|
|
is insufficient; it can be bypassed and used to read arbitrary
|
|
files.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2009-2944</cvename>
|
|
<url>http://ikiwiki.info/security/#index35h2</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-08-28</discovery>
|
|
<entry>2009-09-13</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="b46f3a1e-a052-11de-a649-000c2955660f">
|
|
<topic>xapian-omega -- cross-site scripting vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>xapian-omega</name>
|
|
<range><lt>1.0.16</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Olly Betts reports:</p>
|
|
<blockquote cite="http://lists.xapian.org/pipermail/xapian-discuss/2009-September/007115.html">
|
|
<p>There's a cross-site scripting issue in Omega - exception
|
|
messages don't currently get HTML entities escaped, but can
|
|
contain CGI parameter values in some cases.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2009-2947</cvename>
|
|
<url>http://lists.xapian.org/pipermail/xapian-discuss/2009-September/007115.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-09-09</discovery>
|
|
<entry>2009-09-13</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="922d2398-9e2d-11de-a998-0030843d3802">
|
|
<topic>mozilla firefox -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>firefox</name>
|
|
<range><gt>3.5.*,1</gt><lt>3.5.3,1</lt></range>
|
|
<range><gt>3.*,1</gt><lt>3.0.13,1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Mozilla Foundation reports:</p>
|
|
<blockquote cite="http://www.mozilla.org/security/announce/">
|
|
<p>MFSA 2009-51 Chrome privilege escalation with FeedWriter</p>
|
|
<p>MFSA 2009-50 Location bar spoofing via tall line-height Unicode
|
|
characters</p>
|
|
<p>MFSA 2009-49 TreeColumns dangling pointer vulnerability</p>
|
|
<p>MFSA 2009-48 Insufficient warning for PKCS11 module installation
|
|
and removal</p>
|
|
<p>MFSA 2009-47 Crashes with evidence of memory corruption
|
|
(rv:1.9.1.3/1.9.0.14)</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2009-3069</cvename>
|
|
<cvename>CVE-2009-3070</cvename>
|
|
<cvename>CVE-2009-3071</cvename>
|
|
<cvename>CVE-2009-3072</cvename>
|
|
<cvename>CVE-2009-3073</cvename>
|
|
<cvename>CVE-2009-3074</cvename>
|
|
<cvename>CVE-2009-3075</cvename>
|
|
<cvename>CVE-2009-3076</cvename>
|
|
<cvename>CVE-2009-3077</cvename>
|
|
<cvename>CVE-2009-3078</cvename>
|
|
<cvename>CVE-2009-3079</cvename>
|
|
<url>http://www.mozilla.org/security/announce/2009/mfsa2009-47.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2009/mfsa2009-48.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2009/mfsa2009-49.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2009/mfsa2009-50.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2009/mfsa2009-51.html</url>
|
|
<url>http://secunia.com/advisories/36671/2/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-09-10</discovery>
|
|
<entry>2009-09-10</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="012b495c-9d51-11de-8d20-001bd3385381">
|
|
<topic>cyrus-imapd -- Potential buffer overflow in Sieve</topic>
|
|
<affects>
|
|
<package>
|
|
<name>cyrus-imapd</name>
|
|
<range><gt>2.2.0</gt><lt>2.2.13_6</lt></range>
|
|
<range><gt>2.3.0</gt><lt>2.3.14_2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Cyrus IMAP Server ChangeLog states:</p>
|
|
<blockquote cite="http://cyrusimap.web.cmu.edu/imapd/changes.html">
|
|
<p>Fixed CERT VU#336053 - Potential buffer overflow in Sieve.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2009-2632</cvename>
|
|
<bid>36296</bid>
|
|
<url>http://www.kb.cert.org/vuls/id/336053</url>
|
|
<url>http://www.debian.org/security/2009/dsa-1881</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-09-02</discovery>
|
|
<entry>2009-09-09</entry>
|
|
<modified>2009-09-14</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="24aa9970-9ccd-11de-af10-000c29a67389">
|
|
<topic>silc-toolkit -- Format string vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>silc-toolkit</name>
|
|
<range><lt>1.1.9</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>SILC Changlog reports:</p>
|
|
<blockquote cite="http://silcnet.org/docs/changelog/SILC%20Toolkit%201.1.10">
|
|
<p>An unspecified format string vulnerability exists in
|
|
silc-toolkit.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2009-3051</cvename>
|
|
<url>http://silcnet.org/docs/changelog/SILC%20Toolkit%201.1.10</url>
|
|
<url>http://www.openwall.com/lists/oss-security/2009/09/03/5</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-08-07</discovery>
|
|
<entry>2009-09-08</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="4582948a-9716-11de-83a5-001999392805">
|
|
<topic>opera -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>opera</name>
|
|
<range><lt>10.00.20090830</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>opera-devel</name>
|
|
<range><le>10.00.b3_1,1</le></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-opera</name>
|
|
<range><lt>10.00</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Opera Team Reports:</p>
|
|
<blockquote cite="http://www.opera.com/docs/changelogs/freebsd/1000/">
|
|
<ul>
|
|
<li>Issue where sites using revoked intermediate certificates might be shown as secure</li>
|
|
<li>Issue where the collapsed address bar didn't show the current domain</li>
|
|
<li>Issue where pages could trick users into uploading files</li>
|
|
<li>Some IDNA characters not correctly displaying in the address bar</li>
|
|
<li>Issue where Opera accepts nulls and invalid wild-cards in certificates</li>
|
|
</ul>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://www.opera.com/support/search/view/929/</url>
|
|
<url>http://www.opera.com/support/search/view/930/</url>
|
|
<url>http://www.opera.com/support/search/view/931/</url>
|
|
<url>http://www.opera.com/support/search/view/932/</url>
|
|
<url>http://www.opera.com/support/search/view/934/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-09-01</discovery>
|
|
<entry>2009-09-04</entry>
|
|
<modified>2009-10-29</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="80aa98e0-97b4-11de-b946-0030843d3802">
|
|
<topic>dnsmasq -- TFTP server remote code injection vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>dnsmasq</name>
|
|
<range><lt>2.50</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Simon Kelley reports:</p>
|
|
<blockquote cite="http://www.thekelleys.org.uk/dnsmasq/CHANGELOG">
|
|
<p>Fix security problem which allowed any host permitted to
|
|
do TFTP to possibly compromise dnsmasq by remote buffer
|
|
overflow when TFTP enabled.</p>
|
|
<p>Fix a problem which allowed a malicious TFTP client to
|
|
crash dnsmasq.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>36121</bid>
|
|
<bid>36120</bid>
|
|
<cvename>CVE-2009-2957</cvename>
|
|
<cvename>CVE-2009-2958</cvename>
|
|
<url>http://www.coresecurity.com/content/dnsmasq-vulnerabilities</url>
|
|
<url>https://rhn.redhat.com/errata/RHSA-2009-1238.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-08-31</discovery>
|
|
<entry>2009-09-02</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="e15f2356-9139-11de-8f42-001aa0166822">
|
|
<topic>apache22 -- several vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>apache</name>
|
|
<range><gt>2.2.0</gt><lt>2.2.12</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Apache ChangeLog reports:</p>
|
|
<blockquote cite="http://www.apache.org/dist/httpd/CHANGES_2.2.12">
|
|
<p>CVE-2009-1891: Fix a potential Denial-of-Service attack against mod_deflate or other modules.</p>
|
|
<p>CVE-2009-1195: Prevent the "Includes" Option from being enabled in an .htaccess file if the AllowOverride restrictions do not permit it.</p>
|
|
<p>CVE-2009-1890: Fix a potential Denial-of-Service attack against mod_proxy in a reverse proxy configuration.</p>
|
|
<p>CVE-2009-1191: mod_proxy_ajp: Avoid delivering content from a previous request which failed to send a request body.</p>
|
|
<p>CVE-2009-0023, CVE-2009-1955, CVE-2009-1956: The bundled copy of the APR-util library has been updated, fixing three different security issues which may affect particular configurations and third-party modules (was already fixed in 2.2.11_5).</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2009-1891</cvename><!-- vul: 2.2.11 -->
|
|
<cvename>CVE-2009-1195</cvename><!-- vul: 2.2.x to 2.2.11 -->
|
|
<cvename>CVE-2009-1890</cvename><!-- ok: 2.3.3 -->
|
|
<cvename>CVE-2009-1191</cvename><!-- vul: 2.2.11 -->
|
|
<cvename>CVE-2009-0023</cvename><!-- ok: apr 1.3.5 -->
|
|
<cvename>CVE-2009-1955</cvename><!-- ok: apr-util 1.3.7 -->
|
|
<cvename>CVE-2009-1956</cvename><!-- ok: apr-util 1.3.5 -->
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-07-28</discovery><!-- release date of 2.2.12 -->
|
|
<entry>2009-08-25</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="59e7af2d-8db7-11de-883b-001e3300a30d">
|
|
<topic>pidgin -- MSN overflow parsing SLP messages</topic>
|
|
<affects>
|
|
<package>
|
|
<name>pidgin</name>
|
|
<name>libpurple</name>
|
|
<name>finch</name>
|
|
<range><lt>2.5.9</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/36384">
|
|
<p>A vulnerability has been reported in Pidgin, which can be
|
|
exploited by malicious people to potentially compromise a user's
|
|
system.</p>
|
|
<p>The vulnerability is caused due to an error in the
|
|
"msn_slplink_process_msg()" function when processing MSN SLP
|
|
messages and can be exploited to corrupt memory.</p>
|
|
<p>Successful exploitation may allow execution of arbitrary
|
|
code.</p>
|
|
<p>The vulnerability is reported in versions 2.5.8 and prior.
|
|
Other versions may also be affected.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2009-2694</cvename>
|
|
<url>http://secunia.com/advisories/36384/</url>
|
|
<url>http://www.pidgin.im/news/security/?id=34</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-08-18</discovery>
|
|
<entry>2009-08-20</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="b31a1088-460f-11de-a11a-0022156e8794">
|
|
<topic>GnuTLS -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>gnutls</name>
|
|
<range><lt>2.6.6</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>gnutls-devel</name>
|
|
<range><lt>2.7.8</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>SecurityFocus reports:</p>
|
|
<blockquote cite="http://www.securityfocus.com/bid/34783/discuss">
|
|
<p>GnuTLS is prone to multiple remote vulnerabilities:</p>
|
|
<ul>
|
|
<li>A remote code-execution vulnerability.</li>
|
|
<li>A denial-of-service vulnerability.</li>
|
|
<li>A signature-generation vulnerability.</li>
|
|
<li>A signature-verification vulnerability.</li>
|
|
</ul>
|
|
<p>An attacker can exploit these issues to potentially execute
|
|
arbitrary code, trigger denial-of-service conditions, carry
|
|
out attacks against data signed with weak signatures, and
|
|
cause clients to accept expired or invalid certificates from
|
|
servers.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2009-1415</cvename>
|
|
<cvename>CVE-2009-1416</cvename>
|
|
<cvename>CVE-2009-1417</cvename>
|
|
<bid>34783</bid>
|
|
<url>http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3515</url>
|
|
<url>http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3516</url>
|
|
<url>http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3517</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-05-21</discovery>
|
|
<entry>2009-08-17</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="856a6f84-8b30-11de-8062-00e0815b8da8">
|
|
<topic>GnuTLS -- improper SSL certificate verification</topic>
|
|
<affects>
|
|
<package>
|
|
<name>gnutls</name>
|
|
<range><lt>2.8.3</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>gnutls-devel</name>
|
|
<range><lt>2.9.0</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>GnuTLS reports:</p>
|
|
<blockquote cite="http://article.gmane.org/gmane.network.gnutls.general/1733">
|
|
<p>By using a NUL byte in CN/SAN fields, it was possible to fool
|
|
GnuTLS into 1) not printing the entire CN/SAN field value when
|
|
printing a certificate and 2) cause incorrect positive matches
|
|
when matching a hostname against a certificate.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2009-2730</cvename>
|
|
<url>http://article.gmane.org/gmane.network.gnutls.general/1733</url>
|
|
<url>http://secunia.com/advisories/36266</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-08-11</discovery>
|
|
<entry>2009-08-17</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="86ada694-8b30-11de-b9d0-000c6e274733">
|
|
<topic>memcached -- memcached stats maps Information Disclosure Weakness</topic>
|
|
<affects>
|
|
<package>
|
|
<name>memcached</name>
|
|
<range><lt>1.2.8</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/34915/">
|
|
<p>A weakness has been reported in memcached, which can be exploited
|
|
by malicious people to disclose system information.</p>
|
|
<p>The weakness is caused due to the application disclosing the
|
|
content of /proc/self/maps if a stats maps command is received.
|
|
This can be exploited to disclose e.g. the addresses of allocated
|
|
memory regions.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2009-1255</cvename>
|
|
<url>http://secunia.com/advisories/34915/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-04-29</discovery>
|
|
<entry>2009-08-17</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="2430e9c3-8741-11de-938e-003048590f9e">
|
|
<topic>wordpress -- remote admin password reset vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>wordpress</name>
|
|
<range><lt>2.8.4,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>de-wordpress</name>
|
|
<range><lt>2.8.4</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>wordpress-mu</name>
|
|
<range><lt>2.8.4a</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>WordPress reports:</p>
|
|
<blockquote cite="http://wordpress.org/development/2009/08/2-8-4-security-release/">
|
|
<p>A specially crafted URL could be requested that would allow an
|
|
attacker to bypass a security check to verify a user requested a
|
|
password reset. As a result, the first account without a key in the
|
|
database (usually the admin account) would have its password reset and
|
|
a new password would be emailed to the account owner.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2009-2762</cvename>
|
|
<url>http://wordpress.org/development/2009/08/2-8-4-security-release/</url>
|
|
<url>http://www.milw0rm.com/exploits/9410</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-08-10</discovery>
|
|
<entry>2009-08-12</entry>
|
|
<modified>2010-05-02</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="5179d85c-8683-11de-91b9-0022157515b2">
|
|
<topic>fetchmail -- improper SSL certificate subject verification</topic>
|
|
<affects>
|
|
<package>
|
|
<name>fetchmail</name>
|
|
<range><lt>6.3.11</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Matthias Andree reports:</p>
|
|
<blockquote cite="http://www.fetchmail.info/fetchmail-SA-2009-01.txt">
|
|
<p>Moxie Marlinspike demonstrated in July 2009 that some CAs would
|
|
sign certificates that contain embedded NUL characters in the
|
|
Common Name or subjectAltName fields of ITU-T X.509
|
|
certificates.</p>
|
|
<p>Applications that would treat such X.509 strings as
|
|
NUL-terminated C strings (rather than strings that contain an
|
|
explicit length field) would only check the part up to and
|
|
excluding the NUL character, so that certificate names such as
|
|
www.good.example\0www.bad.example.com would be mistaken as a
|
|
certificate name for www.good.example. fetchmail also had this
|
|
design and implementation flaw.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2009-2666</cvename>
|
|
<url>http://www.fetchmail.info/fetchmail-SA-2009-01.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-08-06</discovery>
|
|
<entry>2009-08-11</entry>
|
|
<modified>2009-08-13</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="739b94a4-838b-11de-938e-003048590f9e">
|
|
<topic>joomla15 -- com_mailto Timeout Issue</topic>
|
|
<affects>
|
|
<package>
|
|
<name>joomla15</name>
|
|
<range><lt>1.5.14</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Joomla! Security Center reports:</p>
|
|
<blockquote cite="http://developer.joomla.org/security/news/303-20090723-core-com-mailto-timeout-issue.html">
|
|
<p>In com_mailto, it was possible to bypass timeout protection against
|
|
sending automated emails.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://developer.joomla.org/security.html</url>
|
|
<url>http://secunia.com/advisories/36097/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-07-22</discovery>
|
|
<entry>2009-08-07</entry>
|
|
<modified>2009-08-11</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="bce1f76d-82d0-11de-88ea-001a4d49522b">
|
|
<topic>subversion -- heap overflow vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>subversion</name>
|
|
<name>subversion-freebsd</name>
|
|
<name>p5-subversion</name>
|
|
<name>py-subversion</name>
|
|
<range><lt>1.6.4</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A Subversion Security Advisory reports:</p>
|
|
<blockquote cite="http://subversion.tigris.org/security/CVE-2009-2411-advisory.txt">
|
|
<p>Subversion clients and servers have multiple heap
|
|
overflow issues in the parsing of binary deltas. This is
|
|
related to an allocation vulnerability in the APR library
|
|
used by Subversion.</p>
|
|
<p>Clients with commit access to a vulnerable server can
|
|
cause a remote heap overflow; servers can cause a heap
|
|
overflow on vulnerable clients that try to do a checkout
|
|
or update.</p>
|
|
<p>This can lead to a DoS (an exploit has been tested) and
|
|
to arbitrary code execution (no exploit tested, but the
|
|
possibility is clear).</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2009-2411</cvename>
|
|
<url>http://subversion.tigris.org/security/CVE-2009-2411-advisory.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-08-06</discovery>
|
|
<entry>2009-08-06</entry>
|
|
<modified>2009-08-07</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="d67b517d-8214-11de-88ea-001a4d49522b">
|
|
<topic>bugzilla -- product name information leak</topic>
|
|
<affects>
|
|
<package>
|
|
<name>bugzilla</name>
|
|
<range><gt>3.3.4</gt><lt>3.4.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A Bugzilla Security Advisory reports:</p>
|
|
<blockquote cite="http://www.bugzilla.org/security/3.4/">
|
|
<p>Normally, users are only supposed to see products that
|
|
they can file bugs against in the "Product" drop-down on
|
|
the bug-editing page. Instead, users were being shown all
|
|
products, even those that they normally could not see. Any
|
|
user who could edit any bug could see all product
|
|
names.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://www.bugzilla.org/security/3.4/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-07-30</discovery>
|
|
<entry>2009-08-05</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="49e8f2ee-8147-11de-a994-0030843d3802">
|
|
<topic>mozilla -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>firefox</name>
|
|
<name>linux-firefox</name>
|
|
<range><lt>3.*,1</lt></range>
|
|
<range><gt>3.*,1</gt><lt>3.0.13,1</lt></range>
|
|
<range><gt>3.5.*,1</gt><lt>3.5.2,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-firefox-devel</name>
|
|
<range><lt>3.5.2</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>seamonkey</name>
|
|
<name>linux-seamonkey</name>
|
|
<range><lt>1.1.18</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-seamonkey-devel</name>
|
|
<range><gt>0</gt></range>
|
|
</package>
|
|
<package>
|
|
<name>thunderbird</name>
|
|
<name>linux-thunderbird</name>
|
|
<range><lt>2.0.0.23</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Mozilla Project reports:</p>
|
|
<blockquote cite="http://www.mozilla.org/security/announce/">
|
|
<p>MFSA 2009-38: Data corruption with SOCKS5 reply containing DNS name
|
|
longer than 15 characters</p>
|
|
<p>MFSA 2009-42: Compromise of SSL-protected communication</p>
|
|
<p>MFSA 2009-43: Heap overflow in certificate regexp parsing</p>
|
|
<p>MFSA 2009-44: Location bar and SSL indicator spoofing via window.open()
|
|
on invalid URL</p>
|
|
<p>MFSA 2009-45: Crashes with evidence of memory corruption
|
|
(rv:1.9.1.2/1.9.0.13)</p>
|
|
<p>MFSA 2009-46: Chrome privilege escalation due to incorrectly cached
|
|
wrapper</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2009-2404</cvename>
|
|
<cvename>CVE-2009-2408</cvename>
|
|
<cvename>CVE-2009-2454</cvename>
|
|
<cvename>CVE-2009-2470</cvename>
|
|
<url>http://www.mozilla.org/security/announce/2009/mfsa2009-38.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2009/mfsa2009-42.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2009/mfsa2009-43.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2009/mfsa2009-44.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2009/mfsa2009-45.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2009/mfsa2009-46.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-08-03</discovery>
|
|
<entry>2009-08-04</entry>
|
|
<modified>2009-09-04</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="4e306850-811f-11de-8a67-000c29a67389">
|
|
<topic>silc-client -- Format string vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>silc-client</name>
|
|
<name>silc-irssi-client</name>
|
|
<range><lt>1.1.8</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>SILC changelog reports:</p>
|
|
<blockquote cite="http://silcnet.org/docs/changelog/SILC%20Client%201.1.8">
|
|
<p>An unspecified format string vulnerability exists in
|
|
silc-client.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2009-3051</cvename>
|
|
<url>http://silcnet.org/docs/changelog/SILC%20Client%201.1.8</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-07-31</discovery>
|
|
<entry>2009-08-04</entry>
|
|
<modified>2010-05-02</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="0d0237d0-7f68-11de-984d-0011098ad87f">
|
|
<topic>SquirrelMail -- Plug-ins compromise</topic>
|
|
<affects>
|
|
<package>
|
|
<name>squirrelmail-multilogin-plugin</name>
|
|
<range><ge>2.3.4</ge><lt>2.3.4_2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<h1>Problem Description:</h1>
|
|
<p>The SquirrelMail Web Server has been compromised, and three plugins
|
|
are affected.</p>
|
|
<p>The port of squirrelmail-sasql-plugin is safe (right MD5), and
|
|
change_pass is not in the FreeBSD ports tree, but multilogin has a
|
|
wrong MD5.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://sourceforge.net/mailarchive/message.php?msg_name=4A727634.3080008%40squirrelmail.org</url>
|
|
<url>http://squirrelmail.org/index.php</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-07-31</discovery>
|
|
<entry>2009-08-02</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="83725c91-7c7e-11de-9672-00e0815b8da8">
|
|
<topic>BIND -- Dynamic update message remote DoS</topic>
|
|
<affects>
|
|
<package>
|
|
<name>bind9</name>
|
|
<range><lt>9.3.6.1.1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>bind9-sdb-postgresql</name>
|
|
<name>bind9-sdb-ldap</name>
|
|
<range><lt>9.4.3.3</lt></range>
|
|
</package>
|
|
<system>
|
|
<name>FreeBSD</name>
|
|
<range><ge>6.3</ge><lt>6.3_12</lt></range>
|
|
<range><ge>6.4</ge><lt>6.4_6</lt></range>
|
|
<range><ge>7.1</ge><lt>7.1_7</lt></range>
|
|
<range><ge>7.2</ge><lt>7.2_3</lt></range>
|
|
</system>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<h1>Problem Description:</h1>
|
|
<p>When named(8) receives a specially crafted dynamic update
|
|
message an internal assertion check is triggered which causes
|
|
named(8) to exit.</p>
|
|
<p>To trigger the problem, the dynamic update message must contains
|
|
a record of type "ANY" and at least one resource record set (RRset)
|
|
for this fully qualified domain name (FQDN) must exist on the
|
|
server.</p>
|
|
<h1>Impact:</h1>
|
|
<p>An attacker which can send DNS requests to a nameserver can cause
|
|
it to exit, thus creating a Denial of Service situation.</p>
|
|
<h1>Workaround:</h1>
|
|
<p>No generally applicable workaround is available, but some firewalls
|
|
may be able to prevent nsupdate DNS packets from reaching the
|
|
nameserver.</p>
|
|
<p>NOTE WELL: Merely configuring named(8) to ignore dynamic updates
|
|
is NOT sufficient to protect it from this vulnerability.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2009-0696</cvename>
|
|
<freebsdsa>SA-09:12.bind</freebsdsa>
|
|
<url>http://www.kb.cert.org/vuls/id/725188</url>
|
|
<url>https://www.isc.org/node/474</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-07-28</discovery>
|
|
<entry>2009-08-01</entry>
|
|
<modified>2009-08-04</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="708c65a5-7c58-11de-a994-0030843d3802">
|
|
<topic>mono -- XML signature HMAC truncation spoofing</topic>
|
|
<affects>
|
|
<package>
|
|
<name>mono</name>
|
|
<range><lt>2.4.2.2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/35852/">
|
|
<p>A security issue has been reported in Mono, which can be
|
|
exploited by malicious people to conduct spoofing attacks.</p>
|
|
<p>The security issue is caused due to an error when processing
|
|
certain XML signatures.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2009-0217</cvename>
|
|
<url>http://secunia.com/advisories/35852/</url>
|
|
<url>http://www.kb.cert.org/vuls/id/466161</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-07-15</discovery>
|
|
<entry>2009-07-29</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="e1156e90-7ad6-11de-b26a-0048543d60ce">
|
|
<topic>squid -- several remote denial of service vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>squid</name>
|
|
<range><ge>3.0.1</ge><lt>3.0.17</lt></range>
|
|
<range><ge>3.1.0.1</ge><lt>3.1.0.12</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Squid security advisory 2009:2 reports:</p>
|
|
<blockquote cite="http://www.squid-cache.org/Advisories/SQUID-2009_2.txt">
|
|
<p>Due to incorrect buffer limits and related bound checks Squid
|
|
is vulnerable to a denial of service attack when processing
|
|
specially crafted requests or responses.</p>
|
|
<p>Due to incorrect data validation Squid is vulnerable to a
|
|
denial of service attack when processing specially crafted
|
|
responses.</p>
|
|
<p>These problems allow any trusted client or external server to
|
|
perform a denial of service attack on the Squid service.</p>
|
|
</blockquote>
|
|
<p>Squid-2.x releases are not affected.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2009-2621</cvename>
|
|
<cvename>CVE-2009-2622</cvename>
|
|
<url>http://www.squid-cache.org/Advisories/SQUID-2009_2.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-07-27</discovery>
|
|
<entry>2009-07-27</entry>
|
|
<modified>2009-08-06</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="c1ef9b33-72a6-11de-82ea-0030843d3802">
|
|
<topic>mozilla -- corrupt JIT state after deep return from native function</topic>
|
|
<affects>
|
|
<package>
|
|
<name>firefox</name>
|
|
<range><ge>3.5.*,1</ge><lt>3.5.1,1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Mozilla Project reports:</p>
|
|
<blockquote cite="http://www.mozilla.org/security/announce/2009/mfsa2009-41.html">
|
|
<p>Firefox user zbyte reported a crash that we determined could result
|
|
in an exploitable memory corruption problem. In certain cases after a
|
|
return from a native function, such as escape(), the Just-in-Time
|
|
(JIT) compiler could get into a corrupt state. This could be exploited
|
|
by an attacker to run arbitrary code such as installing malware.</p>
|
|
<p>This vulnerability does not affect earlier versions of Firefox
|
|
which do not support the JIT feature.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2009-2477</cvename>
|
|
<url>http://www.mozilla.org/security/announce/2009/mfsa2009-41.html</url>
|
|
<url>http://www.kb.cert.org/vuls/id/443060</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-07-16</discovery>
|
|
<entry>2009-07-17</entry>
|
|
<modified>2010-05-02</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="c444c8b7-7169-11de-9ab7-000c29a67389">
|
|
<topic>isc-dhcp-client -- Stack overflow vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>isc-dhcp31-client</name>
|
|
<range><le>3.1.1</le></range>
|
|
</package>
|
|
<package>
|
|
<name>isc-dhcp30-client</name>
|
|
<range><lt>3.0.7_1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>US-CERT reports:</p>
|
|
<blockquote cite="http://www.kb.cert.org/vuls/id/410676">
|
|
<p>The ISC DHCP dhclient application contains a stack buffer
|
|
overflow, which may allow a remote, unauthenticated attacker to
|
|
execute arbitrary code with root privileges.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2009-0692</cvename>
|
|
<url>https://www.isc.org/node/468</url>
|
|
<url>http://secunia.com/advisories/35785</url>
|
|
<url>http://www.kb.cert.org/vuls/id/410676</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-07-14</discovery>
|
|
<entry>2009-07-15</entry>
|
|
<modified>2009-07-21</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="be927298-6f97-11de-b444-001372fd0af2">
|
|
<topic>drupal -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>drupal5</name>
|
|
<range><lt>5.19</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>drupal6</name>
|
|
<range><lt>6.13</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Drupal Security Team reports:</p>
|
|
<blockquote cite="http://drupal.org/node/507572">
|
|
<p>Cross-site scripting</p>
|
|
<p>The Forum module does not correctly handle certain arguments
|
|
obtained from the URL. By enticing a suitably privileged user
|
|
to visit a specially crafted URL, a malicious user is able to
|
|
insert arbitrary HTML and script code into forum pages. Such a
|
|
cross-site scripting attack may lead to the malicious user
|
|
gaining administrative access. Wikipedia has more information
|
|
about cross-site scripting (XSS).</p>
|
|
<p>User signatures have no separate input format, they use the
|
|
format of the comment with which they are displayed. A user
|
|
will no longer be able to edit a comment when an administrator
|
|
changes the comment's input format to a format that is not
|
|
accessible to the user. However they will still be able to
|
|
modify their signature, which will then be processed by the new
|
|
input format.</p>
|
|
<p>If the new format is very permissive, via their signature, the
|
|
user may be able to insert arbitrary HTML and script code into
|
|
pages or, when the PHP filter is enabled for the new format,
|
|
execute PHP code. This issue affects Drupal 6.x only.</p>
|
|
<p>When an anonymous user fails to login due to mistyping his
|
|
username or password, and the page he is on contains a sortable
|
|
table, the (incorrect) username and password are included in
|
|
links on the table. If the user visits these links the password
|
|
may then be leaked to external sites via the HTTP referer.</p>
|
|
<p>In addition, if the anonymous user is enticed to visit the site
|
|
via a specially crafted URL while the Drupal page cache is
|
|
enabled, a malicious user might be able to retrieve the
|
|
(incorrect) username and password from the page cache.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2009-2372</cvename>
|
|
<cvename>CVE-2009-2374</cvename>
|
|
<cvename>CVE-2009-2373</cvename>
|
|
<url>http://drupal.org/node/507572</url>
|
|
<url>http://secunia.com/advisories/35681</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-07-01</discovery>
|
|
<entry>2009-07-13</entry>
|
|
<modified>2010-05-02</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="70372cda-6771-11de-883a-00e0815b8da8">
|
|
<topic>nfsen -- remote command execution</topic>
|
|
<affects>
|
|
<package>
|
|
<name>nfsen</name>
|
|
<range><lt>1.3.2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>nfsen reports:</p>
|
|
<blockquote cite="http://sourceforge.net/forum/forum.php?forum_id=967583">
|
|
<p>Due to double input checking, a remote command execution security
|
|
bug exists in all NfSen versions 1.3 and 1.3.1. Users are
|
|
requested to update to nfsen-1.3.2.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://sourceforge.net/forum/forum.php?forum_id=967583</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-06-18</discovery>
|
|
<entry>2009-07-03</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="ba73f494-65a8-11de-aef5-001c2514716c">
|
|
<topic>phpmyadmin -- XSS vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>phpMyAdmin</name>
|
|
<range><lt>3.2.0.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The phpMyAdmin project reports:</p>
|
|
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2009-5.php">
|
|
<p>It was possible to conduct an XSS attack via a crafted
|
|
SQL bookmark.</p>
|
|
<p>All 3.x releases on which the "bookmarks" feature is
|
|
active are affected, previous versions are not.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2009-2284</cvename>
|
|
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2009-5.php</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-06-30</discovery>
|
|
<entry>2009-06-30</entry>
|
|
<modified>2010-05-02</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="3ebd4cb5-657f-11de-883a-00e0815b8da8">
|
|
<topic>nagios -- Command Injection Vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>nagios</name>
|
|
<range><le>3.0.6_1</le></range>
|
|
</package>
|
|
<package>
|
|
<name>nagios2</name>
|
|
<range><le>2.12_3</le></range>
|
|
</package>
|
|
<package>
|
|
<name>nagios-devel</name>
|
|
<range><le>3.1.0_1</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/35543?">
|
|
<p>A vulnerability has been reported in Nagios, which can be
|
|
exploited by malicious users to potentially compromise a
|
|
vulnerable system.</p>
|
|
<p>Input passed to the "ping" parameter in statuswml.cgi is not
|
|
properly sanitised before being used to invoke the ping command.
|
|
This can be exploited to inject and execute arbitrary shell
|
|
commands.</p>
|
|
<p>Successful exploitation requires access to the ping feature
|
|
of the WAP interface.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2009-2288</cvename>
|
|
<url>http://secunia.com/advisories/35543</url>
|
|
<url>http://tracker.nagios.org/view.php?id=15</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-05-29</discovery>
|
|
<entry>2009-06-30</entry>
|
|
<modified>2009-07-13</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="f59dda75-5ff4-11de-a13e-00e0815b8da8">
|
|
<topic>tor-devel -- DNS resolution vulnerabiliity</topic>
|
|
<affects>
|
|
<package>
|
|
<name>tor-devel</name>
|
|
<range><lt>0.2.1.15-rc</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Tor Project reports:</p>
|
|
<blockquote cite="https://git.torproject.org/checkout/tor/master/ChangeLog">
|
|
<p>A malicious exit relay could convince a controller that the
|
|
client's DNS question resolves to an internal IP address.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>https://git.torproject.org/checkout/tor/master/ChangeLog</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-06-20</discovery>
|
|
<entry>2009-06-23</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="c14aa48c-5ab7-11de-bc9b-0030843d3802">
|
|
<topic>cscope -- multiple buffer overflows</topic>
|
|
<affects>
|
|
<package>
|
|
<name>cscope</name>
|
|
<range><lt>15.7a</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/34978">
|
|
<p>Some vulnerabilities have been reported in Cscope, which
|
|
potentially can be exploited by malicious people to compromise a
|
|
user's system.</p>
|
|
<p>The vulnerabilities are caused due to various boundary errors,
|
|
which can be exploited to cause buffer overflows when parsing
|
|
specially crafted files or directories.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>34805</bid>
|
|
<cvename>CVE-2009-0148</cvename>
|
|
<url>http://secunia.com/advisories/34978</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-05-31</discovery>
|
|
<entry>2009-06-16</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="91a2066b-5ab6-11de-bc9b-0030843d3802">
|
|
<topic>cscope -- buffer overflow</topic>
|
|
<affects>
|
|
<package>
|
|
<name>cscope</name>
|
|
<range><lt>15.6</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>SecurityFocus reports:</p>
|
|
<blockquote cite="http://www.securityfocus.com/bid/34832">
|
|
<p>Attackers may leverage this issue to execute arbitrary code
|
|
in the context of the application. Failed attacks will cause
|
|
denial-of-service conditions.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>34832</bid>
|
|
<cvename>CVE-2009-1577</cvename>
|
|
<url>http://cscope.cvs.sourceforge.net/viewvc/cscope/cscope/src/find.c?view=log#rev1.19</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-05-31</discovery>
|
|
<entry>2009-06-16</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="bdccd14b-5aac-11de-a438-003048590f9e">
|
|
<topic>joomla -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>joomla15</name>
|
|
<range><lt>1.5.11</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/35278/">
|
|
<p>Some vulnerabilities have been reported in Joomla!, which can be
|
|
exploited by malicious users to conduct script insertion attacks and
|
|
by malicious people to conduct cross-site scripting attacks.</p>
|
|
<p>Certain unspecified input is not properly sanitised before being
|
|
used. This can be exploited to insert arbitrary HTML and script code,
|
|
which will be executed in a user's browser session in the context of
|
|
an affected site when the malicious data is displayed.</p>
|
|
<p>Certain unspecified input passed to the user view of the com_users
|
|
core component is not properly sanitised before being returned to the
|
|
user. This can be exploited to execute arbitrary HTML and script code
|
|
in a user's browser session in context of an affected site.</p>
|
|
<p>Input passed via certain parameters to the "JA_Purity" template is
|
|
not properly sanitised before being returned to the user. This can be
|
|
exploited to execute arbitrary HTML and script code in a user's
|
|
browser session in context of an affected site.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2009-1938</cvename>
|
|
<cvename>CVE-2009-1939</cvename>
|
|
<cvename>CVE-2009-1940</cvename>
|
|
<url>http://secunia.com/advisories/35278/</url>
|
|
<url>http://www.joomla.org/announcements/release-news/5235-joomla-1511-security-release-now-available.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-06-03</discovery>
|
|
<entry>2009-06-16</entry>
|
|
<modified>2010-05-02</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="b1ca65e6-5aaf-11de-bc9b-0030843d3802">
|
|
<topic>pidgin -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>pidgin</name>
|
|
<name>libpurple</name>
|
|
<name>finch</name>
|
|
<range><lt>2.5.6</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/35194/">
|
|
<p>Some vulnerabilities and weaknesses have been reported in Pidgin,
|
|
which can be exploited by malicious people to cause a DoS or to
|
|
potentially compromise a user's system.</p>
|
|
<p>A truncation error in the processing of MSN SLP messages can be
|
|
exploited to cause a buffer overflow.</p>
|
|
<p>A boundary error in the XMPP SOCKS5 "bytestream" server when
|
|
initiating an outgoing file transfer can be exploited to cause a
|
|
buffer overflow.</p>
|
|
<p>A boundary error exists in the implementation of the
|
|
"PurpleCircBuffer" structure. This can be exploited to corrupt memory
|
|
and cause a crash via specially crafted XMPP or Sametime
|
|
packets.</p>
|
|
<p>A boundary error in the "decrypt_out()" function can be exploited
|
|
to cause a stack-based buffer overflow with 8 bytes and crash the
|
|
application via a specially crafted QQ packet.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>35067</bid>
|
|
<cvename>CVE-2009-1373</cvename>
|
|
<cvename>CVE-2009-1374</cvename>
|
|
<cvename>CVE-2009-1375</cvename>
|
|
<cvename>CVE-2009-1376</cvename>
|
|
<url>http://secunia.com/advisories/35194/</url>
|
|
<url>http://www.pidgin.im/news/security/?id=29</url>
|
|
<url>http://www.pidgin.im/news/security/?id=30</url>
|
|
<url>http://www.pidgin.im/news/security/?id=32</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-06-03</discovery>
|
|
<entry>2009-06-16</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="d9b01c08-59b3-11de-828e-00e0815b8da8">
|
|
<topic>git -- denial of service vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>git</name>
|
|
<range><lt>1.6.3.2_1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>SecurityFocus reports:</p>
|
|
<blockquote cite="http://www.securityfocus.com/bid/35338/discuss">
|
|
<p>Git is prone to a denial-of-service vulnerability because it
|
|
fails to properly handle some client requests.</p>
|
|
<p>Attackers can exploit this issue to cause a daemon process to
|
|
enter an infinite loop. Repeated exploits may consume excessive
|
|
system resources, resulting in a denial of service condition.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>35338</bid>
|
|
<cvename>CVE-2009-2108</cvename>
|
|
<url>https://www.redhat.com/archives/fedora-security-list/2009-June/msg00000.html</url>
|
|
<url>http://article.gmane.org/gmane.comp.version-control.git/120724</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-06-04</discovery>
|
|
<entry>2009-06-15</entry>
|
|
<modified>2010-05-02</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="62e0fbe5-5798-11de-bb78-001cc0377035">
|
|
<topic>ruby -- BigDecimal denial of service vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>ruby</name>
|
|
<name>ruby+pthreads</name>
|
|
<name>ruby+pthreads+oniguruma</name>
|
|
<name>ruby+oniguruma</name>
|
|
<range><ge>1.8.*,1</ge><lt>1.8.7.160_1,1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The official ruby site reports:</p>
|
|
<blockquote cite="http://www.ruby-lang.org/en/news/2009/06/09/dos-vulnerability-in-bigdecimal/">
|
|
<p>A denial of service (DoS) vulnerability was found on the
|
|
BigDecimal standard library of Ruby. Conversion from BigDecimal
|
|
objects into Float numbers had a problem which enables attackers
|
|
to effectively cause segmentation faults.</p>
|
|
<p>An attacker can cause a denial of service by causing BigDecimal
|
|
to parse an insanely large number, such as:</p>
|
|
<p><code>BigDecimal("9E69999999").to_s("F")</code></p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>35278</bid>
|
|
<cvename>CVE-2009-1904</cvename>
|
|
<url>http://www.ruby-lang.org/en/news/2009/06/09/dos-vulnerability-in-bigdecimal/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-06-09</discovery>
|
|
<entry>2009-06-13</entry>
|
|
<modified>2010-05-02</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="da185955-5738-11de-b857-000f20797ede">
|
|
<topic>mozilla -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>firefox</name>
|
|
<range><lt>2.0.0.20_8,1</lt></range>
|
|
<range><gt>3.*,1</gt><lt>3.0.11,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-firefox</name>
|
|
<name>linux-firefox-devel</name>
|
|
<range><lt>3.0.11</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>thunderbird</name>
|
|
<name>linux-thunderbird</name>
|
|
<range><lt>2.0.0.22</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>seamonkey</name>
|
|
<name>linux-seamonkey</name>
|
|
<range><lt>1.1.17</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Mozilla Foundation reports:</p>
|
|
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/firefox30.html">
|
|
<p>MFSA 2009-32 JavaScript chrome privilege escalation</p>
|
|
<p>MFSA 2009-31 XUL scripts bypass content-policy checks</p>
|
|
<p>MFSA 2009-30 Incorrect principal set for file: resources
|
|
loaded via location bar</p>
|
|
<p>MFSA 2009-29 Arbitrary code execution using event listeners
|
|
attached to an element whose owner document is null</p>
|
|
<p>MFSA 2009-28 Race condition while accessing the private data
|
|
of a NPObject JS wrapper class object</p>
|
|
<p>MFSA 2009-27 SSL tampering via non-200 responses to proxy
|
|
CONNECT requests</p>
|
|
<p>MFSA 2009-26 Arbitrary domain cookie access by local file:
|
|
resources</p>
|
|
<p>MFSA 2009-25 URL spoofing with invalid unicode characters</p>
|
|
<p>MFSA 2009-24 Crashes with evidence of memory corruption (rv:1.9.0.11)</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2009-1392</cvename>
|
|
<cvename>CVE-2009-1832</cvename>
|
|
<cvename>CVE-2009-1833</cvename>
|
|
<cvename>CVE-2009-1834</cvename>
|
|
<cvename>CVE-2009-1835</cvename>
|
|
<cvename>CVE-2009-1836</cvename>
|
|
<cvename>CVE-2009-1837</cvename>
|
|
<cvename>CVE-2009-1838</cvename>
|
|
<cvename>CVE-2009-1839</cvename>
|
|
<cvename>CVE-2009-1840</cvename>
|
|
<cvename>CVE-2009-1841</cvename>
|
|
<url>http://www.mozilla.org/security/announce/2009/mfsa2009-24.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2009/mfsa2009-25.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2009/mfsa2009-26.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2009/mfsa2009-27.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2009/mfsa2009-28.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2009/mfsa2009-29.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2009/mfsa2009-30.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2009/mfsa2009-31.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2009/mfsa2009-32.html</url>
|
|
<url>http://secunia.com/advisories/35331/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-06-11</discovery>
|
|
<entry>2009-06-12</entry>
|
|
<modified>2009-12-12</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="eb9212f7-526b-11de-bbf2-001b77d09812">
|
|
<topic>apr -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>apr</name>
|
|
<range><lt>1.3.5.1.3.7</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>apache</name>
|
|
<range><ge>2.2.0</ge><lt>2.2.11_5</lt></range>
|
|
<range><ge>2.0.0</ge><lt>2.0.63_3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/35284/">
|
|
<p>Some vulnerabilities have been reported in APR-util, which
|
|
can be exploited by malicious users and malicious people to
|
|
cause a DoS (Denial of Service).</p>
|
|
<p>A vulnerability is caused due to an error in the processing
|
|
of XML files and can be exploited to exhaust all available
|
|
memory via a specially crafted XML file containing a
|
|
predefined entity inside an entity definition.</p>
|
|
<p>A vulnerability is caused due to an error within the
|
|
"apr_strmatch_precompile()" function in
|
|
strmatch/apr_strmatch.c, which can be exploited to crash an
|
|
application using the library.</p>
|
|
</blockquote>
|
|
<p>RedHat reports:</p>
|
|
<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=3D504390">
|
|
<p>A single NULL byte buffer overflow flaw was found in
|
|
apr-util's apr_brigade_vprintf() function.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>35221</bid>
|
|
<cvename>CVE-2009-1955</cvename>
|
|
<cvename>CVE-2009-1956</cvename>
|
|
<cvename>CVE-2009-0023</cvename>
|
|
<url>http://www.apache.org/dist/apr/CHANGES-APR-UTIL-1.3</url>
|
|
<url>http://secunia.com/advisories/35284/</url>
|
|
<url>https://bugzilla.redhat.com/show_bug.cgi?id=3D504390</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-06-05</discovery>
|
|
<entry>2009-06-08</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="4f838b74-50a1-11de-b01f-001c2514716c">
|
|
<topic>dokuwiki -- Local File Inclusion with register_globals on</topic>
|
|
<affects>
|
|
<package>
|
|
<name>dokuwiki</name>
|
|
<range><lt>20090214_2</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>dokuwiki-devel</name>
|
|
<range><gt>0</gt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>DokuWiki reports:</p>
|
|
<blockquote cite="http://bugs.splitbrain.org/index.php?do=details&task_id=1700">
|
|
<p>A security hole was discovered which allows an attacker
|
|
to include arbitrary files located on the attacked DokuWiki
|
|
installation. The included file is executed in the PHP context.
|
|
This can be escalated by introducing malicious code through
|
|
uploading file via the media manager or placing PHP code in
|
|
editable pages.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2009-1960</cvename>
|
|
<url>http://bugs.splitbrain.org/index.php?do=details&task_id=1700</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-05-26</discovery>
|
|
<entry>2009-06-04</entry>
|
|
<modified>2010-05-02</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="82b55df8-4d5a-11de-8811-0030843d3802">
|
|
<topic>openssl -- denial of service in DTLS implementation</topic>
|
|
<affects>
|
|
<package>
|
|
<name>openssl</name>
|
|
<range><ge>0.9.8</ge><lt>0.9.8k_1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/35128/">
|
|
<p>Some vulnerabilities have been reported in OpenSSL, which can be
|
|
exploited by malicious people to cause a DoS.</p>
|
|
<p>The library does not limit the number of buffered DTLS records with
|
|
a future epoch. This can be exploited to exhaust all available memory
|
|
via specially crafted DTLS packets.</p>
|
|
<p>An error when processing DTLS messages can be exploited to exhaust
|
|
all available memory by sending a large number of out of sequence
|
|
handshake messages.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2009-1377</cvename>
|
|
<cvename>CVE-2009-1378</cvename>
|
|
<url>http://secunia.com/advisories/35128/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-05-18</discovery>
|
|
<entry>2009-05-30</entry>
|
|
<modified>2009-12-21</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="399f4cd7-4d59-11de-8811-0030843d3802">
|
|
<topic>eggdrop -- denial of service vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>eggdrop</name>
|
|
<range><lt>1.6.19_2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/35104/">
|
|
<p>The vulnerability is caused due to an error in the processing of
|
|
private messages within the server module
|
|
(/mod/server.mod/servrmsg.c). This can be exploited to cause a
|
|
crash by sending a specially crafted message to the bot.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>34985</bid>
|
|
<cvename>CVE-2009-1789</cvename>
|
|
<url>http://www.eggheads.org/news/2009/05/14/35</url>
|
|
<url>http://secunia.com/advisories/35104/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-05-15</discovery>
|
|
<entry>2009-05-30</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="a2d4a330-4d54-11de-8811-0030843d3802">
|
|
<topic>wireshark -- PCNFSD Dissector Denial of Service Vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>ethereal</name>
|
|
<name>ethereal-lite</name>
|
|
<name>tethereal</name>
|
|
<name>tethereal-lite</name>
|
|
<name>wireshark</name>
|
|
<name>wireshark-lite</name>
|
|
<range><lt>1.0.8</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/35201/">
|
|
<p>A vulnerability has been reported in Wireshark, which can be
|
|
exploited by malicious people to cause a DoS.</p>
|
|
<p>The vulnerability is caused due to an error in the PCNFSD dissector
|
|
and can be exploited to cause a crash via a specially crafted PCNFSD
|
|
packet.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2009-1829</cvename>
|
|
<url>http://secunia.com/advisories/35201/</url>
|
|
<url>http://www.wireshark.org/security/wnpa-sec-2009-03.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-05-21</discovery>
|
|
<entry>2009-05-30</entry>
|
|
<modified>2010-05-02</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="6355efdb-4d4d-11de-8811-0030843d3802">
|
|
<topic>libsndfile -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>libsndfile</name>
|
|
<range><lt>1.0.20</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/35076/">
|
|
<p>Two vulnerabilities have been reported in libsndfile, which can be
|
|
exploited by malicious people to compromise an application using the
|
|
library.</p>
|
|
<p>A boundary error exists within the "voc_read_header()" function in
|
|
src/voc.c. This can be exploited to cause a heap-based buffer overflow
|
|
via a specially crafted VOC file.</p>
|
|
<p>A boundary error exists within the "aiff_read_header()" function in
|
|
src/aiff.c. This can be exploited to cause a heap-based buffer overflow
|
|
via a specially crafted AIFF file.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2009-1788</cvename>
|
|
<cvename>CVE-2009-1791</cvename>
|
|
<url>http://secunia.com/advisories/35076/</url>
|
|
<url>http://www.trapkit.de/advisories/TKADV2009-006.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-05-15</discovery>
|
|
<entry>2009-05-30</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="80f13884-4d4c-11de-8811-0030843d3802">
|
|
<topic>slim -- local disclosure of X authority magic cookie</topic>
|
|
<affects>
|
|
<package>
|
|
<name>slim</name>
|
|
<range><lt>1.3.1_3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/35132/">
|
|
<p>A security issue has been reported in SLiM, which can be
|
|
exploited by malicious, local users to disclose sensitive
|
|
information.</p>
|
|
<p>The security issue is caused due to the application
|
|
generating the X authority file by passing the X authority
|
|
cookie via the command line to "xauth". This can be exploited
|
|
to disclose the X authority cookie by consulting the process
|
|
list and e.g. gain access the user's display.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>35015</bid>
|
|
<cvename>CVE-2009-1756</cvename>
|
|
<url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=529306</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-05-20</discovery>
|
|
<entry>2009-05-30</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="4175c811-f690-4898-87c5-755b3cf1bac6">
|
|
<topic>ntp -- stack-based buffer overflow</topic>
|
|
<affects>
|
|
<package>
|
|
<name>ntp</name>
|
|
<range><lt>4.2.4p7</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>US-CERT reports:</p>
|
|
<blockquote cite="http://www.kb.cert.org/vuls/id/853097">
|
|
<p>ntpd contains a stack buffer overflow which may allow a remote
|
|
unauthenticated attacker to execute arbitrary code on a vulnerable
|
|
system or create a denial of service.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>35017</bid>
|
|
<cvename>CVE-2009-0159</cvename>
|
|
<cvename>CVE-2009-1252</cvename>
|
|
<url>http://www.kb.cert.org/vuls/id/853097</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-05-06</discovery>
|
|
<entry>2009-05-20</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="5ed2f96b-33b7-4863-8c6b-540d22344424">
|
|
<topic>imap-uw -- University of Washington IMAP c-client Remote Format String Vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>imap-uw</name>
|
|
<range><lt>2007e</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>SecurityFocus reports:</p>
|
|
<blockquote cite="http://www.securityfocus.com/bid/33795">
|
|
<p>University of Washington IMAP c-client is prone to a remote
|
|
format-string vulnerability because the software fails to adequately
|
|
sanitize user-supplied input before passing it as the
|
|
format-specifier to a formatted-printing function.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>33795</bid>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-02-17</discovery>
|
|
<entry>2009-05-21</entry>
|
|
<modified>2009-05-22</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="37a8603d-4494-11de-bea7-000c29a67389">
|
|
<topic>nsd -- buffer overflow vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>nsd</name>
|
|
<range><lt>3.2.2</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>nsd2</name>
|
|
<range><lt>2.3.7_1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>NLnet Labs:</p>
|
|
<blockquote cite="http://www.nlnetlabs.nl/publications/NSD_vulnerability_announcement.html">
|
|
<p>A one-byte buffer overflow has been reported in NSD. The
|
|
problem affects all versions 2.0.0 to 3.2.1. The bug allows
|
|
a carefully crafted exploit to bring down your DNS server. It
|
|
is highly unlikely that this one byte overflow can lead to
|
|
other (system) exploits.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2009-1755</cvename>
|
|
<url>http://www.nlnetlabs.nl/publications/NSD_vulnerability_announcement.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-05-19</discovery>
|
|
<entry>2009-05-19</entry>
|
|
<modified>2009-05-22</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="48e14d86-42f1-11de-ad22-000e35248ad7">
|
|
<topic>libxine -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>libxine</name>
|
|
<range><lt>1.1.16.3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>xine developers report:</p>
|
|
<blockquote cite="http://sourceforge.net/project/shownotes.php?group_id=9655&release_id=673233">
|
|
<ul>
|
|
<li>Fix another possible int overflow in the 4XM demuxer.
|
|
(ref. TKADV2009-004, CVE-2009-0385)</li>
|
|
<li>Fix an integer overflow in the Quicktime demuxer.</li>
|
|
</ul>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2009-0385</cvename>
|
|
<cvename>CVE-2009-1274</cvename>
|
|
<url>http://trapkit.de/advisories/TKADV2009-004.txt</url>
|
|
<url>http://trapkit.de/advisories/TKADV2009-005.txt</url>
|
|
<url>http://sourceforge.net/project/shownotes.php?release_id=660071</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-04-04</discovery>
|
|
<entry>2009-05-17</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="51d1d428-42f0-11de-ad22-000e35248ad7">
|
|
<topic>libxine -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>libxine</name>
|
|
<range><lt>1.1.16.2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Multiple vulnerabilities were fixed in libxine 1.1.16.2.</p>
|
|
<p>Tobias Klein reports:</p>
|
|
<blockquote cite="http://trapkit.de/advisories/TKADV2009-004.txt">
|
|
<p>FFmpeg contains a type conversion vulnerability while
|
|
parsing malformed 4X movie files. The vulnerability may be
|
|
exploited by a (remote) attacker to execute arbitrary code in
|
|
the context of FFmpeg or an application using the FFmpeg
|
|
library.</p>
|
|
<p>Note: A similar issue also affects xine-lib < version
|
|
1.1.16.2.</p>
|
|
</blockquote>
|
|
<p>xine developers report:</p>
|
|
<blockquote cite="http://sourceforge.net/project/shownotes.php?group_id=9655&release_id=660071">
|
|
<ul>
|
|
<li>Fix broken size checks in various input plugins (ref.
|
|
CVE-2008-5239).</li>
|
|
<li>More malloc checking (ref. CVE-2008-5240).</li>
|
|
</ul>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2009-0698</cvename>
|
|
<cvename>CVE-2008-5234</cvename>
|
|
<cvename>CVE-2008-5240</cvename>
|
|
<url>http://trapkit.de/advisories/TKADV2009-004.txt</url>
|
|
<url>http://sourceforge.net/project/shownotes.php?release_id=660071</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-02-15</discovery>
|
|
<entry>2009-05-17</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="1e8031be-4258-11de-b67a-0030843d3802">
|
|
<topic>php -- ini database truncation inside dba_replace() function</topic>
|
|
<affects>
|
|
<package>
|
|
<name>php4-dba</name>
|
|
<range><lt>4.4.9_1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>php5-dba</name>
|
|
<range><lt>5.2.7</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>securityfocus research reports:</p>
|
|
<blockquote cite="http://www.securityfocus.com/archive/1/498746/30/0/threaded">
|
|
<p>A bug that leads to the emptying of the INI file contents if
|
|
the database key was not found exists in PHP dba extension in
|
|
versions 5.2.6, 4.4.9 and earlier.</p>
|
|
<p>Function dba_replace() are not filtering strings key and value.
|
|
There is a possibility for the destruction of the file.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-7068</cvename>
|
|
<url>http://www.securityfocus.com/archive/1/498746/30/0/threaded</url>
|
|
<url>http://securityreason.com/achievement_securityalert/58</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-11-28</discovery>
|
|
<entry>2009-05-16</entry>
|
|
<modified>2013-06-16</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="6a245f31-4254-11de-b67a-0030843d3802">
|
|
<topic>libwmf -- embedded GD library Use-After-Free vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>libwmf</name>
|
|
<range><lt>0.2.8.4_3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/34901">
|
|
<p>A vulnerability has been reported in libwmf, which can be exploited
|
|
by malicious people to cause a DoS (Denial of Service) or compromise
|
|
an application using the library.</p>
|
|
<p>The vulnerability is caused due to a use-after-free error within the
|
|
embedded GD library, which can be exploited to cause a crash or
|
|
potentially to execute arbitrary code via a specially crafted WMF
|
|
file.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>34792</bid>
|
|
<cvename>CVE-2009-1364</cvename>
|
|
<url>https://bugzilla.redhat.com/show_bug.cgi?id=496864</url>
|
|
<url>https://rhn.redhat.com/errata/RHSA-2009-0457.html</url>
|
|
<url>http://secunia.com/advisories/34901/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-05-05</discovery>
|
|
<entry>2009-05-16</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="48aab1d0-4252-11de-b67a-0030843d3802">
|
|
<topic>libwmf -- integer overflow vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>libwmf</name>
|
|
<range><lt>0.2.8.4_3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/20921">
|
|
<p>infamous41md has reported a vulnerability in libwmf, which
|
|
potentially can be exploited by malicious people to compromise an
|
|
application using the vulnerable library.</p>
|
|
<p>The vulnerability is caused due to an integer overflow error when
|
|
allocating memory based on a value taken directly from a WMF file
|
|
without performing any checks. This can be exploited to cause a
|
|
heap-based buffer overflow when a specially crafted WMF file is
|
|
processed.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>18751</bid>
|
|
<cvename>CVE-2006-3376</cvename>
|
|
<url>http://secunia.com/advisories/20921/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-07-03</discovery>
|
|
<entry>2009-05-16</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="bfe218a5-4218-11de-b67a-0030843d3802">
|
|
<topic>moinmoin -- cross-site scripting vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>moinmoin</name>
|
|
<range><lt>1.8.3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/34821/">
|
|
<p>Input passed via multiple parameters to action/AttachFile.py is not
|
|
properly sanitised before being returned to the user. This can be
|
|
exploited to execute arbitrary HTML and script code in a user's
|
|
browser session in the context of an affected site.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2009-1482</cvename>
|
|
<url>http://secunia.com/advisories/34821/</url>
|
|
<url>http://moinmo.in/SecurityFixes</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-04-21</discovery>
|
|
<entry>2009-05-16</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="4a638895-41b7-11de-b1cc-00219b0fc4d8">
|
|
<topic>mod_perl -- cross-site scripting</topic>
|
|
<affects>
|
|
<package>
|
|
<name>mod_perl</name>
|
|
<range><lt>1.31</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>mod_perl2</name>
|
|
<range><lt>2.05</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/3459796">
|
|
<p>Certain input passed to the "Apache::Status" and "Apache2::Status"
|
|
modules is not properly sanitised before being returned to the user.
|
|
This can be exploited to execute arbitrary HTML and script code in a
|
|
user's browser session in context of an affected website.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2009-0796</cvename>
|
|
<url>http://secunia.com/advisories/34597</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-02-28</discovery>
|
|
<entry>2009-05-16</entry>
|
|
<modified>2009-05-16</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="a6605f4b-4067-11de-b444-001372fd0af2">
|
|
<topic>drupal -- cross-site scripting</topic>
|
|
<affects>
|
|
<package>
|
|
<name>drupal5</name>
|
|
<range><lt>5.18</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>drupal6</name>
|
|
<range><lt>6.12</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Drupal Security Team reports:</p>
|
|
<blockquote cite="http://drupal.org/node/461886">
|
|
<p>When outputting user-supplied data Drupal strips potentially
|
|
dangerous HTML attributes and tags or escapes characters which
|
|
have a special meaning in HTML. This output filtering secures the
|
|
site against cross site scripting attacks via user input.</p>
|
|
<p>Certain byte sequences that are valid in the UTF-8 specification
|
|
are potentially dangerous when interpreted as UTF-7. Internet
|
|
Explorer 6 and 7 may decode these characters as UTF-7 if they
|
|
appear before the <meta http-equiv="Content-Type" /> tag that
|
|
specifies the page content as UTF-8, despite the fact that Drupal
|
|
also sends a real HTTP header specifying the content as UTF-8.
|
|
This enables attackers to execute cross site scripting attacks
|
|
with UTF-7. SA-CORE-2009-005 - Drupal core - Cross site scripting
|
|
contained an incomplete fix for the issue. HTML exports of books
|
|
are still vulnerable, which means that anyone with edit
|
|
permissions for pages in outlines is able to insert arbitrary HTML
|
|
and script code in these exports.</p>
|
|
<p>Additionally, the taxonomy module allows users with the
|
|
'administer taxonomy' permission to inject arbitrary HTML and
|
|
script code in the help text of any vocabulary.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://drupal.org/node/461886</url>
|
|
<url>http://secunia.com/advisories/35045</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-05-13</discovery>
|
|
<entry>2009-05-14</entry>
|
|
<modified>2009-05-16</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="14ab174c-40ef-11de-9fd5-001bd3385381">
|
|
<topic>cyrus-sasl -- buffer overflow vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>cyrus-sasl</name>
|
|
<range><lt>2.1.23</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>US-CERT reports:</p>
|
|
<blockquote cite="http://www.kb.cert.org/vuls/id/238019">
|
|
<p>The sasl_encode64() function converts a string into
|
|
base64. The Cyrus SASL library contains buffer overflows
|
|
that occur because of unsafe use of the sasl_encode64()
|
|
function.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2009-0688</cvename>
|
|
<url>http://www.kb.cert.org/vuls/id/238019</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-04-08</discovery>
|
|
<entry>2009-05-15</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="fc4d0ae8-3fa3-11de-a3fd-0030843d3802">
|
|
<topic>moinmoin -- multiple cross site scripting vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>moinmoin</name>
|
|
<range><lt>1.8.2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/33593/">
|
|
<p>Some vulnerabilities have been reported in MoinMoin, which can be
|
|
exploited by malicious people to conduct cross-site scripting attacks.</p>
|
|
<p>Input passed to multiple parameters in action/AttachFile.py is not
|
|
properly sanitised before being returned to the user. This can be
|
|
exploited to execute arbitrary HTML and script code in a user's
|
|
browser session in the context of an affected site.</p>
|
|
<p>Certain input passed to security/antispam.py is not properly
|
|
sanitised before being returned to the user. This can be exploited to
|
|
execute arbitrary HTML and script code in a user's browser session in
|
|
the context of an affected site.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2009-0260</cvename>
|
|
<cvename>CVE-2009-0312</cvename>
|
|
<url>http://moinmo.in/SecurityFixes</url>
|
|
<url>http://secunia.com/advisories/33593</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-01-21</discovery>
|
|
<entry>2009-05-13</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="f0f97b94-3f95-11de-a3fd-0030843d3802">
|
|
<topic>ghostscript -- buffer overflow vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>ghostscript8</name>
|
|
<name>ghostscript8-nox11</name>
|
|
<range><lt>8.64</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>SecurityFocus reports:</p>
|
|
<blockquote cite="http://www.securityfocus.com/bid/34340/discuss">
|
|
<p>Ghostscript is prone to a remote buffer-overflow vulnerability
|
|
because it fails to properly bounds-check user-supplied input before
|
|
copying it into a finite-sized buffer.</p>
|
|
<p>Exploiting this issue allows remote attackers to overwrite a
|
|
sensitive memory buffer with arbitrary data, potentially allowing them
|
|
to execute malicious machine code in the context of the affected
|
|
application. This vulnerability may facilitate the compromise of
|
|
affected computers.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>34340</bid>
|
|
<cvename>CVE-2008-6679</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-02-03</discovery>
|
|
<entry>2009-05-13</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="4b172278-3f46-11de-becb-001cc0377035">
|
|
<topic>pango -- integer overflow</topic>
|
|
<affects>
|
|
<package>
|
|
<name>pango</name>
|
|
<name>linux-pango</name>
|
|
<name>linux-f8-pango</name>
|
|
<name>linux-f10-pango</name>
|
|
<range><lt>1.24</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>oCERT reports:</p>
|
|
<blockquote cite="http://www.ocert.org/advisories/ocert-2009-001.html">
|
|
<p>Pango suffers from a multiplicative integer overflow which
|
|
may lead to a potentially exploitable, heap overflow depending
|
|
on the calling conditions.</p>
|
|
<p>For example, this vulnerability is remotely reachable in Firefox
|
|
by creating an overly large document.location value but only results
|
|
in a process-terminating, allocation error (denial of service).</p>
|
|
<p>The affected function is pango_glyph_string_set_size. An overflow
|
|
check when doubling the size neglects the overflow possible on the
|
|
subsequent allocation.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>34870</bid>
|
|
<cvename>CVE-2009-1194</cvename>
|
|
<url>http://secunia.com/advisories/35021/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-02-22</discovery>
|
|
<entry>2009-05-13</entry>
|
|
<modified>2009-10-01</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="defce068-39aa-11de-a493-001b77d09812">
|
|
<topic>wireshark -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>ethereal</name>
|
|
<name>ethereal-lite</name>
|
|
<name>tethereal</name>
|
|
<name>tethereal-lite</name>
|
|
<name>wireshark</name>
|
|
<name>wireshark-lite</name>
|
|
<range><lt>1.0.7</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Wireshark team reports:</p>
|
|
<blockquote cite="http://www.wireshark.org/security/wnpa-sec-2009-02.html">
|
|
<p>Wireshark 1.0.7 fixes the following vulnerabilities:</p>
|
|
<ul>
|
|
<li>The PROFINET dissector was vulnerable to a format
|
|
string overflow. (Bug 3382) Versions affected: 0.99.6 to
|
|
1.0.6, CVE-2009-1210.</li>
|
|
<li>The Check Point High-Availability Protocol (CPHAP)
|
|
dissector could crash. (Bug 3269) Versions affected: 0.9.6
|
|
to 1.0.6; CVE-2009-1268.</li>
|
|
<li>Wireshark could crash while loading a Tektronix .rf5
|
|
file. (Bug 3366) Versions affected: 0.99.6 to 1.0.6,
|
|
CVE-2009-1269.</li>
|
|
</ul>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>34291</bid>
|
|
<bid>34457</bid>
|
|
<cvename>CVE-2009-1210</cvename>
|
|
<cvename>CVE-2009-1268</cvename>
|
|
<cvename>CVE-2009-1269</cvename>
|
|
<url>http://www.wireshark.org/security/wnpa-sec-2009-02.html</url>
|
|
<url>http://secunia.com/advisories/34542</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-04-06</discovery>
|
|
<entry>2009-05-09</entry>
|
|
<modified>2009-05-13</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="736e55bc-39bb-11de-a493-001b77d09812">
|
|
<topic>cups -- remote code execution and DNS rebinding</topic>
|
|
<affects>
|
|
<package>
|
|
<name>cups-base</name>
|
|
<range><lt>1.3.10</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Gentoo security team summarizes:</p>
|
|
<blockquote cite="http://www.gentoo.org/security/en/glsa/glsa-200904-20.xml">
|
|
<p>The following issues were reported in CUPS:</p>
|
|
<ul>
|
|
<li>iDefense reported an integer overflow in the
|
|
_cupsImageReadTIFF() function in the "imagetops" filter,
|
|
leading to a heap-based buffer overflow (CVE-2009-0163).</li>
|
|
<li>Aaron Siegel of Apple Product Security reported that the
|
|
CUPS web interface does not verify the content of the "Host"
|
|
HTTP header properly (CVE-2009-0164).</li>
|
|
<li>Braden Thomas and Drew Yao of Apple Product Security
|
|
reported that CUPS is vulnerable to CVE-2009-0146,
|
|
CVE-2009-0147 and CVE-2009-0166, found earlier in xpdf and
|
|
poppler.</li>
|
|
</ul>
|
|
<p>A remote attacker might send or entice a user to send a
|
|
specially crafted print job to CUPS, possibly resulting in the
|
|
execution of arbitrary code with the privileges of the
|
|
configured CUPS user -- by default this is "lp", or a Denial
|
|
of Service. Furthermore, the web interface could be used to
|
|
conduct DNS rebinding attacks.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>34571</bid>
|
|
<bid>34665</bid>
|
|
<bid>34568</bid>
|
|
<cvename>CVE-2009-0163</cvename>
|
|
<cvename>CVE-2009-0164</cvename>
|
|
<cvename>CVE-2009-0146</cvename>
|
|
<cvename>CVE-2009-0147</cvename>
|
|
<cvename>CVE-2009-0166</cvename>
|
|
<url>http://www.cups.org/articles.php?L582</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-05-05</discovery>
|
|
<entry>2009-05-07</entry>
|
|
<modified>2009-05-13</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="fbc8413f-2f7a-11de-9a3f-001b77d09812">
|
|
<topic>FreeBSD -- remotely exploitable crash in OpenSSL</topic>
|
|
<affects>
|
|
<system>
|
|
<name>FreeBSD</name>
|
|
<range><ge>6.3</ge><lt>6.3_10</lt></range>
|
|
<range><ge>6.4</ge><lt>6.4_4</lt></range>
|
|
<range><ge>7.0</ge><lt>7.0_12</lt></range>
|
|
<range><ge>7.1</ge><lt>7.1_5</lt></range>
|
|
</system>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<h1>Problem Description</h1>
|
|
<p>The function ASN1_STRING_print_ex does not properly validate
|
|
the lengths of BMPString or UniversalString objects before
|
|
attempting to print them.</p>
|
|
<h1>Impact</h1>
|
|
<p>An application which attempts to print a BMPString or
|
|
UniversalString which has an invalid length will crash as a
|
|
result of OpenSSL accessing invalid memory locations. This
|
|
could be used by an attacker to crash a remote application.</p>
|
|
<h1>Workaround</h1>
|
|
<p>No workaround is available, but applications which do not use
|
|
the ASN1_STRING_print_ex function (either directly or indirectly)
|
|
are not affected.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<freebsdsa>SA-09:08.openssl</freebsdsa>
|
|
<cvename>CVE-2009-0590</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-03-25</discovery>
|
|
<entry>2009-05-07</entry>
|
|
<modified>2009-05-13</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="2748fdde-3a3c-11de-bbc5-00e0815b8da8">
|
|
<topic>quagga -- Denial of Service</topic>
|
|
<affects>
|
|
<package>
|
|
<name>quagga</name>
|
|
<range><lt>0.99.11_3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Debian Security Team reports:</p>
|
|
<blockquote cite="http://www.securityfocus.com/archive/1/503220">
|
|
<p>It was discovered that Quagga, an IP routing daemon, could
|
|
no longer process the Internet routing table due to broken
|
|
handling of multiple 4-byte AS numbers in an AS path. If such
|
|
a prefix is received, the BGP daemon crashes with an assert
|
|
failure leading to a denial of service.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>34656</bid>
|
|
<mlist msgid="Pine.LNX.4.64.0904301931590.24373@nacho.alt.net">http://lists.quagga.net/pipermail/quagga-dev/2009-April/006541.html</mlist>
|
|
<cvename>CVE-2009-1572</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-05-04</discovery>
|
|
<entry>2009-05-06</entry>
|
|
<modified>2009-05-07</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="e3e30d99-58a8-4a3f-8059-a8b7cd59b881">
|
|
<topic>openfire -- Openfire No Password Changes Security Bypass</topic>
|
|
<affects>
|
|
<package>
|
|
<name>openfire</name>
|
|
<range><lt>3.6.4</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/34984/">
|
|
<p>A vulnerability has been reported in Openfire which can
|
|
be exploited by malicious users to bypass certain security
|
|
restrictions. The vulnerability is caused due to Openfire
|
|
not properly respecting the no password changes setting which
|
|
can be exploited to change passwords by sending jabber:iq:auth
|
|
passwd_change requests to the server.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2009-1596</cvename>
|
|
<url>http://secunia.com/advisories/34984/</url>
|
|
<url>http://www.igniterealtime.org/issues/browse/JM-1532</url>
|
|
<url>http://www.igniterealtime.org/community/message/190288#190288</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-05-04</discovery>
|
|
<entry>2009-05-04</entry>
|
|
<modified>2010-05-02</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="7a1ab8d4-35c1-11de-9672-0030843d3802">
|
|
<topic>drupal -- cross site scripting</topic>
|
|
<affects>
|
|
<package>
|
|
<name>drupal5</name>
|
|
<range><lt>5.17</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>drupal6</name>
|
|
<range><lt>6.11</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Drupal Security Team reports:</p>
|
|
<blockquote cite="http://drupal.org/node/449078">
|
|
<p>When outputting user-supplied data Drupal strips potentially
|
|
dangerous HTML attributes and tags or escapes characters which have a
|
|
special meaning in HTML. This output filtering secures the site
|
|
against cross site scripting attacks via user input.</p>
|
|
<p>Certain byte sequences that are valid in the UTF-8 specification
|
|
are potentially dangerous when interpreted as UTF-7. Internet Explorer
|
|
6 and 7 may decode these characters as UTF-7 if they appear before the
|
|
meta http-equiv="Content-Type" tag that specifies the page content
|
|
as UTF-8, despite the fact that Drupal also sends a real HTTP header
|
|
specifying the content as UTF-8. This behaviour enables malicious
|
|
users to insert and execute Javascript in the context of the website
|
|
if site visitors are allowed to post content.</p>
|
|
<p>In addition, Drupal core also has a very limited information
|
|
disclosure vulnerability under very specific conditions. If a user is
|
|
tricked into visiting the site via a specially crafted URL and then
|
|
submits a form (such as the search box) from that page, the
|
|
information in their form submission may be directed to a third-party
|
|
site determined by the URL and thus disclosed to the third party. The
|
|
third party site may then execute a CSRF attack against the submitted
|
|
form.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2009-1575</cvename>
|
|
<cvename>CVE-2009-1576</cvename>
|
|
<url>http://drupal.org/node/449078</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-04-30</discovery>
|
|
<entry>2009-04-30</entry>
|
|
<modified>2010-05-02</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="3b18e237-2f15-11de-9672-0030843d3802">
|
|
<topic>mozilla -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>firefox</name>
|
|
<range><lt>2.0.0.20_7,1</lt></range>
|
|
<range><gt>3.*,1</gt><lt>3.0.9,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-firefox</name>
|
|
<name>linux-firefox-devel</name>
|
|
<range><lt>3.0.9</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-seamonkey-devel</name>
|
|
<range><gt>0</gt></range>
|
|
</package>
|
|
<package>
|
|
<name>seamonkey</name>
|
|
<name>linux-seamonkey</name>
|
|
<range><lt>1.1.17</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>thunderbird</name>
|
|
<name>linux-thunderbird</name>
|
|
<range><lt>2.0.0.22</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Mozilla Foundation reports:</p>
|
|
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
|
|
<p>MFSA 2009-22: Firefox allows Refresh header to redirect to
|
|
javascript: URIs</p>
|
|
<p>MFSA 2009-21: POST data sent to wrong site when saving web page
|
|
with embedded frame</p>
|
|
<p>MFSA 2009-20: Malicious search plugins can inject code into
|
|
arbitrary sites</p>
|
|
<p>MFSA 2009-19: Same-origin violations in XMLHttpRequest and
|
|
XPCNativeWrapper.toString</p>
|
|
<p>MFSA 2009-18: XSS hazard using third-party stylesheets and XBL
|
|
bindings</p>
|
|
<p>MFSA 2009-17: Same-origin violations when Adobe Flash loaded via
|
|
view-source: scheme</p>
|
|
<p>MFSA 2009-16: jar: scheme ignores the content-disposition: header
|
|
on the inner URI</p>
|
|
<p>MFSA 2009-15: URL spoofing with box drawing character</p>
|
|
<p>MFSA 2009-14 Crashes with evidence of memory corruption
|
|
(rv:1.9.0.9)</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>34656</bid>
|
|
<cvename>CVE-2009-1303</cvename>
|
|
<cvename>CVE-2009-1306</cvename>
|
|
<cvename>CVE-2009-1307</cvename>
|
|
<cvename>CVE-2009-1308</cvename>
|
|
<cvename>CVE-2009-1309</cvename>
|
|
<cvename>CVE-2009-1312</cvename>
|
|
<cvename>CVE-2009-1311</cvename>
|
|
<cvename>CVE-2009-1302</cvename>
|
|
<cvename>CVE-2009-1304</cvename>
|
|
<cvename>CVE-2009-1305</cvename>
|
|
<cvename>CVE-2009-1310</cvename>
|
|
<url>http://www.mozilla.org/security/announce/2009/mfsa2009-22.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2009/mfsa2009-21.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2009/mfsa2009-20.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2009/mfsa2009-19.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2009/mfsa2009-18.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2009/mfsa2009-17.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2009/mfsa2009-16.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2009/mfsa2009-15.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2009/mfsa2009-14.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-04-21</discovery>
|
|
<entry>2009-04-22</entry>
|
|
<modified>2009-12-12</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="50d233d9-374b-46ce-922d-4e6b3f777bef">
|
|
<topic>poppler -- Poppler Multiple Vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>poppler</name>
|
|
<range><lt>0.10.6</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite=" http://secunia.com/advisories/34746/">
|
|
<p>Some vulnerabilities have been reported in Poppler which can be
|
|
exploited by malicious people to potentially compromise an
|
|
application using the library.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://secunia.com/advisories/34746/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-04-17</discovery>
|
|
<entry>2009-04-18</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="a21037d5-2c38-11de-ab3b-0017a4cccfc6">
|
|
<topic>xpdf -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>xpdf</name>
|
|
<range><lt>3.02_11</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://www.vupen.com/english/advisories/2009/1065">
|
|
<p>Some vulnerabilities have been reported in Xpdf, which can be
|
|
exploited by malicious people to potentially compromise a user's
|
|
system.</p>
|
|
<p>A boundary error exists when decoding JBIG2 symbol dictionary
|
|
segments. This can be exploited to cause a heap-based buffer
|
|
overflow and potentially execute arbitrary code.</p>
|
|
<p>Multiple integer overflows in the JBIG2 decoder can be
|
|
exploited to potentially execute arbitrary code.</p>
|
|
<p>Multiple boundary errors in the JBIG2 decoder can be
|
|
exploited to cause buffer overflows and potentially execute
|
|
arbitrary code.</p>
|
|
<p>Multiple errors in the JBIG2 decoder can be exploited can be
|
|
exploited to free arbitrary memory and potentially execute arbitrary
|
|
code.</p>
|
|
<p>Multiple unspecified input validation errors in the JBIG2 decoder can
|
|
be exploited to potentially execute arbitrary code.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2009-0146</cvename>
|
|
<cvename>CVE-2009-0147</cvename>
|
|
<cvename>CVE-2009-0166</cvename>
|
|
<cvename>CVE-2009-0799</cvename>
|
|
<cvename>CVE-2009-0800</cvename>
|
|
<cvename>CVE-2009-1179</cvename>
|
|
<cvename>CVE-2009-1180</cvename>
|
|
<cvename>CVE-2009-1181</cvename>
|
|
<cvename>CVE-2009-1182</cvename>
|
|
<cvename>CVE-2009-1183</cvename>
|
|
<url>http://secunia.com/advisories/34291</url>
|
|
<url>http://www.vupen.com/english/advisories/2009/1065</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-04-16</discovery>
|
|
<entry>2009-04-18</entry>
|
|
<modified>2009-04-18</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="20b4f284-2bfc-11de-bdeb-0030843d3802">
|
|
<topic>freetype2 -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>freetype2</name>
|
|
<range><lt>2.3.9_1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/34723/">
|
|
<p>Some vulnerabilities have been reported in FreeType, which can be
|
|
exploited by malicious people to potentially compromise an application
|
|
using the library.</p>
|
|
<p>An integer overflow error within the "cff_charset_compute_cids()"
|
|
function in cff/cffload.c can be exploited to potentially cause a
|
|
heap-based buffer overflow via a specially crafted font.</p>
|
|
<p>Multiple integer overflow errors within validation functions in
|
|
sfnt/ttcmap.c can be exploited to bypass length validations and
|
|
potentially cause buffer overflows via specially crafted fonts.</p>
|
|
<p>An integer overflow error within the "ft_smooth_render_generic()"
|
|
function in smooth/ftsmooth.c can be exploited to potentially cause a
|
|
heap-based buffer overflow via a specially crafted font.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2009-0946</cvename>
|
|
<url>http://secunia.com/advisories/34723/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-04-16</discovery>
|
|
<entry>2009-04-18</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="cf91c1e4-2b6d-11de-931b-00e0815b8da8">
|
|
<topic>ejabberd -- cross-site scripting vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>ejabberd</name>
|
|
<range><lt>2.0.4</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>SecurityFocus reports:</p>
|
|
<blockquote cite="http://www.securityfocus.com/bid/34133">
|
|
<p>The ejabberd application is prone to a cross-site scripting
|
|
vulnerability.</p>
|
|
<p>An attacker may leverage this issue to execute arbitrary script code
|
|
in the browser of an unsuspecting user in the context of the affected
|
|
site and to steal cookie-based authentication credentials.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>34133</bid>
|
|
<cvename>CVE-2009-0934</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-03-16</discovery>
|
|
<entry>2009-04-17</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="872ae5be-29c0-11de-bdeb-0030843d3802">
|
|
<topic>ziproxy -- multiple vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>ziproxy</name>
|
|
<range><lt>2.7.0</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Ziproxy Developers reports:</p>
|
|
<blockquote cite="http://www.kb.cert.org/vuls/id/MAPG-7N9GN8">
|
|
<p>Multiple HTTP proxy implementations are prone to an
|
|
information-disclosure vulnerability related to the interpretation of
|
|
the 'Host' HTTP header. Specifically, this issue occurs when the proxy
|
|
makes a forwarding decision based on the 'Host' HTTP header instead of
|
|
the destination IP address.</p>
|
|
<p>Attackers may exploit this issue to obtain sensitive information
|
|
such as internal intranet webpages. Additional attacks may also be
|
|
possible.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>33858</bid>
|
|
<cvename>CVE-2009-0804</cvename>
|
|
<url>http://www.kb.cert.org/vuls/id/MAPG-7N9GN8</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-02-23</discovery>
|
|
<entry>2009-04-15</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="1a0e4cc6-29bf-11de-bdeb-0030843d3802">
|
|
<topic>phpmyadmin -- insufficient output sanitizing when generating configuration file</topic>
|
|
<affects>
|
|
<package>
|
|
<name>phpMyAdmin</name>
|
|
<range><lt>3.1.3.2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>phpMyAdmin Team reports:</p>
|
|
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2009-4.php">
|
|
<p>Setup script used to generate configuration can be fooled using a
|
|
crafted POST request to include arbitrary PHP code in generated
|
|
configuration file. Combined with ability to save files on server,
|
|
this can allow unauthenticated users to execute arbitrary PHP code.
|
|
This issue is on different parameters than PMASA-2009-3 and it was
|
|
missed out of our radar because it was not existing in 2.11.x
|
|
branch.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2009-1285</cvename>
|
|
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2009-4.php</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-04-14</discovery>
|
|
<entry>2009-04-15</entry>
|
|
<modified>2010-05-02</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="03d22656-2690-11de-8226-0030843d3802">
|
|
<topic>drupal6-cck -- cross-site scripting</topic>
|
|
<affects>
|
|
<package>
|
|
<name>drupal6-cck</name>
|
|
<range><lt>2.2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Drupal CCK plugin developer reports:</p>
|
|
<blockquote cite="http://drupal.org/node/406520">
|
|
<p>The Node reference and User reference sub-modules, which
|
|
are part of the Content Construction Kit (CCK) project, lets
|
|
administrators define node fields that are references to other
|
|
nodes or to users. When displaying a node edit form, the
|
|
titles of candidate referenced nodes or names of candidate
|
|
referenced users are not properly filtered, allowing malicious
|
|
users to inject arbitrary code on those pages. Such a cross
|
|
site scripting (XSS) attack may lead to a malicious user
|
|
gaining full administrative access.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>34172</bid>
|
|
<cvename>CVE-2009-1069</cvename>
|
|
<url>http://drupal.org/node/406520</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-03-23</discovery>
|
|
<entry>2009-04-11</entry>
|
|
<modified>2010-05-02</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="0fe73a4a-1b18-11de-8226-0030843d3802">
|
|
<topic>pivot-weblog -- file deletion vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>pivot-weblog</name>
|
|
<range><lt>1.40.7</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/34302">
|
|
<p>A vulnerability has been discovered in Pivot, which can be
|
|
exploited by malicious people to delete certain files.</p>
|
|
<p>Input passed to the "refkey" parameter in
|
|
extensions/bbclone_tools/count.php is not properly sanitised
|
|
before being used to delete files. This can be exploited to
|
|
delete files with the permissions of the web server via directory
|
|
traversal sequences passed within the "refkey" parameter.</p>
|
|
<p>NOTE: Users with the "Advanced" user level are able to include and
|
|
execute uploaded PHP code via the "pivot_path" parameter in
|
|
extensions/bbclone_tools/getkey.php when
|
|
extensions/bbclone_tools/hr_conf.php can be deleted.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>34160</bid>
|
|
<url>http://secunia.com/advisories/34302/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-03-18</discovery>
|
|
<entry>2009-03-27</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="06f9174f-190f-11de-b2f0-001c2514716c">
|
|
<topic>phpmyadmin -- insufficient output sanitizing when generating configuration file</topic>
|
|
<affects>
|
|
<package>
|
|
<name>phpMyAdmin211</name>
|
|
<range><lt>2.11.9.5</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>phpMyAdmin</name>
|
|
<range><lt>3.1.3.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>phpMyAdmin reports:</p>
|
|
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2009-3.php">
|
|
<p>Setup script used to generate configuration can be fooled
|
|
using a crafted POST request to include arbitrary PHP code
|
|
in generated configuration file.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2009-1151</cvename>
|
|
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2009-3.php</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-03-24</discovery>
|
|
<entry>2009-03-25</entry>
|
|
<modified>2010-05-02</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="6bb6188c-17b2-11de-ae4d-0030843d3802">
|
|
<topic>amarok -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>amarok</name>
|
|
<range><lt>1.4.10_3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/33505">
|
|
<p>Tobias Klein has reported some vulnerabilities in Amarok, which
|
|
potentially can be exploited by malicious people to compromise a
|
|
user's system.</p>
|
|
<p>Two integer overflow errors exist within the
|
|
"Audible::Tag::readTag()" function in
|
|
src/metadata/audible/audibletag.cpp. These can be exploited to cause
|
|
heap-based buffer overflows via specially crafted Audible Audio
|
|
files.</p>
|
|
<p>Two errors within the "Audible::Tag::readTag()" function in
|
|
src/metadata/audible/audibletag.cpp can be exploited to corrupt
|
|
arbitrary memory via specially crafted Audible Audio files.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>33210</bid>
|
|
<cvename>CVE-2009-0135</cvename>
|
|
<cvename>CVE-2009-0136</cvename>
|
|
<url>http://www.debian.org/security/2009/dsa-1706</url>
|
|
<url>http://secunia.com/advisories/33505</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-01-12</discovery>
|
|
<entry>2009-03-23</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="f6f19735-9245-4918-8a60-87948ebb4907">
|
|
<topic>wireshark -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>ethereal</name>
|
|
<name>ethereal-lite</name>
|
|
<name>tethereal</name>
|
|
<name>tethereal-lite</name>
|
|
<name>wireshark</name>
|
|
<name>wireshark-lite</name>
|
|
<range><lt>1.0.6</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Vendor reports:</p>
|
|
<blockquote cite="http://www.wireshark.org/security/wnpa-sec-2009-01.html">
|
|
<p>On non-Windows systems Wireshark could crash if the HOME
|
|
environment variable contained sprintf-style string formatting
|
|
characters. Wireshark could crash while reading a malformed
|
|
NetScreen snoop file. Wireshark could crash while reading a
|
|
Tektronix K12 text capture file.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2009-0599</cvename>
|
|
<cvename>CVE-2009-0600</cvename>
|
|
<cvename>CVE-2009-0601</cvename>
|
|
<url>http://www.wireshark.org/security/wnpa-sec-2009-01.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-02-06</discovery>
|
|
<entry>2009-03-22</entry>
|
|
<modified>2010-05-02</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="72cba7b0-13cd-11de-a964-0030843d3802">
|
|
<topic>netatalk -- arbitrary command execution in papd daemon</topic>
|
|
<affects>
|
|
<package>
|
|
<name>netatalk</name>
|
|
<range><lt>2.0.3_5,1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/33227/">
|
|
<p>A vulnerability has been reported in Netatalk, which potentially
|
|
can be exploited by malicious users to compromise a vulnerable system.</p>
|
|
<p>The vulnerability is caused due to the papd daemon improperly
|
|
sanitising several received parameters before passing them in a call
|
|
to popen(). This can be exploited to execute arbitrary commands via
|
|
a specially crafted printing request.</p>
|
|
<p>Successful exploitation requires that a printer is configured to
|
|
pass arbitrary values as parameters to a piped command.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>32925</bid>
|
|
<cvename>CVE-2008-5718</cvename>
|
|
<url>http://secunia.com/advisories/33227/</url>
|
|
<url>http://www.openwall.com/lists/oss-security/2009/01/13/3</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-12-19</discovery>
|
|
<entry>2009-03-18</entry>
|
|
<modified>2009-03-18</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="37a365ed-1269-11de-a964-0030843d3802">
|
|
<topic>gstreamer-plugins-good -- multiple memory overflows</topic>
|
|
<affects>
|
|
<package>
|
|
<name>gstreamer-plugins-good</name>
|
|
<range><ge>0.10.9,3</ge><lt>0.10.12,3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/33650/">
|
|
<p>Tobias Klein has reported some vulnerabilities in GStreamer Good
|
|
Plug-ins, which can potentially be exploited by malicious people to
|
|
compromise a vulnerable system.</p>
|
|
<p>A boundary error occurs within the "qtdemux_parse_samples()"
|
|
function in gst/gtdemux/qtdemux.c when performing QuickTime "ctts"
|
|
Atom parsing. This can be exploited to cause a heap-based buffer
|
|
overflow via a specially crafted QuickTime media file.</p>
|
|
<p>An array indexing error exists in the "qtdemux_parse_samples()"
|
|
function in gst/gtdemux/qtdemux.c when performing QuickTime "stss"
|
|
Atom parsing. This can be exploited to corrupt memory via a specially
|
|
crafted QuickTime media file.</p>
|
|
<p>A boundary error occurs within the "qtdemux_parse_samples()"
|
|
function in gst/gtdemux/qtdemux.c when performing QuickTime "stts"
|
|
Atom parsing. This can be exploited to cause a heap-based buffer
|
|
overflow via a specially crafted QuickTime media file.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2009-0386</cvename>
|
|
<cvename>CVE-2009-0387</cvename>
|
|
<cvename>CVE-2009-0397</cvename>
|
|
<url>http://secunia.com/advisories/33650/</url>
|
|
<url>http://trapkit.de/advisories/TKADV2009-003.txt</url>
|
|
<url>http://gstreamer.freedesktop.org/releases/gst-plugins-good/0.10.12.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-01-22</discovery>
|
|
<entry>2009-03-16</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="c5af0747-1262-11de-a964-0030843d3802">
|
|
<topic>libsndfile -- CAF processing integer overflow vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>libsndfile</name>
|
|
<range><lt>1.0.19</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/33980/">
|
|
<p>The vulnerability is caused due to an integer overflow error in the
|
|
processing of CAF description chunks. This can be exploited to cause a
|
|
heap-based buffer overflow by tricking the user into processing a
|
|
specially crafted CAF audio file.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2009-0186</cvename>
|
|
<url>http://secunia.com/advisories/33980/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-03-03</discovery>
|
|
<entry>2009-03-16</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="6733e1bf-125f-11de-a964-0030843d3802">
|
|
<topic>ffmpeg -- 4xm processing memory corruption vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>ffmpeg</name>
|
|
<range><lt>2008.07.27_9</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/33711/">
|
|
<p>Tobias Klein has reported a vulnerability in FFmpeg, which
|
|
potentially can be exploited by malicious people to compromise an
|
|
application using the library.</p>
|
|
<p>The vulnerability is caused due to a signedness error within the
|
|
"fourxm_read_header()" function in libavformat/4xm.c. This can be
|
|
exploited to corrupt arbitrary memory via a specially crafted 4xm
|
|
file.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>33502</bid>
|
|
<cvename>CVE-2009-0385</cvename>
|
|
<url>http://secunia.com/advisories/33711/</url>
|
|
<url>http://trapkit.de/advisories/TKADV2009-004.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-01-28</discovery>
|
|
<entry>2009-03-16</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="35c0b572-125a-11de-a964-0030843d3802">
|
|
<topic>roundcube -- webmail script insertion and php code injection</topic>
|
|
<affects>
|
|
<package>
|
|
<name>roundcube</name>
|
|
<range><lt>0.2.1,1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/33622/">
|
|
<p>Some vulnerabilities have been reported in RoundCube Webmail, which
|
|
can be exploited by malicious users to compromise a vulnerable system
|
|
and by malicious people to conduct script insertion attacks and
|
|
compromise a vulnerable system.</p>
|
|
<p>The HTML "background" attribute within e.g. HTML emails is not
|
|
properly sanitised before being used. This can be exploited to execute
|
|
arbitrary HTML and script code in a user's browser session in context
|
|
of an affected site if a malicious email is viewed.</p>
|
|
<p>Input passed via a vCard is not properly sanitised before being
|
|
used in a call to "preg_replace()" with the "e" modifier in
|
|
program/include/rcube_vcard.php. This can be exploited to inject and
|
|
execute arbitrary PHP code by e.g. tricking a user into importing a
|
|
malicious vCard file.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2009-0413</cvename>
|
|
<url>http://secunia.com/advisories/33622/</url>
|
|
<url>http://sourceforge.net/forum/forum.php?forum_id=927958</url>
|
|
<url>http://trac.roundcube.net/changeset/2245</url>
|
|
<url>http://trac.roundcube.net/ticket/1485689</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-01-21</discovery>
|
|
<entry>2009-03-16</entry>
|
|
<modified>2009-03-26</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="ca0841ff-1254-11de-a964-0030843d3802">
|
|
<topic>proftpd -- multiple sql injection vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>proftpd</name>
|
|
<name>proftpd-mysql</name>
|
|
<range><lt>1.3.2</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>proftpd-devel</name>
|
|
<range><le>1.3.20080922</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/33842/">
|
|
<p>Some vulnerabilities have been reported in ProFTPD, which can be
|
|
exploited by malicious people to conduct SQL injection attacks.</p>
|
|
<p>The application improperly sets the character encoding prior to
|
|
performing SQL queries. This can be exploited to manipulate SQL
|
|
queries by injecting arbitrary SQL code in an environment using a
|
|
multi-byte character encoding.</p>
|
|
<p>An error exists in the "mod_sql" module when processing e.g. user
|
|
names containing '%' characters. This can be exploited to bypass input
|
|
sanitation routines and manipulate SQL queries by injecting arbitrary
|
|
SQL code.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2009-0542</cvename>
|
|
<cvename>CVE-2009-0543</cvename>
|
|
<url>http://secunia.com/advisories/33842/</url>
|
|
<url>http://bugs.proftpd.org/show_bug.cgi?id=3173</url>
|
|
<url>http://bugs.proftpd.org/show_bug.cgi?id=3124</url>
|
|
<url>http://milw0rm.com/exploits/8037</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-02-06</discovery>
|
|
<entry>2009-03-16</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="03140526-1250-11de-a964-0030843d3802">
|
|
<topic>zabbix -- php frontend multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>zabbix</name>
|
|
<range><lt>1.6.2_1,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>zabbix-agent</name>
|
|
<range><lt>1.6.2_1,2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/34091/">
|
|
<p>Some vulnerabilities have been reported in the ZABBIX PHP frontend,
|
|
which can be exploited by malicious people to conduct cross-site
|
|
request forgery attacks and malicious users to disclose sensitive
|
|
information and compromise a vulnerable system.</p>
|
|
<p>Input appended to and passed via the "extlang" parameter to the
|
|
"calc_exp2()" function in include/validate.inc.php is not properly
|
|
sanitised before being used. This can be exploited to inject and
|
|
execute arbitrary PHP code.</p>
|
|
<p>The application allows users to perform certain actions via HTTP
|
|
requests without performing any validity checks to verify the
|
|
requests. This can be exploited to e.g. create users by enticing a
|
|
logged in administrator to visit a malicious web page.</p>
|
|
<p>Input passed to the "srclang" parameter in locales.php (when "next"
|
|
is set to a non-NULL value) is not properly verified before being used
|
|
to include files. This can be exploited to include arbitrary files
|
|
from local resources via directory traversal attacks and URL-encoded
|
|
NULL bytes.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://secunia.com/advisories/34091/</url>
|
|
<url>http://www.ush.it/team/ush/hack-zabbix_162/adv.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-03-04</discovery>
|
|
<entry>2009-03-16</entry>
|
|
<modified>2009-03-23</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="a2074ac6-124c-11de-a964-0030843d3802">
|
|
<topic>php-mbstring -- php mbstring buffer overflow vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>php4-mbstring</name>
|
|
<range><lt>4.4.9</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>php5-mbstring</name>
|
|
<range><lt>5.2.9</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>SecurityFocus reports:</p>
|
|
<blockquote cite="http://www.securityfocus.com/bid/32948">
|
|
<p>PHP is prone to a buffer-overflow vulnerability because it fails to
|
|
perform boundary checks before copying user-supplied data to
|
|
insufficiently sized memory buffers. The issue affects the 'mbstring'
|
|
extension included in the standard distribution.</p>
|
|
<p>An attacker can exploit this issue to execute arbitrary machine
|
|
code in the context of the affected webserver. Failed exploit attempts
|
|
will likely crash the webserver, denying service to legitimate
|
|
users.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>32948</bid>
|
|
<cvename>CVE-2008-5557</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-12-21</discovery>
|
|
<entry>2009-03-16</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="4ce3c20b-124b-11de-a964-0030843d3802">
|
|
<topic>phppgadmin -- directory traversal with register_globals enabled</topic>
|
|
<affects>
|
|
<package>
|
|
<name>phppgadmin</name>
|
|
<range><lt>4.2.2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/33014">
|
|
<p>Dun has discovered a vulnerability in phpPgAdmin, which can be
|
|
exploited by malicious people to disclose sensitive information.</p>
|
|
<p>Input passed via the "_language" parameter to libraries/lib.inc.php
|
|
is not properly sanitised before being used to include files. This can
|
|
be exploited to include arbitrary files from local resources via
|
|
directory traversal attacks and URL-encoded NULL bytes.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>32670</bid>
|
|
<cvename>CVE-2008-5587</cvename>
|
|
<url>http://secunia.com/advisories/33014</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-12-08</discovery>
|
|
<entry>2009-03-16</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="8c5205b4-11a0-11de-a964-0030843d3802">
|
|
<topic>opera -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>opera</name>
|
|
<name>linux-opera</name>
|
|
<range><lt>9.64</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Opera Team reports:</p>
|
|
<blockquote cite="http://www.opera.com/docs/changelogs/freebsd/964/">
|
|
<p>An unspecified error in the processing of JPEG images can be
|
|
exploited to trigger a memory corruption.</p>
|
|
<p>An error can be exploited to execute arbitrary script code in a
|
|
different domain via unspecified plugins.</p>
|
|
<p>An unspecified error has a "moderately severe" impact. No further
|
|
information is available.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2009-0914</cvename>
|
|
<cvename>CVE-2009-0915</cvename>
|
|
<url>http://www.opera.com/docs/changelogs/freebsd/964/</url>
|
|
<url>http://secunia.com/advisories/34135/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-03-15</discovery>
|
|
<entry>2009-03-15</entry>
|
|
<modified>2010-05-02</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="e848a92f-0e7d-11de-92de-000bcdc1757a">
|
|
<topic>epiphany -- untrusted search path vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>epiphany</name>
|
|
<range><lt>2.24.2.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>CVE Mitre reports:</p>
|
|
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5985">
|
|
<p>Untrusted search path vulnerability in the Python interface in
|
|
Epiphany 2.22.3, and possibly other versions, allows local users to
|
|
execute arbitrary code via a Trojan horse Python file in the current
|
|
working directory, related to a vulnerability in the PySys_SetArgv
|
|
function (CVE-2008-5983).</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-5985</cvename>
|
|
<cvename>CVE-2008-5983</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-01-26</discovery>
|
|
<entry>2009-03-11</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="f1892066-0e74-11de-92de-000bcdc1757a">
|
|
<topic>apache -- Cross-site scripting vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>apache</name>
|
|
<range><gt>2.2.0</gt><lt>2.2.9_2</lt></range>
|
|
<range><gt>2.0.0</gt><lt>2.0.63_2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>CVE Mitre reports:</p>
|
|
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2939">
|
|
<p>Cross-site scripting (XSS) vulnerability in proxy_ftp.c in the
|
|
mod_proxy_ftp module in Apache 2.0.63 and earlier, and mod_proxy_ftp.c
|
|
in the mod_proxy_ftp module in Apache 2.2.9 and earlier 2.2 versions,
|
|
allows remote attackers to inject arbitrary web script or HTML via a
|
|
wildcard in the last directory component in the pathname in an FTP
|
|
URI.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-2939</cvename>
|
|
<url>http://www.rapid7.com/advisories/R7-0033.jsp</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-07-25</discovery>
|
|
<entry>2009-03-11</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="ea2411a4-08e8-11de-b88a-0022157515b2">
|
|
<topic>pngcrush -- libpng Uninitialised Pointer Arrays Vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>pngcrush</name>
|
|
<range><lt>1.6.14</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/33976/">
|
|
<p>A vulnerability has been reported in Pngcrush, which
|
|
can be exploited by malicious people to potentially
|
|
compromise a user's system.</p>
|
|
<p>The vulnerability is caused due to the use of vulnerable
|
|
libpng code.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>33827</bid>
|
|
<cvename>CVE-2009-0040</cvename>
|
|
<url>http://secunia.com/advisories/33976</url>
|
|
<url>http://xforce.iss.net/xforce/xfdb/48819</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-02-19</discovery>
|
|
<entry>2009-03-04</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="5d433534-f41c-402e-ade5-e0a2259a7cb6">
|
|
<topic>curl -- cURL/libcURL Location: Redirect URLs Security Bypass</topic>
|
|
<affects>
|
|
<package>
|
|
<name>curl</name>
|
|
<range><ge>5.11</ge><lt>7.19.4</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/34138/">
|
|
<p>The security issue is caused due to cURL following HTTP Location:
|
|
redirects to e.g. scp:// or file:// URLs which can be exploited
|
|
by a malicious HTTP server to overwrite or disclose the content of
|
|
arbitrary local files and potentially execute arbitrary commands via
|
|
specially crafted redirect URLs.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2009-0037</cvename>
|
|
<url>http://secunia.com/advisories/34138/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-03-03</discovery>
|
|
<entry>2009-03-04</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="cf495fd4-fdcd-11dd-9a86-0050568452ac">
|
|
<topic>Zend Framework -- Local File Inclusion vulnerability in Zend_View::render()</topic>
|
|
<affects>
|
|
<package>
|
|
<name>ZendFramework</name>
|
|
<range><lt>1.7.5</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Matthew Weier O'Phinney reports:</p>
|
|
<blockquote cite="http://weierophinney.net/matthew/archives/206-Zend-Framework-1.7.5-Released-Important-Note-Regarding-Zend_View.html">
|
|
<p>A potential Local File Inclusion (LFI) vulnerability exists in
|
|
the Zend_View::render() method. If user input is used to
|
|
specify the script path, then it is possible to trigger the
|
|
LFI.</p>
|
|
<p>Note that Zend Framework applications that never call the
|
|
Zend_View::render() method with a user-supplied parameter are
|
|
not affected by this vulnerability.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://framework.zend.com/issues/browse/ZF-5748</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-02-11</discovery>
|
|
<entry>2009-02-18</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="25eb365c-fd11-11dd-8424-c213de35965d">
|
|
<topic>dia -- remote command execution vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>dia</name>
|
|
<range><lt>0.96.1_6,1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Security Focus reports:</p>
|
|
<blockquote cite="http://www.securityfocus.com/bid/33448/">
|
|
<p>An attacker could exploit this issue by enticing an
|
|
unsuspecting victim to execute the vulnerable
|
|
application in a directory containing a malicious
|
|
Python file. A successful exploit will allow arbitrary
|
|
Python commands to run within the privileges of the currently
|
|
logged-in user.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>33448</bid>
|
|
<cvename>CVE-2008-5984</cvename>
|
|
<url>http://secunia.com/advisories/33672</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-01-26</discovery>
|
|
<entry>2009-02-17</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="5a021595-fba9-11dd-86f3-0030843d3802">
|
|
<topic>pycrypto -- ARC2 module buffer overflow</topic>
|
|
<affects>
|
|
<package>
|
|
<name>py-pycrypto</name>
|
|
<range><lt>2.0.1_2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Dwayne C. Litzenberger reports:</p>
|
|
<blockquote cite="http://lists.dlitz.net/pipermail/pycrypto/2009q1/000062.html">
|
|
<p>pycrypto is exposed to a buffer overflow issue because it fails to
|
|
adequately verify user-supplied input. This issue resides in the ARC2
|
|
module. This issue can be triggered with specially crafted ARC2 keys
|
|
in excess of 128 bytes.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://lists.dlitz.net/pipermail/pycrypto/2009q1/000062.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-02-06</discovery>
|
|
<entry>2009-02-15</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="bcee3989-d106-4f60-948f-835375634710">
|
|
<topic>varnish -- Varnish HTTP Request Parsing Denial of Service</topic>
|
|
<affects>
|
|
<package>
|
|
<name>varnish</name>
|
|
<range><lt>2.0.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>SecurityFocus reports:</p>
|
|
<blockquote cite="http://www.securityfocus.com/bid/33712">
|
|
<p>Varnish is prone to a remote denial-of-service
|
|
vulnerability because the application fails to handle
|
|
certain HTTP requests.</p>
|
|
<p>Successfully exploiting this issue allows remote
|
|
attackers to crash the affected application denying further
|
|
service to legitimate users.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>33712</bid>
|
|
<url>http://secunia.com/advisories/33852/</url>
|
|
<url>http://varnish.projects.linpro.no/wiki/WikiStart</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-10-17</discovery>
|
|
<entry>2009-02-14</entry>
|
|
<modified>2009-02-15</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="78f5606b-f9d1-11dd-b79c-0030843d3802">
|
|
<topic>tor -- multiple vulnerabilites</topic>
|
|
<affects>
|
|
<package>
|
|
<name>tor</name>
|
|
<range><lt>0.2.0.34</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>tor-devel</name>
|
|
<range><lt>0.2.12-alpha</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/33880/">
|
|
<p>Some vulnerabilities have been reported in Tor, where one has an
|
|
unknown impact and others can be exploited by malicious people to
|
|
cause a DoS.</p>
|
|
<p>An error when running Tor as a directory authority can be exploited
|
|
to trigger the execution of an infinite loop.</p>
|
|
<p>An unspecified error exists when running on Windows systems prior
|
|
to Windows XP. No further information is currently available.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2009-0936</cvename>
|
|
<cvename>CVE-2009-0937</cvename>
|
|
<cvename>CVE-2009-0938</cvename>
|
|
<url>http://secunia.com/advisories/33880/</url>
|
|
<url>http://archives.seul.org/or/announce/Feb-2009/msg00000.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-02-10</discovery>
|
|
<entry>2009-02-13</entry>
|
|
<modified>2009-03-20</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="8b491182-f842-11dd-94d9-0030843d3802">
|
|
<topic>firefox -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>firefox</name>
|
|
<range><lt>2.0.0.20_3,1</lt></range>
|
|
<range><gt>3.*,1</gt><lt>3.0.6,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-firefox</name>
|
|
<name>linux-firefox-devel</name>
|
|
<range><lt>3.0.6</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-seamonkey-devel</name>
|
|
<range><gt>0</gt></range>
|
|
</package>
|
|
<package>
|
|
<name>seamonkey</name>
|
|
<name>linux-seamonkey</name>
|
|
<range><lt>1.1.15</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>thunderbird</name>
|
|
<name>linux-thunderbird</name>
|
|
<range><lt>2.0.0.21</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Mozilla Foundation reports:</p>
|
|
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/firefox30.html">
|
|
<p>MFSA 2009-06: Directives to not cache pages ignored</p>
|
|
<p>MFSA 2009-05: XMLHttpRequest allows reading HTTPOnly cookies</p>
|
|
<p>MFSA 2009-04: Chrome privilege escalation via local .desktop
|
|
files</p>
|
|
<p>MFSA 2009-03: Local file stealing with SessionStore</p>
|
|
<p>MFSA 2009-02: XSS using a chrome XBL method and window.eval</p>
|
|
<p>MFSA 2009-01: Crashes with evidence of memory corruption (rv:1.9.0.6)</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2009-0352</cvename>
|
|
<cvename>CVE-2009-0353</cvename>
|
|
<cvename>CVE-2009-0354</cvename>
|
|
<cvename>CVE-2009-0355</cvename>
|
|
<cvename>CVE-2009-0356</cvename>
|
|
<cvename>CVE-2009-0357</cvename>
|
|
<cvename>CVE-2009-0358</cvename>
|
|
<url>http://www.mozilla.org/security/announce/2009/mfsa2009-01.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2009/mfsa2009-02.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2009/mfsa2009-03.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2009/mfsa2009-04.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2009/mfsa2009-05.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2009/mfsa2009-06.html</url>
|
|
<url>http://secunia.com/advisories/33799/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-02-04</discovery>
|
|
<entry>2009-02-11</entry>
|
|
<modified>2009-12-12</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="83574d5a-f828-11dd-9fdf-0050568452ac">
|
|
<topic>codeigniter -- arbitrary script execution in the new Form Validation class</topic>
|
|
<affects>
|
|
<package>
|
|
<name>codeigniter</name>
|
|
<range><ge>1.7.0</ge><lt>1.7.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>znirkel reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/33829/">
|
|
<p>The eval() function in _reset_post_array crashes when posting
|
|
certain data. By passing in carefully-crafted input data, the eval()
|
|
function could also execute malicious PHP code.</p>
|
|
<p>Note that CodeIgniter applications that either do not use the
|
|
new Form Validation class or use the old Validation class are not
|
|
affected by this vulnerability.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://codeigniter.com/bug_tracker/bug/6068/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-11-28</discovery>
|
|
<entry>2009-02-11</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="b07f3254-f83a-11dd-85a4-ea653f0746ab">
|
|
<topic>pyblosxom -- atom flavor multiple XML injection vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>pyblosxom</name>
|
|
<range><lt>1.5.r3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Security Focus reports:</p>
|
|
<blockquote cite="http://www.securityfocus.com/bid/33676/">
|
|
<p>PyBlosxom is prone to multiple XML-injection
|
|
vulnerabilities because the application fails to
|
|
properly sanitize user-supplied input before using it
|
|
in dynamically generated content.</p>
|
|
<p>Attacker-supplied XML and script code would run in the
|
|
context of the affected browser, potentially allowing
|
|
the attacker to steal cookie-based authentication credentials
|
|
or to control how the site is rendered to the user. Other attacks
|
|
are also possible.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>33676</bid>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-02-09</discovery>
|
|
<entry>2009-02-11</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="cc47fafe-f823-11dd-94d9-0030843d3802">
|
|
<topic>typo3 -- cross-site scripting and information disclosure</topic>
|
|
<affects>
|
|
<package>
|
|
<name>typo3</name>
|
|
<range><lt>4.2.6</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/33829/">
|
|
<p>Some vulnerabilities have been reported in Typo3, which can be
|
|
exploited by malicious people to conduct cross-site scripting attacks
|
|
and disclose sensitive information.</p>
|
|
<p>Input passed via unspecified fields to the backend user interface
|
|
is not properly sanitised before being returned to the user. This can
|
|
be exploited to execute arbitrary HTML and script code in a user's
|
|
browser session in context of an affected site.</p>
|
|
<p>An error in the "jumpUrl" mechanism can be exploited to read
|
|
arbitrary files from local resources by disclosing a hash secret used
|
|
to restrict file access.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2009-0815</cvename>
|
|
<cvename>CVE-2009-0816</cvename>
|
|
<url>http://secunia.com/advisories/33829/</url>
|
|
<url>http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-002/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-02-10</discovery>
|
|
<entry>2009-02-11</entry>
|
|
<modified>2010-05-02</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="a89b76a7-f6bd-11dd-94d9-0030843d3802">
|
|
<topic>amaya -- multiple buffer overflow vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>amaya</name>
|
|
<range><gt>0</gt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/32848/">
|
|
<p>A boundary error when processing "div" HTML tags can be exploited
|
|
to cause a stack-based buffer overflow via an overly long "id"
|
|
parameter.</p>
|
|
<p>A boundary error exists when processing overly long links. This can
|
|
be exploited to cause a stack-based buffer overflow by tricking the
|
|
user into e.g. editing a malicious link.</p>
|
|
<p>A boundary error when processing e.g. a "bdo" HTML tag having an
|
|
overly long "dir" attribute can be exploited to cause a stack-based
|
|
buffer overflow.</p>
|
|
<p>A boundary error when processing "input" HTML tags can be
|
|
exploited to cause a stack-based buffer overflow via an overly long
|
|
e.g. "type" attribute.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-5282</cvename>
|
|
<cvename>CVE-2009-0323</cvename>
|
|
<url>http://secunia.com/advisories/32848/</url>
|
|
<url>http://www.bmgsec.com.au/advisory/41/</url>
|
|
<url>http://www.bmgsec.com.au/advisory/40/</url>
|
|
<url>http://milw0rm.com/exploits/7467</url>
|
|
<url>http://www.coresecurity.com/content/amaya-buffer-overflows</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-11-25</discovery>
|
|
<entry>2009-02-09</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="71597e3e-f6b8-11dd-94d9-0030843d3802">
|
|
<topic>websvn -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>websvn</name>
|
|
<range><lt>2.1.0</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/32338/">
|
|
<p>Some vulnerabilities have been reported in WebSVN, which can be
|
|
exploited by malicious users to disclose sensitive information, and by
|
|
malicious people to conduct cross-site scripting attacks and
|
|
manipulate data.</p>
|
|
<p>Input passed in the URL to index.php is not properly sanitised
|
|
before being returned to the user. This can be exploited to execute
|
|
arbitrary HTML and script code in a user's browser session in context
|
|
of an affected site.</p>
|
|
<p>Input passed to the "rev" parameter in rss.php is not properly
|
|
sanitised before being used. This can be exploited to overwrite
|
|
arbitrary files via directory traversal attacks.</p>
|
|
<p>Access to restricted repositories is not properly enforced, which
|
|
can be exploited to disclose potentially sensitive information by
|
|
accessing the repository via "listing.php" and using the "compare with
|
|
previous" and "show changed files" links.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-5918</cvename>
|
|
<cvename>CVE-2008-5919</cvename>
|
|
<cvename>CVE-2009-0240</cvename>
|
|
<url>http://secunia.com/advisories/32338/</url>
|
|
<url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=512191</url>
|
|
<url>http://www.gulftech.org/?node=research&article_id=00132-10202008</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-10-23</discovery>
|
|
<entry>2009-02-09</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="40774927-f6b4-11dd-94d9-0030843d3802">
|
|
<topic>phplist -- local file inclusion vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>phplist</name>
|
|
<range><lt>2.10.9</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/33533/">
|
|
<p>Input passed to the "_SERVER[ConfigFile]" parameter in
|
|
admin/index.php is not properly verified before being used to include
|
|
files. This can be exploited to include arbitrary files from local
|
|
resources.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2009-0422</cvename>
|
|
<url>http://secunia.com/advisories/33533/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-01-15</discovery>
|
|
<entry>2009-02-09</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="9c2460a4-f6b1-11dd-94d9-0030843d3802">
|
|
<topic>squid -- remote denial of service vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>squid</name>
|
|
<range><ge>2.7.1</ge><lt>2.7.6</lt></range>
|
|
<range><ge>3.0.1</ge><lt>3.0.13</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Squid security advisory 2009:1 reports:</p>
|
|
<blockquote cite="http://www.squid-cache.org/Advisories/SQUID-2009_1.txt">
|
|
<p>Due to an internal error Squid is vulnerable to a denial
|
|
of service attack when processing specially crafted requests.</p>
|
|
<p>This problem allows any client to perform a denial of service
|
|
attack on the Squid service.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2009-0478</cvename>
|
|
<url>http://www.squid-cache.org/Advisories/SQUID-2009_1.txt</url>
|
|
<url>http://secunia.com/advisories/33731/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-02-04</discovery>
|
|
<entry>2009-02-09</entry>
|
|
<modified>2009-02-10</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="653606e9-f6ac-11dd-94d9-0030843d3802">
|
|
<topic>typo3 -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>typo3</name>
|
|
<range><lt>4.2.4</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/33617/">
|
|
<p>Some vulnerabilities have been reported in Typo3, which can be
|
|
exploited by malicious people to bypass certain security restrictions,
|
|
conduct cross-site scripting and session fixation attacks, and
|
|
compromise a vulnerable system.</p>
|
|
<p>The "Install tool" system extension uses insufficiently random
|
|
entropy sources to generate an encryption key, resulting in weak
|
|
security.</p>
|
|
<p>The authentication library does not properly invalidate supplied
|
|
session tokens, which can be exploited to hijack a user's
|
|
session.</p>
|
|
<p>Certain unspecified input passed to the "Indexed Search Engine"
|
|
system extension is not properly sanitised before being used to invoke
|
|
commands. This can be exploited to inject and execute arbitrary shell
|
|
commands.</p>
|
|
<p>Input passed via the name and content of files to the "Indexed Search
|
|
Engine" system extension is not properly sanitised before being returned
|
|
to the user. This can be exploited to execute arbitrary HTML and script
|
|
code in a user's browser session in context of an affected site.</p>
|
|
<p>Certain unspecified input passed to the Workspace module is not
|
|
properly sanitised before being returned to the user. This can be
|
|
exploited to execute arbitrary HTML and script code in a user's
|
|
browser session in context of an affected site.</p>
|
|
<p>Note: It is also reported that certain unspecified input passed to
|
|
test scripts of the "ADOdb" system extension is not properly sanitised
|
|
before being returned to the user. This can be exploited to execute
|
|
arbitrary HTML and script code in a user's browser session in context
|
|
of an affected website.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2009-0255</cvename>
|
|
<cvename>CVE-2009-0256</cvename>
|
|
<cvename>CVE-2009-0257</cvename>
|
|
<cvename>CVE-2009-0258</cvename>
|
|
<url>http://secunia.com/advisories/33617/</url>
|
|
<url>http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-001/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-02-07</discovery>
|
|
<entry>2009-02-09</entry>
|
|
<modified>2013-06-19</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="13d6d997-f455-11dd-8516-001b77d09812">
|
|
<topic>sudo -- certain authorized users could run commands as any user</topic>
|
|
<affects>
|
|
<package>
|
|
<name>sudo</name>
|
|
<range><ge>1.6.9</ge><lt>1.6.9.20</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Todd Miller reports:</p>
|
|
<blockquote cite="http://www.gratisoft.us/pipermail/sudo-announce/2009-February/000085.html">
|
|
<p>A bug was introduced in Sudo's group matching code in version
|
|
1.6.9 when support for matching based on the supplemental group
|
|
vector was added. This bug may allow certain users listed in
|
|
the sudoers file to run a command as a different user than their
|
|
access rule specifies.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>33517</bid>
|
|
<cvename>CVE-2009-0034</cvename>
|
|
<mlist msgid="200902041802.n14I2llS024155@core.courtesan.com">http://www.gratisoft.us/pipermail/sudo-announce/2009-February/000085.html</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-02-04</discovery>
|
|
<entry>2009-02-06</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="6d85dc62-f2bd-11dd-9f55-0030843d3802">
|
|
<topic>drupal -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>drupal5</name>
|
|
<range><lt>5.15</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>drupal6</name>
|
|
<range><lt>6.9</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Drupal Team reports:</p>
|
|
<blockquote cite="http://drupal.org/node/358957">
|
|
<p>The Content Translation module for Drupal 6.x enables users to make
|
|
a translation of an existing item of content (a node). In that proces
|
|
the existing node's content is copied into the new node's submission
|
|
form.</p>
|
|
<p>The module contains a flaw that allows a user with the 'translate
|
|
content' permission to potentially bypass normal viewing access
|
|
restrictions, for example allowing the user to see the content of
|
|
unpublished nodes even if they do not have permission to view
|
|
unpublished nodes.</p>
|
|
<p>When user profile pictures are enabled, the default user profile
|
|
validation function will be bypassed, possibly allowing invalid user
|
|
names or e-mail addresses to be submitted.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://drupal.org/node/358957</url>
|
|
<url>http://secunia.com/advisories/33550/</url>
|
|
<url>http://secunia.com/advisories/33500/</url>
|
|
<url>http://secunia.com/advisories/33542/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-01-14</discovery>
|
|
<entry>2009-02-04</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="4a99d61c-f23a-11dd-9f55-0030843d3802">
|
|
<topic>perl -- Directory Permissions Race Condition</topic>
|
|
<affects>
|
|
<package>
|
|
<name>perl</name>
|
|
<range><ge>5.8.0</ge><lt>5.8.9</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/14531/">
|
|
<p>Paul Szabo has reported a vulnerability in Perl File::Path::rmtree,
|
|
which potentially can be exploited by malicious, local users to
|
|
gain escalated privileges.</p>
|
|
<p>The vulnerability is caused due to a race condition in the way
|
|
File::Path::rmtree handles directory permissions when cleaning up
|
|
directories. This can be exploited by replacing an existing sub
|
|
directory in the directory tree with a symbolic link to an arbitrary
|
|
file.</p>
|
|
<p>Successful exploitation may allow changing permissions of arbitrary
|
|
files, if root uses an application using the vulnerable code to delete
|
|
files in a directory having a world-writable sub directory.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-0448</cvename>
|
|
<url>http://www.ubuntulinux.org/usn/usn-94-1</url>
|
|
<url>http://secunia.com/advisories/14531/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-03-09</discovery>
|
|
<entry>2009-02-03</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="6a523dba-eeab-11dd-ab4f-0030843d3802">
|
|
<topic>moinmoin -- multiple cross site scripting vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>moinmoin</name>
|
|
<range><lt>1.8.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/33593/">
|
|
<p>Input passed to multiple parameters in action/AttachFile.py is not
|
|
properly sanitised before being returned to the user. This can be
|
|
exploited to execute arbitrary HTML and script code in a user's
|
|
browser session in the context of an affected site.</p>
|
|
<p>Certain input passed to security/antispam.py is not properly
|
|
sanitised before being returned to the user. This can be exploited to
|
|
execute arbitrary HTML and script code in a user's browser session in
|
|
the context of an affected site.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2009-0260</cvename>
|
|
<cvename>CVE-2009-0312</cvename>
|
|
<url>http://secunia.com/advisories/33593/</url>
|
|
<url>http://hg.moinmo.in/moin/1.8/file/c76d50dac855</url>
|
|
<url>http://hg.moinmo.in/moin/1.8/rev/89b91bf87dad</url>
|
|
<url>http://moinmo.in/SecurityFixes#moin1.8.1</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-01-21</discovery>
|
|
<entry>2009-01-30</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="b9077cc4-6d04-4bcb-a37a-9ceaebfdcc9e">
|
|
<topic>ganglia -- buffer overflow vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>ganglia-monitor-core</name>
|
|
<name>ganglia-monitor-webfrontend</name>
|
|
<range><lt>3.1.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/33506">
|
|
<p>Spike Spiegel has discovered a vulnerability in Ganglia which
|
|
can be exploited by malicious people to compromise a
|
|
vulnerable system. The vulnerability is caused due to a
|
|
boundary error within the process_path function in
|
|
gmetad/server.c. This can be exploited to cause a stack-based
|
|
buffer overflow by e.g. sending a specially crafted message to
|
|
the gmetad service.</p>
|
|
<p>The vulnerability is confirmed in version 3.1.1. Other
|
|
versions may also be affected.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2009-0241</cvename>
|
|
<url>http://secunia.com/advisories/33506</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-01-26</discovery>
|
|
<entry>2009-01-30</entry>
|
|
<modified>2009-01-30</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="100a9ed2-ee56-11dd-ab4f-0030843d3802">
|
|
<topic>tor -- unspecified memory corruption vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>tor</name>
|
|
<range><lt>0.2.0.33</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>tor-devel</name>
|
|
<range><lt>0.2.1.11-alpha</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/33635/">
|
|
<p>A vulnerability with an unknown impact has been reported in Tor.</p>
|
|
<p>The vulnerability is caused due to an unspecified error and can be
|
|
exploited to trigger a heap corruption. No further information is
|
|
currently available.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2009-0414</cvename>
|
|
<url>http://secunia.com/advisories/33635/</url>
|
|
<url>http://archives.seul.org/or/announce/Jan-2009/msg00000.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-01-22</discovery>
|
|
<entry>2009-01-29</entry>
|
|
<modified>2010-05-02</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="2ffb1b0d-ecf5-11dd-abae-00219b0fc4d8">
|
|
<topic>glpi -- SQL Injection</topic>
|
|
<affects>
|
|
<package>
|
|
<name>glpi</name>
|
|
<range><lt>0.71.4</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The GLPI project reports:</p>
|
|
<blockquote cite="http://www.glpi-project.org/spip.php?page=annonce&id_breve=161&lang=en">
|
|
<p>Input passed via unspecified parameters is not properly sanitised
|
|
before being used in SQL queries. This can be exploited to
|
|
manipulateSQL queries by injecting arbitrary SQL code.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://www.glpi-project.org/spip.php?page=annonce&id_breve=161&lang=en</url>
|
|
<url>https://mail.gna.org/public/glpi-news/2009-01/msg00002.html</url>
|
|
<url>https://dev.indepnet.net/glpi/ticket/1224</url>
|
|
<url>http://secunia.com/advisories/33680/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-01-25</discovery>
|
|
<entry>2009-01-28</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="c3aba586-ea77-11dd-9d1e-000bcdc1757a">
|
|
<topic>openfire -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>openfire</name>
|
|
<range><lt>3.6.3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Core Security Technologies reports:</p>
|
|
<blockquote cite="http://www.coresecurity.com/content/openfire-multiple-vulnerabilities">
|
|
<p>Multiple cross-site scripting vulnerabilities have been found
|
|
which may lead to arbitrary remote code execution on the server
|
|
running the application due to unauthorized upload of Java plugin
|
|
code.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>32935</bid>
|
|
<bid>32937</bid>
|
|
<bid>32938</bid>
|
|
<bid>32939</bid>
|
|
<bid>32940</bid>
|
|
<bid>32943</bid>
|
|
<bid>32944</bid>
|
|
<bid>32945</bid>
|
|
<cvename>CVE-2009-0496</cvename>
|
|
<cvename>CVE-2009-0497</cvename>
|
|
<url>http://www.coresecurity.com/content/openfire-multiple-vulnerabilities</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-01-08</discovery>
|
|
<entry>2009-01-25</entry>
|
|
<modified>2010-05-02</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="abcacb5a-e7f1-11dd-afcd-00e0815b8da8">
|
|
<topic>ipset-tools -- Denial of Service Vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>ipsec-tools</name>
|
|
<range><lt>0.7.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>SecurityFocus reports:</p>
|
|
<blockquote cite="http://www.securityfocus.com/bid/30657/discuss">
|
|
<p>IPsec-Tools is affected by multiple remote denial-of-service
|
|
vulnerabilities because the software fails to properly handle
|
|
certain network packets.</p>
|
|
<p>A successful attack allows a remote attacker to crash the
|
|
software, denying further service to legitimate users.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>30657</bid>
|
|
<cvename>CVE-2008-3651</cvename>
|
|
<cvename>CVE-2008-3652</cvename>
|
|
<mlist msgid="20080724084529.GA3768@zen.inc">http://marc.info/?l=ipsec-tools-devel&m=121688914101709&w=2</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-07-28</discovery>
|
|
<entry>2009-01-21</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="4b68d917-e705-11dd-afcd-00e0815b8da8">
|
|
<topic>Teamspeak Server -- Directory Traversal Vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>teamspeak_server</name>
|
|
<range><le>2.0.23.17</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>SecurityFocus reports:</p>
|
|
<blockquote cite="http://www.securityfocus.com/bid/33256">
|
|
<p>TeamSpeak is prone to a directory-traversal vulnerability because
|
|
it fails to sufficiently sanitize user-supplied input data.
|
|
Exploiting the issue may allow an attacker to obtain sensitive
|
|
information that could aid in further attacks.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>33256</bid>
|
|
<url>http://www.securityfocus.com/bid/33256</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2009-01-14</discovery>
|
|
<entry>2009-01-20</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="2bc960c4-e665-11dd-afcd-00e0815b8da8">
|
|
<topic>optipng -- arbitrary code execution via crafted BMP image</topic>
|
|
<affects>
|
|
<package>
|
|
<name>optipng</name>
|
|
<range><lt>0.6.2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/32651">
|
|
<p>A vulnerability has been reported in OptiPNG, which
|
|
potentially can be exploited by malicious people to compromise
|
|
a user's system.</p>
|
|
<p>The vulnerability is caused due to a boundary error in
|
|
the BMP reader and can be exploited to cause a buffer
|
|
overflow by tricking a user into processing a specially
|
|
crafted file.</p>
|
|
<p>Successful exploitation may allow execution of arbitrary
|
|
code.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-5101</cvename>
|
|
<url>http://secunia.com/advisories/32651</url>
|
|
<url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=505399</url>
|
|
<url>http://optipng.sourceforge.net/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-11-11</discovery>
|
|
<entry>2009-01-19</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="ecad44b9-e663-11dd-afcd-00e0815b8da8">
|
|
<topic>git -- gitweb privilege escalation</topic>
|
|
<affects>
|
|
<package>
|
|
<name>git</name>
|
|
<range><lt>1.6.0.6</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Git maintainers report:</p>
|
|
<blockquote cite="http://marc.info/?l=git&m=122975564100860&w=2">
|
|
<p>gitweb has a possible local privilege escalation
|
|
bug that allows a malicious repository owner to run a command
|
|
of his choice by specifying diff.external configuration
|
|
variable in his repository and running a crafted gitweb
|
|
query.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>32967</bid>
|
|
<mlist msgid="7vhc4z1gys.fsf@gitster.siamese.dyndns.org">http://marc.info/?l=git&m=122975564100860&w=2</mlist>
|
|
<url>http://www.kernel.org/pub/software/scm/git/docs/RelNotes-1.6.0.6.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-12-20</discovery>
|
|
<entry>2009-01-19</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="0809ce7d-f672-4924-9b3b-7c74bc279b83">
|
|
<topic>gtar -- GNU TAR safer_name_suffix Remote Denial of Service Vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>gtar</name>
|
|
<range><lt>1.19</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>SecurityFocus reports:</p>
|
|
<blockquote cite="http://www.securityfocus.com/bid/26445/">
|
|
<p>GNUs tar and cpio utilities are prone to a denial-of-service
|
|
vulnerability because of insecure use of the alloca()
|
|
function.</p>
|
|
<p>Successfully exploiting this issue allows attackers
|
|
to crash the affected utilities and possibly to execute
|
|
code but this has not been confirmed.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>26445</bid>
|
|
<cvename>CVE-2007-4476</cvename>
|
|
<url>http://www.securityfocus.com/bid/26445/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-11-14</discovery>
|
|
<entry>2009-01-15</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="5ccb1c14-e357-11dd-a765-0030843d3802">
|
|
<topic>mplayer -- vulnerability in STR files processor</topic>
|
|
<affects>
|
|
<package>
|
|
<name>mplayer</name>
|
|
<name>mplayer-esound</name>
|
|
<name>mplayer-gtk</name>
|
|
<name>mplayer-gtk-esound</name>
|
|
<name>mplayer-gtk2</name>
|
|
<name>mplayer-gtk2-esound</name>
|
|
<range><lt>0.99.11_10</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/30994">
|
|
<p>The vulnerability is caused due to a boundary error within the
|
|
"str_read_packet()" function in libavformat/psxstr.c. This can be
|
|
exploited to cause a heap-based buffer overflow via a specially
|
|
crafted STR file.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-3162</cvename>
|
|
<bid>30157</bid>
|
|
<url>http://secunia.com/advisories/30994</url>
|
|
<url>https://roundup.mplayerhq.hu/roundup/ffmpeg/issue311</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-07-09</discovery>
|
|
<entry>2009-01-15</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="bc6a7e79-e111-11dd-afcd-00e0815b8da8">
|
|
<topic>cgiwrap -- XSS Vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>cgiwrap</name>
|
|
<range><lt>4.0_2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/30765">
|
|
<p>A vulnerability has been reported in CGIWrap, which can be
|
|
exploited by malicious people to conduct cross-site scripting
|
|
attacks.</p>
|
|
<p>The vulnerability is caused due to the application generating
|
|
error messages without specifying a charset. This can be exploited
|
|
to execute arbitrary HTML and script code in a user's browser
|
|
session in context of an affected site.</p>
|
|
<p>Successful exploitation may require that the victim uses Internet
|
|
Explorer or a browser based on Internet Explorer components.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-2852</cvename>
|
|
<url>http://secunia.com/advisories/30765</url>
|
|
<url>http://cgiwrap.sourceforge.net/changes.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-06-19</discovery>
|
|
<entry>2009-01-13</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="d4a358d3-e09a-11dd-a765-0030843d3802">
|
|
<topic>nagios -- web interface privilege escalation vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>nagios</name>
|
|
<range><lt>3.0.5</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>nagios2</name>
|
|
<range><lt>2.12_2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>securityfocus reports:</p>
|
|
<blockquote cite="http://www.securityfocus.com/bid/32156/discuss">
|
|
<p>An attacker with low-level privileges may exploit this issue to
|
|
bypass authorization and cause arbitrary commands to run within the
|
|
context of the Nagios server. This may aid in further attacks.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-5027</cvename>
|
|
<bid>32156</bid>
|
|
<url>http://secunia.com/advisories/33320</url>
|
|
<url>http://www.ubuntu.com/usn/USN-698-1</url>
|
|
<url>http://www.nagios.org/development/history/nagios-3x.php</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-11-06</discovery>
|
|
<entry>2009-01-12</entry>
|
|
<modified>2009-01-15</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="a02c9595-e018-11dd-a765-0030843d3802">
|
|
<topic>pdfjam -- insecure temporary files</topic>
|
|
<affects>
|
|
<package>
|
|
<name>pdfjam</name>
|
|
<range><lt>1.20_4</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/33278">
|
|
<p>Some security issues have been reported in PDFjam, which can be
|
|
exploited by malicious, local users to perform certain actions with
|
|
escalated privileges.</p>
|
|
<p>The security issues are caused due to the "pdf90", "pdfjoin", and
|
|
"pdfnup" scripts using temporary files in an insecure manner. This can
|
|
be exploited to overwrite arbitrary files via symlink attacks.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-5743</cvename>
|
|
<url>https://bugzilla.novell.com/show_bug.cgi?id=459031</url>
|
|
<url>http://secunia.com/advisories/33278</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-12-05</discovery>
|
|
<entry>2009-01-11</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="58997463-e012-11dd-a765-0030843d3802">
|
|
<topic>verlihub -- insecure temporary file usage and arbitrary command execution</topic>
|
|
<affects>
|
|
<package>
|
|
<name>verlihub</name>
|
|
<range><lt>0.9.8.d.r2_2,1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>securityfocus reports:</p>
|
|
<blockquote cite="http://www.securityfocus.com/bid/32889/discuss">
|
|
<p>An attacker with local access could potentially exploit this issue
|
|
to perform symbolic-link attacks, overwriting arbitrary files in the
|
|
context of the affected application.</p>
|
|
<p>Successfully mounting a symlink attack may allow the attacker to
|
|
delete or corrupt sensitive files, which may result in a denial of
|
|
service. Other attacks may also be possible.</p>
|
|
</blockquote>
|
|
<blockquote cite="http://www.securityfocus.com/bid/32420/discuss">
|
|
<p>Verlihub is prone to a remote command-execution vulnerability
|
|
because it fails to sufficiently validate user input.</p>
|
|
<p>Successfully exploiting this issue would allow an attacker to
|
|
execute arbitrary commands on an affected computer in the context of
|
|
the affected application.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-5705</cvename>
|
|
<cvename>CVE-2008-5706</cvename>
|
|
<bid>32889</bid>
|
|
<bid>32420</bid>
|
|
<url>http://milw0rm.com/exploits/7183</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-11-22</discovery>
|
|
<entry>2009-01-11</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="66a770b4-e008-11dd-a765-0030843d3802">
|
|
<topic>mysql -- empty bit-string literal denial of service</topic>
|
|
<affects>
|
|
<package>
|
|
<name>mysql-server</name>
|
|
<range><ge>5.0</ge><lt>5.0.66</lt></range>
|
|
<range><ge>5.1</ge><lt>5.1.26</lt></range>
|
|
<range><ge>6.0</ge><lt>6.0.6</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>MySQL reports:</p>
|
|
<blockquote cite="http://bugs.mysql.com/bug.php?id=35658">
|
|
<p>The vulnerability is caused due to an error when processing an
|
|
empty bit-string literal and can be exploited to crash the server via
|
|
a specially crafted SQL statement.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-3963</cvename>
|
|
<url>http://bugs.mysql.com/bug.php?id=35658</url>
|
|
<url>http://dev.mysql.com/doc/refman/5.0/en/releasenotes-es-5-0-66.html</url>
|
|
<url>http://dev.mysql.com/doc/refman/5.1/en/news-5-1-26.html</url>
|
|
<url>http://dev.mysql.com/doc/refman/6.0/en/news-6-0-6.html</url>
|
|
<url>http://secunia.com/advisories/31769</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-09-11</discovery>
|
|
<entry>2009-01-11</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="8c451386-dff3-11dd-a765-0030843d3802">
|
|
<topic>mysql -- privilege escalation and overwrite of the system table information</topic>
|
|
<affects>
|
|
<package>
|
|
<name>mysql-server</name>
|
|
<range><ge>4.1</ge><lt>4.1.24</lt></range>
|
|
<range><ge>5.0</ge><lt>5.0.51</lt></range>
|
|
<range><ge>5.1</ge><lt>5.1.23</lt></range>
|
|
<range><ge>6.0</ge><lt>6.0.4</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>MySQL reports:</p>
|
|
<blockquote cite="http://dev.mysql.com/doc/refman/4.1/en/news-4-1-24.html">
|
|
<p>Using RENAME TABLE against a table with explicit DATA
|
|
DIRECTORY and INDEX DIRECTORY options can be used to overwrite
|
|
system table information by replacing the symbolic link
|
|
points. the file to which the symlink points.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2007-5969</cvename>
|
|
<bid>26765</bid>
|
|
<url>http://bugs.mysql.com/bug.php?id=32111</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-11-14</discovery>
|
|
<entry>2009-01-11</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="240ac24c-dff3-11dd-a765-0030843d3802">
|
|
<topic>mysql -- remote dos via malformed password packet</topic>
|
|
<affects>
|
|
<package>
|
|
<name>mysql-server</name>
|
|
<range><ge>4.1</ge><lt>4.1.24</lt></range>
|
|
<range><ge>5.0</ge><lt>5.0.44</lt></range>
|
|
<range><ge>5.1</ge><lt>5.1.20</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>MySQL reports:</p>
|
|
<blockquote cite="http://dev.mysql.com/doc/refman/4.1/en/news-4-1-24.html">
|
|
<p>A malformed password packet in the connection protocol
|
|
could cause the server to crash.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2007-3780</cvename>
|
|
<bid>25017</bid>
|
|
<url>http://bugs.mysql.com/bug.php?id=28984</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-07-15</discovery>
|
|
<entry>2009-01-11</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="bb4e9a44-dff2-11dd-a765-0030843d3802">
|
|
<topic>mysql -- renaming of arbitrary tables by authenticated users</topic>
|
|
<affects>
|
|
<package>
|
|
<name>mysql-server</name>
|
|
<range><ge>4.1</ge><lt>4.1.23</lt></range>
|
|
<range><ge>5.0</ge><lt>5.0.42</lt></range>
|
|
<range><ge>5.1</ge><lt>5.1.18</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>MySQL reports:</p>
|
|
<blockquote cite="http://dev.mysql.com/doc/refman/4.1/en/news-4-1-23.html">
|
|
<p>The requirement of the DROP privilege for RENAME TABLE was not
|
|
enforced.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2007-2691</cvename>
|
|
<bid>24016</bid>
|
|
<url>http://bugs.mysql.com/bug.php?id=27515</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-05-14</discovery>
|
|
<entry>2009-01-11</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="69a20ce4-dfee-11dd-a765-0030843d3802">
|
|
<topic>imap-uw -- imap c-client buffer overflow</topic>
|
|
<affects>
|
|
<package>
|
|
<name>imap-uw</name>
|
|
<range><lt>2007e</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>SANS reports:</p>
|
|
<blockquote cite="http://www.washington.edu/imap/documentation/RELNOTES.html">
|
|
<p>The University of Washington IMAP library is a library implementing
|
|
the IMAP mail protocol. University of Washington IMAP is exposed to a
|
|
buffer overflow issue that occurs due to a boundary error within the
|
|
rfc822_output_char function in the c-client library. The University of
|
|
Washington IMAP library versions prior to 2007e are affected.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-5514</cvename>
|
|
<url>http://www.washington.edu/imap/documentation/RELNOTES.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-12-16</discovery>
|
|
<entry>2009-01-11</entry>
|
|
<modified>2010-05-02</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="a6713190-dfea-11dd-a765-0030843d3802">
|
|
<topic>imap-uw -- local buffer overflow vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>imap-uw</name>
|
|
<range><lt>2007d</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>SANS reports:</p>
|
|
<blockquote cite="http://www.sans.org/newsletters/risk/display.php?v=7&i=45#08.45.22">
|
|
<p>University of Washington "tmail" and "dmail" are mail deliver
|
|
agents. "tmail" and "dmail" are exposed to local buffer overflow
|
|
issues because they fail to perform adequate boundary checks on
|
|
user-supplied data.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-5514</cvename>
|
|
<url>http://www.washington.edu/imap/documentation/RELNOTES.html</url>
|
|
<url>http://www.sans.org/newsletters/risk/display.php?v=7&i=45#08.45.22</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-10-29</discovery>
|
|
<entry>2009-01-11</entry>
|
|
<modified>2010-05-02</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="bd730827-dfe0-11dd-a765-0030843d3802">
|
|
<topic>libcdaudio -- remote buffer overflow and code execution</topic>
|
|
<affects>
|
|
<package>
|
|
<name>libcdaudio</name>
|
|
<range><lt>0.99.12p2_2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>securityfocus reports:</p>
|
|
<blockquote cite="http://www.securityfocus.com/bid/32122/discuss">
|
|
<p>The 'libcdaudio' library is prone to a remote heap code in the
|
|
context of an application that uses the library. Failed attacks will
|
|
cause denial-of-service conditions.</p>
|
|
</blockquote>
|
|
<blockquote cite="http://www.securityfocus.com/bid/12770/discuss">
|
|
<p>A buffer-overflow in Grip occurs when the software processes a
|
|
response to a CDDB query that has more than 16 matches.</p>
|
|
<p>To exploit this issue, an attacker must be able to influence the
|
|
response to a CDDB query, either by controlling a malicious CDDB
|
|
server or through some other means. Successful exploits will allow
|
|
arbitrary code to run.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-5030</cvename>
|
|
<cvename>CVE-2005-0706</cvename>
|
|
<bid>32122</bid>
|
|
<bid>12770</bid>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-11-05</discovery>
|
|
<entry>2009-01-11</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="c702944a-db0f-11dd-aa56-000bcdf0a03b">
|
|
<topic>FreeBSD -- netgraph / bluetooth privilege escalation</topic>
|
|
<affects>
|
|
<system>
|
|
<name>FreeBSD</name>
|
|
<range><gt>6.3</gt><lt>6.3_7</lt></range>
|
|
<range><gt>6.4</gt><lt>6.4_1</lt></range>
|
|
<range><gt>7.0</gt><lt>7.0_7</lt></range>
|
|
</system>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<h1>Problem Description:</h1>
|
|
<p>Some function pointers for netgraph and bluetooth sockets are
|
|
not properly initialized.</p>
|
|
<h1>Impact:</h1>
|
|
<p>A local user can cause the FreeBSD kernel to execute
|
|
arbitrary code. This could be used by an attacker directly;
|
|
or it could be used to gain root privilege or to escape from
|
|
a jail.</p>
|
|
<h1>Workaround:</h1>
|
|
<p>No workaround is available, but systems without local
|
|
untrusted users are not vulnerable. Furthermore, systems are
|
|
not vulnerable if they have neither the ng_socket nor
|
|
ng_bluetooth kernel modules loaded or compiled into the
|
|
kernel.</p>
|
|
<p>Systems with the security.jail.socket_unixiproute_only
|
|
sysctl set to 1 (the default) are only vulnerable if they have
|
|
local untrusted users outside of jails.</p>
|
|
<p>If the command</p>
|
|
<p><code># kldstat -v | grep ng_</code></p>
|
|
<p>produces no output, the system is not vulnerable.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<freebsdsa>SA-08:13.protosw</freebsdsa>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-12-23</discovery>
|
|
<entry>2009-01-05</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="e9ecaceb-db0d-11dd-aa56-000bcdf0a03b">
|
|
<topic>FreeBSD -- Cross-site request forgery in ftpd(8)</topic>
|
|
<affects>
|
|
<system>
|
|
<name>FreeBSD</name>
|
|
<range><gt>6.3</gt><lt>6.3_7</lt></range>
|
|
<range><gt>6.4</gt><lt>6.4_1</lt></range>
|
|
<range><gt>7.0</gt><lt>7.0_7</lt></range>
|
|
</system>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<h1>Problem Description:</h1>
|
|
<p>The ftpd(8) server splits long commands into several
|
|
requests. This may result in the server executing a command
|
|
which is hidden inside another very long command.</p>
|
|
<h1>Impact:</h1>
|
|
<p>This could, with a specifically crafted command, be used in a
|
|
cross-site request forgery attack.</p>
|
|
<p>FreeBSD systems running ftpd(8) server could act as a point
|
|
of privilege escalation in an attack against users using web
|
|
browser to access trusted FTP sites.</p>
|
|
<h1>Workaround:</h1>
|
|
<p>No workaround is available, but systems not running FTP
|
|
servers are not vulnerable. Systems not running the FreeBSD
|
|
ftp(8) server are not affected, but users of other ftp
|
|
daemons are advised to take care since several other ftp
|
|
daemons are known to have related bugs.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-4247</cvename>
|
|
<freebsdsa>SA-08:12.ftpd</freebsdsa>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-12-23</discovery>
|
|
<entry>2009-01-05</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="6b8cadce-db0b-11dd-aa56-000bcdf0a03b">
|
|
<topic>FreeBSD -- IPv6 Neighbor Discovery Protocol routing vulnerability</topic>
|
|
<affects>
|
|
<system>
|
|
<name>FreeBSD</name>
|
|
<range><gt>6.3</gt><lt>6.3_5</lt></range>
|
|
<range><gt>7.0</gt><lt>7.0_5</lt></range>
|
|
</system>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<h1>Problem Description</h1>
|
|
<p>IPv6 routers may allow "on-link" IPv6 nodes to create and
|
|
update the router's neighbor cache and forwarding
|
|
information. A malicious IPv6 node sharing a common router
|
|
but on a different physical segment from another node may be
|
|
able to spoof Neighbor Discovery messages, allowing it to
|
|
update router information for the victim node.</p>
|
|
<h1>Impact:</h1>
|
|
<p>An attacker on a different physical network connected to the
|
|
same IPv6 router as another node could redirect IPv6 traffic
|
|
intended for that node. This could lead to denial of service
|
|
or improper access to private network traffic.</p>
|
|
<h1>Workaround:</h1>
|
|
<p>Firewall packet filters can be used to filter incoming
|
|
Neighbor Solicitation messages but may interfere with normal
|
|
IPv6 operation if not configured carefully.</p>
|
|
<p>Reverse path forwarding checks could be used to make
|
|
gateways, such as routers or firewalls, drop Neighbor
|
|
Solicitation messages from nodes with unexpected source
|
|
addresses on a particular interface.</p>
|
|
<p>IPv6 router administrators are encouraged to read RFC 3756
|
|
for further discussion of Neighbor Discovery security
|
|
implications.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-2476</cvename>
|
|
<freebsdsa>SA-08:10.nd6</freebsdsa>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-10-01</discovery>
|
|
<entry>2009-01-05</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="5796858d-db0b-11dd-aa56-000bcdf0a03b">
|
|
<topic>FreeBSD -- arc4random(9) predictable sequence vulnerability</topic>
|
|
<affects>
|
|
<system>
|
|
<name>FreeBSD</name>
|
|
<range><gt>6.3</gt><lt>6.3_6</lt></range>
|
|
<range><gt>7.0</gt><lt>7.0_6</lt></range>
|
|
</system>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<h1>Problem Description:</h1>
|
|
<p>When the arc4random(9) random number generator is
|
|
initialized, there may be inadequate entropy to meet the
|
|
needs of kernel systems which rely on arc4random(9); and it
|
|
may take up to 5 minutes before arc4random(9) is reseeded
|
|
with secure entropy from the Yarrow random number generator.</p>
|
|
<h1>Impact:</h1>
|
|
<p>All security-related kernel subsystems that rely on a
|
|
quality random number generator are subject to a wide range of
|
|
possible attacks for the 300 seconds after boot or until 64k
|
|
of random data is consumed. The list includes:</p>
|
|
<p>* GEOM ELI providers with onetime keys. When a provider is
|
|
configured in a way so that it gets attached at the same time
|
|
during boot (e.g. it uses the rc subsystem to initialize) it
|
|
might be possible for an attacker to recover the encrypted
|
|
data.</p>
|
|
<p>* GEOM shsec providers. The GEOM shsec subsytem is used to
|
|
split a shared secret between two providers so that it can be
|
|
recovered when both of them are present. This is done by
|
|
writing the random sequence to one of providers while
|
|
appending the result of the random sequence on the other host
|
|
to the original data. If the provider was created within the
|
|
first 300 seconds after booting, it might be possible for an
|
|
attacker to extract the original data with access to only one
|
|
of the two providers between which the secret data is split.</p>
|
|
<p>* System processes started early after boot may receive
|
|
predictable IDs.</p>
|
|
<p>* The 802.11 network stack uses arc4random(9) to generate
|
|
initial vectors (IV) for WEP encryption when operating in
|
|
client mode and WEP authentication challenges when operating
|
|
in hostap mode, which may be insecure.</p>
|
|
<p>* The IPv4, IPv6 and TCP/UDP protocol implementations rely
|
|
on a quality random number generator to produce unpredictable
|
|
IP packet identifiers, initial TCP sequence numbers and
|
|
outgoing port numbers. During the first 300 seconds after
|
|
booting, it may be easier for an attacker to execute IP
|
|
session hijacking, OS fingerprinting, idle scanning, or in
|
|
some cases DNS cache poisoning and blind TCP data injection
|
|
attacks.</p>
|
|
<p>* The kernel RPC code uses arc4random(9) to retrieve
|
|
transaction identifiers, which might make RPC clients
|
|
vulnerable to hijacking attacks.</p>
|
|
<h1>Workaround:</h1>
|
|
<p>No workaround is available for affected systems.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-5162</cvename>
|
|
<freebsdsa>SA-08.11.arc4random</freebsdsa>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-11-24</discovery>
|
|
<entry>2009-01-05</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="d5e1aac8-db0b-11dd-ae30-001cc0377035">
|
|
<topic>xterm -- DECRQSS remote command execution vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>xterm</name>
|
|
<range><lt>238</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>SecurityFocus reports:</p>
|
|
<blockquote cite="http://www.securityfocus.com/bid/33060/discuss">
|
|
<p>The xterm program is prone to a remote command-execution
|
|
vulnerability because it fails to sufficiently validate user
|
|
input.</p>
|
|
<p>Successfully exploiting this issue would allow an attacker
|
|
to execute arbitrary commands on an affected computer in the
|
|
context of the affected application.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>33060</bid>
|
|
<cvename>CVE-2008-2383</cvename>
|
|
<url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=510030</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-12-28</discovery>
|
|
<entry>2009-01-05</entry>
|
|
<modified>2009-01-06</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="58a3c266-db01-11dd-ae30-001cc0377035">
|
|
<topic>php5-gd -- uninitialized memory information disclosure vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>php5-gd</name>
|
|
<range><le>5.2.8</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>According to CVE-2008-5498 entry:</p>
|
|
<blockquote cite="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5498">
|
|
<p>Array index error in the "imageRotate" function in PHP 5.2.8 and
|
|
earlier allows context-dependent attackers to read the contents
|
|
of arbitrary memory locations via a crafted value of the third
|
|
argument (aka the "bgd_color" or "clrBack" argument) for an indexed
|
|
image.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>33002</bid>
|
|
<cvename>CVE-2008-5498</cvename>
|
|
<url>http://www.securiteam.com/unixfocus/6G00Y0ANFU.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-12-24</discovery>
|
|
<entry>2009-01-05</entry>
|
|
<modified>2009-02-04</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="27d78386-d35f-11dd-b800-001b77d09812">
|
|
<topic>awstats -- multiple XSS vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>awstats</name>
|
|
<range><lt>6.9,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>awstats-devel</name>
|
|
<range><gt>0</gt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/31519">
|
|
<p>Morgan Todd has discovered a vulnerability in AWStats,
|
|
which can be exploited by malicious people to conduct
|
|
cross-site scripting attacks.</p>
|
|
<p>Input passed in the URL to awstats.pl is not properly
|
|
sanitised before being returned to the user. This can be
|
|
exploited to execute arbitrary HTML and script code in a
|
|
user's browser session in context of an affected site.</p>
|
|
<p>Successful exploitation requires that the application is
|
|
running as a CGI script.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-3714</cvename>
|
|
<cvename>CVE-2008-5080</cvename>
|
|
<url>http://secunia.com/advisories/31519</url>
|
|
<url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=495432</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-03-12</discovery>
|
|
<entry>2009-01-04</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="13b0c8c8-bee0-11dd-a708-001fc66e7203">
|
|
<topic>p5-File-Path -- rmtree allows creation of setuid files</topic>
|
|
<affects>
|
|
<package>
|
|
<name>p5-File-Path</name>
|
|
<range><lt>2.07_1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Jan Lieskovsky reports:</p>
|
|
<blockquote cite="http://www.openwall.com/lists/oss-security/2008/11/28/1">
|
|
<p>perl-File-Path rmtree race condition (CVE-2005-0448 was assigned to
|
|
address this)</p>
|
|
<p>This vulnerability was fixed in 5.8.4-7 but re-introduced
|
|
in 5.8.8-1. It's also present in File::Path 2.xx, up to and
|
|
including 2.07 which has only a partial fix.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-0448</cvename>
|
|
<mlist>http://www.openwall.com/lists/oss-security/2008/11/28/1</mlist>
|
|
<mlist>http://www.gossamer-threads.com/lists/perl/porters/233699#233699</mlist>
|
|
<url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=286905</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-11-28</discovery>
|
|
<entry>2009-01-03</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="0e1e3789-d87f-11dd-8ecd-00163e000016">
|
|
<topic>vim -- multiple vulnerabilities in the netrw module</topic>
|
|
<affects>
|
|
<package>
|
|
<name>vim</name>
|
|
<name>vim-lite</name>
|
|
<name>vim-gtk2</name>
|
|
<name>vim-gnome</name>
|
|
<range><ge>7.0</ge><lt>7.2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Jan Minar reports:</p>
|
|
<blockquote cite="http://www.rdancer.org/vulnerablevim-netrw.v2.html">
|
|
<p>Applying the ``D'' to a file with a crafted file name,
|
|
or inside a directory with a crafted directory name, can
|
|
lead to arbitrary code execution.</p>
|
|
</blockquote>
|
|
<blockquote cite="http://www.rdancer.org/vulnerablevim-netrw.v5.html">
|
|
<p>Lack of sanitization throughout Netrw can lead to arbitrary
|
|
code execution upon opening a directory with a crafted
|
|
name.</p>
|
|
</blockquote>
|
|
<blockquote cite="http://www.rdancer.org/vulnerablevim-netrw-credentials-dis.html">
|
|
<p>The Vim Netrw Plugin shares the FTP user name and password
|
|
across all FTP sessions. Every time Vim makes a new FTP
|
|
connection, it sends the user name and password of the
|
|
previous FTP session to the FTP server.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-3076</cvename>
|
|
<mlist>http://www.openwall.com/lists/oss-security/2008/10/16/2</mlist>
|
|
<url>http://www.rdancer.org/vulnerablevim-netrw.html</url>
|
|
<url>http://www.rdancer.org/vulnerablevim-netrw.v2.html</url>
|
|
<url>http://www.rdancer.org/vulnerablevim-netrw.v5.html</url>
|
|
<url>http://www.rdancer.org/vulnerablevim-netrw-credentials-dis.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-10-16</discovery>
|
|
<entry>2009-01-02</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="214e8e07-d369-11dd-b800-001b77d09812">
|
|
<topic>vinagre -- format string vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>vinagre</name>
|
|
<range><lt>0.5.2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>CORE Security Technologies reports:</p>
|
|
<blockquote cite="http://www.coresecurity.com/content/vinagre-format-string">
|
|
<p>A format string error has been found on the
|
|
vinagre_utils_show_error() function that can be exploited via
|
|
commands issued from a malicious server containing format
|
|
string specifiers on the VNC name.</p>
|
|
<p>In a web based attack scenario, the user would be required
|
|
to connect to a malicious server. Successful exploitation
|
|
would then allow the attacker to execute arbitrary code with
|
|
the privileges of the Vinagre user.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>32682</bid>
|
|
<cvename>CVE-2008-5660</cvename>
|
|
<url>http://www.coresecurity.com/content/vinagre-format-string</url>
|
|
<url>http://ftp.gnome.org/pub/GNOME/sources/vinagre/0.5/vinagre-0.5.2.news</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-12-09</discovery>
|
|
<entry>2008-12-31</entry>
|
|
<modified>2010-05-02</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="f98dea27-d687-11dd-abd1-0050568452ac">
|
|
<topic>twiki -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>twiki</name>
|
|
<range><lt>4.2.4,1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Marc Schoenefeld and Steve Milner of RedHat SRT and Peter Allor of IBM ISS report:</p>
|
|
<blockquote cite="http://twiki.org/cgi-bin/view/Codev/TWikiSecurityAlerts#Security_Alerts_of_TWiki_4_2_x_P">
|
|
<p>XSS vulnerability with URLPARAM variable</p>
|
|
<p>SEARCH variable allows arbitrary shell command execution</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>32668</bid>
|
|
<bid>32669</bid>
|
|
<cvename>CVE-2008-5304</cvename>
|
|
<cvename>CVE-2008-5305</cvename>
|
|
<url>http://secunia.com/advisories/33040</url>
|
|
<url>http://twiki.org/cgi-bin/view/Codev/SecurityAlert-CVE-2008-5304</url>
|
|
<url>http://twiki.org/cgi-bin/view/Codev/SecurityAlert-CVE-2008-5305</url>
|
|
<url>http://www.securitytracker.com/alerts/2008/Dec/1021351.html</url>
|
|
<url>http://www.securitytracker.com/alerts/2008/Dec/1021352.html</url>
|
|
<url>https://www.it-isac.org/postings/cyber/alertdetail.php?id=4513</url>
|
|
<url>http://xforce.iss.net/xforce/xfdb/45293</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-12-05</discovery>
|
|
<entry>2008-12-30</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="8f483746-d45d-11dd-84ec-001fc66e7203">
|
|
<topic>roundcube -- remote execution of arbitrary code</topic>
|
|
<affects>
|
|
<package>
|
|
<name>roundcube</name>
|
|
<range><lt>0.2.b2,1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Entry for CVE-2008-5619 says:</p>
|
|
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5619">
|
|
<p>html2text.php in RoundCube Webmail (roundcubemail)
|
|
0.2-1.alpha and 0.2-3.beta allows remote attackers to execute
|
|
arbitrary code via crafted input that is processed by the
|
|
preg_replace function with the eval switch.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-5619</cvename>
|
|
<url>http://trac.roundcube.net/ticket/1485618</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-12-12</discovery>
|
|
<entry>2008-12-30</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="738f8f9e-d661-11dd-a765-0030843d3802">
|
|
<topic>mysql -- MyISAM table privileges security bypass vulnerability for symlinked paths</topic>
|
|
<affects>
|
|
<package>
|
|
<name>mysql-server</name>
|
|
<range><ge>4.1</ge><lt>4.1.25</lt></range>
|
|
<range><ge>5.0</ge><lt>5.0.75</lt></range>
|
|
<range><ge>5.1</ge><lt>5.1.28</lt></range>
|
|
<range><ge>6.0</ge><lt>6.0.6</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>MySQL Team reports:</p>
|
|
<blockquote cite="http://bugs.mysql.com/bug.php?id=32167">
|
|
<p>Additional corrections were made for the symlink-related privilege
|
|
problem originally addressed. The original fix did not correctly
|
|
handle the data directory pathname if it contained symlinked
|
|
directories in its path, and the check was made only at
|
|
table-creation time, not at table-opening time later.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-2079</cvename>
|
|
<cvename>CVE-2008-4097</cvename>
|
|
<cvename>CVE-2008-4098</cvename>
|
|
<url>http://bugs.mysql.com/bug.php?id=32167</url>
|
|
<url>http://dev.mysql.com/doc/refman/4.1/en/news-4-1-25.html</url>
|
|
<url>http://dev.mysql.com/doc/refman/5.0/en/releasenotes-cs-5-0-75.html</url>
|
|
<url>http://dev.mysql.com/doc/refman/5.1/en/news-5-1-28.html</url>
|
|
<url>http://dev.mysql.com/doc/refman/6.0/en/news-6-0-6.html</url>
|
|
<url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=480292#25</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-07-03</discovery>
|
|
<entry>2008-12-30</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="7c5bd5b8-d652-11dd-a765-0030843d3802">
|
|
<topic>mplayer -- twinvq processing buffer overflow vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>mplayer</name>
|
|
<name>mplayer-esound</name>
|
|
<name>mplayer-gtk</name>
|
|
<name>mplayer-gtk-esound</name>
|
|
<name>mplayer-gtk2</name>
|
|
<name>mplayer-gtk2-esound</name>
|
|
<range><lt>0.99.11_9</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A trapkit reports:</p>
|
|
<blockquote cite="http://trapkit.de/advisories/TKADV2008-014.txt">
|
|
<p>MPlayer contains a stack buffer overflow vulnerability while
|
|
parsing malformed TwinVQ media files. The vulnerability may be
|
|
exploited by a (remote) attacker to execute arbitrary code in
|
|
the context of MPlayer.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-5616</cvename>
|
|
<url>http://secunia.com/advisories/33136/</url>
|
|
<url>http://trapkit.de/advisories/TKADV2008-014.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-12-14</discovery>
|
|
<entry>2008-12-30</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="0ac68e68-d32b-11dd-b540-d1288664c17e">
|
|
<topic>ampache -- insecure temporary file usage</topic>
|
|
<affects>
|
|
<package>
|
|
<name>ampache</name>
|
|
<range><lt>3.4.3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/31657">
|
|
<p>A security issue has been reported in Ampache, which can be
|
|
exploited by malicious, local users to perform certain actions
|
|
with escalated privileges.</p>
|
|
<p>The security issue is caused due to the "gather-messages.sh"
|
|
script handling temporary files in an insecure manner.
|
|
This can be exploited via symlink attacks to overwrite arbitrary
|
|
files with the privileges of the user running the script.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>30875</bid>
|
|
<cvename>CVE-2008-3929</cvename>
|
|
<url>http://secunia.com/advisories/31657</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-12-24</discovery>
|
|
<entry>2008-12-26</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="225bc349-ce10-11dd-a721-0030843d3802">
|
|
<topic>opera -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>opera</name>
|
|
<name>linux-opera</name>
|
|
<range><lt>9.63</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Opera Team reports:</p>
|
|
<blockquote cite="http://www.opera.com/docs/changelogs/freebsd/963/">
|
|
<p>Manipulating certain text-area contents can cause a buffer
|
|
overflow, which may be exploited to execute arbitrary code.</p>
|
|
<p>Certain HTML constructs can cause the resulting DOM to change
|
|
unexpectedly, which triggers a crash. To inject code, additional
|
|
techniques will have to be employed.</p>
|
|
<p>Exceptionally long host names in file: URLs can cause a buffer
|
|
overflow, which may be exploited to execute arbitrary code. Remote Web
|
|
pages cannot refer to file: URLs, so successful exploitation involves
|
|
tricking users into manually opening the exploit URL, or a local file
|
|
that refers to it.</p>
|
|
<p>When Opera is previewing a news feed, some scripted URLs are not
|
|
correctly blocked. These can execute scripts which are able to
|
|
subscribe the user to any feed URL that the attacker chooses, and can
|
|
also view the contents of any feeds that the user is subscribed to.
|
|
These may contain sensitive information.</p>
|
|
<p>Built-in XSLT templates incorrectly handle escaped content and can
|
|
cause it to be treated as markup. If a site accepts content from
|
|
untrusted users, which it then displays using XSLT as escaped strings,
|
|
this can allow scripted markup to be injected. The scripts will then
|
|
be executed in the security context of that site.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-5178</cvename>
|
|
<url>http://www.opera.com/support/kb/view/920/</url>
|
|
<url>http://www.opera.com/support/kb/view/921/</url>
|
|
<url>http://www.opera.com/support/kb/view/922/</url>
|
|
<url>http://www.opera.com/support/kb/view/923/</url>
|
|
<url>http://www.opera.com/support/kb/view/924/</url>
|
|
<url>http://secunia.com/advisories/32752/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-11-18</discovery>
|
|
<entry>2008-12-19</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="61b07d71-ce0e-11dd-a721-0030843d3802">
|
|
<topic>mediawiki -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>mediawiki</name>
|
|
<range><gt>1.6.0</gt><lt>1.6.11</lt></range>
|
|
<range><gt>1.12.0</gt><lt>1.12.3</lt></range>
|
|
<range><gt>1.13.0</gt><lt>1.13.3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The MediaWiki development team reports:</p>
|
|
<blockquote cite="http://lists.wikimedia.org/pipermail/mediawiki-announce/2008-December/000080.html">
|
|
<p>Certain unspecified input is not properly sanitised before being
|
|
returned to the user. This can be exploited to execute arbitrary HTML
|
|
and script code in a user's browser session in context of an affected
|
|
site.</p>
|
|
<p>Certain unspecified input related to uploads is not properly
|
|
sanitised before being used. This can be exploited to inject arbitrary
|
|
HTML and script code, which will be executed in a user's browser
|
|
session in context of an affected site when a malicious data is
|
|
opened. Successful exploitation may require that uploads are enabled
|
|
and the victim uses an Internet Explorer based browser.</p>
|
|
<p>Certain SVG scripts are not properly sanitised before being used.
|
|
This can be exploited to inject arbitrary HTML and script code, which
|
|
will be executed in a user's browser session in context of an affected
|
|
site when a malicious data is opened. Successful exploitation may require
|
|
that SVG uploads are enabled and the victim uses a browser supporting SVG
|
|
scripting.</p>
|
|
<p>The application allows users to perform certain actions via HTTP
|
|
requests without performing any validity checks to verify the
|
|
requests. This can be exploited to perform certain operations when a
|
|
logged in user visits a malicious site.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-5249</cvename>
|
|
<cvename>CVE-2008-5250</cvename>
|
|
<cvename>CVE-2008-5252</cvename>
|
|
<url>http://secunia.com/advisories/33133/</url>
|
|
<url>http://lists.wikimedia.org/pipermail/mediawiki-announce/2008-December/000080.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-12-15</discovery>
|
|
<entry>2008-12-19</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="609c790e-ce0a-11dd-a721-0030843d3802">
|
|
<topic>drupal -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>drupal5</name>
|
|
<range><lt>5.14</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>drupal6</name>
|
|
<range><lt>6.8</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Drupal Project reports:</p>
|
|
<blockquote cite="http://drupal.org/node/345441">
|
|
<p>The update system is vulnerable to Cross site request forgeries.
|
|
Malicious users may cause the superuser (user 1) to execute old
|
|
updates that may damage the database.</p>
|
|
<p>When an input format is deleted, not all existing content on a site
|
|
is updated to reflect this deletion. Such content is then displayed
|
|
unfiltered. This may lead to cross site scripting attacks when harmful
|
|
tags are no longer stripped from 'malicious' content that was posted
|
|
earlier.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-6533</cvename>
|
|
<url>http://drupal.org/node/345441</url>
|
|
<url>http://secunia.com/advisories/33112/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-12-11</discovery>
|
|
<entry>2008-12-19</entry>
|
|
<modified>2010-05-02</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="29f5bfc5-ce04-11dd-a721-0030843d3802">
|
|
<topic>mozilla -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>firefox</name>
|
|
<range><lt>2.0.0.20,1</lt></range>
|
|
<range><gt>3.*,1</gt><lt>3.0.5,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-firefox</name>
|
|
<range><lt>2.0.0.20</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>seamonkey</name>
|
|
<name>linux-seamonkey</name>
|
|
<range><lt>1.1.14</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>thunderbird</name>
|
|
<name>linux-thunderbird</name>
|
|
<range><lt>2.0.0.18</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Mozilla Foundation reports:</p>
|
|
<blockquote cite="http://www.mozilla.org/security/announce/">
|
|
<p>MFSA 2008-69 XSS vulnerabilities in SessionStore</p>
|
|
<p>MFSA 2008-68 XSS and JavaScript privilege escalation</p>
|
|
<p>MFSA 2008-67 Escaped null characters ignored by CSS parser</p>
|
|
<p>MFSA 2008-66 Errors parsing URLs with leading whitespace and
|
|
control characters</p>
|
|
<p>MFSA 2008-65 Cross-domain data theft via script redirect error
|
|
message</p>
|
|
<p>MFSA 2008-64 XMLHttpRequest 302 response disclosure</p>
|
|
<p>MFSA 2008-62 Additional XSS attack vectors in feed preview</p>
|
|
<p>MFSA 2008-61 Information stealing via loadBindingDocument</p>
|
|
<p>MFSA 2008-60 Crashes with evidence of memory corruption
|
|
(rv:1.9.0.5/1.8.1.19)</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-5500</cvename>
|
|
<cvename>CVE-2008-5501</cvename>
|
|
<cvename>CVE-2008-5502</cvename>
|
|
<cvename>CVE-2008-5503</cvename>
|
|
<cvename>CVE-2008-5504</cvename>
|
|
<cvename>CVE-2008-5505</cvename>
|
|
<cvename>CVE-2008-5506</cvename>
|
|
<cvename>CVE-2008-5507</cvename>
|
|
<cvename>CVE-2008-5508</cvename>
|
|
<cvename>CVE-2008-5510</cvename>
|
|
<cvename>CVE-2008-5511</cvename>
|
|
<cvename>CVE-2008-5512</cvename>
|
|
<cvename>CVE-2008-5513</cvename>
|
|
<url>http://www.mozilla.org/security/announce/2008/mfsa2008-60.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2008/mfsa2008-61.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2008/mfsa2008-62.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2008/mfsa2008-63.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2008/mfsa2008-64.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2008/mfsa2008-65.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2008/mfsa2008-66.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2008/mfsa2008-67.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2008/mfsa2008-68.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2008/mfsa2008-69.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-12-17</discovery>
|
|
<entry>2008-12-19</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="54f72962-c7ba-11dd-a721-0030843d3802">
|
|
<topic>phpmyadmin -- cross-site request forgery vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>phpMyAdmin211</name>
|
|
<range><lt>2.11.9.4</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>phpMyAdmin</name>
|
|
<range><lt>3.1.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The phpMyAdmin Team reports:</p>
|
|
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2008-10.php">
|
|
<p>A logged-in user can be subject of SQL injection through cross
|
|
site request forgery. Several scripts in phpMyAdmin are
|
|
vulnerable and the attack can be made through table parameter.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-5621</cvename>
|
|
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2008-10.php</url>
|
|
<url>http://www.milw0rm.com/exploits/7382</url>
|
|
<url>http://secunia.com/advisories/33076/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-12-09</discovery>
|
|
<entry>2008-12-11</entry>
|
|
<modified>2010-05-02</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="1f9e2376-c52f-11dd-8cbc-00163e000016">
|
|
<topic>php5 -- potential magic_quotes_gpc vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>php5</name>
|
|
<range><lt>5.2.8</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>PHP Developers reports:</p>
|
|
<blockquote cite="http://www.php.net/archive/2008.php#id2008-12-07-1">
|
|
<p>Due to a security bug found in the PHP 5.2.7 release, it has been
|
|
removed from distribution. The bug affects configurations where
|
|
magic_quotes_gpc is enabled, because it remains off even when set to
|
|
on.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-5844</cvename>
|
|
<url>http://www.php.net/archive/2008.php#id2008-12-07-1</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-12-07</discovery>
|
|
<entry>2008-12-08</entry>
|
|
<modified>2010-05-02</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="baece347-c489-11dd-a721-0030843d3802">
|
|
<topic>wireshark -- SMTP Processing Denial of Service Vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>wireshark</name>
|
|
<name>wireshark-lite</name>
|
|
<name>ethereal</name>
|
|
<name>ethereal-lite</name>
|
|
<name>tethereal</name>
|
|
<name>tethereal-lite</name>
|
|
<range><lt>1.0.4_1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/32840/">
|
|
<p>A vulnerability has been reported in Wireshark, which can be
|
|
exploited by malicious people to cause a DoS.</p>
|
|
<p>The vulnerability is caused due to an error in the SMTP dissector
|
|
and can be exploited to trigger the execution of an infinite loop via
|
|
a large SMTP packet.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-5285</cvename>
|
|
<url>http://secunia.com/advisories/32840/</url>
|
|
<url>http://lists.grok.org.uk/pipermail/full-disclosure/2008-November/065840.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-11-24</discovery>
|
|
<entry>2008-12-07</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="27d01223-c457-11dd-a721-0030843d3802">
|
|
<topic>php -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>php5</name>
|
|
<range><lt>5.2.7</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/32964/">
|
|
<p>Some vulnerabilities have been reported in PHP, where some have an
|
|
unknown impact and others can potentially be exploited by malicious
|
|
people to cause a DoS (Denial of Service) or compromise a vulnerable
|
|
system.</p>
|
|
<p>An input validation error exists within the
|
|
"ZipArchive::extractTo()" function when extracting ZIP archives.
|
|
This can be exploited to extract files to arbitrary locations
|
|
outside the specified directory via directory traversal sequences in
|
|
a specially crafted ZIP archive.</p>
|
|
<p>An error in the included PCRE library can be exploited to cause a
|
|
buffer overflow.</p>
|
|
<p>The problem is that the "BG(page_uid)" and "BG(page_gid)" variables
|
|
are not initialized. No further information is currently
|
|
available.</p>
|
|
<p>The problem is that the "php_value" order is incorrect for Apache
|
|
configurations. No further information is currently available.</p>
|
|
<p>An error in the GD library can be exploited to cause a crash via a
|
|
specially crafted font file.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-2371</cvename>
|
|
<cvename>CVE-2008-2829</cvename>
|
|
<cvename>CVE-2008-3658</cvename>
|
|
<cvename>CVE-2008-3659</cvename>
|
|
<cvename>CVE-2008-3660</cvename>
|
|
<url>http://www.php.net/ChangeLog-5.php#5.2.7</url>
|
|
<url>http://www.sektioneins.de/advisories/SE-2008-06.txt</url>
|
|
<url>http://secunia.com/advisories/30916/</url>
|
|
<url>http://secunia.com/advisories/31409/</url>
|
|
<url>http://secunia.com/advisories/32964/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-12-04</discovery>
|
|
<entry>2008-12-07</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="44ee8160-c453-11dd-a721-0030843d3802">
|
|
<topic>mgetty+sendfax -- symlink attack via insecure temporary files</topic>
|
|
<affects>
|
|
<package>
|
|
<name>mgetty+sendfax</name>
|
|
<range><lt>1.1.35_2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Debian reports:</p>
|
|
<blockquote cite="http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=496403">
|
|
<p>Faxspool in mgetty 1.1.36 allows local users to overwrite
|
|
arbitrary files via a symlink attack on a /tmp/faxsp.####
|
|
temporary file.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-4936</cvename>
|
|
<url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=496403</url>
|
|
<url>https://bugs.gentoo.org/show_bug.cgi?id=235806</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-08-24</discovery>
|
|
<entry>2008-12-07</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="3efc106e-c451-11dd-a721-0030843d3802">
|
|
<topic>dovecot-managesieve -- Script Name Directory Traversal Vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>dovecot-managesieve</name>
|
|
<range><lt>0.10.4</lt></range>
|
|
<range><ge>0.11.0</ge><lt>0.11.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/Advisories/32768/">
|
|
<p>The security issue is caused due to an input validation error when
|
|
processing script names. This can be exploited to read or modify
|
|
arbitrary files having ".sieve" extensions via directory traversal
|
|
attacks, with the privileges of the attacker's user id.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-5301</cvename>
|
|
<url>http://www.vupen.com/english/advisories/2008/3190</url>
|
|
<url>http://secunia.com/Advisories/32768/</url>
|
|
<url>http://dovecot.org/list/dovecot/2008-November/035259.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-11-18</discovery>
|
|
<entry>2008-12-07</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="578f6322-c450-11dd-a721-0030843d3802">
|
|
<topic>habari -- Cross-Site Scripting Vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>habari</name>
|
|
<range><lt>0.5.2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/32311/">
|
|
<p>Input passed via the "habari_username" parameter when logging in is
|
|
not properly sanitised before being returned to the user. This can
|
|
be exploited to execute arbitrary HTML and script code in a user's
|
|
browser session in context of an affected site.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-4601</cvename>
|
|
<url>http://packetstorm.linuxsecurity.com/0810-exploits/habaricms-xss.txt</url>
|
|
<url>http://secunia.com/advisories/32311/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-10-17</discovery>
|
|
<entry>2008-12-07</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="acf80afa-c3ef-11dd-a721-0030843d3802">
|
|
<topic>vlc -- arbitrary code execution in the RealMedia processor</topic>
|
|
<affects>
|
|
<package>
|
|
<name>vlc-devel</name>
|
|
<range><lt>0.9.8a</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Tobias Klein from TrapKit reports:</p>
|
|
<blockquote cite="http://www.trapkit.de/advisories/TKADV2008-013.txt">
|
|
<p>The VLC media player contains an integer overflow vulnerability
|
|
while parsing malformed RealMedia (.rm) files. The vulnerability
|
|
leads to a heap overflow that can be exploited by a (remote)
|
|
attacker to execute arbitrary code in the context of VLC media
|
|
player.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>32545</bid>
|
|
<cvename>CVE-2008-5276</cvename>
|
|
<url>http://www.trapkit.de/advisories/TKADV2008-013.txt</url>
|
|
<url>http://www.videolan.org/security/sa0811.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-11-30</discovery>
|
|
<entry>2008-12-06</entry>
|
|
<modified>2008-12-07</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="af2745c0-c3e0-11dd-a721-0030843d3802">
|
|
<topic>mantis -- php code execution vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>mantis</name>
|
|
<range><lt>1.1.4</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/32314/">
|
|
<p>EgiX has discovered a vulnerability in Mantis, which can be
|
|
exploited by malicious users to compromise a vulnerable system.</p>
|
|
<p>Input passed to the "sort" parameter in manage_proj_page.php is not
|
|
properly sanitised before being used in a "create_function()" call.
|
|
This can be exploited to execute arbitrary PHP code.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-4687</cvename>
|
|
<url>http://secunia.com/advisories/32314/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-10-17</discovery>
|
|
<entry>2008-12-06</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="29255141-c3df-11dd-a721-0030843d3802">
|
|
<topic>mantis -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>mantis</name>
|
|
<range><lt>1.1.2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/30270/">
|
|
<p>Some vulnerabilities have been reported in Mantis, which can be
|
|
exploited by malicious users to compromise a vulnerable system and
|
|
malicious people to conduct cross-site scripting and request forgery
|
|
attacks.</p>
|
|
<p>Input passed to the "filter_target" parameter in
|
|
return_dynamic_filters.php is not properly sanitised before being
|
|
returned to a user. This can be exploited to execute arbitrary HTML
|
|
and script code in a user's browser session in context of an affected
|
|
site.</p>
|
|
<p>A vulnerability is caused due to the application allowing users to
|
|
perform certain actions via HTTP requests without performing any
|
|
validity checks to verify the request. This can be exploited to e.g.
|
|
add a new user with administrative privileges by enticing a logged-in
|
|
administrator to visit a malicious site.</p>
|
|
<p>Input passed to the "value" parameter in adm_config_set.php is not
|
|
properly sanitised before being used in an "eval()" statement. This
|
|
can be exploited to e.g. execute arbitrary PHP commands via a
|
|
specially crafted request.</p>
|
|
<p>Input passed to the "language" parameter in account_prefs_update.php
|
|
is not properly verified before being used to include files. This
|
|
can be exploited to include arbitrary files from local
|
|
resources.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-2276</cvename>
|
|
<cvename>CVE-2008-3331</cvename>
|
|
<cvename>CVE-2008-3332</cvename>
|
|
<cvename>CVE-2008-3333</cvename>
|
|
<url>http://secunia.com/advisories/30270/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-05-15</discovery>
|
|
<entry>2008-12-06</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="d1ce8a4f-c235-11dd-8cbc-00163e000016">
|
|
<topic>squirrelmail -- Cross site scripting vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>squirrelmail</name>
|
|
<range><lt>1.4.17</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Squirrelmail team reports:</p>
|
|
<blockquote cite="http://sourceforge.net/project/shownotes.php?release_id=644750&group_id=311">
|
|
<p>An issue was fixed that allowed an attacker to send specially-
|
|
crafted hyperlinks in a message that could execute cross-site
|
|
scripting (XSS) when the user viewed the message in SquirrelMail.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-2379</cvename>
|
|
<url>http://secunia.com/Advisories/32143/</url>
|
|
<url>http://sourceforge.net/project/shownotes.php?release_id=644750&group_id=311</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-12-03</discovery>
|
|
<entry>2008-12-04</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="842bafdd-be2f-11dd-a578-0030843d3802">
|
|
<topic>openoffice -- arbitrary code execution vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>openoffice.org-2</name>
|
|
<name>openoffice.org-2-RC</name>
|
|
<name>openoffice.org-2-devel</name>
|
|
<range><ge>2.4</ge><lt>2.4.2</lt></range>
|
|
<range><ge>2.4.20040402</ge></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The OpenOffice Team reports:</p>
|
|
<blockquote cite="http://www.openoffice.org/security/cves/CVE-2008-2237.html">
|
|
<p>A security vulnerability with the way OpenOffice 2.x process WMF
|
|
files may allow a remote unprivileged user who provides a
|
|
StarOffice/StarSuite document that is opened by a local user to
|
|
execute arbitrary commands on the system with the privileges of the
|
|
user running StarOffice/StarSuite. No working exploit is known right
|
|
now.</p>
|
|
</blockquote>
|
|
<blockquote cite="http://www.openoffice.org/security/cves/CVE-2008-2238.html">
|
|
<p>A security vulnerability with the way OpenOffice 2.x process EMF
|
|
files may allow a remote unprivileged user who provides a
|
|
StarOffice/StarSuite document that is opened by a local user to
|
|
execute arbitrary commands on the system with the privileges of the
|
|
user running StarOffice/StarSuite. No working exploit is known right
|
|
now.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-2237</cvename>
|
|
<cvename>CVE-2008-2238</cvename>
|
|
<url>http://www.openoffice.org/security/cves/CVE-2008-2237.html</url>
|
|
<url>http://www.openoffice.org/security/cves/CVE-2008-2238.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-10-29</discovery>
|
|
<entry>2008-11-29</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="622bc638-be27-11dd-a578-0030843d3802">
|
|
<topic>wordpress -- header rss feed script insertion vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>wordpress</name>
|
|
<name>de-wordpress</name>
|
|
<name>wordpress-mu</name>
|
|
<range><lt>2.6.5</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>zh-wordpress</name>
|
|
<range><gt>0</gt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/32882/">
|
|
<p>Input passed via the HTTP "Host" header is not properly sanitised
|
|
before being used. This can be exploited to execute arbitrary HTML and
|
|
script code in a user's browser session in context of an affected site
|
|
if malicious data is viewed.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-5278</cvename>
|
|
<url>http://secunia.com/advisories/32882/</url>
|
|
<url>http://wordpress.org/development/2008/11/wordpress-265/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-11-26</discovery>
|
|
<entry>2008-11-29</entry>
|
|
<modified>2010-05-02</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="1583640d-be20-11dd-a578-0030843d3802">
|
|
<topic>samba -- potential leakage of arbitrary memory contents</topic>
|
|
<affects>
|
|
<package>
|
|
<name>samba</name>
|
|
<name>samba3</name>
|
|
<name>ja-samba</name>
|
|
<range><ge>3.0.29,1</ge><lt>3.0.32_2,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>samba32-devel</name>
|
|
<range><lt>3.2.4_1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Samba Team reports:</p>
|
|
<blockquote cite="http://www.samba.org/samba/security/CVE-2008-4314.html">
|
|
<p>Samba 3.0.29 and beyond contain a change to deal with gcc 4
|
|
optimizations. Part of the change modified range checking for
|
|
client-generated offsets of secondary trans, trans2 and nttrans
|
|
requests. These requests are used to transfer arbitrary amounts
|
|
of memory from clients to servers and back using small SMB
|
|
requests and contain two offsets: One offset (A) pointing into
|
|
the PDU sent by the client and one (B) to direct the transferred
|
|
contents into the buffer built on the server side. While the range
|
|
checking for offset (B) is correct, a cut and paste error lets offset
|
|
(A) pass completely unchecked against overflow.</p>
|
|
<p>The buffers passed into trans, trans2 and nttrans undergo higher-level
|
|
processing like DCE/RPC requests or listing directories. The missing
|
|
bounds check means that a malicious client can make the server do this
|
|
higher-level processing on arbitrary memory contents of the smbd process
|
|
handling the request. It is unknown if that can be abused to pass arbitrary
|
|
memory contents back to the client, but an important barrier is missing from
|
|
the affected Samba versions.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-4314</cvename>
|
|
<url>http://www.samba.org/samba/security/CVE-2008-4314.html</url>
|
|
<url>http://secunia.com/advisories/32813/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-11-27</discovery>
|
|
<entry>2008-11-29</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="37940643-be1b-11dd-a578-0030843d3802">
|
|
<topic>hplip -- hpssd Denial of Service</topic>
|
|
<affects>
|
|
<package>
|
|
<name>hplip</name>
|
|
<range><lt>2.8.2_3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/31470">
|
|
<p>A security issue has been reported in hplip, which can be
|
|
exploited by malicious, local users to cause a DoS.</p>
|
|
<p>The security issue is caused due to an error within hpssd.py when
|
|
parsing certain requests. This can be exploited to crash the service
|
|
by sending specially crafted requests to the default port 2207/TCP.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-2940</cvename>
|
|
<cvename>CVE-2008-2941</cvename>
|
|
<bid>30683</bid>
|
|
<url>https://rhn.redhat.com/errata/RHSA-2008-0818.html</url>
|
|
<url>http://secunia.com/advisories/31470</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-08-14</discovery>
|
|
<entry>2008-11-29</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="87106b67-be13-11dd-a578-0030843d3802">
|
|
<topic>cups -- potential buffer overflow in PNG reading code</topic>
|
|
<affects>
|
|
<package>
|
|
<name>cups-base</name>
|
|
<range><lt>1.3.9_2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>CUPS reports:</p>
|
|
<blockquote cite="http://svn.easysw.com/public/cups/trunk/CHANGES-1.3.txt">
|
|
<p>The PNG image reading code did not validate the
|
|
image size properly, leading to a potential buffer overflow
|
|
(STR #2974)</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-5286</cvename>
|
|
<url>http://www.cups.org/str.php?L2974</url>
|
|
<url>http://svn.easysw.com/public/cups/trunk/CHANGES-1.3.txt</url>
|
|
<url>http://www.openwall.com/lists/oss-security/2008/11/25/2</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-10-17</discovery>
|
|
<entry>2008-11-29</entry>
|
|
<modified>2008-12-25</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="910486d5-ba4d-11dd-8f23-0019666436c2">
|
|
<topic>imlib2 -- XPM processing buffer overflow vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>imlib2</name>
|
|
<name>imlib2-nox11</name>
|
|
<range><lt>1.4.1.000_1,2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/Advisories/32796/">
|
|
<p>A vulnerability has been discovered in imlib2, which can
|
|
be exploited by malicious people to potentially compromise
|
|
an application using the library.</p>
|
|
<p>The vulnerability is caused due to a pointer arithmetic
|
|
error within the "load()" function provided by the XPM
|
|
loader. This can be exploited to cause a heap-based buffer
|
|
overflow via a specially crafted XPM file.</p>
|
|
<p>Successful exploitation may allow execution of arbitrary
|
|
code.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>32371</bid>
|
|
<cvename>CVE-2008-5187</cvename>
|
|
<url>http://secunia.com/Advisories/32796/</url>
|
|
<url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=505714#15</url>
|
|
<url>http://bugzilla.enlightenment.org/show_bug.cgi?id=547</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-11-20</discovery>
|
|
<entry>2008-11-24</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="4d4caee0-b939-11dd-a578-0030843d3802">
|
|
<topic>streamripper -- multiple buffer overflows</topic>
|
|
<affects>
|
|
<package>
|
|
<name>streamripper</name>
|
|
<range><lt>1.64.0</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/secunia_research/2008-50/">
|
|
<p>A boundary error exists within http_parse_sc_header() in lib/http.c
|
|
when parsing an overly long HTTP header starting with "Zwitterion v".</p>
|
|
<p>A boundary error exists within http_get_pls() in lib/http.c when
|
|
parsing a specially crafted pls playlist containing an overly long
|
|
entry.</p>
|
|
<p>A boundary error exists within http_get_m3u() in lib/http.c when
|
|
parsing a specially crafted m3u playlist containing an overly long
|
|
"File" entry.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-4829</cvename>
|
|
<url>http://secunia.com/secunia_research/2008-50/</url>
|
|
<url>http://streamripper.cvs.sourceforge.net/viewvc/streamripper/sripper_1x/CHANGES?revision=1.196</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-11-05</discovery>
|
|
<entry>2008-11-23</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="00d6040a-b8e0-11dd-a578-0030843d3802">
|
|
<topic>mantis -- session hijacking vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>mantis</name>
|
|
<range><lt>1.1.3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The mantis Team reports:</p>
|
|
<blockquote cite="http://www.mantisbt.org/bugs/changelog_page.php?version_id=97">
|
|
<p>When configuring a web application to use only ssl (e. g. by
|
|
forwarding all http-requests to https), a user would expect that
|
|
sniffing and hijacking the session is impossible.
|
|
Though, for this to be secure, one needs to set the session cookie to
|
|
have the secure flag. Else the cookie will be transferred through http
|
|
if the victim's browser does a single http-request on the same domain.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-3102</cvename>
|
|
<url>http://www.mantisbt.org/bugs/view.php?id=9524</url>
|
|
<url>http://www.mantisbt.org/bugs/view.php?id=9533</url>
|
|
<url>http://enablesecurity.com/2008/08/11/surf-jack-https-will-not-save-you/</url>
|
|
<url>http://int21.de/cve/CVE-2008-3102-mantis.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-10-14</discovery>
|
|
<entry>2008-11-22</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="75c24c1d-b688-11dd-88fd-001c2514716c">
|
|
<topic>dovecot -- ACL plugin bypass vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>dovecot</name>
|
|
<range><lt>1.1.4</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Timo Sirainen reports in dovecot 1.1.4 release notes:</p>
|
|
<blockquote cite="http://www.dovecot.org/list/dovecot-news/2008-October/000085.html">
|
|
<p>ACL plugin fixes: Negative rights were actually treated
|
|
as positive rights. 'k' right didn't prevent creating
|
|
parent/child/child mailbox. ACL groups weren't working.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>31587</bid>
|
|
<cvename>CVE-2008-4577</cvename>
|
|
<cvename>CVE-2008-4578</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-10-05</discovery>
|
|
<entry>2008-11-19</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="f1e0164e-b67b-11dd-a55e-00163e000016">
|
|
<topic>libxml2 -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>libxml2</name>
|
|
<range><lt>2.6.32_2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/Advisories/32773/">
|
|
<p>Two vulnerabilities have been reported in Libxml2, which can be
|
|
exploited by malicious people to cause a DoS (Denial of Service) or
|
|
to potentially compromise an application using the library.</p>
|
|
<p>1) An integer overflow error in the "xmlSAX2Characters()" function
|
|
can be exploited to trigger a memory corruption via a specially</p>
|
|
<p>Successful exploitation may allow execution of arbitrary code, but
|
|
requires e.g. that the user is tricked into processing an overly
|
|
large XML file (2GB or more).</p>
|
|
<p>2) An integer overflow error in the "xmlBufferResize()" function
|
|
can be exploited to trigger the execution of an infinite loop.
|
|
The vulnerabilities are reported in version 2.7.2.</p>
|
|
<p>Other versions may also be affected.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-4225</cvename>
|
|
<cvename>CVE-2008-4226</cvename>
|
|
<url>https://bugzilla.redhat.com/show_bug.cgi?id=470466</url>
|
|
<url>https://bugzilla.redhat.com/show_bug.cgi?id=470480</url>
|
|
<url>http://secunia.com/Advisories/32773/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-11-18</discovery>
|
|
<entry>2008-11-19</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="937adf01-b64a-11dd-a55e-00163e000016">
|
|
<topic>openfire -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>openfire</name>
|
|
<range><lt>3.6.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Andreas Kurtz reports:</p>
|
|
<blockquote cite="http://www.andreas-kurtz.de/advisories/AKADV2008-001-v1.0.txt">
|
|
<p>The jabber server Openfire (<= version 3.6.0a) contains several
|
|
serious vulnerabilities. Depending on the particular runtime
|
|
environment these issues can potentially even be used by an
|
|
attacker to execute code on operating system level.</p>
|
|
<ol>
|
|
<li>Authentication bypass - This vulnerability provides an attacker
|
|
full access to all functions in the admin webinterface without
|
|
providing any user credentials. The Tomcat filter which is
|
|
responsible for authentication could be completely
|
|
circumvented.</li>
|
|
<li>SQL injection - It is possible to pass SQL statements to the
|
|
backend database through a SQL injection vulnerability. Depending
|
|
on the particular runtime environment and database permissions it
|
|
is even possible to write files to disk and execute code on
|
|
operating system level.</li>
|
|
<li>Multiple Cross-Site Scripting - Permits arbitrary insertion
|
|
of HTML- and JavaScript code in login.jsp. An attacker could
|
|
also manipulate a parameter to specify a destination to which a
|
|
user will be forwarded to after successful authentication.</li>
|
|
</ol>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-6510</cvename>
|
|
<cvename>CVE-2008-6511</cvename>
|
|
<cvename>CVE-2008-6508</cvename>
|
|
<cvename>CVE-2009-1595</cvename>
|
|
<cvename>CVE-2008-1728</cvename>
|
|
<cvename>CVE-2008-6509</cvename>
|
|
<url>http://www.andreas-kurtz.de/advisories/AKADV2008-001-v1.0.txt</url>
|
|
<url>http://www.igniterealtime.org/builds/openfire/docs/latest/changelog.html</url>
|
|
<url>http://secunia.com/Advisories/32478/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-11-07</discovery>
|
|
<entry>2008-11-19</entry>
|
|
<modified>2010-05-02</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="75f2382e-b586-11dd-95f9-00e0815b8da8">
|
|
<topic>syslog-ng2 -- startup directory leakage in the chroot environment</topic>
|
|
<affects>
|
|
<package>
|
|
<name>syslog-ng2</name>
|
|
<range><lt>2.0.9_2</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>syslog-ng</name>
|
|
<range><le>1.6.12_1</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Florian Grandel reports:</p>
|
|
<blockquote cite="http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=505791">
|
|
<p>I have not had the time to analyze all of syslog-ng code.
|
|
But by reading the code section near the chroot call and looking
|
|
at strace results I believe that syslog-ng does not chdir to the
|
|
chroot jail's location before chrooting into it.</p>
|
|
<p>This opens up ways to work around the chroot jail.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-5110</cvename>
|
|
<url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=505791</url>
|
|
<url>http://www.openwall.com/lists/oss-security/2008/11/17/3</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-11-15</discovery>
|
|
<entry>2008-11-18</entry>
|
|
<modified>2009-07-01</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="a1126054-b57c-11dd-8892-0017319806e7">
|
|
<topic>enscript -- arbitrary code execution vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>enscript-a4</name>
|
|
<name>enscript-letter</name>
|
|
<name>enscript-letterdj</name>
|
|
<range><lt>1.6.4_2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Ulf Harnhammar of Secunia Research reports:</p>
|
|
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3863">
|
|
<p>Stack-based buffer overflow in the read_special_escape function
|
|
in src/psgen.c in GNU Enscript 1.6.1 and 1.6.4 beta, when the -e
|
|
(aka special escapes processing) option is enabled, allows
|
|
user-assisted remote attackers to execute arbitrary code via a
|
|
crafted ASCII file, related to the setfilename command.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-3863</cvename>
|
|
<cvename>CVE-2008-4306</cvename>
|
|
<url>http://secunia.com/secunia_research/2008-41/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-10-22</discovery>
|
|
<entry>2008-11-18</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="45298931-b3bf-11dd-80f8-001cc0377035">
|
|
<topic>gnutls -- X.509 certificate chain validation vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>gnutls</name>
|
|
<range><lt>2.4.2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>SecurityFocus reports:</p>
|
|
<blockquote cite="http://www.securityfocus.com/bid/32232/discuss">
|
|
<p>GnuTLS is prone to a security-bypass vulnerability because the
|
|
application fails to properly validate chained X.509 certificates.
|
|
Successfully exploiting this issue allows attackers to perform
|
|
man-in-the-middle attacks by impersonating trusted servers.
|
|
Unsuspecting users may be under a false sense of security that can
|
|
aid attackers in launching further attacks.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>32232</bid>
|
|
<cvename>CVE-2008-4989</cvename>
|
|
<url>http://www.gnu.org/software/gnutls/security.html</url>
|
|
<mlist msgid="4918143A.3050103@gmx.net">http://lists.gnu.org/archive/html/gnutls-devel/2008-11/msg00017.html</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-11-10</discovery>
|
|
<entry>2008-11-16</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="daf045d7-b211-11dd-a987-000c29ca8953">
|
|
<topic>net-snmp -- DoS for SNMP agent via crafted GETBULK request</topic>
|
|
<affects>
|
|
<package>
|
|
<name>net-snmp</name>
|
|
<range><gt>5.4</gt><lt>5.4.2.1</lt></range>
|
|
<range><gt>5.3</gt><lt>5.3.2.3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Wes Hardaker reports through sourceforge.net forum:</p>
|
|
<blockquote cite="http://sourceforge.net/forum/forum.php?forum_id=882903">
|
|
<p>SECURITY ISSUE: A bug in the getbulk handling code could
|
|
let anyone with even minimal access crash the agent. If you
|
|
have open access to your snmp agents (bad bad bad; stop doing
|
|
that!) or if you don't trust everyone that does have access to
|
|
your agents you should updated immediately to prevent
|
|
potential denial of service attacks.</p>
|
|
</blockquote>
|
|
<p>Description at cve.mitre.org additionally clarifies:</p>
|
|
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4309">
|
|
<p>Integer overflow in the netsnmp_create_subtree_cache
|
|
function in agent/snmp_agent.c in net-snmp 5.4 before
|
|
5.4.2.1, 5.3 before 5.3.2.3, and 5.2 before 5.2.5.1 allows
|
|
remote attackers to cause a denial of service (crash) via
|
|
a crafted SNMP GETBULK request, which triggers a heap-based
|
|
buffer overflow, related to the number of responses or
|
|
repeats.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-4309</cvename>
|
|
<url>http://sourceforge.net/forum/forum.php?forum_id=882903</url>
|
|
<url>http://www.openwall.com/lists/oss-security/2008/10/31/1</url>
|
|
<url>http://net-snmp.svn.sourceforge.net/viewvc/net-snmp/tags/Ext-5-2-5-1/net-snmp/agent/snmp_agent.c?r1=17271&r2=17272&pathrev=17272</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-10-12</discovery>
|
|
<entry>2008-11-14</entry>
|
|
<modified>2009-03-23</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="f29fea8f-b19f-11dd-a55e-00163e000016">
|
|
<topic>mozilla -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>firefox</name>
|
|
<range><lt>2.0.0.18,1</lt></range>
|
|
<range><gt>3.*,1</gt><lt>3.0.4,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-firefox</name>
|
|
<range><lt>2.0.0.18</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>seamonkey</name>
|
|
<name>linux-seamonkey</name>
|
|
<range><lt>1.1.13</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>thunderbird</name>
|
|
<name>linux-thunderbird</name>
|
|
<range><lt>2.0.0.18</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Mozilla Foundation reports:</p>
|
|
<blockquote cite="http://www.mozilla.org/security/announce/">
|
|
<p>MFSA 2008-58 Parsing error in E4X default namespace</p>
|
|
<p>MFSA 2008-57 -moz-binding property bypasses security checks on
|
|
codebase principals</p>
|
|
<p>MFSA 2008-56 nsXMLHttpRequest::NotifyEventListeners() same-origin
|
|
violation</p>
|
|
<p>MFSA 2008-55 Crash and remote code execution in
|
|
nsFrameManager</p>
|
|
<p>MFSA 2008-54 Buffer overflow in http-index-format parser</p>
|
|
<p>MFSA 2008-53 XSS and JavaScript privilege escalation via session
|
|
restore</p>
|
|
<p>MFSA 2008-52 Crashes with evidence of memory corruption
|
|
(rv:1.9.0.4/1.8.1.18)</p>
|
|
<p>MFSA 2008-51 file: URIs inherit chrome privileges when opened
|
|
from chrome</p>
|
|
<p>MFSA 2008-50 Crash and remote code execution via __proto__
|
|
tampering</p>
|
|
<p>MFSA 2008-49 Arbitrary code execution via Flash Player dynamic
|
|
module unloading</p>
|
|
<p>MFSA 2008-48 Image stealing via canvas and HTTP redirect</p>
|
|
<p>MFSA 2008-47 Information stealing via local shortcut files</p>
|
|
<p>MFSA 2008-46 Heap overflow when canceling newsgroup message</p>
|
|
<p>MFSA 2008-44 resource: traversal vulnerabilities</p>
|
|
<p>MFSA 2008-43 BOM characters stripped from JavaScript before
|
|
execution</p>
|
|
<p>MFSA 2008-42 Crashes with evidence of memory corruption
|
|
(rv:1.9.0.2/1.8.1.17)</p>
|
|
<p>MFSA 2008-41 Privilege escalation via XPCnativeWrapper
|
|
pollution</p>
|
|
<p>MFSA 2008-38 nsXMLDocument::OnChannelRedirect() same-origin
|
|
violation</p>
|
|
<p>MFSA 2008-37 UTF-8 URL stack buffer overflow</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-0017</cvename>
|
|
<cvename>CVE-2008-4582</cvename>
|
|
<cvename>CVE-2008-5012</cvename>
|
|
<cvename>CVE-2008-5013</cvename>
|
|
<cvename>CVE-2008-5014</cvename>
|
|
<cvename>CVE-2008-5015</cvename>
|
|
<cvename>CVE-2008-5016</cvename>
|
|
<cvename>CVE-2008-5017</cvename>
|
|
<cvename>CVE-2008-5018</cvename>
|
|
<cvename>CVE-2008-5019</cvename>
|
|
<cvename>CVE-2008-5021</cvename>
|
|
<cvename>CVE-2008-5022</cvename>
|
|
<cvename>CVE-2008-5023</cvename>
|
|
<cvename>CVE-2008-5024</cvename>
|
|
<url>http://www.mozilla.org/security/announce/2008/mfsa2008-47.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2008/mfsa2008-48.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2008/mfsa2008-49.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2008/mfsa2008-50.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2008/mfsa2008-51.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2008/mfsa2008-52.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2008/mfsa2008-53.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2008/mfsa2008-54.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2008/mfsa2008-55.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2008/mfsa2008-56.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2008/mfsa2008-57.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2008/mfsa2008-58.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-11-13</discovery>
|
|
<entry>2008-11-13</entry>
|
|
<modified>2008-11-23</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="445ed958-b0d9-11dd-a55e-00163e000016">
|
|
<topic>faad2 -- heap overflow vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>faad2</name>
|
|
<range><lt>2.6.1_1,1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>CVE reports:</p>
|
|
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4201">
|
|
<p>Heap-based buffer overflow in the decodeMP4file function
|
|
(frontend/main.c) in FAAD2 2.6.1 and earlier allows remote
|
|
attackers to cause a denial of service (crash) and possibly
|
|
execute arbitrary code via a crafted MPEG-4 (MP4) file.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-4201</cvename>
|
|
<url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=499899</url>
|
|
<url>http://www.gentoo.org/security/en/glsa/glsa-200811-03.xml</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-09-16</discovery>
|
|
<entry>2008-11-12</entry>
|
|
<modified>2008-11-13</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="66657bd5-ac92-11dd-b541-001f3b19d541">
|
|
<topic>emacs -- run-python vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>emacs</name>
|
|
<range><ge>22</ge><le>22.2_1</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Emacs developers report:</p>
|
|
<blockquote cite="http://lists.gnu.org/archive/html/emacs-devel/2008-09/msg00215.html">
|
|
<p>The Emacs command `run-python' launches an interactive
|
|
Python interpreter. After the Python process starts up,
|
|
Emacs automatically sends it the line:</p>
|
|
<p>import emacs</p>
|
|
<p>which normally imports a script named emacs.py which is
|
|
distributed with Emacs. This script, which is typically
|
|
located in a write-protected installation directory with
|
|
other Emacs program files, defines various functions to help
|
|
the Python process communicate with Emacs.</p>
|
|
<p>The vulnerability arises because Python, by default,
|
|
prepends '' to the module search path, so modules are looked
|
|
for in the current directory. If the current directory is
|
|
world-writable, an attacker may insert malicious code by
|
|
adding a fake Python module named emacs.py into that
|
|
directory.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-3949</cvename>
|
|
<url>http://lists.gnu.org/archive/html/emacs-devel/2008-09/msg00215.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-09-05</discovery>
|
|
<entry>2008-11-07</entry>
|
|
<modified>2010-05-02</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="24b64fb0-af1d-11dd-8a16-001b1116b350">
|
|
<topic>clamav -- off-by-one heap overflow in VBA project parser</topic>
|
|
<affects>
|
|
<package>
|
|
<name>clamav</name>
|
|
<range><lt>0.94.1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>clamav-devel</name>
|
|
<range><lt>20081105</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Advisory from Moritz Jodeit, November 8th, 2008:</p>
|
|
<blockquote cite="http://www.securityfocus.com/archive/1/498169/30/0/threaded">
|
|
<p>ClamAV contains an off-by-one heap overflow vulnerability
|
|
in the code responsible for parsing VBA project files.
|
|
Successful exploitation could allow an attacker to execute
|
|
arbitrary code with the privileges of the `clamd' process by
|
|
sending an email with a prepared attachment.</p>
|
|
<p>A VBA project file embedded inside an OLE2 office document
|
|
send as an attachment can trigger the off-by-one.</p>
|
|
</blockquote>
|
|
<p>Entry from Thu Oct 30 13:52:42 CET 2008 (acab) in ChangeLog:</p>
|
|
<blockquote cite="http://svn.clamav.net/svn/clamav-devel/trunk/ChangeLog">
|
|
<p>libclamav/vba_extract.c: get_unicode_name off-by-one,
|
|
bb#1239 reported by Moritz Jodeit >moritz*jodeit.org<</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://www.securityfocus.com/archive/1/498169/30/0/threaded</url>
|
|
<url>http://svn.clamav.net/svn/clamav-devel/trunk/ChangeLog</url>
|
|
<cvename>CVE-2008-5050</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-11-08</discovery>
|
|
<entry>2008-11-10</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="c89a3ebb-ae07-11dd-b4b2-001f3c8eabeb">
|
|
<topic>trac -- potential DOS vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>trac</name>
|
|
<range><lt>0.11.2</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>ja-trac</name>
|
|
<range><lt>0.11.2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Trac development team reports:</p>
|
|
<blockquote cite="http://groups.google.com/group/trac-announce/browse_thread/thread/67f7a22ec818d97d">
|
|
<p>0.11.2 is a new stable maintenance release. It contains
|
|
several security fixes and everyone is recommended to
|
|
upgrade their installations.</p>
|
|
<p>Bug fixes:</p>
|
|
<p>Fixes potential DOS vulnerability with certain wiki markup.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://groups.google.com/group/trac-announce/browse_thread/thread/67f7a22ec818d97d</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-11-08</discovery>
|
|
<entry>2008-11-09</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="4b09378e-addb-11dd-a578-0030843d3802">
|
|
<topic>vlc -- cue processing stack overflow</topic>
|
|
<affects>
|
|
<package>
|
|
<name>vlc</name>
|
|
<range><lt>0.8.6.i_2,2</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>vlc-devel</name>
|
|
<range><lt>0.9.6,3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The VLC Team reports:</p>
|
|
<blockquote cite="http://www.videolan.org/security/sa0810.html">
|
|
<p>The VLC media player contains a stack overflow vulnerability
|
|
while parsing malformed cue files. The vulnerability may be
|
|
exploited by a (remote) attacker to execute arbitrary code in
|
|
the context of VLC media player.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-5032</cvename>
|
|
<cvename>CVE-2008-5036</cvename>
|
|
<url>http://www.videolan.org/security/sa0810.html</url>
|
|
<url>http://www.trapkit.de/advisories/TKADV2008-012.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-11-05</discovery>
|
|
<entry>2008-11-08</entry>
|
|
<modified>2010-05-02</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="0e30e802-a9db-11dd-93a2-000bcdf0a03b">
|
|
<topic>opera -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>opera</name>
|
|
<name>linux-opera</name>
|
|
<range><lt>9.62</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Opera reports:</p>
|
|
<blockquote cite="http://www.opera.com/support/search/view/906/">
|
|
<p>When certain parameters are passed to Opera's History
|
|
Search, they can cause content not to be correctly
|
|
sanitized. This can allow scripts to be injected into the
|
|
History Search results page. Such scripts can then run with
|
|
elevated privileges and interact with Opera's configuration,
|
|
allowing them to execute arbitrary code.</p>
|
|
</blockquote>
|
|
<blockquote cite="http://www.opera.com/support/search/view/907/">
|
|
<p>The links panel shows links in all frames on the current
|
|
page, including links with JavaScript URLs. When a page is
|
|
held in a frame, the script is incorrectly executed on the
|
|
outermost page, not the page where the URL was located.
|
|
This can be used to execute scripts in the context of an
|
|
unrelated frame, which allows cross-site scripting.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-4794</cvename>
|
|
<url>http://www.opera.com/support/search/view/906/</url>
|
|
<url>http://www.opera.com/support/search/view/907/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-11-03</discovery>
|
|
<entry>2008-11-03</entry>
|
|
<modified>2010-05-02</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="07bb3bd2-a920-11dd-8503-0211060005df">
|
|
<topic>qemu -- Heap overflow in Cirrus emulation</topic>
|
|
<affects>
|
|
<package>
|
|
<name>qemu</name>
|
|
<name>qemu-devel</name>
|
|
<range><lt>0.9.1_10</lt></range>
|
|
<range><ge>0.9.1s.20080101*</ge><lt>0.9.1s.20080620_2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Aurelien Jarno reports:</p>
|
|
<blockquote cite="http://lists.gnu.org/archive/html/qemu-devel/2008-10/msg01363.html">
|
|
<p>CVE-2008-4539: fix a heap overflow in Cirrus emulation</p>
|
|
<p>The code in hw/cirrus_vga.c has changed a lot between
|
|
CVE-2007-1320 has been announced and the patch has been applied.
|
|
As a consequence it has wrongly applied and QEMU is still
|
|
vulnerable to this bug if using VNC.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-4539</cvename>
|
|
<mlist msgid="E1Kw4kF-0001Mx-KA@cvs.savannah.gnu.org">http://lists.gnu.org/archive/html/qemu-devel/2008-10/msg01363.html</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-11-01</discovery>
|
|
<entry>2008-11-02</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="85b0bbc8-a7a5-11dd-8283-001c2514716c">
|
|
<topic>phpmyadmin -- Cross-Site Scripting Vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>phpMyAdmin</name>
|
|
<range><gt>3.0</gt><lt>3.0.1.1</lt></range>
|
|
<range><lt>2.11.9.3</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>phpMyAdmin211</name>
|
|
<range><lt>2.11.9.3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>SecurityFocus reports:</p>
|
|
<blockquote cite="http://www.securityfocus.com/bid/31928">
|
|
<p>phpMyAdmin is prone to a cross-site scripting vulnerability
|
|
because it fails to sufficiently sanitize user-supplied data.</p>
|
|
<p>An attacker may leverage this issue to execute arbitrary
|
|
script code in the browser of an unsuspecting user in the
|
|
context of the affected site. This may allow the attacker
|
|
to steal cookie-based authentication credentials and to
|
|
launch other attacks.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>31928</bid>
|
|
<url>http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-9</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-10-30</discovery>
|
|
<entry>2008-10-31</entry>
|
|
<modified>2008-10-31</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="f5c4d7f7-9f4b-11dd-bab1-001999392805">
|
|
<topic>opera -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>opera</name>
|
|
<name>linux-opera</name>
|
|
<range><lt>9.61</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Opera reports:</p>
|
|
<blockquote cite="http://www.opera.com/support/search/view/903/">
|
|
<p>Certain constructs are not escaped correctly by Opera's
|
|
History Search results. These can be used to inject scripts
|
|
into the page, which can then be used to look through the user's
|
|
browsing history, including the contents of the pages they have
|
|
visited. These may contain sensitive information.</p>
|
|
</blockquote>
|
|
<blockquote cite="http://www.opera.com/support/search/view/904/">
|
|
<p>If a link that uses a JavaScript URL triggers Opera's Fast
|
|
Forward feature, when the user activates Fast Forward, the
|
|
script should run on the current page. When a page is held in a
|
|
frame, the script is incorrectly executed on the outermost page,
|
|
not the page where the URL was located. This can be used to
|
|
execute scripts in the context of an unrelated frame, which
|
|
allows cross-site scripting.</p>
|
|
</blockquote>
|
|
<blockquote cite="http://www.opera.com/support/search/view/905/">
|
|
<p>When Opera is previewing a news feed, some scripts are not
|
|
correctly blocked. These scripts are able to subscribe the user
|
|
to any feed URL that the attacker chooses, and can also view
|
|
the contents of any feeds that the user is subscribed to.
|
|
These may contain sensitive information.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-4697</cvename>
|
|
<cvename>CVE-2008-4698</cvename>
|
|
<cvename>CVE-2008-4725</cvename>
|
|
<url>http://www.opera.com/support/search/view/903/</url>
|
|
<url>http://www.opera.com/support/search/view/904/</url>
|
|
<url>http://www.opera.com/support/search/view/905/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-10-17</discovery>
|
|
<entry>2008-10-28</entry>
|
|
<modified>2010-05-02</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="2ddbfd29-a455-11dd-a55e-00163e000016">
|
|
<topic>libspf2 -- Buffer overflow</topic>
|
|
<affects>
|
|
<package>
|
|
<name>libspf2</name>
|
|
<range><lt>1.2.8</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>CVE reports:</p>
|
|
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2469">
|
|
<p>Heap-based buffer overflow in the SPF_dns_resolv_lookup function
|
|
in Spf_dns_resolv.c in libspf2 before 1.2.8 allows remote attackers
|
|
to execute arbitrary code via a long DNS TXT record with a modified
|
|
length field.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>31881</bid>
|
|
<cvename>CVE-2008-2469</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-10-21</discovery>
|
|
<entry>2008-10-27</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="55616fda-a2d0-11dd-a9f9-0030843d3802">
|
|
<topic>openx -- sql injection vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>openx</name>
|
|
<range><lt>2.6.2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/32114/">
|
|
<p>OpenX can be exploited by malicious people to conduct SQL injection
|
|
attacks.</p>
|
|
<p>Input passed to the "bannerid" parameter in www/delivery/ac.php is
|
|
not properly sanitised before being used in SQL queries. This can be
|
|
exploited to manipulate SQL queries by injecting arbitrary SQL
|
|
code.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://secunia.com/advisories/32114/</url>
|
|
<url>http://blog.openx.org/10/openx-security-update/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-10-03</discovery>
|
|
<entry>2008-10-25</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="9d3020e4-a2c4-11dd-a9f9-0030843d3802">
|
|
<topic>flyspray -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>flyspray</name>
|
|
<range><lt>0.9.9.5.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Flyspray Project reports:</p>
|
|
<blockquote cite="http://www.flyspray.org/fsa:2">
|
|
<p>Flyspray is affected by a Cross Site scripting Vulnerability
|
|
due to an error escaping PHP's $_SERVER['QUERY_STRING']
|
|
superglobal, that can be maliciously used to inject
|
|
arbitrary code into the savesearch() javascript function.</p>
|
|
<p>There is an XSS problem in the history tab, the application
|
|
fails to sanitize the "details" parameter correctly, leading
|
|
to the possibility of arbitrary code injection into the
|
|
getHistory() javascript function.</p>
|
|
</blockquote>
|
|
<blockquote cite="http://www.flyspray.org/fsa:3">
|
|
<p>Flyspray is affected by a Cross Site scripting Vulnerability
|
|
due missing escaping of SQL error messages. By including HTML
|
|
code in a query and at the same time causing it to fail by
|
|
submitting invalid data, an XSS hole can be exploited.</p>
|
|
<p>There is an XSS problem in the task history attached to
|
|
comments, since the application fails to sanitize the
|
|
old_value and new_value database fields for changed task
|
|
summaries.</p>
|
|
</blockquote>
|
|
<blockquote cite="http://secunia.com/advisories/29215">
|
|
<p>Input passed via the "item_summary" parameter to
|
|
"index.php?do=details" is not properly sanitised before being
|
|
returned to the user. This can be exploited to execute arbitrary
|
|
HTML and script code in a user's browser session in context of
|
|
an affected site.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2007-6461</cvename>
|
|
<cvename>CVE-2008-1165</cvename>
|
|
<cvename>CVE-2008-1166</cvename>
|
|
<url>http://secunia.com/advisories/29215</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-02-24</discovery>
|
|
<entry>2008-10-25</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="3a4a3e9c-a1fe-11dd-81be-001c2514716c">
|
|
<topic>wordpress -- snoopy "_httpsrequest()" shell command execution vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>wordpress</name>
|
|
<name>de-wordpress</name>
|
|
<name>wordpress-mu</name>
|
|
<range><lt>2.6.3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Wordpress development team reports:</p>
|
|
<blockquote cite="http://wordpress.org/development/2008/10/wordpress-263/">
|
|
<p>A <a href="http://secunia.com/Advisories/32361/">vulnerability</a>
|
|
in the <a href="http://sourceforge.net/projects/snoopy/">Snoopy</a>
|
|
library was announced today. WordPress uses Snoopy to fetch the feeds
|
|
shown in the Dashboard. Although this seems to be a low risk
|
|
vulnerability for WordPress users, we wanted to get an update out
|
|
immediately.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>31887</bid>
|
|
<url>http://secunia.com/Advisories/32361/</url>
|
|
<url>http://wordpress.org/development/2008/10/wordpress-263/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-10-23</discovery>
|
|
<entry>2008-10-24</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="706c9eef-a077-11dd-b413-001372fd0af2">
|
|
<topic>drupal -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>drupal5</name>
|
|
<range><lt>5.12</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>drupal6</name>
|
|
<range><lt>6.6</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Drupal Project reports:</p>
|
|
<blockquote cite="http://drupal.org/node/324824">
|
|
<p>On a server configured for IP-based virtual hosts, Drupal may be
|
|
caused to include and execute specifically named files outside
|
|
of its root directory. This bug affects both Drupal 5 and
|
|
Drupal 6.</p>
|
|
<p>The title of book pages is not always properly escaped, enabling
|
|
users with the "create book content" permission or the
|
|
permission to edit any node in the book hierarchy to insert
|
|
arbitrary HTML and script code into pages. Such a Cross site
|
|
scripting attack may lead to the attacker gaining administrator
|
|
access. This bug affects Drupal 6.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-6170</cvename>
|
|
<url>http://drupal.org/node/324824</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-10-22</discovery>
|
|
<entry>2008-10-22</entry>
|
|
<modified>2010-05-12</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="06eac338-9ddf-11dd-813f-000e35248ad7">
|
|
<topic>libxine -- denial of service vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>libxine</name>
|
|
<range><lt>1.1.15</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>xine team reports:</p>
|
|
<blockquote cite="http://www.xinehq.de/index.php/news">
|
|
<p>A new xine-lib version is now available. This release contains
|
|
some security fixes, notably a DoS via corrupted Ogg files
|
|
(CVE-2008-3231), some related fixes, and fixes for a few possible
|
|
buffer overflows.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-3231</cvename>
|
|
<url>http://www.xinehq.de/index.php/news</url>
|
|
<url>http://xforce.iss.net/xforce/xfdb/44040</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-07-13</discovery>
|
|
<entry>2008-10-19</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="78f456fd-9c87-11dd-a55e-00163e000016">
|
|
<topic>linux-flashplugin -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>linux-flashplugin</name>
|
|
<range><le>9.0r124_1</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Adobe Product Security Incident Response Team reports:</p>
|
|
<blockquote cite="http://www.adobe.com/support/security/bulletins/apsb08-18.html">
|
|
<p>Potential vulnerabilities have been identified in Adobe Flash
|
|
Player 9.0.124.0 and earlier that could allow an attacker who
|
|
successfully exploits these potential vulnerabilities to bypass
|
|
Flash Player security controls. Adobe recommends users update
|
|
to the most current version of Flash Player available for their
|
|
platform.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2007-6243</cvename>
|
|
<cvename>CVE-2008-3873</cvename>
|
|
<cvename>CVE-2007-4324</cvename>
|
|
<cvename>CVE-2008-4401</cvename>
|
|
<cvename>CVE-2008-4503</cvename>
|
|
<url>http://www.adobe.com/support/security/bulletins/apsb08-18.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-10-15</discovery>
|
|
<entry>2008-10-17</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="d71da236-9a94-11dd-8f42-001c2514716c">
|
|
<topic>libxml2 -- two vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>libxml2</name>
|
|
<range><lt>2.6.32_1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/31558/">
|
|
<p>Two vulnerabilities have been reported in Libxml2, which can be
|
|
exploited by malicious people to cause a DoS (Denial of Service)
|
|
or potentially compromise an application using the library.</p>
|
|
<p>1) A recursion error exists when processing certain XML content.
|
|
This can be exploited to e.g. exhaust all available memory and CPU
|
|
resources by tricking an application using Libxml2 into processing
|
|
specially crafted XML documents.</p>
|
|
<p>2) A boundary error in the processing of long XML entity names
|
|
in parser.c can be exploited to cause a heap-based buffer overflow
|
|
when specially crafted XML content is parsed.</p>
|
|
<p>Successful exploitation may allow execution of arbitrary code.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-3281</cvename>
|
|
<cvename>CVE-2008-3529</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-08-22</discovery>
|
|
<entry>2008-10-15</entry>
|
|
<modified>2008-10-20</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="12efc567-9879-11dd-a5e7-0030843d3802">
|
|
<topic>drupal -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>drupal5</name>
|
|
<range><lt>5.11</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>drupal6</name>
|
|
<range><lt>6.5</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Drupal Project reports:</p>
|
|
<blockquote cite="http://drupal.org/node/318706">
|
|
<p>A logic error in the core upload module validation allowed
|
|
unprivileged users to attach files to content. Users can view files
|
|
attached to content which they do not otherwise have access to.
|
|
If the core upload module is not enabled, your site will not be
|
|
affected.</p>
|
|
<p>A deficiency in the user module allowed users who had been blocked
|
|
by access rules to continue logging into the site under certain
|
|
conditions. If you do not use the 'access rules' functionality in core,
|
|
your site will not be affected.</p>
|
|
<p>The BlogAPI module does not implement correct validation for
|
|
certain content fields, allowing for values to be set for fields which
|
|
would otherwise be inaccessible on an internal Drupal form. We have
|
|
hardened these checks in BlogAPI module for this release, but the
|
|
security team would like to re-iterate that the 'Administer content
|
|
with BlogAPI' permission should only be given to trusted users.
|
|
If the core BlogAPI module is not enabled, your site will not be
|
|
affected.</p>
|
|
<p>A weakness in the node module API allowed for node validation to be
|
|
bypassed in certain circumstances for contributed modules implementing
|
|
the API. Additional checks have been added to ensure that validation
|
|
is performed in all cases. This vulnerability only affects sites using
|
|
one of a very small number of contributed modules, all of which will
|
|
continue to work correctly with the improved API. None of them were
|
|
found vulnerable, so our correction is a preventative measure.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-4791</cvename>
|
|
<cvename>CVE-2008-4792</cvename>
|
|
<cvename>CVE-2008-4793</cvename>
|
|
<url>http://drupal.org/node/318706</url>
|
|
<url>http://secunia.com/advisories/32200/</url>
|
|
<url>http://secunia.com/advisories/32201/</url>
|
|
<url>http://secunia.com/advisories/32198/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-10-08</discovery>
|
|
<entry>2008-10-12</entry>
|
|
<modified>2010-05-12</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="ce29ce1d-971a-11dd-ab7e-001c2514716c">
|
|
<topic>cups -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>cups-base</name>
|
|
<range><lt>1.3.9</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The release note of cups 1.3.9 reports:</p>
|
|
<blockquote cite="http://cups.org/articles.php?L575">
|
|
<p>It contains the following fixes:</p>
|
|
<ul>
|
|
<li>SECURITY: The HP-GL/2 filter did not range check
|
|
pen numbers (STR #2911)</li>
|
|
<li>SECURITY: The SGI image file reader did not range
|
|
check 16-bit run lengths (STR #2918)</li>
|
|
<li>SECURITY: The text filter did not range check cpi,
|
|
lpi, or column values (STR #2919)</li>
|
|
</ul>
|
|
</blockquote>
|
|
<p>Exploitation of this vulnerability results in the execution
|
|
of arbitrary code with the privileges of the affected service.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-3639</cvename>
|
|
<cvename>CVE-2008-3640</cvename>
|
|
<cvename>CVE-2008-3641</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-10-09</discovery>
|
|
<entry>2008-10-10</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="fb84d5dd-9528-11dd-9a00-001999392805">
|
|
<topic>opera -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>opera</name>
|
|
<name>linux-opera</name>
|
|
<range><lt>9.60</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Opera reports:</p>
|
|
<blockquote cite="http://www.opera.com/support/search/view/901/">
|
|
<p>If a malicious page redirects Opera to a specially crafted
|
|
address (URL), it can cause Opera to crash. Given sufficient
|
|
address content, the crash could cause execution of code
|
|
controlled by the attacking page.</p>
|
|
</blockquote>
|
|
<blockquote cite="http://www.opera.com/support/search/view/902/">
|
|
<p>Once a Java applet has been cached, if a page can predict the
|
|
cache path for that applet, it can load the applet from the
|
|
cache, causing it to run in the context of the local machine.
|
|
This allows it to read other cache files on the computer or
|
|
perform other normally more restrictive actions. These files
|
|
could contain sensitive information, which could then be sent
|
|
to the attacker.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-4695</cvename>
|
|
<cvename>CVE-2008-4694</cvename>
|
|
<url>http://www.opera.com/support/search/view/901/</url>
|
|
<url>http://www.opera.com/support/search/view/902/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-10-04</discovery>
|
|
<entry>2008-10-10</entry>
|
|
<modified>2010-05-12</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="4775c807-8f30-11dd-821f-001cc0377035">
|
|
<topic>mysql -- command line client input validation vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>mysql-client</name>
|
|
<range><gt>5.1</gt><lt>5.1.28_1</lt></range>
|
|
<range><gt>5.0</gt><lt>5.0.67_1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Thomas Henlich reports:</p>
|
|
<blockquote cite="http://www.henlich.de/it-security/mysql-command-line-client-html-injection-vulnerability/">
|
|
<p>The mysql command-line client does not quote HTML special
|
|
characters like < in its output. This allows an attacker who
|
|
is able to write data into a table to hide or modify records in
|
|
the output, and to inject potentially dangerous code, e. g.
|
|
Javascript to perform cross-site scripting or cross-site request
|
|
forgery attacks.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>31486</bid>
|
|
<url>http://www.henlich.de/it-security/mysql-command-line-client-html-injection-vulnerability/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-04-17</discovery>
|
|
<entry>2008-10-01</entry>
|
|
<modified>2008-10-10</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="724e6f93-8f2a-11dd-821f-001cc0377035">
|
|
<topic>mplayer -- multiple integer overflows</topic>
|
|
<affects>
|
|
<package>
|
|
<name>mplayer</name>
|
|
<name>mplayer-esound</name>
|
|
<name>mplayer-gtk</name>
|
|
<name>mplayer-gtk2</name>
|
|
<name>mplayer-gtk-esound</name>
|
|
<name>mplayer-gtk2-esound</name>
|
|
<range><lt>0.99.11_7</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The oCERT team reports:</p>
|
|
<blockquote cite="http://www.ocert.org/advisories/ocert-2008-013.html">
|
|
<p>The MPlayer multimedia player suffers from a vulnerability which
|
|
could result in arbitrary code execution and at the least, in
|
|
unexpected process termination. Three integer underflows located
|
|
in the Real demuxer code can be used to exploit a heap overflow,
|
|
a specific video file can be crafted in order to make the
|
|
stream_read function reading or writing arbitrary amounts of
|
|
memory.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-3827</cvename>
|
|
<url>http://www.ocert.org/advisories/ocert-2008-013.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-09-30</discovery>
|
|
<entry>2008-10-01</entry>
|
|
<modified>2008-10-02</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="fb911e31-8ceb-11dd-bb29-000c6e274733">
|
|
<topic>lighttpd -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>lighttpd</name>
|
|
<range><lt>1.4.19_3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Lighttpd seurity annoucement:</p>
|
|
<blockquote cite="http://www.lighttpd.net/security/lighttpd_sa_2008_05.txt">
|
|
<p>lighttpd 1.4.19, and possibly other versions before 1.5.0, does
|
|
not decode the url before matching against rewrite and redirect
|
|
patterns, which allows attackers to bypass rewrites rules. this
|
|
can be a security problem in certain configurations if these rules
|
|
are used to hide certain urls.</p>
|
|
</blockquote>
|
|
<blockquote cite="http://www.lighttpd.net/security/lighttpd_sa_2008_06.txt">
|
|
<p>lighttpd 1.4.19, and possibly other versions before 1.5.0, does
|
|
not lowercase the filename after generating it from the url in
|
|
mod_userdir on case insensitive (file)systems.</p>
|
|
<p>As other modules are case sensitive, this may lead to information
|
|
disclosure; for example if one configured php to handle files
|
|
ending on ".php", an attacker will get the php source with
|
|
http://example.com/~user/file.PHP</p>
|
|
</blockquote>
|
|
<blockquote cite="http://www.lighttpd.net/security/lighttpd_sa_2008_07.txt">
|
|
<p>lighttpd 1.4.19 does not always release a header if it triggered
|
|
a 400 (Bad Request) due to a duplicate header.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>31434</bid>
|
|
<cvename>CVE-2008-4298</cvename>
|
|
<cvename>CVE-2008-4359</cvename>
|
|
<cvename>CVE-2008-4360</cvename>
|
|
<url>http://www.lighttpd.net/security/lighttpd_sa_2008_05.txt</url>
|
|
<url>http://www.lighttpd.net/security/lighttpd_sa_2008_06.txt</url>
|
|
<url>http://www.lighttpd.net/security/lighttpd_sa_2008_07.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-09-26</discovery>
|
|
<entry>2008-09-27</entry>
|
|
<modified>2009-02-22</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="24ec781b-8c11-11dd-9923-0016d325a0ed">
|
|
<topic>bitlbee -- account recreation security issues</topic>
|
|
<affects>
|
|
<package>
|
|
<name>bitlbee</name>
|
|
<range><lt>1.2.3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/31633/">
|
|
<p>Some security issues have been reported in BitlBee, which can
|
|
be exploited by malicious people to bypass certain security
|
|
restrictions and hijack accounts.</p>
|
|
<p>The security issues are caused due to unspecified errors, which
|
|
can be exploited to overwrite existing accounts.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-3920</cvename>
|
|
<cvename>CVE-2008-3969</cvename>
|
|
<url>http://secunia.com/advisories/31633/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-08-27</discovery>
|
|
<entry>2008-09-26</entry>
|
|
<modified>2008-10-03</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="2273879e-8a2f-11dd-a6fe-0030843d3802">
|
|
<topic>mozilla -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>firefox</name>
|
|
<range><lt>2.0.0.17,1</lt></range>
|
|
<range><gt>3.*,1</gt><lt>3.0.2,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-firefox</name>
|
|
<name>linux-firefox-devel</name>
|
|
<range><lt>2.0.0.17</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>seamonkey</name>
|
|
<name>linux-seamonkey</name>
|
|
<range><lt>1.1.12</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>thunderbird</name>
|
|
<name>linux-thunderbird</name>
|
|
<range><lt>2.0.0.17</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>flock</name>
|
|
<name>linux-flock</name>
|
|
<range><lt>2.0</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-seamonkey-devel</name>
|
|
<range><gt>0</gt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Mozilla Foundation reports:</p>
|
|
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
|
|
<p>MFSA 2008-37<br/>UTF-8 URL stack buffer overflow</p>
|
|
<p>MFSA 2008-38<br/>nsXMLDocument::OnChannelRedirect() same-origin
|
|
violation</p>
|
|
<p>MFSA 2008-39<br/>Privilege escalation using feed preview page and
|
|
XSS flaw</p>
|
|
<p>MFSA 2008-40<br/>Forced mouse drag</p>
|
|
<p>MFSA 2008-41<br/>Privilege escalation via XPCnativeWrapper
|
|
pollution</p>
|
|
<p>MFSA 2008-42<br/>Crashes with evidence of memory corruption
|
|
(rv:1.9.0.2/1.8.1.17)</p>
|
|
<p>MFSA 2008-43<br/>BOM characters stripped from JavaScript before
|
|
execution</p>
|
|
<p>MFSA 2008-44<br/>resource: traversal vulnerabilities</p>
|
|
<p>MFSA 2008-45<br/>XBM image uninitialized memory reading</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-0016</cvename>
|
|
<cvename>CVE-2008-3835</cvename>
|
|
<cvename>CVE-2008-3836</cvename>
|
|
<cvename>CVE-2008-3837</cvename>
|
|
<cvename>CVE-2008-4058</cvename>
|
|
<cvename>CVE-2008-4059</cvename>
|
|
<cvename>CVE-2008-4060</cvename>
|
|
<cvename>CVE-2008-4061</cvename>
|
|
<cvename>CVE-2008-4062</cvename>
|
|
<cvename>CVE-2008-4063</cvename>
|
|
<cvename>CVE-2008-4064</cvename>
|
|
<cvename>CVE-2008-4065</cvename>
|
|
<cvename>CVE-2008-4067</cvename>
|
|
<cvename>CVE-2008-4068</cvename>
|
|
<cvename>CVE-2008-4069</cvename>
|
|
<url>http://www.mozilla.org/security/announce/2008/mfsa2008-37.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2008/mfsa2008-38.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2008/mfsa2008-39.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2008/mfsa2008-40.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2008/mfsa2008-41.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2008/mfsa2008-42.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2008/mfsa2008-43.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2008/mfsa2008-44.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2008/mfsa2008-45.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-09-24</discovery>
|
|
<entry>2008-09-24</entry>
|
|
<modified>2009-12-12</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="a0afb4b9-89a1-11dd-a65b-00163e000016">
|
|
<topic>squirrelmail -- Session hijacking vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>squirrelmail</name>
|
|
<range><le>1.4.15_1</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Hanno Boeck reports:</p>
|
|
<blockquote cite="http://seclists.org/bugtraq/2008/Sep/0239.html">
|
|
<p>When configuring a web application to use only ssl (e.g. by
|
|
forwarding all http-requests to https), a user would expect that
|
|
sniffing and hijacking the session is impossible.</p>
|
|
<p>Though, for this to be secure, one needs to set the session
|
|
cookie to have the secure flag. Otherwise the cookie will be
|
|
transferred through HTTP if the victim's browser does a single
|
|
HTTP request on the same domain.</p>
|
|
<p>Squirrelmail does not set that flag. It is fixed in the 1.5
|
|
test versions, but current 1.4.15 is vulnerable.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>31321</bid>
|
|
<cvename>CVE-2008-3663</cvename>
|
|
<mlist>http://seclists.org/bugtraq/2008/Sep/0239.html</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-08-12</discovery>
|
|
<entry>2008-09-23</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="0f51f2c9-8956-11dd-a6fe-0030843d3802">
|
|
<topic>proftpd -- Long Command Processing Vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>proftpd</name>
|
|
<name>proftpd-mysql</name>
|
|
<range><lt>1.3.2rc2</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>proftpd-devel</name>
|
|
<range><lt>1.3.20080922</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/31930/">
|
|
<p>The vulnerability is caused due to the application truncating an
|
|
overly long FTP command, and improperly interpreting the remainder
|
|
string as a new FTP command. This can be exploited to execute
|
|
arbitrary FTP commands with the privileges of another user by e.g.
|
|
tricking the user into following malicious link.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-4242</cvename>
|
|
<cvename>CVE-2008-4247</cvename>
|
|
<url>http://secunia.com/advisories/31930/</url>
|
|
<url>http://bugs.proftpd.org/show_bug.cgi?id=3115</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-09-22</discovery>
|
|
<entry>2008-09-23</entry>
|
|
<modified>2010-05-12</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="150e4548-8950-11dd-a6fe-0030843d3802">
|
|
<topic>phpmyadmin -- Cross-Site Scripting Vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>phpMyAdmin</name>
|
|
<range><lt>2.11.9.2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/Advisories/31974/">
|
|
<p>An error exists in the "PMA_escapeJsString()" function in
|
|
libraries/js_escape.lib.php, which can be exploited to bypass
|
|
certain filters and execute arbitrary HTML and script code in a
|
|
user's browser session in context of an affected site when e.g.
|
|
Microsoft Internet Explorer is used.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://secunia.com/Advisories/31974/</url>
|
|
<url>http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-8</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-09-23</discovery>
|
|
<entry>2008-09-23</entry>
|
|
<modified>2008-10-03</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="fc9e73b2-8685-11dd-bb64-0030843d3802">
|
|
<topic>gallery -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>gallery</name>
|
|
<range><lt>1.5.9</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>gallery2</name>
|
|
<range><lt>2.2.6</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/31912/">
|
|
<p>An error in the handing of ZIP archives with symbolic links can be
|
|
exploited to disclose the contents of arbitrary files.</p>
|
|
</blockquote>
|
|
<blockquote cite="http://secunia.com/advisories/31858/">
|
|
<p>Input from uploaded Flash animations is not properly sanitised
|
|
before being used. This can be exploited to insert arbitrary HTML and
|
|
script code, which is executed in a user's browser session in context
|
|
of an affected site when the malicious data is viewed.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://secunia.com/advisories/31912/</url>
|
|
<url>http://secunia.com/advisories/31858/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-09-18</discovery>
|
|
<entry>2008-09-19</entry>
|
|
<modified>2008-10-03</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="74bf1594-8493-11dd-bb64-0030843d3802">
|
|
<topic>phpmyadmin -- Code execution vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>phpMyAdmin</name>
|
|
<range><lt>2.11.9.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A phpMyAdmin security announcement:</p>
|
|
<blockquote cite="http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-7">
|
|
<p>The server_databases.php script was vulnerable to an attack coming
|
|
from a user who is already logged-on to phpMyAdmin, where he can
|
|
execute shell code (if the PHP configuration permits commands like
|
|
exec).</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-4096</cvename>
|
|
<url>http://secunia.com/Advisories/31884/</url>
|
|
<url>http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-7</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-09-15</discovery>
|
|
<entry>2008-09-17</entry>
|
|
<modified>2010-05-12</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="9227dcaf-827f-11dd-9cd7-0050568452ac">
|
|
<topic>twiki -- Arbitrary code execution in session files</topic>
|
|
<affects>
|
|
<package>
|
|
<name>twiki</name>
|
|
<range><lt>4.2.3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Th1nk3r reports:</p>
|
|
<blockquote cite="http://www.milw0rm.com/exploits/6269">
|
|
<p>The version of TWiki installed on the remote host allows access to
|
|
the 'configure' script and fails to sanitize the 'image' parameter
|
|
of that script of directory traversal sequences before returning the
|
|
file contents when the 'action' parameter is set to 'image'. An
|
|
unauthenticated attacker can leverage this issue to view arbitrary
|
|
files on the remote host subject to the privileges of the web server
|
|
user id. .</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-3195</cvename>
|
|
<url>http://twiki.org/cgi-bin/view/Codev/SecurityAlert-CVE-2008-3195</url>
|
|
<url>http://www.kb.cert.org/vuls/id/362012</url>
|
|
<url>https://inspectit.accessitgroup.com/threats/details.cgi?id=34031</url>
|
|
<url>http://www.nessus.org/plugins/index.php?view=single&id=34031</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-08-05</discovery>
|
|
<entry>2008-09-14</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="755fa519-80a9-11dd-8de5-0030843d3802">
|
|
<topic>neon -- NULL pointer dereference in Digest domain support</topic>
|
|
<affects>
|
|
<package>
|
|
<name>neon28</name>
|
|
<range><lt>0.28.3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Joe Orton reports:</p>
|
|
<blockquote cite="http://www.openwall.com/lists/oss-security/2008/08/15/4">
|
|
<p>A NULL pointer deference in the Digest authentication support in
|
|
neon versions 0.28.0 through 0.28.2 inclusive allows a malicious
|
|
server to crash a client application, resulting in possible denial
|
|
of service.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>30710</bid>
|
|
<cvename>CVE-2008-3746</cvename>
|
|
<url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=476571</url>
|
|
<url>http://lists.manyfish.co.uk/pipermail/neon/2008-August/000040.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-08-15</discovery>
|
|
<entry>2008-09-12</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="da5c4072-8082-11dd-9c8c-001c2514716c">
|
|
<topic>clamav -- CHM Processing Denial of Service</topic>
|
|
<affects>
|
|
<package>
|
|
<name>clamav</name>
|
|
<range><lt>0.94</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>clamav-devel</name>
|
|
<range><lt>20080902</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Hanno Boeck reports:</p>
|
|
<blockquote cite="http://int21.de/cve/CVE-2008-1389-clamav-chd.html">
|
|
<p>A fuzzing test showed weakness in the chm parser of
|
|
clamav, which can possibly be exploited. The clamav
|
|
team has disabled the chm module in older versions
|
|
though freshclam updates and has released 0.94 with
|
|
a fixed parser.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-1389</cvename>
|
|
<url>https://wwws.clamav.net/bugzilla/show_bug.cgi?id=1089</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-07-09</discovery>
|
|
<entry>2008-09-12</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="7d239578-7ff2-11dd-8de5-0030843d3802">
|
|
<topic>horde -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>horde-base</name>
|
|
<range><lt>3.2.2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/31842/">
|
|
<p>Some vulnerabilities have been reported in various Horde products,
|
|
which can be exploited by malicious people to conduct script insertion
|
|
attacks</p>
|
|
<p>Input via MIME attachment linking is not properly sanitised in the
|
|
MIME library before being used. This can be exploited to execute
|
|
arbitrary HTML and script code in a user's browser session if e.g. a
|
|
malicious email is viewed.</p>
|
|
<p>Certain unspecified input in HTML messages is not properly
|
|
sanitised before being used. This can be exploited to execute
|
|
arbitrary HTML and script in a user's browser session if e.g. a
|
|
malicious HTML email is viewed.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-3823</cvename>
|
|
<cvename>CVE-2008-3824</cvename>
|
|
<mlist>http://lists.horde.org/archives/announce/2008/000429.html</mlist>
|
|
<url>http://secunia.com/advisories/31842/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-09-10</discovery>
|
|
<entry>2008-09-11</entry>
|
|
<modified>2008-10-03</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="0dccaa28-7f3c-11dd-8de5-0030843d3802">
|
|
<topic>python -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>python24</name>
|
|
<range><lt>2.4.5_2</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>python25</name>
|
|
<range><lt>2.5.2_3</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>python23</name>
|
|
<range><gt>0</gt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/31305">
|
|
<p>Some vulnerabilities have been reported in Python, where some have
|
|
unknown impact and others can potentially be exploited by malicious
|
|
people to cause a DoS (Denial of Service) or to compromise a
|
|
vulnerable system.</p>
|
|
<p>Various integer overflow errors exist in core modules e.g.
|
|
stringobject, unicodeobject, bufferobject, longobject, tupleobject,
|
|
stropmodule, gcmodule, mmapmodule.</p>
|
|
<p>An integer overflow in the hashlib module can lead to an unreliable
|
|
cryptographic digest results.</p>
|
|
<p>Integer overflow errors in the processing of unicode strings can be
|
|
exploited to cause buffer overflows on 32-bit systems.</p>
|
|
<p>An integer overflow exists in the PyOS_vsnprintf() function on
|
|
architectures that do not have a "vsnprintf()" function.</p>
|
|
<p>An integer underflow error in the PyOS_vsnprintf() function when
|
|
passing zero-length strings can lead to memory corruption.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-2315</cvename>
|
|
<cvename>CVE-2008-2316</cvename>
|
|
<cvename>CVE-2008-3142</cvename>
|
|
<cvename>CVE-2008-3144</cvename>
|
|
<url>http://bugs.python.org/issue2620</url>
|
|
<url>http://bugs.python.org/issue2588</url>
|
|
<url>http://bugs.python.org/issue2589</url>
|
|
<url>http://secunia.com/advisories/31305</url>
|
|
<mlist>http://mail.python.org/pipermail/python-checkins/2008-July/072276.html</mlist>
|
|
<mlist>http://mail.python.org/pipermail/python-checkins/2008-July/072174.html</mlist>
|
|
<mlist>http://mail.python.org/pipermail/python-checkins/2008-June/070481.html</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-08-04</discovery>
|
|
<entry>2008-09-10</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="388d9ee4-7f22-11dd-a66a-0019666436c2">
|
|
<topic>mysql -- MyISAM table privileges security bypass vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>mysql-server</name>
|
|
<range><ge>6.0</ge><lt>6.0.5</lt></range>
|
|
<range><ge>5.1</ge><lt>5.1.24</lt></range>
|
|
<range><ge>5.0</ge><lt>5.0.67</lt></range>
|
|
<range><ge>4.1</ge><lt>4.1.22_1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>SecurityFocus reports:</p>
|
|
<blockquote cite="http://www.securityfocus.com/bid/29106/discuss">
|
|
<p>MySQL is prone to a security-bypass vulnerability.
|
|
An attacker can exploit this issue to overwrite existing
|
|
table files in the MySQL data directory, bypassing certain
|
|
security restrictions.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>29106</bid>
|
|
<cvename>CVE-2008-2079</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-05-05</discovery>
|
|
<entry>2008-09-10</entry>
|
|
<modified>2008-10-10</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="8e8b8b94-7f1d-11dd-a66a-0019666436c2">
|
|
<topic>rubygem-rails -- SQL injection vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>rubygem-rails</name>
|
|
<range><lt>2.2.2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Jonathan Weiss reports, that it is possible
|
|
to perform an SQL injection in Rails applications
|
|
via not correctly sanitized :limit and :offset
|
|
parameters. It is possible to change arbitrary
|
|
values in affected tables or gain access to the
|
|
sensitive data.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-4094</cvename>
|
|
<url>http://blog.innerewut.de/2008/6/16/why-you-should-upgrade-to-rails-2-1</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-09-08</discovery>
|
|
<entry>2008-09-10</entry>
|
|
<modified>2010-05-12</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="884fced7-7f1c-11dd-a66a-0019666436c2">
|
|
<topic>wordpress -- remote privilege escalation</topic>
|
|
<affects>
|
|
<package>
|
|
<name>wordpress</name>
|
|
<name>de-wordpress</name>
|
|
<name>wordpress-mu</name>
|
|
<range><lt>2.6.2</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>zh-wordpress</name>
|
|
<range><gt>0</gt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Wordpress development team reports:</p>
|
|
<blockquote cite="http://wordpress.org/development/2008/09/wordpress-262/">
|
|
<p>With open registration enabled, it is possible in WordPress
|
|
versions 2.6.1 and earlier to craft a username such that it
|
|
will allow resetting another users password to a randomly
|
|
generated password. The randomly generated password is not
|
|
disclosed to the attacker, so this problem by itself is annoying
|
|
but not a security exploit. However, this attack coupled with a
|
|
weakness in the random number seeding in mt_rand() could be used
|
|
to predict the randomly generated password.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>31068</bid>
|
|
<cvename>CVE-2008-4107</cvename>
|
|
<url>http://wordpress.org/development/2008/09/wordpress-262/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-09-08</discovery>
|
|
<entry>2008-10-22</entry>
|
|
<modified>2010-05-12</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="2f794295-7b69-11dd-80ba-000bcdf0a03b">
|
|
<topic>FreeBSD -- Remote kernel panics on IPv6 connections</topic>
|
|
<affects>
|
|
<system>
|
|
<name>FreeBSD</name>
|
|
<range><gt>6.3</gt><lt>6.3_4</lt></range>
|
|
<range><gt>7.0</gt><lt>7.0_4</lt></range>
|
|
</system>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<h1>Problem Description:</h1>
|
|
<p>In case of an incoming ICMPv6 'Packet Too Big Message', there
|
|
is an insufficient check on the proposed new MTU for a path to
|
|
the destination.</p>
|
|
<h1>Impact:</h1>
|
|
<p>When the kernel is configured to process IPv6 packets and has
|
|
active IPv6 TCP sockets, a specifically crafted ICMPv6 'Packet
|
|
Too Big Message' could cause the TCP stack of the kernel to
|
|
panic.</p>
|
|
<h1>Workaround:</h1>
|
|
<p>Systems without INET6 / IPv6 support are not vulnerable and
|
|
neither are systems which do not listen on any IPv6 TCP sockets
|
|
and have no active IPv6 connections.</p>
|
|
<p>Filter ICMPv6 'Packet Too Big Messages' using a firewall, but
|
|
this will at the same time break PMTU support for IPv6
|
|
connections.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-3530</cvename>
|
|
<freebsdsa>SA-08:09.icmp6</freebsdsa>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-09-03</discovery>
|
|
<entry>2008-09-05</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="7dbb7197-7b68-11dd-80ba-000bcdf0a03b">
|
|
<topic>FreeBSD -- nmount(2) local arbitrary code execution</topic>
|
|
<affects>
|
|
<system>
|
|
<name>FreeBSD</name>
|
|
<range><gt>6.3</gt><lt>6.3_4</lt></range>
|
|
<range><gt>7.0</gt><lt>7.0_4</lt></range>
|
|
</system>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<h1>Problem Description:</h1>
|
|
<p>Various user defined input such as mount points, devices, and
|
|
mount options are prepared and passed as arguments to
|
|
nmount(2) into the kernel. Under certain error conditions,
|
|
user defined data will be copied into a stack allocated buffer
|
|
stored in the kernel without sufficient bounds checking.</p>
|
|
<h1>Impact:</h1>
|
|
<p>If the system is configured to allow unprivileged users to
|
|
mount file systems, it is possible for a local adversary to
|
|
exploit this vulnerability and execute code in the context of
|
|
the kernel.</p>
|
|
<h1>Workaround:</h1>
|
|
<p>It is possible to work around this issue by allowing only
|
|
privileged users to mount file systems by running the
|
|
following sysctl(8) command:</p>
|
|
<pre># sysctl vfs.usermount=0</pre>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-3531</cvename>
|
|
<freebsdsa>SA-08:08.nmount</freebsdsa>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-09-03</discovery>
|
|
<entry>2008-09-05</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="6d4e4759-7b67-11dd-80ba-000bcdf0a03b">
|
|
<topic>FreeBSD -- amd64 swapgs local privilege escalation</topic>
|
|
<affects>
|
|
<system>
|
|
<name>FreeBSD</name>
|
|
<range><gt>6.3</gt><lt>6.3_4</lt></range>
|
|
<range><gt>7.0</gt><lt>7.0_4</lt></range>
|
|
</system>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<h1>Problem Description:</h1>
|
|
<p>If a General Protection Fault happens on a FreeBSD/amd64
|
|
system while it is returning from an interrupt, trap or
|
|
system call, the swapgs CPU instruction may be called one
|
|
extra time when it should not resulting in userland and
|
|
kernel state being mixed.</p>
|
|
<h1>Impact:</h1>
|
|
<p>A local attacker can by causing a General Protection Fault
|
|
while the kernel is returning from an interrupt, trap or
|
|
system call while manipulating stack frames and, run
|
|
arbitrary code with kernel privileges.</p>
|
|
<p>The vulnerability can be used to gain kernel / supervisor
|
|
privilege. This can for example be used by normal users to
|
|
gain root privileges, to break out of jails, or bypass
|
|
Mandatory Access Control (MAC) restrictions.</p>
|
|
<h1>Workaround:</h1>
|
|
<p>No workaround is available, but only systems running the 64
|
|
bit FreeBSD/amd64 kernels are vulnerable.</p>
|
|
<p>Systems with 64 bit capable CPUs, but running the 32 bit
|
|
FreeBSD/i386 kernel are not vulnerable.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-3890</cvename>
|
|
<freebsdsa>SA-08:07.amd64</freebsdsa>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-09-03</discovery>
|
|
<entry>2008-09-05</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="73ec1008-72f0-11dd-874b-0030843d3802">
|
|
<topic>opera -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>opera</name>
|
|
<name>linux-opera</name>
|
|
<range><lt>9.52</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Opera Team reports:</p>
|
|
<blockquote cite="http://www.opera.com/support/search/view/893/">
|
|
<p>Scripts are able to change the addresses of framed pages that
|
|
come from the same site. Due to a flaw in the way that Opera checks
|
|
what frames can be changed, a site can change the address of frames
|
|
on other sites inside any window that it has opened. This allows
|
|
sites to open pages from other sites, and display misleading
|
|
information on them.</p>
|
|
</blockquote>
|
|
<blockquote cite="http://www.opera.com/support/search/view/894/">
|
|
<p>Custom shortcut and menu commands can be used to activate external
|
|
applications. In some cases, the parameters passed to these
|
|
applications are not prepared correctly, and may be created from
|
|
uninitialized memory. These may be misinterpreted as additional
|
|
parameters, and depending on the application, this could allow
|
|
execution of arbitrary code.</p>
|
|
<p>Successful exploitation requires convincing the user to modify
|
|
their shortcuts or menu files appropriately, pointing to an
|
|
appropriate target application, then to activate that shortcut at
|
|
an appropriate time. To inject code, additional means will have to
|
|
be employed.</p>
|
|
</blockquote>
|
|
<blockquote cite="http://www.opera.com/support/search/view/895/">
|
|
<p>When insecure pages load content from secure sites into a frame,
|
|
they can cause Opera to incorrectly report the insecure site as
|
|
being secure. The padlock icon will incorrectly be shown, and the
|
|
security information dialog will state that the connection is
|
|
secure, but without any certificate information.</p>
|
|
</blockquote>
|
|
<blockquote cite="http://www.opera.com/support/search/view/896/">
|
|
<p>As a security precaution, Opera does not allow Web pages to
|
|
link to files on the user's local disk. However, a flaw exists
|
|
that allows Web pages to link to feed source files on the
|
|
user's computer. Suitable detection of JavaScript events and
|
|
appropriate manipulation can unreliably allow a script to
|
|
detect the difference between successful and unsuccessful
|
|
subscriptions to these files, to allow it to discover if the
|
|
file exists or not. In most cases the attempt will fail.</p>
|
|
</blockquote>
|
|
<blockquote cite="http://www.opera.com/support/search/view/897/">
|
|
<p>It has been reported that when a user subscribes to a news
|
|
feed using the feed subscription button, the page address
|
|
can be changed. This causes the address field not to update
|
|
correctly. Although this can mean that misleading
|
|
information can be displayed in the address field, it can
|
|
only leave the attacking page's address in the address bar,
|
|
not a trusted third party address.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-4195</cvename>
|
|
<cvename>CVE-2008-4197</cvename>
|
|
<cvename>CVE-2008-4198</cvename>
|
|
<cvename>CVE-2008-4200</cvename>
|
|
<url>http://www.opera.com/support/search/view/893/</url>
|
|
<url>http://www.opera.com/support/search/view/894/</url>
|
|
<url>http://www.opera.com/support/search/view/895/</url>
|
|
<url>http://www.opera.com/support/search/view/896/</url>
|
|
<url>http://www.opera.com/support/search/view/897/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-08-20</discovery>
|
|
<entry>2008-08-25</entry>
|
|
<modified>2010-05-12</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="d864a0a7-6f27-11dd-acfe-00104b9e1a4a">
|
|
<topic>gnutls -- "gnutls_handshake()" Denial of Service</topic>
|
|
<affects>
|
|
<package>
|
|
<name>gnutls</name>
|
|
<range><ge>2.3.5</ge><lt>2.4.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/31505/">
|
|
<p>A vulnerability has been reported in GnuTLS, which can
|
|
potentially be exploited by malicious people to cause a DoS
|
|
(Denial of Service).</p>
|
|
<p>The vulnerability is caused due to a use-after-free error when an
|
|
application calls "gnutls_handshake()" for an already valid session
|
|
and can potentially be exploited, e.g. during re-handshakes.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-2377</cvename>
|
|
<url>http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/2947</url>
|
|
<url>http://secunia.com/advisories/31505/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-08-15</discovery>
|
|
<entry>2008-08-21</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="8514b6e7-6f0f-11dd-b3db-001c2514716c">
|
|
<topic>joomla -- flaw in the reset token validation</topic>
|
|
<affects>
|
|
<package>
|
|
<name>joomla15</name>
|
|
<range><lt>1.5.6</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Joomla project reports:</p>
|
|
<blockquote cite="http://developer.joomla.org/security/news/241-20080801-core-password-remind-functionality.html">
|
|
<p>A flaw in the reset token validation mechanism allows
|
|
for non-validating tokens to be forged. This will allow
|
|
an unauthenticated, unauthorized user to reset the password
|
|
of the first enabled user (lowest id). Typically, this is
|
|
an administrator user. Note, that changing the first users
|
|
username may lessen the impact of this exploit (since the
|
|
person who changed the password does not know the login
|
|
associated with the new password). However, the only way
|
|
to completely rectify the issue is to upgrade to 1.5.6
|
|
(or patch the /components/com_user/models/reset.php file).</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-3681</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-08-14</discovery>
|
|
<entry>2008-08-20</entry>
|
|
<modified>2008-08-20</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="c4f31e16-6e33-11dd-8eb7-0011098ad87f">
|
|
<topic>cdf3 -- Buffer overflow vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>cdf3</name>
|
|
<range><lt>3.2.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>NASA Goddard Space Flight Center reports:</p>
|
|
<blockquote cite="http://cdf.gsfc.nasa.gov/CDF32_buffer_overflow.html">
|
|
<p>The libraries for the scientific data file format, Common Data
|
|
Format (CDF) version 3.2 and earlier, have the potential for a
|
|
buffer overflow vulnerability when reading specially-crafted
|
|
(invalid) CDF files. If successful, this could trigger execution
|
|
of arbitrary code within the context of the CDF-reading program
|
|
that could be exploited to compromise a system, or otherwise
|
|
crash the program. While it's unlikely that you would open CDFs
|
|
from untrusted sources, we recommend everyone upgrade to the
|
|
latest CDF libraries on their systems, including the IDL and
|
|
Matlab plugins. Most worrisome is any service that enables the
|
|
general public to submit CDF files for processing.</p>
|
|
<p>The vulnerability is in the CDF library routines not properly
|
|
checking the length tags on a CDF file before copying data to a
|
|
stack buffer. Exploitation requires the user to explicitly open
|
|
a specially-crafted file. CDF users should not open files from
|
|
untrusted third parties until the patch is applied (and continue
|
|
then to exercise normal caution for files from untrusted third
|
|
parties).</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-2080</cvename>
|
|
<url>http://cdf.gsfc.nasa.gov/CDF32_buffer_overflow.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-05-15</discovery>
|
|
<entry>2008-08-19</entry>
|
|
<modified>2010-05-12</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="070b5b22-6d74-11dd-aa18-0030843d3802">
|
|
<topic>drupal -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>drupal5</name>
|
|
<range><lt>5.10</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>drupal6</name>
|
|
<range><lt>6.4</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Drupal Project reports:</p>
|
|
<blockquote cite="http://drupal.org/node/295053">
|
|
<p>A bug in the output filter employed by Drupal makes it possible
|
|
for malicious users to insert script code into pages (cross site
|
|
scripting or XSS). A bug in the private filesystem trusts the MIME
|
|
type sent by the browser, enabling malicious users with the ability
|
|
to upload files to execute cross site scripting attacks.</p>
|
|
<p>The BlogAPI module does not validate the extension of uploaded
|
|
files, enabling users with the "administer content with blog api"
|
|
permission to upload harmful files. This bug affects both Drupal
|
|
5.x and 6.x.</p>
|
|
<p>Drupal forms contain a token to protect against cross site
|
|
request forgeries (CSRF). The token may not be validated properly
|
|
for cached forms and forms containing AHAH elements. This bug
|
|
affects Drupal 6.x.</p>
|
|
<p>User access rules can be added or deleted upon accessing a
|
|
properly formatted URL, making such modifications vulnerable to
|
|
cross site request forgeries (CSRF). This may lead to unintended
|
|
addition or deletion of an access rule when a sufficiently
|
|
privileged user visits a page or site created by a malicious
|
|
person. This bug affects both Drupal 5.x and 6.x.</p>
|
|
<p>The Upload module in Drupal 6 contains privilege escalation
|
|
vulnerabilities for users with the "upload files" permission. This
|
|
can lead to users being able to edit nodes which they are normally
|
|
not allowed to, delete any file to which the webserver has
|
|
sufficient rights, and download attachments of nodes to which they
|
|
have no access. Harmful files may also be uploaded via cross site
|
|
request forgeries (CSRF). These bugs affect Drupal 6.x.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-3740</cvename>
|
|
<cvename>CVE-2008-3741</cvename>
|
|
<cvename>CVE-2008-3742</cvename>
|
|
<cvename>CVE-2008-3743</cvename>
|
|
<cvename>CVE-2008-3744</cvename>
|
|
<cvename>CVE-2008-3745</cvename>
|
|
<url>http://secunia.com/advisories/31462/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-08-13</discovery>
|
|
<entry>2008-08-18</entry>
|
|
<modified>2010-05-12</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="c329712a-6b5b-11dd-9d79-001fc61c2a55">
|
|
<topic>ruby -- multiple vulnerabilities in safe level</topic>
|
|
<affects>
|
|
<package>
|
|
<name>ruby</name>
|
|
<name>ruby+pthreads</name>
|
|
<name>ruby+pthreads+oniguruma</name>
|
|
<name>ruby+oniguruma</name>
|
|
<range><ge>1.8.*,1</ge><lt>1.8.6.287,1</lt></range>
|
|
<range><ge>1.9.*,1</ge><lt>1.9.1.0,1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The official ruby site reports:</p>
|
|
<blockquote cite="http://www.ruby-lang.org/en/news/2008/08/08/multiple-vulnerabilities-in-ruby/">
|
|
<p>Several vulnerabilities in safe level have been discovereds:.</p>
|
|
<ul>
|
|
<li>untrace_var is permitted at safe level 4;</li>
|
|
<li>$PROGRAM_NAME may be modified at safe level 4;</li>
|
|
<li>insecure methods may be called at safe level 1-3;</li>
|
|
<li>syslog operations are permitted at safe level 4;</li>
|
|
<li>dl doesn't check taintness, so it could allow attackers
|
|
to call dangerous functions.</li>
|
|
</ul>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-3655</cvename>
|
|
<cvename>CVE-2008-3656</cvename>
|
|
<cvename>CVE-2008-3905</cvename>
|
|
<url>http://www.ruby-lang.org/en/news/2008/08/08/multiple-vulnerabilities-in-ruby/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-08-08</discovery>
|
|
<entry>2008-08-16</entry>
|
|
<modified>2010-05-12</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="f7ba20aa-6b5a-11dd-9d79-001fc61c2a55">
|
|
<topic>ruby -- DoS vulnerability in WEBrick</topic>
|
|
<affects>
|
|
<package>
|
|
<name>ruby</name>
|
|
<name>ruby+pthreads</name>
|
|
<name>ruby+pthreads+oniguruma</name>
|
|
<name>ruby+oniguruma</name>
|
|
<range><ge>1.8.*,1</ge><lt>1.8.6.111_5,1</lt></range>
|
|
<range><ge>1.9.*,1</ge><lt>1.9.1.0,1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The official ruby site reports:</p>
|
|
<blockquote cite="http://www.ruby-lang.org/en/news/2008/08/08/multiple-vulnerabilities-in-ruby/">
|
|
<p>WEBrick::HTTP::DefaultFileHandler is faulty of exponential time
|
|
taking requests due to a backtracking regular expression in
|
|
WEBrick::HTTPUtils.split_header_value.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-3655</cvename>
|
|
<cvename>CVE-2008-3656</cvename>
|
|
<cvename>CVE-2008-3905</cvename>
|
|
<url>http://www.ruby-lang.org/en/news/2008/08/08/multiple-vulnerabilities-in-ruby/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-08-08</discovery>
|
|
<entry>2008-08-16</entry>
|
|
<modified>2010-05-12</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="959d384d-6b59-11dd-9d79-001fc61c2a55">
|
|
<topic>ruby -- DNS spoofing vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>ruby</name>
|
|
<name>ruby+pthreads</name>
|
|
<name>ruby+pthreads+oniguruma</name>
|
|
<name>ruby+oniguruma</name>
|
|
<range><ge>1.8.*,1</ge><lt>1.8.6.111_5,1</lt></range>
|
|
<range><ge>1.9.*,1</ge><lt>1.9.1.0,1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The official ruby site reports:</p>
|
|
<blockquote cite="http://www.ruby-lang.org/en/news/2008/08/08/multiple-vulnerabilities-in-ruby/">
|
|
<p>resolv.rb allow remote attackers to spoof DNS answers. This risk
|
|
can be reduced by randomness of DNS transaction IDs and source
|
|
ports.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-1447</cvename>
|
|
<url>http://www.ruby-lang.org/en/news/2008/08/08/multiple-vulnerabilities-in-ruby/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-08-08</discovery>
|
|
<entry>2008-08-16</entry>
|
|
<modified>2009-02-09</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="1d96305d-6ae6-11dd-91d5-000c29d47fd7">
|
|
<topic>Bugzilla -- Directory Traversal in importxml.pl</topic>
|
|
<affects>
|
|
<package>
|
|
<name>bugzilla</name>
|
|
<name>ja-bugzilla</name>
|
|
<range><ge>2.22.1</ge><lt>2.22.4</lt></range>
|
|
<range><ge>3.*</ge><lt>3.0.4</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A Bugzilla Security Advisory reports:</p>
|
|
<blockquote cite="http://www.bugzilla.org/security/2.22.4/">
|
|
<p>When importing bugs using importxml.pl, the --attach_path
|
|
option can be specified, pointing to the directory where
|
|
attachments to import are stored. If the XML file being
|
|
read by importxml.pl contains a malicious</p>
|
|
<pre>../relative_path/to/local_file</pre>
|
|
<p>node, the script follows this relative path and attaches the
|
|
local file pointed by it to the bug, making the file public.
|
|
The security fix makes sure the relative path is always
|
|
ignored.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-4437</cvename>
|
|
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=437169</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-06-03</discovery>
|
|
<entry>2008-08-15</entry>
|
|
<modified>2010-05-12</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="c61ca9cb-64c3-11dd-954d-006097bcc5f4">
|
|
<topic>openvpn-devel -- arbitrary code execution</topic>
|
|
<affects>
|
|
<package>
|
|
<name>openvpn-devel</name>
|
|
<range><ge>2.1.b14</ge><lt>2.1.r9</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>James Yonan reports:</p>
|
|
<blockquote cite="http://openvpn.net/index.php/documentation/change-log/changelog-21.html">
|
|
<p>Security Fix - affects non-Windows OpenVPN clients running
|
|
OpenVPN 2.1-beta14 through 2.1-rc8 (OpenVPN 2.0.x clients are NOT
|
|
vulnerable nor are any versions of the OpenVPN server
|
|
vulnerable).</p>
|
|
<p>An OpenVPN client connecting to a malicious or compromised server
|
|
could potentially receive an "lladdr" or "iproute" configuration
|
|
directive from the server which could cause arbitrary code execution
|
|
on the client. A successful attack requires that (a) the client has
|
|
agreed to allow the server to push configuration directives to it by
|
|
including "pull" or the macro "client" in its configuration file,
|
|
(b) the client succesfully authenticates the server, (c) the server
|
|
is malicious or has been compromised and is under the control of the
|
|
attacker, and (d) the client is running a non-Windows OS.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-3459</cvename>
|
|
<url>http://openvpn.net/index.php/documentation/change-log/changelog-21.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-07-31</discovery>
|
|
<entry>2008-08-07</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="35e54755-54e4-11dd-ad8b-0030843d3802">
|
|
<topic>phpmyadmin -- cross site request forgery vulnerabilites</topic>
|
|
<affects>
|
|
<package>
|
|
<name>phpMyAdmin</name>
|
|
<range><lt>2.11.7.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A phpMyAdmin security announcement:</p>
|
|
<blockquote cite="http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-5">
|
|
<p>A logged-in user, if abused into clicking a crafted link or loading
|
|
an attack page, would create a database he did not intend to, or would
|
|
change his connection character set.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-5</url>
|
|
<url>http://secunia.com/advisories/31115/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-07-15</discovery>
|
|
<entry>2008-07-18</entry>
|
|
<modified>2008-09-17</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="ecedde1c-5128-11dd-a4e1-0030843d3802">
|
|
<topic>drupal -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>drupal5</name>
|
|
<range><lt>5.8</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>drupal6</name>
|
|
<range><lt>6.3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Drupal Project reports:</p>
|
|
<blockquote cite="http://drupal.org/node/280571">
|
|
<p>Free tagging taxonomy terms can be used to insert arbitrary script
|
|
and HTML code (cross site scripting or XSS) on node preview pages. A
|
|
successful exploit requires that the victim selects a term containing
|
|
script code and chooses to preview the node. This issue affects Drupal
|
|
6.x only. Some values from OpenID providers are output without being
|
|
properly escaped, allowing malicious providers to insert arbitrary script
|
|
and HTML code (XSS) into user pages. This issue affects Drupal 6.x only.
|
|
filter_xss_admin() has been hardened to prevent use of the object HTML
|
|
tag in administrator input.</p>
|
|
<p>Translated strings (5.x, 6.x) and OpenID identities (6.x) are
|
|
immediately deleted upon accessing a properly formatted URL, making
|
|
such deletion vulnerable to cross site request forgeries (CSRF). This
|
|
may lead to unintended deletion of translated strings or OpenID
|
|
identities when a sufficiently privileged user visits a page or site
|
|
created by a malicious person.</p>
|
|
<p>When contributed modules such as Workflow NG terminate the current
|
|
request during a login event, user module is not able to regenerate
|
|
the user's session. This may lead to a session fixation attack, when a
|
|
malicious user is able to control another users' initial session ID.
|
|
As the session is not regenerated, the malicious user may use the
|
|
'fixed' session ID after the victim authenticates and will have the
|
|
same access. This issue affects both Drupal 5 and Drupal 6.</p>
|
|
<p>Schema API uses an inappropriate placeholder for 'numeric' fields
|
|
enabling SQL injection when user-supplied data is used for such
|
|
fields.This issue affects Drupal 6 only.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-3218</cvename>
|
|
<cvename>CVE-2008-3221</cvename>
|
|
<url>http://drupal.org/node/280571</url>
|
|
<url>http://secunia.com/advisories/31028/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-07-9</discovery>
|
|
<entry>2008-07-13</entry>
|
|
<modified>2010-05-12</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="655ee1ec-511b-11dd-80ba-000bcdf0a03b">
|
|
<topic>FreeBSD -- DNS cache poisoning</topic>
|
|
<affects>
|
|
<system>
|
|
<name>FreeBSD</name>
|
|
<range><gt>6.3</gt><lt>6.3_3</lt></range>
|
|
<range><gt>7.0</gt><lt>7.0_3</lt></range>
|
|
</system>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<h1>Problem Description:</h1>
|
|
<p>The BIND DNS implementation does not randomize the UDP source
|
|
port when doing remote queries, and the query id alone does
|
|
not provide adequate randomization.</p>
|
|
<h1>Impact:</h1>
|
|
<p>The lack of source port randomization reduces the amount of
|
|
data the attacker needs to guess in order to successfully
|
|
execute a DNS cache poisoning attack. This allows the
|
|
attacker to influence or control the results of DNS queries
|
|
being returned to users from target systems.</p>
|
|
<h1>Workaround:</h1>
|
|
<p>Limiting the group of machines that can do recursive queries
|
|
on the DNS server will make it more difficult, but not
|
|
impossible, for this vulnerability to be exploited.</p>
|
|
<p>To limit the machines able to perform recursive queries, add an ACL in
|
|
named.conf and limit recursion like the following:</p>
|
|
<pre>acl example-acl {</pre>
|
|
<pre> 192.0.2.0/24;</pre>
|
|
<pre>};</pre>
|
|
<pre>options {</pre>
|
|
<pre> recursion yes;</pre>
|
|
<pre> allow-recursion { example-acl; };</pre>
|
|
<pre>};</pre>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<certvu>800113</certvu>
|
|
<cvename>CVE-2008-1447</cvename>
|
|
<freebsdsa>SA-08:06.bind</freebsdsa>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-07-08</discovery>
|
|
<entry>2008-07-13</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="bc20510f-4dd4-11dd-93e7-0211d880e350">
|
|
<topic>poppler -- uninitialized pointer</topic>
|
|
<affects>
|
|
<package>
|
|
<name>poppler</name>
|
|
<range><lt>0.8.4_2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Felipe Andres Manzano reports:</p>
|
|
<blockquote cite="http://milw0rm.com/exploits/6032">
|
|
<p>The libpoppler pdf rendering library, can free
|
|
uninitialized pointers, leading to arbitrary code
|
|
execution. This vulnerability results from memory
|
|
management bugs in the Page class constructor/destructor.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-2950</cvename>
|
|
<url>http://milw0rm.com/exploits/6032</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-07-07</discovery>
|
|
<entry>2008-07-09</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="f5c58fc1-49c0-11dd-b0ba-00163e000016">
|
|
<topic>py-pylons -- Path traversal bug</topic>
|
|
<affects>
|
|
<package>
|
|
<name>py24-pylons</name>
|
|
<range><lt>0.9.6.2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Pylons team reports:</p>
|
|
<blockquote cite="http://wiki.pylonshq.com/display/pylonsdocs/0.9.6.2">
|
|
<p>The error.py controller uses paste.fileapp to serve the static
|
|
resources to the browser. The default error.py controller uses
|
|
os.path.join to combine the id from Routes with the media path.
|
|
Routes prior to 1.8 double unquoted the PATH_INFO, resulting in
|
|
FileApp returning files from the filesystem that can be outside
|
|
of the intended media path directory.</p>
|
|
<p>An attacker can craft URL's which utilize the double escaping
|
|
to pass in a name to the error.py controller which contains a
|
|
leading slash thus escaping the intended media path and serving
|
|
files from any location on the filesystem that the Pylons
|
|
application has access to.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://wiki.pylonshq.com/display/pylonsdocs/0.9.6.2</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-05-28</discovery>
|
|
<entry>2008-07-04</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="4fb43b2f-46a9-11dd-9d38-00163e000016">
|
|
<topic>FreeType 2 -- Multiple Vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>freetype2</name>
|
|
<range><lt>2.3.6</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/30600">
|
|
<ul>
|
|
<li>An integer overflow error exists in the processing of PFB font
|
|
files. This can be exploited to cause a heap-based buffer overflow
|
|
via a PFB file containing a specially crafted "Private" dictionary
|
|
table.</li>
|
|
<li>An error in the processing of PFB font files can be exploited
|
|
to trigger the "free()" of memory areas that are not allocated on
|
|
the heap.</li>
|
|
<li>An off-by-one error exists in the processing of PFB font files.
|
|
This can be exploited to cause a one-byte heap-based buffer
|
|
overflow via a specially crafted PFB file.</li>
|
|
<li>An off-by-one error exists in the implementation of the "SHC"
|
|
instruction while processing TTF files. This can be exploited to
|
|
cause a one-byte heap-based buffer overflow via a specially crafted
|
|
TTF file.</li>
|
|
</ul>
|
|
<p>Successful exploitation of the vulnerabilities may allow execution
|
|
of arbitrary code.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>29637</bid>
|
|
<bid>29639</bid>
|
|
<bid>29640</bid>
|
|
<bid>29641</bid>
|
|
<cvename>CVE-2008-1806</cvename>
|
|
<cvename>CVE-2008-1807</cvename>
|
|
<cvename>CVE-2008-1808</cvename>
|
|
<url>http://secunia.com/advisories/30600</url>
|
|
<url>http://sourceforge.net/project/shownotes.php?release_id=605780</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-06-10</discovery>
|
|
<entry>2008-07-03</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="1e8e63c0-478a-11dd-a88d-000ea69a5213">
|
|
<topic>fetchmail -- potential crash in -v -v verbose mode (revised patch)</topic>
|
|
<affects>
|
|
<package>
|
|
<name>fetchmail</name>
|
|
<range><lt>6.3.8_7</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Matthias Andree reports:</p>
|
|
<blockquote cite="http://www.fetchmail.info/fetchmail-SA-2008-01.txt">
|
|
<p>2008-06-24 1.2 also fixed issue in report_complete (reported by
|
|
Petr Uzel)</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-2711</cvename>
|
|
<url>http://www.fetchmail.info/fetchmail-SA-2008-01.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-06-24</discovery>
|
|
<entry>2008-07-01</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="e285a1f4-4568-11dd-ae96-0030843d3802">
|
|
<topic>phpmyadmin -- Cross Site Scripting Vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>phpMyAdmin</name>
|
|
<range><lt>2.11.7</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia report:</p>
|
|
<blockquote cite="http://secunia.com/advisories/30813/">
|
|
<p>Some vulnerabilities have been reported in phpMyAdmin, which can be
|
|
exploited by malicious people to conduct cross-site scripting
|
|
attacks.</p>
|
|
<p>Input passed via unspecified parameters to files in /libraries is not
|
|
properly sanitised before being returned to the user. This can be
|
|
exploited to execute arbitrary HTML and script code in a user's
|
|
browser session in context of an affected site.</p>
|
|
<p>Successful exploitation requires that "register_globals" is enabled
|
|
and support for ".htaccess" files is disabled.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-2960</cvename>
|
|
<url>http://secunia.com/advisories/30813/</url>
|
|
<url>http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-4</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-06-23</discovery>
|
|
<entry>2008-06-28</entry>
|
|
<modified>2010-05-12</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="c84dc9ad-41f7-11dd-a4f9-00163e000016">
|
|
<topic>apache -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>apache</name>
|
|
<range><gt>2.2.0</gt><lt>2.2.9</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Apache HTTP server project reports:</p>
|
|
<blockquote cite="http://www.apache.org/dist/httpd/Announcement2.2.html">
|
|
<p>The following potential security flaws are addressed:</p>
|
|
<ul>
|
|
<li>CVE-2008-2364: mod_proxy_http: Better handling of excessive
|
|
interim responses from origin server to prevent potential denial of
|
|
service and high memory usage. Reported by Ryujiro Shibuya.</li>
|
|
<li>CVE-2007-6420: mod_proxy_balancer: Prevent CSRF attacks against
|
|
the balancer-manager interface</li>
|
|
</ul>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2007-6420</cvename>
|
|
<cvename>CVE-2008-2364</cvename>
|
|
<url>http://www.apache.org/dist/httpd/Announcement2.2.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-06-14</discovery>
|
|
<entry>2008-06-24</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="ee6fa2bd-406a-11dd-936a-0015af872849">
|
|
<topic>php -- input validation error in safe_mode</topic>
|
|
<affects>
|
|
<package>
|
|
<name>php5</name>
|
|
<range><lt>5.2.6_2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>According to Maksymilian Arciemowicz research,
|
|
it is possible to bypass security restrictions
|
|
of <code>safe_mode</code> in various
|
|
functions via directory traversal vulnerability. The attacker
|
|
can use this attack to gain access to sensitive
|
|
information. Functions utilizing
|
|
<code>expand_filepath()</code> may be affected.</p>
|
|
<p>It should be noted that this vulnerability is not
|
|
considered to be serious by the FreeBSD Security Team,
|
|
since <code>safe_mode</code> and <code>open_basedir</code>
|
|
are insecure by design and should not be relied upon.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-2665</cvename>
|
|
<cvename>CVE-2008-2666</cvename>
|
|
<bid>29797</bid>
|
|
<url>http://securityreason.com/achievement_securityalert/54</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-06-17</discovery>
|
|
<entry>2008-06-22</entry>
|
|
<modified>2008-09-04</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="30866e6c-3c6d-11dd-98c9-00163e000016">
|
|
<topic>vim -- Vim Shell Command Injection Vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>vim</name>
|
|
<name>vim-lite</name>
|
|
<name>vim-ruby</name>
|
|
<name>vim6</name>
|
|
<name>vim6-ruby</name>
|
|
<range><gt>6</gt><le>6.4.10</le></range>
|
|
<range><gt>7</gt><lt>7.1.315</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Rdancer.org reports:</p>
|
|
<blockquote cite="http://www.rdancer.org/vulnerablevim.html">
|
|
<p>Improper quoting in some parts of Vim written in the Vim Script
|
|
can lead to arbitrary code execution upon opening a crafted
|
|
file.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-2712</cvename>
|
|
<url>http://www.rdancer.org/vulnerablevim.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-06-16</discovery>
|
|
<entry>2008-06-21</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="53802164-3f7e-11dd-90ea-0019666436c2">
|
|
<topic>ruby -- multiple integer and buffer overflow vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>ruby</name>
|
|
<name>ruby+pthreads</name>
|
|
<name>ruby+pthreads+oniguruma</name>
|
|
<name>ruby+oniguruma</name>
|
|
<range><ge>1.8.*,1</ge><lt>1.8.6.111_3,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>ruby_static</name>
|
|
<range><ge>1.8.*,1</ge></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The official ruby site reports:</p>
|
|
<blockquote cite="http://www.ruby-lang.org/en/news/2008/06/20/arbitrary-code-execution-vulnerabilities/">
|
|
<p>Multiple vulnerabilities in Ruby may lead to a denial of service
|
|
(DoS) condition or allow execution of arbitrary code.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-2726</cvename>
|
|
<url>http://www.ruby-lang.org/en/news/2008/06/20/arbitrary-code-execution-vulnerabilities/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-06-19</discovery>
|
|
<entry>2008-06-21</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="168190df-3e9a-11dd-87bc-000ea69a5213">
|
|
<topic>fetchmail -- potential crash in -v -v verbose mode</topic>
|
|
<affects>
|
|
<package>
|
|
<name>fetchmail</name>
|
|
<range><lt>6.3.8_6</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Matthias Andree reports:</p>
|
|
<blockquote cite="http://www.fetchmail.info/fetchmail-SA-2008-01.txt">
|
|
<p>Gunter Nau reported fetchmail crashing on some messages; further
|
|
debugging by Petr Uzel and Petr Cerny at Novell/SUSE Czech Republic
|
|
dug up that this happened when fetchmail was trying to print, in
|
|
-v -v verbose level, headers exceeding 2048 bytes. In this
|
|
situation, fetchmail would resize the buffer and fill in further
|
|
parts of the message, but forget to reinitialize its va_list
|
|
typed source pointer, thus reading data from a garbage address found
|
|
on the stack at addresses above the function arguments the caller
|
|
passed in; usually that would be the caller's stack frame.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-2711</cvename>
|
|
<url>http://www.fetchmail.info/fetchmail-SA-2008-01.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-06-13</discovery>
|
|
<entry>2008-06-20</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="800e8bd5-3acb-11dd-8842-001302a18722">
|
|
<topic>xorg -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>xorg-server</name>
|
|
<range><lt>1.4.2,1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Matthieu Herrb of X.Org reports:</p>
|
|
<blockquote cite="http://lists.freedesktop.org/archives/xorg/2008-June/036026.html">
|
|
<p>Several vulnerabilities have been found in the server-side code
|
|
of some extensions in the X Window System. Improper validation of
|
|
client-provided data can cause data corruption.</p>
|
|
<p>Exploiting these overflows will crash the X server or,
|
|
under certain circumstances allow the execution of arbitray machine
|
|
code.</p>
|
|
<p>When the X server is running with root privileges (which is the case
|
|
for the Xorg server and for most kdrive based servers), these
|
|
vulnerabilities can thus also be used to raise privileges.</p>
|
|
<p>All these vulnerabilities, to be exploited successfully, require either
|
|
an already established connection to a running X server (and normally
|
|
running X servers are only accepting authenticated connections), or a
|
|
shell access with a valid user on the machine where the vulnerable
|
|
server is installed.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-1377</cvename>
|
|
<cvename>CVE-2008-1379</cvename>
|
|
<cvename>CVE-2008-2360</cvename>
|
|
<cvename>CVE-2008-2361</cvename>
|
|
<cvename>CVE-2008-2362</cvename>
|
|
<url>http://lists.freedesktop.org/archives/xorg/2008-June/036026.html</url>
|
|
<url>http://secunia.com/advisories/30627/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-06-11</discovery>
|
|
<entry>2008-06-15</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="c4ba95b2-39ce-11dd-98c9-00163e000016">
|
|
<topic>moinmoin -- superuser privilege escalation</topic>
|
|
<affects>
|
|
<package>
|
|
<name>moinmoin</name>
|
|
<range><lt>1.6.3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>MoinMoin team reports:</p>
|
|
<blockquote cite="http://hg.moinmo.in/moin/1.6/rev/f405012e67af">
|
|
<p>A check in the userform processing was not working as expected and
|
|
could be abused for ACL and superuser privilege escalation.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-1937</cvename>
|
|
<url>http://hg.moinmo.in/moin/1.6/rev/f405012e67af</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-04-20</discovery>
|
|
<entry>2008-06-14</entry>
|
|
<modified>2008-06-15</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="022baf71-38e6-11dd-8d34-00e0815b8da8">
|
|
<topic>Courier Authentication Library -- SQL Injection</topic>
|
|
<affects>
|
|
<package>
|
|
<name>courier-authlib</name>
|
|
<range><lt>0.60.6</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/30591/">
|
|
<p>A vulnerability has been reported in the Courier Authentication
|
|
Library, which can be exploited by malicious people to conduct SQL
|
|
injection attacks.</p>
|
|
<p>Input passed via e.g. the username to the library is not properly
|
|
sanitised before being used in SQL queries. This can be exploited to
|
|
manipulate SQL queries by injecting arbitrary SQL code and e.g.
|
|
potentially bypass authentication.</p>
|
|
<p>Successful exploitation requires that a MySQL database is used for
|
|
authentication and that a Non-Latin character set is selected.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://secunia.com/advisories/30591/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-06-10</discovery>
|
|
<entry>2008-06-13</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="90db9983-2f53-11dd-a0d8-0016d325a0ed">
|
|
<topic>ikiwiki -- cleartext passwords</topic>
|
|
<affects>
|
|
<package>
|
|
<name>ikiwiki</name>
|
|
<range><lt>2.48</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The ikiwiki development team reports:</p>
|
|
<blockquote cite="http://ikiwiki.info/security/#index32h2">
|
|
<p>Until version 2.48, ikiwiki stored passwords in cleartext in
|
|
the userdb. That risks exposing all users' passwords if the file
|
|
is somehow exposed. To pre-emtively guard against that, current
|
|
versions of ikiwiki store password hashes (using Eksblowfish).</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://ikiwiki.info/security/#index32h2</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-05-30</discovery>
|
|
<entry>2008-06-01</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="09066828-2ef1-11dd-a0d8-0016d325a0ed">
|
|
<topic>ikiwiki -- empty password security hole</topic>
|
|
<affects>
|
|
<package>
|
|
<name>ikiwiki</name>
|
|
<range><ge>1.34</ge><lt>2.47_1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The ikiwiki development team reports:</p>
|
|
<blockquote cite="http://ikiwiki.info/security/#index33h2">
|
|
<p>This hole allowed ikiwiki to accept logins using empty
|
|
passwords to openid accounts that didn't use a password.</p>
|
|
<p>Upgrading to a non-vulnerable ikiwiki version immediatly is
|
|
recommended if your wiki allows both password and openid
|
|
logins.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-0169</cvename>
|
|
<url>http://ikiwiki.info/security/#index33h2</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-05-30</discovery>
|
|
<entry>2008-05-31</entry>
|
|
<modified>2010-05-12</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="04c6187d-2d8f-11dd-98c9-00163e000016">
|
|
<topic>linux-flashplugin -- unspecified remote code execution vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>linux-flashplugin</name>
|
|
<range><lt>9.0r124</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Adobe Product Security Incident Response Team reports:</p>
|
|
<blockquote cite="http://blogs.adobe.com/psirt/">
|
|
<p>An exploit appears to be taking advantage of a known
|
|
vulnerability, reported by Mark Dowd of the ISS X-Force and wushi
|
|
of team509, that was resolved in Flash Player 9.0.124.0
|
|
(CVE-2007-0071). This exploit does NOT appear to include a new,
|
|
unpatched vulnerability as has been reported elsewhere - customers
|
|
with Flash Player 9.0.124.0 should not be vulnerable to this
|
|
exploit.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>29386</bid>
|
|
<cvename>CVE-2007-0071</cvename>
|
|
<url>http://blogs.adobe.com/psirt/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-05-27</discovery>
|
|
<entry>2008-05-30</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="fbd7aa81-2cc1-11dd-8cfb-00e0815b8da8">
|
|
<topic>Nagios -- Cross Site Scripting Vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>nagios</name>
|
|
<range><lt>2.12</lt></range>
|
|
<range><gt>3.*</gt><lt>3.0.2</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>nagios-devel</name>
|
|
<range><lt>3.0.2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/30283">
|
|
<p>A vulnerability has been reported in Nagios, which can be
|
|
exploited by malicious people to conduct cross-site scripting
|
|
attacks.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>29140</bid>
|
|
<cvename>CVE-2007-5803</cvename>
|
|
<url>http://secunia.com/advisories/30283</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-05-20</discovery>
|
|
<entry>2008-05-28</entry>
|
|
<modified>2008-09-08</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="555ac165-2bee-11dd-bbdc-00e0815b8da8">
|
|
<topic>spamdyke -- open relay</topic>
|
|
<affects>
|
|
<package>
|
|
<name>spamdyke</name>
|
|
<range><lt>3.1.8</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Spamdyke Team reports:</p>
|
|
<blockquote cite="http://www.spamdyke.org/documentation/Changelog.txt">
|
|
<p>Fixed smtp_filter() to reject the DATA command if no valid
|
|
recipients have been specified. Otherwise, a specific scenario could
|
|
result in every spamdyke installation being used as an open relay.
|
|
If the remote server connects and gives one or more recipients that
|
|
are rejected (for relaying or blacklisting), then gives the DATA
|
|
command, spamdyke will ignore all other commands, assuming that
|
|
message data is being transmitted. However, because all of the
|
|
recipients were rejected, qmail will reject the DATA command. From
|
|
that point on, the remote server can give as many recipients as it
|
|
likes and spamdyke will ignore them all -- they will not be filtered
|
|
at all. After that, the remote server can give the DATA command and
|
|
send the actual message data. Because spamdyke is controlling
|
|
relaying, the RELAYCLIENT environment variable is set and qmail won't
|
|
check for relaying either. Thanks to Mirko Buffoni for reporting
|
|
this one.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-2784</cvename>
|
|
<url>http://www.spamdyke.org/documentation/Changelog.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-05-21</discovery>
|
|
<entry>2008-05-27</entry>
|
|
<modified>2010-05-12</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="402ae710-26a2-11dd-ae05-825f4c35000a">
|
|
<topic>peercast -- arbitrary code execution</topic>
|
|
<affects>
|
|
<package>
|
|
<name>peercast</name>
|
|
<range><gt>0</gt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Nico Golde discovered that PeerCast, a P2P audio and
|
|
video streaming server, is vulnerable to a buffer overflow
|
|
in the HTTP Basic Authentication code, allowing a remote
|
|
attacker to crash PeerCast or execure arbitrary code.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>28986</bid>
|
|
<cvename>CVE-2008-2040</cvename>
|
|
<url>http://secunia.com/advisories/30020</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-05-20</discovery>
|
|
<entry>2008-05-21</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="f5a76faf-244c-11dd-b143-0211d880e350">
|
|
<topic>libvorbis -- various security issues</topic>
|
|
<affects>
|
|
<package>
|
|
<name>libvorbis</name>
|
|
<range><lt>1.2.0_2,3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Red Hat reports:</p>
|
|
<blockquote cite="https://rhn.redhat.com/errata/RHSA-2008-0270.html">
|
|
<p>Will Drewry of the Google Security Team reported several
|
|
flaws in the way libvorbis processed audio data. An
|
|
attacker could create a carefully crafted [Vorbis] audio file
|
|
in such a way that it could cause an application linked
|
|
with libvorbis to crash, or execute arbitrary code when
|
|
it was opened.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-1419</cvename>
|
|
<cvename>CVE-2008-1420</cvename>
|
|
<cvename>CVE-2008-1423</cvename>
|
|
<url>https://rhn.redhat.com/errata/RHSA-2008-0270.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-05-14</discovery>
|
|
<entry>2008-05-17</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="f49ba347-2190-11dd-907c-001c2514716c">
|
|
<topic>django -- XSS vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>py23-django</name>
|
|
<name>py24-django</name>
|
|
<name>py25-django</name>
|
|
<range><lt>0.96.2</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>py23-django-devel</name>
|
|
<name>py24-django-devel</name>
|
|
<name>py25-django-devel</name>
|
|
<range><lt>20080511</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Django project reports:</p>
|
|
<blockquote cite="http://www.djangoproject.com/weblog/2008/may/14/security/">
|
|
<p>The Django administration application will, when accessed by
|
|
a user who is not sufficiently authenticated, display a login
|
|
form and ask the user to provide the necessary credentials
|
|
before displaying the requested page. This form will be submitted
|
|
to the URL the user attempted to access, by supplying the current
|
|
request path as the value of the form's "action" attribute.</p>
|
|
<p>The value of the request path was not being escaped, creating an
|
|
opportunity for a cross-site scripting (XSS) attack by leading a
|
|
user to a URL which contained URL-encoded HTML and/or JavaScript
|
|
in the request path.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-2302</cvename>
|
|
<url>http://www.djangoproject.com/weblog/2008/may/14/security/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-05-10</discovery>
|
|
<entry>2008-05-14</entry>
|
|
<modified>2010-05-12</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="633716fa-1f8f-11dd-b143-0211d880e350">
|
|
<topic>vorbis-tools -- Speex header processing vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>vorbis-tools</name>
|
|
<range><lt>1.2.0_2,3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/29882/">
|
|
<p>A vulnerability has been reported in vorbis-tools,
|
|
which can potentially be exploited by malicious people
|
|
to compromise a user's system.</p>
|
|
<p>The vulnerability is caused due to an input validation
|
|
error when processing Speex headers, which can be
|
|
exploited via a specially crafted Speex stream containing
|
|
a negative "modeID" field in the header.</p>
|
|
<p>Successful exploitation may allow execution of arbitrary
|
|
code.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-1686</cvename>
|
|
<url>http://secunia.com/advisories/29882/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-04-18</discovery>
|
|
<entry>2008-05-11</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="8950ac62-1d30-11dd-9388-0211060005df">
|
|
<topic>qemu -- "drive_init()" Disk Format Security Bypass</topic>
|
|
<affects>
|
|
<package>
|
|
<name>qemu</name>
|
|
<name>qemu-devel</name>
|
|
<range><lt>0.9.1_6</lt></range>
|
|
<range><ge>0.9.1s.20070101*</ge><lt>0.9.1s.20080302_6</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/30111/">
|
|
<p>A vulnerability has been reported in QEMU, which can be exploited
|
|
by malicious, local users to bypass certain security
|
|
restrictions.</p>
|
|
<p>The vulnerability is caused due to the "drive_init()" function
|
|
in vl.c determining the format of a disk from data contained in
|
|
the disk's header. This can be exploited by a malicious user in
|
|
a guest system to e.g. read arbitrary files on the host by
|
|
writing a fake header to a raw formatted disk image.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-2004</cvename>
|
|
<url>http://secunia.com/advisories/30111/</url>
|
|
<mlist>http://lists.gnu.org/archive/html/qemu-devel/2008-04/msg00675.html</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-04-28</discovery>
|
|
<entry>2008-05-08</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="5ef12755-1c6c-11dd-851d-0016d325a0ed">
|
|
<topic>swfdec -- exposure of sensitive information</topic>
|
|
<affects>
|
|
<package>
|
|
<name>swfdec</name>
|
|
<range><lt>0.6.4</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/29915">
|
|
<p>A vulnerability has been reported in swfdec, which can be
|
|
exploited by malicious people to disclose sensitive
|
|
information.</p>
|
|
<p>The vulnerability is caused due to swfdec not properly
|
|
restricting untrusted sandboxes from reading local files,
|
|
which can be exploited to disclose the content of arbitrary
|
|
local files by e.g. tricking a user into visiting a malicious
|
|
website.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-1834</cvename>
|
|
<url>http://secunia.com/advisories/29915</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-04-09</discovery>
|
|
<entry>2008-05-07</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="86a4d810-1884-11dd-a914-0016179b2dd5">
|
|
<topic>mt-daapd -- integer overflow</topic>
|
|
<affects>
|
|
<package>
|
|
<name>mt-daapd</name>
|
|
<range><lt>0.2.4.2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>FrSIRT reports:</p>
|
|
<blockquote cite="http://www.frsirt.com/english/advisories/2008/1303">
|
|
<p>A vulnerability has been identified in mt-daapd which could be exploited
|
|
by remote attackers to cause a denial of service or compromise an
|
|
affected system. This issue is caused by a buffer overflow error in the
|
|
ws_getpostvars() function when processing a negative Content-Length:
|
|
header value, which could be exploited by remote unauthenticated
|
|
attackers to crash an affected application or execute arbitrary
|
|
code.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-1771</cvename>
|
|
<url>http://secunia.com/advisories/29917</url>
|
|
<url>http://www.frsirt.com/english/advisories/2008/1303</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-04-21</discovery>
|
|
<entry>2008-05-02</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="b1bcab7d-1880-11dd-a914-0016179b2dd5">
|
|
<topic>sdl_image -- buffer overflow vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>sdl_image</name>
|
|
<range><lt>1.2.6_1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/28640">
|
|
<p>Two vulnerabilities have been reported in SDL_image, which can be
|
|
exploited by malicious people to cause a Denial of Service or potentially
|
|
compromise an application using the library.</p>
|
|
<p>A boundary error within the LWZReadByte() function in IMG_gif.c can
|
|
be exploited to trigger the overflow of a static buffer via a
|
|
specially crafted GIF file.</p>
|
|
<p>A boundary error within the "IMG_LoadLBM_RW()" function in IMG_lbm.c
|
|
can be exploited to cause a heap-based buffer overflow via a specially
|
|
crafted IFF ILBM file.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2007-6697</cvename>
|
|
<cvename>CVE-2008-0544</cvename>
|
|
<url>http://secunia.com/advisories/28640</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-01-24</discovery>
|
|
<entry>2008-05-02</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="30394651-13e1-11dd-bab7-0016179b2dd5">
|
|
<topic>gnupg -- memory corruption vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>gnupg</name>
|
|
<range><ge>1.0.0</ge><lt>1.4.9</lt></range>
|
|
<range><ge>2.0.0</ge><lt>2.0.9</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/29568">
|
|
<p>A vulnerability has been reported in GnuPG, which can potentially
|
|
be exploited to compromise a vulnerable system.</p>
|
|
<p>The vulnerability is caused due to an error when importing keys
|
|
with duplicated IDs. This can be exploited to cause a memory
|
|
corruption when importing keys via --refresh-keys or --import.</p>
|
|
<p>Successful exploitation potentially allows execution of arbitrary
|
|
code, but has not been proven yet.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>28487</bid>
|
|
<cvename>CVE-2008-1530</cvename>
|
|
<url>http://www.ocert.org/advisories/ocert-2008-1.html</url>
|
|
<url>http://secunia.com/advisories/29568</url>
|
|
<url>https://bugs.g10code.com/gnupg/issue894</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-03-19</discovery>
|
|
<entry>2008-04-26</entry>
|
|
<modified>2008-04-29</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="44c8694a-12f9-11dd-9b26-001c2514716c">
|
|
<topic>extman -- password bypass vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>extman</name>
|
|
<range><ge>0.2.4</ge><lt>0.2.4_1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Extmail team reports:</p>
|
|
<blockquote cite="http://www.extmail.org/forum/thread-7260-1-1.html">
|
|
<p>Emergency update #4 fixes a serious security vulnerability.</p>
|
|
</blockquote>
|
|
<p>Successful exploit of this vulnerability would allow attacker to
|
|
change user's password without knowing it by using specifically
|
|
crafted HTTP request.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://www.extmail.org/forum/thread-7260-1-1.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-04-01</discovery>
|
|
<entry>2008-04-25</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="f47f2746-12c5-11dd-bab7-0016179b2dd5">
|
|
<topic>mailman -- script insertion vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>ja-mailman</name>
|
|
<name>mailman</name>
|
|
<name>mailman-with-htdig</name>
|
|
<range><lt>2.1.10</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/28794">
|
|
<p>A vulnerability has been reported in Mailman, which can be
|
|
exploited by malicious users to conduct script insertion
|
|
attacks.</p>
|
|
<p>Certain input when editing the list templates and the list info
|
|
attribute is not properly sanitised before being stored. This can be
|
|
exploited to insert arbitrary HTML and script code, which is
|
|
executed in a user's browser session in context of an affected site
|
|
when the malicious website is accessed.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-0564</cvename>
|
|
<bid>27630</bid>
|
|
<url>http://www.ubuntu.com/usn/usn-586-1</url>
|
|
<url>http://secunia.com/advisories/28794</url>
|
|
<url>http://sourceforge.net/project/shownotes.php?release_id=593924</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-02-05</discovery>
|
|
<entry>2008-04-25</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="86c05550-12c1-11dd-bab7-0016179b2dd5">
|
|
<topic>mksh -- TTY attachment privilege escalation</topic>
|
|
<affects>
|
|
<package>
|
|
<name>mksh</name>
|
|
<range><lt>R33d</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/29803/">
|
|
<p>The vulnerability is caused due to an error when attaching to a TTY
|
|
via the -T command line switch. This can be exploited to execute
|
|
arbitrary commands with the privileges of the user running mksh via
|
|
characters previously written to the attached virtual console.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-1845</cvename>
|
|
<url>http://secunia.com/advisories/29803/</url>
|
|
<url>http://www.mirbsd.org/mksh.htm#clog</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-04-14</discovery>
|
|
<entry>2008-04-25</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="9c133aa0-12bd-11dd-bab7-0016179b2dd5">
|
|
<topic>serendipity -- multiple cross site scripting vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>serendipity</name>
|
|
<range><lt>1.3.1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>serendipity-devel</name>
|
|
<range><lt>200804242342</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Hanno Boeck reports:</p>
|
|
<blockquote cite="http://int21.de/cve/CVE-2008-1386-s9y.html">
|
|
<p>The installer of serendipity 1.3 has various Cross Site Scripting
|
|
issues. This is considered low priority, as attack scenarios are
|
|
very unlikely.</p>
|
|
<p>Various path fields are not escaped properly, thus filling them
|
|
with javascript code will lead to XSS. MySQL error messages are not
|
|
escaped, thus the database host field can also be filled with
|
|
javascript.</p>
|
|
</blockquote>
|
|
<blockquote cite="http://int21.de/cve/CVE-2008-1385-s9y.html">
|
|
<p>In the referrer plugin of the blog application serendipity,
|
|
the referrer string is not escaped, thus leading to a permanent
|
|
XSS.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>28885</bid>
|
|
<cvename>CVE-2008-1385</cvename>
|
|
<cvename>CVE-2008-1386</cvename>
|
|
<url>http://int21.de/cve/CVE-2008-1385-s9y.html</url>
|
|
<url>http://int21.de/cve/CVE-2008-1386-s9y.html</url>
|
|
<url>http://blog.s9y.org/archives/193-Serendipity-1.3.1-released.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-04-22</discovery>
|
|
<entry>2008-04-25</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="67bd39ba-12b5-11dd-bab7-0016179b2dd5">
|
|
<topic>firefox -- javascript garbage collector vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>firefox</name>
|
|
<range><lt>2.0.0.14,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-firefox</name>
|
|
<name>linux-firefox-devel</name>
|
|
<range><lt>2.0.0.14</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>seamonkey</name>
|
|
<name>linux-seamonkey</name>
|
|
<range><lt>1.1.10</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>flock</name>
|
|
<name>linux-flock</name>
|
|
<range><lt>1.1.2</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-seamonkey-devel</name>
|
|
<range><gt>0</gt></range>
|
|
</package>
|
|
<package>
|
|
<name>thunderbird</name>
|
|
<name>linux-thunderbird</name>
|
|
<range><lt>2.0.0.14</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Mozilla Foundation reports:</p>
|
|
<blockquote cite="http://www.mozilla.org/security/announce/2008/mfsa2008-20.html">
|
|
<p>Fixes for security problems in the JavaScript engine described in
|
|
MFSA 2008-15 introduced a stability problem, where some users
|
|
experienced crashes during JavaScript garbage collection. This is
|
|
being fixed primarily to address stability concerns. We have no
|
|
demonstration that this particular crash is exploitable but are
|
|
issuing this advisory because some crashes of this type have been
|
|
shown to be exploitable in the past.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-1237</cvename>
|
|
<cvename>CVE-2008-1380</cvename>
|
|
<bid>28818</bid>
|
|
<url>http://secunia.com/advisories/29787</url>
|
|
<url>http://www.mozilla.org/security/announce/2008/mfsa2008-20.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-04-16</discovery>
|
|
<entry>2008-04-25</entry>
|
|
<modified>2009-12-12</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="57c705d6-12ae-11dd-bab7-0016179b2dd5">
|
|
<topic>png -- unknown chunk processing uninitialized memory access</topic>
|
|
<affects>
|
|
<package>
|
|
<name>png</name>
|
|
<range><lt>1.2.27</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://.com/advisories/29792">
|
|
<p>Tavis Ormandy has reported a vulnerability in libpng, which can be
|
|
exploited by malicious people to cause a Denial of Service, disclose
|
|
potentially sensitive information, or potentially compromise an
|
|
application using the library.</p>
|
|
<p>The vulnerability is caused due to the improper handling of PNG
|
|
chunks unknown to the library. This can be exploited to trigger the
|
|
use of uninitialized memory in e.g. a free() call via unknown PNG
|
|
chunks having a length of zero.</p>
|
|
<p>Successful exploitation may allow execution of arbitrary code, but
|
|
requires that the application calls the png_set_read_user_chunk_fn()
|
|
function or the png_set_keep_unknown_chunks() function under
|
|
specific conditions.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-1382</cvename>
|
|
<bid>28770</bid>
|
|
<url>http://secunia.com/advisories/29792</url>
|
|
<url>http://libpng.sourceforge.net/Advisory-1.2.26.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-04-12</discovery>
|
|
<entry>2008-04-25</entry>
|
|
<modified>2008-04-29</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="b84a992a-12ab-11dd-bab7-0016179b2dd5">
|
|
<topic>openfire -- unspecified denial of service</topic>
|
|
<affects>
|
|
<package>
|
|
<name>openfire</name>
|
|
<range><lt>3.5.0</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/29751">
|
|
<p>A vulnerability has been reported in Openfire, which can be
|
|
exploited by malicious people to cause a Denial of Service.</p>
|
|
<p>The vulnerability is caused due to an unspecified error and can be
|
|
exploited to cause a Denial of Service.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-1728</cvename>
|
|
<bid>28722</bid>
|
|
<url>http://secunia.com/advisories/29751</url>
|
|
<url>http://www.igniterealtime.org/issues/browse/JM-1289</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-04-10</discovery>
|
|
<entry>2008-04-25</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="f6377f08-12a7-11dd-bab7-0016179b2dd5">
|
|
<topic>php -- integer overflow vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>php5</name>
|
|
<range><lt>5.2.6</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>CVE reports:</p>
|
|
<blockquote cite="http://www.securityfocus.com/bid/28392/discuss">
|
|
<p>Integer overflow in PHP 5.2.5 and earlier allows context-dependent
|
|
attackers to cause a denial of service and possibly have unspecified
|
|
other impact via a printf format parameter with a large width
|
|
specifier, related to the php_sprintf_appendstring function in
|
|
formatted_print.c and probably other functions for formatted strings
|
|
(aka *printf functions).</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-1384</cvename>
|
|
<bid>28392</bid>
|
|
<url>http://securityreason.com/achievement_securityalert/52</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-03-21</discovery>
|
|
<entry>2008-04-25</entry>
|
|
<modified>2008-05-02</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="ec41c3e2-129c-11dd-bab7-0016179b2dd5">
|
|
<topic>python -- Integer Signedness Error in zlib Module</topic>
|
|
<affects>
|
|
<package>
|
|
<name>python23</name>
|
|
<range><lt>2.3.6_1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>python24</name>
|
|
<range><lt>2.4.5_1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>python25</name>
|
|
<range><lt>2.5.2_2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Justin Ferguson reports:</p>
|
|
<blockquote cite="http://bugs.python.org/issue2586">
|
|
<p>Integer signedness error in the zlib extension module in Python
|
|
2.5.2 and earlier allows remote attackers to execute arbitrary code
|
|
via a negative signed integer, which triggers insufficient memory
|
|
allocation and a buffer overflow.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-1721</cvename>
|
|
<bid>28715</bid>
|
|
<url>http://securityreason.com/securityalert/3802</url>
|
|
<url>http://bugs.python.org/issue2586</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-04-10</discovery>
|
|
<entry>2008-04-25</entry>
|
|
<modified>2008-04-28</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="51436b4c-1250-11dd-bab7-0016179b2dd5">
|
|
<topic>postgresql -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>postgresql</name>
|
|
<name>postgresql-server</name>
|
|
<range><ge>7.3</ge><lt>7.3.21</lt></range>
|
|
<range><ge>7.4</ge><lt>7.4.19</lt></range>
|
|
<range><ge>8.0</ge><lt>8.0.15</lt></range>
|
|
<range><ge>8.1</ge><lt>8.1.11</lt></range>
|
|
<range><ge>8.2</ge><lt>8.2.6</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The PostgreSQL developers report:</p>
|
|
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6600">
|
|
<p>PostgreSQL allows users to create indexes on the results of
|
|
user-defined functions, known as "expression indexes". This provided
|
|
two vulnerabilities to privilege escalation: (1) index functions
|
|
were executed as the superuser and not the table owner during VACUUM
|
|
and ANALYZE, and (2) that SET ROLE and SET SESSION AUTHORIZATION
|
|
were permitted within index functions. Both of these holes have now
|
|
been closed.</p>
|
|
</blockquote>
|
|
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4772">
|
|
<p>PostgreSQL allowed malicious users to initiate a denial-of-service
|
|
by passing certain regular expressions in SQL queries. First, users
|
|
could create infinite loops using some specific regular expressions.
|
|
Second, certain complex regular expressions could consume excessive
|
|
amounts of memory. Third, out-of-range backref numbers could be used
|
|
to crash the backend.</p>
|
|
</blockquote>
|
|
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=">
|
|
<p>DBLink functions combined with local trust or ident authentication
|
|
could be used by a malicious user to gain superuser privileges. This
|
|
issue has been fixed, and does not affect users who have not
|
|
installed DBLink (an optional module), or who are using password
|
|
authentication for local access. This same problem was addressed in
|
|
the previous release cycle, but that patch failed to close all forms
|
|
of the loophole.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2007-6600</cvename>
|
|
<cvename>CVE-2007-4772</cvename>
|
|
<cvename>CVE-2007-6067</cvename>
|
|
<cvename>CVE-2007-4769</cvename>
|
|
<cvename>CVE-2007-6601</cvename>
|
|
<bid>27163</bid>
|
|
<url>http://www.postgresql.org/about/news.905</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-01-06</discovery>
|
|
<entry>2008-04-24</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="fe971a0f-1246-11dd-bab7-0016179b2dd5">
|
|
<topic>phpmyadmin -- Shared Host Information Disclosure</topic>
|
|
<affects>
|
|
<package>
|
|
<name>phpMyAdmin</name>
|
|
<range><lt>2.11.5.2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A phpMyAdmin security announcement report:</p>
|
|
<blockquote cite="http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-3">
|
|
<p>It is possible to read the contents of any file that the web
|
|
server's user can access. The exact mechanism to achieve this won't
|
|
be disclosed. If a user can upload on the same host where
|
|
phpMyAdmin is running a PHP script that can read files with the
|
|
rights of the web server's user, the current advisory does not
|
|
describe an additional threat.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-1924</cvename>
|
|
<url>http://secunia.com/advisories/29944/</url>
|
|
<url>http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-3</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-04-23</discovery>
|
|
<entry>2008-04-24</entry>
|
|
<modified>2008-09-17</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="6eb1dc51-1244-11dd-bab7-0016179b2dd5">
|
|
<topic>phpmyadmin -- Username/Password Session File Information Disclosure</topic>
|
|
<affects>
|
|
<package>
|
|
<name>phpMyAdmin</name>
|
|
<range><lt>2.11.5.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A phpMyAdmin security announcement report:</p>
|
|
<blockquote cite="http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-2">
|
|
<p>phpMyAdmin saves sensitive information like the MySQL username and
|
|
password and the Blowfish secret key in session data, which might be
|
|
unprotected on a shared host.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-1567</cvename>
|
|
<url>http://secunia.com/advisories/29613/</url>
|
|
<url>http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-3</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-03-31</discovery>
|
|
<entry>2008-04-24</entry>
|
|
<modified>2008-09-17</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="7a7c5853-10a3-11dd-8eb8-00163e000016">
|
|
<topic>libxine -- array index vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>libxine</name>
|
|
<range><lt>1.1.12</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>xine Team reports:</p>
|
|
<blockquote cite="http://www.xinehq.de/index.php/news">
|
|
<p>A new xine-lib version is now available. This release contains a
|
|
security fix (an unchecked array index that could allows remote
|
|
attackers to execute arbitrary code via a header structure
|
|
containing a negative offset, which is used to dereference a
|
|
function pointer.)</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-1686</cvename>
|
|
<url>http://www.xinehq.de/index.php/news</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-04-06</discovery>
|
|
<entry>2008-04-24</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="589d8053-0b03-11dd-b4ef-00e07dc4ec84">
|
|
<topic>clamav -- Multiple Vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>clamav</name>
|
|
<range><lt>0.93</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>clamav-devel</name>
|
|
<range><lt>20080415</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/29000">
|
|
<p>Some vulnerabilities have been reported in ClamAV, which can be
|
|
exploited by malicious people to cause a DoS (Denial of Service)
|
|
or to compromise a vulnerable system.</p>
|
|
<p>1) A boundary error exists within the "cli_scanpe()" function in
|
|
libclamav/pe.c. This can be exploited to cause a heap-based buffer
|
|
overflow via a specially crafted "Upack" executable.</p>
|
|
<p>Successful exploitation allows execution of arbitrary code.</p>
|
|
<p>2) A boundary error within the processing of PeSpin packed
|
|
executables in libclamav/spin.c can be exploited to cause a
|
|
heap-based buffer overflow.</p>
|
|
<p>Successful exploitation may allow execution of arbitrary code.</p>
|
|
<p>3) An unspecified error in the processing of ARJ files can be
|
|
exploited to hang ClamAV.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-1100</cvename>
|
|
<cvename>CVE-2008-1387</cvename>
|
|
<url>http://secunia.com/advisories/29000</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-04-15</discovery>
|
|
<entry>2008-04-15</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="1ac77649-0908-11dd-974d-000fea2763ce">
|
|
<topic>lighttpd -- OpenSSL Error Queue Denial of Service Vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>lighttpd</name>
|
|
<range><lt>1.4.19_1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/29649">
|
|
<p>A vulnerability has been reported in lighttpd, which can be
|
|
exploited by malicious people to cause a DoS (Denial of
|
|
Service).</p>
|
|
<p>The vulnerability is caused due to lighttpd not properly clearing
|
|
the OpenSSL error queue. This can be exploited to close concurrent
|
|
SSL connections of lighttpd by terminating one SSL connection.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>28489</bid>
|
|
<cvename>CVE-2008-1531</cvename>
|
|
<url>http://secunia.com/advisories/29649</url>
|
|
<url>http://trac.lighttpd.net/trac/ticket/285</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-04-02</discovery>
|
|
<entry>2008-04-13</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="8d2c0ce1-08b6-11dd-94b4-0016d325a0ed">
|
|
<topic>ikiwiki -- cross site request forging</topic>
|
|
<affects>
|
|
<package>
|
|
<name>ikiwiki</name>
|
|
<range><lt>2.42</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The ikiwiki development team reports:</p>
|
|
<blockquote cite="http://ikiwiki.info/security/#index31h2">
|
|
<p>Cross Site Request Forging could be used to construct a link
|
|
that would change a logged-in user's password or other preferences
|
|
if they clicked on the link. It could also be used to construct a
|
|
link that would cause a wiki page to be modified by a logged-in
|
|
user.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-0165</cvename>
|
|
<url>http://ikiwiki.info/security/#index31h2</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-04-10</discovery>
|
|
<entry>2008-04-13</entry>
|
|
<modified>2010-05-12</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="072a53e0-0397-11dd-bd06-0017319806e7">
|
|
<topic>postfix-policyd-weight -- working directory symlink vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>postfix-policyd-weight</name>
|
|
<range><lt>0.1.14.17</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>postfix-policyd-weight does not check for symlink for its working
|
|
directory. If the working directory is not already setup by the
|
|
super root, an unprivileged user can link it to another directories
|
|
in the system. This results in ownership/permission changes on the
|
|
target directory.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>28480</bid>
|
|
<mlist>http://article.gmane.org/gmane.mail.postfix.policyd-weight/815</mlist>
|
|
<mlist>http://article.gmane.org/gmane.mail.postfix.policyd-weight/823</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-03-24</discovery>
|
|
<entry>2008-04-06</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="b21790a5-02fb-11dd-bd06-0017319806e7">
|
|
<topic>powerdns-recursor -- DNS cache poisoning</topic>
|
|
<affects>
|
|
<package>
|
|
<name>powerdns-recursor</name>
|
|
<range><lt>3.1.5</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>If the system random number generator can be predicted by its
|
|
past output, then an attacker may spoof Recursor to accept mallicious
|
|
data. This leads to DNS cache poisoning and client redirection.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://doc.powerdns.com/security-policy.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-03-31</discovery>
|
|
<entry>2008-04-05</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="fb672330-02db-11dd-bd06-0017319806e7">
|
|
<topic>suphp -- multiple local privilege escalation vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>suphp</name>
|
|
<range><lt>0.6.3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Multiple local privilege escalation are found in the symlink
|
|
verification code. An attacker may use it to run a PHP script with
|
|
the victim's privilege. This attack is a little harder when suphp
|
|
operates in paranoid mode. For suphp that runs in owner mode
|
|
which is the default in ports, immediate upgrade to latest
|
|
version is advised.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-1614</cvename>
|
|
<bid>28568</bid>
|
|
<url>http://lists.marsching.biz/pipermail/suphp/2008-March/001750.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-03-30</discovery>
|
|
<entry>2008-04-05</entry>
|
|
<modified>2010-05-12</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="ad4a00fa-0157-11dd-8bd3-001372ae3ab9">
|
|
<topic>opera -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>opera</name>
|
|
<range><lt>9.27.20080331</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-opera</name>
|
|
<range><lt>9.27.20080331</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Opera Software reports of multiple security issues in Opera.
|
|
All of them can lead to arbitrary code execution. Details are
|
|
as the following:</p>
|
|
<ul>
|
|
<li><a href="http://www.opera.com/support/search/view/881/">Newsfeed
|
|
prompt can cause Opera to execute arbitrary code</a></li>
|
|
<li><a href="http://www.opera.com/support/search/view/882/">Resized
|
|
canvas patterns can cause Opera to execute arbitrary code</a></li>
|
|
</ul>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>28585</bid>
|
|
<cvename>CVE-2008-1761</cvename>
|
|
<cvename>CVE-2008-1762</cvename>
|
|
<url>http://www.opera.com/support/search/view/881/</url>
|
|
<url>http://www.opera.com/support/search/view/882/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-04-03</discovery>
|
|
<entry>2008-04-05</entry>
|
|
<modified>2010-05-12</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="12b336c6-fe36-11dc-b09c-001c2514716c">
|
|
<topic>mozilla -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>firefox</name>
|
|
<range><lt>2.0.0.13,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-firefox</name>
|
|
<name>linux-firefox-devel</name>
|
|
<range><lt>2.0.0.13</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>seamonkey</name>
|
|
<name>linux-seamonkey</name>
|
|
<range><lt>1.1.9</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>flock</name>
|
|
<name>linux-flock</name>
|
|
<range><lt>1.1.1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-seamonkey-devel</name>
|
|
<range><gt>0</gt></range>
|
|
</package>
|
|
<package>
|
|
<name>thunderbird</name>
|
|
<name>linux-thunderbird</name>
|
|
<range><lt>2.0.0.14</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Mozilla Foundation reports of multiple security issues
|
|
in Firefox, Seamonkey, and Thunderbird. Several of these
|
|
issues can probably be used to run arbitrary code with the
|
|
privilege of the user running the program.</p>
|
|
<blockquote cite="http://www.mozilla.org/projects/security/known-vulnerabilities.html">
|
|
<ul>
|
|
<li><a href="/security/announce/2008/mfsa2008-19.html">MFSA 2008-19</a>
|
|
XUL popup spoofing variant (cross-tab popups)</li>
|
|
<li><a href="/security/announce/2008/mfsa2008-18.html">MFSA 2008-18</a>
|
|
Java socket connection to any local port via LiveConnect</li>
|
|
<li><a href="/security/announce/2008/mfsa2008-17.html">MFSA 2008-17</a>
|
|
Privacy issue with SSL Client Authentication</li>
|
|
<li><a href="/security/announce/2008/mfsa2008-16.html">MFSA 2008-16</a>
|
|
HTTP Referrer spoofing with malformed URLs</li>
|
|
<li><a href="/security/announce/2008/mfsa2008-15.html">MFSA 2008-15</a>
|
|
Crashes with evidence of memory corruption (rv:1.8.1.13)</li>
|
|
<li><a href="/security/announce/2008/mfsa2008-14.html">MFSA 2008-14</a>
|
|
JavaScript privilege escalation and arbitrary code execution</li>
|
|
</ul>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>28448</bid>
|
|
<cvename>CVE-2008-1241</cvename>
|
|
<cvename>CVE-2008-1240</cvename>
|
|
<cvename>CVE-2007-4879</cvename>
|
|
<cvename>CVE-2008-1238</cvename>
|
|
<cvename>CVE-2008-1236</cvename>
|
|
<cvename>CVE-2008-1237</cvename>
|
|
<cvename>CVE-2008-1233</cvename>
|
|
<cvename>CVE-2008-1234</cvename>
|
|
<cvename>CVE-2008-1235</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-03-26</discovery>
|
|
<entry>2008-03-30</entry>
|
|
<modified>2009-12-12</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="ff304c35-fb5b-11dc-91c1-00e0815b8da8">
|
|
<topic>silc -- pkcs_decode buffer overflow</topic>
|
|
<affects>
|
|
<package>
|
|
<name>silc-irssi-client</name>
|
|
<name>silc-client</name>
|
|
<range><lt>1.1.4</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>silc-server</name>
|
|
<range><lt>1.1.2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Core Security Technologies reports:</p>
|
|
<blockquote cite="http://www.coresecurity.com/?action=item&id=2206">
|
|
<p>A remote buffer overflow vulnerability found in a library
|
|
used by both the SILC server and client to process
|
|
packets containing cryptographic material may allow an
|
|
un-authenticated client to executearbitrary code on the
|
|
server with the privileges of the user account running the
|
|
server, or a malicious SILC server to compromise client
|
|
systems and execute arbitrary code with the privileges of
|
|
the user account running the SILC client program.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>28373</bid>
|
|
<url>http://www.coresecurity.com/?action=item&id=2206</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-03-25</discovery>
|
|
<entry>2008-03-26</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="063399fc-f6d6-11dc-bcee-001c2514716c">
|
|
<topic>bzip2 -- crash with certain malformed archive files</topic>
|
|
<affects>
|
|
<package>
|
|
<name>bzip2</name>
|
|
<range><lt>1.0.5</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>SecurityFocus reports:</p>
|
|
<blockquote cite="http://www.securityfocus.com/bid/28286/">
|
|
<p>The 'bzip2' application is prone to a remote file-handling
|
|
vulnerability because the application fails to properly
|
|
handle malformed files.</p>
|
|
<p>Exploit attempts likely result in application crashes.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>28286</bid>
|
|
<cvename>CVE-2008-1372</cvename>
|
|
<url>https://www.cert.fi/haavoittuvuudet/joint-advisory-archive-formats.html</url>
|
|
<url>http://www.ee.oulu.fi/research/ouspg/protos/testing/c10/archive/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-03-18</discovery>
|
|
<entry>2008-03-20</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="9cfbca7f-efb7-11dc-be01-0211060005df">
|
|
<topic>qemu -- unchecked block read/write vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>qemu</name>
|
|
<name>qemu-devel</name>
|
|
<range><lt>0.9.1_2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Ian Jackson reports on the debian-security mailinglist:</p>
|
|
<blockquote cite="http://lists.debian.org/debian-security/2008/02/msg00064.html">
|
|
<p>When a block device read or write request is made by the guest,
|
|
nothing checks that the request is within the range supported by
|
|
the backend, but the code in the backend typically assumes that
|
|
the request is sensible.</p>
|
|
<p>Depending on the backend, this can allow the guest to read
|
|
and write arbitrary memory locations in qemu, and possibly gain
|
|
control over the qemu process, escaping from the
|
|
emulation/virtualisation.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-0928</cvename>
|
|
<url>http://secunia.com/advisories/29172</url>
|
|
<url>http://secunia.com/advisories/29081</url>
|
|
<mlist msgid="18362.62578.44273.779731@mariner.uk.xensource.com">http://lists.debian.org/debian-security/2008/02/msg00064.html</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-02-19</discovery>
|
|
<entry>2008-03-11</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="b39bdc06-ee42-11dc-8678-00a0cce0781e">
|
|
<topic>dovecot -- security hole in blocking passdbs</topic>
|
|
<affects>
|
|
<package>
|
|
<name>dovecot</name>
|
|
<range><lt>1.0.13</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Dovecot reports:</p>
|
|
<blockquote cite="http://dovecot.org/list/dovecot-news/2008-March/000065.html">
|
|
<p>Security hole in blocking passdbs (MySQL always. PAM, passwd
|
|
and shadow if blocking=yes) where user could specify extra
|
|
fields in the password. The main problem here is when specifying
|
|
"skip_password_check" introduced in v1.0.11 for fixing master user
|
|
logins, allowing the user to log in as anyone without a valid
|
|
password.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://dovecot.org/list/dovecot-news/2008-March/000065.html</url>
|
|
<url>http://secunia.com/advisories/29295/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-03-09</discovery>
|
|
<entry>2008-03-10</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="de4d4110-ebce-11dc-ae14-0016179b2dd5">
|
|
<topic>mplayer -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>mplayer</name>
|
|
<name>mplayer-esound</name>
|
|
<name>mplayer-gtk</name>
|
|
<name>mplayer-gtk2</name>
|
|
<name>mplayer-gtk-esound</name>
|
|
<name>mplayer-gtk2-esound</name>
|
|
<range><lt>0.99.11_2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Mplayer team reports:</p>
|
|
<blockquote cite="http://www.mplayerhq.hu/design7/news.html">
|
|
<p>A buffer overflow was found in the code used to extract album
|
|
titles from CDDB server answers. When parsing answers from the
|
|
CDDB server, the album title is copied into a fixed-size buffer
|
|
with insufficient size checks, which may cause a buffer overflow.
|
|
A malicious database entry could trigger a buffer overflow in the
|
|
program. That can lead to arbitrary code execution with the UID of
|
|
the user running MPlayer.</p>
|
|
<p>A buffer overflow was found in the code used to escape URL
|
|
strings. The code used to skip over IPv6 addresses can be tricked
|
|
into leaving a pointer to a temporary buffer with a non-NULL value;
|
|
this causes the unescape code to reuse the buffer, and may lead to
|
|
a buffer overflow if the old buffer is smaller than required.
|
|
A malicious URL string may be used to trigger a buffer overflow in
|
|
the program, that can lead to arbitrary code execution with the UID
|
|
of the user running MPlayer.</p>
|
|
<p>A buffer overflow was found in the code used to parse MOV file
|
|
headers. The code read some values from the file and used them as
|
|
indexes into as array allocated on the heap without performing any
|
|
boundary check. A malicious file may be used to trigger a buffer
|
|
overflow in the program. That can lead to arbitrary code execution
|
|
with the UID of the user running MPlayer.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-0485</cvename>
|
|
<cvename>CVE-2008-0486</cvename>
|
|
<cvename>CVE-2008-0629</cvename>
|
|
<cvename>CVE-2008-0630</cvename>
|
|
<url>http://secunia.com/advisories/28779</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-02-05</discovery>
|
|
<entry>2008-03-06</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="ca8e56d5-e856-11dc-b5af-0017319806e7">
|
|
<topic>ghostscript -- zseticcspace() function buffer overflow vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>ghostscript-gpl</name>
|
|
<name>ghostscript-gpl-nox11</name>
|
|
<range><lt>8.61_2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Chris Evans from the Google Security Team reports:</p>
|
|
<blockquote cite="http://scary.beasts.org/security/CESA-2008-001.html">
|
|
<p>Severity: parsing of evil PostScript file will result in
|
|
arbitrary code execution.</p>
|
|
<p>A stack-based buffer overflow in the zseticcspace() function
|
|
in zicc.c allows remote arbitrary code execution via a
|
|
malicious PostScript file (.ps) that contains a long Range
|
|
array.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>28017</bid>
|
|
<cvename>CVE-2008-0411</cvename>
|
|
<url>http://scary.beasts.org/security/CESA-2008-001.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-02-28</discovery>
|
|
<entry>2008-03-05</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="ce2f2ade-e7df-11dc-a701-000bcdc1757a">
|
|
<topic>phpmyadmin -- SQL injection vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>phpMyAdmin</name>
|
|
<range><lt>2.11.5</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A phpMyAdmin security announcement report:</p>
|
|
<blockquote cite="http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-1">
|
|
<p>phpMyAdmin used the $_REQUEST superglobal as a source for
|
|
its parameters, instead of $_GET and $_POST. This means that
|
|
on most servers, a cookie with the same name as one of
|
|
phpMyAdmin's parameters can interfere.</p>
|
|
<p>Another application could set a cookie for the root path
|
|
"/" with a "sql_query" name, therefore overriding the
|
|
user-submitted sql_query because by default, the $_REQUEST
|
|
superglobal imports first GET, then POST then COOKIE data.</p>
|
|
<h3>Mitigation factor</h3>
|
|
<p>An attacker must trick the victim into visiting a page on
|
|
the same web server where he has placed code that creates
|
|
a malicious cookie.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>28068</bid>
|
|
<cvename>CVE-2008-1149</cvename>
|
|
<url>http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-1</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-03-01</discovery>
|
|
<entry>2008-03-04</entry>
|
|
<modified>2010-05-12</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="f9e96930-e6df-11dc-8c6a-00304881ac9a">
|
|
<topic>pcre -- buffer overflow vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>pcre</name>
|
|
<range><lt>7.6</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>PCRE developers report:</p>
|
|
<blockquote cite="http://pcre.org/changelog.txt">
|
|
<p>A character class containing a very large number of characters with
|
|
codepoints greater than 255 (in UTF-8 mode, of course) caused a
|
|
buffer overflow.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>27786</bid>
|
|
<cvename>CVE-2008-0674</cvename>
|
|
<url>http://pcre.org/changelog.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-01-28</discovery>
|
|
<entry>2008-02-29</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="e8a6a16d-e498-11dc-bb89-000bcdc1757a">
|
|
<topic>libxine -- buffer overflow vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>libxine</name>
|
|
<range><lt>1.1.10.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>xine Team reports:</p>
|
|
<blockquote cite="http://www.xinehq.de/index.php/news">
|
|
<p>A new xine-lib version is now available. This release
|
|
contains a security fix (array index vulnerability which
|
|
may lead to a stack buffer overflow.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-0486</cvename>
|
|
<url>http://www.xinehq.de/index.php/news</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-02-08</discovery>
|
|
<entry>2008-02-26</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="9f581778-e3d4-11dc-bb89-000bcdc1757a">
|
|
<topic>coppermine -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>coppermine</name>
|
|
<range><lt>1.4.15</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Coppermine Security advisory</p>
|
|
<blockquote cite="http://coppermine-gallery.net/forum/index.php?topic=48106.0">
|
|
<p>The development team is releasing a security update for
|
|
Coppermine in order to counter a recently discovered
|
|
cross-site-scripting vulnerability.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-0504</cvename>
|
|
<cvename>CVE-2008-0505</cvename>
|
|
<cvename>CVE-2008-0506</cvename>
|
|
<url>http://coppermine-gallery.net/forum/index.php?topic=48106.0</url>
|
|
<url>http://coppermine-gallery.net/forum/index.php?topic=50103.0</url>
|
|
<url>http://secunia.com/advisories/28682/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-11-06</discovery>
|
|
<entry>2008-02-25</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="f113bbeb-e3ac-11dc-bb89-000bcdc1757a">
|
|
<topic>moinmoin -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>moinmoin</name>
|
|
<range><lt>1.6.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>MoinMoin Security advisory</p>
|
|
<blockquote cite="http://moinmo.in/SecurityFixes">
|
|
<p>XSS issue in login action</p>
|
|
<p>XSS issue in AttachFile action</p>
|
|
<p>XSS issue in RenamePage/DeletePage action</p>
|
|
<p>XSS issue in gui editor</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>27404</bid>
|
|
<cvename>CVE-2007-0857</cvename>
|
|
<cvename>CVE-2007-0901</cvename>
|
|
<cvename>CVE-2007-0902</cvename>
|
|
<cvename>CVE-2007-2423</cvename>
|
|
<cvename>CVE-2007-2673</cvename>
|
|
<cvename>CVE-2008-0780</cvename>
|
|
<cvename>CVE-2008-0781</cvename>
|
|
<cvename>CVE-2008-0782</cvename>
|
|
<url>http://moinmo.in/SecurityFixes</url>
|
|
<url>http://secunia.com/advisories/29010/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-02-08</discovery>
|
|
<entry>2008-02-25</entry>
|
|
<modified>2008-02-26</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="30c560ff-e0df-11dc-891a-02061b08fc24">
|
|
<topic>opera -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>opera</name>
|
|
<name>opera-devel</name>
|
|
<name>linux-opera</name>
|
|
<range><lt>9.26</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Opera Software ASA reports about multiple security
|
|
fixes:</p>
|
|
<blockquote cite="http://www.opera.com/docs/changelogs/freebsd/925/">
|
|
<ul>
|
|
<li>Fixed an issue where simulated text inputs could trick
|
|
users into uploading arbitrary files, as reported by
|
|
Mozilla.</li>
|
|
<li>Image properties can no longer be used to execute
|
|
scripts, as reported by Max Leonov.</li>
|
|
<li>Fixed an issue where the representation of DOM
|
|
attribute values could allow cross site scripting, as
|
|
reported by Arnaud.lb.</li>
|
|
</ul>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-1080</cvename>
|
|
<cvename>CVE-2008-1081</cvename>
|
|
<url>http://www.opera.com/docs/changelogs/freebsd/926/</url>
|
|
<url>http://www.opera.com/support/search/view/877/</url>
|
|
<url>http://www.opera.com/support/search/view/879/</url>
|
|
<url>http://www.opera.com/support/search/view/880/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-02-20</discovery>
|
|
<entry>2008-02-22</entry>
|
|
<modified>2010-05-12</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="810a5197-e0d9-11dc-891a-02061b08fc24">
|
|
<topic>mozilla -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>firefox</name>
|
|
<range><lt>2.0.0.12,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-firefox</name>
|
|
<name>linux-firefox-devel</name>
|
|
<range><lt>2.0.0.12</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>seamonkey</name>
|
|
<name>linux-seamonkey</name>
|
|
<range><lt>1.1.8</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>flock</name>
|
|
<name>linux-flock</name>
|
|
<range><lt>1.0.9</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-seamonkey-devel</name>
|
|
<range><gt>0</gt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Mozilla Foundation reports of multiple security issues
|
|
in Firefox, Seamonkey, and Thunderbird. Several of these
|
|
issues can probably be used to run arbitrary code with the
|
|
privilege of the user running the program.</p>
|
|
<blockquote cite="http://www.mozilla.org/projects/security/known-vulnerabilities.html">
|
|
<ul>
|
|
<li>Web forgery overwrite with div overlay</li>
|
|
<li>URL token stealing via stylesheet redirect</li>
|
|
<li>Mishandling of locally-saved plain text files</li>
|
|
<li>File action dialog tampering</li>
|
|
<li>Possible information disclosure in BMP decoder</li>
|
|
<li>Web browsing history and forward navigation stealing</li>
|
|
<li>Directory traversal via chrome: URI</li>
|
|
<li>Stored password corruption</li>
|
|
<li>Privilege escalation, XSS, Remote Code Execution</li>
|
|
<li>Multiple file input focus stealing vulnerabilities</li>
|
|
<li>Crashes with evidence of memory corruption (rv:1.8.1.12)</li>
|
|
</ul>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-0412</cvename>
|
|
<cvename>CVE-2008-0413</cvename>
|
|
<cvename>CVE-2008-0414</cvename>
|
|
<cvename>CVE-2008-0415</cvename>
|
|
<cvename>CVE-2008-0417</cvename>
|
|
<cvename>CVE-2008-0418</cvename>
|
|
<cvename>CVE-2008-0419</cvename>
|
|
<cvename>CVE-2008-0420</cvename>
|
|
<cvename>CVE-2008-0591</cvename>
|
|
<cvename>CVE-2008-0592</cvename>
|
|
<cvename>CVE-2008-0593</cvename>
|
|
<cvename>CVE-2008-0594</cvename>
|
|
<url>http://www.mozilla.org/projects/security/known-vulnerabilities.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2008/mfsa2008-01.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2008/mfsa2008-02.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2008/mfsa2008-03.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2008/mfsa2008-04.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2008/mfsa2008-05.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2008/mfsa2008-06.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2008/mfsa2008-07.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2008/mfsa2008-08.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2008/mfsa2008-09.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2008/mfsa2008-10.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2008/mfsa2008-11.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-02-07</discovery>
|
|
<entry>2008-02-22</entry>
|
|
<modified>2009-12-12</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="e5d29309-e0db-11dc-97b2-001c2514716c">
|
|
<topic>openldap -- modrdn Denial of Service vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>openldap-server</name>
|
|
<range><lt>2.3.41</lt></range>
|
|
<range><gt>2.4.0</gt><lt>2.4.8</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia Advisory reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/28926/">
|
|
<p>A vulnerability has been reported in OpenLDAP, which can
|
|
be exploited by malicious users to cause a DoS (Denial of
|
|
Service).</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>27778</bid>
|
|
<cvename>CVE-2008-0658</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-02-13</discovery>
|
|
<entry>2008-02-22</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="be4b0529-dbaf-11dc-9791-000ea6702141">
|
|
<topic>clamav -- ClamAV libclamav PE File Integer Overflow Vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>clamav</name>
|
|
<range><ge>0.92</ge><lt>0.92.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>iDefense Security Advisory 02.12.08:</p>
|
|
<blockquote cite="http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=658">
|
|
<p>Remote exploitation of an integer overflow vulnerability
|
|
in Clam AntiVirus' ClamAV, as included in various vendors'
|
|
operating system distributions, allows attackers to execute
|
|
arbitrary code with the privileges of the affected process.</p>
|
|
<p>The vulnerability exists within the code responsible
|
|
for parsing and scanning PE files. While iterating through
|
|
all sections contained in the PE file, several attacker
|
|
controlled values are extracted from the file. On each iteration,
|
|
arithmetic operations are performed without taking into
|
|
consideration 32-bit integer wrap.</p>
|
|
<p>Since insufficient integer overflow checks are present,
|
|
an attacker can cause a heap overflow by causing a specially
|
|
crafted Petite packed PE binary to be scanned. This results
|
|
in an exploitable memory corruption condition.</p>
|
|
<p>Exploitation of this vulnerability results in the
|
|
execution of arbitrary code with the privileges of the process
|
|
using libclamav. In the case of the clamd program, this will
|
|
result in code execution with the privileges of the clamav user.
|
|
Unsuccessful exploitation results in the clamd process crashing.</p>
|
|
</blockquote>
|
|
<h1>Workaround</h1>
|
|
<p>Disabling the scanning of PE files will prevent exploitation.</p>
|
|
<p>If using clamscan, this can be done by running clamscan with the
|
|
'--no-pe' option.</p>
|
|
<p>If using clamdscan, set the 'ScanPE' option in the clamd.conf
|
|
file to 'no'.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-0318</cvename>
|
|
<url>http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=658</url>
|
|
<url>http://svn.clamav.net/svn/clamav-devel/trunk/ChangeLog</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-01-07</discovery>
|
|
<entry>2008-02-15</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="dea7df85-d96c-11dc-9bfc-000e0c092e7a">
|
|
<topic>cacti -- Multiple security vulnerabilities have been discovered</topic>
|
|
<affects>
|
|
<package>
|
|
<name>cacti</name>
|
|
<range><lt>0.8.7b</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The cacti development team reports:</p>
|
|
<blockquote cite="http://forums.cacti.net/about25749.html">
|
|
<p>Multiple security vulnerabilities have been discovered in
|
|
Cacti's web interface:</p>
|
|
<ul>
|
|
<li>XSS vulnerabilities</li>
|
|
<li>Path disclosure vulnerabilities</li>
|
|
<li>SQL injection vulnerabilities</li>
|
|
<li>HTTP response splitting vulnerabilities</li>
|
|
</ul>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://forums.cacti.net/about25749.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-02-12</discovery>
|
|
<entry>2008-02-12</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="739329c8-d8f0-11dc-ac2f-0016d325a0ed">
|
|
<topic>ikiwiki -- javascript insertion via uris</topic>
|
|
<affects>
|
|
<package>
|
|
<name>ikiwiki</name>
|
|
<range><lt>2.32.3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The ikiwiki development team reports:</p>
|
|
<blockquote cite="http://ikiwiki.info/security/#index30h2">
|
|
<p>The htmlscrubber did not block javascript in uris. This was
|
|
fixed by adding a whitelist of valid uri types, which does not
|
|
include javascript. Some urls specifyable by the meta plugin
|
|
could also theoretically have been used to inject javascript; this
|
|
was also blocked.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-0808</cvename>
|
|
<url>http://ikiwiki.info/security/#index30h2</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-02-10</discovery>
|
|
<entry>2008-02-11</entry>
|
|
<modified>2010-05-12</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="1a818749-d646-11dc-8959-000bcdc1757a">
|
|
<topic>zenphoto -- XSS vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>zenphoto</name>
|
|
<range><lt>1.1.4</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>zenphoto project reports:</p>
|
|
<blockquote cite="http://www.zenphoto.org/2008/02/">
|
|
<p>A new zenphoto version is now available. This release contains
|
|
security fixes for HTML, XSS, and SQL injection vulnerabilities.
|
|
</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2007-6666</cvename>
|
|
<url>http://www.securityfocus.com/bid/27084</url>
|
|
<url>http://secunia.com/advisories/28281</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-01-03</discovery>
|
|
<entry>2008-02-09</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="0832ee18-cf77-11dc-8c6a-00304881ac9a">
|
|
<topic>jetty -- multiple vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>jetty</name>
|
|
<range><lt>6.1.7</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Greg Wilkins reports:</p>
|
|
<blockquote cite="http://jira.codehaus.org/browse/JETTY-386#action_117699">
|
|
<p>jetty allows remote attackers to bypass protection mechanisms and
|
|
read the source of files via multiple '/' characters in the URI.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>27117</bid>
|
|
<cvename>CVE-2007-6672</cvename>
|
|
<url>http://jira.codehaus.org/browse/JETTY-386#action_117699</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-12-22</discovery>
|
|
<entry>2008-02-04</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="6ecd0b42-ce77-11dc-89b1-000e35248ad7">
|
|
<topic>libxine -- buffer overflow vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>libxine</name>
|
|
<range><lt>1.1.10</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>xine project reports:</p>
|
|
<blockquote cite="http://xinehq.de/index.php/news">
|
|
<p>A new xine-lib version is now available. This release contains
|
|
a security fix (remotely-expoitable buffer overflow, CVE-2006-1664).
|
|
(This is not the first time that that bug has been fixed...)
|
|
It also fixes a few more recent bugs, such as the audio output
|
|
problems in 1.1.9.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2006-1664</cvename>
|
|
<url>http://secunia.com/advisories/19853/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-01-23</discovery>
|
|
<entry>2008-01-29</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="fe2b6597-c9a4-11dc-8da8-0008a18a9961">
|
|
<topic>xorg -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>xorg-server</name>
|
|
<range><lt>1.4_4,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>libXfont</name>
|
|
<range><lt>1.3.1_2,1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Matthieu Herrb of X.Org reports:</p>
|
|
<blockquote cite="http://lists.freedesktop.org/archives/xorg/2008-January/031918.html">
|
|
<p>Several vulnerabilities have been identified in server code
|
|
of the X window system caused by lack of proper input validation
|
|
on user controlled data in various parts of the software,
|
|
causing various kinds of overflows.</p>
|
|
<p>Exploiting these overflows will crash the X server or,
|
|
under certain circumstances allow the execution of arbitray
|
|
machine code.</p>
|
|
<p>When the X server is running with root privileges (which is the
|
|
case for the Xorg server and for most kdrive based servers),
|
|
these vulnerabilities can thus also be used to raise
|
|
privileges.</p>
|
|
<p>All these vulnerabilities, to be exploited succesfully, require
|
|
either an already established connection to a running X server
|
|
(and normally running X servers are only accepting authenticated
|
|
connections), or a shell access with a valid user on the machine
|
|
where the vulnerable server is installed.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2007-5760</cvename>
|
|
<cvename>CVE-2007-5958</cvename>
|
|
<cvename>CVE-2007-6427</cvename>
|
|
<cvename>CVE-2007-6428</cvename>
|
|
<cvename>CVE-2007-6429</cvename>
|
|
<cvename>CVE-2008-0006</cvename>
|
|
<url>http://lists.freedesktop.org/archives/xorg/2008-January/031918.html</url>
|
|
<url>http://lists.freedesktop.org/archives/xorg/2008-January/032099.html</url>
|
|
<url>http://secunia.com/advisories/28532/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-01-18</discovery>
|
|
<entry>2008-01-23</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="024edd06-c933-11dc-810c-0016179b2dd5">
|
|
<topic>xfce -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>xfce4-panel</name>
|
|
<name>libxfce4gui</name>
|
|
<range><lt>4.4.2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Gentoo reports:</p>
|
|
<blockquote cite="http://www.gentoo.org/security/en/glsa/glsa-200801-06.xml">
|
|
<p>A remote attacker could entice a user to install a specially
|
|
crafted "rc" file to execute arbitrary code via long strings
|
|
in the "Name" and "Comment" fields or via unspecified vectors
|
|
involving the second vulnerability.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2007-6531</cvename>
|
|
<cvename>CVE-2007-6532</cvename>
|
|
<url>http://www.xfce.org/documentation/changelogs/4.4.2</url>
|
|
<url>http://www.gentoo.org/security/en/glsa/glsa-200801-06.xml</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-01-09</discovery>
|
|
<entry>2008-01-22</entry>
|
|
<modified>2008-02-13</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="a59afa47-c930-11dc-810c-0016179b2dd5">
|
|
<topic>claws-mail -- insecure temporary file creation</topic>
|
|
<affects>
|
|
<package>
|
|
<name>claws-mail</name>
|
|
<range><lt>3.1.0</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Nico Golde reports:</p>
|
|
<blockquote cite="http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=454089">
|
|
<p>A local attacker could exploit this vulnerability to conduct
|
|
symlink attacks to overwrite files with the privileges of the user
|
|
running Claws Mail.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>26676</bid>
|
|
<cvename>CVE-2007-6208</cvename>
|
|
<url>http://www.gentoo.org/security/en/glsa/glsa-200801-03.xml</url>
|
|
<url>http://security.gentoo.org/glsa/glsa-200801-03.xml</url>
|
|
<url>http://secunia.com/advisories/27897</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-12-03</discovery>
|
|
<entry>2008-01-22</entry>
|
|
<modified>2008-02-12</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="e5a9de5f-c6bc-11dc-b9f1-00a0cce0781e">
|
|
<topic>IRC Services-- Denial of Service Vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>ircservices</name>
|
|
<range><lt>5.0.63</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/27761">
|
|
<p>A vulnerability has been reported in IRC Services,
|
|
which can be exploited by malicious people to cause
|
|
a Denial of Service. The vulnerability is caused due
|
|
to the improper handling of overly long passwords within
|
|
the "default_encrypt()" function in encrypt.c and can be
|
|
exploited to crash an affected server.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2007-6122</cvename>
|
|
<url>http://secunia.com/advisories/27761</url>
|
|
<url>http://ircservices.za.net/Changes.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-11-21</discovery>
|
|
<entry>2008-01-19</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="02eedd3c-c6b5-11dc-93b6-000e35248ad7">
|
|
<topic>libxine -- buffer overflow vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>libxine</name>
|
|
<range><lt>1.1.9.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>xine project reports:</p>
|
|
<blockquote cite="http://xinehq.de/index.php/news">
|
|
<p>A new xine-lib version is now available. This release contains
|
|
a security fix (remotely-expoitable buffer overflow, CVE-2008-0225).
|
|
It also contains a read-past-end fix for an internal library
|
|
function which is only used if the OS does not supply it and a
|
|
rendering fix for Darwin/PPC.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-0225</cvename>
|
|
<url>http://aluigi.altervista.org/adv/xinermffhof-adv.txt</url>
|
|
<url>http://secunia.com/advisories/28384</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-01-08</discovery>
|
|
<entry>2008-01-19</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="60e1792b-c380-11dc-821a-000bcdc1757a">
|
|
<topic>geeklog xss vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>geeklog</name>
|
|
<range><lt>1.4.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Geeklog reports:</p>
|
|
<blockquote cite="http://www.geeklog.net/article.php/geeklog-1.4.0sr6">
|
|
<p>MustLive pointed out a possible XSS in the form to email an
|
|
article to a friend that we're fixing with this release.</p>
|
|
<p>Please note that this problem only exists in Geeklog 1.4.0
|
|
- neither Geeklog 1.4.1 nor any older versions (1.3.x series)
|
|
have that problem.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2006-3756</cvename>
|
|
<url>http://www.geeklog.net/article.php/geeklog-1.4.0sr6</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-01-08</discovery>
|
|
<entry>2008-01-15</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="4451a4c9-c05e-11dc-982e-001372fd0af2">
|
|
<topic>drupal -- cross site request forgery</topic>
|
|
<affects>
|
|
<package>
|
|
<name>drupal5</name>
|
|
<range><lt>5.6</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>drupal4</name>
|
|
<range><lt>4.7.11</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Drupal Project reports:</p>
|
|
<blockquote cite="http://drupal.org/node/208562">
|
|
<p>The aggregator module fetches items from RSS feeds and makes
|
|
them available on the site. The module provides an option to
|
|
remove items from a particular feed. This has been implemented
|
|
as a simple GET request and is therefore vulnerable to cross
|
|
site request forgeries. For example: Should a privileged user
|
|
view a page containing an <img> tag with a specially
|
|
constructed src pointing to a remove items URL, the items would
|
|
be removed.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-0272</cvename>
|
|
<url>http://drupal.org/node/208562</url>
|
|
<url>http://secunia.com/advisories/28422/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-01-10</discovery>
|
|
<entry>2008-01-11</entry>
|
|
<modified>2010-05-12</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="6f736456-c060-11dc-982e-001372fd0af2">
|
|
<topic>drupal -- cross site scripting (utf8)</topic>
|
|
<affects>
|
|
<package>
|
|
<name>drupal5</name>
|
|
<range><lt>5.6</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>drupal4</name>
|
|
<range><lt>4.7.11</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Drupal Project reports:</p>
|
|
<blockquote cite="http://drupal.org/node/208564">
|
|
<p>When outputting plaintext Drupal strips potentially dangerous
|
|
HTML tags and attributes from HTML, and escapes characters which
|
|
have a special meaning in HTML. This output filtering secures
|
|
the site against cross site scripting attacks via user input.</p>
|
|
<p>Certain byte sequences that are invalid in the UTF8
|
|
specification are not handled properly by Internet Explorer 6
|
|
and may lead it to see a multibyte start character where none is
|
|
present. Internet Explorer 6 then consumes a number of
|
|
subsequent UTF-8 characters. This may lead to unsafe attributes
|
|
that were outside a tag for the filter to appear inside a tag
|
|
for Internet Explorer 6. This behaviour can then be used to
|
|
insert and execute javascript in the context of the website.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-0273</cvename>
|
|
<url>http://drupal.org/node/208564</url>
|
|
<url>http://secunia.com/advisories/28422/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-01-10</discovery>
|
|
<entry>2008-01-11</entry>
|
|
<modified>2010-05-12</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="f0fa19dd-c060-11dc-982e-001372fd0af2">
|
|
<topic>drupal -- cross site scripting (register_globals)</topic>
|
|
<affects>
|
|
<package>
|
|
<name>drupal5</name>
|
|
<range><lt>5.6</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>drupal4</name>
|
|
<range><lt>4.7.11</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Drupal Project reports:</p>
|
|
<blockquote cite="http://drupal.org/node/208565">
|
|
<p>When theme .tpl.php files are accessible via the web and the PHP
|
|
setting register_globals is set to enabled, anonymous users are
|
|
able to execute cross site scripting attacks via specially
|
|
crafted links.</p>
|
|
<p>Drupal's .htaccess attempts to set register_globals to disabled
|
|
and also prevents access to .tpl.php files. Only when both these
|
|
measures are not effective and your PHP interpreter is
|
|
configured with register_globals set to enabled, will this issue
|
|
affect you.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-0274</cvename>
|
|
<url>http://drupal.org/node/208565</url>
|
|
<url>http://secunia.com/advisories/28422/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-01-10</discovery>
|
|
<entry>2008-01-11</entry>
|
|
<modified>2010-05-12</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="f358de71-bf64-11dc-928b-0016179b2dd5">
|
|
<topic>maradns -- CNAME record resource rotation denial of service</topic>
|
|
<affects>
|
|
<package>
|
|
<name>maradns</name>
|
|
<range><lt>1.2.12.08</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/28329">
|
|
<p>A vulnerability has been reported in MaraDNS, which can be
|
|
exploited by malicious people to cause a Denial of Service.</p>
|
|
<p>The vulnerability is caused due to an error within the handling of
|
|
certain DNS packets. This can be exploited to cause a resource
|
|
rotation by sending specially crafted DNS packets, which cause an
|
|
authoritative CNAME record to not resolve, resulting in a Denial of
|
|
Sevices.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2008-0061</cvename>
|
|
<url>http://maradns.blogspot.com/2007/08/maradns-update-all-versions.html</url>
|
|
<url>http://secunia.com/advisories/28329</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2008-01-04</discovery>
|
|
<entry>2008-01-10</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="f762ccbb-baed-11dc-a302-000102cc8983">
|
|
<topic>linux-realplayer -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>linux-realplayer</name>
|
|
<range><ge>10.0.5</ge><lt>10.0.9.809.20070726</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/27361">
|
|
<p>Multiple vulnerabilities have been reported in
|
|
RealPlayer/RealOne/HelixPlayer, which can be exploited by malicious
|
|
people to compromise a user's system.</p>
|
|
<p>An input validation error when processing .RA/.RAM files can be
|
|
exploited to cause a heap corruption via a specially crafted
|
|
.RA/.RAM file with an overly large size field in the header.</p>
|
|
<p>An error in the processing of .PLS files can be exploited to cause
|
|
a memory corruption and execute arbitrary code via a specially
|
|
crafted .PLS file.</p>
|
|
<p>An input validation error when parsing .SWF files can be exploited
|
|
to cause a buffer overflow via a specially crafted .SWF file with
|
|
malformed record headers.</p>
|
|
<p>A boundary error when processing rm files can be exploited to
|
|
cause a buffer overflow.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2007-5081</cvename>
|
|
<cvename>CVE-2007-3410</cvename>
|
|
<cvename>CVE-2007-2263</cvename>
|
|
<cvename>CVE-2007-2264</cvename>
|
|
<url>http://secunia.com/advisories/27361</url>
|
|
<url>http://service.real.com/realplayer/security/10252007_player/en/</url>
|
|
<url>http://www.zerodayinitiative.com/advisories/ZDI-07-063.html</url>
|
|
<url>http://www.zerodayinitiative.com/advisories/ZDI-07-062.html</url>
|
|
<url>http://www.zerodayinitiative.com/advisories/ZDI-07-061.html</url>
|
|
<url>http://secunia.com/advisories/25819/</url>
|
|
<certvu>759385</certvu>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-10-25</discovery>
|
|
<entry>2008-01-04</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="562cf6c4-b9f1-11dc-a302-000102cc8983">
|
|
<topic>linux-flashplugin -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>linux-flashplugin</name>
|
|
<range><ge>9.0</ge><lt>9.0r115</lt></range>
|
|
<range><ge>7.0</ge><lt>7.0r73</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Adobe Security bulletin:</p>
|
|
<blockquote cite="http://www.adobe.com/support/security/bulletins/apsb07-20.html">
|
|
<p>Critical vulnerabilities have been identified in Adobe Flash
|
|
Player that could allow an attacker who successfully exploits these
|
|
potential vulnerabilities to take control of the affected system. A
|
|
malicious SWF must be loaded in Flash Player by the user for an
|
|
attacker to exploit these potential vulnerabilities. Users are
|
|
recommended to update to the most current version of Flash Player
|
|
available for their platform.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2007-6242</cvename>
|
|
<cvename>CVE-2007-4768</cvename>
|
|
<cvename>CVE-2007-5275</cvename>
|
|
<cvename>CVE-2007-6243</cvename>
|
|
<cvename>CVE-2007-6244</cvename>
|
|
<cvename>CVE-2007-6245</cvename>
|
|
<cvename>CVE-2007-4324</cvename>
|
|
<cvename>CVE-2007-6246</cvename>
|
|
<cvename>CVE-2007-5476</cvename>
|
|
<url>http://www.adobe.com/support/security/bulletins/apsb07-20.html</url>
|
|
<url>http://secunia.com/advisories/28161/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-12-18</discovery>
|
|
<entry>2008-01-03</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="cf484358-b5d6-11dc-8de0-001c2514716c">
|
|
<topic>dovecot -- Specific LDAP + auth cache configuration may mix up user logins</topic>
|
|
<affects>
|
|
<package>
|
|
<name>dovecot</name>
|
|
<range><lt>1.0.10</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Dovecot reports:</p>
|
|
<blockquote cite="http://www.dovecot.org/list/dovecot-news/2007-December/000057.html">
|
|
<p>If two users with the same password and same pass_filter
|
|
variables log in within auth_cache_ttl seconds (1h by default),
|
|
the second user may get logged in with the first user's cached
|
|
pass_attrs. For example if pass_attrs contained the user's
|
|
home/mail directory, this would mean that the second user will
|
|
be accessing the first user's mails.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://www.dovecot.org/list/dovecot-news/2007-December/000057.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-12-21</discovery>
|
|
<entry>2007-12-29</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="4aab7bcd-b294-11dc-a6f0-00a0cce0781e">
|
|
<topic>gallery2 -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>gallery2</name>
|
|
<range><lt>2.2.4</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Gallery team reports:</p>
|
|
<blockquote cite="http://gallery.menalto.com/gallery_2.2.4_released">
|
|
<p>Gallery 2.2.4 addresses the following security
|
|
vulnerabilities:</p>
|
|
<ul>
|
|
<li>Publish XP module - Fixed unauthorized album creation
|
|
and file uploads.</li>
|
|
<li>URL rewrite module - Fixed local file inclusion
|
|
vulnerability in unsecured admin controller and
|
|
information disclosure in hotlink protection.</li>
|
|
<li>Core / add-item modules - Fixed Cross Site Scripting
|
|
(XSS) vulnerabilities through malicious file names.</li>
|
|
<li>Installation (Gallery application) - Update
|
|
web-accessibility protection of the storage folder for
|
|
Apache 2.2.</li>
|
|
<li>Core (Gallery application) / MIME module - Fixed
|
|
vulnerability in checks for disallowed file extensions
|
|
in file uploads.</li>
|
|
<li>Gallery Remote module - Added missing permissions
|
|
checks for some GR commands.</li>
|
|
<li>WebDAV module - Fixed Cross Site Scripting (XSS)
|
|
vulnerability through HTTP PROPPATCH.</li>
|
|
<li>WebDAV module - Fixed information (item data)
|
|
disclosure in a WebDAV view.</li>
|
|
<li>Comment module - Fixed information (item data)
|
|
disclosure in comment views.</li>
|
|
<li>Core module (Gallery application) - Improved
|
|
resilience against item information disclosure
|
|
attacks.</li>
|
|
<li>Slideshow module - Fixed information (item data)
|
|
disclosure in the slideshow.</li>
|
|
<li>Print modules - Fixed information (item data)
|
|
disclosure in several print modules.</li>
|
|
<li>Core / print modules - Fixed arbitrary URL redirection
|
|
(phishing attacks) in the core module and several print
|
|
modules.</li>
|
|
<li>WebCam module - Fixed proxied request weakness.</li>
|
|
</ul>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2007-6685</cvename>
|
|
<cvename>CVE-2007-6686</cvename>
|
|
<cvename>CVE-2007-6687</cvename>
|
|
<cvename>CVE-2007-6689</cvename>
|
|
<cvename>CVE-2007-6690</cvename>
|
|
<cvename>CVE-2007-6692</cvename>
|
|
<url>http://gallery.menalto.com/gallery_2.2.4_released</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-12-24</discovery>
|
|
<entry>2007-12-25</entry>
|
|
<modified>2010-05-12</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="299e3f81-aee7-11dc-b781-0016179b2dd5">
|
|
<topic>e2fsprogs -- heap buffer overflow</topic>
|
|
<affects>
|
|
<package>
|
|
<name>e2fsprogs</name>
|
|
<range><lt>1.40.3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Theodore Y. Ts'o reports:</p>
|
|
<blockquote cite="http://sourceforge.net/project/shownotes.php?group_id=2406&release_id=560230">
|
|
<p>Fix a potential security vulnerability where an untrusted
|
|
filesystem can be corrupted in such a way that a program using
|
|
libext2fs will allocate a buffer which is far too small. This
|
|
can lead to either a crash or potentially a heap-based buffer
|
|
overflow crash. No known exploits exist, but main concern is
|
|
where an untrusted user who possesses privileged access in a
|
|
guest Xen environment could corrupt a filesystem which is then
|
|
accessed by thus allowing the untrusted user to gain privileged
|
|
access in the host OS. Thanks to the McAfee AVERT Research group
|
|
for reporting this issue.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>26772</bid>
|
|
<cvename>CVE-2007-5497</cvename>
|
|
<url>http://secunia.com/advisories/27889/</url>
|
|
<url>http://sourceforge.net/project/shownotes.php?group_id=2406&release_id=560230</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-12-07</discovery>
|
|
<entry>2007-12-20</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="8a835235-ae84-11dc-a5f9-001a4d49522b">
|
|
<topic>wireshark -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>wireshark</name>
|
|
<name>wireshark-lite</name>
|
|
<name>ethereal</name>
|
|
<name>ethereal-lite</name>
|
|
<name>tethereal</name>
|
|
<name>tethereal-lite</name>
|
|
<range><ge>0.8.16</ge><lt>0.99.7</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Wireshark team reports of multiple vulnerabilities:</p>
|
|
<blockquote cite="http://www.wireshark.org/security/wnpa-sec-2007-03.html">
|
|
<ul>
|
|
<li>Wireshark could crash when reading an MP3 file.</li>
|
|
<li>Beyond Security discovered that Wireshark could loop
|
|
excessively while reading a malformed DNP packet.</li>
|
|
<li>Stefan Esser discovered a buffer overflow in the SSL
|
|
dissector.</li>
|
|
<li>The ANSI MAP dissector could be susceptible to a
|
|
buffer overflow on some platforms.</li>
|
|
<li>The Firebird/Interbase dissector could go into an
|
|
infinite loop or crash.</li>
|
|
<li>The NCP dissector could cause a crash.</li>
|
|
<li>The HTTP dissector could crash on some systems while
|
|
decoding chunked messages.</li>
|
|
<li>The MEGACO dissector could enter a large loop and
|
|
consume system resources.</li>
|
|
<li>The DCP ETSI dissector could enter a large loop and
|
|
consume system resources.</li>
|
|
<li>Fabiodds discovered a buffer overflow in the iSeries
|
|
(OS/400) Communication trace file parser.</li>
|
|
<li>The PPP dissector could overflow a buffer.</li>
|
|
<li>The Bluetooth SDP dissector could go into an infinite
|
|
loop.</li>
|
|
<li>A malformed RPC Portmap packet could cause a
|
|
crash.</li>
|
|
<li>The IPv6 dissector could loop excessively.</li>
|
|
<li>The USB dissector could loop excessively or crash.</li>
|
|
<li>The SMB dissector could crash.</li>
|
|
<li>The RPL dissector could go into an infinite loop.</li>
|
|
<li>The WiMAX dissector could crash due to unaligned
|
|
access on some platforms.</li>
|
|
<li>The CIP dissector could attempt to allocate a huge
|
|
amount of memory and crash.</li>
|
|
</ul>
|
|
|
|
<h2>Impact</h2>
|
|
|
|
<p>It may be possible to make Wireshark or Ethereal crash or
|
|
use up available memory by injecting a purposefully
|
|
malformed packet onto the wire or by convincing someone to
|
|
read a malformed packet trace file.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2007-6112</cvename>
|
|
<cvename>CVE-2007-6113</cvename>
|
|
<cvename>CVE-2007-6114</cvename>
|
|
<cvename>CVE-2007-6115</cvename>
|
|
<cvename>CVE-2007-6117</cvename>
|
|
<cvename>CVE-2007-6118</cvename>
|
|
<cvename>CVE-2007-6120</cvename>
|
|
<cvename>CVE-2007-6121</cvename>
|
|
<cvename>CVE-2007-6438</cvename>
|
|
<cvename>CVE-2007-6439</cvename>
|
|
<cvename>CVE-2007-6441</cvename>
|
|
<cvename>CVE-2007-6450</cvename>
|
|
<cvename>CVE-2007-6451</cvename>
|
|
<url>http://www.wireshark.org/security/wnpa-sec-2007-03.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-12-19</discovery>
|
|
<entry>2007-12-19</entry>
|
|
<modified>2007-12-22</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="31b045e7-ae75-11dc-a5f9-001a4d49522b">
|
|
<topic>opera -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>opera</name>
|
|
<name>opera-devel</name>
|
|
<name>linux-opera</name>
|
|
<range><lt>9.25</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Opera Software ASA reports about multiple security
|
|
fixes:</p>
|
|
<blockquote cite="http://www.opera.com/docs/changelogs/freebsd/925/">
|
|
<ul>
|
|
<li>Fixed an issue where plug-ins could be used to allow
|
|
cross domain scripting, as reported by David
|
|
Bloom. Details will be disclosed at a later date.</li>
|
|
<li>Fixed an issue with TLS certificates that could be
|
|
used to execute arbitrary code, as reported by Alexander
|
|
Klink (Cynops GmbH). Details will be disclosed at a
|
|
later date.</li>
|
|
<li>Rich text editing can no longer be used to allow cross
|
|
domain scripting, as reported by David Bloom. See our
|
|
advisory.</li>
|
|
<li>Prevented bitmaps from revealing random data from
|
|
memory, as reported by Gynvael Coldwind. Details will be
|
|
disclosed at a later date.</li>
|
|
</ul>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2007-6520</cvename>
|
|
<cvename>CVE-2007-6521</cvename>
|
|
<cvename>CVE-2007-6522</cvename>
|
|
<cvename>CVE-2007-6524</cvename>
|
|
<url>http://www.opera.com/docs/changelogs/freebsd/925/</url>
|
|
<url>http://www.opera.com/support/search/view/875/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-12-19</discovery>
|
|
<entry>2007-12-19</entry>
|
|
<modified>2007-12-29</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="31435fbc-ae73-11dc-a5f9-001a4d49522b">
|
|
<topic>peercast -- buffer overflow vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>peercast</name>
|
|
<range><lt>0.1218</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Luigi Auriemma reports that peercast is vulnerable to a
|
|
buffer overflow which could lead to a DoS or potentially
|
|
remote code execution:</p>
|
|
<blockquote cite="http://aluigi.altervista.org/adv/peercasthof-adv.txt">
|
|
<p>The handshakeHTTP function which handles all the requests
|
|
received by the other clients is vulnerable to a heap
|
|
overflow which allows an attacker to fill the
|
|
loginPassword and loginMount buffers located in the
|
|
Servent class with how much data he wants.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2007-6454</cvename>
|
|
<url>http://aluigi.altervista.org/adv/peercasthof-adv.txt</url>
|
|
<url>http://secunia.com/advisories/28120/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-12-17</discovery>
|
|
<entry>2007-12-19</entry>
|
|
<modified>2010-05-12</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="fee7e059-acec-11dc-807f-001b246e4fdf">
|
|
<topic>ganglia-webfrontend -- XSS vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>ganglia-webfrontend</name>
|
|
<range><lt>3.0.6</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Ganglia project reports:</p>
|
|
<blockquote cite="http://ganglia.info/?p=60">
|
|
<p>The Ganglia development team is pleased to release Ganglia
|
|
3.0.6 (Foss) which is available[...]. This release includes a
|
|
security fix for web frontend cross-scripting vulnerability.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://sourceforge.net/mailarchive/message.php?msg_name=d4c731da0712101044l7245cba9l34974008879f47a3%40mail.gmail.com</url>
|
|
<url>http://sourceforge.net/mailarchive/forum.php?thread_name=d4c731da0712101044l7245cba9l34974008879f47a3%40mail.gmail.com&forum_name=ganglia-developers</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-12-10</discovery>
|
|
<entry>2007-12-17</entry>
|
|
<modified>2007-12-18</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="30f5ca1d-a90b-11dc-bf13-0211060005df">
|
|
<topic>qemu -- Translation Block Local Denial of Service Vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>qemu</name>
|
|
<name>qemu-devel</name>
|
|
<range><lt>0.9.0_4</lt></range>
|
|
<range><ge>0.9.0s.20070101*</ge><lt>0.9.0s.20070802_1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>SecurityFocus reports:</p>
|
|
<blockquote cite="http://www.securityfocus.com/bid/26666/discuss">
|
|
<p>QEMU is prone to a local denial-of-service vulnerability
|
|
because it fails to perform adequate boundary checks when
|
|
handling user-supplied input.</p>
|
|
<p>Attackers can exploit this issue to cause denial-of-service
|
|
conditions. Given the nature of the issue, attackers may also be
|
|
able to execute arbitrary code, but this has not been confirmed.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>26666</bid>
|
|
<cvename>CVE-2007-6227</cvename>
|
|
<url>http://www.securityfocus.com/archive/1/484429</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-11-30</discovery>
|
|
<entry>2007-12-12</entry>
|
|
<modified>2007-12-14</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="fa708908-a8c7-11dc-b41d-000fb5066b20">
|
|
<topic>drupal -- SQL injection vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>drupal5</name>
|
|
<range><lt>5.4</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>drupal4</name>
|
|
<range><lt>4.7.9</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Drupal Project reports:</p>
|
|
<blockquote cite="http://drupal.org/node/198162">
|
|
<p>The function taxonomy_select_nodes() directly injects variables
|
|
into SQL queries instead of using placeholders. While taxonomy
|
|
module itself validates the input passed to
|
|
taxonomy_select_nodes(), this is a weakness in Drupal core.
|
|
Several contributed modules, such as taxonomy_menu, ajaxLoader,
|
|
and ubrowser, directly pass user input to taxonomy_select_nodes(),
|
|
enabling SQL injection attacks by anonymous users.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2007-6299</cvename>
|
|
<url>http://drupal.org/node/198162</url>
|
|
<url>http://secunia.com/advisories/27932/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-12-05</discovery>
|
|
<entry>2007-12-12</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="ffcbd42d-a8c5-11dc-bec2-02e0185f8d72">
|
|
<topic>samba -- buffer overflow vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>samba</name>
|
|
<name>samba3</name>
|
|
<name>ja-samba</name>
|
|
<range><lt>3.0.28</lt></range>
|
|
<range><gt>*,1</gt><lt>3.0.28,1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secuna Research reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/27760/">
|
|
<p>Secunia Research has discovered a vulnerability in Samba, which
|
|
can be exploited by malicious people to compromise a vulnerable
|
|
system. The vulnerability is caused due to a boundary error within
|
|
the "send_mailslot()" function. This can be exploited to cause a
|
|
stack-based buffer overflow with zero bytes via a specially crafted
|
|
"SAMLOGON" domain logon packet containing a username string placed
|
|
at an odd offset followed by an overly long GETDC string.
|
|
Successful exploitation allows execution of arbitrary code, but
|
|
requires that the "domain logons" option is enabled.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2007-6015</cvename>
|
|
<url>http://secunia.com/advisories/27760/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-12-10</discovery>
|
|
<entry>2007-12-12</entry>
|
|
<modified>2008-09-26</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="b2571f88-a867-11dc-a6f0-00a0cce0781e">
|
|
<topic>smbftpd -- format string vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>smbftpd</name>
|
|
<range><lt>0.96</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/27014/">
|
|
<p>Format string vulnerability in the SMBDirList function in dirlist.c
|
|
in SmbFTPD 0.96 allows remote attackers to execute arbitrary code
|
|
via format string specifiers in a directory name.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2007-5184</cvename>
|
|
<url>http://secunia.com/advisories/27014/</url>
|
|
<url>http://sourceforge.net/project/shownotes.php?release_id=543077</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-10-01</discovery>
|
|
<entry>2007-12-12</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="6ae7cef2-a6ae-11dc-95e6-000c29c5647f">
|
|
<topic>jetty -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>jetty</name>
|
|
<range><lt>6.1.6</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<blockquote cite="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-5613">
|
|
<p>Cross-site scripting (XSS) vulnerability in Dump Servlet in
|
|
Mortbay Jetty before 6.1.6rc1 allows remote attackers to inject
|
|
arbitrary web script or HTML via unspecified parameters and
|
|
cookies.</p>
|
|
</blockquote>
|
|
<blockquote cite="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-5614">
|
|
<p>Mortbay Jetty before 6.1.6rc1 does not properly handle "certain
|
|
quote sequences" in HTML cookie parameters, which allows remote
|
|
attackers to hijack browser sessions via unspecified vectors.</p>
|
|
</blockquote>
|
|
<blockquote cite="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-5615">
|
|
<p>CRLF injection vulnerability in Mortbay Jetty before 6.1.6rc0
|
|
allows remote attackers to inject arbitrary HTTP headers and
|
|
conduct HTTP response splitting attacks via unspecified vectors.
|
|
</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<certvu>237888</certvu>
|
|
<certvu>212984</certvu>
|
|
<certvu>438616</certvu>
|
|
<cvename>CVE-2007-5613</cvename>
|
|
<cvename>CVE-2007-5614</cvename>
|
|
<cvename>CVE-2007-5615</cvename>
|
|
<url>http://svn.codehaus.org/jetty/jetty/trunk/VERSION.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-12-05</discovery>
|
|
<entry>2007-12-10</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="821afaa2-9e9a-11dc-a7e3-0016360406fa">
|
|
<topic>liveMedia -- DoS vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>liveMedia</name>
|
|
<range><lt>2007.11.18,1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The live555 development team reports:</p>
|
|
<blockquote cite="http://www.live555.com/liveMedia/public/changelog.txt">
|
|
<p>Fixed a bounds-checking error in "parseRTSPRequestString()"
|
|
caused by an int vs. unsigned problem.</p>
|
|
</blockquote>
|
|
<blockquote cite="http://aluigi.altervista.org/adv/live555x-adv.txt">
|
|
<p>The function which handles the incoming queries from the
|
|
clients is affected by a vulnerability which allows an attacker
|
|
to crash the server remotely using the smallest RTSP query
|
|
possible to use.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2007-6036</cvename>
|
|
<url>http://aluigi.altervista.org/adv/live555x-adv.txt</url>
|
|
<url>http://www.live555.com/liveMedia/public/changelog.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-11-20</discovery>
|
|
<entry>2007-12-08</entry>
|
|
<modified>2007-12-09</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="610bc692-a2ad-11dc-900c-000bcdc1757a">
|
|
<topic>GNU finger vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>gnu-finger</name>
|
|
<range><le>1.37_1</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>GNU security announcement:</p>
|
|
<blockquote cite="http://www.gnu.org/software/finger/">
|
|
<p>GNU Finger unfortunately has not been updated in
|
|
many years, and has known security vulnerabilities.
|
|
Please do not use it in production environments.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-1999-1165</cvename>
|
|
<url>http://www.gnu.org/software/finger/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>1999-07-21</discovery>
|
|
<entry>2007-12-05</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="6eb580d7-a29c-11dc-8919-001c2514716c">
|
|
<topic>Squid -- Denial of Service Vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>squid</name>
|
|
<range><ge>2.0</ge><lt>2.6.16_1</lt></range>
|
|
<range><ge>3.*</ge><lt>3.0.r1.20071001_1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Squid secuirty advisory reports:</p>
|
|
<blockquote cite="http://www.squid-cache.org/Advisories/SQUID-2007_2.txt">
|
|
<p>Due to incorrect bounds checking Squid is vulnerable
|
|
to a denial of service check during some cache update
|
|
reply processing.</p>
|
|
<p>This problem allows any client trusted to use the
|
|
service to perform a denial of service attack on the
|
|
Squid service.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>26687</bid>
|
|
<cvename>CVE-2007-6239</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-11-28</discovery>
|
|
<entry>2007-12-04</entry>
|
|
<modified>2007-12-07</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="30acb8ae-9d46-11dc-9114-001c2514716c">
|
|
<topic>rubygem-rails -- session-fixation vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>rubygem-rails</name>
|
|
<range><lt>1.2.6</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Rails core team reports:</p>
|
|
<blockquote cite="http://weblog.rubyonrails.com/2007/11/24/ruby-on-rails-1-2-6-security-and-maintenance-release">
|
|
<p>The rails core team has released ruby on rails 1.2.6 to
|
|
address a bug in the fix for session fixation attacks
|
|
(CVE-2007-5380). The CVE Identifier for this new issue
|
|
is CVE-2007-6077.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2007-6077</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-11-24</discovery>
|
|
<entry>2007-11-27</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="44fb0302-9d38-11dc-9114-001c2514716c">
|
|
<topic>rubygem-rails -- JSON XSS vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>rubygem-rails</name>
|
|
<range><lt>1.2.5</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>rubygem-activesupport</name>
|
|
<range><lt>1.4.4</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Rails core team reports:</p>
|
|
<blockquote cite="http://weblog.rubyonrails.org/2007/10/12/rails-1-2-5-maintenance-release">
|
|
<p>All users of Rails 1.2.4 or earlier are advised to upgrade
|
|
to 1.2.5, though it isn't strictly necessary if you
|
|
aren't working with JSON. For more information the JSON
|
|
vulnerability, see CVE-2007-3227.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2007-3227</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-10-12</discovery>
|
|
<entry>2007-11-28</entry>
|
|
<modified>2007-12-01</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="31d9fbb4-9d09-11dc-a29d-0016d325a0ed">
|
|
<topic>ikiwiki -- improper symlink verification vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>ikiwiki</name>
|
|
<range><lt>2.14</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The ikiwiki development team reports:</p>
|
|
<blockquote cite="http://ikiwiki.info/security/#index29h2">
|
|
<p>Ikiwiki did not check if path to the srcdir to contained a
|
|
symlink. If an attacker had commit access to the directories in
|
|
the path, they could change it to a symlink, causing ikiwiki to
|
|
read and publish files that were not intended to be
|
|
published. (But not write to them due to other checks.)</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://ikiwiki.info/security/#index29h2</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-11-26</discovery>
|
|
<entry>2007-11-27</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="f1f6f6da-9d2f-11dc-9114-001c2514716c">
|
|
<topic>firefox -- multiple remote unspecified memory corruption vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>firefox</name>
|
|
<range><lt>2.0.0.10,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-firefox</name>
|
|
<range><lt>2.0.0.10</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>seamonkey</name>
|
|
<name>linux-seamonkey</name>
|
|
<range><lt>1.1.7</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>flock</name>
|
|
<name>linux-flock</name>
|
|
<range><lt>1.0.2</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-firefox-devel</name>
|
|
<range><lt>3.0.a2007.12.12</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-seamonkey-devel</name>
|
|
<range><lt>2.0.a2007.12.12</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Mozilla Foundation reports:</p>
|
|
<blockquote cite="http://www.mozilla.org/security/announce/2007/mfsa2007-38.html">
|
|
<p>The Firefox 2.0.0.10 update contains fixes for three bugs that
|
|
improve the stability of the product. These crashes showed some
|
|
evidence of memory corruption under certain circumstances and we
|
|
presume that with enough effort at least some of these could be
|
|
exploited to run arbitrary code.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>26593</bid>
|
|
<cvename>CVE-2007-5959</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-11-26</discovery>
|
|
<entry>2007-11-27</entry>
|
|
<modified>2007-12-14</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="15485ae8-9848-11dc-9e48-0016179b2dd5">
|
|
<topic>phpmyadmin -- Cross Site Scripting</topic>
|
|
<affects>
|
|
<package>
|
|
<name>phpmyadmin</name>
|
|
<range><lt>2.11.2.2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>phpMyAdmin security announcement:</p>
|
|
<blockquote cite="http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2007-8">
|
|
<p>The login page auth_type cookie was vulnerable to XSS via
|
|
the convcharset parameter. An attacker could use this to
|
|
execute malicious code on the visitors computer</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2007-6100</cvename>
|
|
<url>http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2007-8</url>
|
|
<url>http://www.nth-dimension.org.uk/downloads.php?id=38</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-11-20</discovery>
|
|
<entry>2007-11-21</entry>
|
|
<modified>2010-05-12</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="a63b15f9-97ff-11dc-9e48-0016179b2dd5">
|
|
<topic>samba -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>samba</name>
|
|
<name>samba3</name>
|
|
<name>ja-samba</name>
|
|
<range><lt>3.0.26a</lt></range>
|
|
<range><gt>*,1</gt><lt>3.0.26a_2,1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Samba Team reports:</p>
|
|
<blockquote cite="http://us1.samba.org/samba/security/CVE-2007-5398.html">
|
|
<p>Secunia Research reported a vulnerability that allows for
|
|
the execution of arbitrary code in nmbd. This defect may
|
|
only be exploited when the "wins support" parameter has
|
|
been enabled in smb.conf.</p>
|
|
</blockquote>
|
|
<blockquote cite="http://us1.samba.org/samba/security/CVE-2007-4572.html">
|
|
<p>Samba developers have discovered what is believed to be
|
|
a non-exploitable buffer over in nmbd during the processing
|
|
of GETDC logon server requests. This code is only used
|
|
when the Samba server is configured as a Primary or Backup
|
|
Domain Controller.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>26454</bid>
|
|
<cvename>CVE-2007-4572</cvename>
|
|
<cvename>CVE-2007-5398</cvename>
|
|
<url>http://secunia.com/advisories/27450/</url>
|
|
<url>http://us1.samba.org/samba/security/CVE-2007-4572.html</url>
|
|
<url>http://us1.samba.org/samba/security/CVE-2007-5398.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-11-15</discovery>
|
|
<entry>2007-11-21</entry>
|
|
<modified>2008-09-26</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="392b5b1d-9471-11dc-9db7-001c2514716c">
|
|
<topic>php -- multiple security vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>php5</name>
|
|
<range><lt>5.2.5</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>PHP project reports:</p>
|
|
<blockquote cite="http://www.php.net/releases/5_2_5.php">
|
|
<p>Security Enhancements and Fixes in PHP 5.2.5:</p>
|
|
<ul>
|
|
<li>Fixed dl() to only accept filenames. Reported by Laurent
|
|
Gaffie.</li>
|
|
<li>Fixed dl() to limit argument size to MAXPATHLEN (CVE-2007-4887).
|
|
Reported by Laurent Gaffie.</li>
|
|
<li>Fixed htmlentities/htmlspecialchars not to accept partial
|
|
multibyte sequences. Reported by Rasmus Lerdorf</li>
|
|
<li>Fixed possible triggering of buffer overflows inside glibc
|
|
implementations of the fnmatch(), setlocale() and glob()
|
|
functions. Reported by Laurent Gaffie.</li>
|
|
<li>Fixed "mail.force_extra_parameters" php.ini directive not to be
|
|
modifiable in .htaccess due to the security implications. Reported
|
|
by SecurityReason.</li>
|
|
<li>Fixed bug #42869 (automatic session id insertion adds sessions
|
|
id to non-local forms).</li>
|
|
<li>Fixed bug #41561 (Values set with php_admin_* in httpd.conf can
|
|
be overwritten with ini_set()).</li>
|
|
</ul>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>26403</bid>
|
|
<cvename>CVE-2007-4887</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-11-08</discovery>
|
|
<entry>2007-11-16</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="a7080c30-91a2-11dc-b2eb-00b0d07e6c7e">
|
|
<topic>mt-daapd -- denial of service vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>mt-daapd</name>
|
|
<range><lt>0.2.4.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>US-CERT reports:</p>
|
|
<blockquote cite="http://www.us-cert.gov/cas/bulletins/SB07-316.html">
|
|
<p>webserver.c in mt-dappd in Firefly Media Server 0.2.4 and
|
|
earlier allows remote attackers to cause a denial of service
|
|
(NULL dereference and daemon crash) via a stats method action
|
|
to /xml-rpc with (1) an empty Authorization header line, which
|
|
triggers a crash in the ws_decodepassword function; or (2) a
|
|
header line without a ':' character, which triggers a crash
|
|
in the ws_getheaders function.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2007-5824</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-11-05</discovery>
|
|
<entry>2007-11-12</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="92f86b93-923f-11dc-a2bf-02e081235dab">
|
|
<topic>net-snmp -- denial of service via GETBULK request</topic>
|
|
<affects>
|
|
<package>
|
|
<name>net-snmp</name>
|
|
<range><lt>5.3.1_7</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>CVE reports:</p>
|
|
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5846">
|
|
<p>The SNMP agent (snmp_agent.c) in net-snmp before 5.4.1
|
|
allows remote attackers to cause a denial of service (CPU
|
|
and memory consumption) via a GETBULK request with a large
|
|
max-repeaters value.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2007-5846</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-11-06</discovery>
|
|
<entry>2007-11-13</entry>
|
|
<modified>2007-11-14</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="ff65eecb-91e4-11dc-bd6c-0016179b2dd5">
|
|
<topic>flac -- media file processing integer overflow vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>flac</name>
|
|
<range><lt>1.1.2_2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>iDefense Laps reports:</p>
|
|
<blockquote cite="http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=608">
|
|
<p>Remote exploitation of multiple integer overflow vulnerabilities
|
|
in libFLAC, as included with various vendor's software
|
|
distributions, allows attackers to execute arbitrary code
|
|
in the context of the currently logged in user.</p>
|
|
<p>These vulnerabilities specifically exist in the handling of
|
|
malformed FLAC media files. In each case, an integer overflow can
|
|
occur while calculating the amount of memory to allocate. As such,
|
|
insufficient memory is allocated for the data that is subsequently
|
|
read in from the file, and a heap based buffer overflow occurs.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2007-4619</cvename>
|
|
<url>http://secunia.com/advisories/27210/</url>
|
|
<url>http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=608</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-10-11</discovery>
|
|
<entry>2007-11-13</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="2747fc39-915b-11dc-9239-001c2514716c">
|
|
<topic>xpdf -- multiple remote Stream.CC vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>cups-base</name>
|
|
<range><lt>1.3.3_2</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>gpdf</name>
|
|
<range><gt>0</gt></range>
|
|
</package>
|
|
<package>
|
|
<name>kdegraphics</name>
|
|
<range><lt>3.5.8_1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>koffice</name>
|
|
<range><lt>1.6.3_3,2</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>poppler</name>
|
|
<range><lt>0.6</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>xpdf</name>
|
|
<range><lt>3.02_5</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia Research reports:</p>
|
|
<blockquote cite="http://www.securityfocus.com/archive/1/483372">
|
|
<p>Secunia Research has discovered some vulnerabilities in Xpdf,
|
|
which can be exploited by malicious people to compromise a user's
|
|
system.</p>
|
|
<ul>
|
|
<li>An array indexing error within the
|
|
"DCTStream::readProgressiveDataUnit()" method in xpdf/Stream.cc
|
|
can be exploited to corrupt memory via a specially crafted PDF
|
|
file.</li>
|
|
<li>An integer overflow error within the "DCTStream::reset()"
|
|
method in xpdf/Stream.cc can be exploited to cause a heap-based
|
|
buffer overflow via a specially crafted PDF file.</li>
|
|
<li>A boundary error within the "CCITTFaxStream::lookChar()" method
|
|
in xpdf/Stream.cc can be exploited to cause a heap-based buffer
|
|
overflow by tricking a user into opening a PDF file containing a
|
|
specially crafted "CCITTFaxDecode" filter.</li>
|
|
</ul>
|
|
<p>Successful exploitation may allow execution of arbitrary code.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>26367</bid>
|
|
<cvename>CVE-2007-4352</cvename>
|
|
<cvename>CVE-2007-5392</cvename>
|
|
<cvename>CVE-2007-5393</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-11-07</discovery>
|
|
<entry>2007-11-12</entry>
|
|
<modified>2007-11-14</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="ffba6ab0-90b5-11dc-9835-003048705d5a">
|
|
<topic>plone -- unsafe data interpreted as pickles</topic>
|
|
<affects>
|
|
<package>
|
|
<name>plone</name>
|
|
<range><ge>2.5</ge><lt>2.5.5</lt></range>
|
|
<range><ge>3.0</ge><lt>3.0.3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Plone projectreports:</p>
|
|
<blockquote cite="http://plone.org/about/security/advisories/cve-2007-5741">
|
|
<p>This hotfix corrects a vulnerability in the statusmessages
|
|
and linkintegrity modules, where unsafe network data was
|
|
interpreted as python pickles. This allows an attacker to
|
|
run arbitrary python code within the Zope/Plone process.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>26354</bid>
|
|
<cvename>CVE-2007-5741</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-11-06</discovery>
|
|
<entry>2007-11-12</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="2d2dcbb4-906c-11dc-a951-0016179b2dd5">
|
|
<topic>phpmyadmin -- cross-site scripting vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>phpMyAdmin</name>
|
|
<range><lt>2.11.2.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The DigiTrust Group reports:</p>
|
|
<blockquote cite="http://www.digitrustgroup.com/advisories/tdg-advisory071108a.html">
|
|
<p>When creating a new database, a malicious user can use a
|
|
client-side Web proxy to place malicious code in the db parameter of
|
|
the POST request. Since db_create.php does not properly sanitize
|
|
user-supplied input, an administrator could face a persistent XSS
|
|
attack when the database names are displayed.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2007-5976</cvename>
|
|
<cvename>CVE-2007-5977</cvename>
|
|
<url>http://www.digitrustgroup.com/advisories/tdg-advisory071108a.html</url>
|
|
<url>http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2007-7</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-11-11</discovery>
|
|
<entry>2007-11-11</entry>
|
|
<modified>2010-05-12</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="9b718b82-8ef5-11dc-8e42-001c2514716c">
|
|
<topic>gallery2 -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>gallery2</name>
|
|
<range><lt>2.2.3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Gallery project reports:</p>
|
|
<blockquote cite="http://gallery.menalto.com/gallery_2.2.3_released">
|
|
<p>Gallery 2.2.3 addresses the following security vulnerabilities:</p>
|
|
<ul>
|
|
<li>Unauthorized renaming of items possible with WebDAV (reported
|
|
by Merrick Manalastas)</li>
|
|
<li>Unauthorized modification and retrieval of item properties
|
|
possible with WebDAV</li>
|
|
<li>Unauthorized locking and replacing of items possible with
|
|
WebDAV</li>
|
|
<li>Unauthorized editing of data file possible via linked items with
|
|
Reupload and WebDAV (reported by Nicklous Roberts)</li>
|
|
</ul>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2007-4650</cvename>
|
|
<bid>25580</bid>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-08-29</discovery>
|
|
<entry>2007-11-09</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="20a4eb11-8ea3-11dc-a396-0016179b2dd5">
|
|
<topic>tikiwiki -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>tikiwik</name>
|
|
<range><lt>1.9.8.2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/26618/">
|
|
<p>Some vulnerabilities have been reported in TikiWiki, which
|
|
can be exploited by malicious people to conduct cross-site
|
|
scripting and script insertion attacks and disclose potentially
|
|
sensitive information.</p>
|
|
<p>Input passed to the username parameter in tiki-remind_password.php
|
|
(when remind is set to send me my password) is not properly
|
|
sanitised before being returned to the user. This can be exploited
|
|
to execute arbitrary HTML and script code (for example with meta
|
|
refreshes to a javascript: URL) in a user's browser session in
|
|
context of an affected site.</p>
|
|
<p>Input passed to the local_php and error_handler parameters in
|
|
tiki-index.php is not properly verified before being used to include
|
|
files. This can be exploited to include arbitrary files from local
|
|
resources.</p>
|
|
<p>Input passed to the imp_language parameter in
|
|
tiki-imexport_languages.php is not properly verified before being
|
|
used to include files. This can be exploited to include arbitrary
|
|
files from local resources.</p>
|
|
<p>Certain img src elements are not properly santised before being
|
|
used. This can be exploited to insert arbitrary HTML and script
|
|
code, which is executed in a user's browser session in context of an
|
|
affected site when the malicious data is viewed.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2007-4554</cvename>
|
|
<cvename>CVE-2007-5683</cvename>
|
|
<cvename>CVE-2007-5684</cvename>
|
|
<url>http://secunia.com/advisories/26618/</url>
|
|
<url>http://tikiwiki.cvs.sourceforge.net/tikiwiki/tiki/changelog.txt?view=markup&pathrev=REL-1-9-8-2</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-08-27</discovery>
|
|
<entry>2007-11-09</entry>
|
|
<modified>2008-10-03</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="8dd9722c-8e97-11dc-b8f6-001c2514716c">
|
|
<topic>cups -- off-by-one buffer overflow</topic>
|
|
<affects>
|
|
<package>
|
|
<name>cups-base</name>
|
|
<range><lt>1.3.3_1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/27233">
|
|
<p>Secunia Research has discovered a vulnerability in CUPS, which can
|
|
be exploited by malicious people to compromise a vulnerable
|
|
system.</p>
|
|
<p>The vulnerability is caused due to a boundary error within the
|
|
"ippReadIO()" function in cups/ipp.c when processing IPP (Internet
|
|
Printing Protocol) tags. This can be exploited to overwrite one
|
|
byte on the stack with a zero by sending an IPP request containing
|
|
specially crafted "textWithLanguage" or "nameWithLanguage" tags.</p>
|
|
<p>Successful exploitation allows execution of arbitrary code.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2007-4351</cvename>
|
|
<url>http://secunia.com/secunia_research/2007-76/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-11-06</discovery>
|
|
<entry>2007-11-09</entry>
|
|
<modified>2007-11-12</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="5b47c279-8cb5-11dc-8878-0016179b2dd5">
|
|
<topic>perl -- regular expressions unicode data buffer overflow</topic>
|
|
<affects>
|
|
<package>
|
|
<name>perl</name>
|
|
<name>perl-threaded</name>
|
|
<range><gt>5.8.*</gt><lt>5.8.8_1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Red Hat reports:</p>
|
|
<blockquote cite="https://rhn.redhat.com/errata/RHSA-2007-0966.html">
|
|
<p>A flaw was found in Perl's regular expression engine. Specially
|
|
crafted input to a regular expression can cause Perl to improperly
|
|
allocate memory, possibly resulting in arbitrary code running with
|
|
the permissions of the user running Perl.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2007-5116</cvename>
|
|
<url>http://secunia.com/advisories/27546/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-11-05</discovery>
|
|
<entry>2007-11-06</entry>
|
|
<modified>2007-11-07</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="bfd6eef4-8c94-11dc-8c55-001c2514716c">
|
|
<topic>pcre -- arbitrary code execution</topic>
|
|
<affects>
|
|
<package>
|
|
<name>pcre</name>
|
|
<name>pcre-utf8</name>
|
|
<range><lt>7.3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Debian project reports:</p>
|
|
<blockquote cite="http://www.debian.org/security/2007/dsa-1399">
|
|
<p>Tavis Ormandy of the Google Security Team has discovered
|
|
several security issues in PCRE, the Perl-Compatible Regular
|
|
Expression library, which potentially allow attackers to
|
|
execute arbitrary code by compiling specially crafted regular
|
|
expressions.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2007-1659</cvename>
|
|
<cvename>CVE-2007-1660</cvename>
|
|
<cvename>CVE-2007-1661</cvename>
|
|
<cvename>CVE-2007-1662</cvename>
|
|
<cvename>CVE-2007-4766</cvename>
|
|
<cvename>CVE-2007-4767</cvename>
|
|
<cvename>CVE-2007-4768</cvename>
|
|
<url>http://www.pcre.org/changelog.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-11-05</discovery>
|
|
<entry>2007-11-06</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="617a4021-8bf0-11dc-bffa-0016179b2dd5">
|
|
<topic>perdition -- str_vwrite format string vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>perdition</name>
|
|
<range><lt>1.17.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>SEC-Consult reports:</p>
|
|
<blockquote cite="http://www.sec-consult.com/300.html">
|
|
<p>Perdition IMAP is affected by a format string bug in one of its
|
|
IMAP output-string formatting functions. The bug allows the
|
|
execution of arbitrary code on the affected server.
|
|
A successful exploit does not require prior authentication.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>26270</bid>
|
|
<cvename>CVE-2007-5740</cvename>
|
|
<url>http://www.sec-consult.com/300.html</url>
|
|
<url>http://secunia.com/advisories/27458</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-10-31</discovery>
|
|
<entry>2007-11-05</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="f8b0f83c-8bb3-11dc-bffa-0016179b2dd5">
|
|
<topic>gftp -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>gftp</name>
|
|
<range><lt>2.0.18_6</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Gentoo reports:</p>
|
|
<blockquote cite="http://www.gentoo.org/security/en/glsa/glsa-200711-01.xml">
|
|
<p>Kalle Olavi Niemitalo discovered two boundary errors in fsplib code
|
|
included in gFTP when processing overly long directory or file
|
|
names.</p>
|
|
<p>A remote attacker could trigger these vulnerabilities by enticing
|
|
a user to download a file with a specially crafted directory or file
|
|
name, possibly resulting in the execution of arbitrary code or a
|
|
Denial of Service.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2007-3961</cvename>
|
|
<cvename>CVE-2007-3962</cvename>
|
|
<url>http://www.gentoo.org/security/en/glsa/glsa-200711-01.xml</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-11-01</discovery>
|
|
<entry>2007-11-05</entry>
|
|
<modified>2007-11-11</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="a1ef3fc0-8ad0-11dc-9490-0016179b2dd5">
|
|
<topic>dircproxy -- remote denial of service</topic>
|
|
<affects>
|
|
<package>
|
|
<name>dircproxy</name>
|
|
<range><lt>1.0.5_1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>dircproxy-devel</name>
|
|
<range><lt>1.2.0.b2_1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Securiweb reports:</p>
|
|
<blockquote cite="http://dircproxy.securiweb.net/ticket/89">
|
|
<p>dircproxy allows remote attackers to cause a denial of
|
|
service (segmentation fault) via an ACTION command without a
|
|
parameter, which triggers a NULL pointer dereference, as
|
|
demonstrated using a blank /me message from irssi.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2007-5226</cvename>
|
|
<url>http://dircproxy.securiweb.net/ticket/89</url>
|
|
<url>https://bugzilla.redhat.com/show_bug.cgi?id=319301</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-09-06</discovery>
|
|
<entry>2007-11-04</entry>
|
|
<modified>2008-01-31</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="a467d0f9-8875-11dc-b3ba-0016179b2dd5">
|
|
<topic>wordpress -- cross-site scripting</topic>
|
|
<affects>
|
|
<package>
|
|
<name>wordpress</name>
|
|
<name>de-wordpress</name>
|
|
<range><lt>2.3.1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>zh-wordpress</name>
|
|
<range><gt>0</gt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A Secunia Advisory report:</p>
|
|
<blockquote cite="http://secunia.com/advisories/27407">
|
|
<p>Input passed to the "posts_columns" parameter in
|
|
wp-admin/edit-post-rows.php is not properly sanitised before
|
|
being returned to the user. This can be exploited to execute
|
|
arbitrary HTML and script code in a user's browser session in
|
|
context of an affected site.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2007-5710</cvename>
|
|
<url>http://secunia.com/advisories/27407</url>
|
|
<url>http://wordpress.org/development/2007/10/wordpress-231/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-10-29</discovery>
|
|
<entry>2007-11-01</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="db449245-870d-11dc-a3ec-001921ab2fa4">
|
|
<topic>openldap -- multiple remote denial of service vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>openldap-server</name>
|
|
<range><lt>2.3.39</lt></range>
|
|
<range><gt>2.4.0</gt><lt>2.4.6</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>BugTraq reports:</p>
|
|
<blockquote cite="http://www.securityfocus.com/bid/26245/">
|
|
<p>OpenLDAP is prone to multiple remote denial-of-service
|
|
vulnerabilities because of an incorrect NULL-termination
|
|
issue and a double-free issue.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>26245</bid>
|
|
<cvename>CVE-2007-5707</cvename>
|
|
<cvename>CVE-2007-5708</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-10-29</discovery>
|
|
<entry>2007-10-30</entry>
|
|
<modified>2007-10-31</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="d2c2952d-85a1-11dc-bfff-003048705d5a">
|
|
<topic>py-django -- denial of service vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>py23-django</name>
|
|
<name>py24-django</name>
|
|
<name>py25-django</name>
|
|
<range><lt>0.96.1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>py23-django-devel</name>
|
|
<name>py24-django-devel</name>
|
|
<name>py25-django-devel</name>
|
|
<range><lt>20071026</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Django project reports:</p>
|
|
<blockquote cite="http://www.djangoproject.com/weblog/2007/oct/26/security-fix/">
|
|
<p>A per-process cache used by Django's internationalization
|
|
("i18n") system to store the results of translation lookups
|
|
for particular values of the HTTP Accept-Language header
|
|
used the full value of that header as a key. An attacker
|
|
could take advantage of this by sending repeated requests
|
|
with extremely large strings in the Accept-Language header,
|
|
potentially causing a denial of service by filling available
|
|
memory.</p>
|
|
<p>Due to limitations imposed by Web server software on the
|
|
size of HTTP header fields, combined with reasonable limits
|
|
on the number of requests which may be handled by a single
|
|
server process over its lifetime, this vulnerability may be
|
|
difficult to exploit. Additionally, it is only present when
|
|
the "USE_I18N" setting in Django is "True" and the i18n
|
|
middleware component is enabled*. Nonetheless, all users of
|
|
affected versions of Django are encouraged to update.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://www.djangoproject.com/weblog/2007/oct/26/security-fix/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-10-26</discovery>
|
|
<entry>2007-10-27</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="44224e08-8306-11dc-9283-0016179b2dd5">
|
|
<topic>opera -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>opera</name>
|
|
<name>opera-devel</name>
|
|
<name>linux-opera</name>
|
|
<range><lt>9.24</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>An advisory from Opera reports:</p>
|
|
<blockquote cite="http://www.opera.com/support/search/view/866/">
|
|
<p>If a user has configured Opera to use an external newsgroup
|
|
client or e-mail application, specially crafted Web pages can
|
|
cause Opera to run that application incorrectly. In some cases
|
|
this can lead to execution of arbitrary code.</p>
|
|
</blockquote>
|
|
<blockquote cite="http://www.opera.com/support/search/view/867/">
|
|
<p>When accesing frames from different Web sites, specially crafted
|
|
scripts can bypass the same-origin policy, and overwrite functions
|
|
from those frames. If scripts on the page then run those functions,
|
|
this can cause the script of the attacker's choice to run in the
|
|
context of the target Web site.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2007-5540</cvename>
|
|
<cvename>CVE-2007-5541</cvename>
|
|
<url>http://www.opera.com/support/search/view/866/</url>
|
|
<url>http://www.opera.com/support/search/view/867/</url>
|
|
<url>http://secunia.com/advisories/27277/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-10-17</discovery>
|
|
<entry>2007-10-25</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="9c00d446-8208-11dc-9283-0016179b2dd5">
|
|
<topic>drupal --- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>drupal4</name>
|
|
<range><lt>4.7.8</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>drupal5</name>
|
|
<range><lt>5.3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Drupal Project reports:</p>
|
|
<blockquote cite="http://drupal.org/node/184315">
|
|
<p>In some circumstances Drupal allows user-supplied data to
|
|
become part of response headers. As this user-supplied data
|
|
is not always properly escaped, this can be exploited by
|
|
malicious users to execute HTTP response splitting attacks
|
|
which may lead to a variety of issues, among them cache
|
|
poisoning, cross-user defacement and injection of arbitrary
|
|
code.</p>
|
|
</blockquote>
|
|
<blockquote cite="http://drupal.org/node/184316">
|
|
<p>The Drupal installer allows any visitor to provide credentials
|
|
for a database when the site's own database is not reachable. This
|
|
allows attackers to run arbitrary code on the site's server.
|
|
An immediate workaround is the removal of the file install.php
|
|
in the Drupal root directory.</p>
|
|
</blockquote>
|
|
<blockquote cite="http://drupal.org/node/184320">
|
|
<p>The allowed extension list of the core Upload module contains
|
|
the extension HTML by default. Such files can be used to execute
|
|
arbitrary script code in the context of the affected site when a
|
|
user views the file. Revoking upload permissions or removing the
|
|
.html extension from the allowed extension list will stop uploads
|
|
of malicious files. but will do nothing to protect your site
|
|
againstfiles that are already present. Carefully inspect the file
|
|
system path for any HTML files. We recommend you remove any HTML
|
|
file you did not update yourself. You should look for , CSS
|
|
includes, Javascript includes, and onerror="" attributes if
|
|
you need to review files individually.</p>
|
|
</blockquote>
|
|
<blockquote cite="http://drupal.org/node/184348">
|
|
<p>The Drupal Forms API protects against cross site request
|
|
forgeries (CSRF), where a malicous site can cause a user
|
|
to unintentionally submit a form to a site where he is
|
|
authenticated. The user deletion form does not follow the
|
|
standard Forms API submission model and is therefore not
|
|
protected against this type of attack. A CSRF attack may
|
|
result in the deletion of users.</p>
|
|
</blockquote>
|
|
<blockquote cite="http://drupal.org/node/184354">
|
|
<p>The publication status of comments is not passed during the
|
|
hook_comments API operation, causing various modules that rely
|
|
on the publication status (such as Organic groups, or Subscriptions)
|
|
to mail out unpublished comments.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2007-5597</cvename>
|
|
<cvename>CVE-2007-5596</cvename>
|
|
<cvename>CVE-2007-5595</cvename>
|
|
<cvename>CVE-2007-5594</cvename>
|
|
<cvename>CVE-2007-5593</cvename>
|
|
<url>http://drupal.org/node/184315</url>
|
|
<url>http://drupal.org/node/184316</url>
|
|
<url>http://drupal.org/node/184348</url>
|
|
<url>http://drupal.org/node/184354</url>
|
|
<url>http://drupal.org/node/184320</url>
|
|
<url>http://secunia.com/advisories/27292</url>
|
|
<url>http://secunia.com/advisories/27292</url>
|
|
<url>http://secunia.com/advisories/27292</url>
|
|
<url>http://secunia.com/advisories/27290</url>
|
|
<url>http://secunia.com/advisories/27290</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-10-17</discovery>
|
|
<entry>2007-10-24</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="3a81017a-8154-11dc-9283-0016179b2dd5">
|
|
<topic>ldapscripts -- Command Line User Credentials Disclosure</topic>
|
|
<affects>
|
|
<package>
|
|
<name>ldapscripts</name>
|
|
<range><lt>1.7.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Ganael Laplanche reports:</p>
|
|
<blockquote cite="http://sourceforge.net/project/shownotes.php?group_id=156483&release_id=546600">
|
|
<p>Up to now, each ldap* command was called with the -w parameter,
|
|
which allows to specify the bind password on the command line.
|
|
Unfortunately, this could make the password appear to anybody
|
|
performing a `ps` during the call. This is now avoided by using
|
|
the -y parameter and a password file.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://sourceforge.net/project/shownotes.php?group_id=156483&release_id=546600</url>
|
|
<url>http://secunia.com/advisories/27111</url>
|
|
<cvename>CVE-2007-5373</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-10-09</discovery>
|
|
<entry>2007-10-23</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="e24797af-803d-11dc-b787-003048705d5a">
|
|
<topic>firefox -- OnUnload Javascript browser entrapment vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>firefox</name>
|
|
<range><lt>2.0.0.8,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-firefox</name>
|
|
<range><lt>2.0.0.8</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>seamonkey</name>
|
|
<name>linux-seamonkey</name>
|
|
<range><lt>1.1.5</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>RedHat reports:</p>
|
|
<blockquote cite="https://rhn.redhat.com/errata/RHSA-2007-0979.html">
|
|
<p>Several flaws were found in the way in which Firefox
|
|
displayed malformed web content. A web page containing
|
|
specially-crafted content could potentially trick a user
|
|
into surrendering sensitive information. (CVE-2007-1095,
|
|
CVE-2007-3844, CVE-2007-3511, CVE-2007-5334)</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2007-1095</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-10-19</discovery>
|
|
<entry>2007-10-22</entry>
|
|
<modified>2007-10-23</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="498a8731-7cfc-11dc-96e6-0012f06707f0">
|
|
<topic>phpmyadmin -- cross-site scripting vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>phpMyAdmin</name>
|
|
<range><lt>2.11.1.2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The DigiTrust Group discovered serious XSS vulnerability in
|
|
the phpMyAdmin server_status.php script. According to their
|
|
report</p>
|
|
<blockquote cite="http://www.digitrustgroup.com/advisories/TDG-advisory071015a.html">
|
|
<p>vulnerability can be exploited to execute arbitrary HTML and
|
|
script code in a user's browser session in context of an affected
|
|
site.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2007-5589</cvename>
|
|
<url>http://www.digitrustgroup.com/advisories/TDG-advisory071015a.html</url>
|
|
<url>http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2007-6</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-10-17</discovery>
|
|
<entry>2007-10-17</entry>
|
|
<modified>2010-05-12</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="51b51d4a-7c0f-11dc-9e47-0011d861d5e2">
|
|
<topic>phpmyadmin -- cross-site scripting vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>phpMyAdmin</name>
|
|
<range><lt>2.11.1.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>SecurityFocus reports:</p>
|
|
<blockquote cite="http://www.securityfocus.com/bid/26020/discuss">
|
|
<p>phpMyAdmin is prone to a cross-site scripting vulnerability
|
|
because it fails to properly sanitize user-supplied input.</p>
|
|
<p>An attacker may leverage this issue to execute arbitrary script
|
|
code in the browser of an unsuspecting user in the context of the
|
|
affected site. This may help the attacker steal potentially
|
|
sensitive information and launch other attacks.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2007-5386</cvename>
|
|
<url>http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2007-5</url>
|
|
<url>http://www.digitrustgroup.com/advisories/TDG-advisory071009a</url>
|
|
<url>http://secunia.com/advisories/27173</url>
|
|
<bid>26020</bid>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-10-12</discovery>
|
|
<entry>2007-10-16</entry>
|
|
<modified>2007-10-20</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="7453c85d-7830-11dc-b4c8-0016179b2dd5">
|
|
<topic>nagios-plugins -- Long Location Header Buffer Overflow Vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>nagios-plugins</name>
|
|
<range><lt>1.4.10,1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A Secunia Advisory reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/27124/">
|
|
<p>The vulnerability is caused due to a boundary error within the
|
|
redir() function in check_http.c when processing HTTP Location:
|
|
header information. This can be exploited to cause a buffer overflow
|
|
by returning an overly long string in the "Location:" header to a
|
|
vulnerable system.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://sourceforge.net/forum/forum.php?forum_id=740172</url>
|
|
<url>http://secunia.com/advisories/27124/</url>
|
|
<cvename>CVE-2007-5198</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-09-28</discovery>
|
|
<entry>2007-10-11</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="172acf78-780c-11dc-b3f4-0016179b2dd5">
|
|
<topic>png -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>png</name>
|
|
<range><lt>1.2.22</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A Secunia Advisory reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/27093/">
|
|
<p>Some vulnerabilities have been reported in libpng, which can be
|
|
exploited by malicious people to cause a DoS (Denial of
|
|
Service).</p>
|
|
<p>Certain errors within libpng, including a logical NOT instead of a
|
|
bitwise NOT in pngtrtran.c, an error in the 16bit cheap transparency
|
|
extension, and an incorrect use of sizeof() may be exploited to
|
|
crash an application using the library.</p>
|
|
<p>Various out-of-bounds read errors exist within the functions
|
|
png_handle_pCAL(), png_handle_sCAL(), png_push_read_tEXt(),
|
|
png_handle_iTXt(), and png_handle_ztXt(), which may be exploited by
|
|
exploited to crash an application using the library.</p>
|
|
</blockquote>
|
|
<blockquote cite="http://secunia.com/advisories/27130/">
|
|
<p>The vulnerability is caused due to an off-by-one error within
|
|
the ICC profile chunk handling, which potentially can be
|
|
exploited to crash an application using the library.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://secunia.com/advisories/27093/</url>
|
|
<url>http://secunia.com/advisories/27130/</url>
|
|
<cvename>CVE-2007-5267</cvename>
|
|
<cvename>CVE-2007-5266</cvename>
|
|
<cvename>CVE-2007-5268</cvename>
|
|
<cvename>CVE-2007-5269</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-10-08</discovery>
|
|
<entry>2007-10-11</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="f5b29ec0-71f9-11dc-8c6a-00304881ac9a">
|
|
<topic>ImageMagick -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>ImageMagick</name>
|
|
<name>ImageMagick-nox11</name>
|
|
<range><lt>6.3.5.9</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Multiple vulnerabilities have been discovered in ImageMagick.</p>
|
|
<blockquote cite="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-4985">
|
|
<p>ImageMagick before 6.3.5-9 allows context-dependent attackers
|
|
to cause a denial of service via a crafted image file that
|
|
triggers (1) an infinite loop in the ReadDCMImage function,
|
|
related to ReadBlobByte function calls; or (2) an infinite
|
|
loop in the ReadXCFImage function, related to ReadBlobMSBLong
|
|
function calls.</p>
|
|
</blockquote>
|
|
<blockquote cite="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-4986">
|
|
<p>Multiple integer overflows in ImageMagick before 6.3.5-9
|
|
allow context-dependent attackers to execute arbitrary code
|
|
via a crafted (1) .dcm, (2) .dib, (3) .xbm, (4) .xcf, or (5)
|
|
.xwd image file, which triggers a heap-based buffer overflow.</p>
|
|
</blockquote>
|
|
<blockquote cite="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-4987">
|
|
<p>Off-by-one error in the ReadBlobString function in blob.c in
|
|
ImageMagick before 6.3.5-9 allows context-dependent attackers
|
|
to execute arbitrary code via a crafted image file, which
|
|
triggers the writing of a '\0' character to an out-of-bounds
|
|
address.</p>
|
|
</blockquote>
|
|
<blockquote cite="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-4988">
|
|
<p>Sign extension error in the ReadDIBImage function in
|
|
ImageMagick before 6.3.5-9 allows context-dependent attackers
|
|
to execute arbitrary code via a crafted width value in an
|
|
image file, which triggers an integer overflow and a
|
|
heap-based buffer overflow.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2007-4985</cvename>
|
|
<cvename>CVE-2007-4986</cvename>
|
|
<cvename>CVE-2007-4987</cvename>
|
|
<cvename>CVE-2007-4988</cvename>
|
|
<url>http://studio.imagemagick.org/pipermail/magick-announce/2007-September/000037.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-09-19</discovery>
|
|
<entry>2007-10-10</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="c93e4d41-75c5-11dc-b903-0016179b2dd5">
|
|
<topic>jdk/jre -- Applet Caching May Allow Network Access Restrictions to be Circumvented</topic>
|
|
<affects>
|
|
<package>
|
|
<name>jdk</name>
|
|
<range><ge>1.3.0</ge><lt>1.6.0.3p3</lt></range>
|
|
<range><ge>1.5.0,1</ge><lt>1.5.0.13p7,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-blackdown-jdk</name>
|
|
<range><ge>1.3.0</ge></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-sun-jdk</name>
|
|
<range><ge>1.3.0</ge><lt>1.3.1.20</lt></range>
|
|
<range><ge>1.4.0</ge><lt>1.4.2.16</lt></range>
|
|
<range><eq>1.5.0.b1</eq></range>
|
|
<range><eq>1.5.0.b1,1</eq></range>
|
|
<range><ge>1.5.0,2</ge><lt>1.5.0.13,2</lt></range>
|
|
<range><ge>1.6.0</ge><lt>1.6.0.03</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>SUN reports:</p>
|
|
<blockquote cite="http://sunsolve.sun.com/search/document.do?assetkey=1-26-103079-1">
|
|
<p>A vulnerability in the Java Runtime Environment (JRE) with applet
|
|
caching may allow an untrusted applet that is downloaded from a
|
|
malicious website to make network connections to network services
|
|
on machines other than the one that the applet was downloaded from.
|
|
This may allow network resources (such as web pages) and
|
|
vulnerabilities (that exist on these network services) which are not
|
|
otherwise normally accessible to be accessed or exploited.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://sunsolve.sun.com/search/document.do?assetkey=1-26-103079-1</url>
|
|
<cvename>CVE-2007-5232</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-10-03</discovery>
|
|
<entry>2007-10-08</entry>
|
|
<modified>2007-11-16</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="a5f667db-7596-11dc-8b7a-0019b944b34e">
|
|
<topic>xfs -- multiple vulnerabilites</topic>
|
|
<affects>
|
|
<package>
|
|
<name>xfs</name>
|
|
<range><lt>1.0.5,1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Matthieu Herrb reports:</p>
|
|
<blockquote cite="http://lists.freedesktop.org/archives/xorg/2007-October/028899.html">
|
|
<h1>Problem Description:</h1>
|
|
<p>Several vulnerabilities have been identified in xfs, the X font
|
|
server. The QueryXBitmaps and QueryXExtents protocol requests
|
|
suffer from lack of validation of their 'length' parameters.</p>
|
|
<h1>Impact:</h1>
|
|
<p>On most modern systems, the font server is accessible only for
|
|
local clients and runs with reduced privileges, but on some
|
|
systems it may still be accessible from remote clients and
|
|
possibly running with root privileges, creating an opportunity
|
|
for remote privilege escalation.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2007-4568</cvename>
|
|
<url>http://lists.freedesktop.org/archives/xorg/2007-October/028899.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-10-02</discovery>
|
|
<entry>2007-10-08</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="a058d6fa-7325-11dc-ae10-0016179b2dd5">
|
|
<topic>tcl/tk -- buffer overflow in ReadImage function</topic>
|
|
<affects>
|
|
<package>
|
|
<name>tk</name>
|
|
<name>tk-threads</name>
|
|
<range><gt>8.2.*</gt><lt>8.2.3_11</lt></range>
|
|
<range><gt>8.3.*</gt><lt>8.3.5_10</lt></range>
|
|
<range><gt>8.4.*,2</gt><lt>8.4.16,2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A Buffer overflow in the ReadImage function in generic/tkImgGIF.c
|
|
in Tcl/Tk, allows remote attackers to execute arbitrary code via
|
|
multi-frame interlaced GIF files in which later frames are smaller
|
|
than the first.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://secunia.com/advisories/26942</url>
|
|
<url>http://sourceforge.net/project/shownotes.php?release_id=541207</url>
|
|
<cvename>CVE-2007-5137</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-09-27</discovery>
|
|
<entry>2007-10-05</entry>
|
|
<modified>2011-09-04</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="91ed69f9-72c7-11dc-981a-001921ab2fa4">
|
|
<topic>firebird -- multiple remote buffer overflow vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>firebird-server</name>
|
|
<range><ge>1.*</ge><lt>1.5.5</lt></range>
|
|
<range><ge>2.0.*</ge><lt>2.0.3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>RISE Security reports:</p>
|
|
<blockquote cite="http://risesecurity.org/advisory/RISE-2007003/">
|
|
<p>There exists multiple vulnerabilities within functions
|
|
of Firebird Relational Database, which when properly
|
|
exploited can lead to remote compromise of the vulnerable
|
|
system.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>25925</bid>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-10-03</discovery>
|
|
<entry>2007-10-04</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="15ec9123-7061-11dc-b372-001921ab2fa4">
|
|
<topic>id3lib -- insecure temporary file creation</topic>
|
|
<affects>
|
|
<package>
|
|
<name>id3lib</name>
|
|
<range><lt>3.8.3_4</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Debian Bug report log reports:</p>
|
|
<blockquote cite="http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=438540">
|
|
<p>When tagging file $foo, a temporary copy of the file is
|
|
created, and for some reason, libid3 doesn't use mkstemp
|
|
but just creates $foo.XXXXXX literally, without any checking.</p>
|
|
<p>This would silently truncate and overwrite an existing
|
|
$foo.XXXXXX.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>25372</bid>
|
|
<cvename>CVE-2007-4460</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-08-20</discovery>
|
|
<entry>2007-10-01</entry>
|
|
<modified>2007-10-01</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="c9c14242-6843-11dc-82b6-02e0185f8d72">
|
|
<topic>mediawiki -- cross site scripting vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>mediawiki</name>
|
|
<range><gt>1.10.0</gt><lt>1.10.2</lt></range>
|
|
<range><gt>1.9.0</gt><lt>1.9.4</lt></range>
|
|
<range><gt>1.8.0</gt><lt>1.8.5</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The MediaWiki development team reports:</p>
|
|
<blockquote cite="http://lists.wikimedia.org/pipermail/mediawiki-announce/2007-September/000067.html">
|
|
<p>A possible HTML/XSS injection vector in the API
|
|
pretty-printing mode has been found and fixed.</p>
|
|
<p>The vulnerability may be worked around in an unfixed version
|
|
by simply disabling the API interface if it is not in use, by
|
|
adding this to LocalSettings.php:</p>
|
|
<p>$wgEnableAPI = false;</p>
|
|
<p>(This is the default setting in 1.8.x.)</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2007-4828</cvename>
|
|
<url>http://lists.wikimedia.org/pipermail/mediawiki-announce/2007-September/000067.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-09-10</discovery>
|
|
<entry>2007-09-21</entry>
|
|
<modified>2007-10-10</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="63347ee7-6841-11dc-82b6-02e0185f8d72">
|
|
<topic>wordpress -- remote sql injection vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>wordpress</name>
|
|
<range><lt>2.2.3,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>de-wordpress</name>
|
|
<name>zh-wordpress</name>
|
|
<range><lt>2.2.3</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>wordpress-mu</name>
|
|
<range><lt>1.2.4,2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Alexander Concha reports:</p>
|
|
<blockquote cite="http://www.buayacorp.com/files/wordpress/wordpress-sql-injection-advisory.html">
|
|
<p>While testing WordPress, it has been discovered a SQL
|
|
Injection vulnerability that allows an attacker to retrieve
|
|
remotely any user credentials from a vulnerable site, this
|
|
bug is caused because of early database escaping and the
|
|
lack of validation in query string like parameters.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2007-4894</cvename>
|
|
<url>http://www.buayacorp.com/files/wordpress/wordpress-sql-injection-advisory.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-09-10</discovery>
|
|
<entry>2007-09-21</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="2bc96f18-683f-11dc-82b6-02e0185f8d72">
|
|
<topic>samba -- nss_info plugin privilege escalation vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>samba</name>
|
|
<range><lt>3.0.26a</lt></range>
|
|
<range><gt>*,1</gt><lt>3.0.26a,1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Samba development team reports:</p>
|
|
<blockquote cite="http://www.samba.org/samba/security/CVE-2007-4138.html">
|
|
<p>The idmap_ad.so library provides an nss_info extension to
|
|
Winbind for retrieving a user's home directory path, login
|
|
shell and primary group id from an Active Directory domain
|
|
controller. This functionality is enabled by defining the
|
|
"winbind nss info" smb.conf option to either "sfu" or
|
|
"rfc2307".</p>
|
|
<p>Both the Windows "Identity Management for Unix" and
|
|
"Services for Unix" MMC plug-ins allow a user to be assigned
|
|
a primary group for Unix clients that differs from the user's
|
|
Windows primary group. When the rfc2307 or sfu nss_info plugin
|
|
has been enabled, in the absence of either the RFC2307 or SFU
|
|
primary group attribute, Winbind will assign a primary group ID
|
|
of 0 to the domain user queried using the getpwnam() C library
|
|
call.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2007-4138</cvename>
|
|
<url>http://www.samba.org/samba/security/CVE-2007-4138.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-09-11</discovery>
|
|
<entry>2007-09-21</entry>
|
|
<modified>2008-09-26</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="75231c63-f6a2-499d-8e27-787773bda284">
|
|
<topic>bugzilla -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>bugzilla</name>
|
|
<name>ja-bugzilla</name>
|
|
<range><ge>2.20.*</ge><lt>2.22.3</lt></range>
|
|
<range><ge>3.*</ge><lt>3.0.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A Bugzilla Security Advisory reports:</p>
|
|
<blockquote cite="http://www.bugzilla.org/security/2.20.4/">
|
|
<p>This advisory covers three security issues that have recently been
|
|
fixed in the Bugzilla code:</p>
|
|
<ul>
|
|
<li>A possible cross-site scripting (XSS) vulnerability when filing
|
|
bugs using the guided form.</li>
|
|
<li>When using email_in.pl, insufficiently escaped data may be
|
|
passed to sendmail.</li>
|
|
<li>Users using the WebService interface may access Bugzilla's
|
|
time-tracking fields even if they normally cannot see them.</li>
|
|
</ul>
|
|
<p>We strongly advise that 2.20.x and 2.22.x users should upgrade to
|
|
2.20.5 and 2.22.3 respectively. 3.0 users, and users of 2.18.x or
|
|
below, should upgrade to 3.0.1.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>25425</bid>
|
|
<cvename>CVE-2007-4538</cvename>
|
|
<cvename>CVE-2007-4539</cvename>
|
|
<cvename>CVE-2007-4543</cvename>
|
|
<url>http://www.bugzilla.org/security/2.20.4/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-08-23</discovery>
|
|
<entry>2007-09-21</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="b6f6da57-680a-11dc-b350-001921ab2fa4">
|
|
<topic>clamav -- multiple remote Denial of Service vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>clamav</name>
|
|
<range><lt>0.91.2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>BugTraq reports:</p>
|
|
<blockquote cite="http://www.securityfocus.com/bid/25398">
|
|
<p>ClamAV is prone to multiple denial-of-service vulnerabilities.</p>
|
|
<p>A successful attack may allow an attacker to crash the
|
|
application and deny service to users.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>25398</bid>
|
|
<cvename>CVE-2007-4510</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-08-21</discovery>
|
|
<entry>2007-09-21</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="12488805-6773-11dc-8be8-02e0185f8d72">
|
|
<topic>coppermine -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>coppermine</name>
|
|
<range><lt>1.4.13</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The coppermine development team reports two vulnerabilities
|
|
with the coppermine application. These vulnerabilities are
|
|
caused by improper checking of the log variable in "viewlog.php"
|
|
and improper checking of the referer variable in "mode.php".
|
|
This could allow local file inclusion, potentially disclosing
|
|
valuable information and could lead to an attacker conducting
|
|
a cross site scripting attack against the targeted site.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2007-4976</cvename>
|
|
<cvename>CVE-2007-4977</cvename>
|
|
<url>http://coppermine-gallery.net/forum/index.php?topic=46847.0</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-09-14</discovery>
|
|
<entry>2007-09-20</entry>
|
|
<modified>2010-05-12</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="e595e170-6771-11dc-8be8-02e0185f8d72">
|
|
<topic>openoffice -- arbitrary command execution vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>openoffice</name>
|
|
<range><gt>0</gt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>iDefense reports:</p>
|
|
<blockquote cite="http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=593">
|
|
<p>Remote exploitation of multiple integer overflow
|
|
vulnerabilities within OpenOffice, as included in various
|
|
vendors' operating system distributions, allows attackers to
|
|
execute arbitrary code.</p>
|
|
<p>These vulnerabilities exist within the TIFF parsing code of
|
|
the OpenOffice suite. When parsing the TIFF directory entries
|
|
for certain tags, the parser uses untrusted values from the
|
|
file to calculate the amount of memory to allocate. By
|
|
providing specially crafted values, an integer overflow occurs
|
|
in this calculation. This results in the allocation of a
|
|
buffer of insufficient size, which in turn leads to a heap
|
|
overflow.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2007-2834</cvename>
|
|
<url>http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=593</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-09-19</discovery>
|
|
<entry>2007-09-20</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="f8d3689e-6770-11dc-8be8-02e0185f8d72">
|
|
<topic>bugzilla -- "createmailregexp" security bypass vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>bugzilla</name>
|
|
<range><ge>3.*</ge><lt>3.0.2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Bugzilla development team reports:</p>
|
|
<blockquote cite="http://www.bugzilla.org/security/3.0.1/">
|
|
<p>Bugzilla::WebService::User::offer_account_by_email does
|
|
not check the "createemailregexp" parameter, and thus
|
|
allows users to create accounts who would normally be
|
|
denied account creation. The "emailregexp" parameter is
|
|
still checked. If you do not have the SOAP::Lite Perl
|
|
module installed on your Bugzilla system, your system is
|
|
not vulnerable (because the Bugzilla WebService will not
|
|
be enabled).</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2007-5038</cvename>
|
|
<url>http://www.bugzilla.org/security/3.0.1/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-09-18</discovery>
|
|
<entry>2007-09-20</entry>
|
|
<modified>2010-05-12</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="14ad2a28-66d2-11dc-b25f-02e0185f8d72">
|
|
<topic>konquerer -- address bar spoofing</topic>
|
|
<affects>
|
|
<package>
|
|
<name>kdebase</name>
|
|
<range><lt>3.5.7_3</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>kdelibs</name>
|
|
<range><lt>3.5.7_2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The KDE development team reports:</p>
|
|
<blockquote cite="http://www.kde.org/info/security/advisory-20070914-1.txt">
|
|
<p>The Konqueror address bar is vulnerable to spoofing attacks
|
|
that are based on embedding white spaces in the url. In addition
|
|
the address bar could be tricked to show an URL which it is
|
|
intending to visit for a short amount of time instead of the
|
|
current URL.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2007-3820</cvename>
|
|
<cvename>CVE-2007-4224</cvename>
|
|
<cvename>CVE-2007-4225</cvename>
|
|
<url>http://www.kde.org/info/security/advisory-20070914-1.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-09-14</discovery>
|
|
<entry>2007-09-19</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="79b616d0-66d1-11dc-b25f-02e0185f8d72">
|
|
<topic>kdm -- passwordless login vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>kdebase3</name>
|
|
<range><lt>3.5.7_3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The KDE development team reports:</p>
|
|
<blockquote cite="http://www.kde.org/info/security/advisory-20070919-1.txt">
|
|
<p>KDM can be tricked into performing a password-less login
|
|
even for accounts with a password set under certain
|
|
circumstances, namely autologin to be configured and
|
|
"shutdown with password" enabled.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2007-4569</cvename>
|
|
<url>http://www.kde.org/info/security/advisory-20070919-1.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-09-19</discovery>
|
|
<entry>2007-09-19</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="209f0d75-4b5c-11dc-a6cd-000fb5066b20">
|
|
<topic>flyspray -- authentication bypass</topic>
|
|
<affects>
|
|
<package>
|
|
<name>flyspray</name>
|
|
<range><lt>0.9.9.2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Flyspray Project reports:</p>
|
|
<blockquote cite="http://www.flyspray.org/fsa:1">
|
|
<p>Flyspray authentication system can be bypassed by sending a
|
|
carefully crafted post request.</p>
|
|
<p>To be vulnerable, PHP configuration directive output_buffering
|
|
has to be disabled or set to a low value.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2007-1788</cvename>
|
|
<url>http://www.flyspray.org/fsa:1</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-03-13</discovery>
|
|
<entry>2007-09-19</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="3ce8c7e2-66cf-11dc-b25f-02e0185f8d72">
|
|
<topic>mozilla -- code execution via Quicktime media-link files</topic>
|
|
<affects>
|
|
<package>
|
|
<name>firefox</name>
|
|
<range><lt>2.0.0.7,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-firefox</name>
|
|
<range><lt>2.0.0.7</lt></range>
|
|
</package>
|
|
<!-- Packages which probably will be upgraded -->
|
|
<package>
|
|
<name>seamonkey</name>
|
|
<name>linux-seamonkey</name>
|
|
<range><lt>1.1.5</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-firefox-devel</name>
|
|
<range><lt>3.0.a2007.12.12</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-seamonkey-devel</name>
|
|
<range><lt>2.0.a2007.12.12</lt></range>
|
|
</package>
|
|
<!-- Deprecated/old names -->
|
|
<package>
|
|
<name>firefox-ja</name>
|
|
<name>linux-mozilla-devel</name>
|
|
<name>linux-mozilla</name>
|
|
<name>mozilla</name>
|
|
<range><gt>0</gt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Mozilla Foundation reports a vulnerability within the
|
|
mozilla browser. This vulnerability also affects various
|
|
other browsers like firefox and seamonkey. The vulnerability
|
|
is caused by QuickTime Media-Link files that contain a qtnext
|
|
attribute. This could allow an attacker to start the browser
|
|
with arbitrary command-line options. This could allow the
|
|
attacker to install malware, steal local data and possibly
|
|
execute and/or do other arbitrary things within the users
|
|
context.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2006-4965</cvename>
|
|
<url>http://www.mozilla.org/security/announce/2007/mfsa2007-28.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-09-18</discovery>
|
|
<entry>2007-09-19</entry>
|
|
<modified>2007-12-14</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="71d903fc-602d-11dc-898c-001921ab2fa4">
|
|
<topic>php -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>php5</name>
|
|
<range><lt>5.2.4</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>php4</name>
|
|
<range><lt>4.4.8</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The PHP development team reports:</p>
|
|
<blockquote cite="http://www.php.net/releases/5_2_4.php">
|
|
<p>Security Enhancements and Fixes in PHP 5.2.4:</p>
|
|
<ul>
|
|
<li>Fixed a floating point exception inside wordwrap() (Reported
|
|
by Mattias Bengtsson)</li>
|
|
<li>Fixed several integer overflows inside the GD extension
|
|
(Reported by Mattias Bengtsson)</li>
|
|
<li>Fixed size calculation in chunk_split() (Reported by Gerhard
|
|
Wagner)</li>
|
|
<li>Fixed integer overflow in str[c]spn(). (Reported by Mattias
|
|
Bengtsson)</li>
|
|
<li>Fixed money_format() not to accept multiple %i or %n tokens.
|
|
(Reported by Stanislav Malyshev)</li>
|
|
<li>Fixed zend_alter_ini_entry() memory_limit interruption
|
|
vulnerability. (Reported by Stefan Esser)</li>
|
|
<li>Fixed INFILE LOCAL option handling with MySQL extensions not
|
|
to be allowed when open_basedir or safe_mode is active. (Reported
|
|
by Mattias Bengtsson)</li>
|
|
<li>Fixed session.save_path and error_log values to be checked
|
|
against open_basedir and safe_mode (CVE-2007-3378) (Reported by
|
|
Maksymilian Arciemowicz)</li>
|
|
<li>Fixed a possible invalid read in glob() win32 implementation
|
|
(CVE-2007-3806) (Reported by shinnai)</li>
|
|
<li>Fixed a possible buffer overflow in php_openssl_make_REQ
|
|
(Reported by zatanzlatan at hotbrev dot com)</li>
|
|
<li>Fixed an open_basedir bypass inside glob() function (Reported
|
|
by dr at peytz dot dk)</li>
|
|
<li>Fixed a possible open_basedir bypass inside session extension
|
|
when the session file is a symlink (Reported by c dot i dot morris
|
|
at durham dot ac dot uk)</li>
|
|
<li>Improved fix for MOPB-03-2007.</li>
|
|
<li>Corrected fix for CVE-2007-2872.</li>
|
|
</ul>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2007-2872</cvename>
|
|
<cvename>CVE-2007-3378</cvename>
|
|
<cvename>CVE-2007-3806</cvename>
|
|
<cvename>CVE-2007-3996</cvename>
|
|
<cvename>CVE-2007-3997</cvename>
|
|
<cvename>CVE-2007-3998</cvename>
|
|
<cvename>CVE-2007-4652</cvename>
|
|
<cvename>CVE-2007-4657</cvename>
|
|
<cvename>CVE-2007-4658</cvename>
|
|
<cvename>CVE-2007-4659</cvename>
|
|
<cvename>CVE-2007-4660</cvename>
|
|
<cvename>CVE-2007-4661</cvename>
|
|
<cvename>CVE-2007-4662</cvename>
|
|
<cvename>CVE-2007-4663</cvename>
|
|
<cvename>CVE-2007-4670</cvename>
|
|
<url>http://www.php.net/releases/4_4_8.php</url>
|
|
<url>http://www.php.net/releases/5_2_4.php</url>
|
|
<url>http://secunia.com/advisories/26642</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-08-30</discovery>
|
|
<entry>2007-09-11</entry>
|
|
<modified>2008-01-14</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="c115271d-602b-11dc-898c-001921ab2fa4">
|
|
<topic>apache -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>apache</name>
|
|
<range><gt>2.2.0</gt><lt>2.2.6</lt></range>
|
|
<range><gt>2.0.0</gt><lt>2.0.61</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Apache HTTP server project reports:</p>
|
|
<blockquote cite="http://www.apache.org/dist/httpd/Announcement2.2.html">
|
|
<p>The following potential security flaws are addressed:</p>
|
|
<ul>
|
|
<li>CVE-2007-3847: mod_proxy: Prevent reading past the end of a
|
|
buffer when parsing date-related headers.</li>
|
|
<li>CVE-2007-1863: mod_cache: Prevent a segmentation fault if
|
|
attributes are listed in a Cache-Control header without any
|
|
value.</li>
|
|
<li>CVE-2007-3304: prefork, worker, event MPMs: Ensure that the
|
|
parent process cannot be forced to kill processes outside its
|
|
process group.</li>
|
|
<li>CVE-2006-5752: mod_status: Fix a possible XSS attack against
|
|
a site with a public server-status page and ExtendedStatus
|
|
enabled, for browsers which perform charset "detection".
|
|
Reported by Stefan Esser.</li>
|
|
<li>CVE-2006-1862: mod_mem_cache: Copy headers into longer lived
|
|
storage; header names and values could previously point to
|
|
cleaned up storage.</li>
|
|
</ul>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2007-3847</cvename>
|
|
<cvename>CVE-2007-1863</cvename>
|
|
<cvename>CVE-2006-5752</cvename>
|
|
<cvename>CVE-2007-3304</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-09-07</discovery>
|
|
<entry>2007-09-11</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="4b673ae7-5f9a-11dc-84dd-000102cc8983">
|
|
<topic>lighttpd -- FastCGI header overrun in mod_fastcgi</topic>
|
|
<affects>
|
|
<package>
|
|
<name>lighttpd</name>
|
|
<range><lt>1.4.18</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>lighttpd maintainer reports:</p>
|
|
<blockquote cite="http://www.lighttpd.net/assets/2007/9/9/lighttpd_sa_2007_12.txt">
|
|
<p>Lighttpd is prone to a header overflow when using the mod_fastcgi
|
|
extension, this can lead to arbitrary code execution in the fastcgi
|
|
application. For a detailed description of the bug see the external
|
|
reference.</p>
|
|
<p>This bug was found by Mattias Bengtsson and Philip Olausson</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://www.lighttpd.net/assets/2007/9/9/lighttpd_sa_2007_12.txt</url>
|
|
<url>http://secweb.se/en/advisories/lighttpd-fastcgi-remote-vulnerability/</url>
|
|
<cvename>CVE-2007-4727</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-09-09</discovery>
|
|
<entry>2007-09-10</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="f14ad681-5b88-11dc-812d-0011098b2f36">
|
|
<topic>rkhunter -- insecure temporary file creation</topic>
|
|
<affects>
|
|
<package>
|
|
<name>rkhunter</name>
|
|
<range><lt>1.2.5</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Gentoo reports:</p>
|
|
<blockquote cite="http://www.gentoo.org/security/en/glsa/glsa-200504-25.xml">
|
|
<p>Sune Kloppenborg Jeppesen and Tavis Ormandy of the Gentoo Linux
|
|
Security Team have reported that the check_update.sh script and
|
|
the main rkhunter script insecurely creates several temporary
|
|
files with predictable filenames.</p>
|
|
<p>A local attacker could create symbolic links in the temporary
|
|
files directory, pointing to a valid file somewhere on the
|
|
filesystem. When rkhunter or the check_update.sh script runs,
|
|
this would result in the file being overwritten with the rights of
|
|
the user running the utility, which could be the root user.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>13399</bid>
|
|
<cvename>CVE-2005-1270</cvename>
|
|
<url>http://www.gentoo.org/security/en/glsa/glsa-200504-25.xml</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-04-26</discovery>
|
|
<entry>2007-09-05</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="72cdf2ab-5b87-11dc-812d-0011098b2f36">
|
|
<topic>lsh -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>lsh</name>
|
|
<range><lt>2.0.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/14609">
|
|
<p>A vulnerability has been reported in LSH, which potentially
|
|
can be exploited by malicious people to cause a DoS (Denial
|
|
of Service).</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2003-0826</cvename>
|
|
<cvename>CVE-2005-0814</cvename>
|
|
<url>http://secunia.com/advisories/14609</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-03-17</discovery>
|
|
<entry>2007-09-05</entry>
|
|
<modified>2008-01-07</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="45500f74-5947-11dc-87c1-000e2e5785ad">
|
|
<topic>fetchmail -- denial of service on reject of local warning message</topic>
|
|
<affects>
|
|
<package>
|
|
<name>fetchmail</name>
|
|
<range><ge>4.6.8</ge><lt>6.3.8_4</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Matthias Andree reports:</p>
|
|
<blockquote cite="http://www.fetchmail.info/fetchmail-SA-2007-02.txt">
|
|
<p>fetchmail will generate warning messages in certain
|
|
circumstances (for instance, when leaving oversized messages
|
|
on the server or login to the upstream fails) and send them
|
|
to the local postmaster or the user running it.</p>
|
|
<p>If this warning message is then refused by the SMTP listener
|
|
that fetchmail is forwarding the message to, fetchmail
|
|
crashes and does not collect further messages until it is
|
|
restarted.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2007-4565</cvename>
|
|
<url>http://www.fetchmail.info/fetchmail-SA-2007-02.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-07-29</discovery>
|
|
<entry>2007-09-02</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="d944719e-42f4-4864-89ed-f045b541919f">
|
|
<topic>gtar -- Directory traversal vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>gtar</name>
|
|
<range><lt>1.18_1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Red Hat reports:</p>
|
|
<blockquote cite="http://rhn.redhat.com/errata/RHSA-2007-0860.html">
|
|
<p>A path traversal flaw was discovered in the way GNU
|
|
tar extracted archives. A malicious user could create a
|
|
tar archive that could write to arbitrary files to which
|
|
the user running GNU tar had write access.</p>
|
|
</blockquote>
|
|
<p>Red Hat credits Dmitry V. Levin for reporting the issue.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>25417</bid>
|
|
<cvename>CVE-2007-4131</cvename>
|
|
<url>http://rhn.redhat.com/errata/RHSA-2007-0860.html</url>
|
|
<url>https://bugzilla.redhat.com/show_bug.cgi?id=251921</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-08-23</discovery>
|
|
<entry>2007-09-01</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="d9867f50-54d0-11dc-b80b-0016179b2dd5">
|
|
<topic>claws-mail -- POP3 Format String Vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>claws-mail</name>
|
|
<name>sylpheed-claws</name>
|
|
<range><lt>2.10.0_3</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>sylpheed2</name>
|
|
<range><lt>2.4.4_1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A Secunia Advisory reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/26550/">
|
|
<p>A format string error in the "inc_put_error()" function in
|
|
src/inc.c when displaying a POP3 server's error response can
|
|
be exploited via specially crafted POP3 server replies containing
|
|
format specifiers.</p>
|
|
<p>Successful exploitation may allow execution of arbitrary code,
|
|
but requires that the user is tricked into connecting to a malicious
|
|
POP3 server.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2007-2958</cvename>
|
|
<url>http://secunia.com/advisories/26550/</url>
|
|
<url>http://secunia.com/secunia_research/2007-70/advisory/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-08-24</discovery>
|
|
<entry>2007-08-27</entry>
|
|
<modified>2010-05-12</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="af8e3a0c-5009-11dc-8a43-003048705d5a">
|
|
<topic>rsync -- off by one stack overflow</topic>
|
|
<affects>
|
|
<package>
|
|
<name>rsync</name>
|
|
<range><lt>2.6.9_1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>BugTraq reports:</p>
|
|
<blockquote cite="http://www.securityfocus.com/bid/25336/discuss">
|
|
<p>The rsync utility is prone to an off-by-one buffer-overflow
|
|
vulnerability. This issue is due to a failure of the application
|
|
to properly bounds-check user-supplied input.</p>
|
|
<p>Successfully exploiting this issue may allow arbitrary
|
|
code-execution in the context of the affected utility.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>25336</bid>
|
|
<cvename>CVE-2007-4091</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-08-15</discovery>
|
|
<entry>2007-08-21</entry>
|
|
<modified>2007-08-23</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="df4a7d21-4b17-11dc-9fc2-001372ae3ab9">
|
|
<topic>opera -- Vulnerability in javascript handling</topic>
|
|
<affects>
|
|
<package>
|
|
<name>opera</name>
|
|
<name>opera-devel</name>
|
|
<name>linux-opera</name>
|
|
<range><lt>9.23.20070809</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>An advisory from Opera reports:</p>
|
|
<blockquote cite="http://www.opera.com/support/search/view/865/">
|
|
<p>A specially crafted JavaScript can make Opera execute
|
|
arbitrary code.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://www.opera.com/support/search/view/865/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-08-03</discovery>
|
|
<entry>2007-08-15</entry>
|
|
<modified>2007-08-25</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="4a338d17-412d-11dc-bdb0-0016179b2dd5">
|
|
<topic>fsplib -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>fsplib</name>
|
|
<range><lt>0.9</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A Secunia Advisory reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/26184/">
|
|
<p>fsplib can be exploited to compromise an application using
|
|
the library.</p>
|
|
<p>A boundary error exists in the processing of file names in
|
|
fsp_readdir_native, which can be exploited to cause a stack-based
|
|
buffer overflow if the defined MAXNAMLEN is bigger than 256.</p>
|
|
<p>A boundary error exists in the processing of directory entries in
|
|
fsp_readdir, which can be exploited to cause a stack-based buffer
|
|
overflow on systems with an insufficient size allocated for the
|
|
d_name field of directory entries.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2007-3961</cvename>
|
|
<cvename>CVE-2007-3962</cvename>
|
|
<url>http://secunia.com/advisories/26184/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-07-24</discovery>
|
|
<entry>2007-08-02</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="4872d9a7-4128-11dc-bdb0-0016179b2dd5">
|
|
<topic>joomla -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>joomla</name>
|
|
<range><lt>1.0.13</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A Secunia Advisory reports:</p>
|
|
<p>joomla can be exploited to conduct session fixation
|
|
attacks, cross-site scripting attacks or HTTP response
|
|
splitting attacks.</p>
|
|
<p>Certain unspecified input passed in com_search, com_content and
|
|
mod_login is not properly sanitised before being returned to a
|
|
user. This can be exploited to execute arbitrary HTML and script
|
|
code in a user's browser session in context of an affected
|
|
site.</p>
|
|
<p>Input passed to the url parameter is not properly sanitised
|
|
before being returned to the user. This can be exploited to insert
|
|
arbitrary HTTP headers, which will be included in a response sent
|
|
to the user, allowing for execution of arbitrary HTML and script
|
|
code in a user's browser session in context of an affected
|
|
site.</p>
|
|
<p>An error exists in the handling of sessions and can be exploited
|
|
to hijack another user's session by tricking the user into logging
|
|
in after following a specially crafted link.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2007-4188</cvename>
|
|
<cvename>CVE-2007-4189</cvename>
|
|
<cvename>CVE-2007-4190</cvename>
|
|
<cvename>CVE-2007-5577</cvename>
|
|
<url>http://www.joomla.org/content/view/3677/1/</url>
|
|
<url>http://secunia.com/advisories/26239/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-07-30</discovery>
|
|
<entry>2007-08-02</entry>
|
|
<modified>2010-05-12</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="2dc764fa-40c0-11dc-aeac-02e0185f8d72">
|
|
<topic>FreeBSD -- Buffer overflow in tcpdump(1)</topic>
|
|
<affects>
|
|
<package>
|
|
<name>tcpdump</name>
|
|
<range><lt>3.9.6</lt></range>
|
|
</package>
|
|
<system>
|
|
<name>FreeBSD</name>
|
|
<range><gt>6.2</gt><lt>6.2_7</lt></range>
|
|
<range><gt>6.1</gt><lt>6.1_19</lt></range>
|
|
<range><gt>5.5</gt><lt>5.5_15</lt></range>
|
|
</system>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<h1>Problem Description:</h1>
|
|
<p>An un-checked return value in the BGP dissector code can
|
|
result in an integer overflow. This value is used in
|
|
subsequent buffer management operations, resulting in a stack
|
|
based buffer overflow under certain circumstances.</p>
|
|
<h1>Impact:</h1>
|
|
<p>By crafting malicious BGP packets, an attacker could exploit
|
|
this vulnerability to execute code or crash the tcpdump
|
|
process on the target system. This code would be executed in
|
|
the context of the user running tcpdump(1). It should be
|
|
noted that tcpdump(1) requires privileges in order to open live
|
|
network interfaces.</p>
|
|
<h1>Workaround:</h1>
|
|
<p>No workaround is available.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2007-3798</cvename>
|
|
<freebsdsa>SA-07:06.tcpdump</freebsdsa>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-08-01</discovery>
|
|
<entry>2007-08-02</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="3de342fb-40be-11dc-aeac-02e0185f8d72">
|
|
<topic>FreeBSD -- Predictable query ids in named(8)</topic>
|
|
<affects>
|
|
<package>
|
|
<name>named</name>
|
|
<range><gt>9.4</gt><lt>9.4.1.1</lt></range>
|
|
<range><gt>9.3</gt><lt>9.3.4.1</lt></range>
|
|
</package>
|
|
<system>
|
|
<name>FreeBSD</name>
|
|
<range><gt>6.2</gt><lt>6.2_7</lt></range>
|
|
<range><gt>6.1</gt><lt>6.1_19</lt></range>
|
|
<range><gt>5.5</gt><lt>5.5_15</lt></range>
|
|
</system>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<h1>Problem Description:</h1>
|
|
<p>When named(8) is operating as a recursive DNS server or
|
|
sending NOTIFY requests to slave DNS servers, named(8)
|
|
uses a predictable query id.</p>
|
|
<h1>Impact:</h1>
|
|
<p>An attacker who can see the query id for some request(s)
|
|
sent by named(8) is likely to be able to perform DNS cache
|
|
poisoning by predicting the query id for other request(s).</p>
|
|
<h1>Workaround:</h1>
|
|
<p>No workaround is available.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2007-2926</cvename>
|
|
<freebsdsa>SA-07:07.bind</freebsdsa>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-07-24</discovery>
|
|
<entry>2007-08-02</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="0e43a14d-3f3f-11dc-a79a-0016179b2dd5">
|
|
<topic>xpdf -- stack based buffer overflow</topic>
|
|
<affects>
|
|
<package>
|
|
<name>xpdf</name>
|
|
<range><lt>3.02_2</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>kdegraphics</name>
|
|
<range><lt>3.5.7_1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>cups-base</name>
|
|
<range><lt>1.2.11_3</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>gpdf</name>
|
|
<range><gt>0</gt></range>
|
|
</package>
|
|
<package>
|
|
<name>pdftohtml</name>
|
|
<range><lt>0.39_3</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>poppler</name>
|
|
<range><lt>0.5.9_4</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The KDE Team reports:</p>
|
|
<blockquote cite="http://www.kde.org/info/security/advisory-20070730-1.txt">
|
|
<p>kpdf, the KDE pdf viewer, shares code with xpdf. xpdf contains
|
|
a vulnerability that can cause a stack based buffer overflow
|
|
via a PDF file that exploits an integer overflow in
|
|
StreamPredictor::StreamPredictor(). Remotely supplied
|
|
pdf files can be used to disrupt the kpdf viewer on
|
|
the client machine and possibly execute arbitrary code.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>25124</bid>
|
|
<cvename>CVE-2007-3387</cvename>
|
|
<url>http://www.kde.org/info/security/advisory-20070730-1.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-07-30</discovery>
|
|
<entry>2007-07-31</entry>
|
|
<modified>2009-04-29</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="ff284bf0-3f32-11dc-a79a-0016179b2dd5">
|
|
<cancelled superseded="2dc764fa-40c0-11dc-aeac-02e0185f8d72"/>
|
|
</vuln>
|
|
|
|
<vuln vid="863f95d3-3df1-11dc-b3d3-0016179b2dd5">
|
|
<topic>mutt -- buffer overflow vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>mutt</name>
|
|
<name>mutt-lite</name>
|
|
<name>ja-mutt</name>
|
|
<name>zh-mutt</name>
|
|
<range><lt>1.4.2.3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Securityfocus reports:</p>
|
|
<blockquote cite="http://www.securityfocus.com/bid/24192/">
|
|
<p>Mutt is prone to a local buffer-overflow vulnerability
|
|
because it fails to properly bounds-check user-supplied
|
|
input before using it in a memory copy operation.
|
|
An attacker can exploit this issue to execute arbitrary
|
|
code with the with the privileges of the victim. Failed
|
|
exploit attempts will result in a denial of service.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>24192</bid>
|
|
<cvename>CVE-2007-2683</cvename>
|
|
<url>http://www.redhat.com/support/errata/RHSA-2007-0386.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-05-28</discovery>
|
|
<entry>2007-07-29</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="d2b8a963-3d59-11dc-b3d3-0016179b2dd5">
|
|
<topic>p5-Net-DNS -- multiple Vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>p5-Net-DNS</name>
|
|
<range><lt>0.60</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A Secunia Advisory reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/25829/">
|
|
<p>An error exists in the handling of DNS queries where IDs are
|
|
incremented with a fixed value and are additionally used for
|
|
child processes in a forking server. This can be exploited to
|
|
poison the DNS cache of an application using the module if a
|
|
valid ID is guessed.</p>
|
|
<p>An error in the PP implementation within the "dn_expand()"
|
|
function can be exploited to cause a stack overflow due to an
|
|
endless loop via a specially crafted DNS packet.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2007-3377</cvename>
|
|
<cvename>CVE-2007-3409</cvename>
|
|
<url>http://secunia.com/advisories/25829/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-06-27</discovery>
|
|
<entry>2007-07-28</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="88260dfe-3d21-11dc-b3d3-0016179b2dd5">
|
|
<topic>phpsysinfo -- url Cross-Site Scripting</topic>
|
|
<affects>
|
|
<package>
|
|
<name>phpSysInfo</name>
|
|
<range><lt>2.5.3_1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Doz reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/26248/">
|
|
<p>A Input passed in the URL to index.php is not properly
|
|
sanitised before being returned to the user. This can be
|
|
exploited to execute arbitrary HTML and script code in a
|
|
user's browser session in context of an affected site.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://secunia.com/advisories/26248/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-07-27</discovery>
|
|
<entry>2007-07-28</entry>
|
|
<modified>2007-08-01</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="98dd7788-3d13-11dc-b3d3-0016179b2dd5">
|
|
<topic>drupal -- Cross site request forgeries</topic>
|
|
<affects>
|
|
<package>
|
|
<name>drupal5</name>
|
|
<range><lt>5.2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Drupal Project reports:</p>
|
|
<blockquote cite="http://drupal.org/node/162360">
|
|
<p>Several parts in Drupal core are not protected against cross
|
|
site request forgeries due to inproper use of the Forms API,
|
|
or by taking action solely on GET requests. Malicious users are
|
|
able to delete comments and content revisions and disable menu
|
|
items by enticing a privileged users to visit certain URLs while
|
|
the victim is logged-in to the targeted site.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://drupal.org/node/162360</url>
|
|
<url>http://secunia.com/advisories/26224/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-07-26</discovery>
|
|
<entry>2007-07-28</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="1f5b711b-3d0e-11dc-b3d3-0016179b2dd5">
|
|
<topic>drupal -- Multiple cross-site scripting vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>drupal4</name>
|
|
<range><lt>4.7.7</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>drupal5</name>
|
|
<range><lt>5.2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Drupal Project reports:</p>
|
|
<blockquote cite="http://drupal.org/node/162361">
|
|
<p>Some server variables are not escaped consistently. When
|
|
a malicious user is able to entice a victim to visit a specially
|
|
crafted link or webpage, arbitrary HTML and script code can be
|
|
injected and executed in the context of the victim's session on
|
|
the targeted website.</p>
|
|
<p>Custom content type names are not escaped consistently. A
|
|
malicious user with the 'administer content types' permission
|
|
would be able to inject and execute arbitrary HTML and script
|
|
code on the website. Revoking the 'administer content types'
|
|
permission provides an immediate workaround.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://drupal.org/node/162361</url>
|
|
<url>http://secunia.com/advisories/26224/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-07-26</discovery>
|
|
<entry>2007-07-28</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="1ed03222-3c65-11dc-b3d3-0016179b2dd5">
|
|
<topic>vim -- Command Format String Vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>vim</name>
|
|
<name>vim-lite</name>
|
|
<name>vim-ruby</name>
|
|
<name>vim6</name>
|
|
<name>vim6-ruby</name>
|
|
<range><lt>7.1.39</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A Secunia Advisory reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/25941/">
|
|
<p>A format string error in the "helptags_one()" function in
|
|
src/ex_cmds.c when running the "helptags" command can be exploited
|
|
to execute arbitrary code via specially crafted help files.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2007-2953</cvename>
|
|
<url>http://secunia.com/advisories/25941/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-07-27</discovery>
|
|
<entry>2007-07-27</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="b73335a5-3bbe-11dc-8e83-0016179b2dd5">
|
|
<topic>libvorbis -- Multiple memory corruption flaws</topic>
|
|
<affects>
|
|
<package>
|
|
<name>libvorbis</name>
|
|
<range><lt>1.2.0,3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>isecpartners reports:</p>
|
|
<blockquote cite="http://www.isecpartners.com/advisories/2007-003-libvorbis.txt">
|
|
<p>libvorbis contains several vulnerabilities
|
|
allowing heap overwrite, read violations and a function
|
|
pointer overwrite. These bugs cause a at least a denial
|
|
of service, and potentially code execution.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://www.isecpartners.com/advisories/2007-003-libvorbis.txt</url>
|
|
<cvename>CVE-2007-3106</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-06-05</discovery>
|
|
<entry>2007-07-26</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="ab2575d6-39f0-11dc-b8cc-000fea449b8a">
|
|
<topic>tomcat -- XSS vulnerability in sample applications</topic>
|
|
<affects>
|
|
<package>
|
|
<name>apache-tomcat</name>
|
|
<range><gt>6.0.0</gt><lt>6.0.11</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>tomcat</name>
|
|
<range><gt>5.0.0</gt><lt>5.5.24</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>jakarta-tomcat</name>
|
|
<range><gt>5.0.0</gt><lt>5.5.24</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Apache Project reports:</p>
|
|
<blockquote cite="http://tomcat.apache.org/security-5.html">
|
|
<p>The JSP and Servlet included in the sample application within
|
|
the Tomcat documentation webapp did not escape user provided
|
|
data before including it in the output. This enabled a XSS
|
|
attack. These pages have been simplified not to use any user
|
|
provided data in the output.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2007-1355</cvename>
|
|
<bid>24058</bid>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-05-19</discovery>
|
|
<entry>2007-07-24</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="872623af-39ec-11dc-b8cc-000fea449b8a">
|
|
<topic>tomcat -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>apache-tomcat</name>
|
|
<range><ge>4.1.0</ge><lt>4.1.36</lt></range>
|
|
<range><gt>6.0.0</gt><lt>6.0.11</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>tomcat</name>
|
|
<range><gt>5.0.0</gt><lt>5.5.23</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>jakarta-tomcat</name>
|
|
<range><ge>4.0.0</ge><lt>4.1.0</lt></range>
|
|
<range><gt>5.0.0</gt><lt>5.5.23</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Apache Project reports:</p>
|
|
<blockquote cite="http://www.mail-archive.com/dev@tomcat.apache.org/msg16385.html">
|
|
<p>The Apache Tomcat team is proud to announce the immediate
|
|
availability of Tomcat 4.1.36 stable. This build contains
|
|
numerous library updates, A small number of bug fixes and
|
|
two important security fixes.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-2090</cvename>
|
|
<cvename>CVE-2007-0450</cvename>
|
|
<cvename>CVE-2007-1358</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-04-27</discovery>
|
|
<entry>2007-07-24</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="cddde37a-39b5-11dc-b3da-001921ab2fa4">
|
|
<topic>dokuwiki -- XSS vulnerability in spellchecker backend</topic>
|
|
<affects>
|
|
<package>
|
|
<name>dokuwiki</name>
|
|
<range><lt>20070626_1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>dokuwiki-devel</name>
|
|
<range><lt>20070524_1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>DokuWiki reports:</p>
|
|
<blockquote cite="http://bugs.splitbrain.org/index.php?do=details&task_id=1195">
|
|
<p>The spellchecker tests the UTF-8 capabilities of the used browser
|
|
by sending an UTF-8 string to the backend, which will send it back
|
|
unfiltered. By comparing string length the spellchecker can work
|
|
around broken implementations. An attacker could construct a form to
|
|
let users send JavaScript to the spellchecker backend, resulting in
|
|
malicious JavaScript being executed in their browser.</p>
|
|
<p>Affected are all versions up to and including 2007-06-26 even when
|
|
the spell checker is disabled.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://xforce.iss.net/xforce/xfdb/35501</url>
|
|
<cvename>CVE-2007-3930</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-06-26</discovery>
|
|
<entry>2007-07-24</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="fc9c217e-3791-11dc-bb1a-000fea449b8a">
|
|
<topic>lighttpd -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>lighttpd</name>
|
|
<range><lt>1.4.15_1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia Advisory reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/26130/">
|
|
<p>Some vulnerabilities have been reported in lighttpd,
|
|
which can be exploited by malicious people to bypass
|
|
certain security restrictions or cause a DoS (Denial
|
|
of Service).</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2007-3947</cvename>
|
|
<cvename>CVE-2007-3948</cvename>
|
|
<cvename>CVE-2007-3949</cvename>
|
|
<cvename>CVE-2007-3950</cvename>
|
|
<url>http://trac.lighttpd.net/trac/ticket/1216</url>
|
|
<url>http://trac.lighttpd.net/trac/ticket/1232</url>
|
|
<url>http://trac.lighttpd.net/trac/ticket/1230</url>
|
|
<url>http://trac.lighttpd.net/trac/ticket/1263</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-07-20</discovery>
|
|
<entry>2007-07-21</entry>
|
|
<modified>2010-05-12</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="12d266b6-363f-11dc-b6c9-000c6ec775d9">
|
|
<topic>opera -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>opera</name>
|
|
<name>opera-devel</name>
|
|
<name>linux-opera</name>
|
|
<range><lt>9.22</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Opera Software ASA reports of multiple security fixes in
|
|
Opera, including an arbitrary code execute
|
|
vulnerability:</p>
|
|
<blockquote cite="http://www.opera.com/support/search/view/861/">
|
|
<p>Opera for Linux, FreeBSD, and Solaris has a flaw in the
|
|
createPattern function that leaves old data that was in
|
|
the memory before Opera allocated it in the new
|
|
pattern. The pattern can be read and analyzed by
|
|
JavaScript, so an attacker can get random samples of the
|
|
user's memory, which may contain data.</p>
|
|
</blockquote>
|
|
<blockquote cite="http://www.opera.com/support/search/view/862/">
|
|
<p>Removing a specially crafted torrent from the download
|
|
manager can crash Opera. The crash is caused by an
|
|
erroneous memory access.</p>
|
|
<p>An attacker needs to entice the user to accept the
|
|
malicious BitTorrent download, and later remove it from
|
|
Opera's download manager. To inject code, additional means
|
|
will have to be employed.</p>
|
|
<p>Users clicking a BitTorrent link and rejecting the
|
|
download are not affected.</p>
|
|
</blockquote>
|
|
<blockquote cite="http://www.opera.com/support/search/view/863/">
|
|
<p>data: URLs embed data inside them, instead of linking to
|
|
an external resource. Opera can mistakenly display the end
|
|
of a data URL instead of the beginning. This allows an
|
|
attacker to spoof the URL of a trusted site.</p>
|
|
</blockquote>
|
|
<blockquote cite="http://www.opera.com/support/search/view/864/">
|
|
<p>Opera's HTTP authentication dialog is displayed when the
|
|
user enters a Web page that requires a login name and a
|
|
password. To inform the user which server it was that
|
|
asked for login credentials, the dialog displays the
|
|
server name.</p>
|
|
<p>The user has to see the entire server name. A truncated
|
|
name can be misleading. Opera's authentication dialog cuts
|
|
off the long server names at the right hand side, adding
|
|
an ellipsis (...) to indicate that it has been cut off.</p>
|
|
<p>The dialog has a predictable size, allowing an attacker
|
|
to create a server name which will look almost like a
|
|
trusted site, because the real domain name has been cut
|
|
off. The three dots at the end will not be obvious to all
|
|
users.</p>
|
|
<p>This flaw can be exploited by phishers who can set up
|
|
custom sub-domains, for example by hosting their own
|
|
public DNS.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2007-3929</cvename>
|
|
<cvename>CVE-2007-4944</cvename>
|
|
<url>http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=564</url>
|
|
<url>http://www.opera.com/support/search/view/861/</url>
|
|
<url>http://www.opera.com/support/search/view/862/</url>
|
|
<url>http://www.opera.com/support/search/view/863/</url>
|
|
<url>http://www.opera.com/support/search/view/864/</url>
|
|
<url>http://www.opera.com/docs/changelogs/freebsd/922/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-07-19</discovery>
|
|
<entry>2007-07-19</entry>
|
|
<modified>2010-05-12</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="e190ca65-3636-11dc-a697-000c6ec775d9">
|
|
<topic>mozilla -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>firefox</name>
|
|
<range><lt>2.0.0.5,1</lt></range>
|
|
<range><gt>3.*,1</gt><lt>3.0.a2_3,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-firefox</name>
|
|
<name>linux-thunderbird</name>
|
|
<name>mozilla-thunderbird</name>
|
|
<name>thunderbird</name>
|
|
<range><lt>2.0.0.5</lt></range>
|
|
</package>
|
|
<!-- Packages which probably will be upgraded -->
|
|
<package>
|
|
<name>seamonkey</name>
|
|
<name>linux-seamonkey</name>
|
|
<range><lt>1.1.3</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-firefox-devel</name>
|
|
<range><lt>3.0.a2007.12.12</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-seamonkey-devel</name>
|
|
<range><lt>2.0.a2007.12.12</lt></range>
|
|
</package>
|
|
<!-- Deprecated/old names -->
|
|
<package>
|
|
<name>firefox-ja</name>
|
|
<name>linux-mozilla-devel</name>
|
|
<name>linux-mozilla</name>
|
|
<name>mozilla</name>
|
|
<range><gt>0</gt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Mozilla Foundation reports of multiple security issues
|
|
in Firefox, Seamonkey, and Thunderbird. Several of these
|
|
issues can probably be used to run arbitrary code with the
|
|
privilege of the user running the program.</p>
|
|
<blockquote cite="http://www.mozilla.org/projects/security/known-vulnerabilities.html#firefox2.0.0.5">
|
|
<ul>
|
|
<li>MFSA 2007-25 XPCNativeWrapper pollution</li>
|
|
<li>MFSA 2007-24 Unauthorized access to wyciwyg:// documents</li>
|
|
<li>MFSA 2007-21 Privilege escalation using an event
|
|
handler attached to an element not in the document</li>
|
|
<li>MFSA 2007-20 Frame spoofing while window is loading</li>
|
|
<li>MFSA 2007-19 XSS using addEventListener and setTimeout</li>
|
|
<li>MFSA 2007-18 Crashes with evidence of memory corruption</li>
|
|
</ul>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2007-3089</cvename>
|
|
<cvename>CVE-2007-3734</cvename>
|
|
<cvename>CVE-2007-3735</cvename>
|
|
<cvename>CVE-2007-3737</cvename>
|
|
<cvename>CVE-2007-3738</cvename>
|
|
<url>http://www.mozilla.org/projects/security/known-vulnerabilities.html#firefox2.0.0.5</url>
|
|
<url>http://www.mozilla.org/security/announce/2007/mfsa2007-18.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2007/mfsa2007-19.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2007/mfsa2007-20.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2007/mfsa2007-21.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2007/mfsa2007-24.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2007/mfsa2007-25.html</url>
|
|
<uscertta>TA07-199A</uscertta>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-07-17</discovery>
|
|
<entry>2007-07-19</entry>
|
|
<modified>2008-06-21</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="b42e8c32-34f6-11dc-9bc9-001921ab2fa4">
|
|
<topic>linux-flashplugin -- critical vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>linux-flashplugin</name>
|
|
<range><gt>9.0</gt><le>9.0r45</le></range>
|
|
<range><gt>8.0</gt><le>8.0r34</le></range>
|
|
<range><le>7.0r69</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Adobe reports:</p>
|
|
<blockquote cite="http://www.adobe.com/support/security/bulletins/apsb07-12.html">
|
|
<p>Critical vulnerabilities have been identified in
|
|
Adobe Flash Player that could allow an attacker who
|
|
successfully exploits these potential vulnerabilities
|
|
to take control of the affected system. A malicious
|
|
SWF must be loaded in Flash Player by the user for
|
|
an attacker to exploit these potential vulnerabilities.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2007-2022</cvename>
|
|
<cvename>CVE-2007-3456</cvename>
|
|
<cvename>CVE-2007-3457</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-07-10</discovery>
|
|
<entry>2007-07-18</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="7fadc049-2ba0-11dc-9377-0016179b2dd5">
|
|
<topic>wireshark -- Multiple problems</topic>
|
|
<affects>
|
|
<package>
|
|
<name>wireshark</name>
|
|
<name>wireshark-lite</name>
|
|
<name>ethereal</name>
|
|
<name>ethereal-lite</name>
|
|
<name>tethereal</name>
|
|
<name>tethereal-lite</name>
|
|
<range><ge>0.8.20</ge><lt>0.99.6</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>wireshark Team reports:</p>
|
|
<blockquote cite="http://www.wireshark.org/security/wnpa-sec-2007-02.html">
|
|
<p>It may be possible to make Wireshark or Ethereal crash or use up
|
|
available memory by injecting a purposefully malformed packet onto
|
|
the wire or by convincing someone to read a malformed packet trace
|
|
file.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2007-3389</cvename>
|
|
<cvename>CVE-2007-3390</cvename>
|
|
<cvename>CVE-2007-3391</cvename>
|
|
<cvename>CVE-2007-3392</cvename>
|
|
<cvename>CVE-2007-3393</cvename>
|
|
<url>http://secunia.com/advisories/25833/</url>
|
|
<url>http://www.wireshark.org/security/wnpa-sec-2007-02.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-06-29</discovery>
|
|
<entry>2007-07-06</entry>
|
|
<modified>2010-05-12</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="2c4f4688-298b-11dc-a197-0011098b2f36">
|
|
<topic>typespeed -- arbitrary code execution</topic>
|
|
<affects>
|
|
<package>
|
|
<name>typespeed</name>
|
|
<range><le>0.4.1</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Debian reports:</p>
|
|
<blockquote cite="http://www.debian.org/security/2005/dsa-684">
|
|
<p>Ulf Härnhammar from the Debian Security Audit Project
|
|
discovered a problem in typespeed, a touch-typist trainer
|
|
disguised as game. This could lead to a local attacker
|
|
executing arbitrary code.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-0105</cvename>
|
|
<url>http://www.debian.org/security/2005/dsa-684</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-02-16</discovery>
|
|
<entry>2007-07-03</entry>
|
|
<modified>2007-07-09</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="7128fb45-2633-11dc-94da-0016179b2dd5">
|
|
<topic>vlc -- format string vulnerability and integer overflow</topic>
|
|
<affects>
|
|
<package>
|
|
<name>vlc</name>
|
|
<range><lt>0.8.6c</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>isecpartners reports:</p>
|
|
<blockquote cite="http://www.isecpartners.com/advisories/2007-001-vlc.txt">
|
|
<p>VLC is vulnerable to a format string attack in the parsing
|
|
of Vorbis comments in Ogg Vorbis and Ogg Theora files, CDDA
|
|
data or SAP/SDP service discovery messages. Additionally,
|
|
there are two errors in the handling of wav files, one a
|
|
denial of service due to an uninitialized variable, and one
|
|
integer overflow in sampling frequency calculations.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2007-3316</cvename>
|
|
<cvename>CVE-2007-3468</cvename>
|
|
<cvename>CVE-2007-3467</cvename>
|
|
<url>http://www.isecpartners.com/advisories/2007-001-vlc.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-06-05</discovery>
|
|
<entry>2007-06-18</entry>
|
|
<modified>2010-05-12</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="32d38cbb-2632-11dc-94da-0016179b2dd5">
|
|
<topic>flac123 -- stack overflow in comment parsing</topic>
|
|
<affects>
|
|
<package>
|
|
<name>flac123</name>
|
|
<range><lt>0.0.10</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>isecpartners reports:</p>
|
|
<blockquote cite="http://www.isecpartners.com/advisories/2007-002-flactools.txt">
|
|
<p>flac123, also known as flac-tools, is vulnerable
|
|
to a buffer overflow in vorbis comment parsing.
|
|
This allows for the execution of arbitrary code.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2007-3507</cvename>
|
|
<url>http://sourceforge.net/forum/forum.php?forum_id=710314</url>
|
|
<url>http://www.isecpartners.com/advisories/2007-002-flactools.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-06-05</discovery>
|
|
<entry>2007-06-28</entry>
|
|
<modified>2007-08-10</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="6e099997-25d8-11dc-878b-000c29c5647f">
|
|
<topic>gd -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>gd</name>
|
|
<range><lt>2.0.35,1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>gd had been reported vulnerable to several
|
|
vulnerabilities:</p>
|
|
<ul>
|
|
<li>CVE-2007-3472: Integer overflow in gdImageCreateTrueColor
|
|
function in the GD Graphics Library (libgd) before 2.0.35
|
|
allows user-assisted remote attackers has unspecified attack
|
|
vectors and impact.</li>
|
|
<li>CVE-2007-3473: The gdImageCreateXbm function in the GD
|
|
Graphics Library (libgd) before 2.0.35 allows user-assisted
|
|
remote attackers to cause a denial of service (crash) via
|
|
unspecified vectors involving a gdImageCreate failure.</li>
|
|
<li>CVE-2007-3474: Multiple unspecified vulnerabilities in the GIF
|
|
reader in the GD Graphics Library (libgd) before 2.0.35 allow
|
|
user-assisted remote attackers to have unspecified attack vectors
|
|
and impact.</li>
|
|
<li>CVE-2007-3475: The GD Graphics Library (libgd) before 2.0.35
|
|
allows user-assisted remote attackers to cause a denial of service
|
|
(crash) via a GIF image that has no global color map.</li>
|
|
<li>CVE-2007-3476: Array index error in gd_gif_in.c in the GD Graphics
|
|
Library (libgd) before 2.0.35 allows user-assisted remote attackers
|
|
to cause a denial of service (crash and heap corruption) via large
|
|
color index values in crafted image data, which results in a
|
|
segmentation fault.</li>
|
|
<li>CVE-2007-3477: The (a) imagearc and (b) imagefilledarc functions
|
|
in GD Graphics Library (libgd) before 2.0.35 allows attackers to
|
|
cause a denial of service (CPU consumption) via a large (1) start or
|
|
(2) end angle degree value.</li>
|
|
<li>CVE-2007-3478: Race condition in gdImageStringFTEx
|
|
(gdft_draw_bitmap) in gdft.c in the GD Graphics Library (libgd)
|
|
before 2.0.35 allows user-assisted remote attackers to cause a
|
|
denial of service (crash) via unspecified vectors, possibly
|
|
involving truetype font (TTF) support.</li>
|
|
</ul>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2007-3472</cvename>
|
|
<cvename>CVE-2007-3473</cvename>
|
|
<cvename>CVE-2007-3474</cvename>
|
|
<cvename>CVE-2007-3475</cvename>
|
|
<cvename>CVE-2007-3476</cvename>
|
|
<cvename>CVE-2007-3477</cvename>
|
|
<cvename>CVE-2007-3478</cvename>
|
|
<url>http://www.libgd.org/ReleaseNote020035</url>
|
|
<url>http://www.frsirt.com/english/advisories/2007/2336</url>
|
|
<url>http://bugs.libgd.org/?do=details&task_id=89</url>
|
|
<url>http://bugs.libgd.org/?do=details&task_id=94</url>
|
|
<url>http://bugs.libgd.org/?do=details&task_id=70</url>
|
|
<url>http://bugs.libgd.org/?do=details&task_id=87</url>
|
|
<url>http://bugs.libgd.org/?do=details&task_id=92</url>
|
|
<url>http://bugs.libgd.org/?do=details&task_id=74</url>
|
|
<url>http://bugs.libgd.org/?do=details&task_id=48</url>
|
|
<url>http://bugs.php.net/bug.php?id=40578</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-06-21</discovery>
|
|
<entry>2007-06-29</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="b1b5c125-2308-11dc-b91a-001921ab2fa4">
|
|
<topic>evolution-data-server -- remote execution of arbitrary code vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>evolution-data-server</name>
|
|
<range><lt>1.10.2_1</lt></range>
|
|
<range><gt>1.11.*</gt><lt>1.11.4</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Debian project reports:</p>
|
|
<blockquote cite="http://lists.debian.org/debian-security-announce/debian-security-announce-2007/msg00082.html">
|
|
<p>It was discovered that the IMAP code in the Evolution
|
|
Data Server performs insufficient sanitising of a value
|
|
later used an array index, which can lead to the execution
|
|
of arbitrary code.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2007-3257</cvename>
|
|
<url>http://secunia.com/advisories/25766/</url>
|
|
<url>http://bugzilla.gnome.org/show_bug.cgi?id=447414</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-06-23</discovery>
|
|
<entry>2007-06-25</entry>
|
|
<modified>2007-06-28</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="d337b206-200f-11dc-a197-0011098b2f36">
|
|
<topic>xpcd -- buffer overflow</topic>
|
|
<affects>
|
|
<package>
|
|
<name>xpcd</name>
|
|
<range><gt>0</gt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Debian Project reports:</p>
|
|
<blockquote cite="http://www.debian.org/security/2005/dsa-676">
|
|
<p>Erik Sjolund discovered a buffer overflow in pcdsvgaview,
|
|
an SVGA PhotoCD viewer. xpcd-svga is part of xpcd and uses
|
|
svgalib to display graphics on the Linux console for which
|
|
root permissions are required. A malicious user could
|
|
overflow a fixed-size buffer and may cause the program to
|
|
execute arbitrary code with elevated privileges.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>12523</bid>
|
|
<cvename>CVE-2005-0074</cvename>
|
|
<url>http://www.debian.org/security/2005/dsa-676</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-02-11</discovery>
|
|
<entry>2007-06-21</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="903654bd-1927-11dc-b8a0-02e0185f8d72">
|
|
<topic>clamav -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>clamav</name>
|
|
<range><lt>0.90.3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Clamav had been found vulnerable to multiple vulnerabilities:</p>
|
|
<ul>
|
|
<li>Improper checking for the end of an buffer causing an
|
|
unspecified attack vector.</li>
|
|
<li>Insecure temporary file handling, which could be exploited
|
|
to read sensitive information.</li>
|
|
<li>A flaw in the parser engine which could allow a remote
|
|
attacker to bypass the scanning of RAR files.</li>
|
|
<li>A flaw in libclamav/unrar.c which could cause a remote
|
|
Denial of Service (DoS) by sending a specially crafted
|
|
RAR file with a modified vm_codesize.</li>
|
|
<li>A flaw in the OLE2 parser which could cause a remote
|
|
Denial of Service (DoS).</li>
|
|
</ul>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2007-2650</cvename>
|
|
<cvename>CVE-2007-3023</cvename>
|
|
<cvename>CVE-2007-3024</cvename>
|
|
<cvename>CVE-2007-3122</cvename>
|
|
<cvename>CVE-2007-3123</cvename>
|
|
<url>http://news.gmane.org/gmane.comp.security.virus.clamav.devel/cutoff=2853</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-04-18</discovery>
|
|
<entry>2007-06-19</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="8092b820-1d6f-11dc-a0b2-001921ab2fa4">
|
|
<topic>p5-Mail-SpamAssassin -- local user symlink-attack DoS vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>p5-Mail-SpamAssassin</name>
|
|
<range><lt>3.2.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>SpamAssassin website reports:</p>
|
|
<blockquote cite="http://spamassassin.apache.org/advisories/cve-2007-2873.txt">
|
|
<p>A local user symlink-attack DoS vulnerability in
|
|
SpamAssassin has been found, affecting versions 3.1.x,
|
|
3.2.0, and SVN trunk.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://spamassassin.apache.org/advisories/cve-2007-2873.txt</url>
|
|
<cvename>CVE-2007-2873</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-06-11</discovery>
|
|
<entry>2007-06-18</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="39988ee8-1918-11dc-b6bd-0016179b2dd5">
|
|
<topic>cups -- Incomplete SSL Negotiation Denial of Service</topic>
|
|
<affects>
|
|
<package>
|
|
<name>cups-base</name>
|
|
<range><lt>1.2.11</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/24517/">
|
|
<p>CUPS is not using multiple workers to handle connections.
|
|
This can be exploited to stop CUPS from accepting new connections
|
|
by starting but never completing an SSL negotiation.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://secunia.com/advisories/24517/</url>
|
|
<url>http://security.gentoo.org/glsa/glsa-200703-28.xml</url>
|
|
<cvename>CVE-2007-0720</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-05-05</discovery>
|
|
<entry>2007-06-12</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="70ae62b0-16b0-11dc-b803-0016179b2dd5">
|
|
<topic>c-ares -- DNS Cache Poisoning Vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>c-ares</name>
|
|
<range><lt>1.4.0</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/25579/">
|
|
<p>The vulnerability is caused due to predictable
|
|
DNS "Transaction ID" field in DNS queries and can
|
|
be exploited to poison the DNS cache of an application
|
|
using the library if a valid ID is guessed.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2007-3152</cvename>
|
|
<cvename>CVE-2007-3153</cvename>
|
|
<url>http://secunia.com/advisories/25579/</url>
|
|
<url>http://cool.haxx.se/cvs.cgi/curl/ares/CHANGES?rev=HEAD&content-type=text/vnd.viewcvs-markup</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-06-08</discovery>
|
|
<entry>2007-06-09</entry>
|
|
<modified>2010-05-12</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="0838733d-1698-11dc-a197-0011098b2f36">
|
|
<topic>wordpress -- XMLRPC SQL Injection</topic>
|
|
<affects>
|
|
<package>
|
|
<name>wordpress</name>
|
|
<name>de-wordpress</name>
|
|
<name>zh-wordpress</name>
|
|
<range><lt>2.2.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/25552/">
|
|
<p>Slappter has discovered a vulnerability in WordPress, which can
|
|
be exploited by malicious users to conduct SQL injection
|
|
attacks.</p>
|
|
<p>Input passed to the "wp.suggestCategories" method in xmlrpc.php
|
|
is not properly sanitised before being used in SQL queries. This
|
|
can be exploited to manipulate SQL queries by injecting arbitrary
|
|
SQL code.</p>
|
|
<p>Successful exploitation allows e.g. retrieving usernames and
|
|
password hashes, but requires valid user credentials and knowledge
|
|
of the database table prefix.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>24344</bid>
|
|
<url>http://secunia.com/advisories/25552/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-06-06</discovery>
|
|
<entry>2007-06-09</entry>
|
|
<modified>2007-06-24</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="6a31cbe3-1695-11dc-a197-0011098b2f36">
|
|
<topic>wordpress -- unmoderated comments disclosure</topic>
|
|
<affects>
|
|
<package>
|
|
<name>wordpress</name>
|
|
<name>de-wordpress</name>
|
|
<name>zh-wordpress</name>
|
|
<range><lt>2.2.2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Blogsecurity reports:</p>
|
|
<blockquote cite="http://blogsecurity.net/news/news-310507/">
|
|
<p>An attacker can read comments on posts that have not been
|
|
moderated. This can be a real security risk if blog admins
|
|
are using unmoderated comments (comments that have not been
|
|
made public) to hide sensitive notes regarding posts, future
|
|
work, passwords etc. So please be careful if you are one of
|
|
these blog admins.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://blogsecurity.net/news/news-310507/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-06-01</discovery>
|
|
<entry>2007-06-09</entry>
|
|
<modified>2007-08-16</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="12b7286f-16a2-11dc-b803-0016179b2dd5">
|
|
<topic>webmin -- cross site scripting vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>webmin</name>
|
|
<range><lt>1.350</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/25580/">
|
|
<p>Input passed to unspecified parameters in pam_login.cgi
|
|
is not properly sanitised before being returned to the
|
|
user. This can be exploited to execute arbitrary HTML and
|
|
script code in a user's browser session in context of an
|
|
affected site.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>24381</bid>
|
|
<cvename>CVE-2007-3156</cvename>
|
|
<url>http://secunia.com/advisories/25580/</url>
|
|
<url>http://www.webmin.com/changes-1.350.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-06-01</discovery>
|
|
<entry>2007-06-09</entry>
|
|
<modified>2010-05-12</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="3ac80dd2-14df-11dc-bcfc-0016179b2dd5">
|
|
<topic>mplayer -- cddb stack overflow</topic>
|
|
<affects>
|
|
<package>
|
|
<name>mplayer</name>
|
|
<name>mplayer-esound</name>
|
|
<name>mplayer-gtk</name>
|
|
<name>mplayer-gtk2</name>
|
|
<name>mplayer-gtk-esound</name>
|
|
<name>mplayer-gtk2-esound</name>
|
|
<range><lt>0.99.10_10</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Mplayer Team reports:</p>
|
|
<blockquote cite="http://www.mplayerhq.hu/design7/news.html">
|
|
<p>A stack overflow was found in the code used to handle
|
|
cddb queries. When copying the album title and category,
|
|
no checking was performed on the size of the strings
|
|
before storing them in a fixed-size array. A malicious
|
|
entry in the database could trigger a stack overflow in
|
|
the program, leading to arbitrary code execution with the
|
|
uid of the user running MPlayer.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>24302</bid>
|
|
<cvename>CVE-2007-2948</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-06-06</discovery>
|
|
<entry>2007-06-07</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="d9405748-1342-11dc-a35c-001485ab073e">
|
|
<topic>mod_jk -- information disclosure</topic>
|
|
<affects>
|
|
<package>
|
|
<name>mod_jk</name>
|
|
<range><lt>1.2.23,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>mod_jk-ap2</name>
|
|
<range><lt>1.2.23</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Kazu Nambo reports:</p>
|
|
<blockquote cite="http://tomcat.apache.org/security-jk.html">
|
|
<p>URL decoding the the Apache webserver prior to
|
|
decoding in the Tomcat server could pypass access
|
|
control rules and give access to pages on a different
|
|
AJP by sending a crafted URL.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2007-1860</cvename>
|
|
<url>http://secunia.com/advisories/25383/</url>
|
|
<url>http://tomcat.apache.org/connectors-doc/news/20070301.html#20070518.1</url>
|
|
<url>http://tomcat.apache.org/security-jk.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-05-18</discovery>
|
|
<entry>2007-06-05</entry>
|
|
<modified>2007-10-31</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="62b8f253-12d9-11dc-a35c-001485ab073e">
|
|
<topic>typo3 -- email header injection</topic>
|
|
<affects>
|
|
<package>
|
|
<name>typo3</name>
|
|
<range><gt>3.0</gt><lt>4.0.5</lt></range>
|
|
<range><gt>4.1</gt><lt>4.1.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Olivier Dobberkau, Andreas Otto, and Thorsten Kahler report:</p>
|
|
<blockquote cite="http://typo3.org/teams/security/security-bulletins/typo3-20070221-1/">
|
|
<p>An unspecified error in the internal form engine can be used for
|
|
sending arbitrary mail headers, using it for purposes which it
|
|
is not meant for, e.g. sending spam messages.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2007-1081</cvename>
|
|
<url>http://secunia.com/advisories/24207/</url>
|
|
<url>http://typo3.org/teams/security/security-bulletins/typo3-20070221-1/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-02-21</discovery>
|
|
<entry>2007-06-04</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="3d0e724e-129b-11dc-9f79-0016179b2dd5">
|
|
<topic>phppgadmin -- cross site scripting vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>phppgadmin</name>
|
|
<range><lt>4.1.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>SecurityFocus reports about phppgadmin:</p>
|
|
<blockquote cite="http://www.securityfocus.com/bid/24115/info">
|
|
<p>Exploiting this vulnerability may allow an attacker to perform
|
|
cross-site scripting attacks on unsuspecting users in the context
|
|
of the affected website. As a result, the attacker may be able to
|
|
steal cookie-based authentication credentials and to launch other
|
|
attacks.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>24115</bid>
|
|
<cvename>CVE-2007-5728</cvename>
|
|
<url>http://lists.grok.org.uk/pipermail/full-disclosure/2007-May/063617.html</url>
|
|
<url>http://secunia.com/advisories/25446/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-05-27</discovery>
|
|
<entry>2007-06-04</entry>
|
|
<modified>2010-05-12</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="7ca2a709-103b-11dc-8e82-00001cd613f9">
|
|
<topic>findutils -- GNU locate heap buffer overrun</topic>
|
|
<affects>
|
|
<package>
|
|
<name>findutils</name>
|
|
<range><lt>4.2.31</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>James Youngman reports:</p>
|
|
<blockquote cite="http://lists.gnu.org/archive/html/bug-findutils/2007-06/msg00000.html">
|
|
<p>When GNU locate reads filenames from an old-format locate database,
|
|
they are read into a fixed-length buffer allocated on the heap.
|
|
Filenames longer than the 1026-byte buffer can cause a buffer
|
|
overrun. The overrunning data can be chosen by any person able to
|
|
control the names of filenames created on the local system. This
|
|
will normally include all local users, but in many cases also remote
|
|
users (for example in the case of FTP servers allowing uploads).</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2007-2452</cvename>
|
|
<mlist>http://lists.gnu.org/archive/html/bug-findutils/2007-06/msg00000.html</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-05-30</discovery>
|
|
<entry>2007-06-01</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="de2fab2d-0a37-11dc-aae2-00304881ac9a">
|
|
<topic>FreeType 2 -- Heap overflow vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>freetype2</name>
|
|
<range><lt>2.2.1_2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<blockquote cite="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-2754">
|
|
<p>Integer signedness error in truetype/ttgload.c in Freetype 2.3.4 and
|
|
earlier might allow remote attackers to execute arbitrary code via a
|
|
crafted TTF image with a negative n_points value, which leads to an
|
|
integer overflow and heap-based buffer overflow.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2007-2754</cvename>
|
|
<mlist>http://lists.gnu.org/archive/html/freetype-devel/2007-04/msg00041.html</mlist>
|
|
<url>http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-2754</url>
|
|
<url>https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=240200</url>
|
|
<freebsdpr>ports/112769</freebsdpr>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-04-27</discovery>
|
|
<entry>2007-05-24</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="8e01ab5b-0949-11dc-8163-000e0c2e438a">
|
|
<topic>FreeBSD -- heap overflow in file(1)</topic>
|
|
<affects>
|
|
<package>
|
|
<name>file</name>
|
|
<range><lt>4.21</lt></range>
|
|
</package>
|
|
<system>
|
|
<name>FreeBSD</name>
|
|
<range><gt>6.2</gt><lt>6.2_5</lt></range>
|
|
<range><gt>6.1</gt><lt>6.1_17</lt></range>
|
|
<range><gt>5.5</gt><lt>5.5_13</lt></range>
|
|
</system>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<h1>Problem Description:</h1>
|
|
<p>When writing data into a buffer in the file_printf function,
|
|
the length of the unused portion of the buffer is not
|
|
correctly tracked, resulting in a buffer overflow when
|
|
processing certain files.</p>
|
|
<h1>Impact:</h1>
|
|
<p>An attacker who can cause file(1) to be run on a maliciously
|
|
constructed input can cause file(1) to crash. It may be
|
|
possible for such an attacker to execute arbitrary code with
|
|
the privileges of the user running file(1).</p>
|
|
<p>The above also applies to any other applications using the
|
|
libmagic(3) library.</p>
|
|
<h1>Workaround:</h1>
|
|
<p>No workaround is available, but systems where file(1) and
|
|
other libmagic(3)-using applications are never run on
|
|
untrusted input are not vulnerable.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2007-1536</cvename>
|
|
<freebsdsa>SA-07:04.file</freebsdsa>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-05-23</discovery>
|
|
<entry>2007-05-23</entry>
|
|
<modified>2007-08-02</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="0e575ed3-0764-11dc-a80b-0016179b2dd5">
|
|
<topic>squirrelmail -- Cross site scripting in HTML filter</topic>
|
|
<affects>
|
|
<package>
|
|
<name>squirrelmail</name>
|
|
<range><ge>1.4.0</ge><lt>1.4.9a</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The SquirrelMail developers report:</p>
|
|
<blockquote cite="http://www.squirrelmail.org/security/issue/2007-05-09">
|
|
<p>Multiple cross-site scripting (XSS) vulnerabilities in the HTML
|
|
filter in SquirrelMail 1.4.0 through 1.4.9a allow remote attackers
|
|
to inject arbitrary web script or HTML via the (1) data: URI in an
|
|
HTML e-mail attachment or (2) various non-ASCII character sets that
|
|
are not properly filtered when viewed with Microsoft Internet
|
|
Explorer.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2007-1262</cvename>
|
|
<url>http://www.squirrelmail.org/security/issue/2007-05-09</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-05-09</discovery>
|
|
<entry>2007-05-21</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="4cb9c513-03ef-11dc-a51d-0019b95d4f14">
|
|
<topic>png -- DoS crash vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>png</name>
|
|
<range><lt>1.2.17</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A Libpng Security Advisory reports:</p>
|
|
<blockquote cite="http://www.mirrorservice.org/sites/download.sourceforge.net/pub/sourceforge/l/li/libpng/libpng-1.2.17-ADVISORY.txt">
|
|
<p>A grayscale PNG image with a malformed (bad CRC) tRNS
|
|
chunk will crash some libpng applications.</p>
|
|
<p>This vulnerability could be used to crash a browser when
|
|
a user tries to view such a malformed PNG file. It is not
|
|
known whether the vulnerability could be exploited
|
|
otherwise.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2007-2445</cvename>
|
|
<certvu>684664</certvu>
|
|
<url>http://www.mirrorservice.org/sites/download.sourceforge.net/pub/sourceforge/l/li/libpng/libpng-1.2.17-ADVISORY.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-05-15</discovery>
|
|
<entry>2007-05-16</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="3546a833-03ea-11dc-a51d-0019b95d4f14">
|
|
<topic>samba -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>samba</name>
|
|
<name>ja-samba</name>
|
|
<range><gt>3.*</gt><lt>3.0.25</lt></range>
|
|
<range><gt>3.*,1</gt><lt>3.0.25,1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Samba Team reports:</p>
|
|
<blockquote cite="http://de5.samba.org/samba/security/CVE-2007-2444.html">
|
|
<p>A bug in the local SID/Name translation routines may
|
|
potentially result in a user being able to issue SMB/CIFS
|
|
protocol operations as root.</p>
|
|
<p>When translating SIDs to/from names using Samba local
|
|
list of user and group accounts, a logic error in the smbd
|
|
daemon's internal security stack may result in a
|
|
transition to the root user id rather than the non-root
|
|
user. The user is then able to temporarily issue SMB/CIFS
|
|
protocol operations as the root user. This window of
|
|
opportunity may allow the attacker to establish additional
|
|
means of gaining root access to the server.</p>
|
|
</blockquote>
|
|
<blockquote cite="http://de5.samba.org/samba/security/CVE-2007-2446.html">
|
|
<p>Various bugs in Samba's NDR parsing can allow a user to
|
|
send specially crafted MS-RPC requests that will overwrite
|
|
the heap space with user defined data.</p>
|
|
</blockquote>
|
|
<blockquote cite="http://de5.samba.org/samba/security/CVE-2007-2447.html">
|
|
<p>Unescaped user input parameters are passed as arguments
|
|
to /bin/sh allowing for remote command execution.</p>
|
|
<p>This bug was originally reported against the anonymous
|
|
calls to the SamrChangePassword() MS-RPC function in
|
|
combination with the "username map script" smb.conf option
|
|
(which is not enabled by default).</p>
|
|
<p>After further investigation by Samba developers, it was
|
|
determined that the problem was much broader and impacts
|
|
remote printer and file share management as well. The
|
|
root cause is passing unfiltered user input provided via
|
|
MS-RPC calls to /bin/sh when invoking externals scripts
|
|
defined in smb.conf. However, unlike the "username map
|
|
script" vulnerability, the remote file and printer
|
|
management scripts require an authenticated user
|
|
session.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2007-2444</cvename>
|
|
<cvename>CVE-2007-2446</cvename>
|
|
<cvename>CVE-2007-2447</cvename>
|
|
<url>http://de5.samba.org/samba/security/CVE-2007-2444.html</url>
|
|
<url>http://de5.samba.org/samba/security/CVE-2007-2446.html</url>
|
|
<url>http://de5.samba.org/samba/security/CVE-2007-2447.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-05-14</discovery>
|
|
<entry>2007-05-16</entry>
|
|
<modified>2008-09-26</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="f5e52bf5-fc77-11db-8163-000e0c2e438a">
|
|
<topic>php -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>php5-imap</name>
|
|
<name>php5-odbc</name>
|
|
<name>php5-session</name>
|
|
<name>php5-shmop</name>
|
|
<name>php5-sqlite</name>
|
|
<name>php5-wddx</name>
|
|
<name>php5</name>
|
|
<range><lt>5.2.2</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>php4-odbc</name>
|
|
<name>php4-session</name>
|
|
<name>php4-shmop</name>
|
|
<name>php4-wddx</name>
|
|
<name>php4</name>
|
|
<range><lt>4.4.7</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>mod_php4-twig</name>
|
|
<name>mod_php4</name>
|
|
<name>mod_php5</name>
|
|
<name>mod_php</name>
|
|
<name>php4-cgi</name>
|
|
<name>php4-cli</name>
|
|
<name>php4-dtc</name>
|
|
<name>php4-horde</name>
|
|
<name>php4-nms</name>
|
|
<name>php5-cgi</name>
|
|
<name>php5-cli</name>
|
|
<name>php5-dtc</name>
|
|
<name>php5-horde</name>
|
|
<name>php5-nms</name>
|
|
<range><ge>0</ge></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The PHP development team reports:</p>
|
|
<blockquote cite="http://www.php.net/releases/5_2_2.php">
|
|
<p>Security Enhancements and Fixes in PHP 5.2.2 and PHP
|
|
4.4.7:</p>
|
|
<ul>
|
|
<li>Fixed CVE-2007-1001, GD wbmp used with invalid image
|
|
size</li>
|
|
<li>Fixed asciiz byte truncation inside mail()</li>
|
|
<li>Fixed a bug in mb_parse_str() that can be used to
|
|
activate register_globals</li>
|
|
<li>Fixed unallocated memory access/double free in in
|
|
array_user_key_compare()</li>
|
|
<li>Fixed a double free inside session_regenerate_id()</li>
|
|
<li>Added missing open_basedir & safe_mode checks to zip://
|
|
and bzip:// wrappers.</li>
|
|
<li>Limit nesting level of input variables with
|
|
max_input_nesting_level as fix for.</li>
|
|
<li>Fixed CRLF injection inside ftp_putcmd().</li>
|
|
<li>Fixed a possible super-global overwrite inside
|
|
import_request_variables().</li>
|
|
<li>Fixed a remotely trigger-able buffer overflow inside
|
|
bundled libxmlrpc library.</li>
|
|
</ul>
|
|
<p>Security Enhancements and Fixes in PHP 5.2.2 only:</p>
|
|
<ul>
|
|
<li>Fixed a header injection via Subject and To parameters
|
|
to the mail() function</li>
|
|
<li>Fixed wrong length calculation in unserialize S
|
|
type.</li>
|
|
<li>Fixed substr_compare and substr_count information
|
|
leak.</li>
|
|
<li>Fixed a remotely trigger-able buffer overflow inside
|
|
make_http_soap_request().</li>
|
|
<li>Fixed a buffer overflow inside
|
|
user_filter_factory_create().</li>
|
|
</ul>
|
|
<p>Security Enhancements and Fixes in PHP 4.4.7 only:</p>
|
|
<ul>
|
|
<li>XSS in phpinfo()</li>
|
|
</ul>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2007-1001</cvename>
|
|
<url>http://www.php.net/releases/4_4_7.php</url>
|
|
<url>http://www.php.net/releases/5_2_2.php</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-05-03</discovery>
|
|
<entry>2007-05-07</entry>
|
|
<modified>2007-05-10</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="0ac89b39-f829-11db-b55c-000e0c6d38a9">
|
|
<topic>qemu -- several vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>qemu</name>
|
|
<name>qemu-devel</name>
|
|
<range><lt>0.9.0_1</lt></range>
|
|
<range><ge>0.9.0s.20070101*</ge><lt>0.9.0s.20070405_3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Debian Security Team reports:</p>
|
|
<blockquote cite="http://lists.debian.org/debian-security-announce/debian-security-announce-2007/msg00040.html">
|
|
<p>Several vulnerabilities have been discovered in the QEMU processor
|
|
emulator, which may lead to the execution of arbitrary code or
|
|
denial of service. The Common Vulnerabilities and Exposures project
|
|
identifies the following problems:</p>
|
|
<p>CVE-2007-1320<br/>Tavis Ormandy discovered that a memory management
|
|
routine of the Cirrus video driver performs insufficient bounds
|
|
checking, which might allow the execution of arbitrary code through
|
|
a heap overflow.</p>
|
|
<p>CVE-2007-1321<br/>Tavis Ormandy discovered that the NE2000 network
|
|
driver and the socket code perform insufficient input validation,
|
|
which might allow the execution of arbitrary code through a heap
|
|
overflow.</p>
|
|
<p>CVE-2007-1322<br/>Tavis Ormandy discovered that the "icebp"
|
|
instruction can be abused to terminate the emulation, resulting in
|
|
denial of service.</p>
|
|
<p>CVE-2007-1323<br/>Tavis Ormandy discovered that the NE2000 network
|
|
driver and the socket code perform insufficient input validation,
|
|
which might allow the execution of arbitrary code through a heap
|
|
overflow.</p>
|
|
<p>CVE-2007-1366<br/>Tavis Ormandy discovered that the "aam"
|
|
instruction can be abused to crash qemu through a division by zero,
|
|
resulting in denial of service.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2007-1320</cvename>
|
|
<cvename>CVE-2007-1321</cvename>
|
|
<cvename>CVE-2007-1322</cvename>
|
|
<cvename>CVE-2007-1323</cvename>
|
|
<cvename>CVE-2007-1366</cvename>
|
|
<mlist msgid="20070501100313.GA4074@galadriel.inutil.org">http://lists.debian.org/debian-security-announce/debian-security-announce-2007/msg00040.html</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-05-01</discovery>
|
|
<entry>2007-05-01</entry>
|
|
<modified>2007-05-02</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="632c98be-aad2-4af2-849f-41a6862afd6a">
|
|
<topic>p5-Imager -- possibly exploitable buffer overflow</topic>
|
|
<affects>
|
|
<package>
|
|
<name>p5-Imager</name>
|
|
<range><lt>0.57</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Imager 0.56 and all earlier versions with BMP support have
|
|
a security issue when reading compressed 8-bit per pixel BMP
|
|
files where either a compressed run of data or a literal run
|
|
of data overflows the scan-line.</p>
|
|
<p>Such an overflow causes a buffer overflow in a malloc()
|
|
allocated memory buffer, possibly corrupting the memory arena
|
|
headers.</p>
|
|
<p>The effect depends on your system memory allocator, with glibc
|
|
this typically results in an abort, but with other memory
|
|
allocators it may be possible to cause local code execution.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2007-1942</cvename>
|
|
<cvename>CVE-2007-1943</cvename>
|
|
<cvename>CVE-2007-1946</cvename>
|
|
<cvename>CVE-2007-1948</cvename>
|
|
<url>https://rt.cpan.org/Public/Bug/Display.html?id=26811</url>
|
|
<url>http://ifsec.blogspot.com/2007/04/several-windows-image-viewers.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-04-04</discovery>
|
|
<entry>2007-04-30</entry>
|
|
<modified>2010-05-12</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="275b845e-f56c-11db-8163-000e0c2e438a">
|
|
<topic>FreeBSD -- IPv6 Routing Header 0 is dangerous</topic>
|
|
<affects>
|
|
<system>
|
|
<name>FreeBSD</name>
|
|
<range><gt>6.2</gt><lt>6.2_4</lt></range>
|
|
<range><gt>6.1</gt><lt>6.1_16</lt></range>
|
|
<range><gt>5.5</gt><lt>5.5_12</lt></range>
|
|
</system>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<h1>Problem Description</h1>
|
|
<p>There is no mechanism for preventing IPv6 routing headers
|
|
from being used to route packets over the same link(s) many
|
|
times.</p>
|
|
<h1>Impact</h1>
|
|
<p>An attacker can "amplify" a denial of service attack against
|
|
a link between two vulnerable hosts; that is, by sending a
|
|
small volume of traffic the attacker can consume a much larger
|
|
amount of bandwidth between the two vulnerable hosts.</p>
|
|
<p>An attacker can use vulnerable hosts to "concentrate" a
|
|
denial of service attack against a victim host or network;
|
|
that is, a set of packets sent over a period of 30 seconds
|
|
or more could be constructed such that they all arrive at
|
|
the victim within a period of 1 second or less over a
|
|
period of 30 seconds or more could be constructed such that
|
|
they all arrive at the victim within a period of 1 second or
|
|
less.</p>
|
|
<p>Other attacks may also be possible.</p>
|
|
<h1>Workaround</h1>
|
|
<p>No workaround is available.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2007-2242</cvename>
|
|
<freebsdsa>SA-07:03.ipv6</freebsdsa>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-04-26</discovery>
|
|
<entry>2007-04-28</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="ef2ffb03-f2b0-11db-ad25-0010b5a0a860">
|
|
<topic>mod_perl -- remote DoS in PATH_INFO parsing</topic>
|
|
<affects>
|
|
<package>
|
|
<name>mod_perl</name>
|
|
<range><lt>1.30</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>mod_perl2</name>
|
|
<range><lt>2.0.3_2,3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Mandriva reports:</p>
|
|
<blockquote cite="http://www.mandriva.com/security/advisories?name=MDKSA-2007:083">
|
|
<p>PerlRun.pm in Apache mod_perl 1.29 and earlier, and
|
|
RegistryCooker.pm in mod_perl 2.x, does not properly escape
|
|
PATH_INFO before use in a regular expression, which allows remote
|
|
attackers to cause a denial of service (resource consumption) via a
|
|
crafted URI.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2007-1349</cvename>
|
|
<url>http://www.mandriva.com/security/advisories?name=MDKSA-2007:083</url>
|
|
<url>http://secunia.com/advisories/24839</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-03-29</discovery>
|
|
<entry>2007-04-24</entry>
|
|
<modified>2007-06-27</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="c389d06d-ee57-11db-bd51-0016179b2dd5">
|
|
<topic>claws-mail -- APOP vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>claws-mail</name>
|
|
<range><lt>2.9.0</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>CVE reports:</p>
|
|
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1558">
|
|
<p>The APOP protocol allows remote attackers to guess the first 3
|
|
characters of a password via man-in-the-middle (MITM) attacks
|
|
that use crafted message IDs and MD5 collisions.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2007-1558</cvename>
|
|
<url>http://www.claws-mail.org/news.php</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-04-02</discovery>
|
|
<entry>2007-04-19</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="5678da43-ea99-11db-a802-000fea2763ce">
|
|
<topic>lighttpd -- DOS when access files with mtime 0</topic>
|
|
<affects>
|
|
<package>
|
|
<name>lighttpd</name>
|
|
<range><lt>1.4.15</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Lighttpd SA:</p>
|
|
<blockquote cite="http://www.lighttpd.net/assets/2007/4/13/lighttpd_sa2007_02.txt">
|
|
<p>Lighttpd caches the rendered string for mtime. The cache key has
|
|
as a default value 0. At that point the pointer to the string are
|
|
still NULL. If a file with an mtime of 0 is requested it tries to
|
|
access the pointer and crashes.</p>
|
|
<p>The bug requires that a malicious user can either upload files or
|
|
manipulate the mtime of the files.</p>
|
|
<p>The bug was reported by cubiq and fixed by Marcus Rueckert.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2007-1870</cvename>
|
|
<url>http://www.lighttpd.net/assets/2007/4/13/lighttpd_sa2007_02.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-01-14</discovery>
|
|
<entry>2007-04-14</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="d2b48d30-ea97-11db-a802-000fea2763ce">
|
|
<topic>lighttpd -- Remote DOS in CRLF parsing</topic>
|
|
<affects>
|
|
<package>
|
|
<name>lighttpd</name>
|
|
<range><gt>1.4.11</gt><lt>1.4.13_2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Lighttpd SA:</p>
|
|
<blockquote cite="http://www.lighttpd.net/assets/2007/4/13/lighttpd_sa2007_01.txt">
|
|
<p>If the connection aborts during parsing "\r\n\r\n" the server
|
|
might get into a infinite loop and use 100% of the CPU time.
|
|
lighttpd still responses to other requests. This can be repeated
|
|
until either the server limit for concurrent connections or file
|
|
descriptors is reached.</p>
|
|
<p>The bug was reported and fixed by Robert Jakabosky.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2007-1869</cvename>
|
|
<url>http://www.lighttpd.net/assets/2007/4/13/lighttpd_sa2007_01.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-12-15</discovery>
|
|
<entry>2007-04-14</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="c110eda2-e995-11db-a944-0012f06707f0">
|
|
<topic>freeradius -- EAP-TTLS Tunnel Memory Leak Remote DOS Vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>freeradius</name>
|
|
<name>freeradius-mysql</name>
|
|
<range><le>1.1.5</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The freeradius development team reports:</p>
|
|
<blockquote cite="http://www.freeradius.org/security.html">
|
|
<p>A malicous 802.1x supplicant could send malformed Diameter format
|
|
attributes inside of an EAP-TTLS tunnel. The server would reject
|
|
the authentication request, but would leak one VALUE_PAIR data
|
|
structure, of approximately 300 bytes. If an attacker performed
|
|
the attack many times (e.g. thousands or more over a period of
|
|
minutes to hours), the server could leak megabytes of memory,
|
|
potentially leading to an "out of memory" condition, and early
|
|
process exit.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>23466</bid>
|
|
<cvename>CVE-2005-1455</cvename>
|
|
<cvename>CVE-2005-1454</cvename>
|
|
<cvename>CVE-2007-2028</cvename>
|
|
<cvename>CVE-2005-4745</cvename>
|
|
<url>http://www.freeradius.org/security.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-04-10</discovery>
|
|
<entry>2007-04-13</entry>
|
|
<modified>2010-05-12</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="f1c4d133-e6d3-11db-99ea-0060084a00e5">
|
|
<topic>fetchmail -- insecure APOP authentication</topic>
|
|
<affects>
|
|
<package>
|
|
<name>fetchmail</name>
|
|
<range><lt>6.3.8</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Matthias Andree reports:</p>
|
|
<blockquote cite="http://www.fetchmail.info/fetchmail-SA-2007-01.txt">
|
|
<p>The POP3 standard, currently RFC-1939, has specified an optional,
|
|
MD5-based authentication scheme called "APOP" which no longer
|
|
should be considered secure.</p>
|
|
<p>Additionally, fetchmail's POP3 client implementation has been
|
|
validating the APOP challenge too lightly and accepted random
|
|
garbage as a POP3 server's APOP challenge. This made it easier
|
|
than necessary for man-in-the-middle attackers to retrieve by
|
|
several probing and guessing the first three characters of the
|
|
APOP secret, bringing brute forcing the remaining characters well
|
|
within reach.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2007-1558</cvename>
|
|
<url>http://www.fetchmail.info/fetchmail-SA-2007-01.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-04-06</discovery>
|
|
<entry>2007-04-09</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="84d3fbb2-e607-11db-8a32-000c76189c4c">
|
|
<topic>mcweject -- exploitable buffer overflow</topic>
|
|
<affects>
|
|
<package>
|
|
<name>mcweject</name>
|
|
<range><le>0.9</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>CVE reports:</p>
|
|
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1719">
|
|
<p>Buffer overflow in eject.c in Jason W. Bacon mcweject 0.9 on
|
|
FreeBSD, and possibly other versions, allows local users to execute
|
|
arbitrary code via a long command line argument, possibly involving
|
|
the device name.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2007-1719</cvename>
|
|
<freebsdpr>ports/111365</freebsdpr>
|
|
<url>http://www.milw0rm.com/exploits/3578</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-03-27</discovery>
|
|
<entry>2007-04-08</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="72999d57-d6f6-11db-961b-005056847b26">
|
|
<topic>WebCalendar -- "noSet" variable overwrite vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>WebCalendar</name>
|
|
<range><lt>1.0.5</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/24403/">
|
|
<p>A vulnerability has been discovered in WebCalendar,
|
|
which can be exploited by malicious people to compromise
|
|
a vulnerable system.</p>
|
|
<p>Input passed to unspecified parameters is not properly
|
|
verified before being used with the "noSet" parameter set.
|
|
This can be exploited to overwrite certain variables, and
|
|
allows e.g. the inclusion of arbitrary PHP files from internal
|
|
or external resources.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2007-1343</cvename>
|
|
<bid>22834</bid>
|
|
<url>http://sourceforge.net/project/shownotes.php?release_id=491130</url>
|
|
<url>http://xforce.iss.net/xforce/xfdb/32832</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-03-04</discovery>
|
|
<entry>2007-04-08</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="34414a1e-e377-11db-b8ab-000c76189c4c">
|
|
<topic>zope -- cross-site scripting vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>zope</name>
|
|
<range><lt>2.7.9_2</lt></range>
|
|
<range><ge>2.8.0</ge><le>2.8.8</le></range>
|
|
<range><ge>2.9.0</ge><le>2.9.6</le></range>
|
|
<range><ge>2.10.0</ge><le>2.10.2</le></range>
|
|
</package>
|
|
<package>
|
|
<name>plone</name>
|
|
<range><lt>2.5.3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Zope Team reports:</p>
|
|
<blockquote cite="http://www.zope.org/Products/Zope/Hotfix-2007-03-20/announcement/view">
|
|
<p>A vulnerability has been discovered in Zope, where by certain types
|
|
of misuse of HTTP GET, an attacker could gain elevated privileges.
|
|
All Zope versions up to and including 2.10.2 are affected.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>23084</bid>
|
|
<cvename>CVE-2007-0240</cvename>
|
|
<freebsdpr>ports/111119</freebsdpr>
|
|
<url>http://www.zope.org/Products/Zope/Hotfix-2007-03-20/announcement/view</url>
|
|
<url>http://plone.org/products/plone/releases/2.5.3</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-01-16</discovery>
|
|
<entry>2007-04-05</entry>
|
|
<modified>2009-03-22</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="c27bc173-d7aa-11db-b141-0016179b2dd5">
|
|
<topic>Squid -- TRACE method handling denial of service</topic>
|
|
<affects>
|
|
<package>
|
|
<name>squid</name>
|
|
<range><ge>2.6.*</ge><lt>2.6.12</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Squid advisory 2007:1 notes:</p>
|
|
<blockquote cite="http://www.squid-cache.org/Advisories/SQUID-2007_1.txt">
|
|
<p>Due to an internal error Squid-2.6 is vulnerable to a denial of
|
|
service attack when processing the TRACE request method.</p>
|
|
<p>Workarounds:</p>
|
|
<p>To work around the problem deny access to using the TRACE method by
|
|
inserting the following two lines before your first http_access
|
|
rule.</p>
|
|
<p>acl TRACE method TRACE</p>
|
|
<p>http_access deny TRACE</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2007-1560</cvename>
|
|
<url>http://www.squid-cache.org/Advisories/SQUID-2007_1.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-03-20</discovery>
|
|
<entry>2007-03-21</entry>
|
|
<modified>2010-05-12</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="8e02441d-d39c-11db-a6da-0003476f14d3">
|
|
<topic>sql-ledger -- security bypass vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>sql-ledger</name>
|
|
<range><lt>2.6.26</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Chris Travers reports:</p>
|
|
<blockquote cite="http://www.securityfocus.com/archive/1/462375">
|
|
<p>George Theall of Tenable Security notified the LedgerSMB
|
|
core team today of an authentication bypass vulnerability
|
|
allowing full access to the administrator interface of
|
|
LedgerSMB 1.1 and SQL-Ledger 2.x. The problem is caused
|
|
by the password checking routine failing to enforce a
|
|
password check under certain circumstances. The user
|
|
can then create accounts or effect denial of service
|
|
attacks.</p>
|
|
<p>This is not related to any previous CVE.</p>
|
|
<p>We have coordinated with the SQL-Ledger vendor and
|
|
today both of us released security patches correcting
|
|
the problem. SQL-Ledger users who can upgrade to 2.6.26
|
|
should do so, and LedgerSMB 1.1 or 1.0 users should
|
|
upgrade to 1.1.9. Users who cannot upgrade should
|
|
configure their web servers to use http authentication
|
|
for the admin.pl script in the main root directory.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<freebsdpr>ports/110350</freebsdpr>
|
|
<url>http://www.securityfocus.com/archive/1/462375</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-03-09</discovery>
|
|
<entry>2007-03-16</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="f235fe7a-b9ca-11db-bf0f-0013720b182d">
|
|
<topic>samba -- potential Denial of Service bug in smbd</topic>
|
|
<affects>
|
|
<package>
|
|
<name>samba</name>
|
|
<name>ja-samba</name>
|
|
<range><ge>3.0.6,1</ge><lt>3.0.24,1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Samba Team reports:</p>
|
|
<blockquote cite="http://www.samba.org/samba/security/CVE-2007-0452.html">
|
|
<p>Internally Samba's file server daemon, smbd, implements
|
|
support for deferred file open calls in an attempt to serve
|
|
client requests that would otherwise fail due to a share mode
|
|
violation. When renaming a file under certain circumstances
|
|
it is possible that the request is never removed from the deferred
|
|
open queue. smbd will then become stuck is a loop trying to
|
|
service the open request.</p>
|
|
<p>This bug may allow an authenticated user to exhaust resources
|
|
such as memory and CPU on the server by opening multiple CIFS
|
|
sessions, each of which will normally spawn a new smbd process,
|
|
and sending each connection into an infinite loop.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2007-0452</cvename>
|
|
<url>http://www.samba.org/samba/security/CVE-2007-0452.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-02-05</discovery>
|
|
<entry>2007-03-16</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="57ae52f7-b9cc-11db-bf0f-0013720b182d">
|
|
<topic>samba -- format string bug in afsacl.so VFS plugin</topic>
|
|
<affects>
|
|
<package>
|
|
<name>samba</name>
|
|
<name>ja-samba</name>
|
|
<range><ge>3.0.6,1</ge><lt>3.0.24,1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Samba Team reports:</p>
|
|
<blockquote cite="http://www.samba.org/samba/security/CVE-2007-0454.html">
|
|
<p>NOTE: This security advisory only impacts Samba servers
|
|
that share AFS file systems to CIFS clients and which have
|
|
been explicitly instructed in smb.conf to load the afsacl.so
|
|
VFS module.</p>
|
|
<p>The source defect results in the name of a file stored on
|
|
disk being used as the format string in a call to snprintf().
|
|
This bug becomes exploitable only when a user is able
|
|
to write to a share which utilizes Samba's afsacl.so library
|
|
for setting Windows NT access control lists on files residing
|
|
on an AFS file system.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2007-0454</cvename>
|
|
<url>http://www.samba.org/samba/security/CVE-2007-0454.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-02-05</discovery>
|
|
<entry>2007-03-16</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="73f53712-d028-11db-8c07-0211d85f11fb">
|
|
<topic>ktorrent -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>ktorrent</name>
|
|
<range><lt>2.1.2</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>ktorrent-devel</name>
|
|
<range><lt>20070311</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Two problems have been found in KTorrent:</p>
|
|
<ul>
|
|
<li>KTorrent does not properly sanitize file names to filter
|
|
out ".." components, so it's possible for an attacker to create
|
|
a malicious torrent in order to overwrite arbitrary files within
|
|
the filesystem.</li>
|
|
<li>Messages with invalid chunk indexes aren't rejected.</li>
|
|
</ul>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2007-1384</cvename>
|
|
<cvename>CVE-2007-1385</cvename>
|
|
<url>http://ktorrent.org/forum/viewtopic.php?t=1401</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-03-09</discovery>
|
|
<entry>2007-03-11</entry>
|
|
<modified>2007-03-14</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="abeb9b64-ce50-11db-bc24-0016179b2dd5">
|
|
<topic>mplayer -- DMO File Parsing Buffer Overflow Vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>mplayer</name>
|
|
<name>mplayer-esound</name>
|
|
<name>mplayer-gtk</name>
|
|
<name>mplayer-gtk2</name>
|
|
<name>mplayer-gtk-esound</name>
|
|
<name>mplayer-gtk2-esound</name>
|
|
<range><lt>0.99.10_5</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>"Moritz Jodeit reports:</p>
|
|
<blockquote cite="http://lists.grok.org.uk/pipermail/full-disclosure/2007-March/052738.html">
|
|
<p>There's an exploitable buffer overflow in the current version
|
|
of MPlayer (v1.0rc1) which can be exploited with a maliciously
|
|
crafted video file. It is hidden in the DMO_VideoDecoder()
|
|
function of `loader/dmo/DMO_VideoDecoder.c' file.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>22771</bid>
|
|
<cvename>CVE-2007-1246</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-02-11</discovery>
|
|
<entry>2007-03-09</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="e546c7ce-ce46-11db-bc24-0016179b2dd5">
|
|
<topic>trac -- cross site scripting vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>trac</name>
|
|
<range><lt>0.10.3</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>ja-trac</name>
|
|
<range><lt>0.10.3_1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/24470/">
|
|
<p>The vulnerability is caused due to an error within the
|
|
"download wiki page as text" function, which can be exploited
|
|
to execute arbitrary HTML and script code in a user's browser
|
|
session in context of an affected site.</p>
|
|
<p>Successful exploitation may require that the victim uses IE.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://secunia.com/advisories/24470</url>
|
|
<url>http://trac.edgewall.org/wiki/ChangeLog#a0.10.3.1</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-03-09</discovery>
|
|
<entry>2007-03-09</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="cf86c644-cb6c-11db-8e9d-000c6ec775d9">
|
|
<topic>mod_jk -- long URL stack overflow vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>mod_jk-ap2</name>
|
|
<name>mod_jk</name>
|
|
<range><ge>1.2.19</ge><lt>1.2.21</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>TippingPoint and The Zero Day Initiative reports:</p>
|
|
<blockquote cite="http://www.zerodayinitiative.com/advisories/ZDI-07-008.html">
|
|
<p>This vulnerability allows remote attackers to execute
|
|
arbitrary code on vulnerable installations of Apache
|
|
Tomcat JK Web Server Connector. Authentication is not
|
|
required to exploit this vulnerability.</p>
|
|
<p>The specific flaw exists in the URI handler for the
|
|
mod_jk.so library, map_uri_to_worker(), defined in
|
|
native/common/jk_uri_worker_map.c. When parsing a long URL
|
|
request, the URI worker map routine performs an unsafe
|
|
memory copy. This results in a stack overflow condition
|
|
which can be leveraged to execute arbitrary code.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2007-0774</cvename>
|
|
<url>http://tomcat.apache.org/security-jk.html</url>
|
|
<url>http://www.zerodayinitiative.com/advisories/ZDI-07-008.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-03-02</discovery>
|
|
<entry>2007-03-05</entry>
|
|
<modified>2007-03-06</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="3cb6f059-c69d-11db-9f82-000e0c2e438a">
|
|
<topic>bind -- Multiple Denial of Service vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>named</name>
|
|
<range><lt>9.3.4</lt></range>
|
|
</package>
|
|
<system>
|
|
<name>FreeBSD</name>
|
|
<range><gt>6.2</gt><lt>6.2_1</lt></range>
|
|
<range><gt>6.1</gt><lt>6.1_13</lt></range>
|
|
<range><gt>5.5</gt><lt>5.5_11</lt></range>
|
|
</system>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<h1>Problem Description:</h1>
|
|
<p>A type * (ANY) query response containing multiple RRsets can
|
|
trigger an assertion failure.</p>
|
|
<p>Certain recursive queries can cause the nameserver to crash
|
|
by using memory which has already been freed.</p>
|
|
<h1>Impact:</h1>
|
|
<p>A remote attacker sending a type * (ANY) query to an
|
|
authoritative DNS server for a DNSSEC signed zone can cause
|
|
the named(8) daemon to exit, resulting in a Denial of
|
|
Service.</p>
|
|
<p>A remote attacker sending recursive queries can cause the
|
|
nameserver to crash, resulting in a Denial of Service.</p>
|
|
<h1>Workaround:</h1>
|
|
<p>There is no workaround available, but systems which are not
|
|
authoritative servers for DNSSEC signed zones are not
|
|
affected by the first issue; and systems which do not permit
|
|
untrusted users to perform recursive DNS resolution are not
|
|
affected by the second issue. Note that the default
|
|
configuration for named(8) in FreeBSD allows local access
|
|
only (which on many systems is equivalent to refusing access
|
|
to untrusted users).</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2007-0493</cvename>
|
|
<cvename>CVE-2007-0494</cvename>
|
|
<freebsdsa>SA-07:02.bind</freebsdsa>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-02-09</discovery>
|
|
<entry>2007-02-27</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="46b922a8-c69c-11db-9f82-000e0c2e438a">
|
|
<topic>FreeBSD -- Jail rc.d script privilege escalation</topic>
|
|
<affects>
|
|
<system>
|
|
<name>FreeBSD</name>
|
|
<range><gt>6.1</gt><lt>6.1_12</lt></range>
|
|
<range><gt>6.0</gt><lt>6.0_17</lt></range>
|
|
<range><gt>5.5</gt><lt>5.5_15</lt></range>
|
|
</system>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<h1>Problem Description:</h1>
|
|
<p>In multiple situations the host's jail rc.d(8) script does
|
|
not check if a path inside the jail file system structure is
|
|
a symbolic link before using the path. In particular this is
|
|
the case when writing the output from the jail start-up to
|
|
/var/log/console.log and when mounting and unmounting file
|
|
systems inside the jail directory structure.</p>
|
|
<h1>Impact:</h1>
|
|
<p>Due to the lack of handling of potential symbolic links the
|
|
host's jail rc.d(8) script is vulnerable to "symlink
|
|
attacks". By replacing /var/log/console.log inside the jail
|
|
with a symbolic link it is possible for the superuser (root)
|
|
inside the jail to overwrite files on the host system outside
|
|
the jail with arbitrary content. This in turn can be used to
|
|
execute arbitrary commands with non-jailed superuser
|
|
privileges.</p>
|
|
<p>Similarly, by changing directory mount points inside the
|
|
jail file system structure into symbolic links, it may be
|
|
possible for a jailed attacker to mount file systems which
|
|
were meant to be mounted inside the jail at arbitrary points
|
|
in the host file system structure, or to unmount arbitrary
|
|
file systems on the host system.</p>
|
|
<p>NOTE WELL: The above vulnerabilities occur only when a jail
|
|
is being started or stopped using the host's jail rc.d(8)
|
|
script; once started (and until stopped), running jails
|
|
cannot exploit this.</p>
|
|
<h1>Workaround:</h1>
|
|
<p>If the sysctl(8) variable security.jail.chflags_allowed is
|
|
set to 0 (the default), setting the "sunlnk" system flag on
|
|
/var, /var/log, /var/log/console.log, and all file system
|
|
mount points and their parent directories inside the jail(s)
|
|
will ensure that the console log file and mount points are
|
|
not replaced by symbolic links. If this is done while jails
|
|
are running, the administrator must check that an attacker
|
|
has not replaced any directories with symlinks after setting
|
|
the "sunlnk" flag.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2007-0166</cvename>
|
|
<freebsdsa>SA-07:01.jail</freebsdsa>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-01-11</discovery>
|
|
<entry>2007-02-27</entry>
|
|
<modified>2007-08-02</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="44449bf7-c69b-11db-9f82-000e0c2e438a">
|
|
<topic>gtar -- name mangling symlink vulnerability</topic>
|
|
<affects>
|
|
<system>
|
|
<name>FreeBSD</name>
|
|
<range><gt>5.5</gt><lt>5.5_9</lt></range>
|
|
<range><gt>4.11</gt><lt>4.11_26</lt></range>
|
|
</system>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<h1>Problem Description:</h1>
|
|
<p>Symlinks created using the "GNUTYPE_NAMES" tar extension can
|
|
be absolute due to lack of proper sanity checks.</p>
|
|
<h1>Impact:</h1>
|
|
<p>If an attacker can get a user to extract a specially crafted
|
|
tar archive the attacker can overwrite arbitrary files with
|
|
the permissions of the user running gtar. If file system
|
|
permissions allow it, this may allow the attacker to overwrite
|
|
important system file (if gtar is being run as root), or
|
|
important user configuration files such as .tcshrc or .bashrc,
|
|
which would allow the attacker to run arbitrary commands.</p>
|
|
<h1>Workaround:</h1>
|
|
<p>Use "bsdtar", which is the default tar implementation in
|
|
FreeBSD 5.3 and higher. For FreeBSD 4.x, bsdtar is available
|
|
in the FreeBSD Ports Collection as
|
|
ports/archivers/libarchive.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2006-6097</cvename>
|
|
<freebsdsa>SA-06:26.gtar</freebsdsa>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-12-06</discovery>
|
|
<entry>2007-02-27</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="5c554c0f-c69a-11db-9f82-000e0c2e438a">
|
|
<topic>FreeBSD -- Kernel memory disclosure in firewire(4)</topic>
|
|
<affects>
|
|
<system>
|
|
<name>FreeBSD</name>
|
|
<range><gt>6.1</gt><lt>6.1_11</lt></range>
|
|
<range><gt>6.0</gt><lt>6.2_16</lt></range>
|
|
<range><gt>5.5</gt><lt>5.5_9</lt></range>
|
|
<range><gt>4.11</gt><lt>4.11_26</lt></range>
|
|
</system>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<h1>Problem Description:</h1>
|
|
<p>In the FW_GCROM ioctl, a signed integer comparison is used
|
|
instead of an unsigned integer comparison when computing the
|
|
length of a buffer to be copied from the kernel into the
|
|
calling application.</p>
|
|
<h1>Impact:</h1>
|
|
<p>A user in the "operator" group can read the contents of
|
|
kernel memory. Such memory might contain sensitive
|
|
information, such as portions of the file cache or terminal
|
|
buffers. This information might be directly useful, or it
|
|
might be leveraged to obtain elevated privileges in some way;
|
|
for example, a terminal buffer might include a user-entered
|
|
password.</p>
|
|
<h1>Workaround:</h1>
|
|
<p>No workaround is available, but systems without IEEE 1394
|
|
("FireWire") interfaces are not vulnerable. (Note that
|
|
systems with IEEE 1394 interfaces are affected regardless of
|
|
whether any devices are attached.)</p>
|
|
<p>Note also that FreeBSD does not have any non-root users in
|
|
the "operator" group by default; systems on which no users
|
|
have been added to this group are therefore also not
|
|
vulnerable.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2006-6013</cvename>
|
|
<freebsdsa>SA-06:25.kmem</freebsdsa>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-12-06</discovery>
|
|
<entry>2007-02-27</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="792bc222-c5d7-11db-9f82-000e0c2e438a">
|
|
<topic>libarchive -- Infinite loop in corrupt archives handling in libarchive</topic>
|
|
<affects>
|
|
<package>
|
|
<name>libarchive</name>
|
|
<range><lt>1.3.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<h1>Problem Description:</h1>
|
|
<p>If the end of an archive is reached while attempting to
|
|
"skip" past a region of an archive, libarchive will enter an
|
|
infinite loop wherein it repeatedly attempts (and fails) to
|
|
read further data.</p>
|
|
<h1>Impact:</h1>
|
|
<p>An attacker able to cause a system to extract (via "tar -x"
|
|
or another application which uses libarchive) or list the
|
|
contents (via "tar -t" or another libarchive-using
|
|
application) of an archive provided by the attacker can cause
|
|
libarchive to enter an infinite loop and use all available
|
|
CPU time.</p>
|
|
<h1>Workaround:</h1>
|
|
<p>No workaround is available.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2006-5680</cvename>
|
|
<freebsdsa>SA-06:24.libarchive</freebsdsa>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-11-08</discovery>
|
|
<entry>2007-02-26</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="0f37d765-c5d4-11db-9f82-000e0c2e438a">
|
|
<topic>OpenSSL -- Multiple problems in crypto(3)</topic>
|
|
<affects>
|
|
<package>
|
|
<name>openssl</name>
|
|
<range><lt>0.9.7l_0</lt></range>
|
|
<range><gt>0.9.8</gt><lt>0.9.8d_0</lt></range>
|
|
</package>
|
|
<system>
|
|
<name>FreeBSD</name>
|
|
<range><gt>6.1</gt><lt>6.1_9</lt></range>
|
|
<range><gt>6.0</gt><lt>6.0_14</lt></range>
|
|
<range><gt>5.5</gt><lt>5.5_7</lt></range>
|
|
<range><gt>5.4</gt><lt>5.4_21</lt></range>
|
|
<range><gt>5.3</gt><lt>5.3_36</lt></range>
|
|
<range><gt>4.11</gt><lt>4.11_24</lt></range>
|
|
</system>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<h1>Problem Description:</h1>
|
|
<p>Several problems have been found in OpenSSL:</p>
|
|
<ul>
|
|
<li>During the parsing of certain invalid ASN1 structures an
|
|
error condition is mishandled, possibly resulting in an
|
|
infinite loop.</li>
|
|
<li>A buffer overflow exists in the SSL_get_shared_ciphers
|
|
function.</li>
|
|
<li>A NULL pointer may be dereferenced in the SSL version 2
|
|
client code.</li>
|
|
</ul>
|
|
<p>In addition, many applications using OpenSSL do not perform
|
|
any validation of the lengths of public keys being used.</p>
|
|
<h1>Impact:</h1>
|
|
<p>Servers which parse ASN1 data from untrusted sources may be
|
|
vulnerable to a denial of service attack.</p>
|
|
<p>An attacker accessing a server which uses SSL version 2 may
|
|
be able to execute arbitrary code with the privileges of that
|
|
server.</p>
|
|
<p>A malicious SSL server can cause clients connecting using
|
|
SSL version 2 to crash.</p>
|
|
<p>Applications which perform public key operations using
|
|
untrusted keys may be vulnerable to a denial of service
|
|
attack.</p>
|
|
<h1>Workaround:</h1>
|
|
<p>No workaround is available, but not all of the
|
|
vulnerabilities mentioned affect all applications.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2006-2937</cvename>
|
|
<cvename>CVE-2006-2938</cvename>
|
|
<cvename>CVE-2006-2940</cvename>
|
|
<cvename>CVE-2006-3738</cvename>
|
|
<cvename>CVE-2006-4343</cvename>
|
|
<freebsdsa>SA-06:23.openssl</freebsdsa>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-09-28</discovery>
|
|
<entry>2007-02-26</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="12bd6ecf-c430-11db-95c5-000c6ec775d9">
|
|
<topic>mozilla -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>firefox</name>
|
|
<range><lt>1.5.0.10,1</lt></range>
|
|
<range><gt>2.*,1</gt><lt>2.0.0.2,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-firefox</name>
|
|
<range><lt>1.5.0.10</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>lightning</name>
|
|
<range><lt>0.3.1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>seamonkey</name>
|
|
<name>linux-seamonkey</name>
|
|
<range><lt>1.0.8</lt></range>
|
|
<range><ge>1.1</ge><lt>1.1.1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>thunderbird</name>
|
|
<name>linux-thunderbird</name>
|
|
<name>mozilla-thunderbird</name>
|
|
<range><lt>1.5.0.10</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-firefox-devel</name>
|
|
<range><lt>3.0.a2007.04.18</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-seamonkey-devel</name>
|
|
<range><lt>1.5.a2007.04.18</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>firefox-ja</name>
|
|
<name>linux-mozilla-devel</name>
|
|
<name>linux-mozilla</name>
|
|
<name>mozilla</name>
|
|
<range><gt>0</gt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Mozilla Foundation reports of multiple security issues
|
|
in Firefox, Seamonkey, and Thunderbird. Several of these
|
|
issues can probably be used to run arbitrary code with the
|
|
privilege of the user running the program.</p>
|
|
<blockquote cite="http://www.mozilla.org/projects/security/known-vulnerabilities.html#firefox2.0.0.2">
|
|
<ul>
|
|
<li>MFSA 2007-08 onUnload + document.write() memory corruption</li>
|
|
<li>MFSA 2007-07 Embedded nulls in location.hostname confuse same-domain checks</li>
|
|
<li>MFSA 2007-06 Mozilla Network Security Services (NSS) SSLv2 buffer overflow</li>
|
|
<li>MFSA 2007-05 XSS and local file access by opening blocked popups</li>
|
|
<li>MFSA 2007-04 Spoofing using custom cursor and CSS3 hotspot</li>
|
|
<li>MFSA 2007-03 Information disclosure through cache collisions</li>
|
|
<li>MFSA 2007-02 Improvements to help protect against Cross-Site Scripting attacks</li>
|
|
<li>MFSA 2007-01 Crashes with evidence of memory corruption (rv:1.8.0.10/1.8.1.2)</li>
|
|
</ul>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2006-6077</cvename>
|
|
<cvename>CVE-2007-0008</cvename>
|
|
<cvename>CVE-2007-0009</cvename>
|
|
<cvename>CVE-2007-0775</cvename>
|
|
<cvename>CVE-2007-0776</cvename>
|
|
<cvename>CVE-2007-0777</cvename>
|
|
<cvename>CVE-2007-0778</cvename>
|
|
<cvename>CVE-2007-0779</cvename>
|
|
<cvename>CVE-2007-0780</cvename>
|
|
<cvename>CVE-2007-0800</cvename>
|
|
<cvename>CVE-2007-0981</cvename>
|
|
<cvename>CVE-2007-0995</cvename>
|
|
<cvename>CVE-2007-1092</cvename>
|
|
<url>http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=482</url>
|
|
<url>http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=483</url>
|
|
<url>http://www.mozilla.org/security/announce/2007/mfsa2007-01.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2007/mfsa2007-02.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2007/mfsa2007-03.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2007/mfsa2007-04.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2007/mfsa2007-05.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2007/mfsa2007-06.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2007/mfsa2007-07.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2007/mfsa2007-08.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-02-23</discovery>
|
|
<entry>2007-02-24</entry>
|
|
<modified>2007-04-19</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="afdf500f-c1f6-11db-95c5-000c6ec775d9">
|
|
<topic>snort -- DCE/RPC preprocessor vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>snort</name>
|
|
<range><ge>2.6.1</ge><lt>2.6.1.3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A IBM Internet Security Systems Protection Advisory
|
|
reports:</p>
|
|
<blockquote cite="http://iss.net/threats/257.html">
|
|
<p>Snort is vulnerable to a stack-based buffer overflow as a
|
|
result of DCE/RPC reassembly. This vulnerability is in a
|
|
dynamic-preprocessor enabled in the default configuration,
|
|
and the configuration for this preprocessor allows for
|
|
auto-recognition of SMB traffic to perform reassembly
|
|
on. No checks are performed to see if the traffic is part
|
|
of a valid TCP session, and multiple Write AndX requests
|
|
can be chained in the same TCP segment. As a result, an
|
|
attacker can exploit this overflow with a single TCP PDU
|
|
sent across a network monitored by Snort or Sourcefire.</p>
|
|
<p>Snort users who cannot upgrade immediately are advised to
|
|
disable the DCE/RPC preprocessor by removing the DCE/RPC
|
|
preprocessor directives from snort.conf and restarting
|
|
Snort. However, be advised that disabling the DCE/RPC
|
|
preprocessor reduces detection capabilities for attacks in
|
|
DCE/RPC traffic. After upgrading, customers should
|
|
re-enable the DCE/RPC preprocessor.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<certvu>196240</certvu>
|
|
<cvename>CVE-2006-5276</cvename>
|
|
<url>http://xforce.iss.net/xforce/xfdb/31275</url>
|
|
<url>http://www.snort.org/docs/advisory-2007-02-19.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-02-19</discovery>
|
|
<entry>2007-02-21</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="94234e00-be8a-11db-b2ec-000c6ec775d9">
|
|
<topic>rar -- password prompt buffer overflow vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>rar</name>
|
|
<range><lt>3.70.b1,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>unrar</name>
|
|
<name>zh-unrar</name>
|
|
<range><lt>3.70.b1,4</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>iDefense reports:</p>
|
|
<blockquote cite="http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=472">
|
|
<p>Remote exploitation of a stack based buffer overflow
|
|
vulnerability in RARLabs Unrar may allow an attacker to
|
|
execute arbitrary code with the privileges of the user
|
|
opening the archive.</p>
|
|
<p>Unrar is prone to a stack based buffer overflow when
|
|
processing specially crafted password protected
|
|
archives.</p>
|
|
<p>If users are using the vulnerable command line based
|
|
unrar, they still need to interact with the program in
|
|
order to trigger the vulnerability. They must respond to
|
|
the prompt asking for the password, after which the
|
|
vulnerability will be triggered. They do not need to enter
|
|
a correct password, but they must at least push the enter
|
|
key.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>22447</bid>
|
|
<cvename>CVE-2007-0855</cvename>
|
|
<url>http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=472</url>
|
|
<url>http://www.rarsoft.com/rarnew.htm</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-02-07</discovery>
|
|
<entry>2007-02-17</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="7fcf1727-be71-11db-b2ec-000c6ec775d9">
|
|
<topic>php -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>php5-imap</name>
|
|
<name>php5-odbc</name>
|
|
<name>php5-session</name>
|
|
<name>php5-shmop</name>
|
|
<name>php5-sqlite</name>
|
|
<name>php5-wddx</name>
|
|
<name>php5</name>
|
|
<range><lt>5.2.1_2</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>php4-odbc</name>
|
|
<name>php4-session</name>
|
|
<name>php4-shmop</name>
|
|
<name>php4-wddx</name>
|
|
<name>php4</name>
|
|
<range><lt>4.4.5</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>mod_php4-twig</name>
|
|
<name>mod_php4</name>
|
|
<name>mod_php5</name>
|
|
<name>mod_php</name>
|
|
<name>php4-cgi</name>
|
|
<name>php4-cli</name>
|
|
<name>php4-dtc</name>
|
|
<name>php4-horde</name>
|
|
<name>php4-nms</name>
|
|
<name>php5-cgi</name>
|
|
<name>php5-cli</name>
|
|
<name>php5-dtc</name>
|
|
<name>php5-horde</name>
|
|
<name>php5-nms</name>
|
|
<range><ge>0</ge></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Multiple vulnerabilities have been found in PHP, including:
|
|
buffer overflows, stack overflows, format string, and
|
|
information disclosure vulnerabilities.</p>
|
|
<p>The session extension contained <code>safe_mode</code> and
|
|
<code>open_basedir</code> bypasses, but the FreeBSD Security
|
|
Officer does not consider these real security
|
|
vulnerabilities, since <code>safe_mode</code> and
|
|
<code>open_basedir</code> are insecure by design and should
|
|
not be relied upon.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2007-0905</cvename>
|
|
<cvename>CVE-2007-0906</cvename>
|
|
<cvename>CVE-2007-0907</cvename>
|
|
<cvename>CVE-2007-0908</cvename>
|
|
<cvename>CVE-2007-0909</cvename>
|
|
<cvename>CVE-2007-0910</cvename>
|
|
<cvename>CVE-2007-0988</cvename>
|
|
<url>http://secunia.com/advisories/24089/</url>
|
|
<url>http://www.php.net/releases/4_4_5.php</url>
|
|
<url>http://www.php.net/releases/5_2_1.php</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-02-09</discovery>
|
|
<entry>2007-02-17</entry>
|
|
<modified>2007-03-12</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="7bb127c1-a5aa-11db-9ddc-0011098b2f36">
|
|
<topic>joomla -- multiple remote vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>joomla</name>
|
|
<range><lt>1.0.12</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/23563/">
|
|
<p>Some vulnerabilities have been reported in Joomla!, where some
|
|
have unknown impacts and one can be exploited by malicious people
|
|
to conduct cross-site scripting attacks.</p>
|
|
<ol>
|
|
<li>Input passed to an unspecified parameter is not properly
|
|
sanitised before being returned to the user. This can be
|
|
exploited to execute arbitrary HTML and script code in a
|
|
user's browser session in context of an affected site.</li>
|
|
<li>The vulnerabilities are caused due to unspecified errors
|
|
in Joomla!. The vendor describes them as "several low level
|
|
security issues". No further information is currently
|
|
available.</li>
|
|
</ol>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>21810</bid>
|
|
<cvename>CVE-2006-6832</cvename>
|
|
<cvename>CVE-2006-6833</cvename>
|
|
<cvename>CVE-2006-6834</cvename>
|
|
<url>http://secunia.com/advisories/23563/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-12-29</discovery>
|
|
<entry>2007-01-17</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="1374b96c-a1c2-11db-9ddc-0011098b2f36">
|
|
<topic>sircd -- remote reverse DNS buffer overflow</topic>
|
|
<affects>
|
|
<package>
|
|
<name>sircd</name>
|
|
<range><le>0.4.0</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/8153/">
|
|
<p>A vulnerability in sircd can be exploited by a malicious person
|
|
to compromise a vulnerable system. The vulnerability is caused
|
|
by a boundary error in the code handling reverse DNS lookups,
|
|
when a user connects to the service. If the FQDN (Fully Qualified
|
|
Domain Name) returned is excessively long, the allocated buffer
|
|
is overflowed making it possible to execute arbitrary code on the
|
|
system with the privileges of the sircd daemon.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>6924</bid>
|
|
<url>http://secunia.com/advisories/8153</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2003-02-24</discovery>
|
|
<entry>2007-01-15</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="e92d8f6b-a1c0-11db-9ddc-0011098b2f36">
|
|
<topic>sircd -- remote operator privilege escalation vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>sircd</name>
|
|
<range><ge>0</ge></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/10274/">
|
|
<p>A vulnerability has been reported in sircd, which can be
|
|
exploited by malicious users to gain operator privileges.
|
|
The problem is that any user reportedly can set their usermode
|
|
to operator. The vulnerability has been reported in
|
|
versions 0.5.2 and 0.5.3. Other versions may also be affected.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>9097</bid>
|
|
<url>http://secunia.com/advisories/10274/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2003-11-20</discovery>
|
|
<entry>2007-01-15</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="41da2ba4-a24e-11db-bd24-000f3dcc6a5d">
|
|
<topic>cacti -- Multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>cacti</name>
|
|
<range><lt>0.8.6i.4</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/23528/">
|
|
<p>rgod has discovered four vulnerabilities in Cacti,
|
|
which can be exploited by malicious people to bypass
|
|
certain security restrictions, manipulate data
|
|
and compromise vulnerable systems.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://secunia.com/advisories/23528/</url>
|
|
<url>http://forums.cacti.net/about18846-0-asc-0.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-12-28</discovery>
|
|
<entry>2007-01-12</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="b2ff68b2-9f29-11db-a4e4-0211d87675b7">
|
|
<topic>mplayer -- buffer overflow in the code for RealMedia RTSP streams.</topic>
|
|
<affects>
|
|
<package>
|
|
<name>mplayer</name>
|
|
<name>mplayer-esound</name>
|
|
<name>mplayer-gtk</name>
|
|
<name>mplayer-gtk2</name>
|
|
<name>mplayer-gtk-esound</name>
|
|
<name>mplayer-gtk2-esound</name>
|
|
<range><lt>0.99.10_1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<blockquote cite="http://www.mplayerhq.hu/design7/news.html">
|
|
<p>A potential buffer overflow was found in the code used to handle
|
|
RealMedia RTSP streams. When checking for matching asm rules, the code
|
|
stores the results in a fixed-size array, but no boundary checks are
|
|
performed. This may lead to a buffer overflow if the user is tricked
|
|
into connecting to a malicious server. Since the attacker can not write
|
|
arbitrary data into the buffer, creating an exploit is very hard; but a
|
|
DoS attack is easily made.
|
|
A fix for this problem was committed to SVN on Sun Dec 31 13:27:53 2006
|
|
UTC as r21799. The fix involves three files: stream/realrtsp/asmrp.c,
|
|
stream/realrtsp/asmrp.h and stream/realrtsp/real.c.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<freebsdpr>ports/107217</freebsdpr>
|
|
<cvename>CVE-2006-6172</cvename>
|
|
<url>http://www.mplayerhq.hu/design7/news.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-12-31</discovery>
|
|
<entry>2007-01-08</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="37e30313-9d8c-11db-858b-0060084a00e5">
|
|
<topic>fetchmail -- crashes when refusing a message bound for an MDA</topic>
|
|
<affects>
|
|
<package>
|
|
<name>fetchmail</name>
|
|
<range><ge>6.3.5</ge><lt>6.3.6</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Matthias Andree reports:</p>
|
|
<blockquote cite="http://www.fetchmail.info/fetchmail-SA-2006-03.txt">
|
|
<p>When delivering messages to a message delivery agent by means
|
|
of the "mda" option, fetchmail can crash (by passing
|
|
a NULL pointer to ferror() and fflush()) when refusing a message.
|
|
SMTP and LMTP delivery modes aren't affected.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2006-5974</cvename>
|
|
<url>http://www.fetchmail.info/fetchmail-SA-2006-03.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-01-04</discovery>
|
|
<entry>2007-01-06</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="5238ac45-9d8c-11db-858b-0060084a00e5">
|
|
<topic>fetchmail -- TLS enforcement problem/MITM attack/password exposure</topic>
|
|
<affects>
|
|
<package>
|
|
<name>fetchmail</name>
|
|
<range><lt>6.3.6</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Matthias Andree reports:</p>
|
|
<blockquote cite="http://www.fetchmail.info/fetchmail-SA-2006-02.txt">
|
|
<p>Fetchmail has had several longstanding password disclosure
|
|
vulnerabilities.</p>
|
|
<ul>
|
|
<li>sslcertck/sslfingerprint options should have implied
|
|
"sslproto tls1" in order to enforce TLS negotiation,
|
|
but did not.</li>
|
|
<li>Even with "sslproto tls1" in the config, fetches
|
|
would go ahead in plain text if STLS/STARTTLS wasn't available
|
|
(not advertised, or advertised but rejected).</li>
|
|
<li>POP3 fetches could completely ignore all TLS options
|
|
whether available or not because it didn't reliably issue
|
|
CAPA before checking for STLS support - but CAPA is a
|
|
requisite for STLS. Whether or not CAPAbilities were probed,
|
|
depended on the "auth" option. (Fetchmail only
|
|
tried CAPA if the auth option was not set at all, was set
|
|
to gssapi, kerberos, kerberos_v4, otp, or cram-md5.)</li>
|
|
<li>POP3 could fall back to using plain text passwords, even
|
|
if strong authentication had been configured.</li>
|
|
<li>POP2 would not complain if strong authentication or TLS
|
|
had been requested.</li>
|
|
</ul>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2006-5867</cvename>
|
|
<url>http://www.fetchmail.info/fetchmail-SA-2006-02.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-01-04</discovery>
|
|
<entry>2007-01-06</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="78ad2525-9d0c-11db-a5f6-000c6ec775d9">
|
|
<topic>opera -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>opera</name>
|
|
<name>opera-devel</name>
|
|
<name>linux-opera</name>
|
|
<range><lt>9.10</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>iDefense reports:</p>
|
|
<blockquote cite="http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=457">
|
|
<p>The vulnerability specifically exists due to Opera
|
|
improperly processing a JPEG DHT marker. The DHT marker is
|
|
used to define a Huffman Table which is used for decoding
|
|
the image data. An invalid number of index bytes in the
|
|
DHT marker will trigger a heap overflow with partially
|
|
user controlled data.</p>
|
|
<p>Exploitation of this vulnerability would allow an
|
|
attacker to execute arbitrary code on the affected
|
|
host. The attacker would first need to construct a website
|
|
containing the malicious image and trick the vulnerable
|
|
user into visiting the site. This would trigger the
|
|
vulnerability and allow the code to execute with the
|
|
privileges of the local user.</p>
|
|
</blockquote>
|
|
<blockquote cite="http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=458">
|
|
<p>A flaw exists within Opera's Javascript SVG
|
|
implementation. When processing a
|
|
createSVGTransformFromMatrix request Opera does not
|
|
properly validate the type of object passed to the
|
|
function. Passing an incorrect object to this function can
|
|
result in it using a pointer that is user controlled when
|
|
it attempts to make the virtual function call.</p>
|
|
<p>Exploitation of this vulnerability would allow an
|
|
attacker to execute arbitrary code on the affected
|
|
host. The attacker would first need to construct a website
|
|
containing the malicious JavaScript and trick the
|
|
vulnerable user into visiting the site. This would trigger
|
|
the vulnerability and allow the code to execute with the
|
|
privileges of the local user.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2007-0126</cvename>
|
|
<cvename>CVE-2007-0127</cvename>
|
|
<url>http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=457</url>
|
|
<url>http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=458</url>
|
|
<url>http://www.opera.com/support/search/supsearch.dml?index=851</url>
|
|
<url>http://www.opera.com/support/search/supsearch.dml?index=852</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-01-05</discovery>
|
|
<entry>2007-01-05</entry>
|
|
<modified>2010-05-12</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="3d8d3548-9d02-11db-a541-000ae42e9b93">
|
|
<topic>drupal -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>drupal</name>
|
|
<range><gt>4.7</gt><lt>4.7.5</lt></range>
|
|
<range><lt>4.6.11</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Drupal security team reports:</p>
|
|
<blockquote cite="http://drupal.org/files/sa-2007-001/advisory.txt">
|
|
<p>A few arguments passed via URLs are not properly sanitized
|
|
before display. When an attacker is able to entice an
|
|
administrator to follow a specially crafted link, arbitrary
|
|
HTML and script code can be injected and executed in the
|
|
victim's session. Such an attack may lead to administrator
|
|
access if certain conditions are met.</p>
|
|
</blockquote>
|
|
<blockquote cite="http://drupal.org/files/sa-2007-002/advisory.txt">
|
|
<p>The way page caching was implemented allows a denial of
|
|
service attack. An attacker has to have the ability to post
|
|
content on the site. He or she would then be able to poison
|
|
the page cache, so that it returns cached 404 page not found
|
|
errors for existing pages.</p>
|
|
<p>If the page cache is not enabled, your site is not vulnerable.
|
|
The vulnerability only affects sites running on top of MySQL.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2007-0136</cvename>
|
|
<url>http://drupal.org/files/sa-2007-001/advisory.txt</url>
|
|
<url>http://drupal.org/files/sa-2007-002/advisory.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2007-01-05</discovery>
|
|
<entry>2007-01-05</entry>
|
|
<modified>2010-05-12</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="9347d82d-9a66-11db-b271-000e35248ad7">
|
|
<topic>w3m -- format string vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>w3m</name>
|
|
<name>w3m-img</name>
|
|
<name>w3m-m17n</name>
|
|
<name>w3m-m17n-img</name>
|
|
<name>ja-w3m</name>
|
|
<name>ja-w3m-img</name>
|
|
<range><lt>0.5.1_6</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>An anonymous person reports:</p>
|
|
<blockquote cite="http://sourceforge.net/tracker/index.php?func=detail&aid=1612792&group_id=39518&atid=425439">
|
|
<p>w3m-0.5.1 crashes when using the -dump or -backend options to
|
|
open a HTTPS URL with a SSL certificate where the CN contains
|
|
"%n%n%n%n%n%n".</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>21735</bid>
|
|
<cvename>CVE-2006-6772</cvename>
|
|
<url>http://sourceforge.net/tracker/index.php?func=detail&aid=1612792&group_id=39518&atid=425439</url>
|
|
<url>http://secunia.com/advisories/23492/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-12-10</discovery>
|
|
<entry>2007-01-03</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="f4ff7434-9505-11db-9ddc-0011098b2f36">
|
|
<topic>plone -- user can masquerade as a group</topic>
|
|
<affects>
|
|
<package>
|
|
<name>plone</name>
|
|
<range><gt>2.5</gt><lt>2.5.1_1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Plone.org reports:</p>
|
|
<blockquote cite="http://plone.org/products/plone-hotfix/releases/20061031">
|
|
<p>PlonePAS-using Plone releases (Plone 2.5 and Plone 2.5.1) has a
|
|
potential vulnerability that allows a user to masquerade as a group.
|
|
Please update your sites.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>21460</bid>
|
|
<cvename>CVE-2006-4249</cvename>
|
|
<url>http://plone.org/products/plone-hotfix/releases/20061031</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-11-02</discovery>
|
|
<entry>2006-12-27</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="3f851b22-89fb-11db-a937-003048116330">
|
|
<topic>proftpd -- remote code execution vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>proftpd</name>
|
|
<name>proftpd-mysql</name>
|
|
<range><lt>1.3.0_5</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The proftpd development team reports that several
|
|
remote buffer overflows had been found in the
|
|
proftpd server.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2006-5815</cvename>
|
|
<cvename>CVE-2006-6170</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-11-10</discovery>
|
|
<entry>2006-12-21</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="11a84092-8f9f-11db-ab33-000e0c2e438a">
|
|
<topic>gzip -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<system>
|
|
<name>FreeBSD</name>
|
|
<range><gt>6.1</gt><lt>6.1_7</lt></range>
|
|
<range><gt>6.0</gt><lt>6.0_12</lt></range>
|
|
<range><gt>5.5</gt><lt>5.5_5</lt></range>
|
|
<range><gt>5.4</gt><lt>5.4_19</lt></range>
|
|
<range><gt>5.3</gt><lt>5.3_34</lt></range>
|
|
<range><lt>4.11_22</lt></range>
|
|
</system>
|
|
<package>
|
|
<name>gzip</name>
|
|
<range><lt>1.3.12</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<h1>Problem Description</h1>
|
|
<p>Multiple programming errors have been found in gzip which
|
|
can be triggered when gzip is decompressing files. These
|
|
errors include insufficient bounds checks in buffer use, a
|
|
NULL pointer dereference, and a potential infinite loop.</p>
|
|
<h1>Impact</h1>
|
|
<p>The insufficient bounds checks in buffer use can cause gzip
|
|
to crash, and may permit the execution of arbitrary code.
|
|
The NULL pointer deference can cause gzip to crash. The
|
|
infinite loop can cause a Denial-of-Service situation where
|
|
gzip uses all available CPU time.</p>
|
|
<h1>Workaround</h1>
|
|
<p>No workaround is available.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2006-4334</cvename>
|
|
<cvename>CVE-2006-4335</cvename>
|
|
<cvename>CVE-2006-4336</cvename>
|
|
<cvename>CVE-2006-4337</cvename>
|
|
<cvename>CVE-2006-4338</cvename>
|
|
<freebsdsa>SA-06:21.gzip</freebsdsa>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-09-19</discovery>
|
|
<entry>2006-12-19</entry>
|
|
<modified>2007-06-05</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="ef3306fc-8f9b-11db-ab33-000e0c2e438a">
|
|
<topic>bind9 -- Denial of Service in named(8)</topic>
|
|
<affects>
|
|
<system>
|
|
<name>FreeBSD</name>
|
|
<range><gt>6.1</gt><lt>6.1_6</lt></range>
|
|
<range><gt>6.0</gt><lt>6.0_11</lt></range>
|
|
<range><gt>5.5</gt><lt>5.5_4</lt></range>
|
|
<range><gt>5.4</gt><lt>5.4_18</lt></range>
|
|
<range><gt>5.0</gt><lt>5.3_33</lt></range>
|
|
</system>
|
|
<package>
|
|
<name>bind9</name>
|
|
<range><gt>9.0</gt><lt>9.3.2.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<h1>Problem Description</h1>
|
|
<p>For a recursive DNS server, a remote attacker sending enough
|
|
recursive queries for the replies to arrive after all the
|
|
interested clients have left the recursion queue will trigger
|
|
an INSIST failure in the named(8) daemon. Also for a
|
|
recursive DNS server, an assertion failure can occur when
|
|
processing a query whose reply will contain more than one
|
|
SIG(covered) RRset.</p>
|
|
<p>For an authoritative DNS server serving a RFC 2535 DNSSEC
|
|
zone which is queried for the SIG records where there are
|
|
multiple SIG(covered) RRsets (e.g. a zone apex), named(8)
|
|
will trigger an assertion failure when it tries to construct
|
|
the response.</p>
|
|
<h1>Impact</h1>
|
|
<p>An attacker who can perform recursive lookups on a DNS server
|
|
and is able to send a sufficiently large number of recursive
|
|
queries, or is able to get the DNS server to return more than
|
|
one SIG(covered) RRsets can stop the functionality of the DNS
|
|
service.</p>
|
|
<p>An attacker querying an authoritative DNS server serving a
|
|
RFC 2535 DNSSEC zone may be able to crash the DNS server.</p>
|
|
<h1>Workaround</h1>
|
|
<p>A possible workaround is to only allow trusted clients to
|
|
perform recursive queries.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2006-4095</cvename>
|
|
<cvename>CVE-2006-4096</cvename>
|
|
<freebsdsa>SA-06:20.bind</freebsdsa>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-09-06</discovery>
|
|
<entry>2006-12-19</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="077c2dca-8f9a-11db-ab33-000e0c2e438a">
|
|
<topic>openssl -- Incorrect PKCS#1 v1.5 padding validation in crypto(3)</topic>
|
|
<affects>
|
|
<system>
|
|
<name>FreeBSD</name>
|
|
<range><gt>6.1</gt><lt>6.1_6</lt></range>
|
|
<range><gt>6.0</gt><lt>6.0_11</lt></range>
|
|
<range><gt>5.5</gt><lt>5.5_4</lt></range>
|
|
<range><gt>5.4</gt><lt>5.4_18</lt></range>
|
|
<range><gt>5.3</gt><lt>5.3_33</lt></range>
|
|
<range><lt>4.11_21</lt></range>
|
|
</system>
|
|
<package>
|
|
<name>openssl</name>
|
|
<range><gt>0.9.8</gt><lt>0.9.8c_9</lt></range>
|
|
<range><lt>0.9.7k_0</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<h1>Problem Description</h1>
|
|
<p>When verifying a PKCS#1 v1.5 signature, OpenSSL ignores any
|
|
bytes which follow the cryptographic hash being signed. In
|
|
a valid signature there will be no such bytes.</p>
|
|
<h1>Impact</h1>
|
|
<p>OpenSSL will incorrectly report some invalid signatures as
|
|
valid. When an RSA public exponent of 3 is used, or more
|
|
generally when a small public exponent is used with a
|
|
relatively large modulus (e.g., a public exponent of 17 with
|
|
a 4096-bit modulus), an attacker can construct a signature
|
|
which OpenSSL will accept as a valid PKCS#1 v1.5 signature.</p>
|
|
<h1>Workaround</h1>
|
|
<p>No workaround is available.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2006-4339</cvename>
|
|
<freebsdsa>SA-06:19.openssl</freebsdsa>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-09-06</discovery>
|
|
<entry>2006-12-19</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="0679deeb-8eaf-11db-abc9-0003476f14d3">
|
|
<topic>sql-ledger -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>sql-ledger</name>
|
|
<range><lt>2.6.22</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Debian security Team reports:</p>
|
|
<blockquote cite="http://www.us.debian.org/security/2006/dsa-1239">
|
|
<p>Several remote vulnerabilities have been discovered in SQL
|
|
Ledger, a web based double-entry accounting program, which may
|
|
lead to the execution of arbitrary code. The Common
|
|
Vulnerabilities and Exposures project identifies the following
|
|
problems:</p>
|
|
<p>Chris Travers discovered that the session management can be
|
|
tricked into hijacking existing sessions.</p>
|
|
<p>Chris Travers discovered that directory traversal
|
|
vulnerabilities can be exploited to execute arbitrary Perl
|
|
code.</p>
|
|
<p>It was discovered that missing input sanitising allows
|
|
execution of arbitrary Perl code.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2006-4244</cvename>
|
|
<cvename>CVE-2006-4731</cvename>
|
|
<cvename>CVE-2006-5872</cvename>
|
|
<url>http://www.us.debian.org/security/2006/dsa-1239</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-12-17</discovery>
|
|
<entry>2006-12-18</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="5b47b70d-8ba9-11db-81d5-00123ffe8333">
|
|
<topic>dbus -- match_rule_equal() Weakness</topic>
|
|
<affects>
|
|
<package>
|
|
<name>dbus</name>
|
|
<range><lt>1.0.2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/23373/">
|
|
<p>D-Bus have a weakness, which can be exploited by malicious, local
|
|
users to cause a DoS (Denial of Service).</p>
|
|
<p>An error within the "match_rule_equal()" function can be
|
|
exploited to disable the ability of other processes to receive
|
|
messages by removing their matches from D-Bus.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2006-6107</cvename>
|
|
<url>http://www.freedesktop.org/wiki/Software/dbus</url>
|
|
<url>https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=218055</url>
|
|
<url>http://secunia.com/advisories/23373/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-12-12</discovery>
|
|
<entry>2006-12-14</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="779a2d55-8ba8-11db-81d5-00123ffe8333">
|
|
<topic>evince -- Buffer Overflow Vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>evince</name>
|
|
<range><lt>0.6.1_1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/23111/">
|
|
<p>A vulnerability has been discovered in Evince, which can be
|
|
exploited by malicious people to compromise a user's system.</p>
|
|
<p>The vulnerability is caused due to a boundary error within the
|
|
"get_next_text()" function in ps/ps.c. This can be exploited to
|
|
cause a buffer overflow by e.g. tricking a user into opening a
|
|
specially crafted PostScript file.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2006-5864</cvename>
|
|
<url>http://secunia.com/advisories/23111/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-11-27</discovery>
|
|
<entry>2006-12-14</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="fefd93d8-8af5-11db-9d01-0016179b2dd5">
|
|
<topic>tdiary -- injection vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>ja-tdiary</name>
|
|
<name>tdiary</name>
|
|
<range><le>2.0.3</le></range>
|
|
</package>
|
|
<package>
|
|
<name>ja-tdiary-devel</name>
|
|
<name>tdiary-devel</name>
|
|
<range><gt>2.1</gt><lt>2.1.4_2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>An undisclosed eRuby injection vulnerability had been discovered in
|
|
tDiary.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://sourceforge.net/forum/forum.php?forum_id=642685</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-12-10</discovery>
|
|
<entry>2006-12-13</entry>
|
|
<modified>2007-03-16</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="d29dc506-8aa6-11db-bd0d-00123ffe8333">
|
|
<topic>wv -- Multiple Integer Overflow Vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>wv</name>
|
|
<range><lt>1.2.3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/22595/">
|
|
<p>Some vulnerabilities have been reported in wvWare, which can be
|
|
exploited by malicious people to cause a DoS (Denial of Service)
|
|
and potentially compromise an application using the library.</p>
|
|
<p>The vulnerabilities are caused due to integer overflows within
|
|
the "wvGetLFO_records()" and "wvGetLFO_PLF()" functions. These can
|
|
be exploited to cause heap-based buffer overflows by e.g. tricking
|
|
a user to open a specially crafted Microsoft Word document with an
|
|
application using the library.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2006-4513</cvename>
|
|
<url>http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=433</url>
|
|
<url>http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=434</url>
|
|
<url>http://secunia.com/advisories/22595/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-10-26</discovery>
|
|
<entry>2006-12-13</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="b9044cc2-8aa5-11db-bd0d-00123ffe8333">
|
|
<topic>wv2 -- Integer Overflow Vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>wv2</name>
|
|
<range><lt>0.2.3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/20665/">
|
|
<p>A vulnerability has been reported in wvWare wv2 Library, which
|
|
potentially can be exploited by malicious people to compromise an
|
|
application using the library.</p>
|
|
<p>The vulnerability is caused due to an integer overflow error in
|
|
"word_helper.h" when handling a Word document. This can be
|
|
exploited to cause a buffer overflow and may allow arbitrary code
|
|
execution via a specially crafted Word document.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2006-2197</cvename>
|
|
<url>http://secunia.com/advisories/20665/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-06-12</discovery>
|
|
<entry>2006-12-13</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="e969e6cb-8911-11db-9d01-0016179b2dd5">
|
|
<topic>tnftpd -- Remote root Exploit</topic>
|
|
<affects>
|
|
<package>
|
|
<name>tnftpd</name>
|
|
<range><lt>20040810</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The tnftpd port suffer from a remote stack overrun,
|
|
which can lead to a root compromise.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2006-6652</cvename>
|
|
<url>http://lists.grok.org.uk/pipermail/full-disclosure/2006-December/051009.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-12-1</discovery>
|
|
<entry>2006-12-11</entry>
|
|
<modified>2010-05-12</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="eb5124a4-8a20-11db-b033-00123ffe8333">
|
|
<topic>clamav -- Multipart Nestings Denial of Service</topic>
|
|
<affects>
|
|
<package>
|
|
<name>clamav</name>
|
|
<range><lt>0.88.7</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>clamav-devel</name>
|
|
<range><le>20061029</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/23347/">
|
|
<p>Clam AntiVirus have a vulnerability, which can be exploited by
|
|
malicious people to cause a DoS (Denial of Service).</p>
|
|
<p>The vulnerability is caused due to a stack overflow when scanning
|
|
messages with deeply nested multipart content. This can be
|
|
exploited to crash the service by sending specially crafted emails
|
|
to a vulnerable system.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2006-6481</cvename>
|
|
<url>http://secunia.com/advisories/23347/</url>
|
|
<url>http://www.quantenblog.net/security/virus-scanner-bypass</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-12-06</discovery>
|
|
<entry>2006-12-12</entry>
|
|
<modified>2013-06-19</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="1b043693-8617-11db-93b2-000e35248ad7">
|
|
<topic>libxine -- multiple buffer overflow vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>libxine</name>
|
|
<range><lt>1.1.3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The libxine development team reports that several
|
|
vulnerabilities had been found in the libxine library. The
|
|
first vulnerability is caused by improper checking of the
|
|
src/input/libreal/real.c "real_parse_sdp()" function.
|
|
A remote attacker could exploit this by tricking an user to
|
|
connect to a preparated server potentially causing a buffer
|
|
overflow. Another buffer overflow had been found in the
|
|
libmms library, potentially allowing a remote attacker to
|
|
cause a denial of service vulnerability, and possible remote
|
|
code execution through the following functions: send_command,
|
|
string_utf16, get_data and get_media_packets. Other functions
|
|
might be affected as well.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>18608</bid>
|
|
<bid>21435</bid>
|
|
<cvename>CVE-2006-2200</cvename>
|
|
<cvename>CVE-2006-6172</cvename>
|
|
<url>http://sourceforge.net/project/shownotes.php?release_id=468432</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-05-04</discovery>
|
|
<entry>2006-12-07</entry>
|
|
<modified>2006-12-09</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="4db1669c-8589-11db-ac4f-02e081235dab">
|
|
<topic>gnupg -- remotely controllable function pointer</topic>
|
|
<affects>
|
|
<package>
|
|
<name>gnupg</name>
|
|
<range><lt>1.4.6</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Werner Koch reports:</p>
|
|
<blockquote cite="http://lists.gnupg.org/pipermail/gnupg-announce/2006q4/000491.html">
|
|
<p>GnuPG uses data structures called filters to process
|
|
OpenPGP messages. These filters are used in a similar
|
|
way as a pipelines in the shell. For communication
|
|
between these filters context structures are used. These
|
|
are usually allocated on the stack and passed to the
|
|
filter functions. At most places the OpenPGP data stream
|
|
fed into these filters is closed before the context
|
|
structure gets deallocated. While decrypting encrypted
|
|
packets, this may not happen in all cases and the filter
|
|
may use a void contest structure filled with garbage. An
|
|
attacker may control this garbage. The filter context
|
|
includes another context used by the low-level decryption
|
|
to access the decryption algorithm. This is done using a
|
|
function pointer. By carefully crafting an OpenPGP
|
|
message, an attacker may control this function pointer and
|
|
call an arbitrary function of the process. Obviously an
|
|
exploit needs to prepared for a specific version,
|
|
compiler, libc, etc to be successful - but it is
|
|
definitely doable.</p>
|
|
<p>Fixing this is obvious: We need to allocate the context on
|
|
the heap and use a reference count to keep it valid as
|
|
long as either the controlling code or the filter code
|
|
needs it.</p>
|
|
<p>We have checked all other usages of such a stack based
|
|
filter contexts but fortunately found no other vulnerable
|
|
places. This allows to release a relatively small patch.
|
|
However, for reasons of code cleanness and easier audits
|
|
we will soon start to change all these stack based filter
|
|
contexts to heap based ones.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2006-6235</cvename>
|
|
<url>http://lists.gnupg.org/pipermail/gnupg-announce/2006q4/000246.html</url>
|
|
<url>http://secunia.com/advisories/23245/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-12-04</discovery>
|
|
<entry>2006-12-07</entry>
|
|
<modified>2006-12-15</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="a8674c14-83d7-11db-88d5-0012f06707f0">
|
|
<topic>ruby -- cgi.rb library Denial of Service</topic>
|
|
<affects>
|
|
<package>
|
|
<name>ruby</name>
|
|
<name>ruby+pthreads</name>
|
|
<name>ruby+pthreads+oniguruma</name>
|
|
<name>ruby+oniguruma</name>
|
|
<range><ge>1.8.*,1</ge><lt>1.8.5_5,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>ruby_static</name>
|
|
<range><ge>1.8.*,1</ge></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The official ruby site reports:</p>
|
|
<blockquote cite="http://www.ruby-lang.org/en/news/2006/12/04/another-dos-vulnerability-in-cgi-library/">
|
|
<p>Another vulnerability has been discovered in the CGI library
|
|
(cgi.rb) that ships with Ruby which could be used by a malicious
|
|
user to create a denial of service attack (DoS).</p>
|
|
<p>A specific HTTP request for any web application using cgi.rb
|
|
causes CPU consumption on the machine on which the web application
|
|
is running. Many such requests result in a denial of service.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2006-6303</cvename>
|
|
<url>http://www.ruby-lang.org/en/news/2006/12/04/another-dos-vulnerability-in-cgi-library/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-12-04</discovery>
|
|
<entry>2006-12-04</entry>
|
|
<modified>2010-05-12</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="ed124f8c-82a2-11db-b46b-0012f06707f0">
|
|
<topic>libmusicbrainz -- multiple buffer overflow vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>libmusicbrainz</name>
|
|
<range><lt>2.1.3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>SecurityFocus reports about libmusicbrainz:</p>
|
|
<blockquote cite="http://www.securityfocus.com/bid/19508/discuss">
|
|
<p>The libmusicbrainz library is prone to multiple buffer-overflow
|
|
vulnerabilities because the application fails to check the size of
|
|
the data before copying it into a finite-sized internal memory
|
|
buffer.</p>
|
|
<p>An attacker can exploit these issues to execute arbitrary code
|
|
within the context of the application or to cause a
|
|
denial-of-service condition.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>19508</bid>
|
|
<cvename>CVE-2006-4197</cvename>
|
|
<url>http://www.securityfocus.com/bid/21185/discuss</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-08-17</discovery>
|
|
<entry>2006-12-02</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="666b8c9e-8212-11db-851e-0016179b2dd5">
|
|
<topic>tdiary -- cross site scripting vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>ja-tdiary</name>
|
|
<name>tdiary</name>
|
|
<range><le>2.0.2</le></range>
|
|
</package>
|
|
<package>
|
|
<name>ja-tdiary-devel</name>
|
|
<name>tdiary-devel</name>
|
|
<range><gt>2.1</gt><lt>2.1.4_1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>tDiary was vulnerable to an unspecified Cross-Site
|
|
Scripting vulnerability</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2006-6174</cvename>
|
|
<url>http://sourceforge.net/forum/forum.php?forum_id=638868</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-11-26</discovery>
|
|
<entry>2006-12-02</entry>
|
|
<modified>2010-05-12</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="18e3a5be-81f9-11db-95a2-0012f06707f0">
|
|
<topic>ImageMagick -- SGI Image File heap overflow vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>ImageMagick</name>
|
|
<name>ImageMagick-nox11</name>
|
|
<range><ge>6.0.0</ge><lt>6.2.9</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>SecurityFocus reports about ImageMagick:</p>
|
|
<blockquote cite="http://www.securityfocus.com/bid/21185/info">
|
|
<p>ImageMagick is prone to a remote heap-based buffer-overflow
|
|
vulnerability because the application fails to properly
|
|
bounds-check user-supplied input before copying it to an
|
|
insufficiently sized memory buffer.</p>
|
|
<p>Exploiting this issue allows attackers to execute arbitrary
|
|
machine code in the context of applications that use the
|
|
ImageMagick library.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>21185</bid>
|
|
<cvename>CVE-2006-5868</cvename>
|
|
<url>http://www.securityfocus.com/bid/21185/discuss</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-11-14</discovery>
|
|
<entry>2006-12-02</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="3dd7eb58-80ae-11db-b4ec-000854d03344">
|
|
<topic>gtar -- GNUTYPE_NAMES directory traversal vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>gtar</name>
|
|
<range><lt>1.16_2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Teemu Salmela reports:</p>
|
|
<blockquote cite="http://archives.neohapsis.com/archives/fulldisclosure/2006-11/0344.html">
|
|
<p>There is a tar record type, called GNUTYPE_NAMES (an
|
|
obsolete GNU extension), that allows the creation of
|
|
symbolic links pointing to arbitrary locations in the
|
|
filesystem, which makes it possible to create/overwrite
|
|
arbitrary files.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>21235</bid>
|
|
<cvename>CVE-2006-6097</cvename>
|
|
<url>http://archives.neohapsis.com/archives/fulldisclosure/2006-11/0344.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-11-21</discovery>
|
|
<entry>2006-11-30</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="a8af7d70-8007-11db-b280-0008743bf21a">
|
|
<topic>kronolith -- arbitrary local file inclusion vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>kronolith</name>
|
|
<range><lt>2.1.4</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>iDefense Labs reports:</p>
|
|
<blockquote cite="http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=445">
|
|
<p>Remote exploitation of a design error in Horde's Kronolith
|
|
could allow an authenticated web mail user to execute
|
|
arbitrary PHP code under the security context of the running
|
|
web server.</p>
|
|
<p>The vulnerability specifically exists due to a design error in the
|
|
way it includes certain files. Specifically, the 'lib/FBView.php'
|
|
file contains a function 'Kronolith_FreeBusy_View::factory' which
|
|
will include local files that are supplied via the 'view' HTTP GET
|
|
request parameter.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://lists.horde.org/archives/announce/2006/000307.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-11-29</discovery>
|
|
<entry>2006-11-30</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="34c93ae8-7e6f-11db-bf00-02e081235dab">
|
|
<topic>gnupg -- buffer overflow</topic>
|
|
<affects>
|
|
<package>
|
|
<name>gnupg</name>
|
|
<range><lt>1.4.5_1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Werner Koch reports:</p>
|
|
<blockquote cite="http://lists.gnupg.org/pipermail/gnupg-announce/2006q4/000241.html">
|
|
<p>When running GnuPG interactively, special crafted
|
|
messages may be used to crash gpg or gpg2. Running gpg in
|
|
batch mode, as done by all software using gpg as a backend
|
|
(e.g. mailers), is not affected by this bug.</p>
|
|
<p>Exploiting this overflow seems to be possible.</p>
|
|
<p>gpg-agent, gpgsm, gpgv or other tools from the GnuPG
|
|
suite are not affected.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://lists.gnupg.org/pipermail/gnupg-announce/2006q4/000241.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-11-27</discovery>
|
|
<entry>2006-11-27</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="cca97f5f-7435-11db-91de-0008743bf21a">
|
|
<topic>proftpd -- Remote Code Execution Vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>proftpd</name>
|
|
<name>proftpd-mysql</name>
|
|
<range><le>1.3.0_2</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>FrSIRT reports:</p>
|
|
<blockquote cite="http://www.frsirt.com/english/advisories/2006/4451">
|
|
<p>A vulnerability has been identified in ProFTPD, which could be
|
|
exploited by attackers to cause a denial of service or execute
|
|
arbitrary commands. This flaw is due to a buffer overflow error
|
|
in the "main.c" file where the "cmd_buf_size" size of the buffer
|
|
used to handle FTP commands sent by clients is not properly set
|
|
to the size configured via the "CommandBufferSize" directive,
|
|
which could be exploited by attackers to compromise a vulnerable
|
|
server via a specially crafted FTP command.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://www.frsirt.com/english/advisories/2006/4451</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-11-10</discovery>
|
|
<entry>2006-11-14</entry>
|
|
<modified>2006-11-15</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="5a945904-73b1-11db-91d2-0002a5c2f4ef">
|
|
<topic>unzoo -- Directory Traversal Vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>unzoo</name>
|
|
<range><lt>4.4_1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/12857/">
|
|
<p>Doubles has discovered a vulnerability in Unzoo, which
|
|
potentially can be exploited by malicious people to
|
|
compromise a user's system.</p>
|
|
<p>The vulnerability is caused due to an input validation error
|
|
when unpacking archives. This can be exploited via a
|
|
directory traversal attack to overwrite files outside the
|
|
directory, where the files are extracted to, if a user is
|
|
tricked into extracting a malicious archive using Unzoo.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>11417</bid>
|
|
<url>http://secunia.com/advisories/12857/</url>
|
|
<url>http://securitytracker.com/alerts/2004/Oct/1011673.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-10-18</discovery>
|
|
<entry>2006-11-14</entry>
|
|
<modified>2006-12-15</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="6d68618a-7199-11db-a2ad-000c6ec775d9">
|
|
<topic>bugzilla -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>bugzilla</name>
|
|
<name>ja-bugzilla</name>
|
|
<range><gt>2.*</gt><lt>2.22.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A Bugzilla Security Advisory reports:</p>
|
|
<blockquote cite="http://www.bugzilla.org/security/2.18.5/">
|
|
<ul>
|
|
<li>Sometimes the information put into the <h1> and
|
|
<h2> tags in Bugzilla was not properly escaped,
|
|
leading to a possible XSS vulnerability.</li>
|
|
<li>Bugzilla administrators were allowed to put raw,
|
|
unfiltered HTML into many fields in Bugzilla, leading to
|
|
a possible XSS vulnerability. Now, the HTML allowed in
|
|
those fields is limited.</li>
|
|
<li>attachment.cgi could leak the names of private
|
|
attachments</li>
|
|
<li>The "deadline" field was visible in the XML format of
|
|
a bug, even to users who were not a member of the
|
|
"timetrackinggroup."</li>
|
|
<li>A malicious user could pass a URL to an admin, and
|
|
make the admin delete or change something that he had
|
|
not intended to delete or change.</li>
|
|
<li>It is possible to inject arbitrary HTML into the
|
|
showdependencygraph.cgi page, allowing for a cross-site
|
|
scripting attack.</li>
|
|
</ul>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2006-5453</cvename>
|
|
<cvename>CVE-2006-5454</cvename>
|
|
<cvename>CVE-2006-5455</cvename>
|
|
<url>http://www.bugzilla.org/security/2.18.5/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-10-15</discovery>
|
|
<entry>2006-11-11</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="92442c4b-6f4a-11db-bd28-0012f06707f0">
|
|
<topic>Imlib2 -- multiple image file processing vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>imlib2</name>
|
|
<range><lt>20060926_1,1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/22732/">
|
|
<p>Some vulnerabilities have been reported in imlib2, which can be
|
|
exploited by malicious people to cause a DoS (Denial of Service)
|
|
or potentially compromise an application using the library.</p>
|
|
<p>The vulnerabilities are caused due to unspecified errors within
|
|
the processing of JPG, ARGB, PNG, LBM, PNM, TIFF, and TGA images.
|
|
This may be exploited to execute arbitrary code by e.g. tricking a
|
|
user into opening a specially crafted image file with an
|
|
application using imlib2.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>20903</bid>
|
|
<cvename>CVE-2006-4806</cvename>
|
|
<cvename>CVE-2006-4807</cvename>
|
|
<cvename>CVE-2006-4808</cvename>
|
|
<cvename>CVE-2006-4809</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-11-03</discovery>
|
|
<entry>2006-11-08</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="ab8dbe98-6be4-11db-ae91-0012f06707f0">
|
|
<topic>ruby -- cgi.rb library Denial of Service</topic>
|
|
<affects>
|
|
<package>
|
|
<name>ruby</name>
|
|
<name>ruby+pthreads</name>
|
|
<name>ruby+pthreads+oniguruma</name>
|
|
<name>ruby+oniguruma</name>
|
|
<range><ge>1.8.*,1</ge><lt>1.8.5_4,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>ruby_static</name>
|
|
<range><ge>1.8.*,1</ge></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Official ruby site reports:</p>
|
|
<blockquote cite="http://www.ruby-lang.org/en/news/2006/11/03/CVE-2006-5467/">
|
|
<p>A vulnerability has been discovered in the CGI library (cgi.rb)
|
|
that ships with Ruby which could be used by a malicious user to
|
|
create a denial of service attack (DoS). The problem is triggered
|
|
by sending the library an HTTP request that uses multipart MIME
|
|
encoding and as an invalid boundary specifier that begins with
|
|
"-" instead of "--". Once triggered it will
|
|
exhaust all available memory resources effectively creating a DoS
|
|
condition.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>20777</bid>
|
|
<cvename>CVE-2006-5467</cvename>
|
|
<url>http://rubyforge.org/pipermail/mongrel-users/2006-October/001946.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-10-25</discovery>
|
|
<entry>2006-11-04</entry>
|
|
<modified>2006-12-15</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="b318dc8c-6756-11db-83c3-000c6ec775d9">
|
|
<topic>screen -- combined UTF-8 characters vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>screen</name>
|
|
<range><lt>4.0.3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A vulnerability in the handling of combined UTF-8
|
|
characters in screen may allow an user-assisted attacker to
|
|
crash screen or potentially allow code execution as the user
|
|
running screen. To exploit this issue the user running
|
|
scren must in some way interact with the attacker.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>20727</bid>
|
|
<cvename>CVE-2006-4573</cvename>
|
|
<mlist>http://lists.gnu.org/archive/html/screen-users/2006-10/msg00028.html</mlist>
|
|
<url>https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=212056</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-10-23</discovery>
|
|
<entry>2006-10-29</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="a9c51caf-6603-11db-ab90-000e35fd8194">
|
|
<topic>mysql -- database suid privilege escalation</topic>
|
|
<affects>
|
|
<package>
|
|
<name>mysql-server</name>
|
|
<range><ge>5.1</ge><lt>5.1.12</lt></range>
|
|
<range><ge>5.0</ge><lt>5.0.25</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Dmitri Lenev reports a privilege escalation in
|
|
MySQL. MySQL evaluates arguments of suid routines in the
|
|
security context of the routine's definer instead of the
|
|
routine's caller, which allows remote and local
|
|
authenticated users to gain privileges through a routine
|
|
that has been made available using GRANT EXECUTE.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2006-4227</cvename>
|
|
<url>http://bugs.mysql.com/bug.php?id=18630</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-03-29</discovery>
|
|
<entry>2006-10-29</entry>
|
|
<modified>2006-10-30</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="a0e92718-6603-11db-ab90-000e35fd8194">
|
|
<topic>mysql -- database "case-sensitive" privilege escalation</topic>
|
|
<affects>
|
|
<package>
|
|
<name>mysql-server</name>
|
|
<range><ge>5.1</ge><lt>5.1.12</lt></range>
|
|
<range><ge>5.0</ge><lt>5.0.25</lt></range>
|
|
<range><lt>4.1.21</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Michal Prokopiuk reports a privilege escalation in MySQL.
|
|
The vulnerability causes MySQL, when run on case-sensitive
|
|
filesystems, to allow remote and local authenticated users
|
|
to create or access a database when the database name
|
|
differs only in case from a database for which they have
|
|
permissions.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>19559</bid>
|
|
<cvename>CVE-2006-4226</cvename>
|
|
<url>http://bugs.mysql.com/bug.php?id=17647</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-08-09</discovery>
|
|
<entry>2006-10-29</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="96ed277b-60e0-11db-ad2d-0016179b2dd5">
|
|
<topic>Serendipity -- XSS Vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>serendipity</name>
|
|
<range><lt>1.0.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Serendipity Team reports:</p>
|
|
<blockquote cite="http://blog.s9y.org/archives/147-Serendipity-1.0.2-and-1.1-beta5-released.html">
|
|
<p>Serendipity failed to correctly sanitize user input on the
|
|
media manager administration page. The content of GET variables
|
|
were written into JavaScript strings. By using standard string
|
|
evasion techniques it was possible to execute arbitrary
|
|
JavaScript.</p>
|
|
<p>Additionally Serendipity dynamically created a HTML form on
|
|
the media manager administration page that contained all
|
|
variables found in the URL as hidden fields. While the variable
|
|
values were correctly escaped it was possible to break out
|
|
by specifying strange variable names.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://www.hardened-php.net/advisory_112006.136.htmlSerendipity</url>
|
|
<url>http://secunia.com/advisories/22501/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-10-19</discovery>
|
|
<entry>2006-10-21</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="d8fbf13a-6215-11db-a59e-0211d85f11fb">
|
|
<topic>kdelibs -- integer overflow in khtml</topic>
|
|
<affects>
|
|
<package>
|
|
<name>kdelibs</name>
|
|
<name>kdelibs-nocups</name>
|
|
<range><lt>3.5.4_4</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>qt</name>
|
|
<name>qt-copy</name>
|
|
<range><lt>3.3.6_3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Red Hat reports:</p>
|
|
<blockquote cite="http://rhn.redhat.com/errata/RHSA-2006-0720.html">
|
|
<p>An integer overflow flaw was found in the way Qt handled pixmap
|
|
images. The KDE khtml library uses Qt in such a way that untrusted
|
|
parameters could be passed to Qt, triggering the overflow.
|
|
An attacker could for example create a malicious web page that when
|
|
viewed by a victim in the Konqueror browser would cause Konqueror
|
|
to crash or possibly execute arbitrary code with the privileges of
|
|
the victim.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2006-4811</cvename>
|
|
<url>http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=210742</url>
|
|
<url>http://rhn.redhat.com/errata/RHSA-2006-0720.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-10-14</discovery>
|
|
<entry>2006-10-22</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="4867ae85-608d-11db-8faf-000c6ec775d9">
|
|
<topic>opera -- URL parsing heap overflow vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>opera</name>
|
|
<name>opera-devel</name>
|
|
<name>linux-opera</name>
|
|
<range><gt>9.*</gt><lt>9.02</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>iDefense Labs reports:</p>
|
|
<blockquote cite="http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=424">
|
|
<p>Remote exploitation of a heap overflow vulnerability
|
|
within version 9 of Opera Software's Opera Web browser
|
|
could allow an attacker to execute arbitrary code on the
|
|
affected host.</p>
|
|
<p>A flaw exists within Opera when parsing a tag that
|
|
contains a URL. A heap buffer with a constant size of 256
|
|
bytes is allocated to store the URL, and the tag's URL is
|
|
copied into this buffer without sufficient bounds checking
|
|
of its length.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2006-4819</cvename>
|
|
<url>http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=424</url>
|
|
<url>http://secunia.com/advisories/22218/</url>
|
|
<url>http://www.opera.com/support/search/supsearch.dml?index=848</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-10-17</discovery>
|
|
<entry>2006-10-20</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="1c0def84-5fb1-11db-b2e9-0008c79fa3d2">
|
|
<topic>asterisk -- remote heap overwrite vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>asterisk</name>
|
|
<name>asterisk-bristuff</name>
|
|
<range><lt>1.2.13</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Adam Boileau of Security-Assessment.com reports:</p>
|
|
<blockquote cite="http://www.security-assessment.com/files/advisories/Asterisk_remote_heap_overflow.pdf">
|
|
<p>The Asterisk Skinny channel driver for Cisco SCCP phones
|
|
(chan_skinny.so) incorrectly validates a length value in
|
|
the packet header. An integer wrap-around leads to heap
|
|
overwrite, and arbitrary remote code execution as root.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://www.security-assessment.com/files/advisories/Asterisk_remote_heap_overflow.pdf</url>
|
|
<mlist msgid="4536A2F2.2020902@security-assessment.com">http://marc.theaimsgroup.com/?l=bugtraq&m=116121567530170</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-10-17</discovery>
|
|
<entry>2006-10-20</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="b6c18956-5fa3-11db-ad2d-0016179b2dd5">
|
|
<topic>plone -- unprotected MembershipTool methods</topic>
|
|
<affects>
|
|
<package>
|
|
<name>plone</name>
|
|
<range><lt>2.1.2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Plone Team reports:</p>
|
|
<blockquote cite="http://dev.plone.org/plone/ticket/5432">
|
|
<p>Plone 2.0.5, 2.1.2, and 2.5-beta1 does not restrict
|
|
access to the:</p>
|
|
<ul>
|
|
<li>changeMemberPortrait</li>
|
|
<li>deletePersonalPortrait</li>
|
|
<li>testCurrentPassword</li>
|
|
</ul>
|
|
<p>methods, which allows remote attackers to modify portraits.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2006-1711</cvename>
|
|
<url>http://plone.org/products/plone/releases/2.1.4</url>
|
|
<url>https://svn.plone.org/svn/plone/PloneHotfix20060410/trunk/README.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-10-19</discovery>
|
|
<entry>2006-10-19</entry>
|
|
<modified>2006-10-20</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="19207592-5f17-11db-ae08-0008743bf21a">
|
|
<topic>drupal -- HTML attribute injection</topic>
|
|
<affects>
|
|
<package>
|
|
<name>drupal</name>
|
|
<range><lt>4.6.10</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Drupal Team reports:</p>
|
|
<blockquote cite="http://drupal.org/files/sa-2006-026/advisory.txt">
|
|
<p>A malicious user may entice users to visit a specially
|
|
crafted URL that may result in the redirection of Drupal
|
|
form submission to a third-party site. A user visiting the
|
|
user registration page via such a url, for example, will
|
|
submit all data, such as his/her e-mail address, but also
|
|
possible private profile data, to a third-party site.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://drupal.org/files/sa-2006-026/advisory.txt</url>
|
|
<url>http://drupal.org/drupal-4.7.4</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-10-18</discovery>
|
|
<entry>2006-10-18</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="937d5911-5f16-11db-ae08-0008743bf21a">
|
|
<topic>drupal -- cross site request forgeries</topic>
|
|
<affects>
|
|
<package>
|
|
<name>drupal</name>
|
|
<range><lt>4.6.10</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Drupal Team reports:</p>
|
|
<blockquote cite="http://drupal.org/files/sa-2006-025/advisory.txt">
|
|
<p>Visiting a specially crafted page, anywhere on the web, may
|
|
allow that page to post forms to a Drupal site in the
|
|
context of the visitor's session. To illustrate; suppose
|
|
one has an active user 1 session, the most powerful
|
|
administrator account for a site, to a Drupal site while
|
|
visiting a website created by an attacker. This website
|
|
will now be able to submit any form to the Drupal site with
|
|
the privileges of user 1, either by enticing the user to
|
|
submit a form or by automated means.</p>
|
|
<p>An attacker can exploit this vulnerability by changing
|
|
passwords, posting PHP code or creating new users, for
|
|
example. The attack is only limited by the privileges of
|
|
the session it executes in.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://drupal.org/files/sa-2006-025/advisory.txt</url>
|
|
<url>http://drupal.org/drupal-4.7.4</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-10-18</discovery>
|
|
<entry>2006-10-18</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="b2383758-5f15-11db-ae08-0008743bf21a">
|
|
<topic>drupal -- multiple XSS vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>drupal</name>
|
|
<range><lt>4.6.10</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Drupal Team reports:</p>
|
|
<blockquote cite="http://drupal.org/files/sa-2006-024/advisory.txt">
|
|
<p>A bug in input validation and lack of output validation
|
|
allows HTML and script insertion on several pages.</p>
|
|
<p>Drupal's XML parser passes unescaped data to watchdog
|
|
under certain circumstances. A malicious user may execute
|
|
an XSS attack via a specially crafted RSS feed. This
|
|
vulnerability exists on systems that do not use PHP's
|
|
mb_string extension (to check if mb_string is being used,
|
|
navigate to admin/settings and look under "String
|
|
handling"). Disabling the aggregator module provides an
|
|
immediate workaround.</p>
|
|
<p>The aggregator module, profile module, and forum module do
|
|
not properly escape output of certain fields.</p>
|
|
<p>Note: XSS attacks may lead to administrator access if
|
|
certain conditions are met.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://drupal.org/files/sa-2006-024/advisory.txt</url>
|
|
<url>http://drupal.org/drupal-4.7.4</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-10-18</discovery>
|
|
<entry>2006-10-18</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="18a14baa-5ee5-11db-ae08-0008743bf21a">
|
|
<topic>ingo -- local arbitrary shell command execution</topic>
|
|
<affects>
|
|
<package>
|
|
<name>ingo</name>
|
|
<range><lt>1.1.2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Horde team reports a vulnerability within Ingo, the
|
|
filter management suite. The vulnerability is caused due to
|
|
inadequete escaping, possibly allowing a local user to execute
|
|
arbitrary shell commands via procmail.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2006-5449</cvename>
|
|
<url>http://bugs.horde.org/ticket/?id=4513</url>
|
|
<url>http://cvs.horde.org/diff.php/ingo/docs/CHANGES?r1=1.55.2.49&r2=1.55.2.59&ty=h</url>
|
|
<url>http://lists.horde.org/archives/announce/2006/000296.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-10-18</discovery>
|
|
<entry>2006-10-18</entry>
|
|
<modified>2010-05-12</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="a6d9da4a-5d5e-11db-8faf-000c6ec775d9">
|
|
<topic>nvidia-driver -- arbitrary root code execution vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>nvidia-driver</name>
|
|
<range><ge>1.0.8762</ge><lt>1.0.8776</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Rapid7 reports:</p>
|
|
<blockquote cite="http://www.rapid7.com/advisories/R7-0025.jsp">
|
|
<p>The NVIDIA Binary Graphics Driver for Linux is vulnerable
|
|
to a buffer overflow that allows an attacker to run
|
|
arbitrary code as root. This bug can be exploited both
|
|
locally or remotely (via a remote X client or an X client
|
|
which visits a malicious web page). A working
|
|
proof-of-concept root exploit is included with this
|
|
advisory.</p>
|
|
<p>The NVIDIA drivers for Solaris and FreeBSD are also
|
|
likely to be vulnerable.</p>
|
|
</blockquote>
|
|
<p>Disabling Render acceleration in the "nvidia" driver, via
|
|
the "RenderAccel" X configuration option, can be used as a
|
|
workaround for this issue.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<certvu>147252</certvu>
|
|
<cvename>CVE-2006-5379</cvename>
|
|
<url>http://nvidia.custhelp.com/cgi-bin/nvidia.cfg/php/enduser/std_adp.php?p_faqid=1971</url>
|
|
<url>http://secunia.com/advisories/22419/</url>
|
|
<url>http://www.rapid7.com/advisories/R7-0025.jsp</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-10-16</discovery>
|
|
<entry>2006-10-16</entry>
|
|
<modified>2006-10-21</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="8012a79d-5d21-11db-bb8d-00123ffe8333">
|
|
<topic>clamav -- CHM unpacker and PE rebuilding vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>clamav</name>
|
|
<range><lt>0.88.5</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>clamav-devel</name>
|
|
<range><le>20060922</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/22370/">
|
|
<p>Two vulnerabilities have been reported in Clam AntiVirus, which
|
|
potentially can be exploited by malicious people to cause a DoS
|
|
(Denial of Service) or compromise a vulnerable system.</p>
|
|
<p>1) An unspecified error in the CHM unpacker in chmunpack.c can be
|
|
exploited to cause a DoS.</p>
|
|
<p>2) An unspecified error in rebuildpe.c when rebuilding PE files
|
|
after unpacking can be exploited to cause a heap-based buffer
|
|
overflow.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://secunia.com/advisories/22370/</url>
|
|
<url>http://lurker.clamav.net/message/20061016.015114.dc6a8930.en.html</url>
|
|
<url>http://sourceforge.net/project/shownotes.php?release_id=455799</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-10-15</discovery>
|
|
<entry>2006-10-16</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="93ba13f8-5c41-11db-a5ae-00508d6a62df">
|
|
<topic>tkdiff -- temporary file symlink privilege escalation</topic>
|
|
<affects>
|
|
<package>
|
|
<name>tkdiff</name>
|
|
<range><lt>4.1.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Javier Fernández-Sanguino Peña reports a vulnerability in
|
|
tkdiff which allows local users to gain priveleges of the
|
|
user running tkdiff due to insecure temporary file creation.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://www.debian.org/security/2005/dsa-927</url>
|
|
<cvename>CVE-2005-3343</cvename>
|
|
<bid>16064</bid>
|
|
<url>http://secunia.com/advisories/18083</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-12-20</discovery>
|
|
<entry>2006-10-15</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="2c8a84d9-5bee-11db-a5ae-00508d6a62df">
|
|
<topic>vtiger -- multiple remote file inclusion vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>vtiger</name>
|
|
<range><lt>5.0</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Dedi Dwianto a.k.a the_day reports:</p>
|
|
<blockquote cite="http://www.milw0rm.com/exploits/2508">
|
|
<p>Input passed to the "$calpath" parameter in update.php is
|
|
not properly verified before being used. This can be
|
|
exploited to execute arbitrary PHP code by including files
|
|
from local or external resources.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2006-5289</cvename>
|
|
<bid>20435</bid>
|
|
<mlist msgid="20061009094328.15530.qmail@securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&m=116049557032343</mlist>
|
|
<url>http://advisories.echo.or.id/adv/adv54-theday-2006.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-10-09</discovery>
|
|
<entry>2006-10-15</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="5c9a2769-5ade-11db-a5ae-00508d6a62df">
|
|
<topic>google-earth -- heap overflow in the KML engine</topic>
|
|
<affects>
|
|
<package>
|
|
<name>google-earth</name>
|
|
<range><lt>4.0.2414</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>JAAScois reports:</p>
|
|
<p>While processing KML/KMZ data Google Earth fails to verify
|
|
its size prior to copying it into a fixed-sized buffer.
|
|
This can be exploited as a buffer-overflow vulnerability to
|
|
cause the application to crash and/or to execute arbitrary
|
|
code.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>20464</bid>
|
|
<url>http://www.jaascois.com/exploits/18602024/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-10-10</discovery>
|
|
<entry>2006-10-14</entry>
|
|
<modified>2007-04-13</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="72f21372-55e4-11db-a5ae-00508d6a62df">
|
|
<topic>torrentflux -- User-Agent XSS Vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>torrentflux</name>
|
|
<range><ge>0</ge></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<blockquote cite="http://www.stevenroddis.com.au/2006/10/06/torrentflux-user-agent-xss-vulnerability/">
|
|
<p>Steven Roddis reports that User-Agent string is not
|
|
properly escaped when handled by torrentflux. This allows
|
|
for arbitrary code insertion.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>20371</bid>
|
|
<cvename>CVE-2006-5227</cvename>
|
|
<url>http://www.stevenroddis.com.au/2006/10/06/torrentflux-user-agent-xss-vulnerability/</url>
|
|
<url>http://secunia.com/advisories/22293/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-09-30</discovery>
|
|
<entry>2006-10-07</entry>
|
|
<modified>2006-10-15</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="fe83eb5b-55e1-11db-a5ae-00508d6a62df">
|
|
<topic>python -- buffer overrun in repr() for unicode strings</topic>
|
|
<affects>
|
|
<package>
|
|
<name>python+ipv6</name>
|
|
<range><ge>0</ge></range>
|
|
</package>
|
|
<package>
|
|
<name>python</name>
|
|
<range><lt>2.4.3_1</lt></range>
|
|
<range><gt>2.5.*</gt><lt>2.5.c2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Benjamin C. Wiley Sittler reports:</p>
|
|
<blockquote cite="https://launchpad.net/distros/ubuntu/+source/python2.4/+bug/56633">
|
|
<p>I discovered a [buffer overrun in repr() for unicode
|
|
strings]. This causes an unpatched non-debug wide
|
|
(UTF-32/UCS-4) build of python to abort.</p>
|
|
</blockquote>
|
|
<p>Ubuntu security team reports:</p>
|
|
<blockquote cite="http://www.ubuntu.com/usn/usn-359-1">
|
|
<p>If an application uses repr() on arbitrary untrusted data,
|
|
this [bug] could be exploited to execute arbitrary code
|
|
with the privileges of the python application.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2006-4980</cvename>
|
|
<url>https://launchpad.net/distros/ubuntu/+source/python2.4/+bug/56633</url>
|
|
<url>http://www.ubuntu.com/usn/usn-359-1</url>
|
|
<url>http://secunia.com/advisories/22276/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-08-15</discovery>
|
|
<entry>2006-10-07</entry>
|
|
<modified>2006-10-08</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="e329550b-54f7-11db-a5ae-00508d6a62df">
|
|
<topic>php -- _ecalloc Integer Overflow Vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>php5</name>
|
|
<range><lt>5.1.6_1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>php5-cli</name>
|
|
<name>php5-cgi</name>
|
|
<name>php5-dtc</name>
|
|
<name>php5-horde</name>
|
|
<name>php5-nms</name>
|
|
<name>mod_php5</name>
|
|
<range><ge>0</ge></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Stefan Esser reports:</p>
|
|
<blockquote cite="http://www.hardened-php.net/advisory_092006.133.html">
|
|
<p>The PHP 5 branch of the PHP source code lacks the
|
|
protection against possible integer overflows inside
|
|
ecalloc() that is present in the PHP 4 branch and also for
|
|
several years part of our Hardening-Patch and our new
|
|
Suhosin-Patch.</p>
|
|
<p>It was discovered that such an integer overflow can be
|
|
triggered when user input is passed to the unserialize()
|
|
function. Earlier vulnerabilities in PHP's unserialize()
|
|
that were also discovered by one of our audits in December
|
|
2004 are unrelated to the newly discovered flaw, but they
|
|
have shown, that the unserialize() function is exposed to
|
|
user-input in many popular PHP applications. Examples for
|
|
applications that use the content of COOKIE variables with
|
|
unserialize() are phpBB and Serendipity.</p>
|
|
<p>The successful exploitation of this integer overflow will
|
|
result in arbitrary code execution.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2006-4812</cvename>
|
|
<url>http://www.hardened-php.net/advisory_092006.133.html</url>
|
|
<url>http://secunia.com/advisories/22280/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-09-30</discovery>
|
|
<entry>2006-10-06</entry>
|
|
<modified>2006-10-17</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="8a5770b4-54b5-11db-a5ae-00508d6a62df">
|
|
<topic>mambo -- multiple SQL injection vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>mambo</name>
|
|
<range><lt>4.6.5</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>James Bercegay reports:</p>
|
|
<blockquote cite="http://www.gulftech.org/?node=research&article_id=00116-10042006">
|
|
<p>Mambo is vulnerable to an Authentication Bypass issue that
|
|
is due to an SQL Injection in the login function. The SQL
|
|
Injection is possible because the $passwd variable is only
|
|
sanitized when it is not passed as an argument to the
|
|
function.</p>
|
|
</blockquote>
|
|
<p>Omid reports:</p>
|
|
<blockquote cite="http://seclists.org/bugtraq/2006/Aug/0491.html">
|
|
<p>There are several sql injections in Mambo 4.6 RC2 &
|
|
Joomla 1.0.10 (and maybe other versions):</p>
|
|
<ul>
|
|
<li>When a user edits a content, the "id" parameter is not
|
|
checked properly in /components/com_content/content.php,
|
|
which can cause 2 sql injections.</li>
|
|
<li>The "limit" parameter in the administration section is
|
|
not checked. This affects many pages of administration
|
|
section</li>
|
|
<li>In the administration section, while editing/creating a
|
|
user, the "gid" parameter is not checked properly.</li>
|
|
</ul>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>19719</bid>
|
|
<bid>19734</bid>
|
|
<url>http://www.gulftech.org/?node=research&article_id=00116-10042006</url>
|
|
<url>http://seclists.org/bugtraq/2006/Aug/0491.html</url>
|
|
<url>http://www.frsirt.com/english/advisories/2006/3918</url>
|
|
<url>http://mamboxchange.com/forum/forum.php?forum_id=7704</url>
|
|
<url>http://secunia.com/advisories/21644/</url>
|
|
<url>http://secunia.com/advisories/22221/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-08-26</discovery>
|
|
<entry>2006-10-05</entry>
|
|
<modified>2011-06-27</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="19a92df1-548d-11db-8f1a-000a48049292">
|
|
<topic>tin -- buffer overflow vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>tin</name>
|
|
<name>zh-tin</name>
|
|
<range><lt>1.8.2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<blockquote cite="ftp://ftp.tin.org/pub/news/clients/tin/stable/CHANGES">
|
|
<p>Urs Janssen and Aleksey Salow report possible buffer
|
|
overflows in tin versions 1.8.0 and 1.8.1.</p>
|
|
</blockquote>
|
|
<blockquote cite="http://www.openpkg.org/security/advisories/OpenPKG-SA-2006.005-tin.html">
|
|
<p>OpenPKG project elaborates there is an allocation
|
|
off-by-one bug in version 1.8.0 which can lead to a buffer
|
|
overflow.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>ftp://ftp.tin.org/pub/news/clients/tin/stable/CHANGES</url>
|
|
<url>http://www.openpkg.org/security/advisories/OpenPKG-SA-2006.005-tin.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-02-15</discovery>
|
|
<entry>2006-10-05</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="ae7124ff-547c-11db-8f1a-000a48049292">
|
|
<topic>openldap -- slapd acl selfwrite Security Issue</topic>
|
|
<affects>
|
|
<package>
|
|
<name>openldap-server</name>
|
|
<name>openldap-sasl-server</name>
|
|
<range><lt>2.3.25</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Howard Chu reports:</p>
|
|
<blockquote cite="http://www.openldap.org/its/index.cgi/Software%20Bugs?id=4587">
|
|
<p>An ACL of the form 'access to dn.subtree="ou=groups,
|
|
dc=example,dc=com" attr=member by * selfwrite' is intended
|
|
to only allow users to add/delete their own DN to the
|
|
target attribute. Currently it allows any DNs to be
|
|
modified.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>19832</bid>
|
|
<cvename>CVE-2006-4600</cvename>
|
|
<url>http://www.openldap.org/its/index.cgi/Software%20Bugs?id=4587</url>
|
|
<url>http://www.openldap.org/lists/openldap-announce/200608/msg00000.html</url>
|
|
<url>http://secunia.com/advisories/21721</url>
|
|
<url>http://securitytracker.com/alerts/2006/Sep/1016783.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-06-14</discovery>
|
|
<entry>2006-10-05</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="5a39a22e-5478-11db-8f1a-000a48049292">
|
|
<topic>mono -- "System.CodeDom.Compiler" Insecure Temporary Creation</topic>
|
|
<affects>
|
|
<package>
|
|
<name>mono</name>
|
|
<range><lt>1.1.13.8.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Sebastian Krahmer reports:</p>
|
|
<blockquote cite="http://www.ubuntu.com/usn/usn-357-1">
|
|
<p>Sebastian Krahmer of the SuSE security team discovered
|
|
that the System.CodeDom.Compiler classes used temporary
|
|
files in an insecure way. This could allow a symbolic link
|
|
attack to create or overwrite arbitrary files with the
|
|
privileges of the user invoking the program. Under some
|
|
circumstances, a local attacker could also exploit this to
|
|
inject arbitrary code into running Mono processes.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2006-5072</cvename>
|
|
<url>http://www.ubuntu.com/usn/usn-357-1</url>
|
|
<url>http://secunia.com/advisories/22237/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-10-04</discovery>
|
|
<entry>2006-10-05</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="edabe438-542f-11db-a5ae-00508d6a62df">
|
|
<topic>php -- open_basedir Race Condition Vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>php4</name>
|
|
<name>php5</name>
|
|
<range><lt>4.4.4_1</lt></range>
|
|
<range><ge>5.*</ge><lt>5.1.6_2</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>php-suhosin</name>
|
|
<range><lt>0.9.6</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>php4-cli</name>
|
|
<name>php5-cli</name>
|
|
<name>php4-cgi</name>
|
|
<name>php5-cgi</name>
|
|
<name>php4-dtc</name>
|
|
<name>php5-dtc</name>
|
|
<name>php4-horde</name>
|
|
<name>php5-horde</name>
|
|
<name>php4-nms</name>
|
|
<name>php5-nms</name>
|
|
<name>mod_php4</name>
|
|
<name>mod_php5</name>
|
|
<range><ge>0</ge></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Stefan Esser reports:</p>
|
|
<blockquote cite="http://www.hardened-php.net/advisory_082006.132.html">
|
|
<p>PHP's open_basedir feature is meant to disallow scripts to
|
|
access files outside a set of configured base directories.
|
|
The checks for this are placed within PHP functions dealing
|
|
with files before the actual open call is performed.</p>
|
|
<p>Obviously there is a little span of time between the check
|
|
and the actual open call. During this time span the checked
|
|
path could have been altered and point to a file that is
|
|
forbidden to be accessed due to open_basedir restrictions.</p>
|
|
<p>Because the open_basedir restrictions often not call PHP
|
|
functions but 3rd party library functions to actually open
|
|
the file it is impossible to close this time span in a
|
|
general way. It would only be possible to close it when PHP
|
|
handles the actual opening on it's own.</p>
|
|
<p>While it seems hard to change the path during this little
|
|
time span it is very simple with the use of the symlink()
|
|
function combined with a little trick. PHP's symlink()
|
|
function ensures that source and target of the symlink
|
|
operation are allowed by open_basedir restrictions (and
|
|
safe_mode). However it is possible to point a symlink to
|
|
any file by the use of mkdir(), unlink() and at least two
|
|
symlinks.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>20326</bid>
|
|
<cvename>CVE-2006-5178</cvename>
|
|
<url>http://www.hardened-php.net/advisory_082006.132.html</url>
|
|
<url>http://secunia.com/advisories/22235/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-10-02</discovery>
|
|
<entry>2006-10-05</entry>
|
|
<modified>2006-10-16</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="86526ba4-53c8-11db-8f1a-000a48049292">
|
|
<topic>phpbb -- NULL byte injection vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>phpbb</name>
|
|
<name>zh-phpbb-tw</name>
|
|
<range><lt>2.0.22</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/22188/">
|
|
<p>ShAnKaR has discovered a vulnerability in phpBB, which can
|
|
be exploited by malicious users to compromise a vulnerable
|
|
system.</p>
|
|
<p>Input passed to the "avatar_path" parameter in
|
|
admin/admin_board.php is not properly sanitised before
|
|
being used as a configuration variable to store avatar
|
|
images. This can be exploited to upload and execute
|
|
arbitrary PHP code by changing "avatar_path" to a file with
|
|
a trailing NULL byte.</p>
|
|
<p>Successful exploitation requires privileges to the
|
|
administration section.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>20347</bid>
|
|
<cvename>CVE-2006-4758</cvename>
|
|
<url>http://secunia.com/advisories/22188/</url>
|
|
<url>http://xforce.iss.net/xforce/xfdb/28884</url>
|
|
<url>http://www.security.nnov.ru/Odocument221.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-09-12</discovery>
|
|
<entry>2006-10-04</entry>
|
|
<modified>2006-12-24</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="35f2679f-52d7-11db-8f1a-000a48049292">
|
|
<topic>postnuke -- admin section SQL injection</topic>
|
|
<affects>
|
|
<package>
|
|
<name>postnuke</name>
|
|
<range><lt>0.763</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>ISS X-Force reports:</p>
|
|
<blockquote cite="http://xforce.iss.net/xforce/xfdb/29271">
|
|
<p>PostNuke is vulnerable to SQL injection. A remote attacker
|
|
could send specially-crafted SQL statements to the admin
|
|
section using the hits parameter, which could allow the
|
|
attacker to view, add, modify or delete information in the
|
|
back-end database.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>20317</bid>
|
|
<cvename>CVE-2006-5121</cvename>
|
|
<url>http://xforce.iss.net/xforce/xfdb/29271</url>
|
|
<url>http://www.securityfocus.com/archive/1/archive/1/447361/100/0/threaded</url>
|
|
<url>http://secunia.com/advisories/22197/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-09-29</discovery>
|
|
<entry>2006-10-03</entry>
|
|
<modified>2007-11-17</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="b975763f-5210-11db-8f1a-000a48049292">
|
|
<topic>freetype -- LWFN Files Buffer Overflow Vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>freetype2</name>
|
|
<range><lt>2.1.10_5</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>SecurityTracker reports:</p>
|
|
<blockquote cite="http://securitytracker.com/alerts/2006/Jul/1016522.html">
|
|
<p>A vulnerability was reported in FreeType. A remote user
|
|
can cause arbitrary code to be executed on the target
|
|
user's system.</p>
|
|
<p>A remote user can create a specially crafted font file
|
|
that, when loaded by the target user's system, will trigger
|
|
an integer underflow or integer overflow and crash the
|
|
application or execute arbitrary code on the target system.</p>
|
|
<p>Chris Evans reported these vulnerabilities.</p>
|
|
<p>Impact: A remote user can create a file that, when loaded
|
|
by the target user, will execute arbitrary code on the
|
|
target user's system.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>18034</bid>
|
|
<cvename>CVE-2006-0747</cvename>
|
|
<cvename>CVE-2006-1861</cvename>
|
|
<cvename>CVE-2006-3467</cvename>
|
|
<url>http://securitytracker.com/alerts/2006/Jul/1016522.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-07-10</discovery>
|
|
<entry>2006-10-02</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="74ff10f6-520f-11db-8f1a-000a48049292">
|
|
<topic>cscope -- Buffer Overflow Vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>cscope</name>
|
|
<range><lt>15.6</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/21601">
|
|
<p>Will Drewry has reported some vulnerabilities in Cscope,
|
|
which potentially can be exploited by malicious people to
|
|
compromise a vulnerable system.</p>
|
|
<p>Various boundary errors within the parsing of file lists
|
|
or the expansion of environment variables can be exploited
|
|
to cause stack-based buffer overflows when parsing
|
|
specially crafted "cscope.lists" files or directories.</p>
|
|
<p>A boundary error within the parsing of command line
|
|
arguments can be exploited to cause a stack-based buffer
|
|
overflow when supplying an overly long "reffile" argument.</p>
|
|
<p>Successful exploitation may allow execution of arbitrary
|
|
code.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>19686</bid>
|
|
<bid>19687</bid>
|
|
<cvename>CVE-2006-4262</cvename>
|
|
<url>http://secunia.com/advisories/21601</url>
|
|
<url>http://sourceforge.net/mailarchive/forum.php?thread_id=30266760&forum_id=33500</url>
|
|
<url>http://sourceforge.net/mailarchive/forum.php?thread_id=30266761&forum_id=33500</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-08-20</discovery>
|
|
<entry>2006-10-02</entry>
|
|
<modified>2006-10-11</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="64bf6234-520d-11db-8f1a-000a48049292">
|
|
<topic>gnutls -- RSA Signature Forgery Vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>gnutls</name>
|
|
<name>gnutls-devel</name>
|
|
<range><lt>1.4.4</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/21937">
|
|
<p>A vulnerability has been reported in GnuTLS, which can be
|
|
exploited by malicious people to bypass certain security
|
|
restrictions.</p>
|
|
<p>The vulnerability is caused due to an error in the
|
|
verification of certain signatures. If a RSA key with
|
|
exponent 3 is used, it may be possible to forge PKCS #1
|
|
v1.5 signatures signed with that key.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>20027</bid>
|
|
<cvename>CVE-2006-4790</cvename>
|
|
<url>http://secunia.com/advisories/21937</url>
|
|
<url>http://lists.gnupg.org/pipermail/gnutls-dev/2006-September/001205.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-09-08</discovery>
|
|
<entry>2006-10-02</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="350a5bd9-520b-11db-8f1a-000a48049292">
|
|
<topic>MT -- Search Unspecified XSS</topic>
|
|
<affects>
|
|
<package>
|
|
<name>MT</name>
|
|
<range><ge>3.3</ge><lt>3.33</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/22109">
|
|
<p>Arai has reported a vulnerability in Movable Type and
|
|
Movable Type Enterprise, which can be exploited by
|
|
malicious people to conduct cross-site scripting attacks.</p>
|
|
<p>Some unspecified input passed via the search functionality
|
|
isn't properly sanitised before being returned to the user.
|
|
This can be exploited to execute arbitrary HTML and script
|
|
code in a user's browser session in context of an affected
|
|
site.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>20228</bid>
|
|
<cvename>CVE-2006-5080</cvename>
|
|
<url>http://secunia.com/advisories/22109</url>
|
|
<url>http://www.sixapart.com/movabletype/news/2006/09/mt_333-mte_103_updates.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-09-26</discovery>
|
|
<entry>2006-10-02</entry>
|
|
<modified>2006-10-15</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="19b17ab4-51e0-11db-a5ae-00508d6a62df">
|
|
<topic>phpmyadmin -- XSRF vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>phpMyAdmin</name>
|
|
<range><lt>2.9.0.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>phpMyAdmin team reports:</p>
|
|
<blockquote cite="http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-5">
|
|
<p>We received a security advisory from Stefan Esser
|
|
(sesser@hardened-php.net) and we wish to thank him for his
|
|
work.</p>
|
|
<p>It was possible to inject arbitrary SQL commands by
|
|
forcing an authenticated user to follow a crafted link.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2006-5116</cvename>
|
|
<cvename>CVE-2006-5117</cvename>
|
|
<url>http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-5</url>
|
|
<url>http://secunia.com/advisories/22126/</url>
|
|
<bid>20253</bid>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-09-28</discovery>
|
|
<entry>2006-10-02</entry>
|
|
<modified>2006-10-03</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="32db37a5-50c3-11db-acf3-000c6ec775d9">
|
|
<topic>openssh -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<system>
|
|
<name>FreeBSD</name>
|
|
<range><ge>6.1</ge><lt>6.1_10</lt></range>
|
|
<range><ge>6.0</ge><lt>6.0_15</lt></range>
|
|
<range><ge>5.5</ge><lt>5.5_8</lt></range>
|
|
<range><ge>5.4</ge><lt>5.4_22</lt></range>
|
|
<range><ge>5.0</ge><lt>5.3_37</lt></range>
|
|
<range><lt>4.11_25</lt></range>
|
|
</system>
|
|
<package>
|
|
<name>openssh</name>
|
|
<range><lt>4.4,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>openssh-portable</name>
|
|
<range><lt>4.4.p1,1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<h1>Problem Description</h1>
|
|
<p>The CRC compensation attack detector in the sshd(8) daemon,
|
|
upon receipt of duplicate blocks, uses CPU time cubic in the
|
|
number of duplicate blocks received. [CVE-2006-4924]</p>
|
|
<p>A race condition exists in a signal handler used by the
|
|
sshd(8) daemon to handle the LoginGraceTime option, which
|
|
can potentially cause some cleanup routines to be executed
|
|
multiple times. [CVE-2006-5051]</p>
|
|
<h1>Impact</h1>
|
|
<p>An attacker sending specially crafted packets to sshd(8)
|
|
can cause a Denial of Service by using 100% of CPU time
|
|
until a connection timeout occurs. Since this attack can be
|
|
performed over multiple connections simultaneously, it is
|
|
possible to cause up to MaxStartups (10 by default) sshd
|
|
processes to use all the CPU time they can obtain.
|
|
[CVE-2006-4924]</p>
|
|
<p>The OpenSSH project believe that the race condition can
|
|
lead to a Denial of Service or potentially remote code
|
|
execution, but the FreeBSD Security Team has been unable to
|
|
verify the exact impact. [CVE-2006-5051]</p>
|
|
<h1>Workaround</h1>
|
|
<p>The attack against the CRC compensation attack detector can
|
|
be avoided by disabling SSH Protocol version 1 support in
|
|
sshd_config(5).</p>
|
|
<p>There is no workaround for the second issue.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>20216</bid>
|
|
<cvename>CVE-2006-4924</cvename>
|
|
<cvename>CVE-2006-5051</cvename>
|
|
<freebsdsa>SA-06:22.openssh</freebsdsa>
|
|
<url>http://www.openssh.com/txt/release-4.4</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-09-25</discovery>
|
|
<entry>2006-09-30</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="fcba5764-506a-11db-a5ae-00508d6a62df">
|
|
<topic>dokuwiki -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>dokuwiki</name>
|
|
<range><lt>20060309c</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>dokuwiki-devel</name>
|
|
<range><lt>20060909</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/21819/">
|
|
<p>rgod has discovered a vulnerability in DokuWiki, which can
|
|
be exploited by malicious people to compromise a vulnerable
|
|
system.</p>
|
|
<p>Input passed to the "TARGET_FN" parameter in
|
|
bin/dwpage.php is not properly sanitised before being used
|
|
to copy files. This can be exploited via directory
|
|
traversal attacks in combination with DokuWiki's file
|
|
upload feature to execute arbitrary PHP code.</p>
|
|
</blockquote>
|
|
<p>CVE Mitre reports:</p>
|
|
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4674">
|
|
<p>Direct static code injection vulnerability in doku.php in
|
|
DokuWiki before 2006-03-09c allows remote attackers to
|
|
execute arbitrary PHP code via the X-FORWARDED-FOR HTTP
|
|
header, which is stored in config.php.</p>
|
|
</blockquote>
|
|
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4675">
|
|
<p>Unrestricted file upload vulnerability in
|
|
lib/exe/media.php in DokuWiki before 2006-03-09c allows
|
|
remote attackers to upload executable files into the
|
|
data/media folder via unspecified vectors.</p>
|
|
</blockquote>
|
|
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4679">
|
|
<p>DokuWiki before 2006-03-09c enables the debug feature by
|
|
default, which allows remote attackers to obtain sensitive
|
|
information by calling doku.php with the X-DOKUWIKI-DO HTTP
|
|
header set to "debug".</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>19911</bid>
|
|
<cvename>CVE-2006-4674</cvename>
|
|
<cvename>CVE-2006-4675</cvename>
|
|
<cvename>CVE-2006-4679</cvename>
|
|
<url>http://secunia.com/advisories/21819/</url>
|
|
<url>http://bugs.splitbrain.org/index.php?do=details&id=906</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-09-08</discovery>
|
|
<entry>2006-09-30</entry>
|
|
<modified>2006-10-02</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="450b76ee-5068-11db-a5ae-00508d6a62df">
|
|
<topic>dokuwiki -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>dokuwiki</name>
|
|
<range><lt>20060309_5</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>dokuwiki-devel</name>
|
|
<range><lt>20060609_2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/22192/">
|
|
<p>Some vulnerabilities have been reported in DokuWiki, which
|
|
can be exploited by malicious people to cause a DoS (Denial
|
|
of Service) or potentially compromise a vulnerable system.</p>
|
|
<p>Input passed to the "w" and "h" parameters in
|
|
lib/exec/fetch.php is not properly sanitised before being
|
|
passed as resize parameters to the "convert" application.
|
|
This can be exploited to cause a DoS due to excessive CPU
|
|
and memory consumption by passing very large numbers, or to
|
|
inject arbitrary shell commands by passing specially
|
|
crafted strings to the "w" and "h" parameter.</p>
|
|
<p>Successful exploitation requires that the
|
|
"$conf[imconvert]" option is set.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2006-5098</cvename>
|
|
<cvename>CVE-2006-5099</cvename>
|
|
<url>http://secunia.com/advisories/22192/</url>
|
|
<url>http://secunia.com/advisories/22199/</url>
|
|
<url>http://bugs.splitbrain.org/?do=details&id=924</url>
|
|
<url>http://bugs.splitbrain.org/?do=details&id=926</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-09-26</discovery>
|
|
<entry>2006-09-30</entry>
|
|
<modified>2006-10-02</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="e4c62abd-5065-11db-a5ae-00508d6a62df">
|
|
<topic>tikiwiki -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>tikiwiki</name>
|
|
<range><lt>1.9.5</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/21536/">
|
|
<p>Thomas Pollet has discovered a vulnerability in TikiWiki,
|
|
which can be exploited by malicious people to conduct
|
|
cross-site scripting attacks.</p>
|
|
<p>Input passed to the "highlight" parameter in
|
|
tiki-searchindex.php is not properly sanitised before being
|
|
returned to the user. This can be exploited to execute
|
|
arbitrary HTML and script code in a user's browser session
|
|
in context of an affected site.</p>
|
|
</blockquote>
|
|
<blockquote cite="http://secunia.com/advisories/21733/">
|
|
<p>rgod has discovered a vulnerability in TikiWiki, which can
|
|
be exploited by malicious people to compromise a vulnerable
|
|
system.</p>
|
|
<p>The vulnerability is caused due to the "jhot.php" script
|
|
not correctly verifying uploaded files. This can e.g. be
|
|
exploited to execute arbitrary PHP code by uploading a
|
|
malicious PHP script to the "img/wiki" directory.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>19654</bid>
|
|
<bid>19819</bid>
|
|
<cvename>CVE-2006-4299</cvename>
|
|
<cvename>CVE-2006-4602</cvename>
|
|
<url>http://secunia.com/advisories/21536/</url>
|
|
<url>http://secunia.com/advisories/21733/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-08-21</discovery>
|
|
<entry>2006-09-30</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="e79876e4-5061-11db-a5ae-00508d6a62df">
|
|
<topic>punbb -- NULL byte injection vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>punbb</name>
|
|
<range><lt>1.2.13</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>CVE Mitre reports:</p>
|
|
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=2006-4759">
|
|
<p>PunBB 1.2.12 does not properly handle an avatar directory
|
|
pathname ending in %00, which allows remote authenticated
|
|
administrative users to upload arbitrary files and execute
|
|
code, as demonstrated by a query to admin_options.php with
|
|
an avatars_dir parameter ending in %00. NOTE: this issue
|
|
was originally disputed by the vendor, but the dispute was
|
|
withdrawn on 20060926.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2006-4759</cvename>
|
|
<url>http://forums.punbb.org/viewtopic.php?id=13255</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-09-13</discovery>
|
|
<entry>2006-09-30</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="2d9ad236-4d26-11db-b48d-00508d6a62df">
|
|
<topic>freeciv -- Denial of Service Vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>freeciv</name>
|
|
<name>freeciv-gtk</name>
|
|
<name>freeciv-gtk2</name>
|
|
<name>freeciv-nox11</name>
|
|
<range><lt>2.0.8_2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/21171/">
|
|
<p>Luigi Auriemma has reported a vulnerability in Freeciv,
|
|
which can be exploited by malicious people to cause a DoS
|
|
(Denial of Service).</p>
|
|
<p>An error in the "generic_handle_player_attribute_chunk()"
|
|
function in common/packets.c can be exploited to crash the
|
|
service via a specially crafted
|
|
PACKET_PLAYER_ATTRIBUTE_CHUNK packet sent to the server.</p>
|
|
<p>An error in the "handle_unit_orders()" function in
|
|
server/unithand.c can be exploited to crash the service
|
|
via a specially crafted packet.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2006-3913</cvename>
|
|
<bid>19117</bid>
|
|
<url>http://secunia.com/advisories/21171/</url>
|
|
<url>http://aluigi.altervista.org/adv/freecivx-adv.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-07-23</discovery>
|
|
<entry>2006-09-26</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="339fbbc1-4d23-11db-b48d-00508d6a62df">
|
|
<topic>freeciv -- Packet Parsing Denial of Service Vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>freeciv</name>
|
|
<name>freeciv-gtk</name>
|
|
<name>freeciv-gtk2</name>
|
|
<name>freeciv-nox11</name>
|
|
<range><lt>2.0.8</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/19120/">
|
|
<p>Luigi Auriemma has reported a vulnerability in Freeciv, which
|
|
can be exploited by malicious people to cause a DoS (Denial of
|
|
Service).</p>
|
|
<p>The vulnerability is caused due to an error within the
|
|
handling of the packet length in "common/packets.c". This can
|
|
be exploited to crash the Freeciv server via a specially-
|
|
crafted packet with the size set to "0xffff".</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2006-0047</cvename>
|
|
<bid>16975</bid>
|
|
<url>http://secunia.com/advisories/19120/</url>
|
|
<url>http://aluigi.altervista.org/adv/freecivdos-adv.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-03-06</discovery>
|
|
<entry>2006-09-26</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="1709084d-4d21-11db-b48d-00508d6a62df">
|
|
<topic>plans -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>plans</name>
|
|
<range><lt>6.7.2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/15854/">
|
|
<p>A vulnerability has been reported in Plans, which can be
|
|
exploited by malicious people to conduct SQL injection
|
|
attacks.</p>
|
|
<p>Input passed to the "evt_id" parameter in "plans.cgi"
|
|
isn't properly sanitised before being used in a SQL query.
|
|
This can be exploited to manipulate SQL queries by
|
|
injecting arbitrary SQL code.</p>
|
|
<p>Successful exploitation requires that SQL database
|
|
support has been enabled in "plans_config.pl" (the default
|
|
setting is flat files).</p>
|
|
</blockquote>
|
|
<blockquote cite="http://secunia.com/advisories/15167/">
|
|
<p>Some vulnerabilities have been reported in Plans, which
|
|
can be exploited by malicious people to conduct cross-site
|
|
scripting attacks or gain knowledge of sensitive
|
|
information.</p>
|
|
<p>Input passed to various unspecified parameters is not
|
|
properly sanitised before being returned to users. This
|
|
can be exploited to execute arbitrary HTML and script code
|
|
in a user's browser session in context of a vulnerable
|
|
site.</p>
|
|
<p>An unspecified error can be exploited to gain knowledge
|
|
of the MySQL password.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>14069</bid>
|
|
<url>http://secunia.com/advisories/15167/</url>
|
|
<url>http://secunia.com/advisories/15854/</url>
|
|
<url>http://planscalendar.com/forum/viewtopic.php?t=660</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-04-28</discovery>
|
|
<entry>2006-09-26</entry>
|
|
<modified>2006-10-15</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="d3527663-4ccb-11db-b48d-00508d6a62df">
|
|
<topic>eyeOS -- multiple XSS security bugs</topic>
|
|
<affects>
|
|
<package>
|
|
<name>eyeOS</name>
|
|
<range><lt>0.9.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>eyeOS team reports:</p>
|
|
<blockquote cite="http://eyeos.blogspot.com/2006/09/eyeos-091-released.html">
|
|
<p>[EyeOS 0.9.1] release fixes two XSS security bugs, so we
|
|
recommend all users to upgrade to this new version in order
|
|
to have the best security. These two bugs were discovered by
|
|
Jose Carlos Norte, who is a new eyeOS developer.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>20213</bid>
|
|
<cvename>CVE-2006-5071</cvename>
|
|
<url>http://eyeos.blogspot.com/2006/09/eyeos-091-released.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-09-25</discovery>
|
|
<entry>2006-09-25</entry>
|
|
<modified>2006-10-15</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="65a8f773-4a37-11db-a4cc-000a48049292">
|
|
<topic>zope -- restructuredText "csv_table" Information Disclosure</topic>
|
|
<affects>
|
|
<package>
|
|
<name>zope</name>
|
|
<range><ge>2.7.0</ge><lt>2.7.9_1</lt></range>
|
|
<range><ge>2.8.0</ge><lt>2.8.8_1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/21947/">
|
|
<p>A vulnerability has been reported in Zope, which can be
|
|
exploited by malicious people to disclose potentially
|
|
sensitive information.</p>
|
|
<p>The vulnerability is caused due to an error in the use of
|
|
the docutils module to parse and render "restructured"
|
|
text. This can be exploited to disclose certain information
|
|
via the "csv_table" reStructuredText directive.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>20022</bid>
|
|
<cvename>CVE-2006-4684</cvename>
|
|
<url>http://secunia.com/advisories/21947/</url>
|
|
<url>http://www.zope.org/Products/Zope/Hotfix-2006-08-21/Hotfix-20060821/README.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-08-21</discovery>
|
|
<entry>2006-09-22</entry>
|
|
<modified>2006-12-27</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="f6bff909-4a26-11db-a4cc-000a48049292">
|
|
<topic>libmms -- stack-based buffer overflow</topic>
|
|
<affects>
|
|
<package>
|
|
<name>libmms</name>
|
|
<range><lt>0.3</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>libxine</name>
|
|
<range><lt>1.1.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Mitre CVE reports:</p>
|
|
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2200">
|
|
<p>Stack-based buffer overflow in libmms, as used by (a)
|
|
MiMMS 0.0.9 and (b) xine-lib 1.1.0 and earlier, allows
|
|
remote attackers to cause a denial of service (application
|
|
crash) and possibly execute arbitrary code via the (1)
|
|
send_command, (2) string_utf16, (3) get_data, and (4)
|
|
get_media_packet functions, and possibly other functions.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2006-2200</cvename>
|
|
<bid>18608</bid>
|
|
<url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=374577</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-05-04</discovery>
|
|
<entry>2006-09-22</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="1fe734bf-4a06-11db-b48d-00508d6a62df">
|
|
<topic>opera -- RSA Signature Forgery</topic>
|
|
<affects>
|
|
<package>
|
|
<name>opera</name>
|
|
<name>opera-devel</name>
|
|
<name>linux-opera</name>
|
|
<range><lt>9.02</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Opera reports:</p>
|
|
<blockquote cite="http://www.opera.com/support/search/supsearch.dml?index=845">
|
|
<p>A specially crafted digital certificate can bypass Opera's
|
|
certificate signature verification. Forged certificates can
|
|
contain any false information the forger chooses, and Opera
|
|
will still present it as valid. Opera will not present any
|
|
warning dialogs in this case, and the security status will
|
|
be the highest possible (3). This defeats the protection
|
|
against "man in the middle", the attacks that SSL was
|
|
designed to prevent.</p>
|
|
<p>There is a flaw in OpenSSL's RSA signature verification
|
|
that affects digital certificates using 3 as the public
|
|
exponent. Some of the certificate issuers that are on
|
|
Opera's list of trusted signers have root certificates with
|
|
3 as the public exponent. The forged certificate can appear
|
|
to be signed by one of these.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2006-4339</cvename>
|
|
<url>http://secunia.com/advisories/21982/</url>
|
|
<url>http://secunia.com/advisories/21709/</url>
|
|
<url>http://www.cdc.informatik.tu-darmstadt.de/securebrowser/</url>
|
|
<url>http://www.openssl.org/news/secadv_20060905.txt</url>
|
|
<url>http://www.mozilla.org/security/announce/2006/mfsa2006-60.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-09-18</discovery>
|
|
<entry>2006-09-22</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="e6296105-449b-11db-ba89-000c6ec775d9">
|
|
<topic>mozilla -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>firefox</name>
|
|
<range><lt>1.5.0.7,1</lt></range>
|
|
<range><gt>2.*,1</gt><lt>2.0_1,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-firefox</name>
|
|
<range><lt>1.5.0.7</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>seamonkey</name>
|
|
<name>linux-seamonkey</name>
|
|
<range><lt>1.0.5</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>thunderbird</name>
|
|
<name>linux-thunderbird</name>
|
|
<name>mozilla-thunderbird</name>
|
|
<range><lt>1.5.0.7</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-firefox-devel</name>
|
|
<range><lt>3.0.a2006.09.21</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-seamonkey-devel</name>
|
|
<range><lt>1.5.a2006.09.21</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-mozilla-devel</name>
|
|
<name>linux-mozilla</name>
|
|
<name>mozilla</name>
|
|
<range><gt>0</gt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Mozilla Foundation reports of multiple security issues
|
|
in Firefox, Seamonkey, and Thunderbird. Several of these
|
|
issues can probably be used to run arbitrary code with the
|
|
privilege of the user running the program.</p>
|
|
<blockquote cite="http://www.mozilla.org/security/announce/">
|
|
<ul>
|
|
<li>MFSA 2006-64 Crashes with evidence of memory
|
|
corruption (rv:1.8.0.7)</li>
|
|
<li>MFSA 2006-63 JavaScript execution in mail via XBL</li>
|
|
<li>MFSA 2006-62 Popup-blocker cross-site scripting (XSS)</li>
|
|
<li>MFSA 2006-61 Frame spoofing using document.open()</li>
|
|
<li>MFSA 2006-60 RSA Signature Forgery</li>
|
|
<li>MFSA 2006-59 Concurrency-related vulnerability</li>
|
|
<li>MFSA 2006-58 Auto-Update compromise through DNS and
|
|
SSL spoofing</li>
|
|
<li>MFSA 2006-57 JavaScript Regular Expression Heap
|
|
Corruption</li>
|
|
</ul>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>20042</bid>
|
|
<cvename>CVE-2006-4253</cvename>
|
|
<cvename>CVE-2006-4340</cvename>
|
|
<cvename>CVE-2006-4565</cvename>
|
|
<cvename>CVE-2006-4566</cvename>
|
|
<cvename>CVE-2006-4567</cvename>
|
|
<cvename>CVE-2006-4568</cvename>
|
|
<cvename>CVE-2006-4569</cvename>
|
|
<cvename>CVE-2006-4570</cvename>
|
|
<cvename>CVE-2006-4571</cvename>
|
|
<url>http://www.mozilla.org/security/announce/2006/mfsa2006-57.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2006/mfsa2006-58.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2006/mfsa2006-59.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2006/mfsa2006-60.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2006/mfsa2006-61.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2006/mfsa2006-62.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2006/mfsa2006-63.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2006/mfsa2006-64.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-09-14</discovery>
|
|
<entry>2006-09-15</entry>
|
|
<modified>2006-11-02</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="24f6b1eb-43d5-11db-81e1-000e0c2e438a">
|
|
<topic>win32-codecs -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>win32-codecs</name>
|
|
<range><lt>3.1.0.p8_1,1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Apple Security Team reports that there are multiple
|
|
vulnerabilities within QuickTime (one of the plugins for
|
|
win32-codecs). A remote attacker capable of creating a
|
|
malicious SGI image, FlashPix, FLC movie, or a QuickTime
|
|
movie can possibly lead to execution of arbitrary code or
|
|
cause a Denial of Service (application crash).</p>
|
|
<p>Users who have QuickTime (/win32-codecs) as a browser plugin
|
|
may be vulnerable to remote code execution by visiting a
|
|
website containing a malicious SGI image, FlashPix, FLC movie
|
|
or a QuickTime movie.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>20138</bid>
|
|
<cvename>CVE-2006-4381</cvename>
|
|
<cvename>CVE-2006-4382</cvename>
|
|
<cvename>CVE-2006-4384</cvename>
|
|
<cvename>CVE-2006-4385</cvename>
|
|
<cvename>CVE-2006-4386</cvename>
|
|
<cvename>CVE-2006-4388</cvename>
|
|
<cvename>CVE-2006-4389</cvename>
|
|
<url>http://docs.info.apple.com/article.html?artnum=304357</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-09-08</discovery>
|
|
<entry>2006-09-14</entry>
|
|
<modified>2006-10-17</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="ea09c5df-4362-11db-81e1-000e0c2e438a">
|
|
<topic>php -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>php4</name>
|
|
<name>php5</name>
|
|
<range><lt>4.4.4</lt></range>
|
|
<range><ge>5</ge><lt>5.1.5</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>php4-cli</name>
|
|
<name>php5-cli</name>
|
|
<name>php4-cgi</name>
|
|
<name>php5-cgi</name>
|
|
<name>php4-dtc</name>
|
|
<name>php5-dtc</name>
|
|
<name>php4-horde</name>
|
|
<name>php5-horde</name>
|
|
<name>php4-nms</name>
|
|
<name>php5-nms</name>
|
|
<name>mod_php4</name>
|
|
<name>mod_php5</name>
|
|
<range><ge>0</ge></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The PHP development team reports:</p>
|
|
<blockquote cite="http://www.php.net/release_5_1_5.php">
|
|
<ul>
|
|
<li>Added missing safe_mode/open_basedir checks inside the
|
|
error_log(), file_exists(), imap_open() and imap_reopen()
|
|
functions.</li>
|
|
<li>Fixed overflows inside str_repeat() and wordwrap()
|
|
functions on 64bit systems.</li>
|
|
<li>Fixed possible open_basedir/safe_mode bypass in cURL
|
|
extension and with realpath cache.</li>
|
|
<li>Fixed overflow in GD extension on invalid GIF
|
|
images.</li>
|
|
<li>Fixed a buffer overflow inside sscanf() function.</li>
|
|
<li>Fixed an out of bounds read inside stripos()
|
|
function.</li>
|
|
<li>Fixed memory_limit restriction on 64 bit system.</li>
|
|
</ul>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2006-4481</cvename>
|
|
<cvename>CVE-2006-4482</cvename>
|
|
<cvename>CVE-2006-4483</cvename>
|
|
<cvename>CVE-2006-4484</cvename>
|
|
<cvename>CVE-2006-4485</cvename>
|
|
<cvename>CVE-2006-4486</cvename>
|
|
<url>http://www.php.net/release_4_4_4.php</url>
|
|
<url>http://www.php.net/release_5_1_5.php</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-08-18</discovery>
|
|
<entry>2006-09-13</entry>
|
|
<modified>2006-09-14</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="c0fd7890-4346-11db-89cc-000ae42e9b93">
|
|
<topic>drupal-pubcookie -- authentication may be bypassed</topic>
|
|
<affects>
|
|
<package>
|
|
<name>drupal-pubcookie</name>
|
|
<range><le>4.6.0_20060210</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Drupal Project reports:</p>
|
|
<blockquote cite="http://drupal.org/node/83064">
|
|
<p>It is possible for a malicious user to spoof a user's
|
|
identity by bypassing the login redirection mechanism in the
|
|
pubcookie module. The malicious user may gain the privileges
|
|
of the user they are spoofing, including the administrative
|
|
user.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2006-4717</cvename>
|
|
<url>http://drupal.org/node/83064</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-09-08</discovery>
|
|
<entry>2006-09-13</entry>
|
|
<modified>2010-05-12</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="7c75d48c-429b-11db-afae-000c6ec775d9">
|
|
<topic>linux-flashplugin7 -- arbitrary code execution vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>linux-flashplugin</name>
|
|
<range><lt>7.0r68</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Adobe reports:</p>
|
|
<blockquote cite="http://www.adobe.com/support/security/bulletins/apsb06-11.html">
|
|
<p>Multiple input validation errors have been identified in
|
|
Flash Player 8.0.24.0 and earlier versions that could lead
|
|
to the potential execution of arbitrary code. These
|
|
vulnerabilities could be accessed through content
|
|
delivered from a remote location via the user?s web
|
|
browser, email client, or other applications that include
|
|
or reference the Flash Player. (CVE-2006-3311,
|
|
CVE-2006-3587, CVE-2006-3588)</p>
|
|
<p>These updates include changes to prevent circumvention of
|
|
the "allowScriptAccess" option. (CVE-2006-4640)</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2006-3311</cvename>
|
|
<cvename>CVE-2006-3587</cvename>
|
|
<cvename>CVE-2006-3588</cvename>
|
|
<cvename>CVE-2006-4640</cvename>
|
|
<url>http://www.adobe.com/support/security/bulletins/apsb06-11.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-09-12</discovery>
|
|
<entry>2006-09-12</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="28ce7102-4039-11db-a838-00148584c7dd">
|
|
<cancelled/>
|
|
</vuln>
|
|
|
|
<vuln vid="fffa9257-3c17-11db-86ab-00123ffe8333">
|
|
<topic>mailman -- Multiple Vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>mailman</name>
|
|
<name>ja-mailman</name>
|
|
<name>mailman-with-htdig</name>
|
|
<range><lt>2.1.9.r1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/21732/">
|
|
<p>Mailman can be exploited by malicious people to conduct cross-site
|
|
scripting and phishing attacks, and cause a DoS (Denial of
|
|
Service).</p>
|
|
<p>1) An error in the logging functionality can be exploited to
|
|
inject a spoofed log message into the error log via a specially
|
|
crafted URL.</p>
|
|
<p>Successful exploitation may trick an administrator into visiting
|
|
a malicious web site.</p>
|
|
<p>2) An error in the processing of malformed headers which does not
|
|
follow the RFC 2231 standard can be exploited to cause a DoS
|
|
(Denial of Service).</p>
|
|
<p>3) Some unspecified input isn't properly sanitised before being
|
|
returned to the user. This can be exploited to execute arbitrary
|
|
HTML and script code in a user's browser session in context of an
|
|
affected site.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>19831</bid>
|
|
<cvename>CVE-2006-2191</cvename>
|
|
<cvename>CVE-2006-2941</cvename>
|
|
<cvename>CVE-2006-3636</cvename>
|
|
<cvename>CVE-2006-4624</cvename>
|
|
<url>http://secunia.com/advisories/21732/</url>
|
|
<url>http://sourceforge.net/project/shownotes.php?group_id=103&release_id=444295</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-06-09</discovery>
|
|
<entry>2006-09-04</entry>
|
|
<modified>2006-10-04</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="09639ccc-3abb-11db-81e1-000e0c2e438a">
|
|
<topic>hlstats -- multiple cross site scripting vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>hlstats</name>
|
|
<range><le>1.35</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Kefka reports multiple cross site scripting vulnerabilities
|
|
within hlstats. The vulnerabilities are caused due to
|
|
improper checking of variables, allowing an attacker to
|
|
perform cross site scripting.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>19745</bid>
|
|
<cvename>CVE-2006-4454</cvename>
|
|
<cvename>CVE-2006-6780</cvename>
|
|
<cvename>CVE-2006-6781</cvename>
|
|
<cvename>CVE-2007-2812</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-08-29</discovery>
|
|
<entry>2006-09-02</entry>
|
|
<modified>2011-09-03</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="0b79743b-3ab7-11db-81e1-000e0c2e438a">
|
|
<topic>gtetrinet -- remote code execution</topic>
|
|
<affects>
|
|
<package>
|
|
<name>gtetrinet</name>
|
|
<range><lt>0.7.10</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Debian Security Team reports:</p>
|
|
<blockquote cite="http://www.debian.org/security/2006/dsa-1163">
|
|
<p>Michael Gehring discovered several potential out-of-bounds
|
|
index accesses in gtetrinet, a multiplayer Tetris-like game,
|
|
which may allow a remote server to execute arbitrary
|
|
code</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>19766</bid>
|
|
<cvename>CVE-2006-3125</cvename>
|
|
<url>http://www.debian.org/security/2006/dsa-1163</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-08-30</discovery>
|
|
<entry>2006-09-02</entry>
|
|
<modified>2006-10-01</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="0ab423e7-3822-11db-81e1-000e0c2e438a">
|
|
<topic>joomla -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>joomla</name>
|
|
<range><lt>1.0.11</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Joomla development team reports multiple vulnerabilities
|
|
within the joomla application. Joomla is vulnerable to the
|
|
following vulnerabilities:</p>
|
|
<ul>
|
|
<li>Improper validation of the mosMail function</li>
|
|
<li>Improper validation of the JosIsValidEmail function.</li>
|
|
<li>Remote code execution in PEAR.php</li>
|
|
<li>Zend Hash del key or index vulnerability</li>
|
|
</ul>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://www.joomla.org/content/view/1841/78/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-08-28</discovery>
|
|
<entry>2006-08-30</entry>
|
|
<modified>2010-05-12</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="c9d2e361-32fb-11db-a6e2-000e0c2e438a">
|
|
<topic>sppp -- buffer overflow vulnerability</topic>
|
|
<affects>
|
|
<system>
|
|
<name>FreeBSD</name>
|
|
<range><lt>4.11_20</lt></range>
|
|
<range><ge>5.3</ge><lt>5.3_32</lt></range>
|
|
<range><ge>5.4</ge><lt>5.4_17</lt></range>
|
|
<range><ge>5.5</ge><lt>5.5_3</lt></range>
|
|
<range><ge>6.0</ge><lt>6.0_10</lt></range>
|
|
<range><ge>6.1</ge><lt>6.1_4</lt></range>
|
|
</system>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<h1>Problem Description</h1>
|
|
<p>While processing Link Control Protocol (LCP) configuration
|
|
options received from the remote host, sppp(4) fails to
|
|
correctly validate option lengths. This may result in data
|
|
being read or written beyond the allocated kernel memory
|
|
buffer.</p>
|
|
<h1>Impact</h1>
|
|
<p>An attacker able to send LCP packets, including the remote
|
|
end of a sppp(4) connection, can cause the FreeBSD kernel to
|
|
panic. Such an attacker may also be able to obtain
|
|
sensitive information or gain elevated privileges.</p>
|
|
<h1>Workaround</h1>
|
|
<p>No workaround is available, but systems which do not use sppp(4) are
|
|
not vulnerable.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2006-4304</cvename>
|
|
<freebsdsa>SA-06:18.ppp</freebsdsa>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-08-23</discovery>
|
|
<entry>2006-08-23</entry>
|
|
<modified>2006-08-30</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="e2e8d374-2e40-11db-b683-0008743bf21a">
|
|
<topic>horde -- Phishing and Cross-Site Scripting Vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>horde</name>
|
|
<range><le>3.1.2</le></range>
|
|
</package>
|
|
<package>
|
|
<name>imp</name>
|
|
<range><le>4.1.2</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/21500/">
|
|
<p>Some vulnerabilities have been reported in Horde, which
|
|
can be exploited by malicious people to conduct phishing
|
|
and cross-site scripting attacks.</p>
|
|
<ol>
|
|
<li>Input passed to the "url" parameter in index.php isn't
|
|
properly verified before it is being used to include an
|
|
arbitrary web site in a frameset. This can e.g. be
|
|
exploited to trick a user into believing certain
|
|
malicious content is served from a trusted web site.</li>
|
|
<li>Some unspecified input passed in index.php isn't
|
|
properly sanitised before being returned to the user.
|
|
This can be exploited to execute arbitrary HTML and
|
|
script code in a user's browser session in context of an
|
|
affected site.</li>
|
|
</ol>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>19557</bid>
|
|
<bid>19544</bid>
|
|
<url>http://secunia.com/advisories/21500/</url>
|
|
<url>http://lists.horde.org/archives/announce/2006/000292.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-08-17</discovery>
|
|
<entry>2006-08-17</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="5039ae61-2c9f-11db-8401-000ae42e9b93">
|
|
<topic>globus -- Multiple tmpfile races</topic>
|
|
<affects>
|
|
<package>
|
|
<name>globus</name>
|
|
<range><lt>4.0.2_20060706</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Globus Alliance reports:</p>
|
|
<blockquote cite="http://www.globus.org/mail_archive/security-announce/2006/08/msg00000.html">
|
|
<p>The proxy generation tool (grid-proxy-init) creates the
|
|
file, secures the file to provide access only to owner and
|
|
writes proxy to the file. A race condition exists between
|
|
the opening of the proxy credentials file, and making sure
|
|
it is safe file to write to. The checks to ensure this
|
|
file is accessible only to the owner take place using the
|
|
filename after the file is opened for writing, but before
|
|
any data is written.</p>
|
|
</blockquote>
|
|
<blockquote cite="http://www.globus.org/mail_archive/security-announce/2006/08/msg00001.html">
|
|
<p>Various components of the toolkit use files in shared
|
|
directories to store information, some being sensitive
|
|
information. For example, the tool to create proxy
|
|
certificates, stores the generated proxy certificate by
|
|
default in /tmp. Specific vulnerabilities in handling such
|
|
files were reported in myproxy-admin-adduser, grid-ca-sign
|
|
and grid-security-config.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2006-4232</cvename>
|
|
<cvename>CVE-2006-4233</cvename>
|
|
<url>http://www.globus.org/mail_archive/security-announce/2006/08/msg00000.html</url>
|
|
<url>http://www.globus.org/mail_archive/security-announce/2006/08/msg00001.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-08-08</discovery>
|
|
<entry>2006-08-15</entry>
|
|
<modified>2010-05-12</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="9dda3ff1-2b02-11db-a6e2-000e0c2e438a">
|
|
<topic>x11vnc -- authentication bypass vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>x11vnc</name>
|
|
<range><lt>0.8.2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Ludwig Nussel reports that x11vnc is vulnerable to an
|
|
authentication bypass vulnerability. The vulnerability is
|
|
caused by an error in auth.c. This could allow a remote
|
|
attacker to gain unauthorized and unauthenticated access
|
|
to the system.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>18977</bid>
|
|
<cvename>CVE-2006-2450</cvename>
|
|
<url>http://bugs.debian.org/376824</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-08-08</discovery>
|
|
<entry>2006-08-13</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="9855ac8e-2aec-11db-a6e2-000e0c2e438a">
|
|
<topic>alsaplayer -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>alsaplayer</name>
|
|
<range><gt>0</gt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Luigi Auriemma reports three vulnerabilities within
|
|
alsaplayer:</p>
|
|
<blockquote cite="http://aluigi.altervista.org/adv/alsapbof-adv.txt">
|
|
<ul>
|
|
<li>The function which handles the HTTP connections is
|
|
vulnerable to a buffer-overflow that happens when it uses
|
|
sscanf for copying the URL in the Location's field
|
|
received from the server into the redirect buffer of only
|
|
1024 bytes declared in http_open.</li>
|
|
<li>A buffer-overflow exists in the functions which add items
|
|
to the playlist when the GTK interface is used (so the other
|
|
interfaces are not affected by this problem): new_list_item
|
|
and CbUpdated in interface/gtk/PlaylistWindow.cpp.</li>
|
|
<li>AlsaPlayer automatically queries the CDDB server
|
|
specified in its configuration (by default
|
|
freedb.freedb.org) when the user choices the CDDA function
|
|
for playing audio CDs. The function which queries the
|
|
server uses a buffer of 20 bytes and one of 9 for storing
|
|
the category and ID strings received from the server while
|
|
the buffer which contains this server's response is 32768
|
|
bytes long. Naturally for exploiting this bug the attacker
|
|
must have control of the freedb server specified in the
|
|
AlsaPlayer's configuration.</li>
|
|
</ul>
|
|
</blockquote>
|
|
<p>These vulnerabilities could allow a remote attacker to
|
|
execute arbitrary code, possibly gaining access to the
|
|
system.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2006-4089</cvename>
|
|
<bid>19450</bid>
|
|
<url>http://aluigi.altervista.org/adv/alsapbof-adv.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-08-09</discovery>
|
|
<entry>2006-08-13</entry>
|
|
<modified>2010-05-12</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="17f53c1d-2ae9-11db-a6e2-000e0c2e438a">
|
|
<topic>postgresql -- encoding based SQL injection</topic>
|
|
<affects>
|
|
<package>
|
|
<name>postgresql</name>
|
|
<name>postgresql-server</name>
|
|
<name>ja-postgresql</name>
|
|
<range><ge>7.3</ge><lt>7.3.15</lt></range>
|
|
<range><ge>7.4</ge><lt>7.4.13</lt></range>
|
|
<range><ge>8.0.0</ge><lt>8.0.8</lt></range>
|
|
<range><ge>8.1.0</ge><lt>8.1.4</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The PostgreSQL development team reports:</p>
|
|
<blockquote cite="http://www.postgresql.org/docs/techdocs.50">
|
|
<p>An attacker able to submit crafted strings to an
|
|
application that will embed those strings in SQL commands
|
|
can use invalidly-encoded multibyte characters to bypass
|
|
standard string-escaping methods, resulting in possible
|
|
injection of hostile SQL commands into the database. The
|
|
attacks covered here work in any multibyte encoding.</p>
|
|
<p>The widely-used practice of escaping ASCII single quote
|
|
"'" by turning it into "\'" is unsafe when operating in
|
|
multibyte encodings that allow 0x5c (ASCII code for
|
|
backslash) as the trailing byte of a multibyte character;
|
|
this includes at least SJIS, BIG5, GBK, GB18030, and UHC.
|
|
An application that uses this conversion while embedding
|
|
untrusted strings in SQL commands is vulnerable to
|
|
SQL-injection attacks if it communicates with the server in
|
|
one of these encodings. While the standard client libraries
|
|
used with PostgreSQL have escaped "'" in the safe,
|
|
SQL-standard way of "''" for some time, the older practice
|
|
remains common.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>18092</bid>
|
|
<cvename>CVE-2006-2313</cvename>
|
|
<cvename>CVE-2006-2314</cvename>
|
|
<url>http://www.postgresql.org/docs/techdocs.50</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-05-11</discovery>
|
|
<entry>2006-08-13</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="65c8ecf9-2adb-11db-a6e2-000e0c2e438a">
|
|
<topic>postgresql -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>postgresql</name>
|
|
<name>postgresql-server</name>
|
|
<name>ja-postgresql</name>
|
|
<range><ge>7.2</ge><lt>7.2.7</lt></range>
|
|
<range><ge>7.3</ge><lt>7.3.9</lt></range>
|
|
<range><ge>7.4</ge><lt>7.4.7</lt></range>
|
|
<range><ge>8.0.0</ge><lt>8.0.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Multiple vulnerabilities had been reported in various
|
|
versions of PostgreSQL:</p>
|
|
<ul>
|
|
<li>The EXECUTE restrictions can be bypassed by using the
|
|
AGGREGATE function, which is missing a permissions check.</li>
|
|
<li>A buffer overflow exists in gram.y which could allow an
|
|
attacker to execute arbitrary code by sending a large
|
|
number of arguments to a refcursor function, found in
|
|
gram.y</li>
|
|
<li>The intagg contributed module allows an attacker to crash
|
|
the server (Denial of Service) by constructing a malicious
|
|
crafted array.</li>
|
|
</ul>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-0244</cvename>
|
|
<cvename>CVE-2005-0245</cvename>
|
|
<cvename>CVE-2005-0246</cvename>
|
|
<url>http://secunia.com/advisories/12948</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-02-01</discovery>
|
|
<entry>2006-08-13</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="fcb90eb0-2ace-11db-a6e2-000e0c2e438a">
|
|
<topic>mysql -- format string vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>mysql-server</name>
|
|
<range><ge>5.1</ge><lt>5.1.6</lt></range>
|
|
<range><ge>5.0</ge><lt>5.0.19</lt></range>
|
|
<range><ge>4.1</ge><lt>4.1.18</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Jean-David Maillefer reports a Denial of Service vulnerability
|
|
within MySQL. The vulnerability is caused by improper checking
|
|
of the data_format routine, which cause the MySQL server to
|
|
crash. The crash is triggered by the following code:<br/>
|
|
<code>"SELECT date_format('%d%s', 1);</code></p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>19032</bid>
|
|
<cvename>CVE-2006-3469</cvename>
|
|
<url>http://bugs.mysql.com/bug.php?id=20729</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-06-27</discovery>
|
|
<entry>2006-08-13</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="21b7c550-2a22-11db-a6e2-000e0c2e438a">
|
|
<topic>squirrelmail -- random variable overwrite vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>ja-squirrelmail</name>
|
|
<range><ge>1.4.0</ge><lt>1.4.8,2</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>squirrelmail</name>
|
|
<range><ge>1.4.0</ge><lt>1.4.8</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The SquirrelMail developers report:</p>
|
|
<blockquote cite="http://www.squirrelmail.org/security/issue/2006-08-11">
|
|
<p>A logged in user could overwrite random variables in
|
|
compose.php, which might make it possible to read/write
|
|
other users' preferences or attachments.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2006-4019</cvename>
|
|
<url>http://www.squirrelmail.org/security/issue/2006-08-11</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-08-11</discovery>
|
|
<entry>2006-08-12</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="90064567-28b1-11db-844d-000c6ec775d9">
|
|
<topic>rubygem-rails -- evaluation of ruby code</topic>
|
|
<affects>
|
|
<package>
|
|
<name>rubygem-rails</name>
|
|
<range><ge>1.1.0</ge><lt>1.1.3</lt></range>
|
|
<range><ge>1.1.4</ge><lt>1.1.6</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Ruby on Rails blog reports:</p>
|
|
<blockquote cite="http://weblog.rubyonrails.org/2006/8/10/rails-1-1-6-backports-and-full-disclosure">
|
|
<p>With Rails 1.1.0 through 1.1.5 (minus the short-lived 1.1.3),
|
|
you can trigger the evaluation of Ruby code through the URL
|
|
because of a bug in the routing code of Rails. This means that
|
|
you can essentially take down a Rails process by starting
|
|
something like /script/profiler, as the code will run for a
|
|
long time and that process will be hung while it happens.
|
|
Other URLs can even cause data loss.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://weblog.rubyonrails.org/2006/8/10/rails-1-1-6-backports-and-full-disclosure</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-08-09</discovery>
|
|
<entry>2006-08-10</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="342d2e48-26db-11db-9275-000475abc56f">
|
|
<topic>clamav -- heap overflow vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>clamav</name>
|
|
<range><ge>0.88.1</ge><lt>0.88.4</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>clamav-devel</name>
|
|
<range><lt>20060808</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Clamav team reports:</p>
|
|
<blockquote cite="http://www.clamav.net/security/0.88.4.html">
|
|
<p>A heap overflow vulnerability was discovered in libclamav
|
|
which could cause a denial of service or allow the
|
|
execution of arbitrary code.</p>
|
|
<p>The problem is specifically located in the PE file rebuild
|
|
function used by the UPX unpacker.</p>
|
|
<p>Relevant code from libclamav/upx.c:</p>
|
|
<p>
|
|
memcpy(dst, newbuf, foffset);
|
|
*dsize = foffset;
|
|
free(newbuf);
|
|
|
|
cli_dbgmsg("UPX: PE structure rebuilt from compressed file\n");
|
|
return 1;</p>
|
|
<p>Due to improper validation it is possible to overflow the above
|
|
memcpy() beyond the allocated memory block.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2006-4018</cvename>
|
|
<url>http://www.clamav.net/security/0.88.4.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-08-07</discovery>
|
|
<entry>2006-08-08</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="c905298c-2274-11db-896e-000ae42e9b93">
|
|
<topic>drupal -- XSS vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>drupal</name>
|
|
<range><lt>4.6.9</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Drupal project reports:</p>
|
|
<blockquote cite="http://drupal.org/files/sa-2006-011/advisory.txt">
|
|
<p>A malicious user can execute a cross site scripting attack
|
|
by enticing someone to visit a Drupal site via a specially
|
|
crafted link.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://drupal.org/files/sa-2006-011/advisory.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-08-02</discovery>
|
|
<entry>2006-08-02</entry>
|
|
<modified>2006-08-08</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="ed529baa-21c6-11db-b625-02e081235dab">
|
|
<topic>gnupg -- 2 more possible memory allocation attacks</topic>
|
|
<affects>
|
|
<package>
|
|
<name>gnupg</name>
|
|
<range><lt>1.4.5</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Author reports:</p>
|
|
<blockquote cite="http://lists.gnupg.org/pipermail/gnupg-announce/2006q3/000229.html">
|
|
<p>Fixed 2 more possible memory allocation attacks. They are
|
|
similar to the problem we fixed with 1.4.4. This bug can easily
|
|
be exploted for a DoS; remote code execution is not entirely
|
|
impossible.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://lists.gnupg.org/pipermail/gnupg-announce/2006q3/000229.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-08-01</discovery>
|
|
<entry>2006-08-02</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="76562594-1f19-11db-b7d4-0008743bf21a">
|
|
<topic>ruby -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>ruby</name>
|
|
<name>ruby_static</name>
|
|
<range><gt>1.6.*</gt><lt>1.8.*</lt></range>
|
|
<range><gt>1.8.*</gt><lt>1.8.4_9,1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/21009/">
|
|
<p>Two vulnerabilities have been reported in Ruby, which can
|
|
be exploited by malicious people to bypass certain security
|
|
restrictions.</p>
|
|
<ol>
|
|
<li>An error in the handling of the "alias" functionality
|
|
can be exploited to bypass the safe level protection and
|
|
replace methods called in the trusted level.</li>
|
|
<li>An error caused due to directory operations not being
|
|
properly checked can be exploited to bypass the safe
|
|
level protection and close untainted directory streams.</li>
|
|
</ol>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>18944</bid>
|
|
<cvename>CVE-2006-3694</cvename>
|
|
<url>http://secunia.com/advisories/21009/</url>
|
|
<url>http://jvn.jp/jp/JVN%2383768862/index.html</url>
|
|
<url>http://jvn.jp/jp/JVN%2313947696/index.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-07-12</discovery>
|
|
<entry>2006-07-29</entry>
|
|
<modified>2006-07-30</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="dc8c08c7-1e7c-11db-88cf-000c6ec775d9">
|
|
<topic>apache -- mod_rewrite buffer overflow vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>apache</name>
|
|
<range><ge>1.3.28</ge><lt>1.3.36_1</lt></range>
|
|
<range><ge>2.0.46</ge><lt>2.0.58_2</lt></range>
|
|
<range><ge>2.2.0</ge><lt>2.2.2_1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>apache+mod_perl</name>
|
|
<range><ge>1.3.28</ge><lt>1.3.36_1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>apache+ipv6</name>
|
|
<range><ge>1.3.28</ge><lt>1.3.37</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>apache_fp</name>
|
|
<range><ge>0</ge></range>
|
|
</package>
|
|
<package>
|
|
<name>ru-apache</name>
|
|
<range><ge>1.3.28</ge><lt>1.3.37+30.23</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>ru-apache+mod_ssl</name>
|
|
<range><ge>1.3.28</ge><lt>1.3.34.1.57_2</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>apache+ssl</name>
|
|
<range><ge>1.3.28</ge><lt>1.3.34.1.57_2</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>apache+mod_ssl</name>
|
|
<name>apache+mod_ssl+ipv6</name>
|
|
<name>apache+mod_ssl+mod_accel</name>
|
|
<name>apache+mod_ssl+mod_accel+ipv6</name>
|
|
<name>apache+mod_ssl+mod_accel+mod_deflate</name>
|
|
<name>apache+mod_ssl+mod_accel+mod_deflate+ipv6</name>
|
|
<name>apache+mod_ssl+mod_deflate</name>
|
|
<name>apache+mod_ssl+mod_deflate+ipv6</name>
|
|
<name>apache+mod_ssl+mod_snmp</name>
|
|
<name>apache+mod_ssl+mod_snmp+mod_accel</name>
|
|
<name>apache+mod_ssl+mod_snmp+mod_accel+ipv6</name>
|
|
<name>apache+mod_ssl+mod_snmp+mod_deflate</name>
|
|
<name>apache+mod_ssl+mod_snmp+mod_deflate+ipv6</name>
|
|
<name>apache+mod_ssl+mod_snmp+mod_accel+mod_deflate+ipv6</name>
|
|
<range><ge>1.3.28</ge><lt>1.3.36+2.8.27_1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Apache Software Foundation and The Apache HTTP Server
|
|
Project reports:</p>
|
|
<blockquote cite="http://marc.theaimsgroup.com/?l=apache-httpd-announce&m=115409818602955">
|
|
<p>An off-by-one flaw exists in the Rewrite module,
|
|
mod_rewrite, as shipped with Apache 1.3 since 1.3.28, 2.0
|
|
since 2.0.46, and 2.2 since 2.2.0.</p>
|
|
<p>Depending on the manner in which Apache HTTP Server was
|
|
compiled, this software defect may result in a
|
|
vulnerability which, in combination with certain types of
|
|
Rewrite rules in the web server configuration files, could
|
|
be triggered remotely. For vulnerable builds, the nature
|
|
of the vulnerability can be denial of service (crashing of
|
|
web server processes) or potentially allow arbitrary code
|
|
execution. This issue has been rated as having important
|
|
security impact by the Apache HTTP Server Security Team.</p>
|
|
<p>This flaw does not affect a default installation of
|
|
Apache HTTP Server. Users who do not use, or have not
|
|
enabled, the Rewrite module mod_rewrite are not affected
|
|
by this issue. This issue only affects installations using
|
|
a Rewrite rule with the following characteristics:</p>
|
|
<ul>
|
|
<li>The RewriteRule allows the attacker to control the
|
|
initial part of the rewritten URL (for example if the
|
|
substitution URL starts with $1)</li>
|
|
<li>The RewriteRule flags do NOT include any of the
|
|
following flags: Forbidden (F), Gone (G), or NoEscape
|
|
(NE).</li>
|
|
</ul>
|
|
<p>Please note that ability to exploit this issue is
|
|
dependent on the stack layout for a particular compiled
|
|
version of mod_rewrite. If the compiler used to compile
|
|
Apache HTTP Server has added padding to the stack
|
|
immediately after the buffer being overwritten, it will
|
|
not be possible to exploit this issue, and Apache HTTP
|
|
Server will continue operating normally.</p>
|
|
<p>The Apache HTTP Server project thanks Mark Dowd of McAfee
|
|
Avert Labs for the responsible reporting of this
|
|
vulnerability.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<certvu>395412</certvu>
|
|
<cvename>CVE-2006-3747</cvename>
|
|
<mlist msgid="44CA22D9.6020200@apache.org">http://marc.theaimsgroup.com/?l=apache-httpd-announce&m=115409818602955</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-07-27</discovery>
|
|
<entry>2006-07-28</entry>
|
|
<modified>2006-11-01</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="e2a92664-1d60-11db-88cf-000c6ec775d9">
|
|
<topic>mozilla -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>firefox</name>
|
|
<range><lt>1.5.0.5,1</lt></range>
|
|
<range><gt>2.*,1</gt><lt>2.0_1,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-firefox</name>
|
|
<range><lt>1.5.0.5</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-firefox-devel</name>
|
|
<range><lt>3.0.a2006.07.26</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>seamonkey</name>
|
|
<name>linux-seamonkey</name>
|
|
<range><lt>1.0.3</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>thunderbird</name>
|
|
<name>linux-thunderbird</name>
|
|
<name>mozilla-thunderbird</name>
|
|
<range><lt>1.5.0.5</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>mozilla</name>
|
|
<name>linux-mozilla</name>
|
|
<name>linux-mozilla-devel</name>
|
|
<range><gt>0</gt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A Mozilla Foundation Security Advisory reports of multiple
|
|
issues. Several of which can be used to run arbitrary code
|
|
with the privilege of the user running the program.</p>
|
|
<blockquote cite="http://www.mozilla.org/projects/security/known-vulnerabilities.html#seamonkey1.0.3">
|
|
<ul>
|
|
<li>MFSA 2006-56 chrome: scheme loading remote content</li>
|
|
<li>MFSA 2006-55 Crashes with evidence of memory corruption
|
|
(rv:1.8.0.5)</li>
|
|
<li>MFSA 2006-54 XSS with
|
|
XPCNativeWrapper(window).Function(...)</li>
|
|
<li>MFSA 2006-53 UniversalBrowserRead privilege escalation</li>
|
|
<li>MFSA 2006-52 PAC privilege escalation using
|
|
Function.prototype.call</li>
|
|
<li>MFSA 2006-51 Privilege escalation using named-functions
|
|
and redefined "new Object()"</li>
|
|
<li>MFSA 2006-50 JavaScript engine vulnerabilities</li>
|
|
<li>MFSA 2006-49 Heap buffer overwrite on malformed VCard</li>
|
|
<li>MFSA 2006-48 JavaScript new Function race condition</li>
|
|
<li>MFSA 2006-47 Native DOM methods can be hijacked across
|
|
domains</li>
|
|
<li>MFSA 2006-46 Memory corruption with simultaneous events</li>
|
|
<li>MFSA 2006-45 Javascript navigator Object Vulnerability</li>
|
|
<li>MFSA 2006-44 Code execution through deleted frame
|
|
reference</li>
|
|
</ul>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2006-3113</cvename>
|
|
<cvename>CVE-2006-3677</cvename>
|
|
<cvename>CVE-2006-3801</cvename>
|
|
<cvename>CVE-2006-3802</cvename>
|
|
<cvename>CVE-2006-3803</cvename>
|
|
<cvename>CVE-2006-3804</cvename>
|
|
<cvename>CVE-2006-3805</cvename>
|
|
<cvename>CVE-2006-3806</cvename>
|
|
<cvename>CVE-2006-3807</cvename>
|
|
<cvename>CVE-2006-3808</cvename>
|
|
<cvename>CVE-2006-3809</cvename>
|
|
<cvename>CVE-2006-3810</cvename>
|
|
<cvename>CVE-2006-3811</cvename>
|
|
<cvename>CVE-2006-3812</cvename>
|
|
<url>http://www.mozilla.org/projects/security/known-vulnerabilities.html#seamonkey1.0.3</url>
|
|
<url>http://www.mozilla.org/security/announce/2006/mfsa2006-44.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2006/mfsa2006-45.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2006/mfsa2006-46.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2006/mfsa2006-47.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2006/mfsa2006-48.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2006/mfsa2006-49.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2006/mfsa2006-50.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2006/mfsa2006-51.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2006/mfsa2006-52.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2006/mfsa2006-53.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2006/mfsa2006-54.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2006/mfsa2006-55.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2006/mfsa2006-56.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-07-25</discovery>
|
|
<entry>2006-07-27</entry>
|
|
<modified>2006-11-02</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="5f2a0c40-1322-11db-bd23-000475abc56f">
|
|
<topic>zope -- information disclosure vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>zope</name>
|
|
<range><ge>2.7.0</ge><lt>2.7.9</lt></range>
|
|
<range><ge>2.8.0</ge><lt>2.8.7</lt></range>
|
|
<range><ge>2.9.0</ge><lt>2.9.3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Zope team reports:</p>
|
|
<blockquote cite="http://www.zope.org/Products/Zope/Hotfix-2006-07-05/Hotfix-2006-07-05/view">
|
|
<p>Unspecified vulnerability in (Zope2) allows local users
|
|
to obtain sensitive information via unknown attack vectors
|
|
related to the docutils module and "restructured text".</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2006-3458</cvename>
|
|
<url>http://www.zope.org/Products/Zope/Hotfix-2006-07-05/Hotfix-2006-07-05/view</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-07-05</discovery>
|
|
<entry>2006-07-14</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="6da7344b-128a-11db-b25f-00e00c69a70d">
|
|
<topic>drupal -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>drupal</name>
|
|
<range><lt>4.6.8</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Drupal team reports:</p>
|
|
<blockquote cite="http://drupal.org/node/66767">
|
|
<p>Vulnerability: XSS Vulnerability in taxonomy module</p>
|
|
<p>It is possible for a malicious user to insert and execute
|
|
XSS into terms, due to lack of validation on output of the
|
|
page title. The fix wraps the display of terms in
|
|
check_plain().</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2006-2833</cvename>
|
|
<url>http://drupal.org/node/66767</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-05-18</discovery>
|
|
<entry>2006-07-13</entry>
|
|
<modified>2006-07-14</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="67dbe99f-0f09-11db-94f8-00e029485e38">
|
|
<topic>shoutcast -- cross-site scripting, information exposure</topic>
|
|
<affects>
|
|
<package>
|
|
<name>shoutcast</name>
|
|
<name>linux-shoutcast</name>
|
|
<range><lt>1.9.7</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Goober's advisory reports reports that shoutcast is vulnerable to an
|
|
arbitrary file reading vulnerability:</p>
|
|
<blockquote cite="http://people.ksp.sk/~goober/advisory/001-shoutcast.html">
|
|
<p>Impact of the vulnerability depends on the way the product was
|
|
installed. In general, the vulnerability allows the attacker to read
|
|
any file which can be read by the Shoutcast server process.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2006-3007</cvename>
|
|
<url>http://secunia.com/advisories/20524/</url>
|
|
<url>http://people.ksp.sk/~goober/advisory/001-shoutcast.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-06-09</discovery>
|
|
<entry>2006-07-11</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="b168ddea-105a-11db-ac96-000c6ec775d9">
|
|
<topic>samba -- memory exhaustion DoS in smbd</topic>
|
|
<affects>
|
|
<package>
|
|
<name>samba</name>
|
|
<name>ja-samba</name>
|
|
<range><ge>3.0.1,1</ge><lt>3.0.23,1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Samba Team reports:</p>
|
|
<blockquote cite="http://www.samba.org/samba/security/CAN-2006-3403.html">
|
|
<p>The smbd daemon maintains internal data structures used
|
|
track active connections to file and printer shares. In
|
|
certain circumstances an attacker may be able to
|
|
continually increase the memory usage of an smbd process
|
|
by issuing a large number of share connection requests.
|
|
This defect affects all Samba configurations.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2006-3403</cvename>
|
|
<url>http://www.samba.org/samba/security/CAN-2006-3403.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-07-10</discovery>
|
|
<entry>2006-07-10</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="a876df84-0fef-11db-ac96-000c6ec775d9">
|
|
<topic>twiki -- multiple file extensions file upload vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>twiki</name>
|
|
<range><lt>4.0.4,1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A TWiki Security Alert reports:</p>
|
|
<blockquote cite="http://twiki.org/cgi-bin/view/Codev/SecurityAlertSecureFileUploads">
|
|
<p>The TWiki upload filter already prevents executable
|
|
scripts such as .php, .php1, .phps, .pl from potentially
|
|
getting executed by appending a .txt suffix to the
|
|
uploaded filename. However, PHP and some other types
|
|
allows additional file suffixes, such as .php.en, .php.1,
|
|
and .php.2. TWiki does not check for these suffixes,
|
|
e.g. it is possible to upload php scripts with such
|
|
suffixes without the .txt filename padding.</p>
|
|
</blockquote>
|
|
<p>This issue can also be worked around with a restrictive web
|
|
server configuration. See the
|
|
<a href="http://twiki.org/cgi-bin/view/Codev/SecurityAlertSecureFileUploads">
|
|
TWiki Security Alert</a> for more information about how to do
|
|
this.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>18854</bid>
|
|
<cvename>CVE-2006-3336</cvename>
|
|
<url>http://secunia.com/advisories/20992/</url>
|
|
<url>http://twiki.org/cgi-bin/view/Codev/SecurityAlertSecureFileUploads</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-07-05</discovery>
|
|
<entry>2006-07-10</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="b0d61f73-0e11-11db-a47b-000c2957fdf1">
|
|
<topic>trac -- reStructuredText breach of privacy and denial of service vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>trac</name>
|
|
<name>ja-trac</name>
|
|
<range><lt>0.9.6</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Trac 0.9.6 Release Notes reports:</p>
|
|
<blockquote cite="http://lists.edgewall.com/archive/trac-announce/2006-July/000013.html">
|
|
<p>Fixed reStructuredText breach of privacy and denial of
|
|
service vulnerability found by Felix Wiemann.</p>
|
|
<p>The discovered vulnerability requires docutils to be
|
|
installed and enabled. Systems that do not have docutils
|
|
installed or enabled are not vulnerable. As of this
|
|
version version 0.3.9 or greater of docutils is required
|
|
for using reStructuredText markup in Trac.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-3980</cvename>
|
|
<cvename>CVE-2005-4305</cvename>
|
|
<cvename>CVE-2005-4065</cvename>
|
|
<url>http://projects.edgewall.com/trac/wiki/ChangeLog</url>
|
|
<mlist>http://lists.edgewall.com/archive/trac-announce/2006-July/000013.html</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-07-06</discovery>
|
|
<entry>2006-07-07</entry>
|
|
<modified>2010-05-12</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="e94cb43d-0c4a-11db-9016-0050bf27ba24">
|
|
<topic>horde -- various problems in dereferrer</topic>
|
|
<affects>
|
|
<package>
|
|
<name>horde</name>
|
|
<name>horde-php5</name>
|
|
<range><lt>3.1.2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Horde 3.1.2 release announcement:</p>
|
|
<blockquote cite="http://lists.horde.org/archives/announce/2006/000288.html">
|
|
<p>Security Fixes:</p>
|
|
<ul>
|
|
<li>Closed XSS problems in dereferrer (IE only), help viewer
|
|
and problem reporting screen.</li>
|
|
<li>Removed unused image proxy code from dereferrer.</li>
|
|
</ul>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2006-3548</cvename>
|
|
<url>http://lists.horde.org/archives/announce/2006/000288.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-06-28</discovery>
|
|
<entry>2006-07-05</entry>
|
|
<modified>2010-05-12</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="f70d09cb-0c46-11db-aac7-000c6ec775d9">
|
|
<topic>mambo -- SQL injection vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>mambo</name>
|
|
<range><lt>4.5.4</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Team Mambo reports that two SQL injection
|
|
vulnerabilities have been found in Mambo. The
|
|
vulnerabilities exists due to missing sanitation of the
|
|
<code>title</code> and <code>catid</code> parameters in the
|
|
<code>weblinks.php</code> page and can lead to execution of
|
|
arbitrary SQL code.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>16775</bid>
|
|
<cvename>CVE-2006-0871</cvename>
|
|
<cvename>CVE-2006-1794</cvename>
|
|
<cvename>CVE-2006-3262</cvename>
|
|
<cvename>CVE-2006-3263</cvename>
|
|
<mlist msgid="20060617123242.1684.qmail@securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&m=115056811230529</mlist>
|
|
<url>http://secunia.com/advisories/18935/</url>
|
|
<url>http://secunia.com/advisories/20745/</url>
|
|
<url>http://www.mamboserver.com/?option=com_content&task=view&id=207</url>
|
|
<url>http://www.gulftech.org/?node=research&article_id=00104-02242006</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-06-19</discovery>
|
|
<entry>2006-07-05</entry>
|
|
<modified>2006-10-05</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="229577a8-0936-11db-bf72-00046151137e">
|
|
<topic>phpmyadmin -- cross site scripting vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>phpMyAdmin</name>
|
|
<range><lt>2.8.2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>phpmyadmin Site reports:</p>
|
|
<blockquote cite="http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-4">
|
|
<p>It was possible to craft a request that contains XSS by attacking
|
|
the "table" parameter.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-4</url>
|
|
<url>http://securitynews.ir/advisories/phpmyadmin281.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-06-30</discovery>
|
|
<entry>2006-07-03</entry>
|
|
<modified>2007-10-16</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="227475c2-09cb-11db-9156-000e0c2e438a">
|
|
<topic>webmin, usermin -- arbitrary file disclosure vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>webmin</name>
|
|
<range><lt>1.290</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>usermin</name>
|
|
<range><lt>1.220</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The webmin development team reports:</p>
|
|
<blockquote cite="http://www.webmin.com/security.html">
|
|
<p>An attacker without a login to Webmin can read the
|
|
contents of any file on the server using a specially
|
|
crafted URL. All users should upgrade to version
|
|
1.290 as soon as possible, or setup IP access control
|
|
in Webmin.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>18744</bid>
|
|
<url>http://www.webmin.com/security.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-06-30</discovery>
|
|
<entry>2006-07-02</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="d2a43243-087b-11db-bc36-0008743bf21a">
|
|
<topic>mutt -- Remote Buffer Overflow Vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>mutt</name>
|
|
<name>mutt-lite</name>
|
|
<range><le>1.4.2.1_2</le></range>
|
|
</package>
|
|
<package>
|
|
<name>mutt-devel</name>
|
|
<name>mutt-devel-lite</name>
|
|
<range><le>1.5.11_2</le></range>
|
|
</package>
|
|
<package>
|
|
<name>ja-mutt</name>
|
|
<range><le>1.4.2.1.j1</le></range>
|
|
</package>
|
|
<package>
|
|
<name>zh-mutt-devel</name>
|
|
<range><le>1.5.11_20040617</le></range>
|
|
</package>
|
|
<package>
|
|
<name>ja-mutt-devel</name>
|
|
<range><le>1.5.6.j1_2</le></range>
|
|
</package>
|
|
<package>
|
|
<name>mutt-ng</name>
|
|
<range><le>20060501</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>SecurityFocus reports:</p>
|
|
<blockquote cite="http://www.securityfocus.com/bid/18642">
|
|
<p>Mutt is prone to a remote buffer-overflow vulnerability.
|
|
This issue is due to the application's failure to properly
|
|
bounds-check user-supplied input before copying it to an
|
|
insufficiently sized memory buffer.</p>
|
|
<p>This issue may allow remote attackers to execute arbitrary
|
|
machine code in the context of the affected application.
|
|
Failed exploit attempts will likely crash the application,
|
|
denying further service to legitimate users.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>18642</bid>
|
|
<url>http://dev.mutt.org/cgi-bin/gitweb.cgi?p=mutt/.git;a=commit;h=dc0272b749f0e2b102973b7ac43dbd3908507540</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-06-26</discovery>
|
|
<entry>2006-06-30</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="1f935f61-075d-11db-822b-728b50d539a3">
|
|
<topic>Joomla -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>joomla</name>
|
|
<range><lt>1.0.10</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Joomla Site reports:</p>
|
|
<blockquote cite="http://www.joomla.org/content/view/1510/74/">
|
|
<ul>
|
|
<li>Secured "Remember Me" functionality against SQL injection
|
|
attacks</li>
|
|
<li>Secured "Related Items" module against SQL injection
|
|
attacks</li>
|
|
<li>Secured "Weblinks" submission against SQL injection
|
|
attacks</li>
|
|
<li>Secured SEF from XSS vulnerability</li>
|
|
<li>Hardened frontend submission forms against spoofing</li>
|
|
<li>Secured mosmsg from misuse</li>
|
|
<li>Hardened mosgetparam by setting variable type to integer if
|
|
default value is detected as numeric</li>
|
|
<li>Secured com_messages from XSS vulnerability</li>
|
|
<li>Secured getUserStateFromRequest() from XSS vulnerability</li>
|
|
</ul>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://secunia.com/advisories/20746/</url>
|
|
<url>http://www.joomla.org/content/view/1510/74/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-06-26</discovery>
|
|
<entry>2006-06-30</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="2be7c122-0614-11db-9156-000e0c2e438a">
|
|
<topic>hashcash -- heap overflow vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>hashcash</name>
|
|
<range><lt>1.22</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Andreas Seltenreich reports that hashcash is prone to a heap
|
|
overflow vulnerability. This vulnerability is caused by
|
|
improper checking of memory allocations within the
|
|
"array_push()" function. An attacker could trigger this
|
|
vulnerability by passing a lot of "-r" or "-j" flags from
|
|
the command line, this only applies when the application is
|
|
configured to allow command line options, or by passing a lot
|
|
of resource names when the application was started with the
|
|
"-m" flag set. This could lead to a Denial or Service or
|
|
could allow remote access to the targeted system.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://secunia.com/advisories/20800/</url>
|
|
<url>http://www.hashcash.org/source/CHANGELOG</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-06-27</discovery>
|
|
<entry>2006-06-27</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="f900bda8-0472-11db-bbf7-000c6ec775d9">
|
|
<topic>gnupg -- user id integer overflow vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>gnupg</name>
|
|
<range><lt>1.4.4</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>If GnuPG processes a userid with a very long packet length,
|
|
GnuPG can crash due to insufficient bounds check. This can
|
|
result in a denial-of-service condition or potentially
|
|
execution of arbitrary code with the privileges of the user
|
|
running GnuPG.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>18554</bid>
|
|
<cvename>CVE-2006-3082</cvename>
|
|
<mlist msgid="87psgxic5e.fsf@wheatstone.g10code.de">http://marc.theaimsgroup.com/?l=gnupg-users&m=115124706210430</mlist>
|
|
<mlist msgid="20060531115548.A2E4923E4B6@dzeta.agava.net">http://marc.theaimsgroup.com/?l=full-disclosure&m=114907659313360</mlist>
|
|
<url>http://cvs.gnupg.org/cgi-bin/viewcvs.cgi/trunk/g10/parse-packet.c?rev=4157&r1=4141&r2=4157</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-05-31</discovery>
|
|
<entry>2006-06-25</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="0a4cd819-0291-11db-bbf7-000c6ec775d9">
|
|
<cancelled/>
|
|
</vuln>
|
|
|
|
<vuln vid="09429f7c-fd6e-11da-b1cd-0050bf27ba24">
|
|
<topic>horde -- multiple parameter cross site scripting vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>horde</name>
|
|
<name>horde-php5</name>
|
|
<range><le>3.1.1</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>FrSIRT advisory ADV-2006-2356 reports:</p>
|
|
<blockquote cite="http://www.frsirt.com/english/advisories/2006/2356">
|
|
<p>Multiple vulnerabilities have been identified in Horde
|
|
Application Framework, which may be exploited by attackers
|
|
to execute arbitrary scripting code. These flaws are due
|
|
to input validation errors in the "test.php" and
|
|
"templates/problem/problem.inc" scripts that do not
|
|
validate the "url", "name", "email", "subject" and
|
|
"message" parameters, which could be exploited by
|
|
attackers to cause arbitrary scripting code to be executed
|
|
by the user's browser in the security context of an
|
|
affected Web site.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2006-2195</cvename>
|
|
<url>http://www.frsirt.com/english/advisories/2006/2356</url>
|
|
<url>http://cvs.horde.org/diff.php?f=horde%2Ftest.php&r1=1.145&r2=1.146</url>
|
|
<url>http://cvs.horde.org/diff.php?f=horde%2Ftemplates%2Fproblem%2Fproblem.inc&r1=2.25&r2=2.26</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-06-10</discovery>
|
|
<entry>2006-06-17</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="09c92f3a-fd49-11da-995c-605724cdf281">
|
|
<topic>WebCalendar -- information disclosure vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>WebCalendar</name>
|
|
<range><lt>1.0.4</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/20367/">
|
|
<p>socsam has discovered a vulnerability in WebCalendar,
|
|
which can be exploited by malicious people to bypass
|
|
certain security restrictions and disclose sensitive
|
|
information.</p>
|
|
<p>Input passed to the "includedir" parameter isn't properly
|
|
verified, before it is used in an "fopen()" call. This can
|
|
be exploited to load an arbitrary setting file from an
|
|
external web site.</p>
|
|
<p>This can further be exploited to disclose the content of
|
|
arbitrary files by defining the "user_inc" variable in a
|
|
malicious setting file.</p>
|
|
<p>Successful exploitation requires that "register_globals"
|
|
is enabled.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>18175</bid>
|
|
<cvename>CVE-2006-2762</cvename>
|
|
<url>http://www.securityfocus.com/archive/1/435379</url>
|
|
<url>http://www.securityfocus.com/archive/1/436263</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-05-30</discovery>
|
|
<entry>2006-06-16</entry>
|
|
<modified>2006-06-17</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="c611be81-fbc2-11da-9156-000e0c2e438a">
|
|
<topic>sendmail -- Incorrect multipart message handling</topic>
|
|
<affects>
|
|
<system>
|
|
<name>FreeBSD</name>
|
|
<range><ge>4.11</ge><lt>4.11_19</lt></range>
|
|
<range><ge>5.3</ge><lt>5.3_31</lt></range>
|
|
<range><ge>5.4</ge><lt>5.4_16</lt></range>
|
|
<range><ge>5.5</ge><lt>5.5_2</lt></range>
|
|
<range><ge>6.0</ge><lt>6.0_9</lt></range>
|
|
<range><ge>6.1</ge><lt>6.1_2</lt></range>
|
|
</system>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<h1>Problem Description</h1>
|
|
<p>A suitably malformed multipart MIME message can cause
|
|
sendmail to exceed predefined limits on its stack usage.</p>
|
|
<h1>Impact</h1>
|
|
<p>An attacker able to send mail to, or via, a server can cause
|
|
queued messages on the system to not be delivered, by causing
|
|
the sendmail process which handles queued messages to crash.
|
|
Note that this will not stop new messages from entering the
|
|
queue (either from local processes, or incoming via SMTP).</p>
|
|
<h1>Workaround</h1>
|
|
<p>No workaround is available, but systems which do not receive
|
|
email from untrusted sources are not vulnerable.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2006-1173</cvename>
|
|
<freebsdsa>SA-06:17.sendmail</freebsdsa>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-06-14</discovery>
|
|
<entry>2006-06-14</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="23573650-f99a-11da-994e-00142a5f241c">
|
|
<topic>dokuwiki -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>dokuwiki</name>
|
|
<range><lt>20060309_2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Multiple vulnerabilities have been reported within dokuwiki.
|
|
dokuwiki is proven vulnerable to:</p>
|
|
<ul>
|
|
<li>arbitrary PHP code insertion via spellcheck module,</li>
|
|
<li>XSS attack via "Update your account profile,"</li>
|
|
<li>bypassing of ACL controls when enabled.</li>
|
|
</ul>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://bugs.splitbrain.org/index.php?do=details&id=820</url>
|
|
<url>http://bugs.splitbrain.org/index.php?do=details&id=823</url>
|
|
<url>http://bugs.splitbrain.org/index.php?do=details&id=825</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-05-31</discovery>
|
|
<entry>2006-06-11</entry>
|
|
<modified>2006-06-12</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="107e2ee5-f941-11da-b1fa-020039488e34">
|
|
<topic>libxine -- buffer overflow vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>libxine</name>
|
|
<range><lt>1.1.1_6</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A Secunia Advisory reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/20369">
|
|
<p>Federico L. Bossi Bonin has discovered a weakness in xine-lib,
|
|
which can be exploited by malicious people to crash certain
|
|
applications on a user's system.</p>
|
|
<p>The weakness is cause due to a heap corruption within the
|
|
"xineplug_inp_http.so" plugin when handling an overly large
|
|
reply from the HTTP server. This can be exploited to crash
|
|
an application that uses the plugin (e.g. gxine).</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://secunia.com/advisories/20369</url>
|
|
<cvename>CVE-2006-2802</cvename>
|
|
<bid>18187</bid>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-05-31</discovery>
|
|
<entry>2006-06-11</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="cf3b9a96-f7bb-11da-9156-000e0c2e438a">
|
|
<topic>smbfs -- chroot escape</topic>
|
|
<affects>
|
|
<system>
|
|
<name>FreeBSD</name>
|
|
<range><ge>4.10</ge><lt>4.10_24</lt></range>
|
|
<range><ge>4.11</ge><lt>4.11_18</lt></range>
|
|
<range><ge>5.3</ge><lt>5.3_30</lt></range>
|
|
<range><ge>5.4</ge><lt>5.4_15</lt></range>
|
|
<range><ge>5.5</ge><lt>5.5_1</lt></range>
|
|
<range><ge>6.0</ge><lt>6.0_8</lt></range>
|
|
<range><ge>6.1</ge><lt>6.1_1</lt></range>
|
|
</system>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<h1>Problem Description</h1>
|
|
<p>smbfs does not properly sanitize paths containing a backslash
|
|
character; in particular the directory name '..\' is
|
|
interpreted as the parent directory by the SMB/CIFS server,
|
|
but smbfs handles it in the same manner as any other
|
|
directory.</p>
|
|
<h1>Impact</h1>
|
|
<p>When inside a chroot environment which resides on a smbfs
|
|
mounted file-system it is possible for an attacker to escape
|
|
out of this chroot to any other directory on the smbfs
|
|
mounted file-system.</p>
|
|
<h1>Workaround</h1>
|
|
<p>Mount the smbfs file-systems which need to be used with
|
|
chroot on top, in a way so the chroot directory is exactly on
|
|
the mount point and not a sub directory</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2006-2654</cvename>
|
|
<freebsdsa>SA-06:16.smbfs</freebsdsa>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-05-31</discovery>
|
|
<entry>2006-06-09</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="0ac1aace-f7b9-11da-9156-000e0c2e438a">
|
|
<topic>ypserv -- Inoperative access controls in ypserv</topic>
|
|
<affects>
|
|
<system>
|
|
<name>FreeBSD</name>
|
|
<range><ge>5.3</ge><lt>5.3_30</lt></range>
|
|
<range><ge>5.4</ge><lt>5.4_15</lt></range>
|
|
<range><ge>5.5</ge><lt>5.5_1</lt></range>
|
|
<range><ge>6.0</ge><lt>6.0_8</lt></range>
|
|
<range><ge>6.1</ge><lt>6.1_1</lt></range>
|
|
</system>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<h1>Problem Description</h1>
|
|
<p>There are two documented methods of restricting access to
|
|
NIS maps through ypserv(8): through the use of the
|
|
/var/yp/securenets file, and through the /etc/hosts.allow file.
|
|
While both mechanisms are implemented in the server, a change
|
|
in the build process caused the "securenets" access restrictions
|
|
to be inadvertantly disabled.</p>
|
|
<h1>Impact</h1>
|
|
<p>ypserv(8) will not load or process any of the networks or
|
|
hosts specified in the /var/yp/securenets file, rendering
|
|
those access controls ineffective.</p>
|
|
<h1>Workaround</h1>
|
|
<p>One possible workaround is to use /etc/hosts.allow for access
|
|
control, as shown by examples in that file.</p>
|
|
<p>Another workaround is to use a firewall (e.g., ipfw(4),
|
|
ipf(4), or pf(4)) to limit access to RPC functions from
|
|
untrusted systems or networks, but due to the complexities of
|
|
RPC, it might be difficult to create a set of firewall rules
|
|
which accomplish this without blocking all access to the
|
|
machine in question.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2006-2655</cvename>
|
|
<freebsdsa>SA-06:15.ypserv</freebsdsa>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-05-31</discovery>
|
|
<entry>2006-06-09</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="ec2f2ff5-f710-11da-9156-000e0c2e438a">
|
|
<topic>freeradius -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>freeradius</name>
|
|
<range><ge>1.0.0</ge><le>1.0.4</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The freeradious development team reports:</p>
|
|
<blockquote cite="http://www.freeradius.org/security.html">
|
|
<p>Multiple issues exist with version 1.0.4, and all prior
|
|
versions of the server. Externally exploitable
|
|
vulnerabilities exist only for sites that use the
|
|
rlm_sqlcounter module. Those sites may be vulnerable to
|
|
SQL injection attacks, similar to the issues noted below.
|
|
All sites that have not deployed the rlm_sqlcounter module
|
|
are not vulnerable to external exploits.</p>
|
|
<p>The issues are:<br/>
|
|
SQL Injection attack in the rlm_sqlcounter module.<br/>
|
|
Buffer overflow in the rlm_sqlcounter module, that may cause
|
|
a server crash. <br/>
|
|
Buffer overflow while expanding %t, that may cause a server
|
|
crash.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>17171</bid>
|
|
<cvename>CVE-2005-4744</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-09-09</discovery>
|
|
<entry>2006-06-08</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="1a216dfd-f710-11da-9156-000e0c2e438a">
|
|
<topic>freeradius -- authentication bypass vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>freeradius</name>
|
|
<range><gt>1.0.0</gt><le>1.1.0</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The freeradius development team reports:</p>
|
|
<blockquote cite="http://www.freeradius.org/security.html">
|
|
<p>A validation issue exists with the EAP-MSCHAPv2 module
|
|
in all versions from 1.0.0 (where the module first
|
|
appeared) to 1.1.0. Insufficient input validation was being
|
|
done in the EAP-MSCHAPv2 state machine. A malicious
|
|
attacker could manipulate their EAP-MSCHAPv2 client state
|
|
machine to potentially convince the server to bypass
|
|
authentication checks. This bypassing could also result
|
|
in the server crashing</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>17293</bid>
|
|
<cvename>CVE-2006-1354</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-06-03</discovery>
|
|
<entry>2006-06-08</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="00784d6e-f4ce-11da-87a1-000c6ec775d9">
|
|
<topic>squirrelmail -- plugin.php local file inclusion vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>squirrelmail</name>
|
|
<range><lt>1.4.6_1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The SquirrelMail Project Team reports:</p>
|
|
<blockquote cite="http://www.squirrelmail.org/security/issue/2006-06-01">
|
|
<p>A security issue has been uncovered in
|
|
functions/plugin.php that could allow a remote user to
|
|
access local files on the server without requiring
|
|
login. This issue manifests itself if register_globals is
|
|
enabled, and magic_quotes_gpc is disabled.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://www.squirrelmail.org/security/issue/2006-06-01</url>
|
|
<url>http://secunia.com/advisories/20406/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-06-01</discovery>
|
|
<entry>2006-06-05</entry>
|
|
<modified>2006-06-06</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="af8dba15-f4cc-11da-87a1-000c6ec775d9">
|
|
<topic>dokuwiki -- spellchecker remote PHP code execution</topic>
|
|
<affects>
|
|
<package>
|
|
<name>dokuwiki</name>
|
|
<range><lt>20060309_1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Stefan Esser reports:</p>
|
|
<blockquote cite="http://www.hardened-php.net/advisory_042006.119.html">
|
|
<p>During the evaluation of DokuWiki for a german/korean
|
|
wiki of mine a flaw in DokuWiki's spellchecker was
|
|
discovered, that allows injecting arbitrary PHP commands,
|
|
by requesting a spellcheck on PHP commands in 'complex
|
|
curly syntax'.</p>
|
|
<p>Because the spellchecker is written as part of the AJAX
|
|
functionality of DokuWiki, it can be directly called by
|
|
any website visitor, without the need for a wiki
|
|
account.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://www.hardened-php.net/advisory_042006.119.html</url>
|
|
<url>http://bugs.splitbrain.org/index.php?do=details&id=823</url>
|
|
<url>http://secunia.com/advisories/20429/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-06-05</discovery>
|
|
<entry>2006-06-05</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="40a0185f-ec32-11da-be02-000c6ec775d9">
|
|
<topic>drupal -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>drupal</name>
|
|
<range><lt>4.6.7</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Drupal team reports:</p>
|
|
<blockquote cite="http://drupal.org/node/65357">
|
|
<p>Vulnerability: SQL injection</p>
|
|
<p>A security vulnerability in the database layer allowed
|
|
certain queries to be submitted to the database without
|
|
going through Drupal's query sanitizer.</p>
|
|
</blockquote>
|
|
<blockquote cite="http://drupal.org/node/65409">
|
|
<p>Vulnerability: Execution of arbitrary files</p>
|
|
<p>Certain -- alas, typical -- configurations of Apache
|
|
allows execution of carefully named arbitrary scripts in
|
|
the files directory. Drupal now will attempt to
|
|
automatically create a .htaccess file in your "files"
|
|
directory to protect you.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2006-2742</cvename>
|
|
<cvename>CVE-2006-2743</cvename>
|
|
<url>http://drupal.org/node/65357</url>
|
|
<url>http://drupal.org/node/65409</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-05-18</discovery>
|
|
<entry>2006-06-05</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="7f8cecea-f199-11da-8422-00123ffe8333">
|
|
<topic>MySQL -- SQL-injection security vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>mysql-server</name>
|
|
<range><ge>5.1</ge><le>5.1.9</le></range>
|
|
<range><ge>5.0</ge><lt>5.0.22</lt></range>
|
|
<range><ge>4.1</ge><lt>4.1.20</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>MySQL reports:</p>
|
|
<blockquote cite="http://lists.mysql.com/announce/364">
|
|
<p>An SQL-injection security hole has been found in multibyte
|
|
encoding processing. An SQL-injection security hole can include a
|
|
situation whereby when inserting user supplied data into a
|
|
database, the user might inject his own SQL statements that the
|
|
server will execute. With regards to this vulnerability discovered,
|
|
when character set unaware escaping is used (e.g., addslashes() in
|
|
PHP), it is possible to bypass it in some multibyte character sets
|
|
(e.g., SJIS, BIG5 and GBK). As a result, a function like
|
|
addslashes() is not able to prevent SQL injection attacks. It is
|
|
impossible to fix this on the server side. The best solution is for
|
|
applications to use character set aware escaping offered in a
|
|
function like mysql_real_escape().</p>
|
|
<p>Workarounds:</p>
|
|
<p>One can use NO_BACKSLASH_ESCAPES mode as a workaround for a bug
|
|
in mysql_real_escape_string(), if you cannot upgrade your server
|
|
for some reason. It will enable SQL standard compatibility mode,
|
|
where backslash is not considered a special character.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://lists.mysql.com/announce/364</url>
|
|
<url>http://lists.mysql.com/announce/365</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-05-31</discovery>
|
|
<entry>2006-06-01</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="4913886c-e875-11da-b9f4-00123ffe8333">
|
|
<topic>MySQL -- Information Disclosure and Buffer Overflow Vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>mysql-server</name>
|
|
<range><gt>4.0</gt><lt>4.0.27</lt></range>
|
|
<range><gt>4.1</gt><lt>4.1.19</lt></range>
|
|
<range><gt>5.1</gt><le>5.1.9</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/19929/">
|
|
<p>MySQL have some vulnerabilities, which can be exploited by
|
|
malicious users to disclose potentially sensitive information
|
|
and compromise a vulnerable system.</p>
|
|
<p>1) An error within the code that generates an error response
|
|
to an invalid COM_TABLE_DUMP packet can be exploited by an
|
|
authenticated client to disclosure certain memory content of the
|
|
server process.</p>
|
|
<p>2) A boundary error within the handling of specially crafted
|
|
invalid COM_TABLE_DUMP packets can be exploited by an authenticated
|
|
client to cause a buffer overflow and allows arbitrary code
|
|
execution.</p>
|
|
<p>3) An error within the handling of malformed login packets can be
|
|
exploited to disclosure certain memory content of the server
|
|
process in the error messages.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2006-1516</cvename>
|
|
<cvename>CVE-2006-1517</cvename>
|
|
<cvename>CVE-2006-1518</cvename>
|
|
<certvu>602457</certvu>
|
|
<url>http://www.wisec.it/vulns.php?page=7</url>
|
|
<url>http://www.wisec.it/vulns.php?page=8</url>
|
|
<url>http://dev.mysql.com/doc/refman/4.1/en/news-4-0-27.html</url>
|
|
<url>http://dev.mysql.com/doc/refman/4.1/en/news-4-1-19.html</url>
|
|
<url>http://dev.mysql.com/doc/refman/5.1/en/news-5-1-10.html</url>
|
|
<url>http://secunia.com/advisories/19929/</url>
|
|
<url>http://www.vuxml.org/freebsd/a8d8713e-dc83-11da-a22b-000c6ec775d9.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-05-02</discovery>
|
|
<entry>2006-06-01</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="c0171f59-ea8a-11da-be02-000c6ec775d9">
|
|
<topic>frontpage -- cross site scripting vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>frontpage</name>
|
|
<name>mod_frontpage13</name>
|
|
<name>mod_frontpage20</name>
|
|
<name>mod_frontpage21</name>
|
|
<name>mod_frontpage22</name>
|
|
<range><lt>5.0.2.4803</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Esteban Martinez Fayo reports:</p>
|
|
<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&m=114487846329000">
|
|
<p>The FrontPage Server Extensions 2002 (included in Windows
|
|
Sever 2003 IIS 6.0 and available as a separate download
|
|
for Windows 2000 and XP) has a web page
|
|
/_vti_bin/_vti_adm/fpadmdll.dll that is used for
|
|
administrative purposes. This web page is vulnerable to
|
|
cross site scripting attacks allowing an attacker to run
|
|
client-side script on behalf of an FPSE user. If the
|
|
victim is an administrator, the attacker could take
|
|
complete control of a Front Page Server Extensions 2002
|
|
server.</p>
|
|
<p>To exploit the vulnerability an attacker can send a
|
|
specially crafted e-mail message to a FPSE user and then
|
|
persuade the user to click a link in the e-mail
|
|
message.</p>
|
|
<p>In addition, this vulnerability can be exploited if an
|
|
attacker hosts a malicious website and persuade the user
|
|
to visit it.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2006-0015</cvename>
|
|
<mlist msgid="0e3f01c65e78$93c00800$de00a8c0@rigel">http://marc.theaimsgroup.com/?l=bugtraq&m=114487846329000</mlist>
|
|
<url>http://www.microsoft.com/technet/security/bulletin/MS06-017.mspx</url>
|
|
<url>http://www.rtr.com/fpsupport/fpse_release_may_2_2006.htm</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-04-12</discovery>
|
|
<entry>2006-05-23</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="72d8df84-ea6d-11da-8a53-00123ffe8333">
|
|
<topic>cscope -- buffer overflow vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>cscope</name>
|
|
<range><lt>15.5_2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Jason Duell reports:</p>
|
|
<blockquote cite="http://sourceforge.net/tracker/index.php?func=detail&aid=1064875&group_id=4664&atid=104664">
|
|
<p>Cscope contains an alarming number of buffer overflow
|
|
vulnerabilities. By a rough count, there are at least 48 places
|
|
where we blindly sprintf() a file name into a fixed-length buffer
|
|
of size PATHLEN without checking to see if the file's name
|
|
is <= PATHLEN. We do similar things with environment variable
|
|
values.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-2541</cvename>
|
|
<url>http://sourceforge.net/tracker/index.php?func=detail&aid=1064875&group_id=4664&atid=104664</url>
|
|
<url>http://secunia.com/advisories/13237</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-11-11</discovery>
|
|
<entry>2006-05-23</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="0b628470-e9a6-11da-b9f4-00123ffe8333">
|
|
<topic>coppermine -- Multiple File Extensions Vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>coppermine</name>
|
|
<range><lt>1.4.6</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/20211/">
|
|
<p>Coppermine Photo Gallery have a vulnerability, which can be
|
|
exploited by malicious users to compromise a vulnerable system.</p>
|
|
<p>The vulnerability is caused due to an error in the handling of
|
|
file uploads where a filename has multiple file extensions. This
|
|
can be exploited to upload malicious script files inside the web
|
|
root (e.g. a PHP script).</p>
|
|
<p>Successful exploitation may allow execution of script code
|
|
depending on the HTTP server configuration (it requires e.g. an
|
|
Apache server with the "mod_mime" module installed).</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://sourceforge.net/project/shownotes.php?group_id=89658&release_id=418266</url>
|
|
<url>http://secunia.com/advisories/20211/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-05-22</discovery>
|
|
<entry>2006-05-22</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="6738977b-e9a5-11da-b9f4-00123ffe8333">
|
|
<topic>coppermine -- "file" Local File Inclusion Vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>coppermine</name>
|
|
<range><lt>1.4.5</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/19665/">
|
|
<p>Coppermine Photo Gallery have a vulnerability, which can be
|
|
exploited by malicious people to disclose sensitive
|
|
information.</p>
|
|
<p>Input passed to the "file" parameter in "index.php" isn't properly
|
|
verified, before it is used to include files. This can be exploited
|
|
to include arbitrary files from local resources.</p>
|
|
<p>Example:
|
|
http://[host]/index.php?file=.//././/././/././/./[file]%00</p>
|
|
<p>Successful exploitation requires that "magic_quotes_gpc" is
|
|
disabled.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2006-1909</cvename>
|
|
<url>http://coppermine-gallery.net/forum/index.php?topic=30655.0</url>
|
|
<url>http://myimei.com/security/2006-04-14/copperminephotogallery144-plugininclusionsystemindexphp-remotefileinclusion-attack.html</url>
|
|
<url>http://secunia.com/advisories/19665/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-04-19</discovery>
|
|
<entry>2006-05-22</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="77cceaef-e9a4-11da-b9f4-00123ffe8333">
|
|
<topic>coppermine -- File Inclusion Vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>coppermine</name>
|
|
<range><lt>1.4.4</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/18941/">
|
|
<p>Coppermine Photo Gallery have a vulnerability, which can be
|
|
exploited by malicious people and by malicious users to compromise
|
|
a vulnerable system.</p>
|
|
<p>1) Input passed to the "lang" parameter in include/init.inc.php
|
|
isn't properly verified, before it is used to include files. This
|
|
can be exploited to include arbitrary files from local resources.
|
|
The vulnerability can be further exploited by users who are allowed
|
|
to upload image files to execute arbitrary PHP code.</p>
|
|
<p>2) Input passed to the "f" parameter in docs/showdoc.php isn't
|
|
properly verified, before it is used to include files. This can be
|
|
exploited to include arbitrary files from local resources on the
|
|
Windows platform, and remote files from Windows shared folders.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2006-0872</cvename>
|
|
<cvename>CVE-2006-0873</cvename>
|
|
<url>http://retrogod.altervista.org/cpg_143_adv.html</url>
|
|
<url>http://secunia.com/advisories/18941/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-02-20</discovery>
|
|
<entry>2006-05-22</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="2ecd02e2-e864-11da-b9f4-00123ffe8333">
|
|
<topic>phpmyadmin -- XSRF vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>phpMyAdmin</name>
|
|
<range><lt>2.8.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>phpMyAdmin security team reports:</p>
|
|
<blockquote cite="http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-3">
|
|
<p>It was possible to inject arbitrary SQL commands by forcing an
|
|
authenticated user to follow a crafted link.</p>
|
|
<p>Such issue is quite common in many PHP applications and users
|
|
should take care what links they follow. We consider these
|
|
vulnerabilities to be quite dangerous.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2006-1804</cvename>
|
|
<url>http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-3</url>
|
|
<url>http://secunia.com/advisories/19659</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-05-20</discovery>
|
|
<entry>2006-05-21</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="4645b98c-e46e-11da-9ae7-00123fcc6e5c">
|
|
<topic>vnc -- authentication bypass vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>vnc</name>
|
|
<range><eq>4.1.1</eq></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>RealVNC is susceptible to an authentication-bypass vulnerability.
|
|
A malicious VNC client can cause a VNC server to allow it to connect
|
|
without any authentication regardless of the authentication settings
|
|
configured in the server. Exploiting this issue allows attackers to
|
|
gain unauthenticated, remote access to the VNC servers.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>17978</bid>
|
|
<mlist>http://www.securityfocus.com/archive/1/433994/30/0/threaded</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-05-15</discovery>
|
|
<entry>2006-05-18</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="6d78202e-e2f9-11da-8674-00123ffe8333">
|
|
<topic>phpldapadmin -- Cross-Site Scripting and Script Insertion vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>phpldapadmin098</name>
|
|
<range><lt>0.9.8.3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/19747/">
|
|
<p>phpLDAPadmin have some vulnerabilities, which can be exploited by
|
|
malicious users to conduct script insertion attacks and by
|
|
malicious people to conduct cross-site scripting attacks.</p>
|
|
<p>1) Some input isn't properly sanitised before being returned to
|
|
the user. This can be exploited to execute arbitrary HTML and
|
|
script code in a user's browser session in context of an affected
|
|
site.</p>
|
|
<p>2) Input passed to the "Container DN", "Machine Name", and "UID
|
|
Number" parameters in "template_engine.php" isn't properly
|
|
sanitised before being used. This can be exploited to inject
|
|
arbitrary HTML and script code, which will be executed in a user's
|
|
browser session in context of an affected site when the malicious
|
|
user data is viewed.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2006-2016</cvename>
|
|
<url>http://pridels.blogspot.com/2006/04/phpldapadmin-multiple-vuln.html</url>
|
|
<url>http://www.frsirt.com/english/advisories/2006/1450</url>
|
|
<url>http://secunia.com/advisories/19747/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-04-21</discovery>
|
|
<entry>2006-05-14</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="a86f30e7-dce7-11da-bf3f-02e081235dab">
|
|
<topic>fswiki -- XSS vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>fswiki</name>
|
|
<range><lt>3.5.11</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>JVN reports:</p>
|
|
<blockquote cite="http://jvn.jp/jp/JVN%2335274905/">
|
|
<p>FreeStyleWiki has XSS vulnerability.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://jvn.jp/jp/JVN%2335274905/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-04-18</discovery>
|
|
<entry>2006-05-06</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="a8d8713e-dc83-11da-a22b-000c6ec775d9">
|
|
<topic>mysql50-server -- COM_TABLE_DUMP arbitrary code execution</topic>
|
|
<affects>
|
|
<package>
|
|
<name>mysql-server</name>
|
|
<range><gt>5.0</gt><lt>5.0.21</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Stefano Di Paola reports:</p>
|
|
<blockquote cite="http://www.wisec.it/vulns.php?page=8">
|
|
<p>An authenticated user could remotely execute arbitrary
|
|
commands by taking advantage of a stack overflow.</p>
|
|
<p>To take advantage of these flaws an attacker should have
|
|
direct access to MySQL server communication layer (port
|
|
3306 or unix socket). But if used in conjuction with some
|
|
web application flaws (i.e. php code injection) an
|
|
attacker could use socket programming (i.e. php sockets)
|
|
to gain access to that layer.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2006-1518</cvename>
|
|
<url>http://www.wisec.it/vulns.php?page=8</url>
|
|
<mlist msgid="1146577257.5679.217.camel@first">http://marc.theaimsgroup.com/?l=bugtraq&m=114659633220473</mlist>
|
|
<url>http://dev.mysql.com/doc/refman/5.0/en/news-5-0-21.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-05-02</discovery>
|
|
<entry>2006-05-06</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="2df297a2-dc74-11da-a22b-000c6ec775d9">
|
|
<topic>awstats -- arbitrary command execution vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>awstats</name>
|
|
<range><lt>6.5_2,1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>OS Reviews reports:</p>
|
|
<blockquote cite="http://www.osreviews.net/reviews/comm/awstats">
|
|
<p>If the update of the stats via web front-end is allowed,
|
|
a remote attacker can execute arbitrary code on the server
|
|
using a specially crafted request involving the migrate
|
|
parameter. Input starting with a pipe character ("|")
|
|
leads to an insecure call to Perl's open function and the
|
|
rest of the input being executed in a shell. The code is
|
|
run in the context of the process running the AWStats
|
|
CGI.</p>
|
|
<p>Arbitrary code can be executed by uploading a specially
|
|
crafted configuration file if an attacker can put a file
|
|
on the server with chosen file name and content (e.g. by
|
|
using an FTP account on a shared hosting server). In this
|
|
configuration file, the LogFile directive can be used to
|
|
execute shell code following a pipe character. As above,
|
|
an open call on unsanitized input is the source of this
|
|
vulnerability.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://awstats.sourceforge.net/awstats_security_news.php</url>
|
|
<url>http://secunia.com/advisories/19969/</url>
|
|
<url>http://www.osreviews.net/reviews/comm/awstats</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-05-03</discovery>
|
|
<entry>2006-05-05</entry>
|
|
<modified>2006-11-15</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="d9dc2697-dadf-11da-912f-00123ffe8333">
|
|
<topic>phpwebftp -- "language" Local File Inclusion</topic>
|
|
<affects>
|
|
<package>
|
|
<name>phpwebftp</name>
|
|
<range><lt>3.3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/19706/">
|
|
<p>phpWebFTP have a vulnerability, which can be exploited by
|
|
malicious people to disclose sensitive information.</p>
|
|
<p>Input passed to the "language" parameter in index.php isn't
|
|
properly verified, before it is used to include files. This can be
|
|
exploited to include arbitrary files from local resources.</p>
|
|
<p>Successful exploitation requires that "magic_quotes_gpc" is
|
|
disabled.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2006-1812</cvename>
|
|
<cvename>CVE-2006-1813</cvename>
|
|
<url>https://sourceforge.net/forum/forum.php?forum_id=566199</url>
|
|
<url>http://secunia.com/advisories/19706/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-04-18</discovery>
|
|
<entry>2006-05-03</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="e2476979-da74-11da-a67b-0013d4a4a40e">
|
|
<topic>firefox -- denial of service vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>firefox</name>
|
|
<range><gt>1.5.*,1</gt><lt>1.5.0.3,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-firefox</name>
|
|
<range><lt>1.5.0.3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A Mozilla Foundation Security Advisory reports for
|
|
deleted object reference when designMode="on"</p>
|
|
<blockquote cite="http://www.mozilla.org/security/announce/2006/mfsa2006-30.html">
|
|
<p>Martijn Wargers and Nick Mott each described crashes that
|
|
were discovered to ultimately stem from the same root cause:
|
|
attempting to use a deleted controller context when designMode
|
|
was turned on. This generally results in crashing the browser,
|
|
but in theory references to deleted objects can be abused to
|
|
run malicious code.</p>
|
|
<p>"splices" reported the same crash at the fan site MozillaZine and
|
|
on Bugtraq, incorrectly describing it as a buffer overflow.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2006-1993</cvename>
|
|
<url>http://www.mozilla.org/security/announce/2006/mfsa2006-30.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-05-02</discovery>
|
|
<entry>2006-05-03</entry>
|
|
<modified>2006-05-05</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="400d9d22-d6c5-11da-a14b-00123ffe8333">
|
|
<topic>trac -- Wiki Macro Script Insertion Vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>trac</name>
|
|
<name>ja-trac</name>
|
|
<range><lt>0.9.5</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/19870/">
|
|
<p>A vulnerability has been reported, which can be exploited by
|
|
malicious people to conduct script insertion attacks.</p>
|
|
<p>Input passed using the wiki macro isn't properly sanitised before
|
|
being used. This can be exploited to inject arbitrary HTML and
|
|
script code, which will be executed in a user's browser session in
|
|
context of an affected site when the malicious user data is
|
|
viewed.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://projects.edgewall.com/trac/wiki/ChangeLog</url>
|
|
<url>http://jvn.jp/jp/JVN%2384091359/index.html</url>
|
|
<url>http://secunia.com/advisories/19870/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-04-28</discovery>
|
|
<entry>2006-05-02</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="af2a60ed-da3e-11da-93e0-00123ffe8333">
|
|
<cancelled/>
|
|
</vuln>
|
|
|
|
<vuln vid="b088bf48-da3b-11da-93e0-00123ffe8333">
|
|
<topic>clamav -- Freshclam HTTP Header Buffer Overflow Vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>clamav</name>
|
|
<range><ge>0.80</ge><lt>0.88.2</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>clamav-devel</name>
|
|
<range><ge>20040826</ge><lt>20060502</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/19880/">
|
|
<p>A vulnerability has been reported in ClamAV, which can be
|
|
exploited by malicious people to cause a DoS (Denial of Service)
|
|
and potentially to compromise a vulnerable system.</p>
|
|
<p>The vulnerability is caused due to a boundary error within the
|
|
HTTP client in the Freshclam command line utility. This can be
|
|
exploited to cause a stack-based buffer overflow when the HTTP
|
|
headers received from a web server exceeds 8KB.</p>
|
|
<p>Successful exploitation requires that Freshclam is used to
|
|
download virus signature updates from a malicious mirror web
|
|
server e.g. via DNS poisoning.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2006-1989</cvename>
|
|
<url>http://www.clamav.net/security/0.88.2.html</url>
|
|
<url>http://secunia.com/advisories/19880/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-05-01</discovery>
|
|
<entry>2006-05-03</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="f4af098d-d921-11da-ad4a-00123ffe8333">
|
|
<topic>jabberd -- SASL Negotiation Denial of Service Vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>jabberd</name>
|
|
<range><lt>2.0.11</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/19281/">
|
|
<p>A vulnerability has been reported in jabberd, which can be
|
|
exploited by malicious people to cause a DoS (Denial of
|
|
Service).</p>
|
|
<p>The vulnerability is caused due to an error within the handling
|
|
of SASL negotiation. This can be exploited to cause a crash by
|
|
sending a "response" stanza before an "auth" stanza.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2006-1329</cvename>
|
|
<url>http://article.gmane.org/gmane.network.jabber.admin/27372</url>
|
|
<url>http://jabberstudio.org/projects/jabberd2/releases/view.php?id=826</url>
|
|
<url>http://secunia.com/advisories/19281/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-03-20</discovery>
|
|
<entry>2006-05-01</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="79c1154d-d5a5-11da-8098-00123ffe8333">
|
|
<topic>cacti -- ADOdb "server.php" Insecure Test Script Security Issue</topic>
|
|
<affects>
|
|
<package>
|
|
<name>cacti</name>
|
|
<range><lt>0.8.6h</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/18276/">
|
|
<p>Cacti have a security issue, which can be exploited by malicious
|
|
people to execute arbitrary SQL code and potentially compromise a
|
|
vulnerable system.</p>
|
|
<p>The problem is caused due to the presence of the insecure
|
|
"server.php" test script.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://secunia.com/advisories/18276/</url>
|
|
<url>http://secunia.com/advisories/17418/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-01-09</discovery>
|
|
<entry>2006-04-27</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="dc930435-d59f-11da-8098-00123ffe8333">
|
|
<topic>amaya -- Attribute Value Buffer Overflow Vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>amaya</name>
|
|
<range><lt>9.5</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/19670/">
|
|
<p>Amaya have two vulnerabilities, which can be exploited by
|
|
malicious people to compromise a user's system.</p>
|
|
<p>The vulnerabilities are caused due to boundary errors within the
|
|
parsing of various attribute values. This can be exploited to cause
|
|
stack-based buffer overflows when a user opens a specially crafted
|
|
HTML document containing certain tags with overly long attribute
|
|
values.</p>
|
|
<p>Successful exploitation allows execution of arbitrary code.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2006-1900</cvename>
|
|
<url>http://morph3us.org/advisories/20060412-amaya-94.txt</url>
|
|
<url>http://morph3us.org/advisories/20060412-amaya-94-2.txt</url>
|
|
<url>http://secunia.com/advisories/19670/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-04-14</discovery>
|
|
<entry>2006-04-27</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="116b0820-d59c-11da-8098-00123ffe8333">
|
|
<topic>lifetype -- ADOdb "server.php" Insecure Test Script Security Issue</topic>
|
|
<affects>
|
|
<package>
|
|
<name>lifetype</name>
|
|
<range><lt>1.0.3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/19699/">
|
|
<p>A security issue has been discovered in LifeType, which can be
|
|
exploited by malicious people to execute arbitrary SQL code and
|
|
potentially compromise a vulnerable system.</p>
|
|
<p>The problem is caused due to the presence of the insecure
|
|
"server.php" test script.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2006-0146</cvename>
|
|
<url>http://secunia.com/advisories/19699/</url>
|
|
<url>http://secunia.com/advisories/17418/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-04-19</discovery>
|
|
<entry>2006-04-27</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="21c223f2-d596-11da-8098-00123ffe8333">
|
|
<topic>ethereal -- Multiple Protocol Dissector Vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>ethereal</name>
|
|
<name>ethereal-lite</name>
|
|
<name>tethereal</name>
|
|
<name>tethereal-lite</name>
|
|
<range><ge>0.8.5</ge><lt>0.99.0</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/19769/">
|
|
<p>Multiple vulnerabilities have been reported in Ethereal, which
|
|
can be exploited by malicious people to cause a DoS (Denial of
|
|
Service) or compromise a vulnerable system.</p>
|
|
<p>The vulnerabilities are caused due to various types of errors
|
|
including boundary errors, an off-by-one error, an infinite loop
|
|
error, and several unspecified errors in a multitude of protocol
|
|
dissectors.</p>
|
|
<p>Successful exploitation causes Ethereal to stop responding,
|
|
consume a large amount of system resources, crash, or execute
|
|
arbitrary code.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2006-1932</cvename>
|
|
<cvename>CVE-2006-1933</cvename>
|
|
<cvename>CVE-2006-1934</cvename>
|
|
<cvename>CVE-2006-1935</cvename>
|
|
<cvename>CVE-2006-1936</cvename>
|
|
<cvename>CVE-2006-1937</cvename>
|
|
<cvename>CVE-2006-1938</cvename>
|
|
<cvename>CVE-2006-1939</cvename>
|
|
<cvename>CVE-2006-1940</cvename>
|
|
<url>http://www.ethereal.com/appnotes/enpa-sa-00023.html</url>
|
|
<url>http://secunia.com/advisories/19769/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-04-25</discovery>
|
|
<entry>2006-04-27</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="8b683bea-d49c-11da-a672-000e0c2e438a">
|
|
<topic>asterisk -- denial of service vulnerability, local system access</topic>
|
|
<affects>
|
|
<package>
|
|
<name>asterisk</name>
|
|
<range><lt>1.2.7</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Emmanouel Kellenis reports a denial of service vulnerability
|
|
within asterisk. The vulnerability is caused by a buffer
|
|
overflow in "format_jpeg.c". A large JPEG image could
|
|
trigger this bug, potentially allowing a local attacker to
|
|
execute arbitrary code.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>17561</bid>
|
|
<cvename>CVE-2006-1827</cvename>
|
|
<url>http://www.cipher.org.uk/index.php?p=advisories/Asterisk_Codec_Integer_Overflow_07-04-2006.advisory</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-04-07</discovery>
|
|
<entry>2006-04-25</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="a813a219-d2d4-11da-a672-000e0c2e438a">
|
|
<topic>zgv, xzgv -- heap overflow vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>zgv</name>
|
|
<range><lt>5.9_1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>xzgv</name>
|
|
<range><lt>0.9</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Gentoo reports:</p>
|
|
<blockquote cite="http://www.gentoo.org/security/en/glsa/glsa-200604-10.xml">
|
|
<p>Andrea Barisani of Gentoo Linux discovered xzgv and zgv
|
|
allocate insufficient memory when rendering images with
|
|
more than 3 output components, such as images using the
|
|
YCCK or CMYK colour space. When xzgv or zgv attempt to
|
|
render the image, data from the image overruns a heap
|
|
allocated buffer.</p>
|
|
<p>An attacker may be able to construct a malicious image that
|
|
executes arbitrary code with the permissions of the xzgv or
|
|
zgv user when attempting to render the image.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>17409</bid>
|
|
<cvename>CVE-2006-1060</cvename>
|
|
<url>http://www.gentoo.org/security/en/glsa/glsa-200604-10.xml</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-04-21</discovery>
|
|
<entry>2006-04-23</entry>
|
|
<modified>2010-03-22</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="86cc5c6f-d2b4-11da-a672-000e0c2e438a">
|
|
<topic>crossfire-server -- denial of service and remote code execution vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>crossfire-server</name>
|
|
<range><lt>1.9.0</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>FRSIRT reports:</p>
|
|
<blockquote cite="http://www.frsirt.com/english/advisories/2006/0760">
|
|
<p>A vulnerability has been identified in CrossFire, which
|
|
could be exploited by remote attackers to execute arbitrary
|
|
commands or cause a denial of service. This flaw is due to
|
|
a buffer overflow error in the "oldsocketmode" module that
|
|
fails to properly handle overly large requests, which could
|
|
be exploited by a malicious client to crash or compromise a
|
|
vulnerable system.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>16883</bid>
|
|
<cvename>CVE-2006-1010</cvename>
|
|
<url>http://www.frsirt.com/english/advisories/2006/0760</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-02-28</discovery>
|
|
<entry>2006-04-23</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="8cfb6f42-d2b0-11da-a672-000e0c2e438a">
|
|
<topic>p5-DBI -- insecure temporary file creation vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>p5-DBI-137</name>
|
|
<range><ge>0</ge></range>
|
|
</package>
|
|
<package>
|
|
<name>p5-DBI</name>
|
|
<range><lt>1.37_1</lt></range>
|
|
<range><ge>1.38</ge><lt>1.48</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Javier Fernández-Sanguino Peña reports:</p>
|
|
<blockquote cite="http://www.debian.org/security/2005/dsa-658">
|
|
<p>The DBI library, the Perl5 database interface, creates a
|
|
temporary PID file in an insecure manner. This can be
|
|
exploited by a malicious user to overwrite arbitrary files
|
|
owned by the person executing the parts of the library.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>12360</bid>
|
|
<cvename>CAN-2005-0077</cvename>
|
|
<url>http://www.debian.org/security/2005/dsa-658</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-01-25</discovery>
|
|
<entry>2006-04-23</entry>
|
|
<modified>2006-05-11</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="e0b342a1-d2ae-11da-a672-000e0c2e438a">
|
|
<topic>wordpress -- full path disclosure</topic>
|
|
<affects>
|
|
<package>
|
|
<name>wordpress</name>
|
|
<range><lt>1.5.2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Dedi Dwianto reports:</p>
|
|
<blockquote cite="http://echo.or.id/adv/adv24-theday-2005.txt">
|
|
<p>A remote user can access the file directly to cause the
|
|
system to display an error message that indicates the
|
|
installation path. The resulting error message will
|
|
disclose potentially sensitive installation path
|
|
information to the remote attacker.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-4463</cvename>
|
|
<url>http://echo.or.id/adv/adv24-theday-2005.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-12-20</discovery>
|
|
<entry>2006-04-23</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="8d4ae57d-d2ab-11da-a672-000e0c2e438a">
|
|
<topic>xine -- multiple remote string vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>xine</name>
|
|
<range><lt>0.99.4_4</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>c0ntexb reports:</p>
|
|
<blockquote cite="http://www.open-security.org/advisories/16">
|
|
<p>There are 2 format string bugs in the latest version of
|
|
Xine that could be exploited by a malicious person to
|
|
execute code on the system of a remote user running the
|
|
media player against a malicious playlist file. By passing
|
|
a format specifier in the path of a file that is embedded
|
|
in a remote playlist, it is possible to trigger this bug.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>17579</bid>
|
|
<cvename>CVE-2006-1905</cvename>
|
|
<url>http://www.open-security.org/advisories/16</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-04-18</discovery>
|
|
<entry>2006-04-23</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="408f6ebf-d152-11da-962f-000b972eb521">
|
|
<topic>cyrus-sasl -- DIGEST-MD5 Pre-Authentication Denial of Service</topic>
|
|
<affects>
|
|
<package>
|
|
<name>cyrus-sasl</name>
|
|
<range><ge>2.*</ge><lt>2.1.21</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Unspecified vulnerability in the CMU Cyrus Simple
|
|
Authentication and Security Layer (SASL) library, has unknown
|
|
impact and remote unauthenticated attack vectors, related to
|
|
DIGEST-MD5 negotiation.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2006-1721</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-04-11</discovery>
|
|
<entry>2006-04-22</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="1fa4c9f1-cfca-11da-a672-000e0c2e438a">
|
|
<topic>FreeBSD -- FPU information disclosure</topic>
|
|
<affects>
|
|
<system>
|
|
<name>FreeBSD</name>
|
|
<range><gt>6.0</gt><lt>6.0_7</lt></range>
|
|
<range><gt>5.4</gt><lt>5.4_14</lt></range>
|
|
<range><gt>5.3</gt><lt>5.3_29</lt></range>
|
|
<range><gt>5</gt><lt>5.3</lt></range>
|
|
<range><gt>4.11</gt><lt>4.11_17</lt></range>
|
|
<range><gt>4.10</gt><lt>4.10_23</lt></range>
|
|
<range><lt>4.10</lt></range>
|
|
</system>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<h1>Problem Description</h1>
|
|
<p>On "7th generation" and "8th generation" processors
|
|
manufactured by AMD, including the AMD Athlon, Duron, Athlon
|
|
MP, Athlon XP, Athlon64, Athlon64 FX, Opteron, Turion, and
|
|
Sempron, the fxsave and fxrstor instructions do not save and
|
|
restore the FOP, FIP, and FDP registers unless the exception
|
|
summary bit (ES) in the x87 status word is set to 1,
|
|
indicating that an unmasked x87 exception has occurred.</p>
|
|
<p>This behaviour is consistent with documentation provided by
|
|
AMD, but is different from processors from other vendors,
|
|
which save and restore the FOP, FIP, and FDP registers
|
|
regardless of the value of the ES bit. As a result of this
|
|
discrepancy remaining unnoticed until now, the FreeBSD kernel
|
|
does not restore the contents of the FOP, FIP, and FDP
|
|
registers between context switches.</p>
|
|
<h1>Impact</h1>
|
|
<p>On affected processors, a local attacker can monitor the
|
|
execution path of a process which uses floating-point
|
|
operations. This may allow an attacker to steal
|
|
cryptographic keys or other sensitive information.</p>
|
|
<h1>Workaround</h1>
|
|
<p>No workaround is available, but systems which do not use AMD
|
|
Athlon, Duron, Athlon MP, Athlon XP, Athlon64, Athlon64 FX,
|
|
Opteron, Turion, or Sempron processors are not vulnerable.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2006-1056</cvename>
|
|
<freebsdsa>SA-06:14.fpu</freebsdsa>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-04-19</discovery>
|
|
<entry>2006-04-19</entry>
|
|
<modified>2006-06-09</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="22c6b826-cee0-11da-8578-00123ffe8333">
|
|
<topic>plone -- "member_id" Parameter Portrait Manipulation Vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>plone</name>
|
|
<range><lt>2.1.2_1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/19633/">
|
|
<p>The vulnerability is caused due to missing security declarations
|
|
in "changeMemberPortrait" and "deletePersonalPortrait". This can
|
|
be exploited to manipulate or delete another user's portrait via
|
|
the "member_id" parameter.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2006-1711</cvename>
|
|
<url>http://dev.plone.org/plone/ticket/5432</url>
|
|
<url>http://www.debian.org/security/2006/dsa-1032</url>
|
|
<url>http://secunia.com/advisories/19633/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-04-13</discovery>
|
|
<entry>2006-04-18</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="84630f4a-cd8c-11da-b7b9-000c6ec775d9">
|
|
<topic>mozilla -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>firefox</name>
|
|
<range><lt>1.0.8,1</lt></range>
|
|
<range><gt>1.5.*,1</gt><lt>1.5.0.2,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-firefox</name>
|
|
<range><lt>1.5.0.2</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>mozilla</name>
|
|
<range><lt>1.7.13,2</lt></range>
|
|
<range><ge>1.8.*,2</ge></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-mozilla</name>
|
|
<range><lt>1.7.13</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-mozilla-devel</name>
|
|
<range><gt>0</gt></range>
|
|
</package>
|
|
<package>
|
|
<name>seamonkey</name>
|
|
<name>linux-seamonkey</name>
|
|
<range><lt>1.0.1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>thunderbird</name>
|
|
<name>mozilla-thunderbird</name>
|
|
<range><lt>1.5.0.2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A Mozilla Foundation Security Advisory reports of multiple
|
|
issues. Several of which can be used to run arbitrary code
|
|
with the privilege of the user running the program.</p>
|
|
<blockquote cite="http://www.mozilla.org/security/announce/">
|
|
<ul>
|
|
<li>MFSA 2006-29 Spoofing with translucent windows</li>
|
|
<li>MFSA 2006-28 Security check of js_ValueToFunctionObject() can be circumvented</li>
|
|
<li>MFSA 2006-26 Mail Multiple Information Disclosure</li>
|
|
<li>MFSA 2006-25 Privilege escalation through Print Preview</li>
|
|
<li>MFSA 2006-24 Privilege escalation using crypto.generateCRMFRequest</li>
|
|
<li>MFSA 2006-23 File stealing by changing input type</li>
|
|
<li>MFSA 2006-22 CSS Letter-Spacing Heap Overflow Vulnerability</li>
|
|
<li>MFSA 2006-20 Crashes with evidence of memory corruption (rv:1.8.0.2)</li>
|
|
<li>MFSA 2006-19 Cross-site scripting using .valueOf.call()</li>
|
|
<li>MFSA 2006-18 Mozilla Firefox Tag Order Vulnerability</li>
|
|
<li>MFSA 2006-17 cross-site scripting through window.controllers</li>
|
|
<li>MFSA 2006-16 Accessing XBL compilation scope via valueOf.call()</li>
|
|
<li>MFSA 2006-15 Privilege escalation using a JavaScript function's cloned parent</li>
|
|
<li>MFSA 2006-14 Privilege escalation via XBL.method.eval</li>
|
|
<li>MFSA 2006-13 Downloading executables with "Save Image As..."</li>
|
|
<li>MFSA 2006-12 Secure-site spoof (requires security warning dialog)</li>
|
|
<li>MFSA 2006-11 Crashes with evidence of memory corruption (rv:1.8)</li>
|
|
<li>MFSA 2006-10 JavaScript garbage-collection hazard audit</li>
|
|
<li>MFSA 2006-09 Cross-site JavaScript injection using event handlers</li>
|
|
</ul>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<certvu>179014</certvu>
|
|
<certvu>252324</certvu>
|
|
<certvu>329500</certvu>
|
|
<certvu>350262</certvu>
|
|
<certvu>488774</certvu>
|
|
<certvu>736934</certvu>
|
|
<certvu>813230</certvu>
|
|
<certvu>842094</certvu>
|
|
<certvu>932734</certvu>
|
|
<certvu>935556</certvu>
|
|
<certvu>968814</certvu>
|
|
<cvename>CVE-2006-0749</cvename>
|
|
<cvename>CVE-2006-1045</cvename>
|
|
<cvename>CVE-2006-1529</cvename>
|
|
<cvename>CVE-2006-1530</cvename>
|
|
<cvename>CVE-2006-1531</cvename>
|
|
<cvename>CVE-2006-1723</cvename>
|
|
<cvename>CVE-2006-1724</cvename>
|
|
<cvename>CVE-2006-1725</cvename>
|
|
<cvename>CVE-2006-1726</cvename>
|
|
<cvename>CVE-2006-1727</cvename>
|
|
<cvename>CVE-2006-1728</cvename>
|
|
<cvename>CVE-2006-1729</cvename>
|
|
<cvename>CVE-2006-1730</cvename>
|
|
<cvename>CVE-2006-1731</cvename>
|
|
<cvename>CVE-2006-1732</cvename>
|
|
<cvename>CVE-2006-1733</cvename>
|
|
<cvename>CVE-2006-1734</cvename>
|
|
<cvename>CVE-2006-1735</cvename>
|
|
<cvename>CVE-2006-1736</cvename>
|
|
<cvename>CVE-2006-1737</cvename>
|
|
<cvename>CVE-2006-1738</cvename>
|
|
<cvename>CVE-2006-1739</cvename>
|
|
<cvename>CVE-2006-1740</cvename>
|
|
<cvename>CVE-2006-1741</cvename>
|
|
<cvename>CVE-2006-1742</cvename>
|
|
<cvename>CVE-2006-1790</cvename>
|
|
<url>http://www.mozilla.org/security/announce/2006/mfsa2006-09.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2006/mfsa2006-10.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2006/mfsa2006-11.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2006/mfsa2006-12.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2006/mfsa2006-13.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2006/mfsa2006-14.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2006/mfsa2006-15.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2006/mfsa2006-16.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2006/mfsa2006-17.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2006/mfsa2006-18.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2006/mfsa2006-19.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2006/mfsa2006-20.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2006/mfsa2006-22.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2006/mfsa2006-23.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2006/mfsa2006-25.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2006/mfsa2006-26.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2006/mfsa2006-28.html</url>
|
|
<url>http://www.mozilla.org/security/announce/2006/mfsa2006-29.html</url>
|
|
<url>http://www.zerodayinitiative.com/advisories/ZDI-06-010.html</url>
|
|
<uscertta>TA06-107A</uscertta>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-04-13</discovery>
|
|
<entry>2006-04-16</entry>
|
|
<modified>2006-04-27</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="8be2e304-cce6-11da-a3b1-00123ffe8333">
|
|
<topic>mailman -- Private Archive Script Cross-Site Scripting</topic>
|
|
<affects>
|
|
<package>
|
|
<name>mailman</name>
|
|
<name>ja-mailman</name>
|
|
<name>mailman-with-htdig</name>
|
|
<range><lt>2.1.8</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/19558/">
|
|
<p>A vulnerability has been reported in Mailman, which can be
|
|
exploited by malicious people to conduct cross-site scripting
|
|
attacks.</p>
|
|
<p>Unspecified input passed to the private archive script is not
|
|
properly sanitised before being returned to users. This can be
|
|
exploited to execute arbitrary HTML and script code in a user's
|
|
browser session in context of a vulnerable site.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2006-1712</cvename>
|
|
<mlist>http://mail.python.org/pipermail/mailman-announce/2006-April/000084.html</mlist>
|
|
<url>http://secunia.com/advisories/19558/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-04-07</discovery>
|
|
<entry>2006-04-16</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="43cb40b3-c8c2-11da-a672-000e0c2e438a">
|
|
<topic>f2c -- insecure temporary files</topic>
|
|
<affects>
|
|
<package>
|
|
<name>f2c</name>
|
|
<range><lt>20060506</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Javier Fernández-Sanguino Peña reports two temporary file
|
|
vulnerability within f2c. The vulnerabilities are caused
|
|
due to weak temporary file handling. An attacker could
|
|
create an symbolic link, causing a local user running f2c
|
|
to overwrite the symlinked file. This could give the
|
|
attacker elevated privileges.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>1280</bid>
|
|
<cvename>CAN-2005-0017</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-01-27</discovery>
|
|
<entry>2006-04-10</entry>
|
|
<modified>2006-08-15</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="c7526a14-c4dc-11da-9699-00123ffe8333">
|
|
<topic>mplayer -- Multiple integer overflows</topic>
|
|
<affects>
|
|
<package>
|
|
<name>mplayer</name>
|
|
<name>mplayer-esound</name>
|
|
<name>mplayer-gtk</name>
|
|
<name>mplayer-gtk2</name>
|
|
<name>mplayer-gtk-esound</name>
|
|
<name>mplayer-gtk2-esound</name>
|
|
<range><lt>0.99.7_12</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/19418/">
|
|
<p>The vulnerabilities are caused due to integer overflow errors
|
|
in "libmpdemux/asfheader.c" within the handling of an ASF file,
|
|
and in "libmpdemux/aviheader.c" when parsing the "indx" chunk in
|
|
an AVI file. This can be exploited to cause heap-based buffer
|
|
overflows via a malicious ASF file, or via a AVI file with
|
|
specially-crafted "wLongsPerEntry" and "nEntriesInUse" values in
|
|
the "indx" chunk.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2006-1502</cvename>
|
|
<url>http://www.xfocus.org/advisories/200603/11.html</url>
|
|
<url>http://secunia.com/advisories/19418/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-03-29</discovery>
|
|
<entry>2006-04-07</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="4bfcd857-c628-11da-b2fb-000e0c2e438a">
|
|
<topic>kaffeine -- buffer overflow vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>kaffeine</name>
|
|
<range><ge>0.4.2</ge><lt>0.8.0</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The KDE team reports:</p>
|
|
<blockquote cite="http://www.kde.org/info/security/advisory-20060404-1.txt">
|
|
<p>Kaffeine can produce a buffer overflow in http_peek() while
|
|
creating HTTP request headers for fetching remote playlists,
|
|
which under certain circumstances could be used to crash the
|
|
application and/or execute arbitrary code.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>17372</bid>
|
|
<cvename>CVE-2006-0051</cvename>
|
|
<url>http://www.kde.org/info/security/advisory-20060404-1.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-04-04</discovery>
|
|
<entry>2006-04-07</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="61349f77-c620-11da-b2fb-000e0c2e438a">
|
|
<topic>thunderbird -- javascript execution</topic>
|
|
<affects>
|
|
<package>
|
|
<name>thunderbird</name>
|
|
<name>mozilla-thunderbird</name>
|
|
<range><le>1.0.7</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Renaud Lifchitz reports a vulnerability within thunderbird.
|
|
The vulnerability is caused by improper checking of javascript
|
|
scripts. This could lead to javascript code execution which
|
|
can lead to information disclosure or a denial of service
|
|
(application crash). This vulnerability is present even if
|
|
javascript had been disabled in the preferences.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>16770</bid>
|
|
<cvename>CAN-2006-0884</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-02-22</discovery>
|
|
<entry>2006-04-07</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="fba75b43-c588-11da-9110-00123ffe8333">
|
|
<topic>phpmyadmin -- XSS vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>phpMyAdmin</name>
|
|
<range><lt>2.8.0.3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>phpMyAdmin security announcement:</p>
|
|
<blockquote cite="http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-1">
|
|
<p>It was possible to conduct an XSS attack with a direct call
|
|
to some scripts under the themes directory.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-1</url>
|
|
<url>http://secunia.com/advisories/19556/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-04-06</discovery>
|
|
<entry>2006-04-06</entry>
|
|
<modified>2006-04-07</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="7b55f5c2-c58b-11da-9110-00123ffe8333">
|
|
<topic>phpmyadmin -- 'set_theme' Cross-Site Scripting</topic>
|
|
<affects>
|
|
<package>
|
|
<name>phpMyAdmin</name>
|
|
<range><lt>2.8.0.2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/19277">
|
|
<p>A vulnerability has been reported in phpMyAdmin, which can be
|
|
exploited by malicious people to conduct cross-site scripting
|
|
attacks.</p>
|
|
<p>Input passed to the "set_theme" parameter isn't properly
|
|
sanitised before being returned to the user. This can be exploited
|
|
to execute arbitrary HTML and script code in a user's browser
|
|
session in context of an affected site.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2006-1258</cvename>
|
|
<url>http://secunia.com/advisories/19277</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-03-17</discovery>
|
|
<entry>2006-04-06</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="6a5174bd-c580-11da-9110-00123ffe8333">
|
|
<topic>clamav -- Multiple Vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>clamav</name>
|
|
<range><lt>0.88.1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>clamav-devel</name>
|
|
<range><le>20051104_1</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/19534/">
|
|
<p>Some vulnerabilities have been reported in ClamAV, which
|
|
potentially can be exploited by malicious people to cause a
|
|
DoS (Denial of Service) and compromise a vulnerable system.</p>
|
|
<p>An unspecified integer overflow error exists in the PE header
|
|
parser in "libclamav/pe.c". Successful exploitation requires that
|
|
the ArchiveMaxFileSize option is disabled.</p>
|
|
<p>Some format string errors in the logging handling in
|
|
"shared/output.c" may be exploited to execute arbitrary code.</p>
|
|
<p>An out-of-bounds memory access error in the "cli_bitset_test()"
|
|
function in "ibclamav/others.c" may be exploited to cause a
|
|
crash.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2006-1614</cvename>
|
|
<cvename>CVE-2006-1615</cvename>
|
|
<cvename>CVE-2006-1630</cvename>
|
|
<url>http://secunia.com/advisories/19534/</url>
|
|
<url>http://www.us.debian.org/security/2006/dsa-1024</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-04-06</discovery>
|
|
<entry>2006-04-06</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="99015cf5-c4dd-11da-b2fb-000e0c2e438a">
|
|
<topic>mediawiki -- hardcoded placeholder string security bypass vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>mediawiki</name>
|
|
<range><lt>1.5.4</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The mediawiki development team reports a vulnerability
|
|
within the mediawiki application. The vulnerability is
|
|
caused by improper checking of inline style attributes. This
|
|
could result in the execution of arbitrary javascript code in
|
|
Microsoft Internet Explorer. It appears that other browsers
|
|
are not affected by this vulnerability.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>16032</bid>
|
|
<cvename>CAN-2005-4501</cvename>
|
|
<url>http://sourceforge.net/project/shownotes.php?release_id=379951</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-12-22</discovery>
|
|
<entry>2006-04-05</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="ae9fb0d7-c4dc-11da-b2fb-000e0c2e438a">
|
|
<topic>netpbm -- buffer overflow in pnmtopng</topic>
|
|
<affects>
|
|
<package>
|
|
<name>netpbm</name>
|
|
<range><lt>10.26</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Ubuntu reports:</p>
|
|
<blockquote cite="http://www.ubuntulinux.org/support/documentation/usn/usn-210-1">
|
|
<p>A buffer overflow was found in the "pnmtopng" conversion
|
|
program. By tricking an user (or automated system) to
|
|
process a specially crafted PNM image with pnmtopng, this
|
|
could be exploited to execute arbitrary code with the
|
|
privileges of the user running pnmtopng.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>15128</bid>
|
|
<cvename>CAN-2005-2978</cvename>
|
|
<url>http://www.ubuntulinux.org/support/documentation/usn/usn-210-1</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-10-18</discovery>
|
|
<entry>2006-04-05</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="d9307a41-c4d7-11da-b2fb-000e0c2e438a">
|
|
<topic>zoo -- stack based buffer overflow</topic>
|
|
<affects>
|
|
<package>
|
|
<name>zoo</name>
|
|
<range><lt>2.10.1_2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Jean-Sébastien Guay-Leroux report a vulnerability
|
|
within the zoo archiver. The vulnerability which is present
|
|
in the fullpath() function (from the misc.c file) is caused by
|
|
improper checking of user supplied data. The data returned
|
|
to the buffer can be up to 512 bytes, while the buffer is
|
|
created to hold 256 bytes. This could result in a buffer
|
|
overflow which could allow remote code execution.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>16790</bid>
|
|
<cvename>CVE-2006-0855</cvename>
|
|
<url>http://www.guay-leroux.com/projects/zoo-advisory.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-02-22</discovery>
|
|
<entry>2006-04-05</entry>
|
|
<modified>2006-04-06</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="74b7403c-c4d5-11da-b2fb-000e0c2e438a">
|
|
<topic>mediawiki -- cross site scripting vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>mediawiki</name>
|
|
<range><ge>1.4</ge><lt>1.4.14</lt></range>
|
|
<range><ge>1.5</ge><lt>1.5.7</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The mediawiki development team reports that there is an
|
|
site scripting vulnerability within mediawiki. The
|
|
vulnerability is caused by improper checking of encoded
|
|
links which could allow the injection of html in the output
|
|
generated by mediawiki. This could lead to cross site
|
|
scripting attacks against mediawiki installations.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>17269</bid>
|
|
<cvename>CVE-2006-1498</cvename>
|
|
<url>http://mail.wikipedia.org/pipermail/mediawiki-announce/2006-March/000040.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-03-27</discovery>
|
|
<entry>2006-04-05</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="b5fc63ad-c4c3-11da-9699-00123ffe8333">
|
|
<topic>dia -- XFig Import Plugin Buffer Overflow</topic>
|
|
<affects>
|
|
<package>
|
|
<name>dia</name>
|
|
<name>dia-gnome</name>
|
|
<range><gt>0.86_1</gt><lt>0.94_6,1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/19469/">
|
|
<p>Some vulnerabilities have been reported in Dia, which
|
|
potentially can be exploited by malicious people to
|
|
compromise a user's system.</p>
|
|
<p>The vulnerabilities are caused due to boundary errors
|
|
within the XFig import plugin. This can be exploited to
|
|
cause buffer overflows and may allow arbitrary code
|
|
execution when a specially-crafted FIG file is imported.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2006-1550</cvename>
|
|
<url>http://secunia.com/advisories/19469/</url>
|
|
<mlist msgid="1143662924.6460.60.camel@linux.site">http://mail.gnome.org/archives/dia-list/2006-March/msg00149.html</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-03-31</discovery>
|
|
<entry>2006-04-05</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="be4ccb7b-c48b-11da-ae12-0002b3b60e4c">
|
|
<topic>openvpn -- LD_PRELOAD code execution on client through malicious or compromised server</topic>
|
|
<affects>
|
|
<package>
|
|
<name>openvpn</name>
|
|
<range><ge>2.0</ge><lt>2.0.6</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Hendrik Weimer reports:</p>
|
|
<blockquote cite="http://www.osreviews.net/reviews/security/openvpn-print">
|
|
<p>OpenVPN clients are a bit too generous when accepting
|
|
configuration options from a server. It is possible to transmit
|
|
environment variables to client-side shell scripts. There are some
|
|
filters in place to prevent obvious nonsense, however they don't
|
|
catch the good old LD_PRELOAD trick. All we need is to put a file
|
|
onto the client under a known location (e.g. by returning a
|
|
specially crafted document upon web access) and we have a remote
|
|
root exploit. But since the attack may only come from authenticated
|
|
servers, this threat is greatly reduced.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2006-1629</cvename>
|
|
<url>http://www.osreviews.net/reviews/security/openvpn-print</url>
|
|
<url>http://openvpn.net/changelog.html</url>
|
|
<mlist msgid="4431F7C4.4030804@yonan.net">http://sourceforge.net/mailarchive/message.php?msg_id=15298074</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-04-03</discovery>
|
|
<entry>2006-04-05</entry>
|
|
<modified>2006-04-06</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="92fd40eb-c458-11da-9c79-00123ffe8333">
|
|
<topic>samba -- Exposure of machine account credentials in winbind log files</topic>
|
|
<affects>
|
|
<package>
|
|
<name>samba</name>
|
|
<range><ge>3.0.21a,1</ge><lt>3.0.22,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>ja-samba</name>
|
|
<range><ge>3.0.21a,1</ge><lt>3.0.22,1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Samba Security Advisory:</p>
|
|
<blockquote cite="http://us1.samba.org/samba/security/CAN-2006-1059.html">
|
|
<p>The machine trust account password is the secret
|
|
shared between a domain controller and a specific
|
|
member server. Access to the member server machine
|
|
credentials allows an attacker to impersonate the
|
|
server in the domain and gain access to additional
|
|
information regarding domain users and groups.</p>
|
|
<p>The winbindd daemon writes the clear text of server's
|
|
machine credentials to its log file at level 5.
|
|
The winbindd log files are world readable by default
|
|
and often log files are requested on open mailing
|
|
lists as tools used to debug server misconfigurations.</p>
|
|
<p>This affects servers configured to use domain or
|
|
ads security and possibly Samba domain controllers
|
|
as well (if configured to use winbindd).</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2006-1059</cvename>
|
|
<url>http://us1.samba.org/samba/security/CAN-2006-1059.html</url>
|
|
<url>http://secunia.com/advisories/19455/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-03-30</discovery>
|
|
<entry>2006-04-05</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="91afa94c-c452-11da-8bff-000ae42e9b93">
|
|
<topic>mod_pubcookie -- cross site scripting vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>mod_pubcookie</name>
|
|
<range><lt>3.3.0</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Nathan Dors of the Pubcookie Project reports:</p>
|
|
<blockquote cite="http://www.pubcookie.org/news/20060306-apps-secadv.html">
|
|
<p>Non-persistent XSS vulnerabilities were found in the
|
|
Pubcookie Apache module (mod_pubcookie) and ISAPI
|
|
filter. These components mishandle untrusted data when
|
|
printing responses to the browser. This makes them
|
|
vulnerable to carefully crafted requests containing script
|
|
or HTML. If an attacker can lure an unsuspecting user to
|
|
visit carefully staged content, the attacker can use it to
|
|
redirect the user to a vulnerable Pubcookie application
|
|
server and attempt to exploit the XSS vulnerabilities.</p>
|
|
<p>These vulnerabilities are classified as *high* due to the
|
|
nature and purpose of Pubcookie application servers for user
|
|
authentication and Web Single Sign-on (SSO). An attacker
|
|
who injects malicious script through the vulnerabilities
|
|
might steal private Pubcookie data including a user's
|
|
authentication assertion ("granting") cookies and
|
|
application session cookies.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<certvu>314540</certvu>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-03-06</discovery>
|
|
<entry>2006-04-05</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="855cd9fa-c452-11da-8bff-000ae42e9b93">
|
|
<topic>pubcookie-login-server -- cross site scripting vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>pubcookie-login-server</name>
|
|
<range><lt>3.3.0</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Nathan Dors of the Pubcookie Project reports:</p>
|
|
<blockquote cite="">
|
|
<p> Multiple non-persistent XSS vulnerabilities were found
|
|
in the Pubcookie login server's compiled binary "index.cgi"
|
|
CGI program. The CGI program mishandles untrusted data when
|
|
printing responses to the browser. This makes the program
|
|
vulnerable to carefully crafted requests containing script
|
|
or HTML. If an attacker can lure an unsuspecting user to
|
|
visit carefully staged content, the attacker can use it to
|
|
redirect the user to his or her local Pubcookie login page
|
|
and attempt to exploit the XSS vulnerabilities.</p>
|
|
<p> These vulnerabilities are classified as *critical* due
|
|
to the nature and purpose of the Pubcookie login server for
|
|
user authentication and Web Single Sign-on (SSO). Specific
|
|
threats include:</p>
|
|
<ul>
|
|
<li>An attacker who injects malicious script through the
|
|
vulnerabilities might steal senstive user data including
|
|
a user's authentication credentials (usernames and
|
|
passwords);</li>
|
|
<li>An attacker who injects malicious script through the
|
|
vulnerabilities might steal private Pubcookie data
|
|
including a user's authentication assertion ("granting")
|
|
cookies and SSO ("login") session cookies;</li>
|
|
<li>An attacker who injects HTML tags through the
|
|
vulnerabilities might deface a site's Pubcookie login page
|
|
for a single visit by a single user (i.e. a non-persistent
|
|
defacement).</li>
|
|
</ul>
|
|
<p>At the heart of these threats lies a violation of the
|
|
user's trust in the Pubcookie login server.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<certvu>337585</certvu>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-03-06</discovery>
|
|
<entry>2006-04-05</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="37a5c10f-bf56-11da-b0e9-00123ffe8333">
|
|
<topic>freeradius -- EAP-MSCHAPv2 Authentication Bypass</topic>
|
|
<affects>
|
|
<package>
|
|
<name>freeradius</name>
|
|
<range><ge>1.0.0</ge><lt>1.1.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Freeradius Security Contact reports:</p>
|
|
<blockquote cite="http://www.freeradius.org/security.html#1.1.0">
|
|
<p>Insufficient input validation was being done in the
|
|
EAP-MSCHAPv2 state machine. A malicious attacker could
|
|
manipulate their EAP-MSCHAPv2 client state machine to
|
|
potentially convince the server to bypass authentication
|
|
checks. This bypassing could also result in the server
|
|
crashing.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2006-1354</cvename>
|
|
<url>http://www.freeradius.org/security.html#1.1.0</url>
|
|
<url>http://secunia.com/advisories/19300/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-03-21</discovery>
|
|
<entry>2006-03-29</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="2db97aa6-be81-11da-9b82-0050bf27ba24">
|
|
<topic>horde -- remote code execution vulnerability in the help viewer</topic>
|
|
<affects>
|
|
<package>
|
|
<name>horde</name>
|
|
<name>horde-php5</name>
|
|
<range><lt>3.1.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Horde 3.1.1 release announcement:</p>
|
|
<blockquote cite="http://lists.horde.org/archives/announce/2006/000271.html">
|
|
<p>Major changes compared to Horde 3.1 are:</p>
|
|
<ul>
|
|
<li>Fix for remote code execution vulnerability in the
|
|
help viewer, discovered by Jan Schneider from the Horde
|
|
team.</li>
|
|
</ul>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>17292</bid>
|
|
<cvename>CVE-2006-1491</cvename>
|
|
<url>http://lists.horde.org/archives/announce/2006/000271.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-03-28</discovery>
|
|
<entry>2006-03-28</entry>
|
|
<modified>2006-03-30</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="25858c37-bdab-11da-b7d4-00123ffe8333">
|
|
<topic>linux-realplayer -- buffer overrun</topic>
|
|
<affects>
|
|
<package>
|
|
<name>linux-realplayer</name>
|
|
<range><ge>10.0.1</ge><lt>10.0.7.785.20060201</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia Advisories Reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/19358/">
|
|
<p>A boundary error when processing SWF files can be exploited to
|
|
cause a buffer overflow. This may allow execution of arbitrary
|
|
code on the user's system.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2006-0323</cvename>
|
|
<url>http://service.real.com/realplayer/security/03162006_player/en/</url>
|
|
<url>http://secunia.com/advisories/19358/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-03-23</discovery>
|
|
<entry>2006-03-27</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="fe4c84fc-bdb5-11da-b7d4-00123ffe8333">
|
|
<topic>linux-realplayer -- heap overflow</topic>
|
|
<affects>
|
|
<package>
|
|
<name>linux-realplayer</name>
|
|
<range><ge>10.0.1</ge><lt>10.0.6</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>iDefense Reports:</p>
|
|
<blockquote cite="http://www.idefense.com/intelligence/vulnerabilities/display.php?id=404">
|
|
<p>Remote exploitation of a heap-based buffer overflow in
|
|
RealNetwork Inc's RealPlayer could allow the execution of
|
|
arbitrary code in the context of the currently logged in
|
|
user.</p>
|
|
<p>In order to exploit this vulnerability, an attacker would
|
|
need to entice a user to follow a link to a malicious server.
|
|
Once the user visits a website under the control of an
|
|
attacker, it is possible in a default install of RealPlayer
|
|
to force a web-browser to use RealPlayer to connect to an
|
|
arbitrary server, even when it is not the default application
|
|
for handling those types, by the use of embedded object tags
|
|
in a webpage. This may allow automated exploitation when the
|
|
page is viewed.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-2922</cvename>
|
|
<url>http://service.real.com/realplayer/security/03162006_player/en/</url>
|
|
<url>http://www.idefense.com/intelligence/vulnerabilities/display.php?id=404</url>
|
|
<url>http://secunia.com/advisories/19358/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-03-23</discovery>
|
|
<entry>2006-03-27</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="08ac7b8b-bb30-11da-b2fb-000e0c2e438a">
|
|
<topic>sendmail -- race condition vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>sendmail</name>
|
|
<range><gt>8.13</gt><lt>8.13.6</lt></range>
|
|
</package>
|
|
<system>
|
|
<name>FreeBSD</name>
|
|
<range><ge>6.0</ge><lt>6.0_6</lt></range>
|
|
<range><ge>5.4</ge><lt>5.4_13</lt></range>
|
|
<range><ge>5.3</ge><lt>5.3_28</lt></range>
|
|
<range><ge>4.11</ge><lt>4.11_16</lt></range>
|
|
<range><ge>4.10</ge><lt>4.10_22</lt></range>
|
|
</system>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<h1>Problem Description</h1>
|
|
<p>A race condition has been reported to exist in the handling
|
|
by sendmail of asynchronous signals.</p>
|
|
<h1>Impact</h1>
|
|
<p>A remote attacker may be able to execute arbitrary code with
|
|
the privileges of the user running sendmail, typically
|
|
root.</p>
|
|
<h1>Workaround</h1>
|
|
<p>There is no known workaround other than disabling
|
|
sendmail.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2006-0058</cvename>
|
|
<freebsdsa>SA-06:13.sendmail</freebsdsa>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-03-22</discovery>
|
|
<entry>2006-03-24</entry>
|
|
<modified>2006-06-09</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="e93bc5b0-bb2e-11da-b2fb-000e0c2e438a">
|
|
<topic>OPIE -- arbitrary password change</topic>
|
|
<affects>
|
|
<system>
|
|
<name>FreeBSD</name>
|
|
<range><ge>6.0</ge><lt>6.0_6</lt></range>
|
|
<range><ge>5.4</ge><lt>5.4_13</lt></range>
|
|
<range><ge>5.3</ge><lt>5.3_28</lt></range>
|
|
<range><ge>4.11</ge><lt>4.11_16</lt></range>
|
|
<range><ge>4.10</ge><lt>4.10_22</lt></range>
|
|
</system>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<h1>Problem Description</h1>
|
|
<p>The opiepasswd(1) program uses getlogin(2) to identify the
|
|
user calling opiepasswd(1). In some circumstances
|
|
getlogin(2) will return "root" even when running as an
|
|
unprivileged user. This causes opiepasswd(1) to allow an
|
|
unpriviled user to configure OPIE authentication for the root
|
|
user.</p>
|
|
<h1>Impact</h1>
|
|
<p>In certain cases an attacker able to run commands as a non
|
|
privileged users which have not explicitly logged in, for
|
|
example CGI scripts run by a web server, is able to configure
|
|
OPIE access for the root user. If the attacker is able to
|
|
authenticate as root using OPIE authentication, for example if
|
|
"PermitRootLogin" is set to "yes" in sshd_config or the
|
|
attacker has access to a local user in the "wheel" group, the
|
|
attacker can gain root privileges.</p>
|
|
<h1>Workaround</h1>
|
|
<p>Disable OPIE authentication in PAM:</p>
|
|
<pre># sed -i "" -e /opie/s/^/#/ /etc/pam.d/*</pre>
|
|
<p>or</p>
|
|
<p>Remove the setuid bit from opiepasswd:</p>
|
|
<pre># chflags noschg /usr/bin/opiepasswd</pre>
|
|
<pre># chmod 555 /usr/bin/opiepasswd</pre>
|
|
<pre># chflags schg /usr/bin/opiepasswd</pre>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2006-1283</cvename>
|
|
<freebsdsa>SA-06:12.opie</freebsdsa>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-03-22</discovery>
|
|
<entry>2006-03-24</entry>
|
|
<modified>2006-06-09</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="e50a7476-bb2d-11da-b2fb-000e0c2e438a">
|
|
<topic>ipsec -- reply attack vulnerability</topic>
|
|
<affects>
|
|
<system>
|
|
<name>FreeBSD</name>
|
|
<range><ge>6.0</ge><lt>6.0_6</lt></range>
|
|
<range><ge>5.4</ge><lt>5.4_13</lt></range>
|
|
<range><ge>5.3</ge><lt>5.3_28</lt></range>
|
|
<range><ge>4.11</ge><lt>4.11_16</lt></range>
|
|
<range><ge>4.10</ge><lt>4.10_22</lt></range>
|
|
</system>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<h1>Problem Description</h1>
|
|
<p>IPsec provides an anti-replay service which when enabled
|
|
prevents an attacker from successfully executing a replay
|
|
attack. This is done through the verification of sequence
|
|
numbers. A programming error in the fast_ipsec(4)
|
|
implementation results in the sequence number associated with
|
|
a Security Association not being updated, allowing packets to
|
|
unconditionally pass sequence number verification checks.</p>
|
|
<h1>Impact</h1>
|
|
<p>An attacker able to intercept IPSec packets can replay
|
|
them. If higher level protocols which do not provide any
|
|
protection against packet replays (e.g., UDP) are used, this
|
|
may have a variety of effects.</p>
|
|
<h1>Workaround</h1>
|
|
<p>No workaround is available.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2006-0905</cvename>
|
|
<freebsdsa>SA-06:11.ipsec</freebsdsa>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-03-22</discovery>
|
|
<entry>2006-03-24</entry>
|
|
<modified>2006-06-09</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="61534682-b8f4-11da-8e62-000e0c33c2dc">
|
|
<topic>xorg-server -- privilege escalation</topic>
|
|
<affects>
|
|
<package>
|
|
<name>xorg-server</name>
|
|
<range><eq>6.9.0</eq></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Daniel Stone of X.Org reports:</p>
|
|
<blockquote cite="http://lists.freedesktop.org/archives/xorg/2006-March/013992.html">
|
|
<p>During the analysis of results from the Coverity code review
|
|
of X.Org, we discovered a flaw in the server that allows local
|
|
users to execute arbitrary code with root privileges, or cause
|
|
a denial of service by overwriting files on the system, again
|
|
with root privileges.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2006-0745</cvename>
|
|
<url>https://bugs.freedesktop.org/show_bug.cgi?id=6213</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-03-20</discovery>
|
|
<entry>2006-03-21</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="b62c80c2-b81a-11da-bec5-00123ffe8333">
|
|
<topic>heimdal -- Multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>heimdal</name>
|
|
<range><lt>0.6.6</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A Project heimdal Security Advisory reports:</p>
|
|
<blockquote cite="http://www.pdc.kth.se/heimdal/advisory/2005-04-20/">
|
|
<p>The telnet client program in Heimdal has buffer overflows
|
|
in the functions slc_add_reply() and env_opt_add(), which
|
|
may lead to remote code execution.</p>
|
|
</blockquote>
|
|
<blockquote cite="http://www.pdc.kth.se/heimdal/advisory/2005-06-20/">
|
|
<p>The telnetd server program in Heimdal has buffer overflows
|
|
in the function getterminaltype, which may lead to remote code
|
|
execution.</p>
|
|
</blockquote>
|
|
<blockquote cite="http://www.pdc.kth.se/heimdal/advisory/2006-02-06/">
|
|
<p>The rshd server in Heimdal has a privilege escalation bug
|
|
when storing forwarded credentials. The code allowes a user
|
|
to overwrite a file with its credential cache, and get ownership
|
|
of the file.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-0469</cvename>
|
|
<cvename>CVE-2005-2040</cvename>
|
|
<cvename>CVE-2006-0582</cvename>
|
|
<cvename>CVE-2006-0677</cvename>
|
|
<url>http://www.pdc.kth.se/heimdal/advisory/2005-04-20</url>
|
|
<url>http://www.pdc.kth.se/heimdal/advisory/2005-06-20</url>
|
|
<url>http://www.pdc.kth.se/heimdal/advisory/2006-02-06</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-02-06</discovery>
|
|
<entry>2006-03-20</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="b8e361b8-b7ff-11da-8414-0013d4a4a40e">
|
|
<topic>curl -- TFTP packet buffer overflow vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>curl</name>
|
|
<name>linux-curl</name>
|
|
<range><gt>7.14.1</gt><lt>7.15.3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A Project cURL Security Advisory reports:</p>
|
|
<blockquote cite="http://curl.haxx.se/docs/adv_20060320.html">
|
|
<p>libcurl uses the given file part of a TFTP URL in a manner that
|
|
allows a malicious user to overflow a heap-based memory buffer due
|
|
to the lack of boundary check.</p>
|
|
<p>This overflow happens if you pass in a URL with a TFTP
|
|
protocol prefix ("tftp://"), using a valid host and a path
|
|
part that is longer than 512 bytes.</p>
|
|
<p>The affected flaw can be triggered by a redirect, if
|
|
curl/libcurl is told to follow redirects and an HTTP
|
|
server points the client to a tftp URL with the
|
|
characteristics described above.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2006-1061</cvename>
|
|
<url>http://curl.haxx.se/docs/adv_20060320.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-03-20</discovery>
|
|
<entry>2006-03-20</entry>
|
|
<modified>2006-10-05</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="6779e82f-b60b-11da-913d-000ae42e9b93">
|
|
<topic>drupal -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>drupal</name>
|
|
<range><lt>3.6.6</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Drupal reports:</p>
|
|
<blockquote cite="http://drupal.org/node/53806">
|
|
<p>Mail header injection vulnerability.</p>
|
|
<p>Linefeeds and carriage returns were not being stripped from
|
|
email headers, raising the possibility of bogus headers
|
|
being inserted into outgoing email.</p>
|
|
<p>This could lead to Drupal sites being used to send unwanted
|
|
email.</p>
|
|
</blockquote>
|
|
<blockquote cite="http://drupal.org/node/53805">
|
|
<p>Session fixation vulnerability.</p>
|
|
<p>If someone creates a clever enough URL and convinces you to
|
|
click on it, and you later log in but you do not log off
|
|
then the attacker may be able to impersonate you.</p>
|
|
</blockquote>
|
|
<blockquote cite="http://drupal.org/node/53803">
|
|
<p>XSS vulnerabilities.</p>
|
|
<p>Some user input sanity checking was missing. This could
|
|
lead to possible cross-site scripting (XSS) attacks.</p>
|
|
<p>XSS can lead to user tracking and theft of accounts and
|
|
services.</p>
|
|
</blockquote>
|
|
<blockquote cite="http://drupal.org/node/53796">
|
|
<p>Security bypass in menu.module.</p>
|
|
<p>If you use menu.module to create a menu item, the page you
|
|
point to will be accessible to all, even if it is an admin
|
|
page.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://drupal.org/node/53806</url>
|
|
<url>http://drupal.org/node/53805</url>
|
|
<url>http://drupal.org/node/53803</url>
|
|
<url>http://drupal.org/node/53796</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-03-13</discovery>
|
|
<entry>2006-03-17</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="c7c09579-b466-11da-82d0-0050bf27ba24">
|
|
<topic>horde -- "url" disclosure of sensitive information vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>horde</name>
|
|
<name>horde-php5</name>
|
|
<range><lt>3.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p> Secunia advisory SA19246:</p>
|
|
<blockquote cite="http://secunia.com/advisories/19246/">
|
|
<p>Paul Craig has discovered a vulnerability in Horde, which
|
|
can be exploited by malicious people to disclose sensitive
|
|
information.
|
|
Input passed to the "url" parameter in "services/go.php"
|
|
isn't properly verified, before it is used in a
|
|
"readfile()" call. This can be exploited to disclose the
|
|
content of arbitrary files via e.g. the "php://" protocol
|
|
wrapper.</p>
|
|
<p>The vulnerability has been confirmed in version 3.0.9 and
|
|
has also been reported in prior versions.</p>
|
|
<p>Provided and/or discovered by:
|
|
Paul Craig, Security-Assessment.com.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://secunia.com/advisories/19246/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-03-15</discovery>
|
|
<entry>2006-03-15</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="83421018-b3ef-11da-a32d-000c6ec775d9">
|
|
<topic>linux-flashplugin -- arbitrary code execution vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>linux-flashplugin</name>
|
|
<range><lt>7.0r63</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Adobe reports:</p>
|
|
<blockquote cite="http://www.macromedia.com/devnet/security/security_zone/apsb06-03.html">
|
|
<p>Critical vulnerabilities have been identified in Flash
|
|
Player that could allow an attacker who successfully
|
|
exploits these vulnerabilities to take control of the
|
|
affected system. A malicious SWF must be loaded in Flash
|
|
Player by the user for an attacker to exploit these
|
|
vulnerabilities.</p>
|
|
<p>Flash Player 8 update (8.0.24.0), and Flash Player 7
|
|
update (7.0.63.0) address security vulnerabilities in
|
|
previous versions of Flash Player, which could lead to the
|
|
potential execution of arbitrary code. These
|
|
vulnerabilities could be accessed through content
|
|
delivered from a remote location via the users web
|
|
browser, email client, or other applications that include
|
|
or reference the Flash Player.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2006-0024</cvename>
|
|
<url>http://www.macromedia.com/devnet/security/security_zone/apsb06-03.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-03-14</discovery>
|
|
<entry>2006-03-15</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="6111ecb8-b20d-11da-b2fb-000e0c2e438a">
|
|
<topic>nfs -- remote denial of service</topic>
|
|
<affects>
|
|
<system>
|
|
<name>FreeBSD</name>
|
|
<range><gt>6.0</gt><lt>6.0_5</lt></range>
|
|
<range><gt>5.4</gt><lt>5.4_12</lt></range>
|
|
<range><gt>5.3</gt><lt>5.3_27</lt></range>
|
|
<range><gt>4.11</gt><lt>4.11_15</lt></range>
|
|
<range><gt>4.10</gt><lt>4.10_21</lt></range>
|
|
</system>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<h1>Problem description:</h1>
|
|
<p>A part of the NFS server code charged with handling incoming
|
|
RPC messages via TCP had an error which, when the server
|
|
received a message with a zero-length payload, would cause a
|
|
NULL pointer dereference which results in a kernel panic. The
|
|
kernel will only process the RPC messages if a userland nfsd
|
|
daemon is running.</p>
|
|
<h1>Impact:</h1>
|
|
<p>The NULL pointer deference allows a remote attacker capable
|
|
of sending RPC messages to an affected FreeBSD system to crash
|
|
the FreeBSD system.</p>
|
|
<h1>Workaround:</h1>
|
|
<ol>
|
|
<li>
|
|
<p>Disable the NFS server: set the nfs_server_enable
|
|
variable to "NO" in /etc/rc.conf, and reboot.</p>
|
|
<p>Alternatively, if there are no active NFS clients (as
|
|
listed by the showmount(8) utility), simply killing the
|
|
mountd and nfsd processes should suffice.</p>
|
|
</li>
|
|
<li>
|
|
<p>Add firewall rules to block RPC traffic to the NFS server
|
|
from untrusted hosts.</p>
|
|
</li>
|
|
</ol>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2006-0900</cvename>
|
|
<freebsdsa>SA-06:10.nfs</freebsdsa>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-03-01</discovery>
|
|
<entry>2006-03-12</entry>
|
|
<modified>2006-06-09</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="6a308e8e-b1b4-11da-b2fb-000e0c2e438a">
|
|
<topic>openssh -- remote denial of service</topic>
|
|
<affects>
|
|
<system>
|
|
<name>FreeBSD</name>
|
|
<range><gt>5.4</gt><lt>5.4_12</lt></range>
|
|
<range><gt>5.3</gt><lt>5.3_27</lt></range>
|
|
</system>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<h1>Problem description:</h1>
|
|
<p>Because OpenSSH and OpenPAM have conflicting designs (one is event-
|
|
driven while the other is callback-driven), it is necessary for
|
|
OpenSSH to fork a child process to handle calls to the PAM framework.
|
|
However, if the unprivileged child terminates while PAM authentication
|
|
is under way, the parent process incorrectly believes that the PAM
|
|
child also terminated. The parent process then terminates, and the
|
|
PAM child is left behind.</p>
|
|
<p>Due to the way OpenSSH performs internal accounting, these orphaned
|
|
PAM children are counted as pending connections by the master OpenSSH
|
|
server process. Once a certain number of orphans has accumulated, the
|
|
master decides that it is overloaded and stops accepting client
|
|
connections.</p>
|
|
<h1>Impact:</h1>
|
|
<p>By repeatedly connecting to a vulnerable server, waiting for
|
|
a password prompt, and closing the connection, an attacker can
|
|
cause OpenSSH to stop accepting client connections until the
|
|
system restarts or an administrator manually kills the orphaned
|
|
PAM processes.</p>
|
|
<h1>Workaround:</h1>
|
|
<p>The following command will show a list of orphaned PAM
|
|
processes:</p>
|
|
<pre># pgrep -lf 'sshd.*\[pam\]'</pre>
|
|
<p>The following command will kill orphaned PAM processes:</p>
|
|
<pre># pkill -f 'sshd.*\[pam\]'</pre>
|
|
<p>To prevent OpenSSH from leaving orphaned PAM processes behind,
|
|
perform one of the following:</p>
|
|
<ol>
|
|
<li>
|
|
<p>Disable PAM authentication in OpenSSH. Users will still
|
|
be able to log in using their Unix password, OPIE or SSH
|
|
keys.</p>
|
|
<p>To do this, execute the following commands as root:</p>
|
|
<pre># echo 'UsePAM no' >>/etc/ssh/sshd_config</pre>
|
|
<pre># echo 'PasswordAuthentication yes' >>/etc/ssh/sshd_config</pre>
|
|
<pre># /etc/rc.d/sshd restart</pre>
|
|
</li>
|
|
<li>
|
|
<p>If disabling PAM is not an option - if, for instance, you use
|
|
RADIUS authentication, or store user passwords in an SQL database
|
|
- you may instead disable privilege separation. However, this may
|
|
leave OpenSSH vulnerable to hitherto unknown bugs, and should be
|
|
considered a last resort.</p>
|
|
<p>To do this, execute the following commands as root:</p>
|
|
<pre># echo 'UsePrivilegeSeparation no' >>/etc/ssh/sshd_config</pre>
|
|
<pre># /etc/rc.d/sshd restart</pre>
|
|
</li>
|
|
</ol>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2006-0883</cvename>
|
|
<freebsdsa>SA-06:09.openssh</freebsdsa>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-03-01</discovery>
|
|
<entry>2006-03-12</entry>
|
|
<modified>2006-06-09</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="948921ad-afbc-11da-bad9-02e081235dab">
|
|
<topic>GnuPG does not detect injection of unsigned data</topic>
|
|
<affects>
|
|
<package>
|
|
<name>gnupg</name>
|
|
<range><lt>1.4.2.2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Werner Koch reports:</p>
|
|
<blockquote cite="http://lists.gnupg.org/pipermail/gnupg-announce/2006q1/000216.html">
|
|
<p>In the aftermath of the false positive signature
|
|
verfication bug (announced 2006-02-15) more thorough testing
|
|
of the fix has been done and another vulnerability has been
|
|
detected. This new problem affects the use of *gpg* for
|
|
verification of signatures which are _not_ detached
|
|
signatures. The problem also affects verification of
|
|
signatures embedded in encrypted messages; i.e. standard use
|
|
of gpg for mails.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2006-0049</cvename>
|
|
<mlist msgid="87d5gvh2kr.fsf@wheatstone.g10code.de">http://lists.gnupg.org/pipermail/gnupg-announce/2006q1/000216.html</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-03-09</discovery>
|
|
<entry>2006-03-10</entry>
|
|
<modified>2006-03-11</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="104beb63-af4d-11da-8414-0013d4a4a40e">
|
|
<topic>mplayer -- heap overflow in the ASF demuxer</topic>
|
|
<affects>
|
|
<package>
|
|
<name>mplayer</name>
|
|
<name>mplayer-gtk</name>
|
|
<name>mplayer-esound</name>
|
|
<name>mplayer-gtk-esound</name>
|
|
<range><lt>0.99.7_11</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Mplayer team reports:</p>
|
|
<blockquote cite="http://www.mplayerhq.hu/design7/news.html#vuln13">
|
|
<p>A potential buffer overflow was found in the ASF demuxer.
|
|
Arbitrary remote code execution is possible (under the user ID
|
|
running the player) when streaming an ASF file from a malicious
|
|
server or local code execution (under the user ID running the
|
|
player) if a malicious ASF file is played locally.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2006-0579</cvename>
|
|
<url>http://www.mplayerhq.hu/design7/news.html#vuln13</url>
|
|
<url>http://secunia.com/advisories/18718</url>
|
|
<url>http://bugs.gentoo.org/show_bug.cgi?id=122029</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-02-15</discovery>
|
|
<entry>2006-03-09</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="594ad3c5-a39b-11da-926c-0800209adf0e">
|
|
<topic>SSH.COM SFTP server -- format string vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>ssh2</name>
|
|
<name>ssh2-nox11</name>
|
|
<range><lt>3.2.9.1_5</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>SSH Communications Security Corp reports a format string
|
|
vulnerability in their SFTP server. This vulnerability could
|
|
cause a user with SCP/SFTP access only to get permission to
|
|
execute also other commands. It could also allow user A to
|
|
create a special file that when accessed by user B allows
|
|
user A to execute commands as user B.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2006-0705</cvename>
|
|
<bid>16640</bid>
|
|
<url>http://www.ssh.com/company/newsroom/article/715/</url>
|
|
<url>http://www.frsirt.com/english/advisories/2006/0554</url>
|
|
<url>http://securitytracker.com/id?1015619</url>
|
|
<url>http://secunia.com/advisories/18828</url>
|
|
<url>http://xforce.iss.net/xforce/xfdb/24651</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-02-13</discovery>
|
|
<entry>2006-03-04</entry>
|
|
<modified>2006-03-06</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="6107efb9-aae3-11da-aea1-000854d03344">
|
|
<topic>gtar -- invalid headers buffer overflow</topic>
|
|
<affects>
|
|
<package>
|
|
<name>gtar</name>
|
|
<range><lt>1.15.1_2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>GNU tar is vulnerable to a buffer overflow, caused by
|
|
improper bounds checking of the PAX extended headers. By
|
|
tricking an user into processing a specially crafted tar
|
|
archive, this could be exploited to execute arbitrary
|
|
code with the privileges of the user.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>16764</bid>
|
|
<cvename>CVE-2006-0300</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-02-22</discovery>
|
|
<entry>2006-03-03</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="46f7b598-a781-11da-906a-fde5cdde365e">
|
|
<topic>bugzilla -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>bugzilla</name>
|
|
<name>ja-bugzilla</name>
|
|
<range><ge>2.17.1</ge><lt>2.20.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Some vulnerabilities have been reported in Bugzilla,
|
|
which can be exploited by malicious users to conduct SQL injection
|
|
attacks, and by malicious people to disclose sensitive information
|
|
and conduct script insertion attacks.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2006-2420</cvename>
|
|
<cvename>CVE-2006-0916</cvename>
|
|
<cvename>CVE-2006-0915</cvename>
|
|
<cvename>CVE-2006-0914</cvename>
|
|
<cvename>CVE-2006-0913</cvename>
|
|
<url>http://www.bugzilla.org/security/2.18.4/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-02-20</discovery>
|
|
<entry>2006-02-27</entry>
|
|
<modified>2006-11-11</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="af9018b6-a4f5-11da-bb41-0011433a9404">
|
|
<topic>squirrelmail -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>squirrelmail</name>
|
|
<range><lt>1.4.6</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Multiple vulnerabilities has been discovered since 1.4.5,
|
|
including IMAP injection as well as some XSS issues.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2006-0377</cvename>
|
|
<cvename>CVE-2006-0195</cvename>
|
|
<cvename>CVE-2006-0188</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-02-23</discovery>
|
|
<entry>2006-02-24</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="e319da0b-a228-11da-b410-000e0c2e438a">
|
|
<topic>gedit -- format string vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>gedit</name>
|
|
<range><lt>2.10.3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Yan Feng reports a format string vulnerability in gedit.
|
|
This vulnerability could cause a denial of service with a
|
|
binary file that contains format string characters within
|
|
the filename. It had been reported that web browsers
|
|
and email clients can be configured to provide a filename as
|
|
an argument to gedit.:</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CAN-2005-1686</cvename>
|
|
<mlist msgid="20050520202628.12260.qmail@www.securityfocus.com">:http://marc.theaimsgroup.com/?l=bugtraq&m=111661117701398</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-05-20</discovery>
|
|
<entry>2006-02-20</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="07ead557-a220-11da-b410-000e0c2e438a">
|
|
<topic>WebCalendar -- unauthorized access vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>WebCalendar</name>
|
|
<range><lt>1.0.0</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>SecurityFocus reports that WebCalendar is affected by
|
|
an unauthorized access vulnerability. The vulnerability
|
|
is caused by improper checking of the authentication
|
|
mechanism before access is being permitted to the
|
|
"assistant_edit.php" file.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>14072</bid>
|
|
<cvename>CAN-2005-2320</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-06-27</discovery>
|
|
<entry>2006-02-20</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="9cd52bc6-a213-11da-b410-000e0c2e438a">
|
|
<topic>abiword, koffice -- stack based buffer overflow vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>koffice</name>
|
|
<range><gt>1.2.0</gt><lt>1.4.1_1,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>abiword</name>
|
|
<range><lt>2.2.11</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Chris Evans reports that AbiWord is vulnerable to multiple
|
|
stack-based buffer overflow vulnerabilities. This
|
|
is caused by improper checking of the user-supplied data
|
|
before it is being copied to an too small buffer. The
|
|
vulnerability is triggered when someone is importing RTF
|
|
files.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>15096</bid>
|
|
<cvename>CAN-2005-2972</cvename>
|
|
<url>http://scary.beasts.org/security/CESA-2005-006.txt</url>
|
|
<url>http://www.abisource.com/changelogs/2.2.11.phtml</url>
|
|
<url>http://www.kde.org/info/security/advisory-20051011-1.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-10-14</discovery>
|
|
<entry>2006-02-20</entry>
|
|
<modified>2006-02-20</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="0b2b4b4d-a07c-11da-be0a-000c6ec775d9">
|
|
<topic>postgresql81-server -- SET ROLE privilege escalation</topic>
|
|
<affects>
|
|
<package>
|
|
<name>postgresql-server</name>
|
|
<range><ge>8.1.0</ge><lt>8.1.3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The PostgreSQL team reports:</p>
|
|
<blockquote cite="http://www.postgresql.org/docs/8.1/static/release.html#RELEASE-8-1-3">
|
|
<p>Due to inadequate validity checking, a user could exploit
|
|
the special case that SET ROLE normally uses to restore
|
|
the previous role setting after an error. This allowed
|
|
ordinary users to acquire superuser status, for
|
|
example.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2006-0553</cvename>
|
|
<url>http://www.postgresql.org/docs/8.1/static/release.html#RELEASE-8-1-3</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-02-14</discovery>
|
|
<entry>2006-02-18</entry>
|
|
<modified>2006-08-13</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="63fe4189-9f97-11da-ac32-0001020eed82">
|
|
<topic>gnupg -- false positive signature verification</topic>
|
|
<affects>
|
|
<package>
|
|
<name>gnupg</name>
|
|
<range><lt>1.4.2.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Werner Koch reports:</p>
|
|
<blockquote cite="http://marc.theaimsgroup.com/?l=gnupg-devel&m=113999098729114">
|
|
<p>The Gentoo project identified a security related bug in
|
|
GnuPG. When using any current version of GnuPG for
|
|
unattended signature verification (e.g. by scripts and
|
|
mail programs), false positive signature verification of
|
|
detached signatures may occur.</p>
|
|
<p>This problem affects the tool *gpgv*, as well as using
|
|
"gpg --verify" to imitate gpgv, if only the exit code of
|
|
the process is used to decide whether a detached signature
|
|
is valid. This is a plausible mode of operation for
|
|
gpgv.</p>
|
|
<p>If, as suggested, the --status-fd generated output is
|
|
used to decide whether a signature is valid, no problem
|
|
exists. In particular applications making use of the
|
|
GPGME library[2] are not affected.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2006-0455</cvename>
|
|
<mlist msgid="87u0b1xdru.fsf@wheatstone.g10code.de">http://marc.theaimsgroup.com/?l=gnupg-devel&m=113999098729114</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-02-15</discovery>
|
|
<entry>2006-02-17</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="e34d0c2e-9efb-11da-b410-000e0c2e438a">
|
|
<topic>rssh -- privilege escalation vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>rssh</name>
|
|
<range><lt>2.3.0</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Pizzashack reports:</p>
|
|
<blockquote cite="http://www.pizzashack.org/rssh/security.shtml">
|
|
<p>Max Vozeler has reported a problem whereby rssh can
|
|
allow users who have shell access to systems where rssh
|
|
is installed (and rssh_chroot_helper is installed SUID)
|
|
to gain root access to the system, due to the ability to
|
|
chroot to arbitrary locations. There are a lot of
|
|
potentially mitigating factors, but to be safe you should
|
|
upgrade immediately.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>16050</bid>
|
|
<cvename>CVE-2005-3345</cvename>
|
|
<url>http://www.pizzashack.org/rssh/security.shtml</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-12-18</discovery>
|
|
<entry>2006-02-16</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="d38e1810-9ef7-11da-b410-000e0c2e438a">
|
|
<topic>tor -- malicious tor server can locate a hidden service</topic>
|
|
<affects>
|
|
<package>
|
|
<name>tor</name>
|
|
<range><lt>0.1.0.12</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Roger Dingledine reports:</p>
|
|
<blockquote cite="http://archives.seul.org/or/announce/Jan-2006/msg00001.html">
|
|
<p>If you offer a Tor hidden service, an adversary who can
|
|
run a fast Tor server and who knows some basic statistics
|
|
can find the location of your hidden service in a matter of
|
|
minutes to hours.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2006-0414</cvename>
|
|
<url>http://archives.seul.org/or/announce/Jan-2006/msg00001.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-01-12</discovery>
|
|
<entry>2006-02-16</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="1b725079-9ef6-11da-b410-000e0c2e438a">
|
|
<topic>sudo -- arbitrary command execution</topic>
|
|
<affects>
|
|
<package>
|
|
<name>sudo</name>
|
|
<range><lt>1.6.8.10</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Tavis Ormandy reports:</p>
|
|
<blockquote cite="http://www.courtesan.com/sudo/alerts/bash_env.html">
|
|
<p>The bash shell uses the value of the PS4 environment
|
|
variable (after expansion) as a prefix for commands run
|
|
in execution trace mode. Execution trace mode (xtrace) is
|
|
normally set via bash's -x command line option or
|
|
interactively by running "set -o xtrace". However, it may
|
|
also be enabled by placing the string "xtrace" in the
|
|
SHELLOPTS environment variable before bash is started.</p>
|
|
<p>A malicious user with sudo access to a shell script that
|
|
uses bash can use this feature to run arbitrary commands
|
|
for each line of the script.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>15191</bid>
|
|
<cvename>CVE-2005-2959</cvename>
|
|
<url>http://www.courtesan.com/sudo/alerts/bash_env.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-10-25</discovery>
|
|
<entry>2006-02-16</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="a78299e7-9ef3-11da-b410-000e0c2e438a">
|
|
<topic>libtomcrypt -- weak signature scheme with ECC keys</topic>
|
|
<affects>
|
|
<package>
|
|
<name>libtomcrypt</name>
|
|
<range><le>1.02</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Secure Science Corporation reports that libtomcrypt is
|
|
vulnerable to a weak signature scheme. This allows an
|
|
attacker to create a valid random signature and use that to
|
|
sign arbitrary messages without requiring the private key.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<mlist msgid="4276CC31.9000307@securescience.net">http://marc.theaimsgroup.com/?l=bugtraq&m=111540819703204</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-05-01</discovery>
|
|
<entry>2006-02-16</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="592815da-9eed-11da-b410-000e0c2e438a">
|
|
<topic>mantis -- "view_filters_page.php" cross site scripting vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>mantis</name>
|
|
<range><lt>1.0.0a4</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>r0t reports:</p>
|
|
<blockquote cite="http://pridels.blogspot.com/2005/12/mantis-bugtracking-system-xss-vuln.html">
|
|
<p>Mantis contains a flaw that allows a remote cross site
|
|
scripting attack. This flaw exists because input passed to
|
|
"target_field" parameter in "view_filters_page.php" is not
|
|
properly sanitised before being returned to the user. This
|
|
could allow a user to create a specially crafted URL that
|
|
would execute arbitrary code in a user's browser within the
|
|
trust relationship between the browser and the server,
|
|
leading to a loss of integrity.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CAN-2005-4238</cvename>
|
|
<url>http://pridels.blogspot.com/2005/12/mantis-bugtracking-system-xss-vuln.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-12-13</discovery>
|
|
<entry>2006-02-16</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="28c9243a-72ed-11da-8c1d-000e0c2e438a">
|
|
<topic>phpbb -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>phpbb</name>
|
|
<name>zh-phpbb-tw</name>
|
|
<range><lt>2.0.18</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Multiple vulnerabilities have been reported within phpbb.
|
|
phpbb is proven vulnerable to:</p>
|
|
<ul>
|
|
<li>script insertion,</li>
|
|
<li>bypassing of protetion mechanisms,</li>
|
|
<li>multiple cross site scripting vulnerabilities,</li>
|
|
<li>SQL injection,</li>
|
|
<li>arbitrary code execution</li>
|
|
</ul>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>15170</bid>
|
|
<bid>15243</bid>
|
|
<cvename>CVE-2005-3310</cvename>
|
|
<cvename>CVE-2005-3415</cvename>
|
|
<cvename>CVE-2005-3416</cvename>
|
|
<cvename>CVE-2005-3417</cvename>
|
|
<cvename>CVE-2005-3418</cvename>
|
|
<cvename>CVE-2005-3419</cvename>
|
|
<cvename>CVE-2005-3420</cvename>
|
|
<cvename>CVE-2005-3536</cvename>
|
|
<cvename>CVE-2005-3537</cvename>
|
|
<mlist msgid="20051022132217.10390.qmail@securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&m=113017003617987</mlist>
|
|
<url>http://www.hardened-php.net/advisory_172005.75.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-10-24</discovery>
|
|
<entry>2006-02-16</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="486aff57-9ecd-11da-b410-000e0c2e438a">
|
|
<topic>postgresql -- character conversion and tsearch2 vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>postgresql</name>
|
|
<range><ge>7.2.0</ge><lt>7.2.8</lt></range>
|
|
<range><ge>7.3.0</ge><lt>7.3.10</lt></range>
|
|
<range><ge>7.4.0</ge><lt>7.4.8</lt></range>
|
|
<range><ge>8.0.0</ge><lt>8.0.3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The postgresql development team reports:</p>
|
|
<blockquote cite="http://www.postgresql.org/about/news.315">
|
|
<p>The more severe of the two errors is that the functions
|
|
that support client-to-server character set conversion
|
|
can be called from SQL commands by unprivileged users,
|
|
but these functions are not designed to be safe against
|
|
malicious choices of argument values. This problem exists
|
|
in PostgreSQL 7.3.* through 8.0.*. The recommended fix is
|
|
to disable public EXECUTE access for these functions. This
|
|
does not affect normal usage of the functions for character
|
|
set conversion, but it will prevent misuse.</p>
|
|
<p>The other error is that the contrib/tsearch2 module
|
|
misdeclares several functions as returning type "internal"
|
|
when they do not have any "internal" argument. This breaks
|
|
the type safety of "internal" by allowing users to
|
|
construct SQL commands that invoke other functions accepting
|
|
"internal" arguments. The consequences of this have not been
|
|
investigated in detail, but it is certainly at least possible
|
|
to crash the backend.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CAN-2005-1409</cvename>
|
|
<cvename>CAN-2005-1410</cvename>
|
|
<url>http://www.postgresql.org/about/news.315</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-05-02</discovery>
|
|
<entry>2006-02-16</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="f6447303-9ec9-11da-b410-000e0c2e438a">
|
|
<topic>heartbeat -- insecure temporary file creation vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>heartbeat</name>
|
|
<range><lt>1.2.4</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Eric Romang reports a temporary file creation vulnerability
|
|
within heartbeat. The vulnerability is caused by hardcoded
|
|
temporary file usage. This can cause an attacker to create
|
|
an arbitrary symlink causing the application to overwrite the
|
|
symlinked file with the permissions of the user executing the
|
|
application.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CAN-2005-2231</cvename>
|
|
<url>http://www.zataz.net/adviso/heartbeat-06272005.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-07-12</discovery>
|
|
<entry>2006-02-16</entry>
|
|
<modified>2006-04-16</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="432bf98d-9e25-11da-b410-000e0c2e438a">
|
|
<topic>kpdf -- heap based buffer overflow</topic>
|
|
<affects>
|
|
<package>
|
|
<name>kdegraphics</name>
|
|
<range><lt>3.5.1_1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The KDE team reports:</p>
|
|
<blockquote cite="http://www.kde.org/info/security/advisory-20060202-1.txt">
|
|
<p>kpdf, the KDE pdf viewer, shares code with xpdf. xpdf
|
|
contains a heap based buffer overflow in the splash
|
|
rasterizer engine that can crash kpdf or even execute
|
|
arbitrary code.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2006-0301</cvename>
|
|
<url>http://www.kde.org/info/security/advisory-20060202-1.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-02-02</discovery>
|
|
<entry>2006-02-15</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="bb33981a-7ac6-11da-bf72-00123f589060">
|
|
<topic>perl, webmin, usermin -- perl format string integer wrap vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>perl</name>
|
|
<range><ge>5.6.0</ge><lt>5.6.2</lt></range>
|
|
<range><ge>5.8.0</ge><lt>5.8.7_1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>webmin</name>
|
|
<range><lt>1.250</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>usermin</name>
|
|
<range><lt>1.180</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Perl Development page reports:</p>
|
|
<blockquote cite="http://dev.perl.org/perl5/news/2005/perl_patches_fix_sprintf_buffer.html">
|
|
<p>Dyad Security recently released a security advisory explaining how
|
|
in certain cases, a carefully crafted format string passed to
|
|
sprintf can cause a buffer overflow. This buffer overflow can then
|
|
be used by an attacker to execute code on the machine. This was
|
|
discovered in the context of a design problem with the Webmin
|
|
administration package that allowed a malicious user to pass
|
|
unchecked data into sprintf.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>15629</bid>
|
|
<cvename>CVE-2005-3912</cvename>
|
|
<cvename>CVE-2005-3962</cvename>
|
|
<url>http://dev.perl.org/perl5/news/2005/perl_patches_fix_sprintf_buffer.html</url>
|
|
<url>http://www.dyadsecurity.com/perl-0002.html</url>
|
|
<url>http://www.dyadsecurity.com/webmin-0001.html</url>
|
|
<url>http://www.webmin.com/security.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-09-23</discovery>
|
|
<entry>2006-02-15</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="12f9d9e9-9e1e-11da-b410-000e0c2e438a">
|
|
<topic>phpicalendar -- cross site scripting vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>phpicalendar</name>
|
|
<range><lt>2.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Francesco Ongaro reports that phpicalendar is vulnerable for
|
|
a cross site scripting attack. The vulnerability is caused by
|
|
improper validation of the index.php file allowing attackers
|
|
to include an arbitrary file with the .php extension</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>15193</bid>
|
|
<cvename>CVE-2005-3366</cvename>
|
|
<url>http://www.ush.it/2005/10/25/php-icalendar-css/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-10-25</discovery>
|
|
<entry>2006-02-15</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="f1f163ce-9e09-11da-b410-000e0c2e438a">
|
|
<topic>phpicalendar -- file disclosure vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>phpicalendar</name>
|
|
<range><lt>2.21</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The phpicalendar team reports that there is an
|
|
unspecified vulnerability within phpicalendar. This
|
|
seems to be a file disclosure vulnerability caused by
|
|
improper checking of the template parsing function.
|
|
This would allow an attacker to disclose any file
|
|
readable by the user under which the webserver runs.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://phpicalendar.net/forums/viewtopic.php?t=396</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-02-08</discovery>
|
|
<entry>2006-02-15</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="dfb71c00-9d44-11da-8c1d-000e0c2e438a">
|
|
<topic>FreeBSD -- Infinite loop in SACK handling</topic>
|
|
<affects>
|
|
<system>
|
|
<name>FreeBSD</name>
|
|
<range><gt>5.4</gt><lt>5.4_11</lt></range>
|
|
<range><gt>5.3</gt><lt>5.3_26</lt></range>
|
|
</system>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Problem description:</p>
|
|
<p>When insufficient memory is available to handle an
|
|
incoming selective acknowledgement, the TCP/IP stack may
|
|
enter an infinite loop.</p>
|
|
<p>Impact:</p>
|
|
<p>By opening a TCP connection and sending a carefully crafted
|
|
series of packets, an attacker may be able to cause a denial
|
|
of service.</p>
|
|
<p>Workaround:</p>
|
|
<p>On FreeBSD 5.4, the net.inet.tcp.sack.enable sysctl can be used to
|
|
disable the use of SACK:</p>
|
|
<p># sysctl net.inet.tcp.sack.enable=0</p>
|
|
<p>No workaround is available for FreeBSD 5.3.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2006-0433</cvename>
|
|
<freebsdsa>SA-06:08.sack</freebsdsa>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-02-01</discovery>
|
|
<entry>2006-02-14</entry>
|
|
<modified>2006-06-09</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="52ba7713-9d42-11da-8c1d-000e0c2e438a">
|
|
<topic>pf -- IP fragment handling panic</topic>
|
|
<affects>
|
|
<system>
|
|
<name>FreeBSD</name>
|
|
<range><gt>6.0</gt><lt>6.0_4</lt></range>
|
|
<range><gt>5.4</gt><lt>5.4_10</lt></range>
|
|
<range><gt>5.3</gt><lt>5.3_25</lt></range>
|
|
</system>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Problem description:</p>
|
|
<p>A logic bug in pf's IP fragment cache may result in a packet
|
|
fragment being inserted twice, violating a kernel
|
|
invariant.</p>
|
|
<p>Impact:</p>
|
|
<p>By sending carefully crafted sequence of IP packet fragments,
|
|
a remote attacker can cause a system running pf with a ruleset
|
|
containing a 'scrub fragment crop' or 'scrub fragment
|
|
drop-ovl' rule to crash.</p>
|
|
<p>Workaround:</p>
|
|
<p>Do not use 'scrub fragment crop' or 'scrub fragment drop-ovl'
|
|
rules on systems running pf. In most cases, such rules can be
|
|
replaced by 'scrub fragment reassemble' rules; see the
|
|
pf.conf(5) manual page for more details.</p>
|
|
|
|
<p>Systems which do not use pf, or use pf but do not use the
|
|
aforementioned rules, are not affected by this issue.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2006-0381</cvename>
|
|
<freebsdsa>SA-06:07.pf</freebsdsa>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-01-25</discovery>
|
|
<entry>2006-02-14</entry>
|
|
<modified>2006-06-09</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="7a4f2aca-9d40-11da-8c1d-000e0c2e438a">
|
|
<topic>FreeBSD -- Local kernel memory disclosure</topic>
|
|
<affects>
|
|
<system>
|
|
<name>FreeBSD</name>
|
|
<range><gt>6.0</gt><lt>6.0_4</lt></range>
|
|
</system>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Problem description:</p>
|
|
<p>A buffer allocated from the kernel stack may not be completely
|
|
initialized before being copied to userland. [CVE-2006-0379]</p>
|
|
<p>A logic error in computing a buffer length may allow too much
|
|
data to be copied into userland. [CVE-2006-0380]</p>
|
|
<p>Impact:</p>
|
|
<p>Portions of kernel memory may be disclosed to local users.
|
|
Such memory might contain sensitive information, such as
|
|
portions of the file cache or terminal buffers. This
|
|
information might be directly useful, or it might be
|
|
leveraged to obtain elevated privileges in some way. For
|
|
example, a terminal buffer might include a user-entered
|
|
password.</p>
|
|
<p>Workaround:</p>
|
|
<p>No workaround is available.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2006-0379</cvename>
|
|
<cvename>CVE-2006-0380</cvename>
|
|
<freebsdsa>SA-06:06.kmem</freebsdsa>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-01-25</discovery>
|
|
<entry>2006-02-14</entry>
|
|
<modified>2006-06-09</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="dade3316-9d31-11da-8c1d-000e0c2e438a">
|
|
<topic>IEEE 802.11 -- buffer overflow</topic>
|
|
<affects>
|
|
<system>
|
|
<name>FreeBSD</name>
|
|
<range><gt>6.0</gt><lt>6.0_3</lt></range>
|
|
</system>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Problem description:</p>
|
|
<p>An integer overflow in the handling of corrupt IEEE 802.11
|
|
beacon or probe response frames when scanning for existing
|
|
wireless networks can result in the frame overflowing a
|
|
buffer.</p>
|
|
<p>Impact:</p>
|
|
<p>An attacker able broadcast a carefully crafted beacon or
|
|
probe response frame may be able to execute arbitrary code
|
|
within the context of the FreeBSD kernel on any system
|
|
scanning for wireless networks.</p>
|
|
<p>Workaround:</p>
|
|
<p>No workaround is available, but systems without IEEE 802.11
|
|
hardware or drivers loaded are not vulnerable.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2006-0226</cvename>
|
|
<freebsdsa>SA-06:05.80211</freebsdsa>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-01-18</discovery>
|
|
<entry>2006-02-14</entry>
|
|
<modified>2006-06-09</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="d7c1d00d-9d2e-11da-8c1d-000e0c2e438a">
|
|
<topic>ipfw -- IP fragment denial of service</topic>
|
|
<affects>
|
|
<system>
|
|
<name>FreeBSD</name>
|
|
<range><gt>6.0</gt><lt>6.0_2</lt></range>
|
|
</system>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Problem description:</p>
|
|
<p>The firewall maintains a pointer to layer 4 header
|
|
information in the event that it needs to send a TCP reset
|
|
or ICMP error message to discard packets. Due to incorrect
|
|
handling of IP fragments, this pointer fails to get
|
|
initialized.</p>
|
|
<p>Impact:</p>
|
|
<p>An attacker can cause the firewall to crash by sending ICMP
|
|
IP fragments to or through firewalls which match any reset,
|
|
reject or unreach actions.</p>
|
|
<p>Workaround:</p>
|
|
<p>Change any reset, reject or unreach actions to deny. It
|
|
should be noted that this will result in packets being
|
|
silently discarded.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2006-0054</cvename>
|
|
<freebsdsa>SA-06:04.ipfw</freebsdsa>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-01-11</discovery>
|
|
<entry>2006-02-14</entry>
|
|
<modified>2006-06-09</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="1613db79-8e52-11da-8426-000fea0a9611">
|
|
<topic>kpopup -- local root exploit and local denial of service</topic>
|
|
<affects>
|
|
<package>
|
|
<name>kpopup</name>
|
|
<range><ge>0.9.1</ge><le>0.9.5</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Mitre CVE reports:</p>
|
|
<blockquote cite="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-1170">
|
|
<p>Format string vulnerability in main.cpp in kpopup
|
|
0.9.1-0.9.5pre2 allows local users to cause a denial of
|
|
service (segmentation fault) and possibly execute
|
|
arbitrary code via format string specifiers in command
|
|
line arguments.</p>
|
|
</blockquote>
|
|
<blockquote cite="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-1167">
|
|
<p>misc.cpp in KPopup 0.9.1 trusts the PATH variable when
|
|
executing killall, which allows local users to elevate
|
|
their privileges by modifying the PATH variable to
|
|
reference a malicious killall program.</p>
|
|
</blockquote>
|
|
<p>SecurityFocus credits "b0f" b0fnet@yahoo.com</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2003-1170</cvename>
|
|
<bid>8918</bid>
|
|
<cvename>CVE-2003-1167</cvename>
|
|
<bid>8915</bid>
|
|
<url>http://www.securityfocus.com/archive/1/342736</url>
|
|
<url>http://www.henschelsoft.de/kpopup_en.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2003-10-28</discovery>
|
|
<entry>2006-02-07</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="6b0215ae-8f26-11da-8c1d-000e0c2e438a">
|
|
<topic>cpio -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<system>
|
|
<name>FreeBSD</name>
|
|
<range><ge>6.0</ge><lt>6.0_2</lt></range>
|
|
<range><ge>5.4</ge><lt>5.4_9</lt></range>
|
|
<range><ge>5.3</ge><lt>5.3_24</lt></range>
|
|
<range><ge>4.11</ge><lt>4.11_14</lt></range>
|
|
<range><ge>4.10</ge><lt>4.10_20</lt></range>
|
|
</system>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Problem description:</p>
|
|
<p>A number of issues has been discovered in cpio:</p>
|
|
<p>When creating a new file, cpio closes the file before setting
|
|
its permissions. (CVE-2005-1111)</p>
|
|
<p>When extracting files cpio does not properly sanitize file
|
|
names to filter out ".." components, even if the
|
|
--no-absolute-filenames option is used. (CVE-2005-1229)</p>
|
|
<p>When adding large files (larger than 4 GB) to a cpio archive
|
|
on 64-bit platforms an internal buffer might overflow.
|
|
(CVE-2005-4268)</p>
|
|
<p>Impact</p>
|
|
<p>The first problem can allow a local attacker to change the
|
|
permissions of files owned by the user executing cpio providing
|
|
that they have write access to the directory in which the file
|
|
is being extracted. (CVE-2005-1111)</p>
|
|
<p>The lack of proper file name sanitation can allow an attacker
|
|
to overwrite arbitrary local files when extracting files from
|
|
a cpio archive. (CVE-2005-1229)</p>
|
|
<p>The buffer-overflow on 64-bit platforms could lead cpio to a
|
|
Denial-of-Service situation (crash) or possibly execute
|
|
arbitrary code with the permissions of the user running
|
|
cpio. (CVE-2005-4268)</p>
|
|
<p>Workaround</p>
|
|
<p>Use a different utility to create and extract cpio archives,
|
|
for example pax(1) or (on FreeBSD 5.3 or later) tar(1). If
|
|
this is not possible, do not extract untrusted archives and
|
|
when running on 64-bit platforms do not add untrusted files
|
|
to cpio archives.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-1111</cvename>
|
|
<cvename>CVE-2005-1229</cvename>
|
|
<cvename>CVE-2005-4268</cvename>
|
|
<freebsdsa>SA-06:03.cpio</freebsdsa>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-01-11</discovery>
|
|
<entry>2006-01-27</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="726dd9bd-8f25-11da-8c1d-000e0c2e438a">
|
|
<topic>ee -- temporary file privilege escalation</topic>
|
|
<affects>
|
|
<system>
|
|
<name>FreeBSD</name>
|
|
<range><ge>6.0</ge><lt>6.0_2</lt></range>
|
|
<range><ge>5.4</ge><lt>5.4_9</lt></range>
|
|
<range><ge>5.3</ge><lt>5.3_24</lt></range>
|
|
<range><ge>4.11</ge><lt>4.11_14</lt></range>
|
|
<range><ge>4.10</ge><lt>4.10_20</lt></range>
|
|
</system>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Problem description</p>
|
|
<p>The ispell_op function used by ee(1) while executing spell
|
|
check operations employs an insecure method of temporary file
|
|
generation. This method produces predictable file names based
|
|
on the process ID and fails to confirm which path will be over
|
|
written with the user.<br/>
|
|
It should be noted that ispell does not have to be installed
|
|
in order for this to be exploited. The option simply needs to
|
|
be selected.</p>
|
|
<p>Impact</p>
|
|
<p>These predictable temporary file names are problematic
|
|
because they allow an attacker to take advantage of a race
|
|
condition in order to execute a symlink attack, which could
|
|
allow them to overwrite files on the system in the context of
|
|
the user running the ee(1) editor.</p>
|
|
<p>Workaround</p>
|
|
<p>Instead of invoking ispell through ee(1), invoke it directly.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>16207</bid>
|
|
<cvename>CVE-2006-0055</cvename>
|
|
<freebsdsa>SA-06:02.ee</freebsdsa>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-01-11</discovery>
|
|
<entry>2006-01-27</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="c01a25f5-8f20-11da-8c1d-000e0c2e438a">
|
|
<topic>texindex -- temporary file privilege escalation</topic>
|
|
<affects>
|
|
<system>
|
|
<name>FreeBSD</name>
|
|
<range><ge>6.0</ge><lt>6.0_2</lt></range>
|
|
<range><ge>5.4</ge><lt>5.4_9</lt></range>
|
|
<range><ge>5.3</ge><lt>5.3_24</lt></range>
|
|
<range><ge>4.11</ge><lt>4.11_14</lt></range>
|
|
<range><ge>4.10</ge><lt>4.10_20</lt></range>
|
|
</system>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Problem description</p>
|
|
<p>The "sort_offline" function used by texindex(1) employs the
|
|
"maketempname" function, which produces predictable file names
|
|
and fails to validate that the paths do not exist.</p>
|
|
<p>Impact</p>
|
|
<p>These predictable temporary file names are problematic because
|
|
they allow an attacker to take advantage of a race condition in
|
|
order to execute a symlink attack, which could enable them to
|
|
overwrite files on the system in the context of the user running
|
|
the texindex(1) utility.</p>
|
|
<p>Workaround</p>
|
|
<p>No workaround is available, but the problematic code is only
|
|
executed if the input file being processed is 500kB or more in
|
|
length; as a result, users working with documents of less than
|
|
several hundred pages are very unlikely to be affected.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>14854</bid>
|
|
<cvename>CAN-2005-3011</cvename>
|
|
<freebsdsa>SA-06:01.texindex</freebsdsa>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-01-11</discovery>
|
|
<entry>2006-01-27</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="c5c17ead-8f23-11da-8c1d-000e0c2e438a">
|
|
<topic>cvsbug -- race condition</topic>
|
|
<affects>
|
|
<system>
|
|
<name>FreeBSD</name>
|
|
<range><ge>5.4</ge><lt>5.4_7</lt></range>
|
|
<range><ge>5.3</ge><lt>5.3_22</lt></range>
|
|
<range><ge>4.11</ge><lt>4.11_12</lt></range>
|
|
<range><ge>4.10</ge><lt>4.10_18</lt></range>
|
|
</system>
|
|
<package>
|
|
<name>cvs+ipv6</name>
|
|
<range><lt>1.11.17_1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Problem description</p>
|
|
<p>A temporary file is created, used, deleted, and then
|
|
re-created with the same name. This creates a window during
|
|
which an attacker could replace the file with a link to
|
|
another file. While cvsbug(1) is based on the send-pr(1)
|
|
utility, this problem does not exist in the version of
|
|
send-pr(1) distributed with FreeBSD.<br/>
|
|
In FreeBSD 4.10 and 5.3, some additional problems exist
|
|
concerning temporary file usage in both cvsbug(1) and
|
|
send-pr(1).</p>
|
|
<p>Impact</p>
|
|
<p>A local attacker could cause data to be written to any file
|
|
to which the user running cvsbug(1) (or send-pr(1) in FreeBSD
|
|
4.10 and 5.3) has write access. This may cause damage in
|
|
itself (e.g., by destroying important system files or
|
|
documents) or may be used to obtain elevated privileges.</p>
|
|
<p>Workaround</p>
|
|
<p>Do not use the cvsbug(1) utility on any system with untrusted
|
|
users.<br/>
|
|
Do not use the send-pr(1) utility on a FreeBSD 4.10 or 5.3
|
|
system with untrusted users.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CAN-2005-2693</cvename>
|
|
<freebsdsa>SA-05:20.cvsbug</freebsdsa>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-09-07</discovery>
|
|
<entry>2006-01-27</entry>
|
|
<modified>2006-11-08</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="57a0242d-8c4e-11da-8ddf-000ae42e9b93">
|
|
<topic>sge -- local root exploit in bundled rsh executable</topic>
|
|
<affects>
|
|
<package>
|
|
<name>sge</name>
|
|
<name>sgeee</name>
|
|
<range><lt>5.3.6.20040330_1</lt></range>
|
|
<range><gt>6.*</gt><lt>6.0.7.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Sun Microsystems reports:</p>
|
|
<blockquote cite="http://gridengine.sunsource.net/project/gridengine/news/SGE60u7_1-announce.html">
|
|
<p>The SGE 6.0u7_1 release fixes a security bug which can
|
|
allow malicious users to gain root access.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://gridengine.sunsource.net/project/gridengine/news/SGE60u7_1-announce.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-12-23</discovery>
|
|
<entry>2006-01-23</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="f11d3b22-88c6-11da-a7b2-0060084a00e5">
|
|
<topic>fetchmail -- crash when bouncing a message</topic>
|
|
<affects>
|
|
<package>
|
|
<name>fetchmail</name>
|
|
<range><ge>6.3.0</ge><lt>6.3.2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Matthias Andree reports:</p>
|
|
<blockquote cite="http://www.fetchmail.info/fetchmail-SA-2006-01.txt">
|
|
<p>Fetchmail contains a bug that causes itself to crash when
|
|
bouncing a message to the originator or to the local
|
|
postmaster. The crash happens after the bounce message has
|
|
been sent, when fetchmail tries to free the dynamic array
|
|
of failed addresses, and calls the free() function with an
|
|
invalid pointer.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2006-0321</cvename>
|
|
<url>http://www.fetchmail.info/fetchmail-SA-2006-01.txt</url>
|
|
<url>http://bugs.debian.org/348747</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-01-22</discovery>
|
|
<entry>2006-01-23</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="612a34ec-81dc-11da-a043-0002a5c3d308">
|
|
<topic>clamav -- possible heap overflow in the UPX code</topic>
|
|
<affects>
|
|
<package>
|
|
<name>clamav</name>
|
|
<range><lt>0.88</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>clamav-devel</name>
|
|
<range><lt>20060110</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Zero Day Initiative reports:</p>
|
|
<blockquote cite="http://www.zerodayinitiative.com/advisories/ZDI-06-001.html">
|
|
<p>This vulnerability allows remote attackers to execute
|
|
arbitrary code on vulnerable Clam AntiVirus
|
|
installations. Authentication is not required to exploit
|
|
this vulnerability.</p>
|
|
<p>This specific flaw exists within libclamav/upx.c during
|
|
the unpacking of executable files compressed with UPX. Due
|
|
to an invalid size calculation during a data copy from the
|
|
user-controlled file to heap allocated memory, an
|
|
exploitable memory corruption condition is created.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>16191</bid>
|
|
<cvename>CVE-2006-0162</cvename>
|
|
<mlist>http://lurker.clamav.net/message/20060109.213247.a16ae8db.en.html</mlist>
|
|
<url>http://www.zerodayinitiative.com/advisories/ZDI-06-001.html</url>
|
|
<url>http://secunia.com/advisories/18379/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-01-09</discovery>
|
|
<entry>2006-01-10</entry>
|
|
<modified>2006-01-15</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="6d9a28f8-8152-11da-817c-0001020eed82">
|
|
<topic>milter-bogom -- headerless message crash</topic>
|
|
<affects>
|
|
<package>
|
|
<name>milter-bogom</name>
|
|
<range><lt>1.8.2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Juan J. Marítnez reports:</p>
|
|
<blockquote cite="http://www.usebox.net/jjm/bogom/errata/bogom-errata-2006-1.txt">
|
|
<p>The milter crashes while processing a headerless
|
|
message</p>
|
|
<p>Impact: bogom crashes and sendmail moves it to error
|
|
state</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://www.usebox.net/jjm/bogom/errata/bogom-errata-2006-1.txt</url>
|
|
<mlist>http://alf.dyndns.ws/pipermail/milter/2006-January/000076.html</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2006-01-05</discovery>
|
|
<entry>2006-01-09</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="b747b2a9-7be0-11da-8ec4-0002b3b60e4c">
|
|
<topic>bogofilter -- heap corruption through excessively long words</topic>
|
|
<affects>
|
|
<package>
|
|
<name>bogofilter</name>
|
|
<range><ge>0.96.2</ge><lt>0.96.3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Matthias Andree reports:</p>
|
|
<blockquote cite="http://bogofilter.sourceforge.net/security/bogofilter-SA-2005-02">
|
|
<p>Bogofilter's/bogolexer's input handling in version 0.96.2 was not
|
|
keeping track of its output buffers properly and could overrun a
|
|
heap buffer if the input contained words whose length exceeded
|
|
16,384 bytes, the size of flex's input buffer. A "word" here refers
|
|
to a contiguous run of input octets that was not '_' and did not
|
|
match at least one of ispunct(), iscntrl() or isspace().</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-4592</cvename>
|
|
<url>http://bogofilter.sourceforge.net/security/bogofilter-SA-2005-02</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-10-23</discovery>
|
|
<entry>2006-01-07</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="92140bc9-7bde-11da-8ec4-0002b3b60e4c">
|
|
<topic>bogofilter -- heap corruption through malformed input</topic>
|
|
<affects>
|
|
<package>
|
|
<name>bogofilter</name>
|
|
<range><ge>0.93.5</ge><lt>0.96.3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Matthias Andree reports:</p>
|
|
<blockquote cite="http://bogofilter.sourceforge.net/security/bogofilter-SA-2005-01">
|
|
<p>When using Unicode databases (default in more recent bogofilter
|
|
installations), upon encountering invalid input sequences,
|
|
bogofilter or bogolexer could overrun a malloc()'d buffer,
|
|
corrupting the heap, while converting character sets. Bogofilter
|
|
would usually be processing untrusted data received from the
|
|
network at that time.</p>
|
|
|
|
<p>This problem was aggravated by an unrelated bug that made
|
|
bogofilter process binary attachments as though they were text, and
|
|
attempt charset conversion on them. Given the MIME default
|
|
character set, US-ASCII, all input octets in the range 0x80...0xff
|
|
were considered invalid input sequences and could trigger the heap
|
|
corruption.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-4591</cvename>
|
|
<url>http://bogofilter.sourceforge.net/security/bogofilter-SA-2005-01</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-10-22</discovery>
|
|
<entry>2006-01-07</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="c2fdb3bc-7d72-11da-b96e-000fb586ba73">
|
|
<topic>rxvt-unicode -- restore permissions on tty devices</topic>
|
|
<affects>
|
|
<package>
|
|
<name>rxvt-unicode</name>
|
|
<range><lt>6.3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A rxvt-unicode changelog reports:</p>
|
|
<blockquote cite="http://dist.schmorp.de/rxvt-unicode/Changes">
|
|
<p>SECURITY FIX: on systems using openpty, permissions were
|
|
not correctly updated on the tty device and were left as
|
|
world-readable and world-writable (likely in original rxvt,
|
|
too), and were not restored properly. Affected are only
|
|
systems where non-unix ptys were used (such as most BSDs).
|
|
Found, patched and debugged by Ryan Beasley.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://dist.schmorp.de/rxvt-unicode/Changes</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-12-31</discovery>
|
|
<entry>2006-01-04</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="9fff8dc8-7aa7-11da-bf72-00123f589060">
|
|
<topic>apache -- mod_imap cross-site scripting flaw</topic>
|
|
<affects>
|
|
<package>
|
|
<name>apache</name>
|
|
<range><ge>1.3</ge><lt>1.3.34_3</lt></range>
|
|
<range><ge>2.0.35</ge><lt>2.0.55_2</lt></range>
|
|
<range><ge>2.1</ge><lt>2.1.9_3</lt></range>
|
|
<range><ge>2.2</ge><lt>2.2.0_3</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>apache+mod_perl</name>
|
|
<range><lt>1.3.34_1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>apache_fp</name>
|
|
<range><ge>0</ge></range>
|
|
</package>
|
|
<package>
|
|
<name>apache+ipv6</name>
|
|
<range><lt>1.3.37</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>ru-apache</name>
|
|
<range><lt>1.3.34+30.22_1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>ru-apache+mod_ssl</name>
|
|
<range><lt>1.3.34+30.22+2.8.25_1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>apache+ssl</name>
|
|
<range><ge>1.3.0</ge><lt>1.3.33.1.55_2</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>apache+mod_ssl</name>
|
|
<name>apache+mod_ssl+ipv6</name>
|
|
<name>apache+mod_ssl+mod_accel</name>
|
|
<name>apache+mod_ssl+mod_accel+ipv6</name>
|
|
<name>apache+mod_ssl+mod_accel+mod_deflate</name>
|
|
<name>apache+mod_ssl+mod_accel+mod_deflate+ipv6</name>
|
|
<name>apache+mod_ssl+mod_deflate</name>
|
|
<name>apache+mod_ssl+mod_deflate+ipv6</name>
|
|
<name>apache+mod_ssl+mod_snmp</name>
|
|
<name>apache+mod_ssl+mod_snmp+mod_accel</name>
|
|
<name>apache+mod_ssl+mod_snmp+mod_accel+ipv6</name>
|
|
<name>apache+mod_ssl+mod_snmp+mod_deflate</name>
|
|
<name>apache+mod_ssl+mod_snmp+mod_deflate+ipv6</name>
|
|
<name>apache+mod_ssl+mod_snmp+mod_accel+mod_deflate+ipv6</name>
|
|
<range><lt>1.3.34+2.8.25_1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Apache HTTP Server Project reports:</p>
|
|
<blockquote cite="http://httpd.apache.org/security/vulnerabilities_13.html">
|
|
<p>A flaw in mod_imap when using the Referer directive with
|
|
image maps. In certain site configurations a remote
|
|
attacker could perform a cross-site scripting attack if a
|
|
victim can be forced to visit a malicious URL using
|
|
certain web browsers.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-3352</cvename>
|
|
<bid>15834</bid>
|
|
<url>http://www.apacheweek.com/features/security-13</url>
|
|
<url>http://www.apacheweek.com/features/security-20</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-11-01</discovery>
|
|
<entry>2006-01-01</entry>
|
|
<modified>2009-01-23</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="43770b1c-72f6-11da-8c1d-000e0c2e438a">
|
|
<topic>nbd-server -- buffer overflow vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>nbd-server</name>
|
|
<range><lt>2.8.2_1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Kurt Fitzner reports a buffer overflow vulnerability
|
|
within nbd. This could potentially allow the execution
|
|
of arbitrary code on the nbd server.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-3534</cvename>
|
|
<url>http://www.debian.org/security/2005/dsa-924</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-12-21</discovery>
|
|
<entry>2005-12-22</entry>
|
|
<modified>2005-12-25</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="b5a49db7-72fc-11da-9827-021106004fd6">
|
|
<topic>scponly -- local privilege escalation exploits</topic>
|
|
<affects>
|
|
<package>
|
|
<name>scponly</name>
|
|
<range><lt>4.2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Max Vozeler reports:</p>
|
|
<blockquote cite="https://lists.ccs.neu.edu/pipermail/scponly/2005-December/001027.html">
|
|
<p>If ALL the following conditions are true, administrators using
|
|
scponly-4.1 or older may be at risk of a local privilege
|
|
escalation exploit:</p>
|
|
<ul>
|
|
<li>the chrooted setuid scponlyc binary is installed</li>
|
|
<li>regular non-scponly users have interactive shell access
|
|
to the box</li>
|
|
<li>a user executable dynamically linked setuid binary
|
|
(such as ping) exists on the same file system mount
|
|
as the user's home directory</li>
|
|
<li>the operating system supports an LD_PRELOAD style
|
|
mechanism to overload dynamic library loading</li>
|
|
</ul>
|
|
</blockquote>
|
|
<p>Pekka Pessi also reports:</p>
|
|
<blockquote cite="https://lists.ccs.neu.edu/pipermail/scponly/2005-December/001027.html">
|
|
<p>If ANY the following conditions are true, administrators
|
|
using scponly-4.1 or older may be at risk of a local privilege
|
|
escalation exploit:</p>
|
|
<ul>
|
|
<li>scp compatibility is enabled</li>
|
|
<li>rsync compatibility is enabled</li>
|
|
</ul>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>https://lists.ccs.neu.edu/pipermail/scponly/2005-December/001027.html</url>
|
|
<url>http://sublimation.org/scponly/#relnotes</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-12-21</discovery>
|
|
<entry>2005-12-22</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="f7eb0b23-7099-11da-a15c-0060084a00e5">
|
|
<topic>fetchmail -- null pointer dereference in multidrop mode with headerless email</topic>
|
|
<affects>
|
|
<package>
|
|
<name>fetchmail</name>
|
|
<range><lt>6.3.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The fetchmail team reports:</p>
|
|
<blockquote cite="http://www.fetchmail.info/fetchmail-SA-2005-03.txt">
|
|
<p>Fetchmail contains a bug that causes an application crash
|
|
when fetchmail is configured for multidrop mode and the
|
|
upstream mail server sends a message without headers. As
|
|
fetchmail does not record this message as "previously fetched",
|
|
it will crash with the same message if it is re-executed, so it
|
|
cannot make progress. A malicious or broken-into upstream server
|
|
could thus cause a denial of service in fetchmail clients.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-4348</cvename>
|
|
<url>http://www.fetchmail.info/fetchmail-SA-2005-03.txt</url>
|
|
<url>http://article.gmane.org/gmane.mail.fetchmail.user/7573</url>
|
|
<url>http://bugs.debian.org/343836</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-12-19</discovery>
|
|
<entry>2005-12-19</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="82a41084-6ce7-11da-b90c-000e0c2e438a">
|
|
<topic>mantis -- "t_core_path" file inclusion vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>mantis</name>
|
|
<range><lt>1.0.0rc3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia Research reports:</p>
|
|
<blockquote cite="http://secunia.com/secunia_research/2005-46/advisory/">
|
|
<p>Input passed to the "t_core_path" parameter in
|
|
"bug_sponsorship_list_view_inc.php" isn't properly verified,
|
|
before it used to include files. This can be exploited to
|
|
include arbitrary files from external and local
|
|
resources.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-3335</cvename>
|
|
<url>http://secunia.com/secunia_research/2005-46/advisory/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-10-26</discovery>
|
|
<entry>2005-12-14</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="6e3b12e2-6ce3-11da-b90c-000e0c2e438a">
|
|
<topic>mantis -- "view_filters_page.php" cross-site scripting vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>mantis</name>
|
|
<range><lt>1.0.0rc4</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>r0t reports:</p>
|
|
<blockquote cite="http://pridels.blogspot.com/2005/12/mantis-bugtracking-system-xss-vuln.html">
|
|
<p>Mantis contains a flaw that allows a remote cross site
|
|
scripting attack. This flaw exists because input passed to
|
|
"target_field" parameter in "view_filters_page.php" isn't
|
|
properly sanitised before being returned to the user. This
|
|
could allow a user to create a specially crafted URL that
|
|
would execute arbitrary code in a user's browser within the
|
|
trust relationship between the browser and the server,
|
|
leading to a loss of integrity.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>15842</bid>
|
|
<url>http://pridels.blogspot.com/2005/12/mantis-bugtracking-system-xss-vuln.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-12-13</discovery>
|
|
<entry>2005-12-14</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="2506f558-6a8a-11da-b96e-000fb586ba73">
|
|
<topic>mnemo -- Cross site scripting vulnerabilities in several of the notepad name and note data fields</topic>
|
|
<affects>
|
|
<package>
|
|
<name>mnemo</name>
|
|
<range><lt>2.0.3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Announce of Mnemo H3 (2.0.3) (final):</p>
|
|
<blockquote cite="http://marc.theaimsgroup.com/?l=horde-announce&m=113433279228172&w=2">
|
|
<p>This [2.0.3] is a security release that fixes cross site
|
|
scripting vulnerabilities in several of the notepad name
|
|
and note data fields. None of the vulnerabilities can be
|
|
exploited by unauthenticated users; however, we strongly
|
|
recommend that all users of Mnemo 2.0.2 upgrade to 2.0.3
|
|
as soon as possible.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://marc.theaimsgroup.com/?l=horde-announce&m=113433279228172&w=2</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-12-11</discovery>
|
|
<entry>2005-12-11</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="ee6b5956-6a89-11da-b96e-000fb586ba73">
|
|
<topic>nag -- Cross site scripting vulnerabilities in several of the tasklist name and task data fields</topic>
|
|
<affects>
|
|
<package>
|
|
<name>nag</name>
|
|
<range><lt>2.0.4</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Announce of Nag H3 (2.0.4) (final):</p>
|
|
<blockquote cite="http://marc.theaimsgroup.com/?l=horde-announce&m=113433205826731&w=2">
|
|
<p>This [2.0.4] is a security release that fixes cross site
|
|
scripting vulnerabilities in several of the tasklist name
|
|
and task data fields. None of the vulnerabilities can be
|
|
exploited by unauthenticated users; however, we strongly
|
|
recommend that all users of Nag 2.0.3 upgrade to 2.0.4 as
|
|
soon as possible.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://marc.theaimsgroup.com/?l=horde-announce&m=113433205826731&w=2</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-12-11</discovery>
|
|
<entry>2005-12-11</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="eeebd55d-6a88-11da-b96e-000fb586ba73">
|
|
<topic>turba -- Cross site scripting vulnerabilities in several of the address book name and contact data fields</topic>
|
|
<affects>
|
|
<package>
|
|
<name>turba</name>
|
|
<range><lt>2.0.5</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Announce of Turba H3 (2.0.5) (final):</p>
|
|
<blockquote cite="http://marc.theaimsgroup.com/?l=horde-announce&m=113433120829232&w=2">
|
|
<p>This [2.0.5] is a security release that fixes cross site
|
|
scripting vulnerabilities in several of the address book
|
|
name and contact data fields. None of the vulnerabilities
|
|
can be exploited by unauthenticated users; however, we
|
|
strongly recommend that all users of Turba 2.0.4 upgrade
|
|
to 2.0.5 as soon as possible.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://marc.theaimsgroup.com/?l=horde-announce&m=113433120829232&w=2</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-12-11</discovery>
|
|
<entry>2005-12-11</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="36494478-6a88-11da-b96e-000fb586ba73">
|
|
<topic>kronolith -- Cross site scripting vulnerabilities in several of the calendar name and event data fields</topic>
|
|
<affects>
|
|
<package>
|
|
<name>kronolith</name>
|
|
<range><lt>2.0.6</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Announce of Kronolith H3 (2.0.6) (final):</p>
|
|
<blockquote cite="http://marc.theaimsgroup.com/?l=kronolith&m=113433029822279&w=2">
|
|
<p>This [2.0.6] is a security release that fixes cross site
|
|
scripting vulnerabilities in several of the calendar name
|
|
and event data fields. None of the vulnerabilities can be
|
|
exploited by unauthenticated users; however, we strongly
|
|
recommend that all users of Kronolith 2.0.5 upgrade to
|
|
2.0.6 as soon as possible.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://marc.theaimsgroup.com/?l=kronolith&m=113433029822279&w=2</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-12-11</discovery>
|
|
<entry>2005-12-11</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="01356ccc-6a87-11da-b96e-000fb586ba73">
|
|
<topic>horde -- Cross site scripting vulnerabilities in several of Horde's templates</topic>
|
|
<affects>
|
|
<package>
|
|
<name>horde</name>
|
|
<name>horde-php5</name>
|
|
<range><lt>3.0.8</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Announce of Horde H3 3.0.8 (final):</p>
|
|
<blockquote cite="http://marc.theaimsgroup.com/?l=horde-announce&m=113433346726097&w=2">
|
|
<p>This [3.0.8] is a security release that fixes cross site
|
|
scripting vulnerabilities in several of Horde's templates.
|
|
None of the vulnerabilities can be exploited by
|
|
unauthenticated users; however, we strongly recommend that
|
|
all users of Horde 3.0.7 upgrade to 3.0.8 as soon as
|
|
possible.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://marc.theaimsgroup.com/?l=horde-announce&m=113433346726097&w=2</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-12-11</discovery>
|
|
<entry>2005-12-11</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="9b4facec-6761-11da-99f6-00123ffe8333">
|
|
<topic>curl -- URL buffer overflow vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>curl</name>
|
|
<range><ge>7.11.2</ge><lt>7.15.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A Project cURL Security Advisory reports:</p>
|
|
<blockquote cite="http://curl.haxx.se/docs/adv_20051207.html">
|
|
<p>libcurl's URL parser function can overflow a malloced
|
|
buffer in two ways, if given a too long URL.</p>
|
|
<p>1 - pass in a URL with no protocol (like "http://")
|
|
prefix, using no slash and the string is 256 bytes or
|
|
longer. This leads to a single zero byte overflow of the
|
|
malloced buffer.</p>
|
|
<p>2 - pass in a URL with only a question mark as separator
|
|
(no slash) between the host and the query part of the URL.
|
|
This leads to a single zero byte overflow of the malloced
|
|
buffer.</p>
|
|
<p>Both overflows can be made with the same input string,
|
|
leading to two single zero byte overwrites.</p>
|
|
<p>The affected flaw cannot be triggered by a redirect, but
|
|
the long URL must be passed in "directly" to libcurl. It
|
|
makes this a "local" problem. Of course, lots of programs
|
|
may still pass in user-provided URLs to libcurl without doing
|
|
much syntax checking of their own, allowing a user to exploit
|
|
this vulnerability.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>15756</bid>
|
|
<cvename>CVE-2005-4077</cvename>
|
|
<url>http://curl.haxx.se/docs/adv_20051207.html</url>
|
|
<url>http://www.hardened-php.net/advisory_242005.109.html</url>
|
|
<url>http://secunia.com/advisories/17907/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-12-07</discovery>
|
|
<entry>2005-12-09</entry>
|
|
<modified>2006-01-01</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="23afd91f-676b-11da-99f6-00123ffe8333">
|
|
<topic>phpmyadmin -- register_globals emulation "import_blacklist" manipulation</topic>
|
|
<affects>
|
|
<package>
|
|
<name>phpMyAdmin</name>
|
|
<range><lt>2.7.0.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/17925/">
|
|
<p>Stefan Esser has reported a vulnerability in phpMyAdmin,
|
|
which can be exploited by malicious people to conduct
|
|
cross-site scripting attacks, disclose sensitive
|
|
information, and compromise a vulnerable system.</p>
|
|
<p>The vulnerability is caused due to an error in the
|
|
register_globals emulation layer in "grab_globals.php"
|
|
where the "import_blacklist" variable is not properly
|
|
protected from being overwritten. This can be exploited
|
|
to execute arbitrary HTML and script code in a user's
|
|
browser session in context of an affected site, and
|
|
include arbitrary files from external and local resources.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-9</url>
|
|
<url>http://www.hardened-php.net/advisory_252005.110.html</url>
|
|
<url>http://secunia.com/advisories/17925/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-12-07</discovery>
|
|
<entry>2005-12-07</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="59ada6e5-676a-11da-99f6-00123ffe8333">
|
|
<topic>phpmyadmin -- XSS vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>phpMyAdmin</name>
|
|
<range><lt>2.7.0</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A phpMyAdmin security advisory reports:</p>
|
|
<blockquote cite="http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-8">
|
|
<p>It was possible to conduct an XSS attack via the
|
|
HTTP_HOST variable; also, some scripts in the libraries
|
|
directory that handle header generation were vulnerable
|
|
to XSS.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-3665</cvename>
|
|
<url>http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-8</url>
|
|
<url>http://secunia.com/advisories/17895/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-12-05</discovery>
|
|
<entry>2005-12-07</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="964161cd-6715-11da-99f6-00123ffe8333">
|
|
<topic>ffmpeg -- libavcodec buffer overflow vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>ffmpeg</name>
|
|
<range><lt>0.4.9.p1_4</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>ffmpeg-devel</name>
|
|
<range><lt>0.4.9.c.2005120600</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/17892/">
|
|
<p>Simon Kilvington has reported a vulnerability in
|
|
FFmpeg libavcodec, which can be exploited by malicious
|
|
people to cause a DoS (Denial of Service) and
|
|
potentially to compromise a user's system.</p>
|
|
<p>The vulnerability is caused due to a boundary error
|
|
in the "avcodec_default_get_buffer()" function of
|
|
"utils.c" in libavcodec. This can be exploited to
|
|
cause a heap-based buffer overflow when a
|
|
specially-crafted 1x1 ".png" file containing a palette
|
|
is read.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://article.gmane.org/gmane.comp.video.ffmpeg.devel/26558</url>
|
|
<url>http://secunia.com/advisories/17892/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-11-30</discovery>
|
|
<entry>2005-12-07</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="7289187b-66a5-11da-99f6-00123ffe8333">
|
|
<topic>trac -- search module SQL injection vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>trac</name>
|
|
<range><lt>0.9.2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/17894/">
|
|
<p>A vulnerability has been reported in Trac, which
|
|
can be exploited by malicious people to conduct SQL
|
|
injection attacks.</p>
|
|
<p>Some unspecified input passed in the search module
|
|
isn't properly sanitised before being used in a SQL
|
|
query. This can be exploited to manipulate SQL
|
|
queries by injecting arbitrary SQL code.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://projects.edgewall.com/trac/wiki/ChangeLog#a0.9.2</url>
|
|
<url>http://secunia.com/advisories/17894/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-12-05</discovery>
|
|
<entry>2005-12-07</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="faca0843-6281-11da-8630-00123ffe8333">
|
|
<topic>drupal -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>drupal</name>
|
|
<range><lt>4.6.4</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/17824/">
|
|
<p>Some vulnerabilities have been reported in Drupal,
|
|
which can be exploited by malicious people to bypass
|
|
certain security restrictions, and conduct script
|
|
insertion and HTTP response splitting attacks.</p>
|
|
<p>1) An input validation error in the filtering of
|
|
HTML code can be exploited to inject arbitrary
|
|
JavaScript code in submitted content, which will be
|
|
executed in a user's browser session in context of
|
|
an affected site when the malicious user data is
|
|
viewed.
|
|
Successful exploitation requires that the user has
|
|
access to the full HTML input format.
|
|
Ref: sa-2005-007</p>
|
|
<p>2) An input validation error in the attachment
|
|
handling can be exploited to upload a malicious
|
|
image with embedded HTML and script content, which
|
|
will be executed in a user's browser session in
|
|
context of an affected site when viewed directly with
|
|
the Microsoft Internet Explorer browser.
|
|
This can also be exploited to inject arbitrary HTTP
|
|
headers, which will be included in the response sent
|
|
to the user.
|
|
Ref: sa-2005-008</p>
|
|
<p>3) The problem is that it is possible to bypass the
|
|
"access user profile" permission. However, this cannot
|
|
be exploited to modify data.
|
|
Successful exploitation requires that the server runs
|
|
PHP 5.
|
|
Ref: sa-2005-009</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://drupal.org/files/sa-2005-007/advisory.txt</url>
|
|
<url>http://drupal.org/files/sa-2005-008/advisory.txt</url>
|
|
<url>http://drupal.org/files/sa-2005-009/advisory.txt</url>
|
|
<url>http://secunia.com/advisories/17824/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-12-01</discovery>
|
|
<entry>2005-12-01</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="d6b092bd-61e1-11da-b64c-0001020eed82">
|
|
<topic>opera -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>linux-opera</name>
|
|
<name>opera-devel</name>
|
|
<name>opera</name>
|
|
<range><lt>8.51</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Opera reports:</p>
|
|
<blockquote cite="http://www.opera.com/support/search/supsearch.dml?index=819">
|
|
<p>It is possible to make a form input that looks like an
|
|
image link. If the form input has a "title" attribute, the
|
|
status bar will show the "title". A "title" which looks
|
|
like a URL can mislead the user, since the title can say
|
|
http://nice.familiar.com/, while the form action can be
|
|
something else.</p>
|
|
<p>Opera's tooltip says "Title:" before the title text,
|
|
making a spoof URL less convincing. A user who has enabled
|
|
the status bar and disabled tooltips can be affected by
|
|
this. Neither of these settings are Opera's defaults.</p>
|
|
<p>This exploit is mostly of interest to users who disable
|
|
JavaScript. If JavaScript is enabled, any link target or
|
|
form action can be overridden by the script. The tooltip
|
|
and the statusbar can only be trusted to show the true
|
|
location if JavaScript is disabled.</p>
|
|
</blockquote>
|
|
<blockquote cite="http://www.opera.com/support/search/supsearch.dml?index=817">
|
|
<p>Java code using LiveConnect methods to remove a property
|
|
of a JavaScript object may in some cases use null pointers
|
|
that can make Opera crash. This crash is not exploitable
|
|
and such code is rare on the web.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-3699</cvename>
|
|
<url>http://secunia.com/advisories/17571/</url>
|
|
<url>http://www.opera.com/support/search/supsearch.dml?index=817</url>
|
|
<url>http://www.opera.com/support/search/supsearch.dml?index=819</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-11-16</discovery>
|
|
<entry>2005-11-30</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="dfc1daa8-61de-11da-b64c-0001020eed82">
|
|
<topic>opera -- command line URL shell command injection</topic>
|
|
<affects>
|
|
<package>
|
|
<name>linux-opera</name>
|
|
<name>opera-devel</name>
|
|
<name>opera</name>
|
|
<range><lt>8.51</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>An Opera Advisory reports:</p>
|
|
<blockquote cite="http://www.opera.com/support/search/supsearch.dml?index=818">
|
|
<p>Opera for UNIX uses a wrapper shell script to start up
|
|
Opera. This shell script reads the input arguments, like
|
|
the file names or URLs that Opera is to open. It also
|
|
performs some environment checks, for example whether Java
|
|
is available and if so, where it is located.</p>
|
|
<p>This wrapper script can also run commands embedded in the
|
|
URL, so that a specially crafted URL can make arbitrary
|
|
commands run on the recipient's machine. Users who have
|
|
other programs set up to use Opera to open Web links are
|
|
vulnerable to this flaw. For these users, clicking a Web
|
|
link in for example OpenOffice.org or Evolution can run a
|
|
command that was put into the link.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>15521</bid>
|
|
<cvename>CVE-2005-3750</cvename>
|
|
<url>http://secunia.com/secunia_research/2005-57/advisory/</url>
|
|
<url>http://www.opera.com/support/search/supsearch.dml?index=818</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-11-17</discovery>
|
|
<entry>2005-11-30</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="ffb82d3a-610f-11da-8823-00123ffe8333">
|
|
<topic>mambo -- "register_globals" emulation layer overwrite vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>mambo</name>
|
|
<range><lt>4.5.3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A Secunia Advisory reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/17622/">
|
|
<p>peter MC tachatte has discovered a vulnerability in Mambo,
|
|
which can be exploited by malicious people to manipulate
|
|
certain information and compromise a vulnerable system.</p>
|
|
<p>The vulnerability is caused due to an error in the
|
|
"register_globals" emulation layer in "globals.php" where
|
|
certain arrays used by the system can be overwritten. This
|
|
can be exploited to include arbitrary files from external
|
|
and local resources via the "mosConfig_absolute_path" parameter.</p>
|
|
<p>Successful exploitation requires that "register_globals"
|
|
is disabled.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://www.mamboserver.com/index.php?option=com_content&task=view&id=172&Itemid=1</url>
|
|
<url>http://secunia.com/advisories/17622/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-11-17</discovery>
|
|
<entry>2005-11-30</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="27a70a01-5f6c-11da-8d54-000cf18bbe54">
|
|
<topic>ghostscript -- insecure temporary file creation vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>ghostscript-gnu</name>
|
|
<name>ghostscript-gnu-nox11</name>
|
|
<range><lt>7.07_14</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>ghostscript-afpl</name>
|
|
<name>ghostscript-afpl-nox11</name>
|
|
<range><lt>8.53_1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<blockquote cite="http://www.securityfocus.com/bid/11285/discuss">
|
|
<p>Ghostscript is affected by an insecure temporary file
|
|
creation vulnerability. This issue is likely due
|
|
to a design error that causes the application to fail
|
|
to verify the existence of a file before writing to it.</p>
|
|
|
|
<p>An attacker may leverage this issue to overwrite
|
|
arbitrary files with the privileges of an unsuspecting
|
|
user that activates the vulnerable application.
|
|
Reportedly this issue is unlikely to facilitate
|
|
privilege escalation.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>11285</bid>
|
|
<cvename>CVE-2004-0967</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-10-19</discovery>
|
|
<entry>2005-11-27</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="873a6542-5b8d-11da-b96e-000fb586ba73">
|
|
<topic>horde -- Cross site scripting vulnerabilities in MIME viewers</topic>
|
|
<affects>
|
|
<package>
|
|
<name>horde</name>
|
|
<name>horde-php5</name>
|
|
<range><lt>3.0.7</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Announce of Horde 3.0.7 (final):</p>
|
|
<blockquote cite="http://lists.horde.org/archives/announce/2005/000232.html">
|
|
<p>This [3.0.7] is a security release that fixes cross site
|
|
scripting vulnerabilities in two of Horde's MIME viewers. These
|
|
holes could for example be exploited by an attacker sending
|
|
specially crafted emails to Horde's webmail client IMP. The
|
|
attack could be used to steal users' identity information, taking
|
|
over users' sessions, or changing users' settings.</p>
|
|
<p>As a hotfix the css and tgz MIME drivers can be disabled by
|
|
removing their entries from the
|
|
$mime_drivers_map['horde']['registered'] list in
|
|
horde/config/mime_drivers.php.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>15535</bid>
|
|
<cvename>CVE-2005-3759</cvename>
|
|
<url>http://lists.horde.org/archives/announce/2005/000232.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-11-22</discovery>
|
|
<entry>2005-11-22</entry>
|
|
<modified>2005-11-26</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="c55f9ed0-56a7-11da-a3f0-00123ffe8333">
|
|
<topic>phpmyadmin -- HTTP Response Splitting vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>phpMyAdmin</name>
|
|
<range><lt>2.6.4.4</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A phpMyAdmin security advisory reports:</p>
|
|
<blockquote cite="http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-6">
|
|
<p>Some scripts in phpMyAdmin are vulnerable to an
|
|
HTTP Response Splitting attack.</p>
|
|
<p>Severity:</p>
|
|
<p>We consider these vulnerabilities to be serious.
|
|
However, they can only be triggered on systems running
|
|
with register_globals = on.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-6</url>
|
|
<url>http://secunia.com/advisories/17578/</url>
|
|
<url>http://www.fitsec.com/advisories/FS-05-02.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-11-15</discovery>
|
|
<entry>2005-11-16</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="9c1cea79-548a-11da-b53f-0004614cc33d">
|
|
<topic>phpSysInfo -- "register_globals" emulation layer overwrite vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>phpSysInfo</name>
|
|
<range><lt>2.5.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A Secunia Advisory reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/17441/">
|
|
<p>Christopher Kunz has reported a vulnerability in
|
|
phpSysInfo, which can be exploited by malicious people
|
|
to manipulate certain information.</p>
|
|
<p>The vulnerability is caused due to an error in
|
|
the "register_globals" emulation layer where certain
|
|
arrays used by the system can be overwritten. This can be
|
|
exploited to execute arbitrary HTML and script code in
|
|
a user's browser session and include arbitrary files from
|
|
local resources.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://www.hardened-php.net/advisory_222005.81.html</url>
|
|
<url>http://secunia.com/advisories/17441/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-11-10</discovery>
|
|
<entry>2005-11-13</entry>
|
|
<modified>2005-12-25</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="aed343b4-5480-11da-b579-001125afbed7">
|
|
<topic>Macromedia flash player -- swf file handling arbitrary code</topic>
|
|
<affects>
|
|
<package>
|
|
<name>linux-flashplugin6</name>
|
|
<range><le>6.0r79_3</le></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-flashplugin7</name>
|
|
<range><lt>7.0r61</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A Secunia Advisory reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/17430/">
|
|
<p>A vulnerability has been reported in Macromedia
|
|
Flash Player, which can be exploited by malicious
|
|
people to compromise a user's system.</p>
|
|
<p>The vulnerability is caused due to missing validation
|
|
of the frame type identifier that is read from
|
|
a SWF file. This value is used as an index in Flash.ocx
|
|
to reference an array of function pointers. This can be
|
|
exploited via a specially crafted SWF file to cause
|
|
the index to reference memory that is under the attacker's
|
|
control, which causes Flash Player to use attacker
|
|
supplied values as function pointers.</p>
|
|
<p>Successful exploitation allows execution of arbitrary
|
|
code.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://www.macromedia.com/devnet/security/security_zone/mpsb05-07.html</url>
|
|
<url>http://secunia.com/advisories/17430/</url>
|
|
<url>http://www.eeye.com/html/research/advisories/AD20051104.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-06-27</discovery>
|
|
<entry>2005-11-13</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="f4b95430-51d8-11da-8e93-0010dc4afb40">
|
|
<topic>flyspray -- cross-site scripting vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>flyspray</name>
|
|
<range><lt>0.9.8</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A Secunia Advisory reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/17316/">
|
|
<p>Lostmon has reported some vulnerabilities in Flyspray,
|
|
which can be exploited by malicious people to conduct
|
|
cross-site scripting attacks.</p>
|
|
<p>Some input isn't properly sanitised before being
|
|
returned to the user. This can be exploited to execute
|
|
arbitrary HTML and script code in a user's browser
|
|
session in context of an affected site.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>15209</bid>
|
|
<url>http://secunia.com/advisories/17316/</url>
|
|
<url>http://lostmon.blogspot.com/2005/10/flyspray-bug-killer-multiple-variable.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-10-26</discovery>
|
|
<entry>2005-11-10</entry>
|
|
<modified>2005-11-29</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="7f3fdef7-51d2-11da-8e93-0010dc4afb40">
|
|
<topic>p5-Mail-SpamAssassin -- long message header denial of service</topic>
|
|
<affects>
|
|
<package>
|
|
<name>p5-Mail-SpamAssassin</name>
|
|
<range><lt>3.1.0</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A Secunia Advisory reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/17386/">
|
|
<p>A vulnerability has been reported in SpamAssassin,
|
|
which can be exploited by malicious people to cause
|
|
a DoS (Denial of Service).</p>
|
|
<p>The vulnerability is caused due to the use of
|
|
an inefficient regular expression in
|
|
"/SpamAssassin/Message.pm" to parse email headers.
|
|
This can cause perl to crash when it runs out of stack
|
|
space and can be exploited via a malicious email that
|
|
contains a large number of recipients.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://secunia.com/advisories/17386/</url>
|
|
<url>http://issues.apache.org/SpamAssassin/show_bug.cgi?id=4570</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-11-10</discovery>
|
|
<entry>2005-11-10</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="eb29a575-3381-11da-8340-000e0c2e438a">
|
|
<topic>qpopper -- multiple privilege escalation vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>qpopper</name>
|
|
<range><ge>4.0</ge><le>4.0.5</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Jens Steube reports that qpopper is vulnerable to a privilege
|
|
escalation vulnerability. qpopper does not properly drop root
|
|
privileges so that user supplied configuration and trace files
|
|
can be processed with root privileges. This could allow a
|
|
local attacker to create or modify arbitrary files.</p>
|
|
<p>qpopper is also affected by improper umask settings
|
|
which could allow users to create group or world-writeable
|
|
files, possibly allowing an attacker to overwrite arbitrary
|
|
files.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-1151</cvename>
|
|
<cvename>CVE-2005-1152</cvename>
|
|
<url>http://secunia.com/advisories/15475/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-05-26</discovery>
|
|
<entry>2005-11-07</entry>
|
|
<modified>2005-11-26</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="44e5f5bd-4d76-11da-bf37-000fb586ba73">
|
|
<topic>pear-PEAR -- PEAR installer arbitrary code execution vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>pear-PEAR</name>
|
|
<range><lt>1.4.3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Gregory Beaver reports:</p>
|
|
<blockquote cite="http://pear.php.net/advisory-20051104.txt">
|
|
<p>A standard feature of the PEAR installer implemented in
|
|
all versions of PEAR can lead to the execution of
|
|
arbitrary PHP code upon running the "pear" command
|
|
or loading the Web/Gtk frontend.</p>
|
|
<p>To be vulnerable, a user must explicitly install a
|
|
publicly released malicious package using the PEAR
|
|
installer, or explicitly install a package that depends on
|
|
a malicious package.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://pear.php.net/advisory-20051104.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-11-01</discovery>
|
|
<entry>2005-11-04</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="3de49331-0dec-422c-93e5-e4719e9869c5">
|
|
<topic>openvpn -- potential denial-of-service on servers in TCP mode</topic>
|
|
<affects>
|
|
<package>
|
|
<name>openvpn</name>
|
|
<range><ge>2.0</ge><lt>2.0.4</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>James Yonan reports:</p>
|
|
<blockquote cite="http://openvpn.net/changelog.html">
|
|
<p>If the TCP server accept() call returns an error status, the
|
|
resulting exception handler may attempt to indirect through a NULL
|
|
pointer, causing a segfault. Affects all OpenVPN 2.0 versions.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-3409</cvename>
|
|
<url>http://openvpn.net/changelog.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-11-01</discovery>
|
|
<entry>2005-11-01</entry>
|
|
<modified>2005-11-04</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="6129fdc7-6462-456d-a3ef-8fc3fbf44d16">
|
|
<topic>openvpn -- arbitrary code execution on client through malicious or compromised server</topic>
|
|
<affects>
|
|
<package>
|
|
<name>openvpn</name>
|
|
<range><ge>2.0</ge><lt>2.0.4</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>James Yonan reports:</p>
|
|
<blockquote cite="http://openvpn.net/changelog.html">
|
|
<p>A format string vulnerability
|
|
in the foreign_option function in options.c could
|
|
potentially allow a malicious or compromised server
|
|
to execute arbitrary code on the client. Only
|
|
non-Windows clients are affected. The vulnerability
|
|
only exists if (a) the client's TLS negotiation with
|
|
the server succeeds, (b) the server is malicious or
|
|
has been compromised such that it is configured to
|
|
push a maliciously crafted options string to the client,
|
|
and (c) the client indicates its willingness to accept
|
|
pushed options from the server by having "pull" or
|
|
"client" in its configuration file (Credit: Vade79).</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-3393</cvename>
|
|
<mlist>http://www.securityfocus.com/archive/1/415293/30/0/threaded</mlist>
|
|
<url>http://openvpn.net/changelog.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-10-31</discovery>
|
|
<entry>2005-11-01</entry>
|
|
<modified>2005-11-04</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="6821a2db-4ab7-11da-932d-00055d790c25">
|
|
<topic>PHP -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>mod_php4-twig</name>
|
|
<name>php4-cgi</name>
|
|
<name>php4-cli</name>
|
|
<name>php4-dtc</name>
|
|
<name>php4-horde</name>
|
|
<name>php4-nms</name>
|
|
<name>php4</name>
|
|
<range><lt>4.4.1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>mod_php</name>
|
|
<name>mod_php4</name>
|
|
<range><ge>4</ge><lt>4.4.1,1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A Secunia Advisory reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/17371/">
|
|
<p>Some vulnerabilities have been reported in PHP,
|
|
which can be exploited by malicious people to conduct
|
|
cross-site scripting attacks, bypass certain security
|
|
restrictions, and potentially compromise a vulnerable
|
|
system.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://secunia.com/advisories/17371/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-10-31</discovery>
|
|
<entry>2005-11-01</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="70fc13d9-4ab4-11da-932d-00055d790c25">
|
|
<topic>skype -- multiple buffer overflow vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>skype</name>
|
|
<range><lt>1.2.0.18</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A Secunia Advisory reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/17305/">
|
|
<p>Some vulnerabilities have been reported in Skype,
|
|
which can be exploited by malicious people to cause
|
|
a DoS or to compromise a user's system.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-3265</cvename>
|
|
<cvename>CVE-2005-3267</cvename>
|
|
<certvu>930345</certvu>
|
|
<certvu>668193</certvu>
|
|
<url>http://secunia.com/advisories/17305/</url>
|
|
<url>http://skype.com/security/skype-sb-2005-02.html</url>
|
|
<url>http://skype.com/security/skype-sb-2005-03.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-10-25</discovery>
|
|
<entry>2005-11-01</entry>
|
|
<modified>2005-11-02</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="1c3142a3-4ab2-11da-932d-00055d790c25">
|
|
<topic>squid -- FTP server response handling denial of service</topic>
|
|
<affects>
|
|
<package>
|
|
<name>squid</name>
|
|
<range><lt>2.5.11_3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A Secunia Advisory reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/17271/">
|
|
<p>M.A.Young has reported a vulnerability in Squid,
|
|
which can be exploited by malicious people to cause
|
|
a DoS (Denial of Service).</p>
|
|
<p>The vulnerability is caused due to an error in
|
|
handling certain FTP server responses. This can be
|
|
exploited to crash Squid by visiting a malicious FTP
|
|
server via the proxy.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-3258</cvename>
|
|
<url>http://secunia.com/advisories/17271/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-10-19</discovery>
|
|
<entry>2005-11-01</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="f38c87a5-4a3e-11da-8ba2-0004614cc33d">
|
|
<topic>base -- PHP SQL injection vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>base</name>
|
|
<range><lt>1.2.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A Secunia Advisory reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/17314/">
|
|
<p>Remco Verhoef has discovered a vulnerability in
|
|
Basic Analysis and Security Engine (BASE), which
|
|
can be exploited by malicious users to conduct SQL
|
|
injection attacks.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>15199</bid>
|
|
<url>http://secunia.com/advisories/17314/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-10-25</discovery>
|
|
<entry>2005-10-31</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="baf74e0b-497a-11da-a4f4-0060084a00e5">
|
|
<topic>fetchmail -- fetchmailconf local password exposure</topic>
|
|
<affects>
|
|
<package>
|
|
<name>fetchmail</name>
|
|
<range><lt>6.2.5.2_1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The fetchmail team reports:</p>
|
|
<blockquote cite="http://www.fetchmail.info/fetchmail-SA-2005-02.txt">
|
|
<p>The fetchmailconf program before and excluding version
|
|
1.49 opened the run control file, wrote the configuration
|
|
to it, and only then changed the mode to 0600 (rw-------).
|
|
Writing the file, which usually contains passwords, before
|
|
making it unreadable to other users, can expose sensitive
|
|
password information.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-3088</cvename>
|
|
<url>http://www.fetchmail.info/fetchmail-SA-2005-02.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-10-21</discovery>
|
|
<entry>2005-10-30</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="c01170bf-4990-11da-a1b8-000854d03344">
|
|
<topic>lynx -- remote buffer overflow</topic>
|
|
<affects>
|
|
<package>
|
|
<name>lynx</name>
|
|
<name>ja-lynx</name>
|
|
<range><lt>2.8.5_1</lt></range>
|
|
<range><gt>2.8.6*</gt><lt>2.8.6d14</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>lynx-ssl</name>
|
|
<range><lt>2.8.5_1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Ulf Härnhammar reports:</p>
|
|
<blockquote cite="http://lists.grok.org.uk/pipermail/full-disclosure/2005-October/038019.html">
|
|
<p>When Lynx connects to an NNTP server to fetch information
|
|
about the available articles in a newsgroup, it will
|
|
call a function called HTrjis() with the information
|
|
from certain article headers. The function adds missing
|
|
ESC characters to certain data, to support Asian character
|
|
sets. However, it does not check if it writes outside
|
|
of the char array buf, and that causes a remote stack-based
|
|
buffer overflow.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description> <references>
|
|
<cvename>CVE-2005-3120</cvename>
|
|
<url>http://lists.grok.org.uk/pipermail/full-disclosure/2005-October/038019.html</url>
|
|
</references> <dates>
|
|
<discovery>2005-10-17</discovery>
|
|
<entry>2005-10-30</entry>
|
|
<modified>2006-10-05</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="1daea60a-4719-11da-b5c6-0004614cc33d">
|
|
<topic>ruby -- vulnerability in the safe level settings</topic>
|
|
<affects>
|
|
<package>
|
|
<name>ruby</name>
|
|
<name>ruby_static</name>
|
|
<range><gt>1.6.*</gt><lt>1.6.8.2004.07.28_2</lt></range>
|
|
<range><gt>1.8.*</gt><lt>1.8.2_5</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Ruby home page reports:</p>
|
|
<blockquote cite="http://www.ruby-lang.org/en/20051003.html">
|
|
<p>The Object Oriented Scripting Language Ruby supports
|
|
safely executing an untrusted code with two mechanisms:
|
|
safe level and taint flag on objects.</p>
|
|
<p>A vulnerability has been found that allows bypassing
|
|
these mechanisms.</p>
|
|
<p>By using the vulnerability, arbitrary code can be executed
|
|
beyond the restrictions specified in each safe level.
|
|
Therefore, Ruby has to be updated on all systems that use
|
|
safe level to execute untrusted code.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-2337</cvename>
|
|
<url>http://www.ruby-lang.org/en/20051003.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-10-02</discovery>
|
|
<entry>2005-10-27</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="2f0cb4bb-416d-11da-99fe-000854d03344">
|
|
<topic>xloadimage -- buffer overflows in NIFF image title handling</topic>
|
|
<affects>
|
|
<package>
|
|
<name>xloadimage</name>
|
|
<range><lt>4.1.15</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>xli</name>
|
|
<range><lt>1.17.0_4</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Ariel Berkman reports:</p>
|
|
<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&m=112862493918840&w=2">
|
|
<p>Unlike most of the supported image formats in xloadimage,
|
|
the NIFF image format can store a title name of arbitrary
|
|
length as part of the image file.</p>
|
|
<p>When xloadimage is processing a loaded image, it is
|
|
creating a new Image object and then writing the processed
|
|
image to it. At that point, it will also copy the title
|
|
from the old image to the newly created image.</p>
|
|
<p>The 'zoom', 'reduce', and 'rotate' functions are using
|
|
a fixed length buffer to construct the new title name
|
|
when an image processing is done. Since the title name
|
|
in a NIFF format is of varying length, and there are
|
|
insufficient buffer size validations, the buffer can
|
|
be overflowed.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>15051</bid>
|
|
<cvename>CVE-2005-3178</cvename>
|
|
<mlist msgid="BOEKKJLADFNHIEFBHCECMEONCFAA.aberkm1@uic.edu">http://marc.theaimsgroup.com/?l=bugtraq&m=112862493918840&w=2</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-10-05</discovery>
|
|
<entry>2005-10-20</entry>
|
|
<modified>2005-10-23</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="97d45e95-3ffc-11da-a263-0001020eed82">
|
|
<topic>snort -- Back Orifice preprocessor buffer overflow vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>snort</name>
|
|
<range><ge>2.4.0</ge><lt>2.4.3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Jennifer Steffens reports:</p>
|
|
<blockquote cite="http://www.snort.org/pub-bin/snortnews.cgi#99">
|
|
<p>The Back Orifice preprocessor contains a stack-based
|
|
buffer overflow. This vulnerability could be leveraged by
|
|
an attacker to execute code remotely on a Snort sensor
|
|
where the Back Orifice preprocessor is enabled. However,
|
|
there are a number of factors that make remote code
|
|
execution difficult to achieve across different builds of
|
|
Snort on different platforms, even on the same platform
|
|
with different compiler versions, and it is more likely
|
|
that an attacker could use the vulnerability as a denial
|
|
of service attack.</p>
|
|
<p>The Back Orifice preprocessor can be disabled by
|
|
commenting out the line "preprocessor bo" in
|
|
snort.conf. This can be done in any text editor using the
|
|
following procedure:</p>
|
|
<ol>
|
|
<li>Locate the line "preprocessor bo"</li>
|
|
<li>Comment out this line by preceding it with a hash
|
|
(#). The new line will look like "#preprocessor bo"</li>
|
|
<li>Save the file</li>
|
|
<li>Restart snort</li>
|
|
</ol>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<certvu>175500</certvu>
|
|
<url>http://www.snort.org/pub-bin/snortnews.cgi#99</url>
|
|
<url>http://xforce.iss.net/xforce/alerts/id/207</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-10-18</discovery>
|
|
<entry>2005-10-18</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="60f8fe7b-3cfb-11da-baa2-0004614cc33d">
|
|
<topic>WebCalendar -- remote file inclusion vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>WebCalendar</name>
|
|
<range><lt>1.0.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>WebCalendar is proven vulnerable to a remote file inclusion
|
|
vulnerability. The send_reminders.php does not properly
|
|
verify the "includedir" parameter, giving remote attackers
|
|
the possibility to include local and remote files. These
|
|
files can be used by the attacker to gain access to the
|
|
system.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>14651</bid>
|
|
<cvename>CVE-2005-2717</cvename>
|
|
<url>http://sourceforge.net/forum/forum.php?thread_id=1342085&forum_id=11587</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-08-26</discovery>
|
|
<entry>2005-10-15</entry>
|
|
<modified>2005-11-08</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="47bdabcf-3cf9-11da-baa2-0004614cc33d">
|
|
<topic>gallery2 -- file disclosure vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>gallery2</name>
|
|
<range><lt>2.0.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Michael Dipper wrote:</p>
|
|
<blockquote cite="http://dipper.info/security/20051012/">
|
|
<p>A vulnerability has been discovered in gallery,
|
|
which allows remote users unauthorized access to files
|
|
on the webserver.</p>
|
|
<p>A remote user accessing gallery over the web may use
|
|
specially crafted HTTP parameters to access arbitrary
|
|
files located on the webserver. All files readable by
|
|
the webserver process are subject to disclosure.
|
|
The vulnerability is *not* restricted to the webserver's
|
|
document root but extends to the whole server file space.</p>
|
|
<p>The vulnerabilty may be used by any anonymous user,
|
|
there is no login to the application required.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>15108</bid>
|
|
<cvename>CVE-2005-3251</cvename>
|
|
<url>http://dipper.info/security/20051012/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-10-12</discovery>
|
|
<entry>2005-10-15</entry>
|
|
<modified>2005-11-08</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="60e26a40-3b25-11da-9484-00123ffe8333">
|
|
<topic>openssl -- potential SSL 2.0 rollback</topic>
|
|
<affects>
|
|
<package>
|
|
<name>openssl</name>
|
|
<name>openssl-overwrite-base</name>
|
|
<range><le>0.9.7g</le></range>
|
|
<range><ge>0.9.8</ge><le>0.9.8_1</le></range>
|
|
<range><ge>0.9.*_20050325</ge><le>0.9.*_20051011</le></range>
|
|
</package>
|
|
<package>
|
|
<name>openssl-beta</name>
|
|
<name>openssl-beta-overwrite-base</name>
|
|
<range><le>0.9.8_1</le></range>
|
|
<range><ge>0.9.*_20050325</ge><le>0.9.*_20051011</le></range>
|
|
</package>
|
|
<package>
|
|
<name>compat5x-alpha</name>
|
|
<name>compat5x-amd64</name>
|
|
<name>compat5x-i386</name>
|
|
<name>compat5x-sparc64</name>
|
|
<range><lt>5.4.0.8</lt></range>
|
|
</package>
|
|
<system>
|
|
<name>FreeBSD</name>
|
|
<range><lt>4.10_19</lt></range>
|
|
<range><ge>4.11</ge><lt>4.11_13</lt></range>
|
|
<range><ge>5.3</ge><lt>5.3_23</lt></range>
|
|
<range><ge>5.4</ge><lt>5.4_8</lt></range>
|
|
</system>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Vulnerability:</p>
|
|
<blockquote cite="http://www.openssl.org/news/secadv_20051011.txt">
|
|
<p>Such applications are affected if they use the option
|
|
SSL_OP_MSIE_SSLV2_RSA_PADDING. This option is implied by use of
|
|
SSL_OP_ALL, which is intended to work around various bugs in
|
|
third-party software that might prevent interoperability. The
|
|
SSL_OP_MSIE_SSLV2_RSA_PADDING option disables a verification step in
|
|
the SSL 2.0 server supposed to prevent active protocol-version
|
|
rollback attacks. With this verification step disabled, an attacker
|
|
acting as a "man in the middle" can force a client and a server to
|
|
negotiate the SSL 2.0 protocol even if these parties both support
|
|
SSL 3.0 or TLS 1.0. The SSL 2.0 protocol is known to have severe
|
|
cryptographic weaknesses and is supported as a fallback only.</p>
|
|
<p>Applications using neither SSL_OP_MSIE_SSLV2_RSA_PADDING nor
|
|
SSL_OP_ALL are not affected. Also, applications that disable
|
|
use of SSL 2.0 are not affected.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<freebsdsa>SA-05:21.openssl</freebsdsa>
|
|
<cvename>CVE-2005-2969</cvename>
|
|
<url>http://www.openssl.org/news/secadv_20051011.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-10-11</discovery>
|
|
<entry>2005-10-12</entry>
|
|
<modified>2005-10-25</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="9b7053fd-3ab5-11da-9484-00123ffe8333">
|
|
<topic>phpmyadmin -- local file inclusion vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>phpMyAdmin</name>
|
|
<range><ge>2.6.4.r1</ge><le>2.6.4.1</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A phpMyAdmin security announcement reports:</p>
|
|
<blockquote cite="http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-4">
|
|
<p>In libraries/grab_globals.lib.php, the $__redirect
|
|
parameter was not correctly validated, opening the door to
|
|
a local file inclusion attack.</p>
|
|
<p>We consider this vulnerability to be serious.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>15053</bid>
|
|
<mlist msgid="20051010161119.1689.qmail@securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&m=112907764728209</mlist>
|
|
<url>http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-4</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-10-11</discovery>
|
|
<entry>2005-10-11</entry>
|
|
<modified>2005-10-13</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="d2b80c7c-3aae-11da-9484-00123ffe8333">
|
|
<topic>zope -- expose RestructuredText functionality to untrusted users</topic>
|
|
<affects>
|
|
<package>
|
|
<name>zope</name>
|
|
<range><ge>2.6.0</ge><lt>2.7.8</lt></range>
|
|
<range><ge>2.8.0</ge><le>2.8.1_2</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A Zope Hotfix Alert reports:</p>
|
|
<blockquote cite="http://www.zope.org/Products/Zope/Hotfix_2005-10-09/security_alert">
|
|
<p>This hotfix resolves a security issue with docutils.</p>
|
|
<p>Affected are possibly all Zope instances that expose
|
|
RestructuredText functionalies to untrusted users through
|
|
the web.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-3323</cvename>
|
|
<bid>15082</bid>
|
|
<url>http://www.zope.org/Products/Zope/Hotfix_2005-10-09/security_alert</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-10-09</discovery>
|
|
<entry>2005-10-11</entry>
|
|
<modified>2005-11-28</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="3bc5691e-38dd-11da-92f5-020039488e34">
|
|
<topic>libxine -- format string vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>libxine</name>
|
|
<range><lt>1.1.0_1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Gentoo Linux Security Advisory reports:</p>
|
|
<blockquote cite="http://www.gentoo.org/security/en/glsa/glsa-200510-08.xml">
|
|
<p>Ulf Harnhammar discovered a format string bug in the routines
|
|
handling CDDB server response contents.</p>
|
|
<p>An attacker could submit malicious information about an audio
|
|
CD to a public CDDB server (or impersonate a public CDDB server).
|
|
When the victim plays this CD on a multimedia frontend relying
|
|
on xine-lib, it could end up executing arbitrary code.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-2967</cvename>
|
|
<url>http://www.gentoo.org/security/en/glsa/glsa-200510-08.xml</url>
|
|
<url>http://xinehq.de/index.php/security/XSA-2005-1</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-10-08</discovery>
|
|
<entry>2005-10-09</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="1f6e2ade-35c2-11da-811d-0050bf27ba24">
|
|
<topic>imap-uw -- mailbox name handling remote buffer vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>imap-uw</name>
|
|
<range><lt>2004g</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>FrSIRT reports:</p>
|
|
<blockquote cite="http://www.frsirt.com/english/advisories/2005/1953">
|
|
<p>A vulnerability has been identified in UW-IMAP, which could
|
|
be exploited by remote attackers to execute arbitrary commands.
|
|
This flaw is due to a stack overflow error in the
|
|
"mail_valid_net_parse_work()" [src/c-client/mail.c] function that
|
|
does not properly handle specially crafted mailbox names containing
|
|
a quote (") character, which could be exploited by authenticated
|
|
remote attackers to execute arbitrary commands with the privileges
|
|
of the IMAP server.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-2933</cvename>
|
|
<url>http://www.frsirt.com/english/advisories/2005/1953</url>
|
|
<url>http://www.idefense.com/application/poi/display?id=313&type=vulnerabilities</url>
|
|
<url>http://www.washington.edu/imap/documentation/RELNOTES.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-10-05</discovery>
|
|
<entry>2005-10-05</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="d4c70df5-335d-11da-9c70-0040f42d58c6">
|
|
<topic>weex -- remote format string vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>weex</name>
|
|
<range><lt>2.6.1.5_1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Emanuel Haupt reports:</p>
|
|
<blockquote cite="http://www.freebsd.org/cgi/query-pr.cgi?pr=ports/86833">
|
|
<p>Someone who controls an FTP server that weex will log in to
|
|
can set up malicious data in the account that weex will use,
|
|
and that will cause a format string bug that will allow remote
|
|
code execution. It will only happen when weex is first run or
|
|
when its cache files are rebuilt with the -r option,
|
|
though. The vulnerability was found by Ulf Harnhammar.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<freebsdpr>ports/86833</freebsdpr>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-10-02</discovery>
|
|
<entry>2005-10-02</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="8a3ece40-3315-11da-a263-0001020eed82">
|
|
<topic>picasm -- buffer overflow vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>picasm</name>
|
|
<range><lt>1.12c</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Shaun Colley reports:</p>
|
|
<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&m=111661253517089">
|
|
<p>When generating error and warning messages, picasm copies
|
|
strings into fixed length buffers without bounds
|
|
checking.</p>
|
|
<p>If an attacker could trick a user into assembling a
|
|
source file with a malformed 'error' directive, arbitrary
|
|
code could be executed with the privileges of the user.
|
|
This could result in full system compromise.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>13698</bid>
|
|
<cvename>CVE-2005-1679</cvename>
|
|
<mlist msgid="c522a35a0505200807744163c4@mail.gmail.com">http://marc.theaimsgroup.com/?l=bugtraq&m=111661253517089</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-05-20</discovery>
|
|
<entry>2005-10-02</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="1e606080-3293-11da-ac91-020039488e34">
|
|
<topic>uim -- privilege escalation vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>ja-uim</name>
|
|
<range><lt>0.4.9.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The uim developers reports:</p>
|
|
<blockquote cite="http://lists.freedesktop.org/archives/uim/2005-September/001346.html">
|
|
<p>Masanari Yamamoto discovered that incorrect use
|
|
of environment variables in uim. This bug causes
|
|
privilege escalation if setuid/setgid applications
|
|
was linked to libuim.</p>
|
|
<p>This bug appears in 'immodule for Qt' enabled Qt.
|
|
(Normal Qt is also safe.) In some distribution,
|
|
mlterm is also an setuid/setgid application.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://lists.freedesktop.org/archives/uim/2005-September/001346.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-09-28</discovery>
|
|
<entry>2005-10-01</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="8688d5cd-328c-11da-a263-0001020eed82">
|
|
<topic>cfengine -- arbitrary file overwriting vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>cfengine</name>
|
|
<range><lt>2.1.6_1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>cfengine2</name>
|
|
<range><gt>0</gt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A Debian Security Advisory reports:</p>
|
|
<blockquote cite="http://www.debian.org/security/2005/dsa-835">
|
|
<p>Javier Fernández-Sanguino Peña discovered several
|
|
insecure temporary file uses in cfengine, a tool for
|
|
configuring and maintaining networked machines, that can
|
|
be exploited by a symlink attack to overwrite arbitrary
|
|
files owned by the user executing cfengine, which is
|
|
probably root.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-2960</cvename>
|
|
<bid>14994</bid>
|
|
<url>http://www.debian.org/security/2005/dsa-835</url>
|
|
<url>http://www.debian.org/security/2005/dsa-836</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-10-01</discovery>
|
|
<entry>2005-10-01</entry>
|
|
<modified>2005-10-07</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="271498a9-2cd4-11da-a263-0001020eed82">
|
|
<topic>clamav -- arbitrary code execution and DoS vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>clamav</name>
|
|
<range><lt>0.87</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>clamav-devel</name>
|
|
<range><lt>20050917</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Gentoo Linux Security Advisory reports:</p>
|
|
<blockquote cite="http://www.gentoo.org/security/en/glsa/glsa-200509-13.xml">
|
|
<p>Clam AntiVirus is vulnerable to a buffer overflow in
|
|
"libclamav/upx.c" when processing malformed UPX-packed
|
|
executables. It can also be sent into an infinite loop in
|
|
"libclamav/fsg.c" when processing specially-crafted
|
|
FSG-packed executables.</p>
|
|
<p>By sending a specially-crafted file an attacker could
|
|
execute arbitrary code with the permissions of the user
|
|
running Clam AntiVirus, or cause a Denial of Service.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<certvu>363713</certvu>
|
|
<cvename>CVE-2005-2919</cvename>
|
|
<cvename>CVE-2005-2920</cvename>
|
|
<url>http://www.gentoo.org/security/en/glsa/glsa-200509-13.xml</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-09-16</discovery>
|
|
<entry>2005-09-24</entry>
|
|
<modified>2005-10-22</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="8f5dd74b-2c61-11da-a263-0001020eed82">
|
|
<topic>firefox & mozilla -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>firefox</name>
|
|
<range><lt>1.0.7,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-firefox</name>
|
|
<range><lt>1.0.7</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>mozilla</name>
|
|
<range><lt>1.7.12,2</lt></range>
|
|
<range><ge>1.8.*,2</ge></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-mozilla</name>
|
|
<range><lt>1.7.12</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-mozilla-devel</name>
|
|
<range><gt>0</gt></range>
|
|
</package>
|
|
<package>
|
|
<name>netscape7</name>
|
|
<range><ge>0</ge></range>
|
|
</package>
|
|
<package>
|
|
<!-- These ports are obsolete. -->
|
|
<name>de-linux-mozillafirebird</name>
|
|
<name>el-linux-mozillafirebird</name>
|
|
<name>ja-linux-mozillafirebird-gtk1</name>
|
|
<name>ja-mozillafirebird-gtk2</name>
|
|
<name>linux-mozillafirebird</name>
|
|
<name>ru-linux-mozillafirebird</name>
|
|
<name>zhCN-linux-mozillafirebird</name>
|
|
<name>zhTW-linux-mozillafirebird</name>
|
|
<range><ge>0</ge></range>
|
|
</package>
|
|
<package>
|
|
<!-- These package names are obsolete. -->
|
|
<name>de-linux-netscape</name>
|
|
<name>de-netscape7</name>
|
|
<name>fr-linux-netscape</name>
|
|
<name>fr-netscape7</name>
|
|
<name>ja-linux-netscape</name>
|
|
<name>ja-netscape7</name>
|
|
<name>linux-netscape</name>
|
|
<name>linux-phoenix</name>
|
|
<name>mozilla+ipv6</name>
|
|
<name>mozilla-embedded</name>
|
|
<name>mozilla-firebird</name>
|
|
<name>mozilla-gtk1</name>
|
|
<name>mozilla-gtk2</name>
|
|
<name>mozilla-gtk</name>
|
|
<name>mozilla-thunderbird</name>
|
|
<name>phoenix</name>
|
|
<name>pt_BR-netscape7</name>
|
|
<range><ge>0</ge></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A Mozilla Foundation Security Advisory reports of multiple
|
|
issues:</p>
|
|
<blockquote cite="http://www.mozilla.org/security/announce/mfsa2005-58.html">
|
|
<h1>Heap overrun in XBM image processing</h1>
|
|
<p>jackerror reports that an improperly terminated XBM image
|
|
ending with space characters instead of the expected end
|
|
tag can lead to a heap buffer overrun. This appears to be
|
|
exploitable to install or run malicious code on the user's
|
|
machine.</p>
|
|
<p>Thunderbird does not support the XBM format and is not
|
|
affected by this flaw.</p>
|
|
<h1>Crash on "zero-width non-joiner" sequence</h1>
|
|
<p>Mats Palmgren discovered that a reported crash on Unicode
|
|
sequences with "zero-width non-joiner" characters was due
|
|
to stack corruption that may be exploitable.</p>
|
|
<h1>XMLHttpRequest header spoofing</h1>
|
|
<p>It was possible to add illegal and malformed headers to
|
|
an XMLHttpRequest. This could have been used to exploit
|
|
server or proxy flaws from the user's machine, or to fool
|
|
a server or proxy into thinking a single request was a
|
|
stream of separate requests. The severity of this
|
|
vulnerability depends on the value of servers which might
|
|
be vulnerable to HTTP request smuggling and similar
|
|
attacks, or which share an IP address (virtual hosting)
|
|
with the attacker's page.</p>
|
|
<p>For users connecting to the web through a proxy this flaw
|
|
could be used to bypass the same-origin restriction on
|
|
XMLHttpRequests by fooling the proxy into handling a
|
|
single request as multiple pipe-lined requests directed at
|
|
arbitrary hosts. This could be used, for example, to read
|
|
files on intranet servers behind a firewall.</p>
|
|
<h1>Object spoofing using XBL <implements></h1>
|
|
<p>moz_bug_r_a4 demonstrated a DOM object spoofing bug
|
|
similar to <a href="http://www.mozilla.org/security/announce/mfsa2005-55.html">MFSA
|
|
2005-55</a> using an XBL control that <implements>
|
|
an internal interface. The severity depends on the version
|
|
of Firefox: investigation so far indicates Firefox 1.0.x
|
|
releases don't expose any vulnerable functionality to
|
|
interfaces spoofed in this way, but that early Deer Park
|
|
Alpha 1 versions did.</p>
|
|
<p>XBL was changed to no longer allow unprivileged controls
|
|
from web content to implement XPCOM interfaces.</p>
|
|
<h1>JavaScript integer overflow</h1>
|
|
<p>Georgi Guninski reported an integer overflow in the
|
|
JavaScript engine. We presume this could be exploited to
|
|
run arbitrary code under favorable conditions.</p>
|
|
<h1>Privilege escalation using about: scheme</h1>
|
|
<p>heatsync and shutdown report two different ways to bypass
|
|
the restriction on loading high privileged "chrome" pages
|
|
from an unprivileged "about:" page. By itself this is
|
|
harmless--once the "about" page's privilege is raised the
|
|
original page no longer has access--but should this be
|
|
combined with a same-origin violation this could lead to
|
|
arbitrary code execution.</p>
|
|
<h1>Chrome window spoofing</h1>
|
|
<p>moz_bug_r_a4 demonstrates a way to get a blank "chrome"
|
|
canvas by opening a window from a reference to a closed
|
|
window. The resulting window is not privileged, but the
|
|
normal browser UI is missing and can be used to construct
|
|
a spoof page without any of the safety features of the
|
|
browser chrome designed to alert users to phishing sites,
|
|
such as the address bar and the status bar.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-2701</cvename>
|
|
<cvename>CVE-2005-2702</cvename>
|
|
<cvename>CVE-2005-2703</cvename>
|
|
<cvename>CVE-2005-2704</cvename>
|
|
<cvename>CVE-2005-2705</cvename>
|
|
<cvename>CVE-2005-2706</cvename>
|
|
<cvename>CVE-2005-2707</cvename>
|
|
<url>http://www.mozilla.org/security/announce/mfsa2005-58.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-09-22</discovery>
|
|
<entry>2005-09-23</entry>
|
|
<modified>2005-10-26</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="2e28cefb-2aee-11da-a263-0001020eed82">
|
|
<topic>firefox & mozilla -- command line URL shell command injection</topic>
|
|
<affects>
|
|
<package>
|
|
<name>firefox</name>
|
|
<range><lt>1.0.7,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-firefox</name>
|
|
<range><lt>1.0.7</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>mozilla</name>
|
|
<range><lt>1.7.12,2</lt></range>
|
|
<range><ge>1.8.*,2</ge></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-mozilla</name>
|
|
<range><lt>1.7.12</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-mozilla-devel</name>
|
|
<range><gt>0</gt></range>
|
|
</package>
|
|
<package>
|
|
<name>netscape7</name>
|
|
<range><ge>0</ge></range>
|
|
</package>
|
|
<package>
|
|
<!-- These ports are obsolete. -->
|
|
<name>de-linux-mozillafirebird</name>
|
|
<name>el-linux-mozillafirebird</name>
|
|
<name>ja-linux-mozillafirebird-gtk1</name>
|
|
<name>ja-mozillafirebird-gtk2</name>
|
|
<name>linux-mozillafirebird</name>
|
|
<name>ru-linux-mozillafirebird</name>
|
|
<name>zhCN-linux-mozillafirebird</name>
|
|
<name>zhTW-linux-mozillafirebird</name>
|
|
<range><ge>0</ge></range>
|
|
</package>
|
|
<package>
|
|
<!-- These package names are obsolete. -->
|
|
<name>de-linux-netscape</name>
|
|
<name>de-netscape7</name>
|
|
<name>fr-linux-netscape</name>
|
|
<name>fr-netscape7</name>
|
|
<name>ja-linux-netscape</name>
|
|
<name>ja-netscape7</name>
|
|
<name>linux-netscape</name>
|
|
<name>linux-phoenix</name>
|
|
<name>mozilla+ipv6</name>
|
|
<name>mozilla-embedded</name>
|
|
<name>mozilla-firebird</name>
|
|
<name>mozilla-gtk1</name>
|
|
<name>mozilla-gtk2</name>
|
|
<name>mozilla-gtk</name>
|
|
<name>mozilla-thunderbird</name>
|
|
<name>phoenix</name>
|
|
<name>pt_BR-netscape7</name>
|
|
<range><ge>0</ge></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A Secunia Advisory reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/16869/">
|
|
<p>Peter Zelezny has discovered a vulnerability in Firefox,
|
|
which can be exploited by malicious people to compromise a
|
|
user's system.</p>
|
|
<p>The vulnerability is caused due to the shell script used
|
|
to launch Firefox parsing shell commands that are enclosed
|
|
within backticks in the URL provided via the command
|
|
line. This can e.g. be exploited to execute arbitrary
|
|
shell commands by tricking a user into following a
|
|
malicious link in an external application which uses
|
|
Firefox as the default browser.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-2968</cvename>
|
|
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=307185</url>
|
|
<url>http://secunia.com/advisories/16869/</url>
|
|
<url>http://www.mozilla.org/security/announce/mfsa2005-59.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-09-06</discovery>
|
|
<entry>2005-09-22</entry>
|
|
<modified>2005-10-26</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="e936d612-253f-11da-bc01-000e0c2e438a">
|
|
<topic>apache -- Certificate Revocation List (CRL) off-by-one vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>apache</name>
|
|
<range><gt>2.*</gt><lt>2.0.54_1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Marc Stern reports an off-by-one vulnerability in within
|
|
mod_ssl. The vulnerability lies in mod_ssl's Certificate
|
|
Revocation List (CRL). If Apache is configured to use a
|
|
CRL this could allow an attacker to crash a child process
|
|
causing a Denial of Service.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>14366</bid>
|
|
<cvename>CVE-2005-1268</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-07-12</discovery>
|
|
<entry>2005-09-17</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="7d52081f-2795-11da-bc01-000e0c2e438a">
|
|
<topic>squirrelmail -- _$POST variable handling allows for various attacks</topic>
|
|
<affects>
|
|
<package>
|
|
<name>squirrelmail</name>
|
|
<name>ja-squirrelmail</name>
|
|
<range><ge>1.4.0</ge><lt>1.4.5</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A Squirrelmail Advisory reports:</p>
|
|
<blockquote cite="http://www.squirrelmail.org/security/issue/2005-07-13">
|
|
<p>An extract($_POST) was done in options_identities.php which
|
|
allowed for an attacker to set random variables in that
|
|
file. This could lead to the reading (and possible
|
|
writing) of other people's preferences, cross site scripting
|
|
or writing files in webserver-writable locations.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>14254</bid>
|
|
<cvename>CVE-2005-2095</cvename>
|
|
<url>http://www.squirrelmail.org/security/issue/2005-07-13</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-07-13</discovery>
|
|
<entry>2005-09-17</entry>
|
|
<modified>2005-09-19</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="a863aa74-24be-11da-8882-000e0c33c2dc">
|
|
<topic>X11 server -- pixmap allocation vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>XFree86-Server</name>
|
|
<range><lt>4.5.0_2</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>xorg-server</name>
|
|
<range><lt>6.8.2_5</lt></range>
|
|
<range><gt>6.8.99</gt><lt>6.8.99.12_1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Allocating large pixmaps by a client can trigger an integer
|
|
overflow in the X server, potentially leading to execution of
|
|
arbitrary code with elevated (root) privileges.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>14807</bid>
|
|
<certvu>102441</certvu>
|
|
<cvename>CVE-2005-2495</cvename>
|
|
<url>https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=166856</url>
|
|
<url>https://bugs.freedesktop.org/show_bug.cgi?id=594</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-09-12</discovery>
|
|
<entry>2005-09-15</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="9750cf22-216d-11da-bc01-000e0c2e438a">
|
|
<topic>unzip -- permission race vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>unzip</name>
|
|
<name>zh-unzip</name>
|
|
<name>ko-unzip</name>
|
|
<range><lt>5.52_2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Imran Ghory reports a vulnerability within unzip. The
|
|
vulnerability is caused by a race condition between
|
|
extracting an archive and changing the permissions of the
|
|
extracted files. This would give an attacker enough time to
|
|
remove a file and hardlink it to another file owned by the
|
|
user running unzip. When unzip changes the permissions of
|
|
the file it could give the attacker access to files that
|
|
normally would not have been accessible for others.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>14450</bid>
|
|
<cvename>CVE-2005-2475</cvename>
|
|
<mlist msgid="7389fc4b05080116031536adf7@mail.gmail.com">http://marc.theaimsgroup.com/?l=bugtraq&m=112300046224117</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-08-02</discovery>
|
|
<entry>2005-09-13</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="8665ebb9-2237-11da-978e-0001020eed82">
|
|
<topic>firefox & mozilla -- buffer overflow vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>firefox</name>
|
|
<range><lt>1.0.6_5,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-firefox</name>
|
|
<range><lt>1.0.7</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>mozilla</name>
|
|
<range><lt>1.7.11_1,2</lt></range>
|
|
<range><ge>1.8.*,2</ge><lt>1.8.b1_5,2</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-mozilla</name>
|
|
<range><lt>1.7.12</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-mozilla-devel</name>
|
|
<range><gt>0</gt></range>
|
|
</package>
|
|
<package>
|
|
<name>netscape7</name>
|
|
<range><ge>0</ge></range>
|
|
</package>
|
|
<package>
|
|
<!-- These ports are obsolete. -->
|
|
<name>de-linux-mozillafirebird</name>
|
|
<name>el-linux-mozillafirebird</name>
|
|
<name>ja-linux-mozillafirebird-gtk1</name>
|
|
<name>ja-mozillafirebird-gtk2</name>
|
|
<name>linux-mozillafirebird</name>
|
|
<name>ru-linux-mozillafirebird</name>
|
|
<name>zhCN-linux-mozillafirebird</name>
|
|
<name>zhTW-linux-mozillafirebird</name>
|
|
<range><ge>0</ge></range>
|
|
</package>
|
|
<package>
|
|
<!-- These package names are obsolete. -->
|
|
<name>de-linux-netscape</name>
|
|
<name>de-netscape7</name>
|
|
<name>fr-linux-netscape</name>
|
|
<name>fr-netscape7</name>
|
|
<name>ja-linux-netscape</name>
|
|
<name>ja-netscape7</name>
|
|
<name>linux-netscape</name>
|
|
<name>linux-phoenix</name>
|
|
<name>mozilla+ipv6</name>
|
|
<name>mozilla-embedded</name>
|
|
<name>mozilla-firebird</name>
|
|
<name>mozilla-gtk1</name>
|
|
<name>mozilla-gtk2</name>
|
|
<name>mozilla-gtk</name>
|
|
<name>mozilla-thunderbird</name>
|
|
<name>phoenix</name>
|
|
<name>pt_BR-netscape7</name>
|
|
<range><ge>0</ge></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Tom Ferris reports:</p>
|
|
<blockquote cite="http://marc.theaimsgroup.com/?l=full-disclosure&m=112624614008387">
|
|
<p>A buffer overflow vulnerability exists within Firefox
|
|
version 1.0.6 and all other prior versions which allows
|
|
for an attacker to remotely execute arbitrary code on an
|
|
affected host.</p>
|
|
<p>The problem seems to be when a hostname which has all
|
|
dashes causes the NormalizeIDN call in
|
|
nsStandardURL::BuildNormalizedSpec to return true, but is
|
|
sets encHost to an empty string. Meaning, Firefox appends
|
|
0 to approxLen and then appends the long string of dashes
|
|
to the buffer instead.</p>
|
|
</blockquote>
|
|
<p><strong>Note:</strong> It is possible to disable IDN
|
|
support as a workaround to protect against this buffer
|
|
overflow. How to do this is described on the <em><a href="http://www.mozilla.org/security/idn.html">What Firefox
|
|
and Mozilla users should know about the IDN buffer overflow
|
|
security issue</a></em> web page.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>14784</bid>
|
|
<certvu>573857</certvu>
|
|
<cvename>CVE-2005-2871</cvename>
|
|
<url>http://marc.theaimsgroup.com/?l=full-disclosure&m=112624614008387</url>
|
|
<url>http://www.mozilla.org/security/idn.html</url>
|
|
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=307259</url>
|
|
<url>http://www.mozilla.org/security/announce/mfsa2005-57.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-09-08</discovery>
|
|
<entry>2005-09-10</entry>
|
|
<modified>2005-10-26</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="673aec6f-1cae-11da-bc01-000e0c2e438a">
|
|
<topic>htdig -- cross site scripting vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>htdig</name>
|
|
<range><lt>3.2.0.b6_1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Michael Krax reports a vulnerability within htdig. The
|
|
vulnerability lies within an unsanitized config parameter,
|
|
allowing a malicious attacker to execute arbitrary scripting
|
|
code on the target's browser. This might allow the attacker
|
|
to obtain the user's cookies which are associated with the
|
|
site, including cookies used for authentication.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>12442</bid>
|
|
<cvename>CVE-2005-0085</cvename>
|
|
<url>http://www.securitytracker.com/alerts/2005/Feb/1013078.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-02-03</discovery>
|
|
<entry>2005-09-04</entry>
|
|
<modified>2005-09-13</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="4e210d72-1c5c-11da-92ce-0048543d60ce">
|
|
<topic>squid -- Denial Of Service Vulnerability in sslConnectTimeout</topic>
|
|
<affects>
|
|
<package>
|
|
<name>squid</name>
|
|
<range><lt>2.5.10_5</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The squid patches page notes:</p>
|
|
<blockquote cite="http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE10-sslConnectTimeout">
|
|
<p>After certain slightly odd requests Squid crashes with a
|
|
segmentation fault in sslConnectTimeout.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>14731</bid>
|
|
<cvename>CVE-2005-2796</cvename>
|
|
<url>http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE10-sslConnectTimeout</url>
|
|
<url>http://www.squid-cache.org/bugs/show_bug.cgi?id=1355</url>
|
|
<url>http://secunia.com/advisories/16674/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-07-21</discovery>
|
|
<entry>2005-09-04</entry>
|
|
<modified>2005-10-02</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="0c0dc409-1c5e-11da-92ce-0048543d60ce">
|
|
<topic>squid -- Possible Denial Of Service Vulnerability in store.c</topic>
|
|
<affects>
|
|
<package>
|
|
<name>squid</name>
|
|
<range><lt>2.5.10_5</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The squid patches page notes:</p>
|
|
<blockquote cite="http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE10-STORE_PENDING">
|
|
<p>Squid crashes with the above assertion failure [assertion failed:
|
|
store.c:523: "e->store_status == STORE_PENDING"] in certain
|
|
conditions involving aborted requests.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>14761</bid>
|
|
<cvename>CVE-2005-2794</cvename>
|
|
<url>http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE10-STORE_PENDING</url>
|
|
<url>http://www.squid-cache.org/bugs/show_bug.cgi?id=1368</url>
|
|
<url>http://secunia.com/advisories/16708/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-08-02</discovery>
|
|
<entry>2005-09-04</entry>
|
|
<modified>2005-10-02</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="30e4ed7b-1ca6-11da-bc01-000e0c2e438a">
|
|
<topic>bind9 -- denial of service</topic>
|
|
<affects>
|
|
<package>
|
|
<name>bind9</name>
|
|
<range><eq>9.3.0</eq></range>
|
|
</package>
|
|
<system>
|
|
<name>FreeBSD</name>
|
|
<range><ge>5.3</ge><lt>5.3_16</lt></range>
|
|
</system>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Problem description</p>
|
|
<p>A DNSSEC-related validator function in BIND 9.3.0 contains an
|
|
inappropriate internal consistency test. When this test is
|
|
triggered, named(8) will exit.</p>
|
|
<p>Impact</p>
|
|
<p>On systems with DNSSEC enabled, a remote attacker may be able
|
|
to inject a specially crafted packet that will cause the
|
|
internal consistency test to trigger, and named(8) to
|
|
terminate. As a result, the name server will no longer be
|
|
available to service requests.</p>
|
|
<p>Workaround</p>
|
|
<p>DNSSEC is not enabled by default, and the "dnssec-enable"
|
|
directive is not normally present. If DNSSEC has been
|
|
enabled, disable it by changing the "dnssec-enable" directive
|
|
to "dnssec-enable no;" in the named.conf(5) configuration
|
|
file.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<certvu>938617</certvu>
|
|
<cvename>CVE-2005-0034</cvename>
|
|
<url>http://www.uniras.gov.uk/niscc/docs/al-20050125-00060.html?lang=en</url>
|
|
<url>http://www.isc.org/sw/bind/bind9.3.php#security</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-01-25</discovery>
|
|
<entry>2005-09-03</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="947f4b14-1c89-11da-bc01-000e0c2e438a">
|
|
<topic>bind -- buffer overrun vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>bind84</name>
|
|
<range><ge>8.4.4</ge><lt>8.4.6</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>An ISC advisory reports a buffer overrun vulnerability within
|
|
bind. The vulnerability could result in a Denial of Service.
|
|
A workaround is available by disabling recursion and glue
|
|
fetching.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<certvu>327633</certvu>
|
|
<cvename>CVE-2005-0033</cvename>
|
|
<url>http://www.uniras.gov.uk/niscc/docs/al-20050125-00059.html?lang=en</url>
|
|
<url>http://www.isc.org/sw/bind/bind-security.php</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-01-25</discovery>
|
|
<entry>2005-09-03</entry>
|
|
<modified>2005-09-21</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="08df5d46-1baf-11da-8038-0040f42d58c6">
|
|
<topic>urban -- stack overflow vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>urban</name>
|
|
<range><lt>1.5.3_2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Several filename-related stack overflow bugs allow a local
|
|
attacker to elevate its privileges to the games group, since
|
|
urban is installed setgid games.</p>
|
|
<p>Issue discovered and fixed by <shaun@rsc.cx>.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-2864</cvename>
|
|
<mlist msgid="55104.213.107.125.108.1125844783.squirrel@webmail.rsc.cx">http://marc.theaimsgroup.com/?l=bugtraq&m=112604855119036</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-09-02</discovery>
|
|
<entry>2005-09-02</entry>
|
|
<modified>2005-09-22</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="6e27f3b6-189b-11da-b6be-0090274e8dbb">
|
|
<topic>fswiki -- command injection vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>fswiki</name>
|
|
<range><lt>3.5.9</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>There is a command injection vulnerability in admin page
|
|
of fswiki.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://jvn.jp/jp/JVN%2342435855/index.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-08-29</discovery>
|
|
<entry>2005-08-29</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="e5afdf63-1746-11da-978e-0001020eed82">
|
|
<topic>evolution -- remote format string vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>evolution</name>
|
|
<range><gt>1.5</gt><lt>2.2.3_1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A SITIC Vulnerability Advisory reports:</p>
|
|
<blockquote cite="http://www.sitic.se/eng/advisories_and_recommendations/sa05-001.html">
|
|
<p>Evolution suffers from several format string bugs when
|
|
handling data from remote sources. These bugs lead to
|
|
crashes or the execution of arbitrary assembly language
|
|
code.</p>
|
|
<ol>
|
|
<li>The first format string bug occurs when viewing the
|
|
full vCard data attached to an e-mail message.</li>
|
|
<li>The second format string bug occurs when displaying
|
|
contact data from remote LDAP servers.</li>
|
|
<li>The third format string bug occurs when displaying
|
|
task list data from remote servers.</li>
|
|
<li>The fourth, and least serious, format string bug
|
|
occurs when the user goes to the Calendars tab to save
|
|
task list data that is vulnerable to problem 3
|
|
above. Other calendar entries that do not come from task
|
|
lists are also affected.</li>
|
|
</ol>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>14532</bid>
|
|
<cvename>CVE-2005-2549</cvename>
|
|
<cvename>CVE-2005-2550</cvename>
|
|
<url>http://www.sitic.se/eng/advisories_and_recommendations/sa05-001.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-08-10</discovery>
|
|
<entry>2005-08-27</entry>
|
|
<modified>2006-03-24</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="38c76fcf-1744-11da-978e-0001020eed82">
|
|
<topic>pam_ldap -- authentication bypass vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>pam_ldap</name>
|
|
<range><lt>1.8.0</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Luke Howard reports:</p>
|
|
<blockquote cite="https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=166163">
|
|
<p>If a pam_ldap client authenticates against an LDAP server
|
|
that returns a passwordPolicyResponse control, but omits
|
|
the optional "error" field of the
|
|
PasswordPolicyResponseValue, then the LDAP authentication
|
|
result will be ignored and the authentication step will
|
|
always succeed.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-2641</cvename>
|
|
<certvu>778916</certvu>
|
|
<url>https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=166163</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-08-22</discovery>
|
|
<entry>2005-08-27</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="b971d2a6-1670-11da-978e-0001020eed82">
|
|
<topic>pcre -- regular expression buffer overflow</topic>
|
|
<affects>
|
|
<package>
|
|
<name>pcre</name>
|
|
<name>pcre-utf8</name>
|
|
<range><lt>6.2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The pcre library is vulnerable to a buffer overflow
|
|
vulnerability due to insufficient validation of quantifier
|
|
values. This could lead execution of arbitrary code with
|
|
the permissions of the program using pcre by way of a
|
|
specially crated regular expression.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>14620</bid>
|
|
<cvename>CVE-2005-2491</cvename>
|
|
<url>http://www.pcre.org/changelog.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-08-01</discovery>
|
|
<entry>2005-08-26</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="f66e011d-13ff-11da-af41-0004614cc33d">
|
|
<topic>elm -- remote buffer overflow in Expires header</topic>
|
|
<affects>
|
|
<package>
|
|
<name>elm</name>
|
|
<range><lt>2.5.8</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Ulf Harnhammar has discovered a remotely exploitable buffer
|
|
overflow in Elm e-mail client when parsing the Expires header
|
|
of an e-mail message:</p>
|
|
<blockquote cite="http://archives.neohapsis.com/archives/fulldisclosure/2005-08/0688.html">
|
|
<p>The attacker only needs to send the victim an e-mail
|
|
message. When the victim with that message in his or her
|
|
inbox starts Elm or simply views the inbox in an already
|
|
started copy of Elm, the buffer overflow will happen
|
|
immediately. The overflow is stack-based, and it gives full
|
|
control over EIP, EBP and EBX. It is caused by a bad
|
|
sscanf(3) call, using a format string containing "%s"
|
|
to copy from a long char array to a shorter array.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://archives.neohapsis.com/archives/fulldisclosure/2005-08/0688.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-08-20</discovery>
|
|
<entry>2005-08-23</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="5ad3e437-e527-4514-b9ed-280b2ca1a8c9">
|
|
<topic>openvpn -- multiple TCP clients connecting with the same certificate at the same time can crash the server</topic>
|
|
<affects>
|
|
<package>
|
|
<name>openvpn</name>
|
|
<range><lt>2.0.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>James Yonan reports:</p>
|
|
<blockquote cite="http://openvpn.net/changelog.html">
|
|
<p>If two or more client machines try to connect to the server
|
|
at the same time via TCP, using the same client certificate,
|
|
and when --duplicate-cn is not enabled on the server, a race
|
|
condition can crash the server with "Assertion failed at
|
|
mtcp.c:411"</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-2534</cvename>
|
|
<url>http://openvpn.net/changelog.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-08-03</discovery>
|
|
<entry>2005-08-19</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="1986449a-8b74-40fa-b7cc-0d8def8aad65">
|
|
<topic>openvpn -- denial of service: malicious authenticated "tap" client can deplete server virtual memory</topic>
|
|
<affects>
|
|
<package>
|
|
<name>openvpn</name>
|
|
<range><lt>2.0.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>James Yonan reports:</p>
|
|
<blockquote cite="http://openvpn.net/changelog.html">
|
|
<p>A malicious [authenticated] client in "dev tap"
|
|
ethernet bridging mode could theoretically flood the server
|
|
with packets appearing to come from hundreds of thousands
|
|
of different MAC addresses, causing the OpenVPN process to
|
|
deplete system virtual memory as it expands its internal
|
|
routing table.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-2533</cvename>
|
|
<url>http://openvpn.net/changelog.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-07-27</discovery>
|
|
<entry>2005-08-19</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="d1c39c8e-05ab-4739-870f-765490fa2052">
|
|
<topic>openvpn -- denial of service: undecryptable packet from authorized client can disconnect unrelated clients</topic>
|
|
<affects>
|
|
<package>
|
|
<name>openvpn</name>
|
|
<range><lt>2.0.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>James Yonan reports:</p>
|
|
<blockquote cite="http://openvpn.net/changelog.html">
|
|
<p>If the client sends a packet which fails to decrypt on the
|
|
server, the OpenSSL error queue is not properly flushed,
|
|
which can result in another unrelated client instance on the
|
|
server seeing the error and responding to it, resulting in
|
|
disconnection of the unrelated client.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-2532</cvename>
|
|
<url>http://openvpn.net/changelog.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-07-27</discovery>
|
|
<entry>2005-08-19</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="a51ad838-2077-48b2-a136-e888a7db5f8d">
|
|
<topic>openvpn -- denial of service: client certificate validation can disconnect unrelated clients</topic>
|
|
<affects>
|
|
<package>
|
|
<name>openvpn</name>
|
|
<range><lt>2.0.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>James Yonan reports:</p>
|
|
<blockquote cite="http://openvpn.net/changelog.html">
|
|
<p>DoS attack against server when run with "verb 0" and
|
|
without "tls-auth". If a client connection to the server
|
|
fails certificate verification, the OpenSSL error queue is
|
|
not properly flushed, which can result in another unrelated
|
|
client instance on the server seeing the error and
|
|
responding to it, resulting in disconnection of the
|
|
unrelated client.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-2531</cvename>
|
|
<url>http://openvpn.net/changelog.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-08-03</discovery>
|
|
<entry>2005-08-19</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="5fde5c30-0f4e-11da-bc01-000e0c2e438a">
|
|
<topic>tor -- diffie-hellman handshake flaw</topic>
|
|
<affects>
|
|
<package>
|
|
<name>tor</name>
|
|
<range><lt>0.1.0.14</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A tor advisory reports</p>
|
|
<blockquote cite="http://archives.seul.org/or/announce/Aug-2005/msg00002.html">
|
|
<p>Tor clients can completely loose anonymity, confidentiality,
|
|
and data integrity if the first Tor server in their path is
|
|
malicious. Specifically, if the Tor client chooses a
|
|
malicious Tor server for her first hop in the circuit, that
|
|
server can learn all the keys she negotiates for the rest of
|
|
the circuit (or just spoof the whole circuit), and then read
|
|
and/or modify all her traffic over that circuit.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-2643</cvename>
|
|
<url>http://archives.seul.org/or/announce/Aug-2005/msg00002.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-08-11</discovery>
|
|
<entry>2005-08-17</entry>
|
|
<modified>2005-09-21</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="f74dc01b-0e83-11da-bc08-0001020eed82">
|
|
<topic>acroread -- plug-in buffer overflow vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>acroread</name>
|
|
<range><lt>7.0.1</lt></range>
|
|
<range><gt>5.*,1</gt><lt>7.0.1,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>acroread4</name>
|
|
<name>acroread5</name>
|
|
<range><ge>0</ge></range>
|
|
</package>
|
|
<package>
|
|
<name>acroread7</name>
|
|
<range><lt>7.0.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A Adobe Security Advisory reports:</p>
|
|
<blockquote cite="http://www.adobe.com/support/techdocs/321644.html">
|
|
<p>The identified vulnerability is a buffer overflow within
|
|
a core application plug-in, which is part of Adobe Acrobat
|
|
and Adobe Reader. If a malicious file were opened it could
|
|
trigger a buffer overflow as the file is being loaded into
|
|
Adobe Acrobat and Adobe Reader. A buffer overflow can
|
|
cause the application to crash and increase the risk of
|
|
malicious code execution.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-2470</cvename>
|
|
<url>http://www.adobe.com/support/techdocs/321644.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-08-16</discovery>
|
|
<entry>2005-08-16</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="e65ad1bf-0d8b-11da-90d0-00304823c0d3">
|
|
<topic>pear-XML_RPC -- remote PHP code injection vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>pear-XML_RPC</name>
|
|
<range><lt>1.4.0</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>phpmyfaq</name>
|
|
<range><lt>1.4.11</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>drupal</name>
|
|
<range><lt>4.6.3</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>eGroupWare</name>
|
|
<range><lt>1.0.0.009</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>phpAdsNew</name>
|
|
<range><lt>2.0.5</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>phpgroupware</name>
|
|
<range><lt>0.9.16.007</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>b2evolution</name>
|
|
<range><lt>0.9.0.12_2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A Hardened-PHP Project Security Advisory reports:</p>
|
|
<blockquote cite="http://www.hardened-php.net/advisory_142005.66.html">
|
|
<p>When the library parses XMLRPC requests/responses, it constructs
|
|
a string of PHP code, that is later evaluated. This means any
|
|
failure to properly handle the construction of this string can
|
|
result in arbitrary execution of PHP code.</p>
|
|
<p>This new injection vulnerability is cause by not properly
|
|
handling the situation, when certain XML tags are nested
|
|
in the parsed document, that were never meant to be nested
|
|
at all. This can be easily exploited in a way, that
|
|
user-input is placed outside of string delimiters within
|
|
the evaluation string, which obviously results in
|
|
arbitrary code execution.</p>
|
|
</blockquote>
|
|
<p>Note that several applications contains an embedded version
|
|
on XML_RPC, therefor making them the vulnerable to the same
|
|
code injection vulnerability.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-2498</cvename>
|
|
<url>http://b2evolution.net/news/2005/08/31/fix_for_xml_rpc_vulnerability_again_1</url>
|
|
<url>http://downloads.phpgroupware.org/changelog</url>
|
|
<url>http://drupal.org/files/sa-2005-004/advisory.txt</url>
|
|
<url>http://phpadsnew.com/two/nucleus/index.php?itemid=45</url>
|
|
<url>http://sourceforge.net/project/shownotes.php?release_id=349626</url>
|
|
<url>http://www.hardened-php.net/advisory_142005.66.html</url>
|
|
<url>http://www.hardened-php.net/advisory_152005.67.html</url>
|
|
<url>http://www.phpmyfaq.de/advisory_2005-08-15.php</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-08-15</discovery>
|
|
<entry>2005-08-15</entry>
|
|
<modified>2005-09-04</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="e86fbb5f-0d04-11da-bc08-0001020eed82">
|
|
<topic>awstats -- arbitrary code execution vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>awstats</name>
|
|
<range><lt>6.4_1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>An iDEFENSE Security Advisory reports:</p>
|
|
<blockquote cite="http://www.idefense.com/application/poi/display?id=290&type=vulnerabilities">
|
|
<p>Remote exploitation of an input validation vulnerability
|
|
in AWStats allows remote attackers to execute arbitrary
|
|
commands.</p>
|
|
|
|
<p>The problem specifically exists because of insufficient
|
|
input filtering before passing user-supplied data to an
|
|
<code>eval()</code> function. As part of the statistics
|
|
reporting function, AWStats displays information about the
|
|
most common referrer values that caused users to visit the
|
|
website. The referrer data is used without proper
|
|
sanitation in an <code>eval()</code> statement, resulting
|
|
in the execution of arbitrary perl code.</p>
|
|
|
|
<p>Successful exploitation results in the execution of
|
|
arbitrary commands with permissions of the web
|
|
service. Exploitation will not occur until the stats page
|
|
has been regenerated with the tainted referrer values from
|
|
the http access log. Note that AWStats is only vulnerable
|
|
in situations where at least one URLPlugin is enabled.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-1527</cvename>
|
|
<mlist msgid="20050811155502.61E3C7A00B4@mail.idefense.com">http://marc.theaimsgroup.com/?l=full-disclosure&m=112377934108902</mlist>
|
|
<url>http://www.idefense.com/application/poi/display?id=290&type=vulnerabilities</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-08-09</discovery>
|
|
<entry>2005-08-14</entry>
|
|
<modified>2005-08-23</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="3b4a6982-0b24-11da-bc08-0001020eed82">
|
|
<topic>libgadu -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>gaim</name>
|
|
<name>ja-gaim</name>
|
|
<name>ko-gaim</name>
|
|
<name>ru-gaim</name>
|
|
<range><lt>1.4.0_1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>kdenetwork</name>
|
|
<range><gt>3.2.2</gt><lt>3.4.2</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>pl-ekg</name>
|
|
<range><lt>1.6r3,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>centericq</name>
|
|
<range><lt>4.21.0_1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Wojtek Kaniewski reports:</p>
|
|
<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&m=112198499417250">
|
|
<p>Multiple vulnerabilities have been found in libgadu, a
|
|
library for handling Gadu-Gadu instant messaging
|
|
protocol. It is a part of ekg, a Gadu-Gadu client, but is
|
|
widely used in other clients. Also some of the user
|
|
contributed scripts were found to behave in an insecure
|
|
manner.</p>
|
|
<ul>
|
|
<li>integer overflow in libgadu (CVE-2005-1852) that could
|
|
be triggered by an incomming message and lead to
|
|
application crash and/or remote code execution</li>
|
|
<li>insecure file creation (CVE-2005-1850) and shell
|
|
command injection (CVE-2005-1851) in other user
|
|
contributed scripts (discovered by Marcin Owsiany and
|
|
Wojtek Kaniewski)</li>
|
|
<li>several signedness errors in libgadu that could be
|
|
triggered by an incomming network data or an application
|
|
passing invalid user input to the library</li>
|
|
<li>memory alignment errors in libgadu that could be
|
|
triggered by an incomming message and lead to bus errors
|
|
on architectures like SPARC</li>
|
|
<li>endianness errors in libgadu that could cause invalid
|
|
behaviour of applications on big-endian
|
|
architectures</li>
|
|
</ul>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>14345</bid>
|
|
<cvename>CVE-2005-1850</cvename>
|
|
<cvename>CVE-2005-1851</cvename>
|
|
<cvename>CVE-2005-1852</cvename>
|
|
<cvename>CVE-2005-2369</cvename>
|
|
<cvename>CVE-2005-2370</cvename>
|
|
<cvename>CVE-2005-2448</cvename>
|
|
<mlist msgid="42DFF06F.7060005@toxygen.net">http://marc.theaimsgroup.com/?l=bugtraq&m=112198499417250</mlist>
|
|
<url>http://gaim.sourceforge.net/security/?id=20</url>
|
|
<url>http://www.kde.org/info/security/advisory-20050721-1.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-07-21</discovery>
|
|
<entry>2005-08-12</entry>
|
|
<modified>2005-10-23</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="09db2844-0b21-11da-bc08-0001020eed82">
|
|
<topic>gaim -- AIM/ICQ non-UTF-8 filename crash</topic>
|
|
<affects>
|
|
<package>
|
|
<name>gaim</name>
|
|
<name>ja-gaim</name>
|
|
<name>ko-gaim</name>
|
|
<name>ru-gaim</name>
|
|
<range><lt>1.4.0_1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The GAIM team reports:</p>
|
|
<blockquote cite="http://gaim.sourceforge.net/security/?id=21">
|
|
<p>A remote user could cause Gaim to crash on some systems
|
|
by sending the Gaim user a file whose filename contains
|
|
certain invalid characters. It is unknown what combination
|
|
of systems are affected, but it is suspected that Windows
|
|
users and systems with older versions of GTK+ are
|
|
especially susceptible.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-2102</cvename>
|
|
<url>http://gaim.sourceforge.net/security/?id=21</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-08-09</discovery>
|
|
<entry>2005-08-12</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="6d1761d2-0b23-11da-bc08-0001020eed82">
|
|
<topic>gaim -- AIM/ICQ away message buffer overflow</topic>
|
|
<affects>
|
|
<package>
|
|
<name>gaim</name>
|
|
<name>ja-gaim</name>
|
|
<name>ko-gaim</name>
|
|
<name>ru-gaim</name>
|
|
<range><lt>1.4.0_1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The GAIM team reports:</p>
|
|
<blockquote cite="http://gaim.sourceforge.net/security/?id=22">
|
|
<p>A remote AIM or ICQ user can cause a buffer overflow in
|
|
Gaim by setting an away message containing many AIM
|
|
substitution strings (such as %t or %n).</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-2103</cvename>
|
|
<url>http://gaim.sourceforge.net/security/?id=22</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-08-09</discovery>
|
|
<entry>2005-08-12</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="24eee285-09c7-11da-bc08-0001020eed82">
|
|
<topic>xpdf -- disk fill DoS vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>xpdf</name>
|
|
<range><lt>3.00_7</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>kdegraphics</name>
|
|
<range><lt>3.4.2</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>gpdf</name>
|
|
<range><lt>2.10.0_2</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>cups-base</name>
|
|
<range><lt>1.1.23.0_5</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>xpdf is vulnerable to a denial of service vulnerability
|
|
which can cause xpdf to create an infinitely large file,
|
|
thereby filling up the /tmp partition, when opening a
|
|
specially crafted PDF file.</p>
|
|
<p>Note that several applications contains an embedded version
|
|
of xpdf, therefor making them the vulnerable to the same
|
|
DoS. In CUPS this vulnerability would cause the pdftops
|
|
filter to crash.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>14529</bid>
|
|
<cvename>CVE-2005-2097</cvename>
|
|
<url>http://rhn.redhat.com/errata/RHSA-2005-670.html</url>
|
|
<url>http://www.kde.org/info/security/advisory-20050809-1.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-08-09</discovery>
|
|
<entry>2005-08-12</entry>
|
|
<modified>2005-09-07</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="d7cd5015-08c9-11da-bc08-0001020eed82">
|
|
<topic>gforge -- XSS and email flood vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>gforge</name>
|
|
<range><gt>0</gt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Jose Antonio Coret reports that GForge contains multiple
|
|
Cross Site Scripting vulnerabilities and an e-mail flood
|
|
vulnerability:</p>
|
|
<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&m=112259845904350">
|
|
<p>The login form is also vulnerable to XSS (Cross Site
|
|
Scripting) attacks. This may be used to launch phising
|
|
attacks by sending HTML e-mails (i.e.: saying that you
|
|
need to upgrade to the latest GForge version due to a
|
|
security problem) and putting in the e-mail an HTML link
|
|
that points to an specially crafted url that inserts an
|
|
html form in the GForge login page and when the user press
|
|
the login button, he/she send the credentials to the
|
|
attackers website.</p>
|
|
|
|
<p>The 'forgot your password?' feature allows a remote user
|
|
to load a certain URL to cause the service to send a
|
|
validation e-mail to the specified user's e-mail address.
|
|
There is no limit to the number of messages sent over a
|
|
period of time, so a remote user can flood the target
|
|
user's secondary e-mail address. E-Mail Flood, E-Mail
|
|
bomber.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>14405</bid>
|
|
<cvename>CVE-2005-2430</cvename>
|
|
<cvename>CVE-2005-2431</cvename>
|
|
<mlist msgid="1122496636.26878.2.camel@localhost.localdomain">http://marc.theaimsgroup.com/?l=bugtraq&m=112259845904350</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-07-27</discovery>
|
|
<entry>2005-08-09</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="0274a9f1-0759-11da-bc08-0001020eed82">
|
|
<topic>postnuke -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>postnuke</name>
|
|
<range><lt>0.760</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Postnuke Security Announcementss reports of the following
|
|
vulnerabilities:</p>
|
|
<blockquote cite="http://news.postnuke.com/Article2691.html">
|
|
<ul>
|
|
<li>missing input validation within /modules/Messages/readpmsg.php</li>
|
|
<li>possible path disclosure within /user.php</li>
|
|
<li>possible path disclosure within /modules/News/article.php</li>
|
|
<li>possible remote code injection within /includes/pnMod.php</li>
|
|
<li>possible cross-site-scripting in /index.php</li>
|
|
</ul>
|
|
</blockquote>
|
|
<blockquote cite="http://news.postnuke.com/Article2699.html">
|
|
<ul>
|
|
<li>remote code injection via xml rpc library</li>
|
|
</ul>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-1621</cvename>
|
|
<cvename>CVE-2005-1695</cvename>
|
|
<cvename>CVE-2005-1696</cvename>
|
|
<cvename>CVE-2005-1698</cvename>
|
|
<cvename>CVE-2005-1777</cvename>
|
|
<cvename>CVE-2005-1778</cvename>
|
|
<cvename>CVE-2005-1921</cvename>
|
|
<mlist msgid="20050527223753.21735.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&m=111721364707520</mlist>
|
|
<url>http://secunia.com/advisories/15450/</url>
|
|
<url>http://news.postnuke.com/Article2691.html</url>
|
|
<url>http://news.postnuke.com/Article2699.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-05-27</discovery>
|
|
<entry>2005-08-08</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="0bf9d7fb-05b3-11da-bc08-0001020eed82">
|
|
<topic>mambo -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>mambo</name>
|
|
<range><lt>4.5.2.3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A Secunia Advisory reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/15710/">
|
|
<p>Some vulnerabilities have been reported in Mambo, where
|
|
some have unknown impacts and others can be exploited by
|
|
malicious people to conduct spoofing and SQL injection
|
|
attacks.</p>
|
|
<ol>
|
|
<li>Input passed to the "user_rating" parameter when
|
|
voting isn't properly sanitised before being used in a
|
|
SQL query. This can be exploited to manipulate SQL
|
|
queries by injecting arbitrary SQL code.</li>
|
|
<li>Some unspecified vulnerabilities in the "mosDBTable"
|
|
class and the "DOMIT" library have an unknown
|
|
impact.</li>
|
|
<li>An unspecified error in the "administrator/index3.php"
|
|
script can be exploited to spoof session IDs.</li>
|
|
</ol>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>13966</bid>
|
|
<cvename>CVE-2005-2002</cvename>
|
|
<url>http://secunia.com/advisories/15710/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-06-15</discovery>
|
|
<entry>2005-08-05</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="2b6e47b1-0598-11da-86bc-000e0c2e438a">
|
|
<topic>ipsec -- Incorrect key usage in AES-XCBC-MAC</topic>
|
|
<affects>
|
|
<system>
|
|
<name>FreeBSD</name>
|
|
<range><ge>5.4</ge><lt>5.4_6</lt></range>
|
|
<range><ge>5.*</ge><lt>5.3_20</lt></range>
|
|
</system>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<h1>Problem description</h1>
|
|
<p>A programming error in the implementation of the
|
|
AES-XCBC-MAC algorithm for authentication resulted in a
|
|
constant key being used instead of the key specified by the
|
|
system administrator.</p>
|
|
<h1>Impact</h1>
|
|
<p>If the AES-XCBC-MAC algorithm is used for authentication in
|
|
the absence of any encryption, then an attacker may be able to
|
|
forge packets which appear to originate from a different
|
|
system and thereby succeed in establishing an IPsec session.
|
|
If access to sensitive information or systems is controlled
|
|
based on the identity of the source system, this may result
|
|
in information disclosure or privilege escalation.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-2359</cvename>
|
|
<freebsdsa>SA-05:19.ipsec</freebsdsa>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-07-27</discovery>
|
|
<entry>2005-08-05</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="837b9fb2-0595-11da-86bc-000e0c2e438a">
|
|
<topic>zlib -- buffer overflow vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>linux_base-suse</name>
|
|
<range><lt>9.3_1</lt></range>
|
|
</package>
|
|
<system>
|
|
<name>FreeBSD</name>
|
|
<range><ge>5.4</ge><lt>5.4_6</lt></range>
|
|
<range><ge>5.3</ge><lt>5.3_20</lt></range>
|
|
</system>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<h1>Problem description</h1>
|
|
<p>A fixed-size buffer is used in the decompression of data
|
|
streams. Due to erronous analysis performed when zlib was
|
|
written, this buffer, which was belived to be sufficiently
|
|
large to handle any possible input stream, is in fact too
|
|
small.</p>
|
|
<h1>Impact</h1>
|
|
<p>A carefully constructed compressed data stream can result in
|
|
zlib overwriting some data structures. This may cause
|
|
applications to halt, resulting in a denial of service; or
|
|
it may result in an attacker gaining elevated privileges.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-1849</cvename>
|
|
<freebsdsa>SA-05:18.zlib</freebsdsa>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-07-27</discovery>
|
|
<entry>2005-08-05</entry>
|
|
<modified>2005-09-24</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="7257b26f-0597-11da-86bc-000e0c2e438a">
|
|
<topic>devfs -- ruleset bypass</topic>
|
|
<affects>
|
|
<system>
|
|
<name>FreeBSD</name>
|
|
<range><ge>5.4</ge><lt>5.4_5</lt></range>
|
|
<range><ge>5.*</ge><lt>5.3_19</lt></range>
|
|
</system>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<h1>Problem description</h1>
|
|
<p>Due to insufficient parameter checking of the node type
|
|
during device creation, any user can expose hidden device
|
|
nodes on devfs mounted file systems within their jail.
|
|
Device nodes will be created in the jail with their normal
|
|
default access permissions.</p>
|
|
<h1>Impact</h1>
|
|
<p>Jailed processes can get access to restricted resources on
|
|
the host system. For jailed processes running with superuser
|
|
privileges this implies access to all devices on the system.
|
|
This level of access can lead to information leakage and
|
|
privilege escalation.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-2218</cvename>
|
|
<freebsdsa>SA-05:17.devfs</freebsdsa>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-07-20</discovery>
|
|
<entry>2005-08-05</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="c28f4705-043f-11da-bc08-0001020eed82">
|
|
<topic>proftpd -- format string vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>proftpd</name>
|
|
<name>proftpd-mysql</name>
|
|
<range><lt>1.3.0.rc2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The ProFTPD release notes states:</p>
|
|
<blockquote cite="http://www.proftpd.org/docs/RELEASE_NOTES-1.3.0rc2">
|
|
<p>sean <infamous42md at hotpop.com> found two format
|
|
string vulnerabilities, one in mod_sql's SQLShowInfo
|
|
directive, and one involving the 'ftpshut' utility. Both
|
|
can be considered low risk, as they require active
|
|
involvement on the part of the site administrator in order
|
|
to be exploited.</p>
|
|
</blockquote>
|
|
<p>These vulnerabilities could potentially lead to information
|
|
disclosure, a denial-of-server situation, or execution of
|
|
arbitrary code with the permissions of the user running
|
|
ProFTPD.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-2390</cvename>
|
|
<url>http://www.gentoo.org/security/en/glsa/glsa-200508-02.xml</url>
|
|
<url>http://www.proftpd.org/docs/RELEASE_NOTES-1.3.0rc2</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-07-26</discovery>
|
|
<entry>2005-08-03</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="debbb39c-fdb3-11d9-a30d-00b0d09acbfc">
|
|
<topic>nbsmtp -- format string vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>nbsmtp</name>
|
|
<range><lt>0.99_1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>When nbsmtp is executed in debug mode, server messages
|
|
will be printed to stdout and logged via syslog. Syslog is
|
|
used insecurely and user-supplied format characters are
|
|
directly fed to the syslog function, which results in a
|
|
format string vulnerability.</p>
|
|
<p>Under some circumstances, an SMTP server may be able to
|
|
abuse this vulnerability in order to alter the nbsmtp
|
|
process and execute malicious code.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://people.freebsd.org/~niels/issues/nbsmtp-20050726.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-07-25</discovery>
|
|
<entry>2005-08-01</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="b1e8c810-01d0-11da-bc08-0001020eed82">
|
|
<topic>sylpheed -- MIME-encoded file name buffer overflow vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>sylpheed</name>
|
|
<name>sylpheed-gtk2</name>
|
|
<name>sylpheed-claws</name>
|
|
<range><lt>1.0.4</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Sylpheed is vulnerable to a buffer overflow when displaying
|
|
emails with attachments that have MIME-encoded file names.
|
|
This could be used by a remote attacker to crash sylpheed
|
|
potentially allowing execution of arbitrary code with the
|
|
permissions of the user running sylpheed.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>12934</bid>
|
|
<cvename>CVE-2005-0926</cvename>
|
|
<url>http://sylpheed.good-day.net/changelog.html.en</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-03-29</discovery>
|
|
<entry>2005-07-31</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="58247a96-01c8-11da-bc08-0001020eed82">
|
|
<topic>phpmyadmin -- cross site scripting vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>phpmyadmin</name>
|
|
<name>phpMyAdmin</name>
|
|
<range><lt>2.6.2.r1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A phpMyAdmin security announcement reports:</p>
|
|
<blockquote cite="http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-3">
|
|
<p>The convcharset parameter was not correctly validated,
|
|
opening the door to a XSS attack.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>12982</bid>
|
|
<cvename>CVE-2005-0992</cvename>
|
|
<mlist msgid="4f9e4516050404101223fbdeed@mail.gmail.com">http://marc.theaimsgroup.com/?l=bugtraq&m=111264361622660</mlist>
|
|
<url>http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-3</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-04-03</discovery>
|
|
<entry>2005-07-31</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="8375a73f-01bf-11da-bc08-0001020eed82">
|
|
<topic>gnupg -- OpenPGP symmetric encryption vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>gnupg</name>
|
|
<range><lt>1.4.1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>p5-Crypt-OpenPGP</name>
|
|
<range><le>1.03</le></range>
|
|
</package>
|
|
<package>
|
|
<name>pgp</name>
|
|
<range><ge>3.0</ge></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Serge Mister and Robert Zuccherato reports that the OpenPGP
|
|
protocol is vulnerable to a cryptographic attack when using
|
|
symmetric encryption in an automated way.</p>
|
|
<p>David Shaw reports about the impact:</p>
|
|
<blockquote cite="http://lists.gnupg.org/pipermail/gnupg-announce/2005q1/000191.html">
|
|
<p>This attack, while very significant from a cryptographic
|
|
point of view, is not generally effective in the real
|
|
world. To be specific, unless you have your OpenPGP
|
|
program set up as part of an automated system to accept
|
|
encrypted messages, decrypt them, and then provide a
|
|
response to the submitter, then this does not affect you
|
|
at all.</p>
|
|
</blockquote>
|
|
<p>Note that the <q>fix</q> in GnuPG does note completely
|
|
eliminate the potential problem:</p>
|
|
<blockquote cite="http://lists.gnupg.org/pipermail/gnupg-announce/2005q1/000191.html">
|
|
<p>These patches disable a portion of the OpenPGP protocol
|
|
that the attack is exploiting. This change should not be
|
|
user visible. With the patch in place, this attack will
|
|
not work using a public-key encrypted message. It will
|
|
still work using a passphrase-encrypted message.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<certvu>303094</certvu>
|
|
<cvename>CVE-2005-0366</cvename>
|
|
<url>http://eprint.iacr.org/2005/033</url>
|
|
<url>http://lists.gnupg.org/pipermail/gnupg-announce/2005q1/000191.html</url>
|
|
<url>http://www.pgp.com/newsroom/ctocorner/openpgp.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-02-08</discovery>
|
|
<entry>2005-07-31</entry>
|
|
<modified>2007-04-23</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="81f127a8-0038-11da-86bc-000e0c2e438a">
|
|
<topic>vim -- vulnerabilities in modeline handling: glob, expand</topic>
|
|
<affects>
|
|
<package>
|
|
<name>vim</name>
|
|
<name>vim-lite</name>
|
|
<name>vim+ruby</name>
|
|
<range><ge>6.3</ge><lt>6.3.82</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Georgi Guninski discovered a way to construct Vim modelines
|
|
that execute arbitrary shell commands. The vulnerability
|
|
can be exploited by including shell commands in modelines
|
|
that call the glob() or expand() functions. An attacker
|
|
could trick an user to read or edit a trojaned file with
|
|
modelines enabled, after which the attacker is able to
|
|
execute arbitrary commands with the privileges of the user.</p>
|
|
<p><strong>Note:</strong> It is generally recommended that VIM
|
|
users use <code>set nomodeline</code> in
|
|
<code>~/.vimrc</code> to avoid the possibility of trojaned
|
|
text files.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>14374</bid>
|
|
<cvename>CVE-2005-2368</cvename>
|
|
<url>http://www.guninski.com/where_do_you_want_billg_to_go_today_5.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-07-25</discovery>
|
|
<entry>2005-07-31</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="68222076-010b-11da-bc08-0001020eed82">
|
|
<topic>tiff -- buffer overflow vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>tiff</name>
|
|
<range><lt>3.7.3</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-tiff</name>
|
|
<range><lt>3.6.1_3</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>pdflib</name>
|
|
<name>pdflib-perl</name>
|
|
<range><lt>6.0.1_2</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>gdal</name>
|
|
<range><lt>1.2.1_2</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>ivtools</name>
|
|
<range><lt>1.2.3</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>paraview</name>
|
|
<range><lt>2.4.3</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>fractorama</name>
|
|
<range><lt>1.6.7_1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>iv</name>
|
|
<name>ja-iv</name>
|
|
<name>ja-libimg</name>
|
|
<range><gt>0</gt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A Gentoo Linux Security Advisory reports:</p>
|
|
<blockquote cite="http://www.gentoo.org/security/en/glsa/glsa-200505-07.xml">
|
|
<p>Tavis Ormandy of the Gentoo Linux Security Audit Team
|
|
discovered a stack based buffer overflow in the libTIFF
|
|
library when reading a TIFF image with a malformed
|
|
BitsPerSample tag.</p>
|
|
<p>Successful exploitation would require the victim to open
|
|
a specially crafted TIFF image, resulting in the execution
|
|
of arbitrary code.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-1544</cvename>
|
|
<url>http://bugzilla.remotesensing.org/show_bug.cgi?id=843</url>
|
|
<url>http://www.gentoo.org/security/en/glsa/glsa-200505-07.xml</url>
|
|
<url>http://www.remotesensing.org/libtiff/v3.7.3.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-05-10</discovery>
|
|
<entry>2005-07-30</entry>
|
|
<modified>2006-06-08</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="934b1de4-00d7-11da-bc08-0001020eed82">
|
|
<topic>opera -- image dragging vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>linux-opera</name>
|
|
<name>opera-devel</name>
|
|
<name>opera</name>
|
|
<range><lt>8.02</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A Secunia Advisory reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/15756/">
|
|
<p>Secunia Research has discovered a vulnerability in Opera,
|
|
which can be exploited by malicious people to conduct
|
|
cross-site scripting attacks and retrieve a user's
|
|
files.</p>
|
|
<p>The vulnerability is caused due to Opera allowing a user
|
|
to drag e.g. an image, which is actually a "javascript:"
|
|
URI, resulting in cross-site scripting if dropped over
|
|
another site. This may also be used to populate a file
|
|
upload form, resulting in uploading of arbitrary files to
|
|
a malicious web site.</p>
|
|
<p>Successful exploitation requires that the user is tricked
|
|
into dragging and dropping e.g. an image or a link.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://secunia.com/advisories/15756/</url>
|
|
<url>http://www.opera.com/freebsd/changelogs/802/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-07-28</discovery>
|
|
<entry>2005-07-30</entry>
|
|
<modified>2006-06-08</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="a2aa24fd-00d4-11da-bc08-0001020eed82">
|
|
<topic>opera -- download dialog spoofing vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>linux-opera</name>
|
|
<name>opera-devel</name>
|
|
<name>opera</name>
|
|
<range><lt>8.02</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A Secunia Advisory reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/15870/">
|
|
<p>Secunia Research has discovered a vulnerability in Opera,
|
|
which can be exploited by malicious people to trick users
|
|
into executing malicious files.</p>
|
|
<p>The vulnerability is caused due to an error in the
|
|
handling of extended ASCII codes in the download
|
|
dialog. This can be exploited to spoof the file extension
|
|
in the file download dialog via a specially crafted
|
|
"Content-Disposition" HTTP header.</p>
|
|
<p>Successful exploitation may result in users being tricked
|
|
into executing a malicious file via the download dialog,
|
|
but requires that the "Arial Unicode MS" font
|
|
(ARIALUNI.TTF) has been installed on the system.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://secunia.com/advisories/15870/</url>
|
|
<url>http://www.opera.com/freebsd/changelogs/802/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-07-28</discovery>
|
|
<entry>2005-07-30</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="5d51d245-00ca-11da-bc08-0001020eed82">
|
|
<topic>ethereal -- multiple protocol dissectors vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>ethereal</name>
|
|
<name>ethereal-lite</name>
|
|
<name>tethereal</name>
|
|
<name>tethereal-lite</name>
|
|
<range><ge>0.8.5</ge><lt>0.10.12</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>An Ethreal Security Advisories reports:</p>
|
|
<blockquote cite="http://www.ethereal.com/appnotes/enpa-sa-00020.html">
|
|
<p>Our testing program has turned up several more security
|
|
issues:</p>
|
|
<ul>
|
|
<li>The LDAP dissector could free static memory and crash.</li>
|
|
<li>The AgentX dissector could crash.</li>
|
|
<li>The 802.3 dissector could go into an infinite loop.</li>
|
|
<li>The PER dissector could abort.</li>
|
|
<li>The DHCP dissector could go into an infinite loop.</li>
|
|
<li>The BER dissector could abort or loop infinitely.</li>
|
|
<li>The MEGACO dissector could go into an infinite loop.</li>
|
|
<li>The GIOP dissector could dereference a null pointer.</li>
|
|
<li>The SMB dissector was susceptible to a buffer overflow.</li>
|
|
<li>The WBXML could dereference a null pointer.</li>
|
|
<li>The H1 dissector could go into an infinite loop.</li>
|
|
<li>The DOCSIS dissector could cause a crash.</li>
|
|
<li>The SMPP dissector could go into an infinite loop.</li>
|
|
<li>SCTP graphs could crash.</li>
|
|
<li>The HTTP dissector could crash.</li>
|
|
<li>The SMB dissector could go into a large loop.</li>
|
|
<li>The DCERPC dissector could crash.</li>
|
|
<li>Several dissectors could crash while reassembling packets.</li>
|
|
</ul>
|
|
<p>Steve Grubb at Red Hat found the following issues:</p>
|
|
<ul>
|
|
<li>The CAMEL dissector could dereference a null pointer.</li>
|
|
<li>The DHCP dissector could crash.</li>
|
|
<li>The CAMEL dissector could crash.</li>
|
|
<li>The PER dissector could crash.</li>
|
|
<li>The RADIUS dissector could crash.</li>
|
|
<li>The Telnet dissector could crash.</li>
|
|
<li>The IS-IS LSP dissector could crash.</li>
|
|
<li>The NCP dissector could crash.</li>
|
|
</ul>
|
|
<p>iDEFENSE found the following issues:</p>
|
|
<ul>
|
|
<li>Several dissectors were susceptible to a format string
|
|
overflow.</li>
|
|
</ul>
|
|
<h1>Impact:</h1>
|
|
<p>It may be possible to make Ethereal crash, use up
|
|
available memory, or run arbitrary code by injecting a
|
|
purposefully malformed packet onto the wire or by
|
|
convincing someone to read a malformed packet trace
|
|
file.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://www.ethereal.com/appnotes/enpa-sa-00020.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-07-26</discovery>
|
|
<entry>2005-07-30</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="651996e0-fe07-11d9-8329-000e0c2e438a">
|
|
<topic>apache -- http request smuggling</topic>
|
|
<affects>
|
|
<package>
|
|
<name>apache</name>
|
|
<range><lt>1.3.33_2</lt></range>
|
|
<range><gt>2.*</gt><lt>2.0.54_1</lt></range>
|
|
<range><gt>2.1.0</gt><lt>2.1.6_1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>apache+ssl</name>
|
|
<range><lt>1.3.33.1.55_1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>apache+mod_perl</name>
|
|
<range><lt>1.3.33_3</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>apache+mod_ssl</name>
|
|
<name>apache+mod_ssl+ipv6</name>
|
|
<name>apache+mod_ssl+mod_accel</name>
|
|
<name>apache+mod_ssl+mod_accel+ipv6</name>
|
|
<name>apache+mod_ssl+mod_accel+mod_deflate</name>
|
|
<name>apache+mod_ssl+mod_accel+mod_deflate+ipv6</name>
|
|
<name>apache+mod_ssl+mod_deflate</name>
|
|
<name>apache+mod_ssl+mod_deflate+ipv6</name>
|
|
<name>apache+mod_ssl+mod_snmp</name>
|
|
<name>apache+mod_ssl+mod_snmp+mod_accel</name>
|
|
<name>apache+mod_ssl+mod_snmp+mod_accel+ipv6</name>
|
|
<name>apache+mod_ssl+mod_snmp+mod_deflate</name>
|
|
<name>apache+mod_ssl+mod_snmp+mod_deflate+ipv6</name>
|
|
<name>apache+mod_ssl+mod_snmp+mod_accel+mod_deflate+ipv6</name>
|
|
<range><lt>1.3.33+2.8.22_1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>apache_fp</name>
|
|
<range><gt>0</gt></range>
|
|
</package>
|
|
<package>
|
|
<name>apache+ipv6</name>
|
|
<range><lt>1.3.37</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>ru-apache</name>
|
|
<range><lt>1.3.34+30.22</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>ru-apache+mod_ssl</name>
|
|
<range><lt>1.3.34+30.22+2.8.25</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A Watchfire whitepaper reports an vulnerability in the
|
|
Apache webserver. The vulnerability can be exploited by
|
|
malicious people causing cross site scripting, web cache
|
|
poisoining, session hijacking and most importantly the
|
|
ability to bypass web application firewall protection.
|
|
Exploiting this vulnerability requires multiple carefully
|
|
crafted HTTP requests, taking advantage of an caching server,
|
|
proxy server, web application firewall etc. This only affects
|
|
installations where Apache is used as HTTP proxy in
|
|
combination with the following web servers:</p>
|
|
<ul>
|
|
<li>IIS/6.0 and 5.0</li>
|
|
<li>Apache 2.0.45 (as web server)</li>
|
|
<li>apache 1.3.29</li>
|
|
<li>WebSphere 5.1 and 5.0</li>
|
|
<li>WebLogic 8.1 SP1</li>
|
|
<li>Oracle9iAS web server 9.0.2</li>
|
|
<li>SunONE web server 6.1 SP4</li>
|
|
</ul>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>14106</bid>
|
|
<cvename>CVE-2005-2088</cvename>
|
|
<url>http://www.watchfire.com/resources/HTTP-Request-Smuggling.pdf</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-07-25</discovery>
|
|
<entry>2005-07-26</entry>
|
|
<modified>2009-01-23</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="1db7ecf5-fd24-11d9-b4d6-0007e900f87b">
|
|
<topic>clamav -- multiple remote buffer overflows</topic>
|
|
<affects>
|
|
<package>
|
|
<name>clamav</name>
|
|
<range><lt>0.86.2</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>clamav-devel</name>
|
|
<range><le>20050704</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>An Secunia Advisory reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/16180/">
|
|
<p>Neel Mehta and Alex Wheeler have reported some
|
|
vulnerabilities in Clam AntiVirus, which can be exploited
|
|
by malicious people to cause a DoS (Denial of Service)
|
|
or compromise a vulnerable system.</p>
|
|
<ol>
|
|
<li>Two integer overflow errors in "libclamav/tnef.c"
|
|
when processing TNEF files can be exploited to cause
|
|
a heap-based buffer overflow via a specially crafted
|
|
TNEF file with a length value of -1 in the header.</li>
|
|
<li>An integer overflow error in "libclamav/chmunpack.c"
|
|
can be exploited to cause a heap-based buffer overflow
|
|
via a specially crafted CHM file with a chunk entry that
|
|
has a filename length of -1.</li>
|
|
<li>A boundary error in "libclamav/fsg.c" when
|
|
processing a FSG compressed file can cause a heap-based
|
|
buffer overflow.</li>
|
|
</ol>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://www.rem0te.com/public/images/clamav.pdf</url>
|
|
<url>http://secunia.com/advisories/16180/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-07-24</discovery>
|
|
<entry>2005-07-25</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="ccd325d2-fa08-11d9-bc08-0001020eed82">
|
|
<topic>isc-dhcpd -- format string vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>isc-dhcp3-client</name>
|
|
<name>isc-dhcp3-devel</name>
|
|
<name>isc-dhcp3-relay</name>
|
|
<name>isc-dhcp3-server</name>
|
|
<name>isc-dhcp3</name>
|
|
<name>isc-dhcp</name>
|
|
<name>isc-dhcpd</name>
|
|
<range><lt>3.0.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The ISC DHCP programs are vulnerable to several format
|
|
string vulnerabilities which may allow a remote attacker to
|
|
execute arbitrary code with the permissions of the DHCP
|
|
programs, typically root for the DHCP server.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>11591</bid>
|
|
<certvu>448384</certvu>
|
|
<cvename>CVE-2004-1006</cvename>
|
|
<mlist msgid="20041109003345.GG763@isc.org">http://marc.theaimsgroup.com/?l=dhcp-announce&m=109996073218290</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-11-08</discovery>
|
|
<entry>2005-07-23</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="b4892b5b-fb1c-11d9-96ba-00909925db3e">
|
|
<topic>egroupware -- multiple cross-site scripting (XSS) and SQL injection vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>egroupware</name>
|
|
<range><lt>1.0.0.007</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Multiple cross-site scripting (XSS) vulnerabilities in eGroupware
|
|
before 1.0.0.007 allow remote attackers to inject arbitrary web
|
|
script or HTML via the (1) ab_id, (2) page, (3) type,
|
|
or (4) lang parameter to index.php or (5) category_id parameter.
|
|
</p>
|
|
<p>Multiple SQL injection vulnerabilities in index.php in eGroupware
|
|
before 1.0.0.007 allow remote attackers to execute arbitrary SQL
|
|
commands via the (1) filter or (2) cats_app parameter.
|
|
</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-1202</cvename>
|
|
<cvename>CVE-2005-1203</cvename>
|
|
<url>http://sourceforge.net/project/shownotes.php?release_id=320768</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-04-20</discovery>
|
|
<entry>2005-07-23</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="3f4ac724-fa8b-11d9-afcf-0060084a00e5">
|
|
<topic>fetchmail -- denial of service/crash from malicious POP3 server</topic>
|
|
<affects>
|
|
<package>
|
|
<name>fetchmail</name>
|
|
<range><eq>6.2.5.1</eq></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>In fetchmail 6.2.5.1, the remote code injection via
|
|
POP3 UIDL was fixed, but a denial of service attack was
|
|
introduced:</p>
|
|
<p>Two possible NULL-pointer dereferences allow a malicous
|
|
POP3 server to crash fetchmail by respondig with UID lines
|
|
containing only the article number but no UID (in violation
|
|
of RFC-1939), or a message without Message-ID when no UIDL
|
|
support is available.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<mlist msgid="20050721172317.GB3071@amilo.ms.mff.cuni.cz">http://lists.berlios.de/pipermail/fetchmail-devel/2005-July/000397.html</mlist>
|
|
<url>http://www.fetchmail.info/fetchmail-SA-2005-01.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-07-21</discovery>
|
|
<entry>2005-07-22</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="e72fd82b-fa01-11d9-bc08-0001020eed82">
|
|
<topic>dnrd -- remote buffer and stack overflow vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>dnrd</name>
|
|
<range><lt>2.19.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Natanael Copa reports that dnrd is vulnerable to a remote
|
|
buffer overflow and a remote stack overflow. These
|
|
vulnerabilities can be triggered by sending invalid DNS
|
|
packets to dnrd.</p>
|
|
<p>The buffer overflow could potentially be used to execute
|
|
arbitrary code with the permissions of the dnrd daemon.
|
|
Note that dnrd runs in an chroot environment and runs as
|
|
non-root.</p>
|
|
<p>The stack overflow vulnerability can cause dnrd to
|
|
crash.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-2315</cvename>
|
|
<cvename>CVE-2005-2316</cvename>
|
|
<freebsdpr>ports/83851</freebsdpr>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-07-21</discovery>
|
|
<entry>2005-07-21</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="43a7b0a7-f9bc-11d9-b473-00061bc2ad93">
|
|
<topic>PowerDNS -- LDAP backend fails to escape all queries</topic>
|
|
<affects>
|
|
<package>
|
|
<name>powerdns</name>
|
|
<range><lt>2.9.18</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The LDAP backend in PowerDNS has issues with escaping
|
|
queries which could cause connection errors. This would
|
|
make it possible for a malicious user to temporarily blank
|
|
domains.</p>
|
|
<blockquote cite="http://doc.powerdns.com/security-policy.html">
|
|
<p>This is known to affect all releases prior to 2.9.18.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-2302</cvename>
|
|
<url>http://doc.powerdns.com/security-policy.html</url>
|
|
<url>http://marc.theaimsgroup.com/?l=bugtraq&m=112155941310297&w=2</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-07-16</discovery>
|
|
<entry>2005-07-21</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="3497d7be-2fef-45f4-8162-9063751b573a">
|
|
<topic>fetchmail -- remote root/code injection from malicious POP3 server</topic>
|
|
<affects>
|
|
<package>
|
|
<name>fetchmail</name>
|
|
<range><lt>6.2.5.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>fetchmail's POP3/UIDL code does not truncate received UIDs properly.
|
|
A malicious or compromised POP3 server can thus corrupt fetchmail's
|
|
stack and inject code when fetchmail is using UIDL, either through
|
|
configuration, or as a result of certain server capabilities. Note
|
|
that fetchmail is run as root on some sites, so an attack might
|
|
compromise the root account and thus the whole machine.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-2335</cvename>
|
|
<freebsdpr>ports/83805</freebsdpr>
|
|
<url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=212762</url>
|
|
<url>http://www.fetchmail.info/fetchmail-SA-2005-01.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-07-20</discovery>
|
|
<entry>2005-07-20</entry>
|
|
<modified>2005-07-21</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="2e116ba5-f7c3-11d9-928e-000b5d7e6dd5">
|
|
<topic>kdebase -- Kate backup file permission leak</topic>
|
|
<affects>
|
|
<package>
|
|
<name>kdebase</name>
|
|
<range><ge>3.2.0</ge><lt>3.4.1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux_base-suse</name>
|
|
<range><ge>9.3</ge><lt>9.3_2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A KDE Security Advisory explains:</p>
|
|
<blockquote cite="http://www.kde.org/info/security/advisory-20050718-1.txt">
|
|
<p>Kate / Kwrite create a file backup before saving a modified
|
|
file. These backup files are created with default permissions,
|
|
even if the original file had more strict permissions set.</p>
|
|
<p>Depending on the system security settings, backup files
|
|
might be readable by other users. Kate / Kwrite are
|
|
network transparent applications and therefore this
|
|
vulnerability might not be restricted to local users.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-1920</cvename>
|
|
<url>https://bugs.kde.org/show_bug.cgi?id=103331</url>
|
|
<url>http://www.kde.org/info/security/advisory-20050718-1.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-07-18</discovery>
|
|
<entry>2005-07-18</entry>
|
|
<modified>2005-10-09</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="5d72701a-f601-11d9-bcd1-02061b08fc24">
|
|
<topic>firefox & mozilla -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>firefox</name>
|
|
<range><lt>1.0.5,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-firefox</name>
|
|
<range><lt>1.0.5</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>mozilla</name>
|
|
<range><lt>1.7.9,2</lt></range>
|
|
<range><ge>1.8.*,2</ge></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-mozilla</name>
|
|
<name>linux-mozilla-devel</name>
|
|
<range><lt>1.7.9</lt></range>
|
|
<range><ge>1.8.*</ge></range>
|
|
</package>
|
|
<package>
|
|
<name>netscape7</name>
|
|
<range><ge>0</ge></range>
|
|
</package>
|
|
<package>
|
|
<!-- These ports are obsolete. -->
|
|
<name>de-linux-mozillafirebird</name>
|
|
<name>el-linux-mozillafirebird</name>
|
|
<name>ja-linux-mozillafirebird-gtk1</name>
|
|
<name>ja-mozillafirebird-gtk2</name>
|
|
<name>linux-mozillafirebird</name>
|
|
<name>ru-linux-mozillafirebird</name>
|
|
<name>zhCN-linux-mozillafirebird</name>
|
|
<name>zhTW-linux-mozillafirebird</name>
|
|
<range><ge>0</ge></range>
|
|
</package>
|
|
<package>
|
|
<!-- These package names are obsolete. -->
|
|
<name>de-linux-netscape</name>
|
|
<name>de-netscape7</name>
|
|
<name>fr-linux-netscape</name>
|
|
<name>fr-netscape7</name>
|
|
<name>ja-linux-netscape</name>
|
|
<name>ja-netscape7</name>
|
|
<name>linux-netscape</name>
|
|
<name>linux-phoenix</name>
|
|
<name>mozilla+ipv6</name>
|
|
<name>mozilla-embedded</name>
|
|
<name>mozilla-firebird</name>
|
|
<name>mozilla-gtk1</name>
|
|
<name>mozilla-gtk2</name>
|
|
<name>mozilla-gtk</name>
|
|
<name>mozilla-thunderbird</name>
|
|
<name>phoenix</name>
|
|
<name>pt_BR-netscape7</name>
|
|
<range><ge>0</ge></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Mozilla Foundation reports of multiple security
|
|
vulnerabilities in Firefox and Mozilla:</p>
|
|
<blockquote cite="http://www.mozilla.org/projects/security/known-vulnerabilities.html">
|
|
<ul>
|
|
<li><em>MFSA 2005-56</em> Code execution through shared function
|
|
objects</li>
|
|
<li><em>MFSA 2005-55</em> XHTML node spoofing</li>
|
|
<li><em>MFSA 2005-54</em> Javascript prompt origin spoofing</li>
|
|
<li><em>MFSA 2005-53</em> Standalone applications can run arbitrary
|
|
code through the browser</li>
|
|
<li><em>MFSA 2005-52</em> Same origin violation: frame calling
|
|
top.focus()</li>
|
|
<li><em>MFSA 2005-51</em> The return of frame-injection
|
|
spoofing</li>
|
|
<li><em>MFSA 2005-50</em> Possibly exploitable crash in
|
|
InstallVersion.compareTo()</li>
|
|
<li><em>MFSA 2005-49</em> Script injection from Firefox sidebar
|
|
panel using data:</li>
|
|
<li><em>MFSA 2005-48</em> Same-origin violation with InstallTrigger
|
|
callback</li>
|
|
<li><em>MFSA 2005-47</em> Code execution via "Set as
|
|
Wallpaper"</li>
|
|
<li><em>MFSA 2005-46</em> XBL scripts ran even when Javascript
|
|
disabled</li>
|
|
<li><em>MFSA 2005-45</em> Content-generated event
|
|
vulnerabilities</li>
|
|
</ul>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-1937</cvename>
|
|
<cvename>CVE-2005-2260</cvename>
|
|
<cvename>CVE-2005-2261</cvename>
|
|
<cvename>CVE-2005-2262</cvename>
|
|
<cvename>CVE-2005-2263</cvename>
|
|
<cvename>CVE-2005-2264</cvename>
|
|
<cvename>CVE-2005-2265</cvename>
|
|
<cvename>CVE-2005-2266</cvename>
|
|
<cvename>CVE-2005-2267</cvename>
|
|
<cvename>CVE-2005-2268</cvename>
|
|
<cvename>CVE-2005-2269</cvename>
|
|
<cvename>CVE-2005-2270</cvename>
|
|
<url>http://www.mozilla.org/projects/security/known-vulnerabilities.html</url>
|
|
<url>http://www.mozilla.org/security/announce/mfsa2005-45.html</url>
|
|
<url>http://www.mozilla.org/security/announce/mfsa2005-46.html</url>
|
|
<url>http://www.mozilla.org/security/announce/mfsa2005-47.html</url>
|
|
<url>http://www.mozilla.org/security/announce/mfsa2005-48.html</url>
|
|
<url>http://www.mozilla.org/security/announce/mfsa2005-49.html</url>
|
|
<url>http://www.mozilla.org/security/announce/mfsa2005-50.html</url>
|
|
<url>http://www.mozilla.org/security/announce/mfsa2005-51.html</url>
|
|
<url>http://www.mozilla.org/security/announce/mfsa2005-52.html</url>
|
|
<url>http://www.mozilla.org/security/announce/mfsa2005-53.html</url>
|
|
<url>http://www.mozilla.org/security/announce/mfsa2005-54.html</url>
|
|
<url>http://www.mozilla.org/security/announce/mfsa2005-55.html</url>
|
|
<url>http://www.mozilla.org/security/announce/mfsa2005-56.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-07-12</discovery>
|
|
<entry>2005-07-16</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="f241641e-f5ea-11d9-a6db-000d608ed240">
|
|
<topic>drupal -- PHP code execution vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>drupal</name>
|
|
<range><lt>4.6.2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Kuba Zygmunt discovered a flaw in the input validation routines
|
|
of Drupal's filter mechanism. An attacker could execute
|
|
arbitrary PHP code on a target site when public comments or
|
|
postings are allowed.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-1921</cvename>
|
|
<cvename>CVE-2005-2106</cvename>
|
|
<url>http://drupal.org/files/sa-2005-002/advisory.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-06-29</discovery>
|
|
<entry>2005-07-16</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="50457509-d05e-11d9-9aed-000e0c2e438a">
|
|
<topic>phpSysInfo -- cross site scripting vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>phpSysInfo</name>
|
|
<range><lt>2.5.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A Securityreason.com advisory reports that various cross
|
|
site scripting vulnerabilities have been found in phpSysInfo.
|
|
Input is not properly sanitised before it is returned to the
|
|
user. A malicious person could exploit this to execute
|
|
arbitrary HTML and script code in a users browser session.
|
|
Also it is possible to view the full path of certain scripts
|
|
by accessing them directly.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>12887</bid>
|
|
<cvename>CVE-2005-0869</cvename>
|
|
<cvename>CVE-2005-0870</cvename>
|
|
<mlist msgid="20050323180207.11987.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&m=111161017209422</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-03-22</discovery>
|
|
<entry>2005-07-09</entry>
|
|
<modified>2005-12-25</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="eeae6cce-d05c-11d9-9aed-000e0c2e438a">
|
|
<topic>mysql-server -- insecure temporary file creation</topic>
|
|
<affects>
|
|
<package>
|
|
<name>mysql-server</name>
|
|
<range><gt>4.1</gt><lt>4.1.12</lt></range>
|
|
<range><gt>5.0</gt><lt>5.0.6</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A Zataz advisory reports that MySQL contains a security
|
|
flaw which could allow a malicious local user to inject
|
|
arbitrary SQL commands during the initial database creation
|
|
process.</p>
|
|
<p>The problem lies in the mysql_install_db script which
|
|
creates temporary files based on the PID used by the
|
|
script.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>13660</bid>
|
|
<cvename>CVE-2005-1636</cvename>
|
|
<url>http://www.zataz.net/adviso/mysql-05172005.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-05-07</discovery>
|
|
<entry>2005-07-09</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="3e0072d4-d05b-11d9-9aed-000e0c2e438a">
|
|
<topic>net-snmp -- fixproc insecure temporary file creation</topic>
|
|
<affects>
|
|
<package>
|
|
<name>net-snmp</name>
|
|
<range><lt>5.2.1.2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A Gentoo advisory reports:</p>
|
|
<blockquote cite="http://www.gentoo.org/security/en/glsa/glsa-200505-18.xml">
|
|
<p>Net-SNMP creates temporary files in an insecure manner,
|
|
possibly allowing the execution of arbitrary code.</p>
|
|
<p>A malicious local attacker could exploit a race condition
|
|
to change the content of the temporary files before they
|
|
are executed by fixproc, possibly leading to the execution
|
|
of arbitrary code. A local attacker could also create
|
|
symbolic links in the temporary files directory, pointing
|
|
to a valid file somewhere on the filesystem. When fixproc
|
|
is executed, this would result in the file being
|
|
overwritten.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>13715</bid>
|
|
<cvename>CVE-2005-1740</cvename>
|
|
<url>http://security.gentoo.org/glsa/glsa-200505-18.xml</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-05-23</discovery>
|
|
<entry>2005-07-09</entry>
|
|
<modified>2005-07-13</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="326c517a-d029-11d9-9aed-000e0c2e438a">
|
|
<topic>phpbb -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>phpbb</name>
|
|
<range><lt>2.0.12</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>phpBB is vulnerable to remote exploitation of an input
|
|
validation vulnerability allows attackers to read the
|
|
contents of arbitrary system files under the privileges
|
|
of the webserver. This also allows remote attackers to
|
|
unlink arbitrary system files under the privileges of the
|
|
webserver.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>12618</bid>
|
|
<bid>12621</bid>
|
|
<bid>12623</bid>
|
|
<cvename>CVE-2005-0258</cvename>
|
|
<cvename>CVE-2005-0259</cvename>
|
|
<url>http://security.gentoo.org/glsa/glsa-200503-02.xml</url>
|
|
<url>http://www.idefense.com/application/poi/display?id=205&type=vulnerabilities</url>
|
|
<url>http://www.idefense.com/application/poi/display?id=204&type=vulnerabilities</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-02-22</discovery>
|
|
<entry>2005-07-09</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="6596bb80-d026-11d9-9aed-000e0c2e438a">
|
|
<topic>shtool -- insecure temporary file creation</topic>
|
|
<affects>
|
|
<package>
|
|
<name>shtool</name>
|
|
<range><le>2.0.1</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A Zataz advisory reports that shtool contains a security
|
|
flaw which could allow a malicious local user to create or
|
|
overwrite the contents of arbitrary files. The attacker
|
|
could fool a user into executing the arbitrary file possibly
|
|
executing arbitrary code.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>13767</bid>
|
|
<url>http://www.zataz.net/adviso/shtool-05252005.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-05-25</discovery>
|
|
<entry>2005-07-09</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="88188a8c-eff6-11d9-8310-0001020eed82">
|
|
<topic>phppgadmin -- "formLanguage" local file inclusion vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>phppgadmin</name>
|
|
<range><lt>3.5.4</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A Secunia Advisory reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/15941/">
|
|
<p>A vulnerability has been reported in phpPgAdmin, which
|
|
can be exploited by malicious people to disclose sensitive
|
|
information.</p>
|
|
<p>Input passed to the "formLanguage" parameter in
|
|
"index.php" isn't properly verified, before it is used to
|
|
include files. This can be exploited to include arbitrary
|
|
files from local resources.</p>
|
|
<p>Successful exploitation requires that "magic_quotes_gpc"
|
|
is disabled.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>14142</bid>
|
|
<cvename>CVE-2005-2256</cvename>
|
|
<url>http://secunia.com/advisories/15941/</url>
|
|
<url>http://sourceforge.net/project/shownotes.php?release_id=342261</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-07-05</discovery>
|
|
<entry>2005-07-08</entry>
|
|
<modified>2005-07-21</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="b64481d9-eff4-11d9-8310-0001020eed82">
|
|
<topic>pear-XML_RPC -- information disclosure vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>pear-XML_RPC</name>
|
|
<range><lt>1.3.2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The pear-XML_RPC release notes reports that the following
|
|
issues has been fixed:</p>
|
|
<blockquote cite="http://pear.php.net/package/XML_RPC/download/1.3.2">
|
|
<p>Eliminate path disclosure vulnerabilities by suppressing
|
|
error messages when eval()'ing.</p>
|
|
<p>Eliminate path disclosure vulnerability by catching bogus
|
|
parameters submitted to
|
|
<code>XML_RPC_Value::serializeval()</code>.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://pear.php.net/package/XML_RPC/download/1.3.2</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-07-07</discovery>
|
|
<entry>2005-07-08</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="9a035a56-eff0-11d9-8310-0001020eed82">
|
|
<topic>ekg -- insecure temporary file creation</topic>
|
|
<affects>
|
|
<package>
|
|
<name>pl-ekg</name>
|
|
<range><lt>1.6r2,1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Eric Romang reports that ekg creates temporary files in an
|
|
insecure manner. This can be exploited by an attacker using
|
|
a symlink attack to overwrite arbitrary files and possibly
|
|
execute arbitrary commands with the permissions of the user
|
|
running ekg.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>14146</bid>
|
|
<cvename>CVE-2005-1916</cvename>
|
|
<mlist msgid="42CA2DDB.5030606@zataz.net">http://marc.theaimsgroup.com/?l=bugtraq&m=112060146011122</mlist>
|
|
<url>http://bugs.gentoo.org/show_bug.cgi?id=94172</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-07-05</discovery>
|
|
<entry>2005-07-08</entry>
|
|
<modified>2005-07-31</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="6e33f4ab-efed-11d9-8310-0001020eed82">
|
|
<topic>bugzilla -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>bugzilla</name>
|
|
<name>ja-bugzilla</name>
|
|
<range><ge>2.17.1</ge><lt>2.18.2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A Bugzilla Security Advisory reports:</p>
|
|
<blockquote cite="http://www.bugzilla.org/security/2.18.1/">
|
|
<p>Any user can change any flag on any bug, even if they
|
|
don't have access to that bug, or even if they can't
|
|
normally make bug changes. This also allows them to expose
|
|
the summary of a bug.</p>
|
|
<p>Bugs are inserted into the database before they are
|
|
marked as private, in Bugzilla code. Thus, MySQL
|
|
replication can lag in between the time that the bug is
|
|
inserted and when it is marked as private (usually less
|
|
than a second). If replication lags at this point, the bug
|
|
summary will be accessible to all users until replication
|
|
catches up. Also, on a very slow machine, there may be a
|
|
pause longer than a second that allows users to see the
|
|
title of the newly-filed bug.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-2173</cvename>
|
|
<cvename>CVE-2005-2174</cvename>
|
|
<url>http://www.bugzilla.org/security/2.18.1/</url>
|
|
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=292544</url>
|
|
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=293159</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-07-07</discovery>
|
|
<entry>2005-07-08</entry>
|
|
<modified>2005-07-18</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="d177d9f9-e317-11d9-8088-00123f0f7307">
|
|
<topic>nwclient -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>nwclient</name>
|
|
<range><gt>0</gt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Insecure file permissions, network access control and DNS
|
|
usage put systems that use Legato NetWorker at risk.</p>
|
|
<p>When the software is running, several files that contain
|
|
sensitive information are created with insecure permissions.
|
|
The information exposed include passwords and can therefore
|
|
be used for privilege elevation.</p>
|
|
<p>An empty "servers" file, which should normally
|
|
contain hostnames of authorized backup servers, may allow
|
|
unauthorized backups to be made. Sensitive information can
|
|
be extracted from these backups.</p>
|
|
<p>When reverse DNS fails for the Legato client IP a weak
|
|
authorization scheme, containing a flaw that allows
|
|
unauthorized access, is used. This may allow unauthorized
|
|
access.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>3564</bid>
|
|
<bid>3840</bid>
|
|
<bid>3842</bid>
|
|
<cvename>CVE-2001-0910</cvename>
|
|
<cvename>CVE-2002-0113</cvename>
|
|
<cvename>CVE-2002-0114</cvename>
|
|
<url>http://portal1.legato.com/resources/bulletins/372.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2002-01-10</discovery>
|
|
<entry>2005-07-08</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="107692a1-ee6c-11d9-8310-0001020eed82">
|
|
<topic>acroread -- insecure temporary file creation</topic>
|
|
<affects>
|
|
<package>
|
|
<name>acroread4</name>
|
|
<name>acroread5</name>
|
|
<range><ge>0</ge></range>
|
|
</package>
|
|
<package>
|
|
<name>acroread</name>
|
|
<range><lt>7.0.0</lt></range>
|
|
<range><gt>5.*,1</gt><lt>7.0.0,1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia Research reports:</p>
|
|
<blockquote cite="http://secunia.com/secunia_research/2005-6/advisory/">
|
|
<p>Secunia has discovered a security issue in Adobe Reader
|
|
for Linux, which can be exploited by malicious, local
|
|
users to gain knowledge of sensitive information.</p>
|
|
<p>The problem is caused due to temporary files being
|
|
created with permissions based on a user's umask in the
|
|
"/tmp" folder under certain circumstances when documents
|
|
are opened.</p>
|
|
<p>Successful exploitation allows an unprivileged user to
|
|
read arbitrary users' documents.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-1912</cvename>
|
|
<url>http://secunia.com/secunia_research/2005-6/advisory/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-06-29</discovery>
|
|
<entry>2005-07-06</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="d8e1aadd-ee68-11d9-8310-0001020eed82">
|
|
<topic>clamav -- cabinet file handling DoS vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>clamav</name>
|
|
<range><lt>0.86</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>clamav-devel</name>
|
|
<range><lt>20050620</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>An iDEFENSE Security Advisory reports:</p>
|
|
<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&m=112006456809016">
|
|
<p>Remote exploitation of an input validation error in Clam
|
|
AntiVirus ClamAV allows attackers to cause a denial of
|
|
service condition.</p>
|
|
<p>The vulnerability specifically exists due to insufficient
|
|
validation on cabinet file header data. The
|
|
<code>ENSURE_BITS()</code> macro fails to check for zero
|
|
length reads, allowing a carefully constructed cabinet
|
|
file to cause an infinite loop.</p>
|
|
<p>ClamAV is used in a number of mail gateway
|
|
products. Successful exploitation requires an attacker to
|
|
send a specially constructed CAB file through a mail
|
|
gateway or personal anti-virus client utilizing the ClamAV
|
|
scanning engine. The infinate loop will cause the ClamAV
|
|
software to use all available processor resources,
|
|
resulting in a denial of service or severe degradation to
|
|
system performance. Remote exploitation can be achieved by
|
|
sending a malicious file in an e-mail message or during an
|
|
HTTP session.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-1923</cvename>
|
|
<mlist msgid="FB24803D1DF2A34FA59FC157B77C97050462A3AB@IDSERV04.idef.com">http://marc.theaimsgroup.com/?l=bugtraq&m=112006456809016</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-06-29</discovery>
|
|
<entry>2005-07-06</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="6d18fe19-ee67-11d9-8310-0001020eed82">
|
|
<topic>clamav -- MS-Expand file handling DoS vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>clamav</name>
|
|
<range><lt>0.86</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>clamav-devel</name>
|
|
<range><lt>20050620</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>An iDEFENSE Security Advisory reports:</p>
|
|
<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&m=112006402411598">
|
|
<p>Remote exploitation of an input validation error in Clam
|
|
AntiVirus ClamAV allows attackers to cause a denial of
|
|
service condition.</p>
|
|
<p>The vulnerability specifically exists due to improper
|
|
behavior during exceptional conditions.</p>
|
|
<p>Successful exploitation allows attackers to exhaust file
|
|
descriptors pool and memory. Anti-virus detection
|
|
functionality will fail if there is no file descriptors
|
|
available with which to open files. Remote exploitation
|
|
can be achieved by sending a malicious file in an e-mail
|
|
message or during an HTTP session.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-1922</cvename>
|
|
<mlist msgid="FB24803D1DF2A34FA59FC157B77C97050462A3AC@IDSERV04.idef.com">http://marc.theaimsgroup.com/?l=bugtraq&m=112006402411598</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-06-29</discovery>
|
|
<entry>2005-07-06</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="8efe93e2-ee62-11d9-8310-0001020eed82">
|
|
<topic>zlib -- buffer overflow vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>zsync</name>
|
|
<range><lt>0.4.1</lt></range>
|
|
</package>
|
|
<system>
|
|
<name>FreeBSD</name>
|
|
<range><ge>5.4</ge><lt>5.4_4</lt></range>
|
|
<range><ge>5.3</ge><lt>5.3_18</lt></range>
|
|
</system>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<h1>Problem Description</h1>
|
|
<p>An error in the handling of corrupt compressed data streams
|
|
can result in a buffer being overflowed.</p>
|
|
<h1>Impact</h1>
|
|
<p>By carefully crafting a corrupt compressed data stream, an
|
|
attacker can overwrite data structures in a zlib-using
|
|
application. This may cause the application to halt,
|
|
causing a denial of service; or it may result in the
|
|
attacker gaining elevated privileges.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-2096</cvename>
|
|
<freebsdsa>SA-05:16.zlib</freebsdsa>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-07-06</discovery>
|
|
<entry>2005-07-06</entry>
|
|
<modified>2005-10-01</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="70c59485-ee5a-11d9-8310-0001020eed82">
|
|
<topic>acroread -- buffer overflow vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>acroread4</name>
|
|
<name>acroread5</name>
|
|
<range><ge>0</ge></range>
|
|
</package>
|
|
<package>
|
|
<name>acroread</name>
|
|
<range><lt>7.0.0</lt></range>
|
|
<range><gt>5.*,1</gt><lt>7.0.0,1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>An Adobe Security Advisory reports:</p>
|
|
<blockquote cite="http://www.adobe.com/support/techdocs/329083.html">
|
|
<p>A vulnerability within Adobe Reader has been
|
|
identified. Under certain circumstances, remote
|
|
exploitation of a buffer overflow in Adobe Reader could
|
|
allow an attacker to execute arbitrary code.</p>
|
|
<p>If exploited, it could allow the execution of arbitrary
|
|
code under the privileges of the local user. Remote
|
|
exploitation is possible if the malicious PDF document is
|
|
sent as an email attachment or if the PDF document is
|
|
accessed via a web link.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-1625</cvename>
|
|
<url>http://www.adobe.com/support/techdocs/329083.html</url>
|
|
<mlist msgid="FB24803D1DF2A34FA59FC157B77C97050462A5E2@IDSERV04.idef.com">http://marc.theaimsgroup.com/?l=bugtraq&m=112059685332569</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-07-05</discovery>
|
|
<entry>2005-07-06</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="b2a1a3b5-ed95-11d9-8310-0001020eed82">
|
|
<topic>net-snmp -- remote DoS vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>net-snmp</name>
|
|
<range><lt>5.2.1.2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A Net-SNMP release announcement reports:</p>
|
|
<blockquote cite="http://marc.theaimsgroup.com/?l=net-snmp-announce&m=112059518426328">
|
|
<p>A security vulnerability has been found in Net-SNMP
|
|
releases that could allow a denial of service attack
|
|
against Net-SNMP agent's which have opened a stream based
|
|
protocol (EG, TCP but not UDP; it should be noted that
|
|
Net-SNMP does not by default open a TCP port).</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>14168</bid>
|
|
<cvename>CVE-2005-2177</cvename>
|
|
<mlist msgid="sdzmt5sul0.fsf@wes.hardakers.net">http://marc.theaimsgroup.com/?l=net-snmp-announce&m=112059518426328</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-07-02</discovery>
|
|
<entry>2005-07-05</entry>
|
|
<modified>2005-10-26</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="1cf00643-ed8a-11d9-8310-0001020eed82">
|
|
<topic>cacti -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>cacti</name>
|
|
<range><lt>0.8.6f</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Stefan Esser reports:</p>
|
|
<blockquote cite="http://www.hardened-php.net/advisory-032005.php">
|
|
<p>Wrongly implemented user input filters lead to multiple
|
|
SQL Injection vulnerabilities which can lead f.e. to
|
|
disclosure of the admin password hash.</p>
|
|
</blockquote>
|
|
<blockquote cite="http://www.hardened-php.net/advisory-042005.php">
|
|
<p>Wrongly implemented user input filters allows injection
|
|
of user input into executed commandline.</p>
|
|
<p>Alberto Trivero posted his Remote Command Execution
|
|
Exploit for Cacti <= 0.8.6d to Bugtraq on the 22th
|
|
June. Having analysed his bug we come to the conclusion,
|
|
that the malfunctioning input filters, which were already
|
|
mentioned in the previous advisory are also responsible
|
|
for this bug still being exploitable.</p>
|
|
</blockquote>
|
|
<blockquote cite="http://www.hardened-php.net/advisory-052005.php">
|
|
<p>A HTTP headers bypass switch can also be used to
|
|
completely bypass the authentification system of Cacti. As
|
|
admin it is possible to execute shell commands with the
|
|
permission of the webserver.</p>
|
|
<p>While looking at the source of Cacti a HTTP headers
|
|
bypass switch was discovered, that also switches off a
|
|
call to <code>session_start()</code> and the manual
|
|
application of <code>addslashes()</code> in case of
|
|
<code>magic_quotes_gpc=Off</code>.</p>
|
|
<p>When register_globals is turned on* an attacker can use
|
|
this switch to disables Cacti's use of PHP's session
|
|
support and therefore supply the session variables on his
|
|
own through f.e. the URL. Additionally using the switch
|
|
renders several SQL statements vulnerable to SQL
|
|
Injections attacks, when magic_quotes_gpc is turned off,
|
|
which is the recommended setting.</p>
|
|
<p>Logged in as an admin it is possible to issue shell
|
|
commands.</p>
|
|
<p>(*) register_globals is turned off by default since PHP
|
|
4.2 but is activated on most servers because of older
|
|
scripts requiring it.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<mlist msgid="007301c57753$5ab17f60$0100a8c0@alberto">http://marc.theaimsgroup.com/?l=bugtraq&m=111954136315248</mlist>
|
|
<url>http://www.hardened-php.net/advisory-032005.php</url>
|
|
<url>http://www.hardened-php.net/advisory-042005.php</url>
|
|
<url>http://www.hardened-php.net/advisory-052005.php</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-06-22</discovery>
|
|
<entry>2005-07-05</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="dca0a345-ed81-11d9-8310-0001020eed82">
|
|
<topic>wordpress -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>wordpress</name>
|
|
<range><lt>1.5.1.3,1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>GulfTech Security Research reports:</p>
|
|
<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&m=112006967221438">
|
|
<p>There are a number of vulnerabilities in WordPress that
|
|
may allow an attacker to ultimately run arbitrary code on
|
|
the vulnerable system. These vulnerabilities include SQL
|
|
Injection, Cross Site Scripting, and also issues that may
|
|
aid an attacker in social engineering.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-2107</cvename>
|
|
<cvename>CVE-2005-2108</cvename>
|
|
<cvename>CVE-2005-2109</cvename>
|
|
<cvename>CVE-2005-2110</cvename>
|
|
<mlist msgid="42C2BE6E.2050408@gulftech.org">http://marc.theaimsgroup.com/?l=bugtraq&m=112006967221438</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-06-28</discovery>
|
|
<entry>2005-07-05</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="a4955b32-ed84-11d9-8310-0001020eed82">
|
|
<topic>wordpress -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>wordpress</name>
|
|
<range><lt>1.5.1.2,1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A Gentoo Linux Security Advisory reports:</p>
|
|
<blockquote cite="http://www.gentoo.org/security/en/glsa/glsa-200506-04.xml">
|
|
<p>Due to a lack of input validation, WordPress is
|
|
vulnerable to SQL injection and XSS attacks.</p>
|
|
<p>An attacker could use the SQL injection vulnerabilites to
|
|
gain information from the database. Furthermore the
|
|
cross-site scripting issues give an attacker the ability
|
|
to inject and execute malicious script code or to steal
|
|
cookie-based authentication credentials, potentially
|
|
compromising the victim's browser.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-1810</cvename>
|
|
<url>http://www.gentoo.org/security/en/glsa/glsa-200506-04.xml</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-04-12</discovery>
|
|
<entry>2005-07-05</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="4afacca1-eb9d-11d9-a8bd-000cf18bbe54">
|
|
<topic>phpbb -- remote PHP code execution vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>phpbb</name>
|
|
<range><lt>2.0.16</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>FrSIRT Advisory reports:</p>
|
|
<blockquote cite="http://www.frsirt.com/english/advisories/2005/0904">
|
|
<p>A vulnerability was identified in phpBB, which
|
|
may be exploited by attackers to compromise a vulnerable
|
|
web server. This flaw is due to an input validation error
|
|
in the "viewtopic.php" script that does not properly filter
|
|
the "highlight" parameter before calling the "preg_replace()"
|
|
function, which may be exploited by remote attackers to execute
|
|
arbitrary PHP commands with the privileges of the web server.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-2086</cvename>
|
|
<url>http://www.frsirt.com/english/advisories/2005/0904</url>
|
|
<url>http://www.phpbb.com/phpBB/viewtopic.php?t=302011</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-06-28</discovery>
|
|
<entry>2005-07-03</entry>
|
|
<modified>2005-07-07</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="523fad14-eb9d-11d9-a8bd-000cf18bbe54">
|
|
<topic>pear-XML_RPC -- arbitrary remote code execution</topic>
|
|
<affects>
|
|
<package>
|
|
<name>pear-XML_RPC</name>
|
|
<range><lt>1.3.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>GulfTech Security Research Team reports:</p>
|
|
<blockquote cite="http://www.gulftech.org/?node=research&article_id=00087-07012005">
|
|
<p>PEAR XML_RPC is vulnerable to a very high risk php code
|
|
injection vulnerability due to unsanatized data being
|
|
passed into an eval() call.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-1921</cvename>
|
|
<url>http://www.gulftech.org/?node=research&article_id=00087-07012005</url>
|
|
<url>http://www.hardened-php.net/advisory-022005.php</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-06-29</discovery>
|
|
<entry>2005-07-03</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="f70f8860-e8ee-11d9-b875-0001020eed82">
|
|
<topic>kernel -- ipfw packet matching errors with address tables</topic>
|
|
<affects>
|
|
<system>
|
|
<name>FreeBSD</name>
|
|
<range><ge>5.4</ge><lt>5.4_3</lt></range>
|
|
</system>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<h1>Problem Description</h1>
|
|
<p>The ipfw tables lookup code caches the result of the last
|
|
query. The kernel may process multiple packets
|
|
concurrently, performing several concurrent table lookups.
|
|
Due to an insufficient locking, a cached result can become
|
|
corrupted that could cause some addresses to be incorrectly
|
|
matched against a lookup table.</p>
|
|
<h1>Impact</h1>
|
|
<p>When lookup tables are used with ipfw, packets may on very
|
|
rare occasions incorrectly match a lookup table. This could
|
|
result in a packet being treated contrary to the defined
|
|
packet filtering ruleset. For example, a packet may be
|
|
allowed to pass through when it should have been
|
|
discarded.</p>
|
|
<p>The problem can only occur on Symmetric Multi-Processor
|
|
(SMP) systems, or on Uni Processor (UP) systems with the
|
|
PREEMPTION kernel option enabled (not the default).</p>
|
|
<h1>Workaround</h1>
|
|
<p>a) Do not use lookup tables.</p>
|
|
<p>OR</p>
|
|
<p>b) Disable concurrent processing of packets in the network
|
|
stack by setting the "debug.mpsafenet=0" tunable:</p>
|
|
<p># echo "debug.mpsafenet=0" << /boot/loader.conf</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-2019</cvename>
|
|
<freebsdsa>SA-05:13.ipfw</freebsdsa>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-06-29</discovery>
|
|
<entry>2005-06-29</entry>
|
|
<modified>2005-07-06</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="197f444f-e8ef-11d9-b875-0001020eed82">
|
|
<topic>bzip2 -- denial of service and permission race vulnerabilities</topic>
|
|
<affects>
|
|
<system>
|
|
<name>FreeBSD</name>
|
|
<range><ge>5.4</ge><lt>5.4_3</lt></range>
|
|
<range><ge>5.*</ge><lt>5.3_17</lt></range>
|
|
<range><ge>4.11</ge><lt>4.11_11</lt></range>
|
|
<range><lt>4.10_16</lt></range>
|
|
</system>
|
|
<package>
|
|
<name>bzip2</name>
|
|
<range><lt>1.0.3_1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<h1>Problem Description</h1>
|
|
<p>Two problems have been discovered relating to the
|
|
extraction of bzip2-compressed files. First, a carefully
|
|
constructed invalid bzip2 archive can cause bzip2 to enter
|
|
an infinite loop. Second, when creating a new file, bzip2
|
|
closes the file before setting its permissions.</p>
|
|
<h1>Impact</h1>
|
|
<p>The first problem can cause bzip2 to extract a bzip2
|
|
archive to an infinitely large file. If bzip2 is used in
|
|
automated processing of untrusted files this could be
|
|
exploited by an attacker to create an denial-of-service
|
|
situation by exhausting disk space or by consuming all
|
|
available cpu time.</p>
|
|
<p>The second problem can allow a local attacker to change the
|
|
permissions of local files owned by the user executing bzip2
|
|
providing that they have write access to the directory in
|
|
which the file is being extracted.</p>
|
|
<h1>Workaround</h1>
|
|
<p>Do not uncompress bzip2 archives from untrusted sources and
|
|
do not uncompress files in directories where untrusted users
|
|
have write access.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-0953</cvename>
|
|
<cvename>CVE-2005-1260</cvename>
|
|
<freebsdsa>SA-05:14.bzip2</freebsdsa>
|
|
<url>http://scary.beasts.org/security/CESA-2005-002.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-03-30</discovery>
|
|
<entry>2005-06-29</entry>
|
|
<modified>2005-07-06</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="3ec8f43b-e8ef-11d9-b875-0001020eed82">
|
|
<topic>kernel -- TCP connection stall denial of service</topic>
|
|
<affects>
|
|
<system>
|
|
<name>FreeBSD</name>
|
|
<range><ge>5.4</ge><lt>5.4_3</lt></range>
|
|
<range><ge>5.*</ge><lt>5.3_17</lt></range>
|
|
<range><ge>4.11</ge><lt>4.11_11</lt></range>
|
|
<range><lt>4.10_16</lt></range>
|
|
</system>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<h1>Problem Description</h1>
|
|
<p>Two problems have been discovered in the FreeBSD TCP stack.</p>
|
|
<p>First, when a TCP packets containing a timestamp is
|
|
received, inadequate checking of sequence numbers is
|
|
performed, allowing an attacker to artificially increase the
|
|
internal "recent" timestamp for a connection.</p>
|
|
<p>Second, a TCP packet with the SYN flag set is accepted for
|
|
established connections, allowing an attacker to overwrite
|
|
certain TCP options.</p>
|
|
<h1>Impact</h1>
|
|
<p>Using either of the two problems an attacker with knowledge
|
|
of the local and remote IP and port numbers associated with
|
|
a connection can cause a denial of service situation by
|
|
stalling the TCP connection. The stalled TCP connection my
|
|
be closed after some time by the other host.</p>
|
|
<h1>Workaround</h1>
|
|
<p>In some cases it may be possible to defend against these
|
|
attacks by blocking the attack packets using a firewall.
|
|
Packets used to effect either of these attacks would have
|
|
spoofed source IP addresses.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<certvu>637934</certvu>
|
|
<cvename>CVE-2005-0356</cvename>
|
|
<cvename>CVE-2005-2068</cvename>
|
|
<freebsdsa>SA-05:15.tcp</freebsdsa>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-06-29</discovery>
|
|
<entry>2005-06-29</entry>
|
|
<modified>2005-07-06</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="76adaab0-e4e3-11d9-b875-0001020eed82">
|
|
<topic>ethereal -- multiple protocol dissectors vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>ethereal</name>
|
|
<name>ethereal-lite</name>
|
|
<name>tethereal</name>
|
|
<name>tethereal-lite</name>
|
|
<range><ge>0.8.14</ge><lt>0.10.11</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>An Ethreal Security Advisories reports:</p>
|
|
<blockquote cite="http://www.ethereal.com/appnotes/enpa-sa-00019.html">
|
|
<p>An aggressive testing program as well as independent
|
|
discovery has turned up a multitude of security issues:</p>
|
|
<ul>
|
|
<li>The ANSI A dissector was susceptible to format string
|
|
vulnerabilities. Discovered by Bryan Fulton.</li>
|
|
<li>The GSM MAP dissector could crash.</li>
|
|
<li>The AIM dissector could cause a crash.</li>
|
|
<li>The DISTCC dissector was susceptible to a buffer
|
|
overflow. Discovered by Ilja van Sprundel</li>
|
|
<li>The FCELS dissector was susceptible to a buffer
|
|
overflow. Discovered by Neil Kettle</li>
|
|
<li>The SIP dissector was susceptible to a buffer
|
|
overflow. Discovered by Ejovi Nuwere.</li>
|
|
<li>The KINK dissector was susceptible to a null pointer
|
|
exception, endless looping, and other problems.</li>
|
|
<li>The LMP dissector was susceptible to an endless
|
|
loop.</li>
|
|
<li>The Telnet dissector could abort.</li>
|
|
<li>The TZSP dissector could cause a segmentation
|
|
fault.</li>
|
|
<li>The WSP dissector was susceptible to a null pointer
|
|
exception and assertions.</li>
|
|
<li>The 802.3 Slow protocols dissector could throw an
|
|
assertion.</li>
|
|
<li>The BER dissector could throw assertions.</li>
|
|
<li>The SMB Mailslot dissector was susceptible to a null
|
|
pointer exception and could throw assertions.</li>
|
|
<li>The H.245 dissector was susceptible to a null pointer
|
|
exception.</li>
|
|
<li>The Bittorrent dissector could cause a segmentation
|
|
fault.</li>
|
|
<li>The SMB dissector could cause a segmentation fault and
|
|
throw assertions.</li>
|
|
<li>The Fibre Channel dissector could cause a crash.</li>
|
|
<li>The DICOM dissector could attempt to allocate large
|
|
amounts of memory.</li>
|
|
<li>The MGCP dissector was susceptible to a null pointer
|
|
exception, could loop indefinitely, and segfault.</li>
|
|
<li>The RSVP dissector could loop indefinitely.</li>
|
|
<li>The DHCP dissector was susceptible to format string
|
|
vulnerabilities, and could abort.</li>
|
|
<li>The SRVLOC dissector could crash unexpectedly or go
|
|
into an infinite loop.</li>
|
|
<li>The EIGRP dissector could loop indefinitely.</li>
|
|
<li>The ISIS dissector could overflow a buffer.</li>
|
|
<li>The CMIP, CMP, CMS, CRMF, ESS, OCSP, PKIX1Explitit,
|
|
PKIX Qualified, and X.509 dissectors could overflow
|
|
buffers.</li>
|
|
<li>The NDPS dissector could exhaust system memory or
|
|
cause an assertion, or crash.</li>
|
|
<li>The Q.931 dissector could try to free a null pointer
|
|
and overflow a buffer.</li>
|
|
<li>The IAX2 dissector could throw an assertion.</li>
|
|
<li>The ICEP dissector could try to free the same memory
|
|
twice.</li>
|
|
<li>The MEGACO dissector was susceptible to an infinite
|
|
loop and a buffer overflow.</li>
|
|
<li>The DLSw dissector was susceptible to an infinite
|
|
loop.</li>
|
|
<li>The RPC dissector was susceptible to a null pointer
|
|
exception.</li>
|
|
<li>The NCP dissector could overflow a buffer or loop for
|
|
a large amount of time.</li>
|
|
<li>The RADIUS dissector could throw an assertion.</li>
|
|
<li>The GSM dissector could access an invalid
|
|
pointer.</li>
|
|
<li>The SMB PIPE dissector could throw an assertion.</li>
|
|
<li>The L2TP dissector was susceptible to an infinite loop.</li>
|
|
<li>The SMB NETLOGON dissector could dereference a null
|
|
pointer.</li>
|
|
<li>The MRDISC dissector could throw an assertion.</li>
|
|
<li>The ISUP dissector could overflow a buffer or cause a
|
|
segmentation fault.</li>
|
|
<li>The LDAP dissector could crash.</li>
|
|
<li>The TCAP dissector could overflow a buffer or throw an
|
|
assertion.</li>
|
|
<li>The NTLMSSP dissector could crash.</li>
|
|
<li>The Presentation dissector could overflow a
|
|
buffer.</li>
|
|
<li>Additionally, a number of dissectors could throw an
|
|
assertion when passing an invalid protocol tree item
|
|
length.</li>
|
|
</ul>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>13391</bid>
|
|
<bid>13504</bid>
|
|
<bid>13567</bid>
|
|
<cvename>CVE-2005-1281</cvename>
|
|
<cvename>CVE-2005-1456</cvename>
|
|
<cvename>CVE-2005-1457</cvename>
|
|
<cvename>CVE-2005-1458</cvename>
|
|
<cvename>CVE-2005-1459</cvename>
|
|
<cvename>CVE-2005-1460</cvename>
|
|
<cvename>CVE-2005-1461</cvename>
|
|
<cvename>CVE-2005-1462</cvename>
|
|
<cvename>CVE-2005-1463</cvename>
|
|
<cvename>CVE-2005-1464</cvename>
|
|
<cvename>CVE-2005-1465</cvename>
|
|
<cvename>CVE-2005-1466</cvename>
|
|
<cvename>CVE-2005-1467</cvename>
|
|
<cvename>CVE-2005-1468</cvename>
|
|
<cvename>CVE-2005-1469</cvename>
|
|
<cvename>CVE-2005-1470</cvename>
|
|
<url>http://www.ethereal.com/appnotes/enpa-sa-00019.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-05-04</discovery>
|
|
<entry>2005-06-24</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="691ed622-e499-11d9-a8bd-000cf18bbe54">
|
|
<topic>tor -- information disclosure</topic>
|
|
<affects>
|
|
<package>
|
|
<name>tor</name>
|
|
<range><lt>0.1.0.10</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Roger Dingledine reports:</p>
|
|
<blockquote cite="http://archives.seul.org/or/announce/Jun-2005/msg00001.html">
|
|
<p>The Tor 0.1.0.10 release from a few days ago
|
|
includes a fix for a bug that might allow an attacker
|
|
to read arbitrary memory (maybe even keys) from an exit
|
|
server's process space. We haven't heard any reports of
|
|
exploits yet, but hey.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<mlist>http://archives.seul.org/or/announce/Jun-2005/msg00001.html</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-06-16</discovery>
|
|
<entry>2005-06-24</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="95ee96f2-e488-11d9-bf22-080020c11455">
|
|
<topic>linux-realplayer -- RealText parsing heap overflow</topic>
|
|
<affects>
|
|
<package>
|
|
<name>linux-realplayer</name>
|
|
<range><le>10.0.4_1</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>An iDEFENSE Security Advisory reports:</p>
|
|
<blockquote cite="http://www.idefense.com/application/poi/display?id=250&type=vulnerabilities&flashstatus=false">
|
|
<p>Remote exploitation of a heap-based buffer
|
|
overflow vulnerability in the RealText file format
|
|
parser within various versions of RealNetworks
|
|
Inc.'s RealPlayer could allow attackers to
|
|
execute arbitrary code.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-1277</cvename>
|
|
<url>http://www.idefense.com/application/poi/display?id=250&type=vulnerabilities&flashstatus=false</url>
|
|
<url>http://service.real.com/help/faq/security/050623_player/EN/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-06-23</discovery>
|
|
<entry>2005-06-24</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="594eb447-e398-11d9-a8bd-000cf18bbe54">
|
|
<topic>ruby -- arbitrary command execution on XMLRPC server</topic>
|
|
<affects>
|
|
<package>
|
|
<name>ruby</name>
|
|
<name>ruby_static</name>
|
|
<range><gt>1.8.*</gt><lt>1.8.2_3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Nobuhiro IMAI reports:</p>
|
|
<blockquote cite="http://blade.nagaokaut.ac.jp/cgi-bin/scat.rb/ruby/ruby-core/5237">
|
|
<p>the default value modification on
|
|
Module#public_instance_methods (from false to true) breaks
|
|
s.add_handler(XMLRPC::iPIMethods("sample"), MyHandler.new) style
|
|
security protection.</p>
|
|
<p>This problem could allow a remote attacker to execute arbitrary
|
|
commands on XMLRPC server of libruby.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-1992</cvename>
|
|
<url>http://blade.nagaokaut.ac.jp/cgi-bin/scat.rb/ruby/ruby-core/5237</url>
|
|
<url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=315064</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-06-22</discovery>
|
|
<entry>2005-06-23</entry>
|
|
<modified>2005-11-06</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="96948a6a-e239-11d9-83cf-0010dc5df42d">
|
|
<topic>cacti -- potential SQL injection and cross site scripting attacks</topic>
|
|
<affects>
|
|
<package>
|
|
<name>cacti</name>
|
|
<range><le>0.8.6d</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>iDEFENSE security group disclosed potential SQL injection
|
|
attacks from unchecked user input and two security holes
|
|
regarding potential cross site scripting attacks</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://www.cacti.net/release_notes_0_8_6e.php</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-06-21</discovery>
|
|
<entry>2005-06-21</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="79217c9b-e1d9-11d9-b875-0001020eed82">
|
|
<topic>opera -- XMLHttpRequest security bypass</topic>
|
|
<affects>
|
|
<package>
|
|
<name>linux-opera</name>
|
|
<name>opera-devel</name>
|
|
<name>opera</name>
|
|
<range><gt>8.*</gt><lt>8.01</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A Secunia Advisory reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/15008/">
|
|
<p>Secunia Research has discovered a vulnerability in Opera,
|
|
which can be exploited by malicious people to steal
|
|
content or to perform actions on other web sites with the
|
|
privileges of the user.</p>
|
|
<p>Normally, it should not be possible for the
|
|
<code>XMLHttpRequest</code> object to access resources
|
|
from outside the domain of which the object was
|
|
opened. However, due to insufficient validation of server
|
|
side redirects, it is possible to circumvent this
|
|
restriction.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-1475</cvename>
|
|
<url>http://secunia.com/advisories/15008/</url>
|
|
<url>http://secunia.com/secunia_research/2005-4/advisory/</url>
|
|
<url>http://www.opera.com/freebsd/changelogs/801/#security</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-06-16</discovery>
|
|
<entry>2005-06-20</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="40856a51-e1d9-11d9-b875-0001020eed82">
|
|
<topic>opera -- "javascript:" URL cross-site scripting vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>linux-opera</name>
|
|
<name>opera-devel</name>
|
|
<name>opera</name>
|
|
<range><lt>8.01</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A Secunia Advisory reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/15411/">
|
|
<p>Secunia Research has discovered a vulnerability in Opera,
|
|
which can be exploited by malicious people to conduct
|
|
cross-site scripting attacks and to read local files.</p>
|
|
<p>The vulnerability is caused due to Opera not properly
|
|
restricting the privileges of "javascript:" URLs when
|
|
opened in e.g. new windows or frames.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-1669</cvename>
|
|
<url>http://secunia.com/advisories/15411/</url>
|
|
<url>http://www.opera.com/freebsd/changelogs/801/#security</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-06-16</discovery>
|
|
<entry>2005-06-20</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="985bfcf0-e1d7-11d9-b875-0001020eed82">
|
|
<topic>opera -- redirection cross-site scripting vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>linux-opera</name>
|
|
<name>opera-devel</name>
|
|
<name>opera</name>
|
|
<range><gt>8.*</gt><lt>8.01</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A Secunia Advisory reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/15423/">
|
|
<p>Secunia Research has discovered a vulnerability in Opera,
|
|
which can be exploited by malicious people to conduct
|
|
cross-site scripting attacks against users.</p>
|
|
<p>The vulnerability is caused due to input not being
|
|
sanitised, when Opera generates a temporary page for
|
|
displaying a redirection when "Automatic redirection" is
|
|
disabled (not default setting).</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://secunia.com/advisories/15423/</url>
|
|
<url>http://secunia.com/secunia_research/2003-1/advisory/</url>
|
|
<url>http://www.opera.com/freebsd/changelogs/801/#security</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-06-16</discovery>
|
|
<entry>2005-06-20</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="3bf157fa-e1c6-11d9-b875-0001020eed82">
|
|
<topic>sudo -- local race condition vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>sudo</name>
|
|
<range><lt>1.6.8.9</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Todd C. Miller reports:</p>
|
|
<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&m=111928183431376">
|
|
<p>A race condition in Sudo's command pathname handling
|
|
prior to Sudo version 1.6.8p9 that could allow a user with
|
|
Sudo privileges to run arbitrary commands.</p>
|
|
<p>Exploitation of the bug requires that the user be allowed
|
|
to run one or more commands via Sudo and be able to create
|
|
symbolic links in the filesystem. Furthermore, a sudoers
|
|
entry giving another user access to the ALL pseudo-command
|
|
must follow the user's sudoers entry for the race to
|
|
exist.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>13993</bid>
|
|
<cvename>CVE-2005-1993</cvename>
|
|
<mlist msgid="200506201424.j5KEOhQI024645@xerxes.courtesan.com">http://marc.theaimsgroup.com/?l=bugtraq&m=111928183431376</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-06-20</discovery>
|
|
<entry>2005-06-20</entry>
|
|
<modified>2005-11-14</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="b02c1d80-e1bb-11d9-b875-0001020eed82">
|
|
<topic>trac -- file upload/download vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>trac</name>
|
|
<range><lt>0.8.4</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Stefan Esser reports:</p>
|
|
<blockquote cite="http://www.hardened-php.net/advisory-012005.php">
|
|
<p>Trac's wiki and ticket systems allows to add attachments
|
|
to wiki entries and bug tracker tickets. These attachments
|
|
are stored within directories that are determined by the
|
|
id of the corresponding ticket or wiki entry.</p>
|
|
<p>Due to a missing validation of the id parameter it is
|
|
possible for an attacker to supply arbitrary paths to the
|
|
upload and attachment viewer scripts. This means that a
|
|
potential attacker can retrieve any file accessible by the
|
|
webserver user.</p>
|
|
<p>Additionally it is possible to upload arbitrary files (up
|
|
to a configured file length) to any place the webserver
|
|
has write access too.</p>
|
|
<p>For obvious reasons this can lead to the execution of
|
|
arbitrary code if it possible to upload files to the
|
|
document root or it's subdirectories. One example of a
|
|
configuration would be f.e. running Trac and
|
|
s9y/wordpress with writeable content directories on the
|
|
same webserver.</p>
|
|
<p>Another potential usage of this exploit would be to abuse
|
|
Trac powered webservers as storage for f.e. torrent
|
|
files.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>13990</bid>
|
|
<url>http://www.hardened-php.net/advisory-012005.php</url>
|
|
<url>http://projects.edgewall.com/trac/wiki/ChangeLog</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-06-20</discovery>
|
|
<entry>2005-06-20</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="85069fb6-e15b-11d9-83cf-0010dc5df42d">
|
|
<topic>razor-agents -- denial of service vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>razor-agents</name>
|
|
<range><le>2.71</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A Secunia security advisory reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/15739/">
|
|
<p>Two vulnerabilities have been reported in Razor-agents,
|
|
which can be exploited by malicious people to cause a DoS
|
|
(Denial of Service).</p>
|
|
<ol>
|
|
<li>An unspecified error in the preprocessing of certain
|
|
HTML messages can be exploited to crash the
|
|
application.</li>
|
|
<li>A bug in the discovery logic causes Razor-agents to go
|
|
into an infinite loop and consume a large amount of
|
|
memory when discovery fails.</li>
|
|
</ol>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://secunia.com/advisories/15739/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-06-17</discovery>
|
|
<entry>2005-06-20</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="cc4ce06b-e01c-11d9-a8bd-000cf18bbe54">
|
|
<topic>p5-Mail-SpamAssassin -- denial of service vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>p5-Mail-SpamAssassin</name>
|
|
<range><ge>3.0.1</ge><lt>3.0.4</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Apache SpamAssassin Security Team reports:</p>
|
|
<blockquote cite="http://mail-archives.apache.org/mod_mbox/spamassassin-announce/200506.mbox/%3c17072.35054.586017.822288@proton.pathname.com%3e">
|
|
<p>Apache SpamAssassin 3.0.4 was recently released, and
|
|
fixes a denial of service vulnerability in versions 3.0.1, 3.0.2,
|
|
and 3.0.3. The vulnerability allows certain misformatted
|
|
long message headers to cause spam checking to
|
|
take a very long time.</p>
|
|
<p>While the exploit has yet to be seen in the wild,
|
|
we are concerned that there may be attempts to abuse
|
|
the vulnerability in the future. Therefore, we strongly
|
|
recommend all users of these versions upgrade to
|
|
Apache SpamAssassin 3.0.4 as soon as possible.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-1266</cvename>
|
|
<mlist msgid="c17072.35054.586017.822288@proton.pathname.com">http://mail-archives.apache.org/mod_mbox/spamassassin-announce/200506.mbox/%3c17072.35054.586017.822288@proton.pathname.com%3e</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-06-15</discovery>
|
|
<entry>2005-06-18</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="e879ca68-e01b-11d9-a8bd-000cf18bbe54">
|
|
<topic>squirrelmail -- Several cross site scripting vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>squirrelmail</name>
|
|
<name>ja-squirrelmail</name>
|
|
<range><ge>1.4.0</ge><le>1.4.4</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A SquirrelMail Security Advisory reports:</p>
|
|
<blockquote cite="http://www.squirrelmail.org/security/issue/2005-06-15">
|
|
<p>Several cross site scripting (XSS) vulnerabilities have been
|
|
discovered in SquirrelMail versions 1.4.0 - 1.4.4.</p>
|
|
<p>The vulnerabilities are in two categories: the majority can be
|
|
exploited through URL manipulation, and some by sending a specially
|
|
crafted email to a victim. When done very carefully,
|
|
this can cause the session of the user to be hijacked.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-1769</cvename>
|
|
<url>http://www.squirrelmail.org/security/issue/2005-06-15</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-06-15</discovery>
|
|
<entry>2005-06-18</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="02bc9b7c-e019-11d9-a8bd-000cf18bbe54">
|
|
<topic>acroread -- XML External Entity vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>acroread7</name>
|
|
<name>ja-acroread</name>
|
|
<range><ge>7.0.0</ge><lt>7.0.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Sverre H. Huseby discovered a vulnerability in Adobe Acrobat
|
|
and Adobe Reader.
|
|
Under certain circumstances, using XML scripts it is possible
|
|
to discover the existence of local files.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-1306</cvename>
|
|
<url>http://shh.thathost.com/secadv/adobexxe/</url>
|
|
<url>http://www.adobe.com/support/techdocs/331710.html</url>
|
|
<url>http://support.adobe.co.jp/faq/faq/qadoc.sv?226360+002+3</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-06-15</discovery>
|
|
<entry>2005-06-18</entry>
|
|
<modified>2005-08-28</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="63bd4bad-dffe-11d9-b875-0001020eed82">
|
|
<topic>gzip -- directory traversal and permission race vulnerabilities</topic>
|
|
<affects>
|
|
<system>
|
|
<name>FreeBSD</name>
|
|
<range><ge>5.4</ge><lt>5.4_2</lt></range>
|
|
<range><ge>5.0</ge><lt>5.3_16</lt></range>
|
|
<range><ge>4.11</ge><lt>4.11_10</lt></range>
|
|
<range><ge>4.10</ge><lt>4.10_15</lt></range>
|
|
<range><ge>4.9</ge><lt>4.9_18</lt></range>
|
|
<range><lt>4.8_33</lt></range>
|
|
</system>
|
|
<package>
|
|
<name>gzip</name>
|
|
<range><lt>1.3.5_2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<h1>Problem Description</h1>
|
|
<p>Two problems related to extraction of files exist in gzip:</p>
|
|
<p>The first problem is that gzip does not properly sanitize
|
|
filenames containing "/" when uncompressing files using the
|
|
-N command line option.</p>
|
|
<p>The second problem is that gzip does not set permissions on
|
|
newly extracted files until after the file has been created
|
|
and the file descriptor has been closed.</p>
|
|
<h1>Impact</h1>
|
|
<p>The first problem can allow an attacker to overwrite
|
|
arbitrary local files when uncompressing a file using the -N
|
|
command line option.</p>
|
|
<p>The second problem can allow a local attacker to change the
|
|
permissions of arbitrary local files, on the same partition
|
|
as the one the user is uncompressing a file on, by removing
|
|
the file the user is uncompressing and replacing it with a
|
|
hardlink before the uncompress operation is finished.</p>
|
|
<h1>Workaround</h1>
|
|
<p>Do not use the -N command line option on untrusted files
|
|
and do not uncompress files in directories where untrusted
|
|
users have write access.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-0988</cvename>
|
|
<cvename>CVE-2005-1228</cvename>
|
|
<freebsdsa>SA-05:11.gzip</freebsdsa>
|
|
<mlist msgid="7389fc4b05040412574f819112@mail.gmail.com">http://marc.theaimsgroup.com/?l=bugtraq&m=111271860708210</mlist>
|
|
<mlist msgid="7389fc4b0504201224759f31b@mail.gmail.com">http://marc.theaimsgroup.com/?l=bugtraq&m=111402732406477</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-04-20</discovery>
|
|
<entry>2005-06-18</entry>
|
|
<modified>2005-07-06</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="9fae0f1f-df82-11d9-b875-0001020eed82">
|
|
<topic>tcpdump -- infinite loops in protocol decoding</topic>
|
|
<affects>
|
|
<system>
|
|
<name>FreeBSD</name>
|
|
<range><ge>5.4</ge><lt>5.4_2</lt></range>
|
|
<range><ge>5.3</ge><lt>5.3_16</lt></range>
|
|
</system>
|
|
<package>
|
|
<name>tcpdump</name>
|
|
<range><lt>3.8.3_2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<h1>Problem Description</h1>
|
|
<p>Several tcpdump protocol decoders contain programming
|
|
errors which can cause them to go into infinite loops.</p>
|
|
<h1>Impact</h1>
|
|
<p>An attacker can inject specially crafted packets into the
|
|
network which, when processed by tcpdump, could lead to a
|
|
denial-of-service. After the attack, tcpdump would no
|
|
longer capture traffic, and would potentially use all
|
|
available processor time.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-1267</cvename>
|
|
<cvename>CVE-2005-1278</cvename>
|
|
<cvename>CVE-2005-1279</cvename>
|
|
<cvename>CVE-2005-1280</cvename>
|
|
<freebsdsa>SA-05:10.tcpdump</freebsdsa>
|
|
<mlist msgid="20050426100140.1945.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&m=111454406222040</mlist>
|
|
<mlist msgid="20050426100057.1748.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&m=111454461300644</mlist>
|
|
<mlist msgid="20050619091553.GB982@zaphod.nitro.dk">http://marc.theaimsgroup.com/?l=bugtraq&m=111928309502304</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-06-09</discovery>
|
|
<entry>2005-06-18</entry>
|
|
<modified>2005-06-20</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="2701611f-df5c-11d9-b875-0001020eed82">
|
|
<topic>gaim -- Yahoo! remote crash vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>gaim</name>
|
|
<name>ja-gaim</name>
|
|
<name>ko-gaim</name>
|
|
<name>ru-gaim</name>
|
|
<range><lt>1.3.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Jacopo Ottaviani reports that Gaim can be crashed by being
|
|
offered files with names containing non-ASCII
|
|
characters via the Yahoo! protocol.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>13931</bid>
|
|
<cvename>CVE-2005-1269</cvename>
|
|
<url>http://gaim.sourceforge.net/security/index.php?id=18</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-06-10</discovery>
|
|
<entry>2005-06-17</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="b6612eee-df5f-11d9-b875-0001020eed82">
|
|
<topic>gaim -- MSN Remote DoS vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>gaim</name>
|
|
<name>ja-gaim</name>
|
|
<name>ko-gaim</name>
|
|
<name>ru-gaim</name>
|
|
<range><lt>1.3.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The GAIM team reports:</p>
|
|
<blockquote cite="http://gaim.sourceforge.net/security/index.php?id=19">
|
|
<p>Remote attackers can cause a denial of service (crash)
|
|
via a malformed MSN message that leads to a memory
|
|
allocation of a large size, possibly due to an integer
|
|
signedness error.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>13932</bid>
|
|
<cvename>CVE-2005-1934</cvename>
|
|
<url>http://gaim.sourceforge.net/security/index.php?id=19</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-06-10</discovery>
|
|
<entry>2005-06-17</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="12b1a62d-6056-4d90-9e21-45fcde6abae4">
|
|
<topic>gallery -- remote code injection via HTTP_POST_VARS</topic>
|
|
<affects>
|
|
<package>
|
|
<name>gallery</name>
|
|
<range><lt>1.4.1.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A web server running Gallery can be exploited for arbitrary
|
|
PHP code execution through the use of a maliciously crafted
|
|
URL.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-2124</cvename>
|
|
<mlist msgid="0c0a01c3e525$1c0ed2b0$c90c030a@bmedirattatg">http://marc.theaimsgroup.com/?l=bugtraq&m=107524414317693</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-01-27</discovery>
|
|
<entry>2005-06-17</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="5752a0df-60c5-4876-a872-f12f9a02fa05">
|
|
<topic>gallery -- cross-site scripting</topic>
|
|
<affects>
|
|
<package>
|
|
<name>gallery</name>
|
|
<range><lt>1.4.4.5</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Gallery includes several cross-site scripting vulnerabilities
|
|
that could allow malicious content to be injected.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-1106</cvename>
|
|
<cvename>CVE-2005-0219</cvename>
|
|
<cvename>CVE-2005-0220</cvename>
|
|
<cvename>CVE-2005-0221</cvename>
|
|
<cvename>CVE-2005-0222</cvename>
|
|
<bid>11602</bid>
|
|
<url>http://gallery.menalto.com/modules.php?op=modload&name=News&file=article&sid=147</url>
|
|
<url>http://marc.theaimsgroup.com/?l=bugtraq&m=110608459222364</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-01-26</discovery>
|
|
<entry>2005-06-17</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="0512b761-70fb-40d3-9954-aa4565528fa8">
|
|
<topic>kstars -- exploitable set-user-ID application fliccd</topic>
|
|
<affects>
|
|
<package>
|
|
<name>kdeedu</name>
|
|
<range><lt>3.3.2_1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A KDE Security Advisory explains:</p>
|
|
<blockquote cite="http://www.kde.org/info/security/advisory-20050215-1.txt">
|
|
<h1>Overview</h1>
|
|
<p>KStars includes support for the Instrument Neutral
|
|
Distributed Interface (INDI). The build system of this
|
|
extra 3rd party software contained an installation hook to
|
|
install fliccd (part of INDI) as SUID root
|
|
application.</p>
|
|
<p>Erik Sjölund discovered that the code contains several
|
|
vulnerabilities that allow stack based buffer
|
|
overflows.</p>
|
|
<h1>Impact</h1>
|
|
<p>If the fliccd binary is installed as suid root, it
|
|
enables root privilege escalation for local users, or, if
|
|
the daemon is actually running (which it does not by
|
|
default) and is running as root, remote root privilege
|
|
escalation.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-0011</cvename>
|
|
<url>http://www.kde.org/info/security/advisory-20050215-1.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-01-05</discovery>
|
|
<entry>2005-06-17</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="4c005a5e-2541-4d95-80a0-00c76919aa66">
|
|
<topic>fd_set -- bitmap index overflow in multiple applications</topic>
|
|
<affects>
|
|
<package>
|
|
<name>gatekeeper</name>
|
|
<range><lt>2.2.1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>citadel</name>
|
|
<range><lt>6.29</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>3proxy</name>
|
|
<range><lt>0.5.b</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>jabber</name>
|
|
<range><lt>1.4.3.1_1,1</lt></range>
|
|
<range><eq>1.4.4</eq></range>
|
|
</package>
|
|
<package>
|
|
<name>bnc</name>
|
|
<range><lt>2.9.3</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>rinetd</name>
|
|
<range><lt>0.62_1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>dante</name>
|
|
<range><lt>1.1.15</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>bld</name>
|
|
<range><lt>0.3.3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>3APA3A reports:</p>
|
|
<blockquote cite="http://www.security.nnov.ru/advisories/sockets.asp">
|
|
<p>If programmer fails to check socket number before using
|
|
select() or fd_set macros, it's possible to overwrite
|
|
memory behind fd_set structure. Very few select() based
|
|
application actually check FD_SETSIZE value. <em>[...]</em></p>
|
|
<p>Depending on vulnerable application it's possible to
|
|
overwrite portions of memory. Impact is close to
|
|
off-by-one overflows, code execution doesn't seems
|
|
exploitable.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://www.gotbnc.com/changes.html#2.9.3</url>
|
|
<url>http://www.security.nnov.ru/advisories/sockets.asp</url>
|
|
<mlist msgid="1473827718.20050124233008@security.nnov.ru">http://marc.theaimsgroup.com/?l=bugtraq&m=110660879328901</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-12-12</discovery>
|
|
<entry>2005-06-17</entry>
|
|
<modified>2006-09-03</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="b5ffaa2a-ee50-4498-af99-61bc1b163c00">
|
|
<topic>leafnode -- denial of service vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>leafnode</name>
|
|
<range><lt>1.11.3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Matthias Andree reports:</p>
|
|
<blockquote cite="http://leafnode.sourceforge.net/leafnode-SA-2005-02.txt">
|
|
<p>A vulnerability was found in the fetchnews program (the NNTP
|
|
client) that may under some circumstances cause a wait for input
|
|
that never arrives, fetchnews "hangs". [...]</p>
|
|
<p>As only one fetchnews program can run at a time, subsequently
|
|
started fetchnews and texpire programs will terminate. [...]</p>
|
|
<p>Upgrade your leafnode package to version 1.11.3.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-1911</cvename>
|
|
<url>http://leafnode.sourceforge.net/leafnode-SA-2005-02.txt</url>
|
|
<freebsdpr>ports/82056</freebsdpr>
|
|
<mlist msgid="20050608215155.GB27234@merlin.emma.line.org">http://marc.theaimsgroup.com/?l=vulnwatch&m=111827180929063</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-06-08</discovery>
|
|
<entry>2005-06-09</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="fe903533-ff96-4c7a-bd3e-4d40efa71897">
|
|
<topic>gforge -- directory traversal vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>gforge</name>
|
|
<range><lt>4.0</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>An STG Security Advisory reports:</p>
|
|
<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&m=110627132209963">
|
|
<p>GForge CVS module made by Dragos Moinescu and another
|
|
module made by Ronald Petty have a directory traversal
|
|
vulnerability. [...] malicious attackers can read
|
|
arbitrary directory lists.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-0299</cvename>
|
|
<bid>12318</bid>
|
|
<mlist msgid="20050120051735.2832.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&m=110627132209963</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-01-20</discovery>
|
|
<entry>2005-06-03</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="d1bbc235-c0c9-45cd-8d2d-c1b8fd22e616">
|
|
<topic>imap-uw -- authentication bypass when CRAM-MD5 is enabled</topic>
|
|
<affects>
|
|
<package>
|
|
<name>imap-uw</name>
|
|
<range><lt>2004b,1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The CRAM-MD5 authentication support of the University of
|
|
Washington IMAP and POP3 servers contains a vulnerability that
|
|
may allow an attacker to bypass authentication and impersonate
|
|
arbitrary users. Only installations with CRAM-MD5 support
|
|
configured are affected.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-0198</cvename>
|
|
<certvu>702777</certvu>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-01-04</discovery>
|
|
<entry>2005-06-03</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="5bf1a715-cc57-440f-b0a5-6406961c54a7">
|
|
<topic>squid -- denial-of-service vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>squid</name>
|
|
<range><lt>2.5.9</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Squid team reported several denial-of-service
|
|
vulnerabilities related to the handling of DNS responses and
|
|
NT Lan Manager messages. These may allow an attacker to crash
|
|
the Squid cache.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-0446</cvename>
|
|
<url>http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE8-dns_assert</url>
|
|
<cvename>CVE-2005-0096</cvename>
|
|
<cvename>CVE-2005-0097</cvename>
|
|
<url>http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-fakeauth_auth</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-01-16</discovery>
|
|
<entry>2005-06-03</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="3b260179-e464-460d-bf9f-d5cda6204020">
|
|
<topic>racoon -- remote denial-of-service</topic>
|
|
<affects>
|
|
<package>
|
|
<name>racoon</name>
|
|
<range><lt>20050510a</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Sebastian Krahmer discovered that the racoon ISAKMP daemon
|
|
could be crashed with a maliciously crafted UDP packet. No
|
|
authentication is required in order to perform the attack.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-0398</cvename>
|
|
<mlist>http://sourceforge.net/mailarchive/forum.php?thread_id=6787713&forum_id=32000</mlist>
|
|
<url>http://xforce.iss.net/xforce/xfdb/19707</url>
|
|
<url>https://bugzilla.redhat.com/bugzilla/attachment.cgi?id=109966&action=view</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-03-12</discovery>
|
|
<entry>2005-06-03</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="bfbbd505-3bd6-409c-8c67-445d3635cf4b">
|
|
<topic>xli -- integer overflows in image size calculations</topic>
|
|
<affects>
|
|
<package>
|
|
<name>xli</name>
|
|
<range><le>1.17.0_1</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Tavis Ormandy discovered several integer overflows in xli's
|
|
image size handling. A maliciously crafted image may be able
|
|
to cause a heap buffer overflow and execute arbitrary code.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-0639</cvename>
|
|
<url>http://bugs.gentoo.org/show_bug.cgi?id=79762</url>
|
|
<url>http://pantransit.reptiles.org/prog/xli/CHANGES</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-02-08</discovery>
|
|
<entry>2005-06-03</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="310d0087-0fde-4929-a41f-96f17c5adffe">
|
|
<topic>xloadimage -- arbitrary command execution when handling compressed files</topic>
|
|
<affects>
|
|
<package>
|
|
<name>xli</name>
|
|
<range><le>1.17.0_1</le></range>
|
|
</package>
|
|
<package>
|
|
<name>xloadimage</name>
|
|
<range><le>4.1.10</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Tavis Ormandy discovered that xli and xloadimage attempt to
|
|
decompress images by piping them through <code>gunzip</code>
|
|
or similar decompression tools. Unfortunately, the
|
|
unsanitized file name is included as part of the command.
|
|
This is dangerous, as in some situations, such as mailcap
|
|
processing, an attacker may control the input file name. As a
|
|
result, an attacker may be able to cause arbitrary command
|
|
execution.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-0638</cvename>
|
|
<url>http://bugs.gentoo.org/show_bug.cgi?id=79762</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-02-18</discovery>
|
|
<entry>2005-06-03</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="8c1da77d-d3e9-11d9-8ffb-00061bc2ad93">
|
|
<topic>xloadimage -- buffer overflow in FACES image handling</topic>
|
|
<affects>
|
|
<package>
|
|
<name>xli</name>
|
|
<range><le>1.17.0_1</le></range>
|
|
</package>
|
|
<package>
|
|
<name>xloadimage</name>
|
|
<range><lt>4.1.9</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>In 2001, zen-parse discovered a buffer overflow in
|
|
xloadimage's FACES image loader. A maliciously crafted image
|
|
could cause xloadimage to execute arbitrary code. A published
|
|
exploit exists for this vulnerability.</p>
|
|
<p>In 2005, Rob Holland discovered that the same vulnerability
|
|
was present in xli.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2001-0775</cvename>
|
|
<mlist>http://marc.theaimsgroup.com/?l=bugtraq&m=99477230306845</mlist>
|
|
<url>https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=46186</url>
|
|
<url>http://bugs.gentoo.org/show_bug.cgi?id=79762</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2000-02-19</discovery>
|
|
<entry>2005-06-03</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="99b5cfa5-d3d2-11d9-8ffb-00061bc2ad93">
|
|
<topic>yamt -- buffer overflow and directory traversal issues</topic>
|
|
<affects>
|
|
<package>
|
|
<name>yamt</name>
|
|
<range><lt>0.5_2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Stanislav Brabec discovered errors in yamt's path name
|
|
handling that lead to buffer overflows and directory traversal
|
|
issues. When processing a file with a maliciously crafted ID3
|
|
tag, yamt might overwrite arbitrary files or possibly execute
|
|
arbitrary code.</p>
|
|
<p>The SuSE package ChangeLog contains:</p>
|
|
<blockquote>
|
|
<ul>
|
|
<li>Several security fixes (#49337):</li>
|
|
<li>directory traversal in rename</li>
|
|
<li>directory traversal in sort</li>
|
|
<li>buffer overflow in sort</li>
|
|
<li>buffer overflow in rename</li>
|
|
</ul>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-1846</cvename>
|
|
<cvename>CVE-2005-1847</cvename>
|
|
<url>http://rpmfind.net/linux/RPM/suse/updates/8.2/i386/rpm/i586/yamt-0.5-1277.i586.html</url>
|
|
<url>ftp://ftp.suse.com/pub/suse/i386/update/8.2/rpm/src/yamt-0.5-1277.src.rpm</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-01-20</discovery>
|
|
<entry>2005-06-03</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="ae6ec9b8-2f43-4d02-8129-c6a3a53ef09d">
|
|
<topic>xview -- multiple buffer overflows in xv_parse_one</topic>
|
|
<affects>
|
|
<package>
|
|
<name>xview</name>
|
|
<range><lt>3.2.1_3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A Debian Security Advisory reports:</p>
|
|
<blockquote cite="http://www.debian.org/security/2005/dsa-672">
|
|
<p>Erik Sjölund discovered that programs linked against xview
|
|
are vulnerable to a number of buffer overflows in the XView
|
|
library. When the overflow is triggered in a program which
|
|
is installed setuid root a malicious user could perhaps
|
|
execute arbitrary code as privileged user.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-0076</cvename>
|
|
<url>http://www.debian.org/security/2005/dsa-672</url>
|
|
<url>http://xforce.iss.net/xforce/xfdb/19271</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-02-09</discovery>
|
|
<entry>2005-06-01</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="f7e8d2ca-410e-40b2-8748-3abd021e44a9">
|
|
<topic>xtrlock -- X display locking bypass</topic>
|
|
<affects>
|
|
<package>
|
|
<name>xtrlock</name>
|
|
<range><lt>2.0.10</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The X display locking program <code>xtrlock</code> contains
|
|
an integer overflow bug. It is possible for an attacker with
|
|
physical access to the system to bypass the display lock.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-0079</cvename>
|
|
<url>http://www.debian.org/security/2005/dsa-649</url>
|
|
<url>http://xforce.iss.net/xforce/xfdb/18991</url>
|
|
<url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=278191</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-10-25</discovery>
|
|
<entry>2005-06-01</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="bf2e7483-d3fa-440d-8c6e-8f1f2f018818">
|
|
<topic>linux_base -- vulnerabilities in Red Hat 7.1 libraries</topic>
|
|
<affects>
|
|
<package>
|
|
<name>linux_base</name>
|
|
<range><lt>7.3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Trevor Johnson reported that the Red Hat Linux RPMs used
|
|
by linux_base contained multiple older vulnerabilities, such
|
|
as a DNS resolver issue and critical bugs in X font handling
|
|
and XPM image handling.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://fedoralegacy.org/updates/RH7.3/2004-10-23-FLSA_2004_1947__Updated_glibc_packages_fix_flaws.html</url>
|
|
<url>http://rhn.redhat.com/errata/RHSA-2004-059.html</url>
|
|
<url>http://rhn.redhat.com/errata/RHSA-2004-478.html</url>
|
|
<url>http://rhn.redhat.com/errata/RHSA-2004-612.html</url>
|
|
<cvename>CVE-2002-0029</cvename>
|
|
<cvename>CVE-2004-0083</cvename>
|
|
<cvename>CVE-2004-0084</cvename>
|
|
<cvename>CVE-2004-0106</cvename>
|
|
<cvename>CVE-2004-0687</cvename>
|
|
<cvename>CVE-2004-0688</cvename>
|
|
<cvename>CVE-2004-0692</cvename>
|
|
<cvename>CVE-2004-0914</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-09-27</discovery>
|
|
<entry>2005-06-01</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="79630c0c-8dcc-45d0-9908-4087fe1d618c">
|
|
<topic>squirrelmail -- XSS and remote code injection vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>squirrelmail</name>
|
|
<name>ja-squirrelmail</name>
|
|
<range><lt>1.4.4</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A SquirrelMail Security Advisory reports:</p>
|
|
<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&m=110702772714662">
|
|
<p>SquirrelMail 1.4.4 has been released to resolve a number of
|
|
security issues disclosed below. It is strongly recommended
|
|
that all running SquirrelMail prior to 1.4.4 upgrade to the
|
|
latest release.</p>
|
|
<h1>Remote File Inclusion</h1>
|
|
<p>Manoel Zaninetti reported an issue in src/webmail.php which
|
|
would allow a crafted URL to include a remote web page.
|
|
This was assigned CAN-2005-0103 by the Common
|
|
Vulnerabilities and Exposures.</p>
|
|
<h1>Cross Site Scripting Issues</h1>
|
|
<p>A possible cross site scripting issue exists in
|
|
src/webmail.php that is only accessible when the PHP
|
|
installation is running with register_globals set to On.
|
|
This issue was uncovered internally by the SquirrelMail
|
|
Development team. This isssue was assigned CAN-2005-0104 by
|
|
the Common Vulnerabilities and Exposures.</p>
|
|
<p>A second issue which was resolved in the 1.4.4-rc1 release
|
|
was uncovered and assigned CAN-2004-1036 by the Common
|
|
Vulnerabilities and Exposures. This issue could allow a
|
|
remote user to send a specially crafted header and cause
|
|
execution of script (such as javascript) in the client
|
|
browser.</p>
|
|
<h1>Local File Inclusion</h1>
|
|
<p>A possible local file inclusion issue was uncovered by one
|
|
of our developers involving custom preference handlers.
|
|
This issue is only active if the PHP installation is running
|
|
with register_globals set to On.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-1036</cvename>
|
|
<cvename>CVE-2005-0075</cvename>
|
|
<cvename>CVE-2005-0103</cvename>
|
|
<cvename>CVE-2005-0104</cvename>
|
|
<mlist msgid="47249.24.0.109.81.1106975343.squirrel@sm-14.netdork.net">http://marc.theaimsgroup.com/?l=bugtraq&m=110702772714662</mlist>
|
|
<url>http://www.squirrelmail.org/security/issue/2005-01-14</url>
|
|
<url>http://www.squirrelmail.org/security/issue/2005-01-19</url>
|
|
<url>http://www.squirrelmail.org/security/issue/2005-01-20</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-01-29</discovery>
|
|
<entry>2005-06-01</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="0d9ba03b-0dbb-42b4-ae0f-60e27af78e22">
|
|
<topic>sympa -- buffer overflow in "queue"</topic>
|
|
<affects>
|
|
<package>
|
|
<name>sympa</name>
|
|
<range><lt>4.1.2_1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Erik Sjölund discovered a vulnerabilitiy in Sympa. The
|
|
<code>queue</code> application processes messages received via
|
|
aliases. It contains a buffer overflow in the usage of
|
|
<code>sprintf</code>. In some configurations, it may allow an
|
|
attacker to execute arbitrary code as the <code>sympa</code>
|
|
user.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-0073</cvename>
|
|
<url>http://www.debian.org/security/2005/dsa-677</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-02-11</discovery>
|
|
<entry>2005-06-01</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="b3cd00f7-c0c5-452d-87bc-086c5635333e">
|
|
<topic>mailman -- generated passwords are poor quality</topic>
|
|
<affects>
|
|
<package>
|
|
<name>mailman</name>
|
|
<name>ja-mailman</name>
|
|
<range><lt>2.1.6</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Florian Weimer wrote:</p>
|
|
<blockquote cite="http://mail.python.org/pipermail/mailman-developers/attachments/20041215/be238297/attachment.mht">
|
|
<p>Mailman 2.1.5 uses weak auto-generated passwords for new
|
|
subscribers. These passwords are assigned when members
|
|
subscribe without specifying their own password (either by
|
|
email or the web frontend). Knowledge of this password
|
|
allows an attacker to gain access to the list archive even
|
|
though she's not a member and the archive is restricted to
|
|
members only. [...]</p>
|
|
<p>This means that only about 5 million different passwords
|
|
are ever generated, a number that is in the range of brute
|
|
force attacks -- you only have to guess one subscriber
|
|
address (which is usually not that hard).</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-1143</cvename>
|
|
<mlist>http://mail.python.org/pipermail/mailman-developers/2004-December/017553.html</mlist>
|
|
<mlist msgid="87llc0u6l8.fsf@deneb.enyo.de">http://mail.python.org/pipermail/mailman-developers/attachments/20041215/be238297/attachment.mht</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-12-15</discovery>
|
|
<entry>2005-06-01</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="ad9d2518-3471-4737-b60b-9a1f51023b28">
|
|
<topic>mailman -- password disclosure</topic>
|
|
<affects>
|
|
<package>
|
|
<name>mailman</name>
|
|
<name>ja-mailman</name>
|
|
<range><lt>2.1.5</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Barry Warsaw reports:</p>
|
|
<blockquote cite="http://mail.python.org/pipermail/mailman-announce/2004-May/000072.html">
|
|
<p>Today I am releasing Mailman 2.1.5, a bug fix release
|
|
[...] This version also contains a fix for an exploit that
|
|
could allow 3rd parties to retrieve member passwords. It is
|
|
thus highly recommended that all existing sites upgrade to
|
|
the latest version.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0412</cvename>
|
|
<mlist>http://mail.python.org/pipermail/mailman-announce/2004-May/000072.html</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-05-15</discovery>
|
|
<entry>2005-06-01</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="26a08c77-32da-4dd7-a884-a76fc49aa824">
|
|
<topic>tomcat -- Tomcat Manager cross-site scripting</topic>
|
|
<affects>
|
|
<package>
|
|
<name>jakarta-tomcat</name>
|
|
<range><ge>5.0.*</ge><lt>5.0.30_5</lt></range>
|
|
<range><ge>5.5.*</ge><lt>5.5.7</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Oliver Karow discovered cross-site scripting issues in
|
|
the Apache Jakarta Tomcat manager. The developers refer to
|
|
the issues as <q>minor</q>.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://www.oliverkarow.de/research/jakarta556_xss.txt</url>
|
|
<mlist>http://www.mail-archive.com/tomcat-dev@jakarta.apache.org/msg66978.html</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-01-03</discovery>
|
|
<entry>2005-06-01</entry>
|
|
<modified>2006-09-12</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="84479a62-ca5f-11d9-b772-000c29b00e99">
|
|
<topic>fswiki -- XSS problem in file upload form</topic>
|
|
<affects>
|
|
<package>
|
|
<name>fswiki</name>
|
|
<range><le>3.5.6</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A Secunia security advisory reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/15538">
|
|
<p>A vulnerability has been reported in FreeStyle Wiki and
|
|
FSWikiLite, which can be exploited by malicious people to
|
|
conduct script insertion attacks.</p>
|
|
<p>Input passed in uploaded attachments is not properly
|
|
sanitised before being used. This can be exploited to inject
|
|
arbitrary HTML and script code, which will be executed in a
|
|
user's browser session in context of an affected site when
|
|
the malicious attachment is viewed.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-1799</cvename>
|
|
<url>http://secunia.com/advisories/15538</url>
|
|
<freebsdpr>ports/81520</freebsdpr>
|
|
<url>http://fswiki.poi.jp/wiki.cgi?page=%CD%FA%CE%F2%2F2005%2D5%2D19</url>
|
|
<url>http://jvn.jp/jp/JVN%23465742E4/index.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-05-19</discovery>
|
|
<entry>2005-05-29</entry>
|
|
<modified>2005-06-01</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="2fbe16c2-cab6-11d9-9aed-000e0c2e438a">
|
|
<topic>freeradius -- sql injection and denial of service vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>freeradius</name>
|
|
<range><le>1.0.2_1</le></range>
|
|
</package>
|
|
<package>
|
|
<name>freeradius-devel</name>
|
|
<range><le>1.0.2</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A Gentoo Advisory reports:</p>
|
|
<blockquote cite="http://www.gentoo.org/security/en/glsa/glsa-200505-13.xml">
|
|
<p>The FreeRADIUS server is vulnerable to an SQL injection
|
|
attack and a buffer overflow, possibly resulting in
|
|
disclosure and modification of data and Denial of
|
|
Service.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>13540</bid>
|
|
<bid>13541</bid>
|
|
<url>http://www.gentoo.org/security/en/glsa/glsa-200505-13.xml</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-05-17</discovery>
|
|
<entry>2005-05-22</entry>
|
|
<modified>2008-01-20</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="641e8609-cab5-11d9-9aed-000e0c2e438a">
|
|
<topic>ppxp -- local root exploit</topic>
|
|
<affects>
|
|
<package>
|
|
<name>ppxp</name>
|
|
<range><gt>0</gt></range>
|
|
</package>
|
|
<package>
|
|
<name>ja-ppxp</name>
|
|
<range><gt>0</gt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A Debian Advisory reports:</p>
|
|
<blockquote cite="http://www.debian.org/security/2005/dsa-725">
|
|
<p>Jens Steube discovered that ppxp, yet another PPP program,
|
|
does not release root privileges when opening potentially
|
|
user supplied log files. This can be tricked into opening
|
|
a root shell.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-0392</cvename>
|
|
<url>http://www.debian.org/security/2005/dsa-725</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-05-19</discovery>
|
|
<entry>2005-05-22</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="1033750f-cab4-11d9-9aed-000e0c2e438a">
|
|
<topic>oops -- format string vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>oops</name>
|
|
<range><le>1.5.24</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A RST/GHC Advisory reports that there is an format string
|
|
vulnerability in oops. The vulnerability can be found in
|
|
the MySQL/PgSQL authentication module. Succesful
|
|
exploitation may allow execution of arbitrary code.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>13172</bid>
|
|
<cvename>CVE-2005-1121</cvename>
|
|
<url>http://rst.void.ru/papers/advisory24.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-04-14</discovery>
|
|
<entry>2005-05-22</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="d51a7e6e-c546-11d9-9aed-000e0c2e438a">
|
|
<topic>cdrdao -- unspecified privilege escalation vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>cdrdao</name>
|
|
<range><lt>1.2.0</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The developers of cdrdao report that there is a potential
|
|
root exploit in the software. In order to be able to
|
|
succesfully exploit this vulnerability cdrdao must be
|
|
installed setuid root. When succesfully exploited a local
|
|
user might get escalated privileges. By default this port is
|
|
not installed setuid root.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://secunia.com/advisories/15354/</url>
|
|
<url>http://sourceforge.net/forum/forum.php?forum_id=466399</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-05-13</discovery>
|
|
<entry>2005-05-19</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="ad5e70bb-c429-11d9-ac59-02061b08fc24">
|
|
<topic>gaim -- MSN remote DoS vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>gaim</name>
|
|
<name>ja-gaim</name>
|
|
<name>ko-gaim</name>
|
|
<name>ru-gaim</name>
|
|
<range><lt>1.3.0</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The GAIM team reports:</p>
|
|
<blockquote cite="http://gaim.sourceforge.net/security/index.php?id=17">
|
|
<p>Potential remote denial of service bug resulting from not
|
|
checking a pointer for non-NULL before passing it to
|
|
strncmp, which results in a crash. This can be triggered
|
|
by a remote client sending an SLP message with an empty
|
|
body.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-1262</cvename>
|
|
<url>http://gaim.sourceforge.net/security/index.php?id=17</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-05-10</discovery>
|
|
<entry>2005-05-14</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="889061af-c427-11d9-ac59-02061b08fc24">
|
|
<topic>gaim -- remote crash on some protocols</topic>
|
|
<affects>
|
|
<package>
|
|
<name>gaim</name>
|
|
<name>ja-gaim</name>
|
|
<name>ko-gaim</name>
|
|
<name>ru-gaim</name>
|
|
<range><lt>1.3.0</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The GAIM team reports that GAIM is vulnerable to a
|
|
denial-of-service vulnerability which can cause GAIM to
|
|
crash:</p>
|
|
<blockquote cite="http://gaim.sourceforge.net/security/index.php?id=16">
|
|
<p>It is possible for a remote user to overflow a static
|
|
buffer by sending an IM containing a very large URL
|
|
(greater than 8192 bytes) to the Gaim user. This is not
|
|
possible on all protocols, due to message length
|
|
restrictions. Jabber are SILC are known to be
|
|
vulnerable.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-1261</cvename>
|
|
<url>http://gaim.sourceforge.net/security/index.php?id=16</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-05-10</discovery>
|
|
<entry>2005-05-14</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="180e9a38-060f-4c16-a6b7-49f3505ff22a">
|
|
<topic>kernel -- information disclosure when using HTT</topic>
|
|
<affects>
|
|
<system>
|
|
<name>FreeBSD</name>
|
|
<range><ge>5.4</ge><lt>5.4_1</lt></range>
|
|
<range><ge>5.0</ge><lt>5.3_15</lt></range>
|
|
<range><ge>4.11</ge><lt>4.11_9</lt></range>
|
|
<range><lt>4.10_14</lt></range>
|
|
</system>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<h1>Problem description and impact</h1>
|
|
<p>When running on processors supporting Hyper-Threading Technology, it
|
|
is possible for a malicious thread to monitor the execution of another
|
|
thread.</p>
|
|
<p>Information may be disclosed to local users, allowing in many
|
|
cases for privilege escalation. For example, on a multi-user
|
|
system, it may be possible to steal cryptographic keys used in
|
|
applications such as OpenSSH or SSL-enabled web servers.</p>
|
|
<p><strong>NOTE:</strong> Similar problems may exist in other
|
|
simultaneous multithreading implementations, or even some
|
|
systems in the absence of simultaneous multithreading.
|
|
However, current research has only demonstrated this flaw in
|
|
Hyper-Threading Technology, where shared memory caches are
|
|
used.</p>
|
|
<h1>Workaround</h1>
|
|
<p>Systems not using processors with Hyper-Threading Technology
|
|
support are not affected by this issue. On systems which are
|
|
affected, the security flaw can be eliminated by setting the
|
|
"machdep.hlt_logical_cpus" tunable:</p>
|
|
<pre># echo "machdep.hlt_logical_cpus=1" >> /boot/loader.conf</pre>
|
|
<p>The system must be rebooted in order for tunables to take effect.</p>
|
|
<p>Use of this workaround is not recommended on "dual-core" systems, as
|
|
this workaround will also disable one of the processor
|
|
cores.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-0109</cvename>
|
|
<freebsdsa>SA-05:09.htt</freebsdsa>
|
|
<url>http://www.daemonology.net/hyperthreading-considered-harmful/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-05-13</discovery>
|
|
<entry>2005-05-13</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="66dbb2ee-99b8-45b2-bb3e-640caea67a60">
|
|
<topic>leafnode -- fetchnews denial-of-service triggered by transmission abort/timeout</topic>
|
|
<affects>
|
|
<package>
|
|
<name>leafnode</name>
|
|
<range><ge>1.9.48</ge><lt>1.11.2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>When an upstream server aborts the transmission or stops sending
|
|
data after the fetchnews program has requested an article header
|
|
or body, fetchnews may crash, without querying further servers
|
|
that are configured. This can prevent articles from being fetched.
|
|
</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://leafnode.sourceforge.net/leafnode-SA-2005-01.txt</url>
|
|
<cvename>CVE-2005-1453</cvename>
|
|
<freebsdpr>ports/80663</freebsdpr>
|
|
<bid>13489</bid>
|
|
<bid>13492</bid>
|
|
<mlist msgid="20050504152311.GA25593@merlin.emma.line.org">http://sourceforge.net/mailarchive/forum.php?thread_id=7186974&forum_id=10210</mlist>
|
|
<mlist msgid="20050504152311.GA25593@merlin.emma.line.org">http://article.gmane.org/gmane.network.leafnode.announce/52</mlist>
|
|
<mlist msgid="20050504152311.GA25593@merlin.emma.line.org">http://www.dt.e-technik.uni-dortmund.de/pipermail/leafnode-list/2005q2/000900.html</mlist>
|
|
<mlist msgid="20050504152311.GA25593@merlin.emma.line.org">http://www.fredi.de/maillist/msg00111.html</mlist>
|
|
<mlist msgid="20050504152311.GA25593@merlin.emma.line.org">http://archives.neohapsis.com/archives/vulnwatch/2005-q2/0037.html</mlist>
|
|
<url>http://www.frsirt.com/english/advisories/2005/0468</url>
|
|
<url>http://secunia.com/advisories/15252</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-05-04</discovery>
|
|
<entry>2005-05-13</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="a6427195-c2c7-11d9-89f7-02061b08fc24">
|
|
<topic>mozilla -- privilege escalation via non-DOM property overrides</topic>
|
|
<affects>
|
|
<package>
|
|
<name>firefox</name>
|
|
<range><lt>1.0.4,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-firefox</name>
|
|
<range><lt>1.0.4</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>mozilla</name>
|
|
<range><lt>1.7.8,2</lt></range>
|
|
<range><ge>1.8.*,2</ge></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-mozilla</name>
|
|
<name>linux-mozilla-devel</name>
|
|
<range><lt>1.7.8</lt></range>
|
|
<range><ge>1.8.*</ge></range>
|
|
</package>
|
|
<package>
|
|
<name>netscape7</name>
|
|
<range><ge>0</ge></range>
|
|
</package>
|
|
<package>
|
|
<!-- These ports are obsolete. -->
|
|
<name>de-linux-mozillafirebird</name>
|
|
<name>el-linux-mozillafirebird</name>
|
|
<name>ja-linux-mozillafirebird-gtk1</name>
|
|
<name>ja-mozillafirebird-gtk2</name>
|
|
<name>linux-mozillafirebird</name>
|
|
<name>ru-linux-mozillafirebird</name>
|
|
<name>zhCN-linux-mozillafirebird</name>
|
|
<name>zhTW-linux-mozillafirebird</name>
|
|
<range><ge>0</ge></range>
|
|
</package>
|
|
<package>
|
|
<!-- These package names are obsolete. -->
|
|
<name>de-linux-netscape</name>
|
|
<name>de-netscape7</name>
|
|
<name>fr-linux-netscape</name>
|
|
<name>fr-netscape7</name>
|
|
<name>ja-linux-netscape</name>
|
|
<name>ja-netscape7</name>
|
|
<name>linux-netscape</name>
|
|
<name>linux-phoenix</name>
|
|
<name>mozilla+ipv6</name>
|
|
<name>mozilla-embedded</name>
|
|
<name>mozilla-firebird</name>
|
|
<name>mozilla-gtk1</name>
|
|
<name>mozilla-gtk2</name>
|
|
<name>mozilla-gtk</name>
|
|
<name>mozilla-thunderbird</name>
|
|
<name>phoenix</name>
|
|
<name>pt_BR-netscape7</name>
|
|
<range><ge>0</ge></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A Mozilla Foundation Security Advisory reports:</p>
|
|
<blockquote cite="http://www.mozilla.org/security/announce/mfsa2005-44.html">
|
|
<p>Additional checks were added to make sure Javascript eval
|
|
and Script objects are run with the privileges of the
|
|
context that created them, not the potentially elevated
|
|
privilege of the context calling them in order to protect
|
|
against an additional variant of <a href="http://www.mozilla.org/security/announce/mfsa2005-41.html">MFSA
|
|
2005-41</a>.</p>
|
|
</blockquote>
|
|
<p>The Mozilla Foundation Security Advisory MFSA 2005-41
|
|
reports:</p>
|
|
<blockquote cite="http://www.mozilla.org/security/announce/mfsa2005-41.html">
|
|
<p>moz_bug_r_a4 reported several exploits giving an attacker
|
|
the ability to install malicious code or steal data,
|
|
requiring only that the user do commonplace actions like
|
|
click on a link or open the context menu.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://www.mozilla.org/security/announce/mfsa2005-44.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-05-11</discovery>
|
|
<entry>2005-05-12</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="a81746a1-c2c7-11d9-89f7-02061b08fc24">
|
|
<topic>mozilla -- "Wrapped" javascript: urls bypass security checks</topic>
|
|
<affects>
|
|
<package>
|
|
<name>firefox</name>
|
|
<range><lt>1.0.4,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-firefox</name>
|
|
<range><lt>1.0.4</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>mozilla</name>
|
|
<range><lt>1.7.8,2</lt></range>
|
|
<range><ge>1.8.*,2</ge></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-mozilla</name>
|
|
<name>linux-mozilla-devel</name>
|
|
<range><lt>1.7.8</lt></range>
|
|
<range><ge>1.8.*</ge></range>
|
|
</package>
|
|
<package>
|
|
<name>netscape7</name>
|
|
<range><ge>0</ge></range>
|
|
</package>
|
|
<package>
|
|
<!-- These ports are obsolete. -->
|
|
<name>de-linux-mozillafirebird</name>
|
|
<name>el-linux-mozillafirebird</name>
|
|
<name>ja-linux-mozillafirebird-gtk1</name>
|
|
<name>ja-mozillafirebird-gtk2</name>
|
|
<name>linux-mozillafirebird</name>
|
|
<name>ru-linux-mozillafirebird</name>
|
|
<name>zhCN-linux-mozillafirebird</name>
|
|
<name>zhTW-linux-mozillafirebird</name>
|
|
<range><ge>0</ge></range>
|
|
</package>
|
|
<package>
|
|
<!-- These package names are obsolete. -->
|
|
<name>de-linux-netscape</name>
|
|
<name>de-netscape7</name>
|
|
<name>fr-linux-netscape</name>
|
|
<name>fr-netscape7</name>
|
|
<name>ja-linux-netscape</name>
|
|
<name>ja-netscape7</name>
|
|
<name>linux-netscape</name>
|
|
<name>linux-phoenix</name>
|
|
<name>mozilla+ipv6</name>
|
|
<name>mozilla-embedded</name>
|
|
<name>mozilla-firebird</name>
|
|
<name>mozilla-gtk1</name>
|
|
<name>mozilla-gtk2</name>
|
|
<name>mozilla-gtk</name>
|
|
<name>mozilla-thunderbird</name>
|
|
<name>phoenix</name>
|
|
<name>pt_BR-netscape7</name>
|
|
<range><ge>0</ge></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A Mozilla Foundation Security Advisory reports:</p>
|
|
<blockquote cite="http://www.mozilla.org/security/announce/mfsa2005-43.html">
|
|
<p>Some security checks intended to prevent script injection
|
|
were incorrect and could be bypassed by wrapping a
|
|
javascript: url in the view-source:
|
|
pseudo-protocol. Michael Krax demonstrated that a variant
|
|
of his <a href="http://www.mozilla.org/security/announce/mfsa2005-37.html">favicon</a>
|
|
exploit could still execute arbitrary code, and the same
|
|
technique could also be used to perform cross-site
|
|
scripting.</p>
|
|
<p>Georgi Guninski demonstrated the same flaw wrapping
|
|
javascript: urls with the jar: pseudo-protocol.</p>
|
|
<p>L. David Baron discovered a nested variant that defeated
|
|
checks in the script security manager.</p>
|
|
<p><strong>Workaround:</strong> Disable Javascript</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://www.mozilla.org/security/announce/mfsa2005-43.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-05-11</discovery>
|
|
<entry>2005-05-12</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="eca6195a-c233-11d9-804c-02061b08fc24">
|
|
<topic>mozilla -- code execution via javascript: IconURL vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>firefox</name>
|
|
<range><lt>1.0.4,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-firefox</name>
|
|
<range><lt>1.0.4</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>mozilla</name>
|
|
<range><lt>1.7.8,2</lt></range>
|
|
<range><ge>1.8.*,2</ge></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-mozilla</name>
|
|
<name>linux-mozilla-devel</name>
|
|
<range><lt>1.7.8</lt></range>
|
|
<range><ge>1.8.*</ge></range>
|
|
</package>
|
|
<package>
|
|
<name>netscape7</name>
|
|
<range><ge>0</ge></range>
|
|
</package>
|
|
<package>
|
|
<!-- These ports are obsolete. -->
|
|
<name>de-linux-mozillafirebird</name>
|
|
<name>el-linux-mozillafirebird</name>
|
|
<name>ja-linux-mozillafirebird-gtk1</name>
|
|
<name>ja-mozillafirebird-gtk2</name>
|
|
<name>linux-mozillafirebird</name>
|
|
<name>ru-linux-mozillafirebird</name>
|
|
<name>zhCN-linux-mozillafirebird</name>
|
|
<name>zhTW-linux-mozillafirebird</name>
|
|
<range><ge>0</ge></range>
|
|
</package>
|
|
<package>
|
|
<!-- These package names are obsolete. -->
|
|
<name>de-linux-netscape</name>
|
|
<name>de-netscape7</name>
|
|
<name>fr-linux-netscape</name>
|
|
<name>fr-netscape7</name>
|
|
<name>ja-linux-netscape</name>
|
|
<name>ja-netscape7</name>
|
|
<name>linux-netscape</name>
|
|
<name>linux-phoenix</name>
|
|
<name>mozilla+ipv6</name>
|
|
<name>mozilla-embedded</name>
|
|
<name>mozilla-firebird</name>
|
|
<name>mozilla-gtk1</name>
|
|
<name>mozilla-gtk2</name>
|
|
<name>mozilla-gtk</name>
|
|
<name>mozilla-thunderbird</name>
|
|
<name>phoenix</name>
|
|
<name>pt_BR-netscape7</name>
|
|
<range><ge>0</ge></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A Mozilla Foundation Security Advisory reports:</p>
|
|
<blockquote cite="http://www.mozilla.org/security/announce/mfsa2005-42.html">
|
|
<p>Two vulnerabilities have been discovered in Firefox,
|
|
which can be exploited by malicious people to conduct
|
|
cross-site scripting attacks and compromise a user's
|
|
system.</p>
|
|
<ol>
|
|
<li>The problem is that "IFRAME" JavaScript URLs are not
|
|
properly protected from being executed in context of
|
|
another URL in the history list. This can be exploited
|
|
to execute arbitrary HTML and script code in a user's
|
|
browser session in context of an arbitrary site.</li>
|
|
<li>Input passed to the "IconURL" parameter in
|
|
"InstallTrigger.install()" is not properly verified
|
|
before being used. This can be exploited to execute
|
|
arbitrary JavaScript code with escalated privileges via
|
|
a specially crafted JavaScript URL.</li>
|
|
</ol>
|
|
<p>Successful exploitation requires that the site is allowed
|
|
to install software (default sites are
|
|
"update.mozilla.org" and "addons.mozilla.org").</p>
|
|
<p>A combination of vulnerability 1 and 2 can be exploited
|
|
to execute arbitrary code.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-1476</cvename>
|
|
<cvename>CVE-2005-1477</cvename>
|
|
<url>http://www.mozilla.org/security/announce/mfsa2005-42.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-05-08</discovery>
|
|
<entry>2005-05-11</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="01bb84e2-bd88-11d9-a281-02e018374e71">
|
|
<topic>groff -- pic2graph and eqn2graph are vulnerable to symlink attack through temporary files</topic>
|
|
<affects>
|
|
<package>
|
|
<name>ja-groff</name>
|
|
<range><ge>1.18.1</ge><lt>1.18.1_8</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The eqn2graph and pic2graph scripts in groff 1.18.1
|
|
allow local users to overwrite arbitrary files via
|
|
a symlink attack on temporary files.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<freebsdpr>ports/80671</freebsdpr>
|
|
<bid>12058</bid>
|
|
<cvename>CVE-2004-1296</cvename>
|
|
<url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=286371</url>
|
|
<url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=286372</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-12-20</discovery>
|
|
<entry>2005-05-09</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="169f422f-bd88-11d9-a281-02e018374e71">
|
|
<topic>groff -- groffer uses temporary files unsafely</topic>
|
|
<affects>
|
|
<package>
|
|
<name>ja-groff</name>
|
|
<range><ge>1.18</ge><lt>1.18.1_8</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The groffer script in the groff package 1.18 and later versions
|
|
allows local users to overwrite files via a symlink attack
|
|
on temporary files.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<freebsdpr>ports/80671</freebsdpr>
|
|
<bid>11287</bid>
|
|
<cvename>CVE-2004-0969</cvename>
|
|
<url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=278265</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-09-30</discovery>
|
|
<entry>2005-05-09</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="5f003a08-ba3c-11d9-837d-000e0c2e438a">
|
|
<topic>sharutils -- unshar insecure temporary file creation</topic>
|
|
<affects>
|
|
<package>
|
|
<name>sharutils</name>
|
|
<range><lt>4.3.80</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>An Ubuntu Advisory reports:</p>
|
|
<blockquote cite="http://www.ubuntulinux.org/support/documentation/usn/usn-104-1">
|
|
<p>Joey Hess discovered that "unshar" created temporary files
|
|
in an insecure manner. This could allow a symbolic link
|
|
attack to create or overwrite arbitrary files with the
|
|
privileges of the user invoking the program.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>12981</bid>
|
|
<cvename>CVE-2005-0990</cvename>
|
|
<url>http://www.ubuntulinux.org/support/documentation/usn/usn-104-1</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-04-04</discovery>
|
|
<entry>2005-05-01</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="8c5ad0cf-ba37-11d9-837d-000e0c2e438a">
|
|
<topic>rsnapshot -- local privilege escalation</topic>
|
|
<affects>
|
|
<package>
|
|
<name>rsnapshot</name>
|
|
<range><lt>1.1.7</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>An rsnapshot Advisory reports:</p>
|
|
<blockquote cite="http://www.rsnapshot.org/security/2005/001.html">
|
|
<p>The copy_symlink() subroutine in rsnapshot incorrectly
|
|
changes file ownership on the files pointed to by symlinks,
|
|
not on the symlinks themselves. This would allow, under
|
|
certain circumstances, an arbitrary user to take ownership
|
|
of a file on the main filesystem.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>13095</bid>
|
|
<cvename>CVE-2005-1064</cvename>
|
|
<url>http://www.rsnapshot.org/security/2005/001.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-04-10</discovery>
|
|
<entry>2005-05-01</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="756db070-b9d4-11d9-ae81-000ae42e9b93">
|
|
<topic>coppermine -- IP spoofing and XSS vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>coppermine</name>
|
|
<range><lt>1.3.2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>GHC team reports about coppermine</p>
|
|
<blockquote cite="http://www.securityfocus.com/archive/1/396080">
|
|
<p>The lack of sanitizing of user defined variables may
|
|
result in undesirable consequences such as IP spoofing
|
|
or XSS attack.</p>
|
|
<p>Generally users of Coppermine Gallery can post comments.
|
|
Remote address & x-forwarded-for variables are logged
|
|
for admin's eyes. X-Forwarded-for variable does not pass
|
|
throu any filtration before logging into database. User
|
|
can define/redefine this variable.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<mlist msgid="20050418122434.10438.qmail@www.securityfocus.com">http://www.securityfocus.com/archive/1/396080</mlist>
|
|
<bid>13218</bid>
|
|
<cvename>CVE-2005-1172</cvename>
|
|
<url>http://coppermine.sourceforge.net/board/index.php?topic=17134.0</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-04-18</discovery>
|
|
<entry>2005-05-01</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="cd286cc5-b762-11d9-bfb7-000c6ec775d9">
|
|
<topic>ImageMagick -- ReadPNMImage() heap overflow vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>ImageMagick</name>
|
|
<name>ImageMagick-nox11</name>
|
|
<range><lt>6.2.2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Damian Put reports about ImageMagick:</p>
|
|
<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&m=111445767107869">
|
|
<p>Remote exploitation of a heap overflow vulnerability
|
|
could allow execution of arbitrary code or course denial
|
|
of service.</p>
|
|
<p>A heap overflow exists in ReadPNMImage() function, that
|
|
is used to decode a PNM image files.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>13351</bid>
|
|
<url>http://marc.theaimsgroup.com/?l=bugtraq&m=111445767107869</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-04-25</discovery>
|
|
<entry>2005-04-27</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="91c606fc-b5d0-11d9-a788-0001020eed82">
|
|
<topic>mplayer & libxine -- MMS and Real RTSP buffer overflow vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>mplayer</name>
|
|
<name>mplayer-gtk</name>
|
|
<name>mplayer-gtk2</name>
|
|
<name>mplayer-esound</name>
|
|
<name>mplayer-gtk-esound</name>
|
|
<name>mplayer-gtk2-esound</name>
|
|
<range><lt>0.99.7</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>libxine</name>
|
|
<range><ge>0.9.9</ge><lt>1.0.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A xine security announcement reports:</p>
|
|
<blockquote cite="http://xinehq.de/index.php/security/XSA-2004-8">
|
|
<p>By a user receiving data from a malicious network
|
|
streaming server, an attacker can overrun a heap buffer,
|
|
which can, on some systems, lead to or help in executing
|
|
attacker-chosen malicious code with the permissions of the
|
|
user running a xine-lib based media application.</p>
|
|
<p>Both the MMS and Real RTSP streaming client code made
|
|
some too-strong assumptions on the transferred
|
|
data. Several critical bounds checks were missing,
|
|
resulting in the possibility of heap overflows, should the
|
|
remote server not adhere to these assumptions. In the MMS
|
|
case, a remote server could present content with too many
|
|
individual streams; in the RTSP case, a remote server's
|
|
reply could have too many lines.</p>
|
|
<p>An attacker can set up a server delivering malicious data
|
|
to the users. This can be used to overflow a heap buffer,
|
|
which can, with certain implementations of heap
|
|
management, lead to attacker chosen data written to the
|
|
stack. This can cause attacker-chosen code being executed
|
|
with the permissions of the user running the
|
|
application. By tricking users to retrieve a stream, which
|
|
can be as easy as providing a link on a website, this
|
|
vulnerability can be exploited remotely.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>13270</bid>
|
|
<bid>13271</bid>
|
|
<cvename>CVE-2005-1195</cvename>
|
|
<url>http://www.mplayerhq.hu/homepage/design7/news.html#vuln10</url>
|
|
<url>http://www.mplayerhq.hu/homepage/design7/news.html#vuln11</url>
|
|
<url>http://xinehq.de/index.php/security/XSA-2004-8</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-04-16</discovery>
|
|
<entry>2005-04-25</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="8b0e94cc-b5cd-11d9-a788-0001020eed82">
|
|
<topic>gaim -- AIM/ICQ remote denial of service vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>gaim</name>
|
|
<name>ja-gaim</name>
|
|
<name>ko-gaim</name>
|
|
<name>ru-gaim</name>
|
|
<range><lt>1.1.3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The GAIM team reports that GAIM is vulnerable to a
|
|
denial-of-service vulnerability which can cause GAIM to
|
|
freeze:</p>
|
|
<blockquote cite="http://gaim.sourceforge.net/security/index.php?id=10">
|
|
<p>Certain malformed SNAC packets sent by other AIM or ICQ
|
|
users can trigger an infinite loop in Gaim when parsing
|
|
the SNAC. The remote user would need a custom client, able
|
|
to generate malformed SNACs.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-0472</cvename>
|
|
<url>http://gaim.sourceforge.net/security/index.php?id=10</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-02-17</discovery>
|
|
<entry>2005-04-25</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="142353df-b5cc-11d9-a788-0001020eed82">
|
|
<topic>gaim -- remote DoS on receiving malformed HTML</topic>
|
|
<affects>
|
|
<package>
|
|
<name>gaim</name>
|
|
<name>ja-gaim</name>
|
|
<name>ko-gaim</name>
|
|
<name>ru-gaim</name>
|
|
<range><lt>1.1.4</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The GAIM team reports:</p>
|
|
<blockquote cite="http://gaim.sourceforge.net/security/index.php?id=12">
|
|
<p>Receiving malformed HTML can result in an invalid memory
|
|
access causing Gaim to crash.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-0208</cvename>
|
|
<cvename>CVE-2005-0473</cvename>
|
|
<url>http://gaim.sourceforge.net/security/index.php?id=11</url>
|
|
<url>http://gaim.sourceforge.net/security/index.php?id=12</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-02-17</discovery>
|
|
<entry>2005-04-25</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="91f1adc7-b3e9-11d9-a788-0001020eed82">
|
|
<topic>kdewebdev -- kommander untrusted code execution vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>kdewebdev</name>
|
|
<range><gt>3.2,2</gt><lt>3.4.0_1,2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A KDE Security Advisory reports:</p>
|
|
<blockquote cite="http://www.kde.org/info/security/advisory-20050420-1.txt">
|
|
<p>Kommander executes without user confirmation data files
|
|
from possibly untrusted locations. As they contain
|
|
scripts, the user might accidentally run arbitrary
|
|
code.</p>
|
|
<p><strong>Impact:</strong> Remotly supplied kommander files
|
|
from untrusted sources are executed without
|
|
confirmation.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-0754</cvename>
|
|
<url>http://www.kde.org/info/security/advisory-20050420-1.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-04-20</discovery>
|
|
<entry>2005-04-23</entry>
|
|
<modified>2008-08-04</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="97edf5ab-b319-11d9-837d-000e0c2e438a">
|
|
<topic>junkbuster -- heap corruption vulnerability and configuration modification vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>junkbuster</name>
|
|
<range><lt>2.0.2_3</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>junkbuster-zlib</name>
|
|
<range><gt>0</gt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A Debian advisory reports:</p>
|
|
<blockquote cite="http://www.debian.org/security/2005/dsa-713">
|
|
<p>James Ranson discovered that an attacker can modify the
|
|
referrer setting with a carefully crafted URL by accidently
|
|
overwriting a global variable.</p>
|
|
<p>Tavis Ormandy from the Gentoo Security Team discovered
|
|
several heap corruptions due to inconsistent use of an
|
|
internal function that can crash the daemon or possibly
|
|
lead to the execution of arbitrary code.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>13146</bid>
|
|
<bid>13147</bid>
|
|
<cvename>CVE-2005-1108</cvename>
|
|
<cvename>CVE-2005-1109</cvename>
|
|
<url>http://www.debian.org/security/2005/dsa-713</url>
|
|
<url>http://www.gentoo.org/security/en/glsa/glsa-200504-11.xml</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-04-13</discovery>
|
|
<entry>2005-04-22</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="06404241-b306-11d9-a788-0001020eed82">
|
|
<topic>kdelibs -- kimgio input validation errors</topic>
|
|
<affects>
|
|
<package>
|
|
<name>kdelibs</name>
|
|
<range><ge>3.2</ge><lt>3.4.0_2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A KDE Security Advisory reports:</p>
|
|
<blockquote cite="http://www.kde.org/info/security/advisory-20050421-1.txt">
|
|
<p>kimgio contains a PCX image file format reader that does
|
|
not properly perform input validation. A source code audit
|
|
performed by the KDE security team discovered several
|
|
vulnerabilities in the PCX and other image file format
|
|
readers, some of them exploitable to execute arbitrary
|
|
code.</p>
|
|
<p><strong>Impact:</strong> Remotely supplied, specially
|
|
crafted image files can be used to execute arbitrary
|
|
code.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-1046</cvename>
|
|
<url>http://bugs.kde.org/102328</url>
|
|
<url>http://www.kde.org/info/security/advisory-20050421-1.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-04-21</discovery>
|
|
<entry>2005-04-22</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="6c2d4f29-af3e-11d9-837d-000e0c2e438a">
|
|
<topic>gld -- format string and buffer overflow vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>gld</name>
|
|
<range><lt>1.5</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Gld has been found vulnerable to multiple buffer overflows as
|
|
well as multiple format string vulnerabilities.</p>
|
|
<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&m=111339935903880">
|
|
<p>An attacker could exploit this vulnerability to execute
|
|
arbitrary code with the permissions of the user running Gld,
|
|
the default user being root.</p>
|
|
</blockquote>
|
|
<p>The FreeBSD port defaults to running gld as the root user.
|
|
The risk of exploitation can be minimized by making gld
|
|
listen on the loopback address only, or configure it to only
|
|
accept connections from trusted smtp servers.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>13129</bid>
|
|
<bid>13133</bid>
|
|
<cvename>CVE-2005-1099</cvename>
|
|
<cvename>CVE-2005-1100</cvename>
|
|
<mlist msgid="20050412004111.562AC7A890E@ws4-4.us4.outblaze.com">http://marc.theaimsgroup.com/?l=bugtraq&m=111339935903880</mlist>
|
|
<mlist msgid="20050413174736.20947.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&m=111342432325670</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-04-12</discovery>
|
|
<entry>2005-04-19</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="0163b498-af54-11d9-acd0-000854d03344">
|
|
<topic>axel -- remote buffer overflow</topic>
|
|
<affects>
|
|
<package>
|
|
<name>axel</name>
|
|
<range><lt>1.0a_4</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A Debian Security Advisory reports:</p>
|
|
<blockquote cite="http://www.debian.org/security/2005/dsa-706">
|
|
<p>Ulf Härnhammar from the Debian Security Audit Project
|
|
discovered a buffer overflow in axel, a light download
|
|
accelerator. When reading remote input the program did
|
|
not check if a part of the input can overflow a buffer
|
|
and maybe trigger the execution of arbitrary code.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>13059</bid>
|
|
<cvename>CVE-2005-0390</cvename>
|
|
<url>http://www.debian.org/security/2005/dsa-706</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-04-16</discovery>
|
|
<entry>2005-04-17</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="ce6ac624-aec8-11d9-a788-0001020eed82">
|
|
<topic>firefox -- PLUGINSPAGE privileged javascript execution</topic>
|
|
<affects>
|
|
<package>
|
|
<name>firefox</name>
|
|
<range><lt>1.0.3,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-firefox</name>
|
|
<range><lt>1.0.3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A Mozilla Foundation Security Advisory reports:</p>
|
|
<blockquote cite="http://www.mozilla.org/security/announce/mfsa2005-34.html">
|
|
<p>When a webpage requires a plugin that is not installed
|
|
the user can click to launch the Plugin Finder Service
|
|
(PFS) to find an appropriate plugin. If the service does
|
|
not have an appropriate plugin the EMBED tag is checked
|
|
for a PLUGINSPAGE attribute, and if one is found the PFS
|
|
dialog will contain a "manual install" button that will
|
|
load the PLUGINSPAGE url.</p>
|
|
<p>Omar Khan reported that if the PLUGINSPAGE attribute
|
|
contains a javascript: url then pressing the button could
|
|
launch arbitrary code capable of stealing local data or
|
|
installing malicious code.</p>
|
|
<p>Doron Rosenberg reported a variant that injects script by
|
|
appending it to a malformed URL of any protocol.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-0752</cvename>
|
|
<url>http://www.mozilla.org/security/announce/mfsa2005-34.html</url>
|
|
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=288556</url>
|
|
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=289171</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-03-31</discovery>
|
|
<entry>2005-04-16</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="18e5428f-ae7c-11d9-837d-000e0c2e438a">
|
|
<topic>jdk -- jar directory traversal vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>jdk</name>
|
|
<range><le>1.2.2p11_3</le></range>
|
|
<range><ge>1.3.*</ge><le>1.3.1p9_4</le></range>
|
|
<range><ge>1.4.*</ge><le>1.4.2p7</le></range>
|
|
<range><ge>1.5.*</ge><le>1.5.0p1_1</le></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-ibm-jdk</name>
|
|
<range><le>1.4.2_1</le></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-sun-jdk</name>
|
|
<range><le>1.4.2.08_1</le></range>
|
|
<range><eq>1.5.0b1</eq></range>
|
|
<range><eq>1.5.0b1,1</eq></range>
|
|
<range><ge>1.5.0,2</ge><le>1.5.0.02,2</le></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-blackdown-jdk</name>
|
|
<range><le>1.4.2_2</le></range>
|
|
</package>
|
|
<package>
|
|
<name>diablo-jdk</name>
|
|
<range><le>1.3.1.0_1</le></range>
|
|
</package>
|
|
<package>
|
|
<name>diablo-jdk-freebsd6</name>
|
|
<range><le>i386.1.5.0.07.00</le></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-jdk</name>
|
|
<range><ge>0</ge></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Pluf has discovered a vulnerability in Sun Java JDK/SDK,
|
|
which potentially can be exploited by malicious people to
|
|
compromise a user's system.</p>
|
|
<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&m=111331593310508">
|
|
<p>The jar tool does not check properly if the files to be
|
|
extracted have the string "../" on its names, so it's
|
|
possible for an attacker to create a malicious jar file in
|
|
order to overwrite arbitrary files within the filesystem.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-1080</cvename>
|
|
<mlist msgid="200504120226.10559.pluf@7a69ezine.org">http://marc.theaimsgroup.com/?l=bugtraq&m=111331593310508</mlist>
|
|
<url>http://www.securiteam.com/securitynews/5IP0C0AFGW.html</url>
|
|
<url>http://secunia.com/advisories/14902/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-04-11</discovery>
|
|
<entry>2005-04-16</entry>
|
|
<modified>2006-09-12</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="f650d5b8-ae62-11d9-a788-0001020eed82">
|
|
<topic>mozilla -- privilege escalation via DOM property overrides</topic>
|
|
<affects>
|
|
<package>
|
|
<name>firefox</name>
|
|
<range><lt>1.0.3,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-firefox</name>
|
|
<range><lt>1.0.3</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>mozilla</name>
|
|
<range><lt>1.7.7,2</lt></range>
|
|
<range><ge>1.8.*,2</ge></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-mozilla</name>
|
|
<name>linux-mozilla-devel</name>
|
|
<range><lt>1.7.7</lt></range>
|
|
<range><ge>1.8.*</ge></range>
|
|
</package>
|
|
<package>
|
|
<name>netscape7</name>
|
|
<range><ge>0</ge></range>
|
|
</package>
|
|
<package>
|
|
<!-- These ports are obsolete. -->
|
|
<name>de-linux-mozillafirebird</name>
|
|
<name>el-linux-mozillafirebird</name>
|
|
<name>ja-linux-mozillafirebird-gtk1</name>
|
|
<name>ja-mozillafirebird-gtk2</name>
|
|
<name>linux-mozillafirebird</name>
|
|
<name>ru-linux-mozillafirebird</name>
|
|
<name>zhCN-linux-mozillafirebird</name>
|
|
<name>zhTW-linux-mozillafirebird</name>
|
|
<range><ge>0</ge></range>
|
|
</package>
|
|
<package>
|
|
<!-- These package names are obsolete. -->
|
|
<name>de-linux-netscape</name>
|
|
<name>de-netscape7</name>
|
|
<name>fr-linux-netscape</name>
|
|
<name>fr-netscape7</name>
|
|
<name>ja-linux-netscape</name>
|
|
<name>ja-netscape7</name>
|
|
<name>linux-netscape</name>
|
|
<name>linux-phoenix</name>
|
|
<name>mozilla+ipv6</name>
|
|
<name>mozilla-embedded</name>
|
|
<name>mozilla-firebird</name>
|
|
<name>mozilla-gtk1</name>
|
|
<name>mozilla-gtk2</name>
|
|
<name>mozilla-gtk</name>
|
|
<name>mozilla-thunderbird</name>
|
|
<name>phoenix</name>
|
|
<name>pt_BR-netscape7</name>
|
|
<range><ge>0</ge></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A Mozilla Foundation Security Advisory reports:</p>
|
|
<blockquote cite="http://www.mozilla.org/security/announce/mfsa2005-41.html">
|
|
<p>moz_bug_r_a4 reported several exploits giving an attacker
|
|
the ability to install malicious code or steal data,
|
|
requiring only that the user do commonplace actions like
|
|
click on a link or open the context menu. The common cause
|
|
in each case was privileged UI code ("chrome") being
|
|
overly trusting of DOM nodes from the content
|
|
window. Scripts in the web page can override properties
|
|
and methods of DOM nodes and shadow the native values,
|
|
unless steps are taken to get the true underlying values.</p>
|
|
<p>We found that most extensions also interacted with
|
|
content DOM in a natural, but unsafe, manner. Changes were
|
|
made so that chrome code using this natural DOM coding
|
|
style will now automatically use the native DOM value if
|
|
it exists without having to use cumbersome wrapper
|
|
objects.</p>
|
|
<p>Most of the specific exploits involved tricking the
|
|
privileged code into calling eval() on an
|
|
attacker-supplied script string, or the equivalent using
|
|
the Script() object. Checks were added in the security
|
|
manager to make sure eval and Script objects are run with
|
|
the privileges of the context that created them, not the
|
|
potentially elevated privileges of the context calling
|
|
them.</p>
|
|
<p><strong>Workaround</strong>: Disable Javascript</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://www.mozilla.org/security/announce/mfsa2005-41.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-04-15</discovery>
|
|
<entry>2005-04-16</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="1989b511-ae62-11d9-a788-0001020eed82">
|
|
<topic>mozilla -- code execution through javascript: favicons</topic>
|
|
<affects>
|
|
<package>
|
|
<name>firefox</name>
|
|
<range><lt>1.0.3,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-firefox</name>
|
|
<range><lt>1.0.3</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>mozilla</name>
|
|
<range><lt>1.7.7,2</lt></range>
|
|
<range><ge>1.8.*,2</ge></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-mozilla</name>
|
|
<name>linux-mozilla-devel</name>
|
|
<range><lt>1.7.7</lt></range>
|
|
<range><ge>1.8.*</ge></range>
|
|
</package>
|
|
<package>
|
|
<name>netscape7</name>
|
|
<range><ge>0</ge></range>
|
|
</package>
|
|
<package>
|
|
<!-- These ports are obsolete. -->
|
|
<name>de-linux-mozillafirebird</name>
|
|
<name>el-linux-mozillafirebird</name>
|
|
<name>ja-linux-mozillafirebird-gtk1</name>
|
|
<name>ja-mozillafirebird-gtk2</name>
|
|
<name>linux-mozillafirebird</name>
|
|
<name>ru-linux-mozillafirebird</name>
|
|
<name>zhCN-linux-mozillafirebird</name>
|
|
<name>zhTW-linux-mozillafirebird</name>
|
|
<range><ge>0</ge></range>
|
|
</package>
|
|
<package>
|
|
<!-- These package names are obsolete. -->
|
|
<name>de-linux-netscape</name>
|
|
<name>de-netscape7</name>
|
|
<name>fr-linux-netscape</name>
|
|
<name>fr-netscape7</name>
|
|
<name>ja-linux-netscape</name>
|
|
<name>ja-netscape7</name>
|
|
<name>linux-netscape</name>
|
|
<name>linux-phoenix</name>
|
|
<name>mozilla+ipv6</name>
|
|
<name>mozilla-embedded</name>
|
|
<name>mozilla-firebird</name>
|
|
<name>mozilla-gtk1</name>
|
|
<name>mozilla-gtk2</name>
|
|
<name>mozilla-gtk</name>
|
|
<name>mozilla-thunderbird</name>
|
|
<name>phoenix</name>
|
|
<name>pt_BR-netscape7</name>
|
|
<range><ge>0</ge></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A Mozilla Foundation Security Advisory reports:</p>
|
|
<blockquote cite="http://www.mozilla.org/security/announce/mfsa2005-37.html">
|
|
<p>Firefox and the Mozilla Suite support custom "favicons"
|
|
through the <LINK rel="icon"> tag. If a link tag is added
|
|
to the page programmatically and a javascript: url is
|
|
used, then script will run with elevated privileges and
|
|
could run or install malicious software.</p>
|
|
<p><strong>Workaround</strong>: Disable Javascript</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://www.mozilla.org/security/announce/mfsa2005-37.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-04-12</discovery>
|
|
<entry>2005-04-16</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="45b75152-ae5f-11d9-a788-0001020eed82">
|
|
<topic>mozilla -- javascript "lambda" replace exposes memory contents</topic>
|
|
<affects>
|
|
<package>
|
|
<name>firefox</name>
|
|
<range><lt>1.0.3,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-firefox</name>
|
|
<range><lt>1.0.3</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>mozilla</name>
|
|
<range><lt>1.7.7,2</lt></range>
|
|
<range><ge>1.8.*,2</ge></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-mozilla</name>
|
|
<name>linux-mozilla-devel</name>
|
|
<range><lt>1.7.7</lt></range>
|
|
<range><ge>1.8.*</ge></range>
|
|
</package>
|
|
<package>
|
|
<name>netscape7</name>
|
|
<range><ge>0</ge></range>
|
|
</package>
|
|
<package>
|
|
<!-- These ports are obsolete. -->
|
|
<name>de-linux-mozillafirebird</name>
|
|
<name>el-linux-mozillafirebird</name>
|
|
<name>ja-linux-mozillafirebird-gtk1</name>
|
|
<name>ja-mozillafirebird-gtk2</name>
|
|
<name>linux-mozillafirebird</name>
|
|
<name>ru-linux-mozillafirebird</name>
|
|
<name>zhCN-linux-mozillafirebird</name>
|
|
<name>zhTW-linux-mozillafirebird</name>
|
|
<range><ge>0</ge></range>
|
|
</package>
|
|
<package>
|
|
<!-- These package names are obsolete. -->
|
|
<name>de-linux-netscape</name>
|
|
<name>de-netscape7</name>
|
|
<name>fr-linux-netscape</name>
|
|
<name>fr-netscape7</name>
|
|
<name>ja-linux-netscape</name>
|
|
<name>ja-netscape7</name>
|
|
<name>linux-netscape</name>
|
|
<name>linux-phoenix</name>
|
|
<name>mozilla+ipv6</name>
|
|
<name>mozilla-embedded</name>
|
|
<name>mozilla-firebird</name>
|
|
<name>mozilla-gtk1</name>
|
|
<name>mozilla-gtk2</name>
|
|
<name>mozilla-gtk</name>
|
|
<name>mozilla-thunderbird</name>
|
|
<name>phoenix</name>
|
|
<name>pt_BR-netscape7</name>
|
|
<range><ge>0</ge></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A Mozilla Foundation Security Advisory reports:</p>
|
|
<blockquote cite="http://www.mozilla.org/security/announce/mfsa2005-33.html">
|
|
<p>A bug in javascript's regular expression string
|
|
replacement when using an anonymous function as the
|
|
replacement argument allows a malicious script to capture
|
|
blocks of memory allocated to the browser. A web site
|
|
could capture data and transmit it to a server without
|
|
user interaction or knowledge.</p>
|
|
<p><strong>Workaround</strong>: Disable Javascript</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-0989</cvename>
|
|
<url>http://www.mozilla.org/security/announce/mfsa2005-33.html</url>
|
|
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=288688</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-04-01</discovery>
|
|
<entry>2005-04-16</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="1f2fdcff-ae60-11d9-a788-0001020eed82">
|
|
<topic>firefox -- arbitrary code execution in sidebar panel</topic>
|
|
<affects>
|
|
<package>
|
|
<name>firefox</name>
|
|
<range><lt>1.0.3,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-firefox</name>
|
|
<range><lt>1.0.3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A Mozilla Foundation Security Advisory reports:</p>
|
|
<blockquote cite="http://www.mozilla.org/security/announce/mfsa2005-39.html">
|
|
<p>Sites can use the _search target to open links in the
|
|
Firefox sidebar. Two missing security checks allow
|
|
malicious scripts to first open a privileged page (such as
|
|
about:config) and then inject script using a javascript:
|
|
url. This could be used to install malicious code or steal
|
|
data without user interaction.</p>
|
|
<p><strong>Workaround</strong>: Disable Javascript</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://www.mozilla.org/security/announce/mfsa2005-39.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-04-12</discovery>
|
|
<entry>2005-04-16</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="b206dd82-ac67-11d9-a788-0001020eed82">
|
|
<topic>openoffice -- DOC document heap overflow vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>openoffice</name>
|
|
<name>ar-openoffice</name>
|
|
<name>ca-openoffice</name>
|
|
<name>cs-openoffice</name>
|
|
<name>de-openoffice</name>
|
|
<name>dk-openoffice</name>
|
|
<name>el-openoffice</name>
|
|
<name>es-openoffice</name>
|
|
<name>et-openoffice</name>
|
|
<name>fi-openoffice</name>
|
|
<name>fr-openoffice</name>
|
|
<name>gr-openoffice</name>
|
|
<name>hu-openoffice</name>
|
|
<name>it-openoffice</name>
|
|
<name>ja-openoffice</name>
|
|
<name>ko-openoffice</name>
|
|
<name>nl-openoffice</name>
|
|
<name>pl-openoffice</name>
|
|
<name>pt-openoffice</name>
|
|
<name>pt_BR-openoffice</name>
|
|
<name>ru-openoffice</name>
|
|
<name>se-openoffice</name>
|
|
<name>sk-openoffice</name>
|
|
<name>sl-openoffice-SI</name>
|
|
<name>tr-openoffice</name>
|
|
<name>zh-openoffice-CN</name>
|
|
<name>zh-openoffice-TW</name>
|
|
<!-- Deprecated names -->
|
|
<name>jp-openoffice</name>
|
|
<name>kr-openoffice</name>
|
|
<name>sl-openoffice-SL</name>
|
|
<name>zh-openoffice</name>
|
|
<name>zh_TW-openoffice</name>
|
|
<range><lt>1.1.4_2</lt></range>
|
|
<range><gt>2.*</gt><le>2.0.20050406</le></range>
|
|
</package>
|
|
<package>
|
|
<name>openoffice</name>
|
|
<name>ja-openoffice</name>
|
|
<range><ge>6.0.a609</ge><le>6.0.a638</le></range>
|
|
<range><ge>641c</ge><le>645</le></range>
|
|
<range><eq>1.1RC4</eq></range>
|
|
<range><eq>1.1rc5</eq></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>AD-LAB reports that a heap-based buffer overflow
|
|
vulnerability exists in OpenOffice's handling of DOC
|
|
documents. When reading a DOC document 16 bit from a 32 bit
|
|
integer is used for memory allocation, but the full 32 bit
|
|
is used for further processing of the document. This can
|
|
allow an attacker to crash OpenOffice, or potentially
|
|
execute arbitrary code as the user running OpenOffice, by
|
|
tricking an user into opening a specially crafted DOC
|
|
document.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>13092</bid>
|
|
<cvename>CVE-2005-0941</cvename>
|
|
<mlist msgid="20050412000438.17342.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&m=111325305109137</mlist>
|
|
<url>http://www.openoffice.org/issues/show_bug.cgi?id=46388</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-04-11</discovery>
|
|
<entry>2005-04-13</entry>
|
|
<modified>2005-04-20</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="22f00553-a09d-11d9-a788-0001020eed82">
|
|
<topic>portupgrade -- insecure temporary file handling vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>portupgrade</name>
|
|
<range><lt>20041226_2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Simon L. Nielsen discovered that portupgrade handles
|
|
temporary files in an insecure manner. This could allow an
|
|
unprivileged local attacker to execute arbitrary commands or
|
|
overwrite arbitrary files with the permissions of the user
|
|
running portupgrade, typically root, by way of a symlink
|
|
attack.</p>
|
|
<p>The following issues exist where the temporary files are
|
|
created, by default in the world writeable directory
|
|
/var/tmp, with the permissions of the user running
|
|
portupgrade:</p>
|
|
<ul>
|
|
<li>pkg_fetch download packages with a predictable local
|
|
filename allowing a local attacker to overwrite arbitrary
|
|
local files or potentially replace the downloaded package
|
|
after download but before install with a package with
|
|
malicious content, allowing the attacker to run arbitrary
|
|
commands.</li>
|
|
<li>portupgrade will, when upgrading ports/packages, write
|
|
the old package to a predictable temporary file, allowing
|
|
an attacker to overwrite arbitrary files via a symlink
|
|
attack.</li>
|
|
<li>portupgrade will <q>touch</q> a temporary file
|
|
with a constant filename (pkgdb.fixme) allowing an
|
|
attacker to create arbitrary zero-byte files via a symlink
|
|
attack.</li>
|
|
</ul>
|
|
<p>A workaround for these issues is to set the
|
|
<code>PKG_TMPDIR</code> environment variable to a directory
|
|
only write-able by the user running portupgrade.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-0610</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-04-12</discovery>
|
|
<entry>2005-04-12</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="ecf68408-a9f5-11d9-a788-0001020eed82">
|
|
<topic>gaim -- jabber remote crash</topic>
|
|
<affects>
|
|
<package>
|
|
<name>gaim</name>
|
|
<name>ja-gaim</name>
|
|
<name>ko-gaim</name>
|
|
<name>ru-gaim</name>
|
|
<range><lt>1.2.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The GAIM team reports:</p>
|
|
<blockquote cite="http://gaim.sourceforge.net/security/?id=15">
|
|
<p>A remote jabber user can cause Gaim to crash by sending a
|
|
specific file transfer request.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>13004</bid>
|
|
<cvename>CVE-2005-0967</cvename>
|
|
<url>http://gaim.sourceforge.net/security/?id=15</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-04-04</discovery>
|
|
<entry>2005-04-10</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="ec09baa3-a9f5-11d9-a788-0001020eed82">
|
|
<topic>gaim -- remote DoS on receiving certain messages over IRC</topic>
|
|
<affects>
|
|
<package>
|
|
<name>gaim</name>
|
|
<name>ja-gaim</name>
|
|
<name>ko-gaim</name>
|
|
<name>ru-gaim</name>
|
|
<range><lt>1.2.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The GAIM team reports:</p>
|
|
<blockquote cite="http://gaim.sourceforge.net/security/?id=14">
|
|
<p>The IRC protocol plugin in Gaim 1.2.0, and possibly
|
|
earlier versions, allows (1) remote attackers to inject
|
|
arbitrary Gaim markup via irc_msg_kick, irc_msg_mode,
|
|
irc_msg_part, irc_msg_quit, (2) remote attackers to inject
|
|
arbitrary Pango markup and pop up empty dialog boxes via
|
|
irc_msg_invite, or (3) malicious IRC servers to cause a
|
|
denial of service (application crash) by injecting certain
|
|
Pango markup into irc_msg_badmode, irc_msg_banned,
|
|
irc_msg_unknown, irc_msg_nochan functions.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>13003</bid>
|
|
<cvename>CVE-2005-0966</cvename>
|
|
<url>http://gaim.sourceforge.net/security/?id=14</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-04-02</discovery>
|
|
<entry>2005-04-10</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="3fa2b372-a9f5-11d9-a788-0001020eed82">
|
|
<topic>gaim -- remote DoS on receiving malformed HTML</topic>
|
|
<affects>
|
|
<package>
|
|
<name>gaim</name>
|
|
<name>ja-gaim</name>
|
|
<name>ko-gaim</name>
|
|
<name>ru-gaim</name>
|
|
<range><lt>1.2.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The GAIM team reports:</p>
|
|
<blockquote cite="http://gaim.sourceforge.net/security/?id=13">
|
|
<p>The gaim_markup_strip_html function in Gaim 1.2.0, and
|
|
possibly earlier versions, allows remote attackers to
|
|
cause a denial of service (application crash) via a string
|
|
that contains malformed HTML, which causes an
|
|
out-of-bounds read.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>12999</bid>
|
|
<cvename>CVE-2005-0965</cvename>
|
|
<url>http://gaim.sourceforge.net/security/?id=13</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-04-02</discovery>
|
|
<entry>2005-04-10</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="07f3fe15-a9de-11d9-a788-0001020eed82">
|
|
<topic>php -- readfile() DoS vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>mod_php4-twig</name>
|
|
<name>php4-cgi</name>
|
|
<name>php4-cli</name>
|
|
<name>php4-dtc</name>
|
|
<name>php4-horde</name>
|
|
<name>php4-nms</name>
|
|
<name>php4</name>
|
|
<range><lt>4.3.5_7</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>mod_php</name>
|
|
<name>mod_php4</name>
|
|
<range><lt>4.3.5_7,1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A SUSE Security advisory reports:</p>
|
|
<blockquote cite="http://www.novell.com/linux/security/advisories/2005_06_sr.html">
|
|
<p>A bug in the readfile() function of php4 could be used to
|
|
to crash the httpd running the php4 code when accessing
|
|
files with a multiple of the architectures page size
|
|
leading to a denial of service.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>12665</bid>
|
|
<cvename>CVE-2005-0596</cvename>
|
|
<url>http://bugs.php.net/bug.php?id=27037</url>
|
|
<url>http://www.novell.com/linux/security/advisories/2005_06_sr.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-01-25</discovery>
|
|
<entry>2005-04-10</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="8dbf7894-a9a8-11d9-a788-0001020eed82">
|
|
<topic>squid -- DoS on failed PUT/POST requests vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>squid</name>
|
|
<range><le>2.5.7_12</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The squid patches page notes:</p>
|
|
<blockquote cite="http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-post">
|
|
<p>An inconsistent state is entered on a failed PUT/POST
|
|
request making a high risk for segmentation faults or
|
|
other strange errors</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-0718</cvename>
|
|
<url>http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-post</url>
|
|
<url>http://www.squid-cache.org/bugs/show_bug.cgi?id=1224</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-02-03</discovery>
|
|
<entry>2005-04-10</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="396ee517-a607-11d9-ac72-000bdb1444a4">
|
|
<topic>horde -- Horde Page Title Cross-Site Scripting Vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>horde</name>
|
|
<name>horde-php5</name>
|
|
<range><gt>3.*</gt><lt>3.0.4</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia Advisory: SA14730</p>
|
|
<blockquote cite="http://secunia.com/advisories/14730">
|
|
<p>A vulnerability has been reported in Horde, which can be
|
|
exploited by malicious people to conduct cross-site scripting
|
|
attacks.</p>
|
|
<p>Input passed when setting the parent frame's page title via
|
|
JavaScript is not properly sanitised before being returned to
|
|
the user. This can be exploited to execute arbitrary HTML and
|
|
script code in a user's browser session in context of an affected
|
|
site.</p>
|
|
<p>The vulnerability has been reported in version 3.0.4-RC2. Prior
|
|
versions may also be affected.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-0961</cvename>
|
|
<mlist msgid="20050329111028.6A112117243@neo.wg.de">http://lists.horde.org/archives/announce/2005/000176.html</mlist>
|
|
<url>http://cvs.horde.org/diff.php/horde/docs/CHANGES?r1=1.515.2.49&r2=1.515.2.93&ty=h</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-03-29</discovery>
|
|
<entry>2005-04-05</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="ef410571-a541-11d9-a788-0001020eed82">
|
|
<topic>wu-ftpd -- remote globbing DoS vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>wu-ftpd</name>
|
|
<range><lt>2.6.2_6</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>wu-ftpd+ipv6</name>
|
|
<range><lt>2.6.2_7</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>An iDEFENSE Security Advisory reports:</p>
|
|
<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&m=110935886414939">
|
|
<p>Remote exploitation of an input validation vulnerability
|
|
in version 2.6.2 of WU-FPTD could allow for a denial of
|
|
service of the system by resource exhaustion.</p>
|
|
<p>The vulnerability specifically exists in the
|
|
<code>wu_fnmatch()</code> function in wu_fnmatch.c. When a
|
|
pattern containing a '*' character is supplied as input,
|
|
the function calls itself recursively on a smaller
|
|
substring. By supplying a string which contains a large
|
|
number of '*' characters, the system will take a long time
|
|
to return the results, during which time it will be using
|
|
a large amount of CPU time.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-0256</cvename>
|
|
<mlist msgid="FB24803D1DF2A34FA59FC157B77C970503E249AF@idserv04.idef.com">http://marc.theaimsgroup.com/?l=bugtraq&m=110935886414939</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-02-05</discovery>
|
|
<entry>2005-04-04</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="5ebfe901-a3cb-11d9-b248-000854d03344">
|
|
<topic>hashcash -- format string vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>hashcash</name>
|
|
<range><lt>1.17</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A Gentoo Linux Security Advisory reports:</p>
|
|
<blockquote cite="http://www.gentoo.org/security/en/glsa/glsa-200503-12.xml">
|
|
<p>Tavis Ormandy of the Gentoo Linux Security Audit Team
|
|
identified a flaw in the Hashcash utility that an attacker
|
|
could expose by specifying a malformed reply address.</p>
|
|
<p>Successful exploitation would permit an attacker to disrupt
|
|
Hashcash users, and potentially execute arbitrary code.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-0687</cvename>
|
|
<url>http://www.gentoo.org/security/en/glsa/glsa-200503-12.xml</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-03-06</discovery>
|
|
<entry>2005-04-02</entry>
|
|
<modified>2005-04-03</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="70b62f5e-9e2e-11d9-a256-0001020eed82">
|
|
<topic>clamav -- zip handling DoS vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>clamav</name>
|
|
<range><lt>0.81</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>clamav-devel</name>
|
|
<range><lt>20050408</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The clamav daemon is vulnerable to a DoS vulnerability due
|
|
to insufficient handling of malformed zip files which can
|
|
crash the clamav daemon.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>12408</bid>
|
|
<cvename>CVE-2005-0133</cvename>
|
|
<url>http://sourceforge.net/project/shownotes.php?release_id=300116</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-01-27</discovery>
|
|
<entry>2005-03-26</entry>
|
|
<modified>2005-04-09</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="48a59c96-9c6e-11d9-a040-000a95bc6fae">
|
|
<topic>wine -- information disclosure due to insecure temporary file handling</topic>
|
|
<affects>
|
|
<package>
|
|
<name>wine</name>
|
|
<range><lt>20050310</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Due to insecure temporary file creation in the Wine Windows
|
|
emulator, it is possible for any user to read potentially
|
|
sensitive information from temporary registry files.</p>
|
|
<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&m=111082537009842">
|
|
<p>When a Win32 application is launched by wine, wine makes
|
|
a dump of the Windows registry in /tmp with name
|
|
regxxxxyyyy.tmp , where xxxxxx is the pid in hexadecimal
|
|
value of the current wine process and yyyy is an integer
|
|
value usually equal to zero.</p>
|
|
<p>regxxxxyyyy.tmp is created with 0644 (-rw-r--r--)
|
|
permissions. This could represent a security problem in a
|
|
multi-user environment. Indeed, any local user could
|
|
access to windows regstry's dump and get sensitive
|
|
information, like passwords and other private data.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-0787</cvename>
|
|
<mlist msgid="20050314135701.30231.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&m=111082537009842</mlist>
|
|
<url>http://bugs.winehq.org/show_bug.cgi?id=2715</url>
|
|
<url>http://www.securitytracker.com/alerts/2005/Mar/1013428.html</url>
|
|
<url>http://www.zone-h.org/advisories/read/id=7300</url>
|
|
<url>http://www.securityfocus.com/bid/12791</url>
|
|
<url>http://xforce.iss.net/xforce/xfdb/19697</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-03-13</discovery>
|
|
<entry>2005-03-24</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="741f8841-9c6b-11d9-9dbe-000a95bc6fae">
|
|
<topic>firefox -- arbitrary code execution from sidebar panel</topic>
|
|
<affects>
|
|
<package>
|
|
<name>firefox</name>
|
|
<range><lt>1.0.2,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-firefox</name>
|
|
<range><lt>1.0.2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A Mozilla Foundation Security Advisory states:</p>
|
|
<blockquote cite="http://www.mozilla.org/security/announce/mfsa2005-31.html">
|
|
<p>If a user bookmarked a malicious page as a Firefox
|
|
sidebar panel that page could execute arbitrary programs
|
|
by opening a privileged page and injecting javascript into
|
|
it.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-0402</cvename>
|
|
<url>http://www.mozilla.org/security/announce/mfsa2005-31.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-03-03</discovery>
|
|
<entry>2005-03-24</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="7d2aac52-9c6b-11d9-99a7-000a95bc6fae">
|
|
<topic>mozilla -- heap buffer overflow in GIF image processing</topic>
|
|
<affects>
|
|
<package>
|
|
<name>firefox</name>
|
|
<range><lt>1.0.2,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>thunderbird</name>
|
|
<name>linux-firefox</name>
|
|
<range><lt>1.0.2</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>mozilla</name>
|
|
<range><lt>1.7.6,2</lt></range>
|
|
<range><ge>1.8.*,2</ge></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-mozilla</name>
|
|
<name>linux-mozilla-devel</name>
|
|
<range><lt>1.7.6</lt></range>
|
|
<range><ge>1.8.*</ge></range>
|
|
</package>
|
|
<package>
|
|
<name>netscape7</name>
|
|
<range><ge>0</ge></range>
|
|
</package>
|
|
<package>
|
|
<!-- These ports are obsolete. -->
|
|
<name>de-linux-mozillafirebird</name>
|
|
<name>el-linux-mozillafirebird</name>
|
|
<name>ja-linux-mozillafirebird-gtk1</name>
|
|
<name>ja-mozillafirebird-gtk2</name>
|
|
<name>linux-mozillafirebird</name>
|
|
<name>ru-linux-mozillafirebird</name>
|
|
<name>zhCN-linux-mozillafirebird</name>
|
|
<name>zhTW-linux-mozillafirebird</name>
|
|
<range><ge>0</ge></range>
|
|
</package>
|
|
<package>
|
|
<!-- These package names are obsolete. -->
|
|
<name>de-linux-netscape</name>
|
|
<name>de-netscape7</name>
|
|
<name>fr-linux-netscape</name>
|
|
<name>fr-netscape7</name>
|
|
<name>ja-linux-netscape</name>
|
|
<name>ja-netscape7</name>
|
|
<name>linux-netscape</name>
|
|
<name>linux-phoenix</name>
|
|
<name>mozilla+ipv6</name>
|
|
<name>mozilla-embedded</name>
|
|
<name>mozilla-firebird</name>
|
|
<name>mozilla-gtk1</name>
|
|
<name>mozilla-gtk2</name>
|
|
<name>mozilla-gtk</name>
|
|
<name>mozilla-thunderbird</name>
|
|
<name>phoenix</name>
|
|
<name>pt_BR-netscape7</name>
|
|
<range><ge>0</ge></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A Mozilla Foundation Security Advisory states:</p>
|
|
<blockquote cite="http://www.mozilla.org/security/announce/mfsa2005-31.html">
|
|
<p>An <em>(sic)</em> GIF processing error when parsing the
|
|
obsolete Netscape extension 2 can lead to an exploitable
|
|
heap overrun, allowing an attacker to run arbitrary code on
|
|
the user's machine.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-0399</cvename>
|
|
<url>http://www.mozilla.org/security/announce/mfsa2005-30.html</url>
|
|
<url>http://xforce.iss.net/xforce/alerts/id/191</url>
|
|
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=285595</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-03-10</discovery>
|
|
<entry>2005-03-24</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="f8536143-9bc4-11d9-b8b3-000a95bc6fae">
|
|
<topic>sylpheed -- buffer overflow in header processing</topic>
|
|
<affects>
|
|
<package>
|
|
<name>sylpheed</name>
|
|
<name>sylpheed-claws</name>
|
|
<name>sylpheed-gtk2</name>
|
|
<range><ge>0.8.*</ge><lt>1.0.3</lt></range>
|
|
<range><ge>1.9.*</ge><lt>1.9.5</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Sylpheed web site states:</p>
|
|
<blockquote cite="http://sylpheed.good-day.net/index.cgi.en#changes">
|
|
<p>A buffer overflow which occurred when replying to a
|
|
message with certain headers which contain non-ascii
|
|
characters was fixed.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-0667</cvename>
|
|
<url>http://sylpheed.good-day.net/index.cgi.en#changes</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-03-07</discovery>
|
|
<entry>2005-03-23</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="a4bd3039-9a48-11d9-a256-0001020eed82">
|
|
<topic>xv -- filename handling format string vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>xv</name>
|
|
<name>ja-xv</name>
|
|
<range><lt>3.10a_5</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A Gentoo Linux Security Advisory reports:</p>
|
|
<blockquote cite="http://www.gentoo.org/security/en/glsa/glsa-200503-09.xml">
|
|
<p>Tavis Ormandy of the Gentoo Linux Security Audit Team
|
|
identified a flaw in the handling of image filenames by xv.</p>
|
|
<p>Successful exploitation would require a victim to process
|
|
a specially crafted image with a malformed filename,
|
|
potentially resulting in the execution of arbitrary code.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-0665</cvename>
|
|
<url>http://www.gentoo.org/security/en/glsa/glsa-200503-09.xml</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-03-01</discovery>
|
|
<entry>2005-03-21</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="972697a7-9a42-11d9-a256-0001020eed82">
|
|
<topic>kdelibs -- local DCOP denial of service vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>ja-kdelibs</name>
|
|
<name>kdelibs-nocups</name>
|
|
<name>kdelibs</name>
|
|
<range><lt>3.4.0</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A KDE Security Advisory reports:</p>
|
|
<blockquote cite="http://www.kde.org/info/security/advisory-20050316-1.txt">
|
|
<p>Sebastian Krahmer of the SUSE LINUX Security Team
|
|
reported a local denial of service vulnerability in KDE's
|
|
Desktop Communication Protocol (DCOP) daemon better known
|
|
as dcopserver.</p>
|
|
<p>A local user can lock up the dcopserver of arbitrary
|
|
other users on the same machine. This can cause a
|
|
significant reduction in desktop functionality for the
|
|
affected users including, but not limited to, the
|
|
inability to browse the internet and the inability to
|
|
start new applications.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-0396</cvename>
|
|
<url>http://www.kde.org/info/security/advisory-20050316-1.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-03-16</discovery>
|
|
<entry>2005-03-21</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="6192ae3d-9595-11d9-a9e0-0001020eed82">
|
|
<topic>phpmyadmin -- increased privilege vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>phpmyadmin</name>
|
|
<name>phpMyAdmin</name>
|
|
<range><lt>2.6.1.3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The phpMyAdmin team reports:</p>
|
|
<blockquote cite="http://sourceforge.net/forum/forum.php?forum_id=450948">
|
|
<p>Escaping of the "_" character was not properly done,
|
|
giving a wildcard privilege when editing db-specific
|
|
privileges with phpMyAdmin.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-0653</cvename>
|
|
<url>http://sourceforge.net/forum/forum.php?forum_id=450948</url>
|
|
<url>http://sourceforge.net/tracker/index.php?func=detail&aid=1113788&group_id=23067&atid=377408</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-02-01</discovery>
|
|
<entry>2005-03-15</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="cb470368-94d2-11d9-a9e0-0001020eed82">
|
|
<topic>ethereal -- multiple protocol dissectors vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>ethereal</name>
|
|
<name>ethereal-lite</name>
|
|
<name>tethereal</name>
|
|
<name>tethereal-lite</name>
|
|
<range><ge>0.9.1</ge><lt>0.10.10</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>An Ethreal Security Advisories reports:</p>
|
|
<blockquote cite="http://www.ethereal.com/appnotes/enpa-sa-00018.html">
|
|
<p>Issues have been discovered in the following protocol
|
|
dissectors:</p>
|
|
<ul>
|
|
<li>Matevz Pustisek discovered a buffer overflow in the
|
|
Etheric dissector. CVE: CAN-2005-0704</li>
|
|
<li>The GPRS-LLC dissector could crash if the "ignore
|
|
cipher bit" option was enabled. CVE: CAN-2005-0705</li>
|
|
<li>Diego Giago discovered a buffer overflow in the 3GPP2
|
|
A11 dissector. This flaw was later reported by Leon
|
|
Juranic. CVE: CAN-2005-0699</li>
|
|
<li>Leon Juranic discovered a buffer overflow in the IAPP dissector.
|
|
CVE: CAN-2005-0739</li>
|
|
<li>A bug in the JXTA dissector could make Ethereal crash.</li>
|
|
<li>A bug in the sFlow dissector could make Ethereal crash.</li>
|
|
</ul>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>12759</bid>
|
|
<cvename>CVE-2005-0699</cvename>
|
|
<cvename>CVE-2005-0704</cvename>
|
|
<cvename>CVE-2005-0705</cvename>
|
|
<cvename>CVE-2005-0739</cvename>
|
|
<url>http://www.ethereal.com/appnotes/enpa-sa-00018.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-03-09</discovery>
|
|
<entry>2005-03-14</entry>
|
|
<modified>2005-06-24</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="bcf27002-94c3-11d9-a9e0-0001020eed82">
|
|
<topic>grip -- CDDB response multiple matches buffer overflow vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>grip</name>
|
|
<range><lt>3.2.0_7</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Joseph VanAndel reports that grip is vulnerability to a
|
|
buffer overflow vulnerability when receiving more than 16
|
|
CDDB responses. This could lead to a crash in grip and
|
|
potentially execution arbitrary code.</p>
|
|
<p>A workaround is to disable CDDB lookups.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>12770</bid>
|
|
<cvename>CVE-2005-0706</cvename>
|
|
<url>http://sourceforge.net/tracker/index.php?func=detail&aid=834724&group_id=3714&atid=103714</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2003-11-02</discovery>
|
|
<entry>2005-03-14</entry>
|
|
<modified>2005-03-18</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="619ef337-949a-11d9-b813-00d05964249f">
|
|
<topic>mysql-server -- multiple remote vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>mysql-server</name>
|
|
<range><ge>4.0.0</ge><lt>4.0.24</lt></range>
|
|
<range><ge>4.1.0</ge><lt>4.1.10a</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>SecurityFocus reports:</p>
|
|
<blockquote cite="http://www.securityfocus.com/bid/12781/discussion/">
|
|
<p>MySQL is reported prone to an insecure temporary file creation
|
|
vulnerability.</p>
|
|
<p>Reports indicate that an attacker that has 'CREATE TEMPORARY TABLE'
|
|
privileges on an affected installation may leverage this
|
|
vulnerability to corrupt files with the privileges of the MySQL
|
|
process.</p>
|
|
<p>MySQL is reported prone to an input validation vulnerability that
|
|
can be exploited by remote users that have INSERT and DELETE
|
|
privileges on the 'mysql' administrative database.</p>
|
|
<p>Reports indicate that this issue may be leveraged to load an
|
|
execute a malicious library in the context of the MySQL process.</p>
|
|
<p>Finally, MySQL is reported prone to a remote arbitrary code
|
|
execution vulnerability. It is reported that the vulnerability may
|
|
be triggered by employing the 'CREATE FUNCTION' statement to
|
|
manipulate functions in order to control sensitive data
|
|
structures.</p>
|
|
<p>This issue may be exploited to execute arbitrary code in the
|
|
context of the database process.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>12781</bid>
|
|
<cvename>CVE-2005-0709</cvename>
|
|
<cvename>CVE-2005-0710</cvename>
|
|
<cvename>CVE-2005-0711</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-03-11</discovery>
|
|
<entry>2005-03-14</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="d4bd4046-93a6-11d9-8378-000bdb1444a4">
|
|
<topic>rxvt-unicode -- buffer overflow vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>rxvt-unicode</name>
|
|
<range><lt>5.3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A rxvt-unicode changelog reports:</p>
|
|
<blockquote cite="http://dist.schmorp.de/rxvt-unicode/Changes">
|
|
<p>Fix a bug that allowed to overflow a buffer via a long
|
|
escape sequence, which is probably exploitable (fix by
|
|
Rob Holland / Yoann Vandoorselaere / Gentoo Audit Team).</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://dist.schmorp.de/rxvt-unicode/Changes</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-03-13</discovery>
|
|
<entry>2005-03-13</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="a7062952-9023-11d9-a22c-0001020eed82">
|
|
<topic>phpmyadmin -- information disclosure vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>phpmyadmin</name>
|
|
<name>phpMyAdmin</name>
|
|
<range><lt>2.6.1.2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A phpMyAdmin security announcement reports:</p>
|
|
<blockquote cite="http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-2">
|
|
<p>By calling some scripts that are part of phpMyAdmin in an
|
|
unexpected way (especially scripts in the libraries
|
|
subdirectory), it is possible to trigger phpMyAdmin to
|
|
display a PHP error message which contains the full path
|
|
of the directory where phpMyAdmin is installed.</p>
|
|
<p><strong>Mitigation factor:</strong> This path disclosure
|
|
is possible on servers where the recommended setting of
|
|
the PHP configuration directive
|
|
<code>display_errors</code> is set to on, which is against
|
|
the recommendations given in the PHP manual.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-0544</cvename>
|
|
<url>http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-2</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-02-22</discovery>
|
|
<entry>2005-03-08</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="882ef43b-901f-11d9-a22c-0001020eed82">
|
|
<topic>phpmyadmin -- arbitrary file include and XSS vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>phpmyadmin</name>
|
|
<name>phpMyAdmin</name>
|
|
<range><gt>1.3.1</gt><lt>2.6.1.2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A phpMyAdmin security announcement reports:</p>
|
|
<blockquote cite="http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-1">
|
|
<p>We received two bug reports by Maksymilian Arciemowicz
|
|
about those vulnerabilities and we wish to thank him for
|
|
his work. The vulnerabilities apply to those points:</p>
|
|
<ol>
|
|
<li>css/phpmyadmin.css.php was vulnerable against
|
|
<code>$cfg</code> and <code>GLOBALS</code> variable
|
|
injections. This way, a possible attacker could
|
|
manipulate any configuration parameter. Using
|
|
phpMyAdmin's theming mechanism, he was able to include
|
|
arbitrary files. This is especially dangerous if php is
|
|
not running in safe mode.</li>
|
|
<li>A possible attacker could manipulate phpMyAdmin's
|
|
localized strings via the URL and inject harmful
|
|
JavaScript code this way, which could be used for XSS
|
|
attacks.</li>
|
|
</ol>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>12644</bid>
|
|
<bid>12645</bid>
|
|
<cvename>CVE-2005-0543</cvename>
|
|
<cvename>CVE-2005-0567</cvename>
|
|
<mlist msgid="20050224190307.20197.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&m=110929725801154</mlist>
|
|
<url>http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-1</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-02-21</discovery>
|
|
<entry>2005-03-08</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="624fe633-9006-11d9-a22c-0001020eed82">
|
|
<topic>libexif -- buffer overflow vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>libexif</name>
|
|
<range><lt>0.6.10_1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Sylvain Defresne reports that libexif is vulnerable to a
|
|
buffer overflow vulnerability due to insufficient input
|
|
checking. This could lead crash of applications using
|
|
libexif.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>12744</bid>
|
|
<cvename>CVE-2005-0664</cvename>
|
|
<url>https://bugzilla.ubuntulinux.org/show_bug.cgi?id=7152</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-03-03</discovery>
|
|
<entry>2005-03-08</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="4a0b334d-8d8d-11d9-afa0-003048705d5a">
|
|
<topic>phpbb -- Insuffient check against HTML code in usercp_register.php</topic>
|
|
<affects>
|
|
<package>
|
|
<name>phpbb</name>
|
|
<range><le>2.0.13</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Neo Security Team reports:</p>
|
|
<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&m=110987231502274">
|
|
<p>If we specify a variable in the html code (any type:
|
|
hidden, text, radio, check, etc) with the name allowhtml,
|
|
allowbbcode or allowsmilies, is going to be on the html,
|
|
bbcode and smilies in our signature.</p>
|
|
</blockquote>
|
|
<p>This is a low risk vulnerability that allows users to bypass
|
|
forum-wide configuration.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<mlist msgid="20050303055339.3109.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&m=110987231502274</mlist>
|
|
<mlist msgid="38599.166.68.134.174.1109875231.squirrel@166.68.134.174">http://marc.theaimsgroup.com/?l=bugtraq&m=110988400407204</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-02-28</discovery>
|
|
<entry>2005-03-05</entry>
|
|
<modified>2005-03-07</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="f3eec2b5-8cd8-11d9-8066-000a95bc6fae">
|
|
<topic>postnuke -- SQL injection vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>postnuke</name>
|
|
<range><lt>0.760</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Two separate SQL injection vulnerabilites have been
|
|
identified in the PostNuke PHP content management
|
|
system. An attacker can use this vulnerability to
|
|
potentially insert executable PHP code into the content
|
|
management system (to view all files within the PHP scope,
|
|
for instance). Various other SQL injection vulnerabilities
|
|
exist, which give attackers the ability to run SQL queries
|
|
on any tables within the database.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-0617</cvename>
|
|
<cvename>CVE-2005-0615</cvename>
|
|
<mlist>http://marc.theaimsgroup.com/?l=bugtraq&m=110962710805864</mlist>
|
|
<mlist>http://marc.theaimsgroup.com/?l=bugtraq&m=110962819232255</mlist>
|
|
<url>http://news.postnuke.com/Article2669.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-02-28</discovery>
|
|
<entry>2005-03-04</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="7e580822-8cd8-11d9-8c81-000a95bc6fae">
|
|
<topic>postnuke -- cross-site scripting (XSS) vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>postnuke</name>
|
|
<range><lt>0.760</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A cross-site scripting vulnerability is present in the
|
|
PostNuke PHP content management system. By passing data
|
|
injected through exploitable errors in input validation, an
|
|
attacker can insert code which will run on the machine of
|
|
anybody viewing the page. It is feasible that this attack
|
|
could be used to retrieve session information from cookies,
|
|
thereby allowing the attacker to gain administrative access
|
|
to the CMS.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-0616</cvename>
|
|
<mlist>http://marc.theaimsgroup.com/?l=bugtraq&m=110962768300373</mlist>
|
|
<url>http://news.postnuke.com/Article2669.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-02-28</discovery>
|
|
<entry>2005-03-04</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="c73305ae-8cd7-11d9-9873-000a95bc6fae">
|
|
<topic>realplayer -- remote heap overflow</topic>
|
|
<affects>
|
|
<package>
|
|
<name>linux-realplayer</name>
|
|
<range><le>10.0.2</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Two exploits have been identified in the Linux RealPlayer client.
|
|
RealNetworks states:</p>
|
|
<blockquote cite="http://service.real.com/help/faq/security/050224_player/EN/">
|
|
<p>RealNetworks, Inc. has addressed recently discovered
|
|
security vulnerabilities that offered the potential for
|
|
an attacker to run arbitrary or malicious code on a
|
|
customer's machine. RealNetworks has received no reports
|
|
of machines compromised as a result of the now-remedied
|
|
vulnerabilities. RealNetworks takes all security
|
|
vulnerabilities very seriously.</p>
|
|
<p>The specific exploits were:</p>
|
|
<ul>
|
|
<li><strong>Exploit 1:</strong> To fashion a malicious WAV
|
|
file to cause a buffer overflow which could have allowed
|
|
an attacker to execute arbitrary code on a customer's
|
|
machine.</li>
|
|
<li><strong>Exploit 2:</strong> To fashion a malicious
|
|
SMIL file to cause a buffer overflow which could have
|
|
allowed an attacker to execute arbitrary code on a
|
|
customer's machine.</li>
|
|
</ul>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-0611</cvename>
|
|
<mlist>http://marc.theaimsgroup.com/?l=vulnwatch&m=110977858619314</mlist>
|
|
<url>http://service.real.com/help/faq/security/050224_player/EN/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-03-01</discovery>
|
|
<entry>2005-03-04</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="713c3913-8c2b-11d9-b58c-0001020eed82">
|
|
<topic>ImageMagick -- format string vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>ImageMagick</name>
|
|
<name>ImageMagick-nox11</name>
|
|
<range><lt>6.2.0.3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Tavis Ormandy reports:</p>
|
|
<blockquote>
|
|
<p>magemagick-6.2.0-3 fixes an potential issue handling
|
|
malformed filenames, the flaw may affect webapps or
|
|
scripts that use the imagemagick utilities for image
|
|
processing, or applications linked with libMagick.</p>
|
|
</blockquote>
|
|
<p>This vulnerability could crash ImageMagick or potentially
|
|
lead to the execution of arbitrary code with the permissions
|
|
of the user running ImageMagick.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-0397</cvename>
|
|
<url>http://www.ubuntulinux.org/support/documentation/usn/usn-90-1</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-03-02</discovery>
|
|
<entry>2005-03-03</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="fb03b1c6-8a8a-11d9-81f7-02023f003c9f">
|
|
<topic>uim -- privilege escalation vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>ja-uim</name>
|
|
<range><lt>0.4.6</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The uim developers reports:</p>
|
|
<blockquote cite="http://lists.freedesktop.org/pipermail/uim/2005-February/000996.html">
|
|
<p>Takumi ASAKI discovered that uim always trusts environment
|
|
variables. But this is not correct behavior, sometimes environment
|
|
variables shouldn't be trusted. This bug causes privilege escalation
|
|
when libuim is linked against setuid/setgid application. Since GTK+
|
|
prohibits setuid/setgid applications, the bug appears only in
|
|
'immodule for Qt' enabled Qt. (Normal Qt is also safe.)</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-0503</cvename>
|
|
<mlist>http://lists.freedesktop.org/pipermail/uim/2005-February/000996.html</mlist>
|
|
<bid>12604</bid>
|
|
<url>http://secunia.com/advisories/13981</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-02-21</discovery>
|
|
<entry>2005-03-01</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="bdad9ada-8a52-11d9-9e53-000a95bc6fae">
|
|
<topic>lighttpd -- script source disclosure vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>lighttpd</name>
|
|
<range><lt>1.3.8</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The lighttpd website reports:</p>
|
|
<blockquote cite="http://article.gmane.org/gmane.comp.web.lighttpd/1171">
|
|
<p>In lighttpd 1.3.7 and below it is possible to fetch the source
|
|
files which should be handled by CGI or FastCGI applications.</p>
|
|
</blockquote>
|
|
<p>The vulnerability is in the handling of urlencoded trailing
|
|
NUL bytes. Installations that do not use CGI or FastCGI are
|
|
not affected.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-0453</cvename>
|
|
<mlist>http://article.gmane.org/gmane.comp.web.lighttpd/1171</mlist>
|
|
<url>http://www.lighttpd.net/news/</url>
|
|
<url>http://xforce.iss.net/xforce/xfdb/19350</url>
|
|
<bid>12567</bid>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-02-12</discovery>
|
|
<entry>2005-03-01</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="53e711ed-8972-11d9-9ff8-00306e01dda2">
|
|
<topic>phpbb -- privilege elevation and path disclosure</topic>
|
|
<affects>
|
|
<package>
|
|
<name>phpbb</name>
|
|
<range><lt>2.0.13</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The phpbb developer group reports:</p>
|
|
<blockquote cite="http://www.phpbb.com/phpBB/viewtopic.php?t=267563">
|
|
<p>phpBB Group announces the release of phpBB 2.0.13, the
|
|
"Beware of the furries" edition. This release addresses two
|
|
recent security exploits, one of them critical. They were
|
|
reported a few days after .12 was released and no one is
|
|
more annoyed than us, having to release a new version ini
|
|
such a short period of time. Fortunately both fixes are
|
|
easy and in each case just one line needs to be edited.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://www.phpbb.com/phpBB/viewtopic.php?t=267563</url>
|
|
<bid>12678</bid>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-02-27</discovery>
|
|
<entry>2005-02-28</entry>
|
|
<modified>2005-03-05</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="96df5fd0-8900-11d9-aa18-0001020eed82">
|
|
<topic>curl -- authentication buffer overflow vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>curl</name>
|
|
<range><lt>7.13.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Two iDEFENSE Security Advisories reports:</p>
|
|
<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&m=110902601221592">
|
|
<p>An exploitable stack-based buffer overflow condition
|
|
exists when using NT Lan Manager (NTLM)
|
|
authentication. The problem specifically exists within
|
|
<code>Curl_input_ntlm()</code> defined in
|
|
lib/http_ntlm.c.</p>
|
|
<p>Successful exploitation allows remote attackers to
|
|
execute arbitrary code under the privileges of the target
|
|
user. Exploitation requires that an attacker either coerce
|
|
or force a target to connect to a malicious server using
|
|
NTLM authentication.</p>
|
|
</blockquote>
|
|
<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&m=110902850731457">
|
|
<p>An exploitable stack-based buffer overflow condition
|
|
exists when using Kerberos authentication. The problem
|
|
specifically exists within the functions
|
|
<code>Curl_krb_kauth()</code> and <code>krb4_auth()</code>
|
|
defined in lib/krb4.c.</p>
|
|
<p>Successful exploitation allows remote attackers to
|
|
execute arbitrary code under the privileges of the target
|
|
user. Exploitation requires that an attacker either coerce
|
|
or force a target to connect to a malicious server using
|
|
Kerberos authentication.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>12615</bid>
|
|
<bid>12616</bid>
|
|
<cvename>CVE-2005-0490</cvename>
|
|
<mlist msgid="FB24803D1DF2A34FA59FC157B77C970503E2462D@idserv04.idef.com">http://marc.theaimsgroup.com/?l=bugtraq&m=110902850731457</mlist>
|
|
<mlist msgid="FB24803D1DF2A34FA59FC157B77C970503E2462E@idserv04.idef.com">http://marc.theaimsgroup.com/?l=bugtraq&m=110902601221592</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-12-21</discovery>
|
|
<entry>2005-02-27</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="b2d248ad-88f6-11d9-aa18-0001020eed82">
|
|
<topic>cyrus-imapd -- multiple buffer overflow vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>cyrus-imapd</name>
|
|
<range><lt>2.1.18</lt></range>
|
|
<range><gt>2.2.*</gt><lt>2.2.11</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Cyrus IMAP Server ChangeLog states:</p>
|
|
<blockquote cite="http://asg.web.cmu.edu/cyrus/download/imapd/changes.html">
|
|
<ul>
|
|
<li>Fix possible single byte overflow in mailbox handling
|
|
code.</li>
|
|
<li>Fix possible single byte overflows in the imapd
|
|
annotate extension.</li>
|
|
<li>Fix stack buffer overflows in fetchnews (exploitable
|
|
by peer news server), backend (exploitable by admin),
|
|
and in imapd (exploitable by users though only on
|
|
platforms where a filename may be larger than a mailbox
|
|
name).</li>
|
|
</ul>
|
|
</blockquote>
|
|
<p>The 2.1.X series are reportedly only affected by the second
|
|
issue.</p>
|
|
<p>These issues may lead to execution of arbitrary code with
|
|
the permissions of the user running the Cyrus IMAP
|
|
Server.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>12636</bid>
|
|
<cvename>CVE-2005-0546</cvename>
|
|
<url>http://asg.web.cmu.edu/cyrus/download/imapd/changes.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-02-14</discovery>
|
|
<entry>2005-02-27</entry>
|
|
<modified>2005-04-05</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="2c5757f4-88bf-11d9-8720-0007e900f87b">
|
|
<topic>sup -- format string vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>sup</name>
|
|
<range><lt>2.0.20050226</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Debian Security Advisory reports:</p>
|
|
<blockquote cite="http://www.securityfocus.com/advisories/6874">
|
|
<p>jaguar@felinemenace.org discovered a format string
|
|
vulnerability in sup, a set of programs to synchronize
|
|
collections of files across a number of machines,
|
|
whereby a remote attacker could potentially cause
|
|
arbitrary code to be executed with the privileges
|
|
of the supfilesrv process (this process does not run
|
|
automatically by default).</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>10571</bid>
|
|
<cvename>CVE-2004-0451</cvename>
|
|
<url>http://www.securityfocus.com/advisories/6874</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-06-19</discovery>
|
|
<entry>2005-02-27</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="d022754d-8839-11d9-aa18-0001020eed82">
|
|
<topic>mozilla -- insecure temporary directory vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>firefox</name>
|
|
<range><lt>1.0.1,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>mozilla</name>
|
|
<range><lt>1.7.6,2</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-mozilla</name>
|
|
<name>linux-mozilla-devel</name>
|
|
<range><lt>1.7.6</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>netscape7</name>
|
|
<range><ge>0</ge></range>
|
|
</package>
|
|
<package>
|
|
<!-- These ports are obsolete. -->
|
|
<name>de-linux-mozillafirebird</name>
|
|
<name>el-linux-mozillafirebird</name>
|
|
<name>ja-linux-mozillafirebird-gtk1</name>
|
|
<name>ja-mozillafirebird-gtk2</name>
|
|
<name>linux-mozillafirebird</name>
|
|
<name>ru-linux-mozillafirebird</name>
|
|
<name>zhCN-linux-mozillafirebird</name>
|
|
<name>zhTW-linux-mozillafirebird</name>
|
|
<range><ge>0</ge></range>
|
|
</package>
|
|
<package>
|
|
<!-- These package names are obsolete. -->
|
|
<name>de-linux-netscape</name>
|
|
<name>de-netscape7</name>
|
|
<name>fr-linux-netscape</name>
|
|
<name>fr-netscape7</name>
|
|
<name>ja-linux-netscape</name>
|
|
<name>ja-netscape7</name>
|
|
<name>linux-netscape</name>
|
|
<name>linux-phoenix</name>
|
|
<name>mozilla+ipv6</name>
|
|
<name>mozilla-embedded</name>
|
|
<name>mozilla-firebird</name>
|
|
<name>mozilla-gtk1</name>
|
|
<name>mozilla-gtk2</name>
|
|
<name>mozilla-gtk</name>
|
|
<name>mozilla-thunderbird</name>
|
|
<name>phoenix</name>
|
|
<name>pt_BR-netscape7</name>
|
|
<range><ge>0</ge></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A Mozilla Foundation Security Advisory reports:</p>
|
|
<blockquote cite="http://www.mozilla.org/security/announce/mfsa2005-28.html">
|
|
<p>A predictable name is used for the plugin temporary
|
|
directory. A malicious local user could symlink this to
|
|
the victim's home directory and wait for the victim to run
|
|
Firefox. When Firefox shuts down the victim's directory
|
|
would be erased.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://www.mozilla.org/security/announce/mfsa2005-28.html</url>
|
|
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=281284</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-02-06</discovery>
|
|
<entry>2005-02-26</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="cbfde1cd-87eb-11d9-aa18-0001020eed82">
|
|
<topic>mozilla -- arbitrary code execution vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>firefox</name>
|
|
<range><lt>1.0.1,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>mozilla</name>
|
|
<range><lt>1.7.6,2</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-mozilla</name>
|
|
<name>linux-mozilla-devel</name>
|
|
<range><lt>1.7.6</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>netscape7</name>
|
|
<range><ge>0</ge></range>
|
|
</package>
|
|
<package>
|
|
<!-- These ports are obsolete. -->
|
|
<name>de-linux-mozillafirebird</name>
|
|
<name>el-linux-mozillafirebird</name>
|
|
<name>ja-linux-mozillafirebird-gtk1</name>
|
|
<name>ja-mozillafirebird-gtk2</name>
|
|
<name>linux-mozillafirebird</name>
|
|
<name>ru-linux-mozillafirebird</name>
|
|
<name>zhCN-linux-mozillafirebird</name>
|
|
<name>zhTW-linux-mozillafirebird</name>
|
|
<range><ge>0</ge></range>
|
|
</package>
|
|
<package>
|
|
<!-- These package names are obsolete. -->
|
|
<name>de-linux-netscape</name>
|
|
<name>de-netscape7</name>
|
|
<name>fr-linux-netscape</name>
|
|
<name>fr-netscape7</name>
|
|
<name>ja-linux-netscape</name>
|
|
<name>ja-netscape7</name>
|
|
<name>linux-netscape</name>
|
|
<name>linux-phoenix</name>
|
|
<name>mozilla+ipv6</name>
|
|
<name>mozilla-embedded</name>
|
|
<name>mozilla-firebird</name>
|
|
<name>mozilla-gtk1</name>
|
|
<name>mozilla-gtk2</name>
|
|
<name>mozilla-gtk</name>
|
|
<name>mozilla-thunderbird</name>
|
|
<name>phoenix</name>
|
|
<name>pt_BR-netscape7</name>
|
|
<range><ge>0</ge></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A Mozilla Foundation Security Advisory reports:</p>
|
|
<blockquote cite="http://www.mozilla.org/security/announce/mfsa2005-27.html">
|
|
<p>Plugins (such as flash) can be used to load privileged
|
|
content into a frame. Once loaded various spoofs can be
|
|
applied to get the user to interact with the privileged
|
|
content. Michael Krax's "Fireflashing" example
|
|
demonstrates that an attacker can open about:config in a
|
|
frame, hide it with an opacity setting, and if the
|
|
attacker can get the victim to click at a particular spot
|
|
(design some kind of simple game) you could toggle boolean
|
|
preferences, some of which would make further attacks
|
|
easier.</p>
|
|
<p>The "firescrolling" example demonstrates arbitrary code
|
|
execution (in this case downloading a file) by convincing
|
|
the user to scroll twice.</p>
|
|
</blockquote>
|
|
<p><strong>Workaround:</strong> Disable JavaScript.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-0527</cvename>
|
|
<url>http://www.mikx.de/fireflashing/</url>
|
|
<url>http://www.mikx.de/firescrolling/</url>
|
|
<url>http://www.mozilla.org/security/announce/mfsa2005-27.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-02-24</discovery>
|
|
<entry>2005-02-26</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="32d4f0f1-85c3-11d9-b6dc-0007e900f747">
|
|
<topic>mkbold-mkitalic -- format string vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>mkbold-mkitalic</name>
|
|
<range><lt>0.07</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The version 0.06_1 and prior
|
|
have a format string vulnerability which can be triggered
|
|
by using a carefully-crafted BDF font file.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://home.jp.FreeBSD.org/cgi-bin/showmail/ports-jp/15568</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-02-23</discovery>
|
|
<entry>2005-02-24</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="03653079-8594-11d9-afa0-003048705d5a">
|
|
<topic>phpbb -- multiple information disclosure vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>phpbb</name>
|
|
<range><lt>2.0.12</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>psoTFX reports:</p>
|
|
<blockquote cite="http://www.phpbb.com/phpBB/viewtopic.php?f=14&t=265423">
|
|
<p>phpBB Group are pleased to announce the release of phpBB
|
|
2.0.12 the "Horray for Furrywood" release. This release
|
|
addresses a number of bugs and a couple of potential
|
|
exploits. [...] one of the potential exploits addressed
|
|
in this release could be serious in certain situations and
|
|
thus we urge all users, as always, to upgrade to this
|
|
release as soon as possible. Mostly this release is
|
|
concerned with eliminating disclosures of information
|
|
which while useful in debug situations may allow third
|
|
parties to gain information which could be used to do harm
|
|
via unknown or unfixed exploits in this or other
|
|
applications.</p>
|
|
</blockquote>
|
|
<p>The ChangeLog for phpBB 2.0.12 states:</p>
|
|
<blockquote cite="http://www.phpbb.com/support/documents.php?mode=changelog">
|
|
<ul>
|
|
<li>Prevented full path display on critical messages</li>
|
|
<li>Fixed full path disclosure in username handling caused
|
|
by a PHP 4.3.10 bug - <strong>AnthraX101</strong></li>
|
|
<li>Added exclude list to unsetting globals (if
|
|
register_globals is on) -
|
|
<strong>SpoofedExistence</strong></li>
|
|
<li>Fixed arbitrary file disclosure vulnerability in avatar
|
|
handling functions - <strong>AnthraX101</strong></li>
|
|
<li>Fixed arbitrary file unlink vulnerability in avatar
|
|
handling functions - <strong>AnthraX101</strong></li>
|
|
<li>Fixed path disclosure bug in search.php caused by a
|
|
PHP 4.3.10 bug (related to AnthraX101's discovery)</li>
|
|
<li>Fixed path disclosure bug in viewtopic.php caused by
|
|
a PHP 4.3.10 bug - <strong>matrix_killer</strong></li>
|
|
</ul>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://www.phpbb.com/support/documents.php?mode=changelog</url>
|
|
<url>http://www.phpbb.com/phpBB/viewtopic.php?f=14&t=265423</url>
|
|
<freebsdpr>ports/77943</freebsdpr>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-02-22</discovery>
|
|
<entry>2005-02-23</entry>
|
|
<modified>2005-02-25</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="1d3a2737-7eb7-11d9-acf7-000854d03344">
|
|
<topic>unace -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>unace</name>
|
|
<range><lt>1.2b_2</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-unace</name>
|
|
<range><gt>0</gt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Ulf Härnhammar reports:</p>
|
|
<ul>
|
|
<li>There are buffer overflows when extracting, testing or
|
|
listing specially prepared ACE archives.</li>
|
|
<li>There are directory traversal bugs when extracting ACE
|
|
archives.</li>
|
|
<li>There are also buffer overflows when dealing with long
|
|
(>17000 characters) command line arguments.</li>
|
|
</ul>
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/14359/">
|
|
<p>The vulnerabilities have been confirmed in version 1.2b.
|
|
One of the buffer overflow vulnerabilities have also been
|
|
reported in version 2.04, 2.2 and 2.5. Other versions may
|
|
also be affected.</p>
|
|
<p>Successful exploitation may allow execution of arbitrary
|
|
code.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<certvu>215006</certvu>
|
|
<cvename>CVE-2005-0160</cvename>
|
|
<cvename>CVE-2005-0161</cvename>
|
|
<mlist msgid="1109113175.421bb95705d42@webmail.uu.se">http://marc.theaimsgroup.com/?l=full-disclosure&m=110911451613135</mlist>
|
|
<url>http://secunia.com/advisories/14359/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-02-14</discovery>
|
|
<entry>2005-02-22</entry>
|
|
<modified>2006-09-26</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="a413ed94-836e-11d9-a9e7-0001020eed82">
|
|
<topic>putty -- pscp/psftp heap corruption vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>putty</name>
|
|
<range><lt>0.57</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Simon Tatham reports:</p>
|
|
<blockquote cite="http://lists.tartarus.org/pipermail/putty-announce/2005/000012.html">
|
|
<p>This version fixes a security hole in previous versions
|
|
of PuTTY, which can allow a malicious SFTP server to
|
|
attack your client. If you use either PSCP or PSFTP, you
|
|
should upgrade. Users of the main PuTTY program are not
|
|
affected. (However, note that the server must have passed
|
|
host key verification before this attack can be launched,
|
|
so a man-in-the-middle shouldn't be able to attack you if
|
|
you're careful.)</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>12601</bid>
|
|
<cvename>CVE-2005-0467</cvename>
|
|
<mlist msgid="E1D2taM-0005R1-00@ixion.tartarus.org">http://lists.tartarus.org/pipermail/putty-announce/2005/000012.html</mlist>
|
|
<mlist msgid="FB24803D1DF2A34FA59FC157B77C970503E2462F@idserv04.idef.com">http://marc.theaimsgroup.com/?l=bugtraq&m=110902510713763</mlist>
|
|
<url>http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-sftp-readdir.html</url>
|
|
<url>http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-sftp-string.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-02-20</discovery>
|
|
<entry>2005-02-20</entry>
|
|
<modified>2005-02-23</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="29dd0065-81fa-11d9-a9e7-0001020eed82">
|
|
<topic>kdelibs -- insecure temporary file creation</topic>
|
|
<affects>
|
|
<package>
|
|
<name>kdelibs</name>
|
|
<name>ja-kdelibs</name>
|
|
<range><lt>3.3.2_5</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Davide Madrisan reports:</p>
|
|
<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&m=110814653804757">
|
|
<p>The `dcopidlng' script in the KDE library package
|
|
(kdelibs-3.3.2/dcop/dcopidlng/dcopidlng) creates temporary
|
|
files in a unsecure manner.</p>
|
|
</blockquote>
|
|
<p><strong>Note:</strong> dcopidlng is only used at build
|
|
time, so only users installing KDE are vulnerable, not users
|
|
already running KDE.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-0365</cvename>
|
|
<url>http://bugs.kde.org/show_bug.cgi?id=97608</url>
|
|
<mlist msgid="200502110916.48921.davide.madrisan@qilinux.it">http://marc.theaimsgroup.com/?l=bugtraq&m=110814653804757</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-01-21</discovery>
|
|
<entry>2005-02-18</entry>
|
|
<modified>2005-02-20</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="74c86a29-81ef-11d9-a9e7-0001020eed82">
|
|
<topic>bidwatcher -- format string vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>bidwatcher</name>
|
|
<range><lt>1.3.17</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A Debian Security Advisory reports:</p>
|
|
<blockquote cite="http://www.debian.org/security/2005/dsa-687">
|
|
<p>Ulf Härnhammer from the Debian Security Audit Project
|
|
discovered a format string vulnerability in bidwatcher, a
|
|
tool for watching and bidding on eBay auctions. This
|
|
problem can be triggered remotely by a web server of eBay,
|
|
or someone pretending to be eBay, sending certain data
|
|
back.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>12590</bid>
|
|
<cvename>CVE-2005-0158</cvename>
|
|
<url>http://www.debian.org/security/2005/dsa-687</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-02-18</discovery>
|
|
<entry>2005-02-18</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="2d8cf857-81ea-11d9-a9e7-0001020eed82">
|
|
<topic>gftp -- directory traversal vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>gftp</name>
|
|
<range><lt>2.0.18</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A Debian Security Advisory reports:</p>
|
|
<blockquote cite="http://www.debian.org/security/2005/dsa-686">
|
|
<p>Albert Puigsech Galicia discovered a directory traversal
|
|
vulnerability in a proprietary FTP client (CAN-2004-1376)
|
|
which is also present in gftp, a GTK+ FTP client. A
|
|
malicious server could provide a specially crafted
|
|
filename that could cause arbitrary files to be
|
|
overwritten or created by the client.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>12539</bid>
|
|
<cvename>CVE-2005-0372</cvename>
|
|
<url>http://www.debian.org/security/2005/dsa-686</url>
|
|
<url>http://www.gftp.org/changelog.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-02-04</discovery>
|
|
<entry>2005-02-18</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="20c9bb14-81e6-11d9-a9e7-0001020eed82">
|
|
<topic>opera -- "data:" URI handler spoofing vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>opera</name>
|
|
<name>opera-devel</name>
|
|
<name>linux-opera</name>
|
|
<range><lt>7.54.20050131</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A Secunia Advisory reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/13818/">
|
|
<p>Michael Holzt has discovered a vulnerability in Opera,
|
|
which can be exploited by malicious people to trick users
|
|
into executing malicious files.</p>
|
|
<p>The vulnerability is caused due to an error in the
|
|
processing of "data:" URIs, causing wrong information to
|
|
be shown in a download dialog. This can be exploited by
|
|
e.g. a malicious website to trick users into executing a
|
|
malicious file by supplying a specially crafted "data:"
|
|
URI.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-0456</cvename>
|
|
<certvu>882926</certvu>
|
|
<url>http://secunia.com/advisories/13818/</url>
|
|
<url>http://www.opera.com/freebsd/changelogs/754u2/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-01-12</discovery>
|
|
<entry>2005-02-18</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="d8e55d65-81d6-11d9-a9e7-0001020eed82">
|
|
<topic>opera -- kfmclient exec command execution vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>opera</name>
|
|
<name>opera-devel</name>
|
|
<name>linux-opera</name>
|
|
<range><lt>7.54.20050131</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Giovanni Delvecchio reports:</p>
|
|
<blockquote cite="http://www.zone-h.org/advisories/read/id=6503">
|
|
<p>Opera for linux uses "kfmclient exec" as "Default
|
|
Application" to handle saved files. This could be used by
|
|
malicious remote users to execute arbitrary shell commands
|
|
on a target system.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-1491</cvename>
|
|
<url>http://secunia.com/advisories/13447/</url>
|
|
<url>http://www.opera.com/freebsd/changelogs/754u2/</url>
|
|
<url>http://www.zone-h.org/advisories/read/id=6503</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-12-12</discovery>
|
|
<entry>2005-02-18</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="6b4b0b3f-8127-11d9-a9e7-0001020eed82">
|
|
<topic>postgresql -- multiple buffer overflows in PL/PgSQL parser</topic>
|
|
<affects>
|
|
<package>
|
|
<name>postgresql</name>
|
|
<name>postgresql-server</name>
|
|
<name>ja-postgresql</name>
|
|
<range><lt>7.3.9_1</lt></range>
|
|
<range><gt>7.4.*</gt><lt>7.4.7_1</lt></range>
|
|
<range><gt>8.*</gt><lt>8.0.1_1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The PL/PgSQL parser in postgresql is vulnerable to several
|
|
buffer overflows. These could be exploited by a remote
|
|
attacker to execute arbitrary code with the permissions of
|
|
the postgresql server by running a specially crafted
|
|
query.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-0247</cvename>
|
|
<url>http://archives.postgresql.org/pgsql-committers/2005-02/msg00049.php</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-02-07</discovery>
|
|
<entry>2005-02-17</entry>
|
|
<modified>2005-02-19</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="fdad8a87-7f94-11d9-a9e7-0001020eed82">
|
|
<topic>awstats -- arbitrary command execution</topic>
|
|
<affects>
|
|
<package>
|
|
<name>awstats</name>
|
|
<range><lt>6.4</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Several input validation errors exist in AWStats that allow a
|
|
remote unauthenticated attacker to execute arbitrary commands
|
|
with the priviliges of the web server. These programming
|
|
errors involve CGI parameters including
|
|
<code>loadplugin</code>, <code>logfile</code>,
|
|
<code>pluginmode</code>, <code>update</code>, and possibly
|
|
others.</p>
|
|
<p>Additionally, the <code>debug</code> and other CGI parameters
|
|
may be used to cause AWStats to disclose AWStats and system
|
|
configuration information.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-0362</cvename>
|
|
<cvename>CVE-2005-0363</cvename>
|
|
<cvename>CVE-2005-0435</cvename>
|
|
<cvename>CVE-2005-0436</cvename>
|
|
<cvename>CVE-2005-0437</cvename>
|
|
<cvename>CVE-2005-0438</cvename>
|
|
<bid>12543</bid>
|
|
<bid>12545</bid>
|
|
<mlist msgid="20050214081040.3370.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&m=110840530924124</mlist>
|
|
<url>http://awstats.sourceforge.net/docs/awstats_changelog.txt</url>
|
|
<url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=294488</url>
|
|
<url>http://packetstormsecurity.nl/0501-exploits/AWStatsVulnAnalysis.pdf</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-02-10</discovery>
|
|
<entry>2005-02-16</entry>
|
|
<modified>2005-02-23</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="5a5422fd-7e1a-11d9-a9e7-0001020eed82">
|
|
<topic>powerdns -- DoS vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>powerdns</name>
|
|
<range><lt>2.9.17</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>PowerDNS is vulnerable to a temporary denial-of-service
|
|
vulnerability that can be triggered using a random stream of
|
|
bytes.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>12446</bid>
|
|
<url>http://ds9a.nl/cgi-bin/cvstrac/pdns/tktview?tn=21</url>
|
|
<url>http://doc.powerdns.com/changelog.html#CHANGELOG-2-9-17</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-09-18</discovery>
|
|
<entry>2005-02-14</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="3e3c860d-7dae-11d9-a9e7-0001020eed82">
|
|
<topic>emacs -- movemail format string vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>movemail</name>
|
|
<range><le>1.0</le></range>
|
|
</package>
|
|
<package>
|
|
<name>zh-emacs</name>
|
|
<name>emacs</name>
|
|
<range><lt>20.7_4</lt></range>
|
|
<range><gt>21.*</gt><lt>21.3_4</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>xemacs</name>
|
|
<name>xemacs-mule</name>
|
|
<name>zh-xemacs</name>
|
|
<name>zh-xemacs-mule</name>
|
|
<range><lt>21.4.17</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>xemacs-devel</name>
|
|
<range><lt>21.5.b19,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>xemacs-devel-21.5</name>
|
|
<range><eq>b11</eq></range>
|
|
</package>
|
|
<package>
|
|
<name>xemacs-devel-mule</name>
|
|
<range><lt>21.5.b19</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>mule-common</name>
|
|
<name>hanemacs</name>
|
|
<range><gt>0</gt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Max Vozeler discovered several format string
|
|
vulnerabilities in the movemail utility of Emacs. They can
|
|
be exploited when connecting to a malicious POP server and
|
|
can allow an attacker can execute arbitrary code under the
|
|
privileges of the user running Emacs.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-0100</cvename>
|
|
<bid>12462</bid>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-01-31</discovery>
|
|
<entry>2005-02-14</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="bc4a7efa-7d9a-11d9-a9e7-0001020eed82">
|
|
<topic>ngircd -- format string vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>ngircd</name>
|
|
<range><lt>0.8.3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A No System Group security advisory reports that ngircd is
|
|
vulnerable to a format string vulnerability in the
|
|
<code>Log_Resolver()</code> function of log.c, if IDENT
|
|
support is enabled. This could allow a remote attacker to
|
|
execute arbitrary code with the permissions of the ngircd
|
|
daemon, which is <q>root</q> by default.</p>
|
|
<p><strong>Note:</strong> By default the FreeBSD ngircd port
|
|
does not enable IDENT support.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-0226</cvename>
|
|
<bid>12434</bid>
|
|
<mlist msgid="20050203020909.21785.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&m=110746413108183</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-02-03</discovery>
|
|
<entry>2005-02-13</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="7f6dd1bd-7d99-11d9-a9e7-0001020eed82">
|
|
<topic>ngircd -- buffer overflow vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>ngircd</name>
|
|
<range><lt>0.8.2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Florian Westphal discovered a buffer overflow in ngircd
|
|
which can be used remotely crash the server and possibly
|
|
execute arbitrary code.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-0199</cvename>
|
|
<bid>12397</bid>
|
|
<mlist>http://arthur.ath.cx/pipermail/ngircd-ml/2005-January/000228.html</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-01-26</discovery>
|
|
<entry>2005-02-13</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="5192e7ca-7d4f-11d9-a9e7-0001020eed82">
|
|
<topic>mod_python -- information leakage vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>mod_python</name>
|
|
<range><lt>2.7.11</lt></range>
|
|
<range><gt>3.*</gt><lt>3.1.4</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Mark J Cox reports:</p>
|
|
<blockquote>
|
|
<p>Graham Dumpleton discovered a flaw which can affect
|
|
anyone using the publisher handle of the Apache Software
|
|
Foundation mod_python. The publisher handle lets you
|
|
publish objects inside modules to make them callable via
|
|
URL. The flaw allows a carefully crafted URL to obtain
|
|
extra information that should not be visible (information
|
|
leak).</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-0088</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-01-30</discovery>
|
|
<entry>2005-02-13</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="c7ccc33f-7d31-11d9-a9e7-0001020eed82">
|
|
<topic>mailman -- directory traversal vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>mailman</name>
|
|
<name>ja-mailman</name>
|
|
<range><lt>2.1.5_2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A directory traversal vulnerability in mailman allow remote
|
|
attackers to read arbitrary files due to inadequate input
|
|
sanitizing. This could, among other things, lead remote
|
|
attackers to gaining access to the mailman configuration
|
|
database (which contains subscriber email addresses and
|
|
passwords) or to the mail archives for private lists.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-0202</cvename>
|
|
<mlist msgid="20050209181502.GA26136@grok.org.uk">http://marc.theaimsgroup.com/?l=full-disclosure&m=110797575304304</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-01-02</discovery>
|
|
<entry>2005-02-12</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="72da8af6-7c75-11d9-8cc5-000854d03344">
|
|
<topic>enscript -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>enscript-a4</name>
|
|
<name>enscript-letter</name>
|
|
<name>enscript-letterdj</name>
|
|
<range><lt>1.6.4_1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Erik Sjölund discovered several issues in enscript:
|
|
it suffers from several buffer overflows, quotes and shell
|
|
escape characters are insufficiently sanitized in filenames,
|
|
and it supported taking input from an arbitrary command
|
|
pipe, with unwanted side effects.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-1184</cvename>
|
|
<cvename>CVE-2004-1185</cvename>
|
|
<cvename>CVE-2004-1186</cvename>
|
|
<url>http://www.gentoo.org/security/en/glsa/glsa-200502-03.xml</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-02-02</discovery>
|
|
<entry>2005-02-11</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="5d425189-7a03-11d9-a9e7-0001020eed82">
|
|
<topic>postgresql -- privilege escalation vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>postgresql</name>
|
|
<name>postgresql-server</name>
|
|
<name>ja-postgresql</name>
|
|
<range><lt>7.3.9</lt></range>
|
|
<range><gt>7.4.*</gt><lt>7.4.7</lt></range>
|
|
<range><gt>8.*</gt><lt>8.0.1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>postgresql-devel</name>
|
|
<range><le>8.0.1,1</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>John Heasman and others disovered that non-privileged users
|
|
could use the <q>LOAD</q> extension to load arbitrary
|
|
libraries into the postgres server process space. This
|
|
could be used by non-privileged local users to execute
|
|
arbitrary code with the privileges of the postgresql
|
|
server.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>12411</bid>
|
|
<cvename>CVE-2005-0227</cvename>
|
|
<mlist>http://archives.postgresql.org/pgsql-announce/2005-02/msg00000.php</mlist>
|
|
<mlist>http://archives.postgresql.org/pgsql-bugs/2005-01/msg00269.php</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-01-21</discovery>
|
|
<entry>2005-02-08</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="831a6a66-79fa-11d9-a9e7-0001020eed82">
|
|
<topic>ethereal -- multiple protocol dissectors vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>ethereal</name>
|
|
<name>ethereal-lite</name>
|
|
<name>tethereal</name>
|
|
<name>tethereal-lite</name>
|
|
<range><ge>0.8.10</ge><lt>0.10.9</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>An Ethreal Security Advisories reports:</p>
|
|
<blockquote cite="http://www.ethereal.com/appnotes/enpa-sa-00017.html">
|
|
<p>Issues have been discovered in the following protocol
|
|
dissectors:</p>
|
|
<ul>
|
|
<li>The COPS dissector could go into an infinite
|
|
loop. CVE: CAN-2005-0006</li>
|
|
<li>The DLSw dissector could cause an assertion. CVE:
|
|
CAN-2005-0007</li>
|
|
<li>The DNP dissector could cause memory corruption. CVE:
|
|
CAN-2005-0008</li>
|
|
<li>The Gnutella dissector could cuase an assertion. CVE:
|
|
CAN-2005-0009</li>
|
|
<li>The MMSE dissector could free statically-allocated
|
|
memory. CVE: CAN-2005-0010</li>
|
|
<li>The X11 dissector is vulnerable to a string buffer
|
|
overflow. CVE: CAN-2005-0084</li>
|
|
</ul>
|
|
<p>Impact: It may be possible to make Ethereal crash or run
|
|
arbitrary code by injecting a purposefully malformed
|
|
packet onto the wire or by convincing someone to read a
|
|
malformed packet trace file.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-0006</cvename>
|
|
<cvename>CVE-2005-0007</cvename>
|
|
<cvename>CVE-2005-0008</cvename>
|
|
<cvename>CVE-2005-0009</cvename>
|
|
<cvename>CVE-2005-0010</cvename>
|
|
<cvename>CVE-2005-0084</cvename>
|
|
<bid>12326</bid>
|
|
<url>http://www.ethereal.com/appnotes/enpa-sa-00017.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-01-18</discovery>
|
|
<entry>2005-02-08</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="bfda39de-7467-11d9-9e1e-c296ac722cb3">
|
|
<topic>squid -- correct handling of oversized HTTP reply headers</topic>
|
|
<affects>
|
|
<package>
|
|
<name>squid</name>
|
|
<range><lt>2.5.7_12</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The squid patches page notes:</p>
|
|
<blockquote cite="http://www.squid-cache.org/Versions/v2/2.5/bugs/squid-2.5.STABLE7-oversize_reply_headers.patch">
|
|
<p>This patch addresses a HTTP protocol mismatch related to oversized
|
|
reply headers. In addition it enhances the cache.log reporting on
|
|
reply header parsing failures to make it easier to track down which
|
|
sites are malfunctioning.</p>
|
|
</blockquote>
|
|
<p>It is believed that this bug may lead to cache pollution or
|
|
allow access controls to be bypassed.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-0241</cvename>
|
|
<url>http://www.squid-cache.org/bugs/show_bug.cgi?id=1216</url>
|
|
<url>http://www.squid-cache.org/Versions/v2/2.5/bugs/squid-2.5.STABLE7-oversize_reply_headers.patch</url>
|
|
<freebsdpr>ports/76967</freebsdpr>
|
|
<certvu>823350</certvu>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-01-31</discovery>
|
|
<entry>2005-02-08</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="6afa87d3-764b-11d9-b0e7-0000e249a0a2">
|
|
<topic>python -- SimpleXMLRPCServer.py allows unrestricted traversal</topic>
|
|
<affects>
|
|
<package>
|
|
<name>python</name>
|
|
<name>python+ipv6</name>
|
|
<range><ge>2.2</ge><lt>2.2.3_7</lt></range>
|
|
<range><ge>2.3</ge><lt>2.3.4_4</lt></range>
|
|
<range><ge>2.4</ge><lt>2.4_1</lt></range>
|
|
<range><ge>2.5.a0.20050129</ge><lt>2.5.a0.20050129_1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>According to Python Security Advisory PSF-2005-001,</p>
|
|
<blockquote cite="http://www.python.org/security/PSF-2005-001/">
|
|
<p>The Python development team has discovered a flaw in
|
|
the <code>SimpleXMLRPCServer</code> library module which
|
|
can give remote attackers access to internals of the
|
|
registered object or its module or possibly other modules.
|
|
The flaw only affects Python XML-RPC servers that use the
|
|
<code>register_instance()</code> method to register an object
|
|
without a <code>_dispatch()</code> method. Servers using
|
|
only <code>register_function()</code> are not affected.</p>
|
|
<p>On vulnerable XML-RPC servers, a remote attacker may
|
|
be able to view or modify globals of the module(s)
|
|
containing the registered instance's class(es), potentially
|
|
leading to data loss or arbitrary code execution. If the
|
|
registered object is a module, the danger is particularly
|
|
serious. For example, if the registered module imports
|
|
the <code>os</code> module, an attacker could invoke the
|
|
<code>os.system()</code> function.</p>
|
|
</blockquote>
|
|
<p><strong>Note:</strong> This vulnerability affects your
|
|
system only if you're running
|
|
<code>SimpleXMLRPCServer</code>-based server. This isn't
|
|
harmful at all if you don't run any internet server written
|
|
in Python or your server doesn't serve in XML-RPC protocol.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-0089</cvename>
|
|
<url>http://www.python.org/security/PSF-2005-001/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-02-03</discovery>
|
|
<entry>2005-02-03</entry>
|
|
<modified>2006-10-08</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="a5eb760a-753c-11d9-a36f-000a95bc6fae">
|
|
<topic>perl -- vulnerabilities in PERLIO_DEBUG handling</topic>
|
|
<affects>
|
|
<package>
|
|
<name>perl</name>
|
|
<name>perl-threaded</name>
|
|
<range><ge>5.8</ge><lt>5.8.6_2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Kevin Finisterre discovered bugs in perl's I/O debug support:</p>
|
|
<ul>
|
|
<li>The environmental variable PERLIO_DEBUG is honored even
|
|
by the set-user-ID perl command (usually
|
|
named <code>sperl</code> or <code>suidperl</code>). As a
|
|
result, a local attacker may be able to gain elevated
|
|
privileges. <em>(CVE-2005-0155)</em></li>
|
|
<li>A buffer overflow may occur in threaded versions of perl
|
|
when the full pathname of the script being executed is
|
|
very long. <em>(CVE-2005-0156)</em>.</li>
|
|
</ul>
|
|
<p><strong>Note:</strong> By default, no set-user-ID perl
|
|
binary is installed. An administrator must enable it
|
|
manually at build time with the <code>ENABLE_SUIDPERL</code>
|
|
port flag.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-0155</cvename>
|
|
<cvename>CVE-2005-0156</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-02-02</discovery>
|
|
<entry>2005-02-02</entry>
|
|
<modified>2007-11-07</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="cd7e260a-6bff-11d9-a5df-00065be4b5b6">
|
|
<topic>newsgrab -- insecure file and directory creation</topic>
|
|
<affects>
|
|
<package>
|
|
<name>newsgrab</name>
|
|
<range><le>0.4.0</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The newsgrab script uses insecure permissions during the
|
|
creation of the local output directory and downloaded files.</p>
|
|
<p>After a file is created, permissions on it are set using the mode
|
|
value of the newsgroup posting. This can potentially be a problem
|
|
when the mode is not restrictive enough. In addition, the output
|
|
directory is created with world writable permissions allowing other
|
|
users to drop symlinks or other files at that location.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://people.freebsd.org/~niels/issues/newsgrab-20050114.txt</url>
|
|
<url>http://sourceforge.net/project/shownotes.php?release_id=300562</url>
|
|
<cvename>CVE-2005-0154</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-01-18</discovery>
|
|
<entry>2005-02-01</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="35f6093c-73c3-11d9-8a93-00065be4b5b6">
|
|
<topic>newsgrab -- directory traversal vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>newsgrab</name>
|
|
<range><le>0.4.0</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The newsgrab script creates files by using the names provided
|
|
in the newsgroup messages in a perl open() call. This is done
|
|
without performing any security checks to prevent a
|
|
directory traversal. A specially crafted newsgroup message
|
|
could cause newsgrab to drop an attachment anywhere on the
|
|
file system using the permissions of the user running the
|
|
script.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://people.freebsd.org/~niels/issues/newsgrab-20050114.txt</url>
|
|
<url>http://sourceforge.net/project/shownotes.php?release_id=300562</url>
|
|
<cvename>CVE-2005-0153</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-01-18</discovery>
|
|
<entry>2005-02-01</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="7f13607b-6948-11d9-8937-00065be4b5b6">
|
|
<topic>newspost -- server response buffer overflow vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>newspost</name>
|
|
<range><le>2.1.1</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The newspost program uses a function named socket_getline to read
|
|
server responses from the network socket. Unfortunately this function
|
|
does not check the length of the buffer in which the read data is stored
|
|
and only stops reading when a newline character is found.</p>
|
|
<p>A malicious NNTP server could use this bug to cause a buffer overflow
|
|
by sending an overly long response. Such an overflow allows arbitrary
|
|
code to be executed, with the privileges of the newspost process, on the
|
|
affected systems.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://people.freebsd.org/~niels/issues/newspost-20050114.txt</url>
|
|
<cvename>CVE-2005-0101</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-01-14</discovery>
|
|
<entry>2005-02-01</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="76e0b133-6bfd-11d9-a5df-00065be4b5b6">
|
|
<topic>newsfetch -- server response buffer overflow vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>newsfetch</name>
|
|
<range><le>1.21_1</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The newsfetch program uses the sscanf function to read information
|
|
from server responses into static memory buffers. Unfortunately
|
|
this is done without any proper bounds checking. As a result long
|
|
server responses may cause an overflow when a newsgroup listing is
|
|
requested from an NNTP server.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://people.freebsd.org/~niels/issues/newsfetch-20050119.txt</url>
|
|
<cvename>CVE-2005-0132</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-01-18</discovery>
|
|
<entry>2005-02-01</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="23fb5a04-722b-11d9-9e1e-c296ac722cb3">
|
|
<topic>squid -- buffer overflow in WCCP recvfrom() call</topic>
|
|
<affects>
|
|
<package>
|
|
<name>squid</name>
|
|
<range><lt>2.5.7_10</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>According to the Squid Proxy Cache Security Update Advisory
|
|
SQUID-2005:3,</p>
|
|
<blockquote cite="http://www.squid-cache.org/Advisories/SQUID-2005_3.txt">
|
|
<p>The WCCP recvfrom() call accepts more data than will fit in
|
|
the allocated buffer. An attacker may send a larger-than-normal
|
|
WCCP message to Squid and overflow this buffer.</p>
|
|
<p>Severity:</p>
|
|
<p>The bug is important because it allows remote attackers to crash
|
|
Squid, causing a disription in service. However, the bug is
|
|
exploitable only if you have configured Squid to send WCCP messages
|
|
to, and expect WCCP replies from, a router.</p>
|
|
<p>Sites that do not use WCCP are not vulnerable.</p>
|
|
</blockquote>
|
|
<p>Note that while the default configuration of the FreeBSD squid port
|
|
enables WCCP support in general, the default configuration
|
|
supplied does not actually configure squid to send and receive WCCP
|
|
messages.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-0211</cvename>
|
|
<certvu>886006</certvu>
|
|
<url>http://www.squid-cache.org/Advisories/SQUID-2005_3.txt</url>
|
|
<url>http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-wccp_buffer_overflow</url>
|
|
<url>http://www.squid-cache.org/bugs/show_bug.cgi?id=1217</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-01-28</discovery>
|
|
<entry>2005-01-28</entry>
|
|
<modified>2005-02-13</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="f755545e-6fcd-11d9-abec-00061bd2d56f">
|
|
<topic>xpdf -- makeFileKey2() buffer overflow vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>xpdf</name>
|
|
<range><lt>3.00_6</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>kdegraphics</name>
|
|
<range><lt>3.3.2_2</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>gpdf</name>
|
|
<range><lt>2.8.3</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>teTeX-base</name>
|
|
<range><lt>2.0.2_9</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>cups-base</name>
|
|
<range><lt>1.1.23.0_3</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>koffice</name>
|
|
<range><lt>1.3.5_2,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>pdftohtml</name>
|
|
<range><lt>0.36_2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>An iDEFENSE Security Advisory reports:</p>
|
|
<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&m=110608898221554">
|
|
<p>Remote exploitation of a buffer overflow vulnerability in
|
|
the xpdf PDF viewer included in multiple Unix and Linux
|
|
distributions could allow for arbitrary code execution as
|
|
the user viewing a PDF file.</p>
|
|
<p>The vulnerability specifically exists due to insufficient
|
|
bounds checking while processing a PDF file that provides
|
|
malicious values in the /Encrypt /Length tag. The
|
|
offending code can be found in the
|
|
<code>Decrypt::makeFileKey2</code> function in the source
|
|
file xpdf/Decrypt.cc.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-0064</cvename>
|
|
<mlist msgid="FB24803D1DF2A34FA59FC157B77C970503C8B298@idserv04.idef.com">http://marc.theaimsgroup.com/?l=bugtraq&m=110608898221554</mlist>
|
|
<url>http://www.koffice.org/security/advisory-20050120-1.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-01-06</discovery>
|
|
<entry>2005-01-26</entry>
|
|
<modified>2005-02-03</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="d371b627-6ed5-11d9-bd18-000a95bc6fae">
|
|
<topic>zhcon -- unauthorized file access</topic>
|
|
<affects>
|
|
<package>
|
|
<name>zhcon</name>
|
|
<name>zh-zhcon</name>
|
|
<range><lt>0.2.3_3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Martin <q>Joey</q> Schulze reports:</p>
|
|
<blockquote>
|
|
<p>Erik Sjöund discovered that zhcon, a fast console CJK
|
|
system using the Linux framebuffer, accesses a
|
|
user-controlled configuration file with elevated
|
|
privileges. Thus, it is possible to read arbitrary files.</p>
|
|
</blockquote>
|
|
<p>When installed from the FreeBSD Ports Collection, zhcon is
|
|
installed set-user-ID root.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-0072</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-01-25</discovery>
|
|
<entry>2005-01-25</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="b8943e61-6e68-11d9-a9e7-0001020eed82">
|
|
<topic>evolution -- arbitrary code execution vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>evolution</name>
|
|
<range><lt>2.0.3_1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Martin <q>Joey</q> Schulze reports:</p>
|
|
<blockquote>
|
|
<p>Max Vozeler discovered an integer overflow in the helper
|
|
application camel-lock-helper which runs setuid root or
|
|
setgid mail inside of Evolution, a free groupware suite.
|
|
A local attacker can cause the setuid root helper to
|
|
execute arbitrary code with elevated privileges via a
|
|
malicious POP server.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>12354</bid>
|
|
<cvename>CVE-2005-0102</cvename>
|
|
<url>http://cvs.gnome.org/viewcvs/evolution/camel/camel-lock-helper.c?rev=1.7&view=log#rev1.5.74.1</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-01-20</discovery>
|
|
<entry>2005-01-25</entry>
|
|
<modified>2005-02-02</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="88ff90f2-6e43-11d9-8c87-000a95bc6fae">
|
|
<topic>mod_dosevasive -- insecure temporary file creation</topic>
|
|
<affects>
|
|
<package>
|
|
<name>mod_dosevasive20</name>
|
|
<range><lt>1.10</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>An LSS Security Advisory reports:</p>
|
|
<blockquote cite="http://security.lss.hr/en/index.php?page=details&ID=LSS-2005-01-01">
|
|
<p>When a denial of service attack is detected,
|
|
mod_dosevasive will, among other things, create a
|
|
temporary file which it will use to trace actions from the
|
|
offensive IP address. This file is insecurely created in
|
|
/tmp and it's name is easily predictable.</p>
|
|
<p>It is then easy for an attacker to create arbitrary files
|
|
in any directory that the user under which apache runs has
|
|
privileges to write.</p>
|
|
<p><em>[...]</em> once the target file is opened, there is a
|
|
race attack (although difficult to exploit) which can lead
|
|
to mod_dosevasive overwriting any file that the user under
|
|
which apache runs has privileges to write.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<freebsdpr>ports/77513</freebsdpr>
|
|
<url>http://security.lss.hr/en/index.php?page=details&ID=LSS-2005-01-01</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-01-04</discovery>
|
|
<entry>2005-01-24</entry>
|
|
<modified>2005-02-22</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="b4d94fa0-6e38-11d9-9e1e-c296ac722cb3">
|
|
<topic>squid -- possible cache-poisoning via malformed HTTP responses</topic>
|
|
<affects>
|
|
<package>
|
|
<name>squid</name>
|
|
<range><lt>2.5.7_9</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The squid patches page notes:</p>
|
|
<blockquote cite="http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-header_parsing">
|
|
<p>This patch makes Squid considerably stricter while
|
|
parsing the HTTP protocol.</p>
|
|
<ol>
|
|
<li>A Content-length header should only appear once in a
|
|
valid request or response. Multiple Content-length
|
|
headers, in conjunction with specially crafted requests,
|
|
may allow Squid's cache to be poisoned with bad content
|
|
in certain situations.</li>
|
|
<li>CR characters is only allowed as part of the CR NL
|
|
line terminator, not alone. This to ensure that all
|
|
involved agrees on the structure of HTTP headers.</li>
|
|
<li>Rejects requests/responses that have whitespace in an
|
|
HTTP header name.</li>
|
|
</ol>
|
|
</blockquote>
|
|
<p>To enable these strict parsing rules, update to at least
|
|
squid-2.5.7_9 and specify <code>relaxed_header_parser
|
|
off</code> in squid.conf.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-0174</cvename>
|
|
<url>http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-header_parsing</url>
|
|
<certvu>768702</certvu>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-01-24</discovery>
|
|
<entry>2005-01-24</entry>
|
|
<modified>2006-01-02</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="97c3a452-6e36-11d9-8324-000a95bc6fae">
|
|
<topic>bugzilla -- cross-site scripting vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>bugzilla</name>
|
|
<name>ja-bugzilla</name>
|
|
<range><lt>2.16.8</lt></range>
|
|
<range><ge>2.17.*</ge><lt>2.18</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A Bugzilla advisory states:</p>
|
|
<blockquote cite="http://www.bugzilla.org/security/2.16.7-nr/">
|
|
<p>This advisory covers a single cross-site scripting issue
|
|
that has recently been discovered and fixed in the
|
|
Bugzilla code: If a malicious user links to a Bugzilla
|
|
site using a specially crafted URL, a script in the error
|
|
page generated by Bugzilla will display the URL unaltered
|
|
in the page, allowing scripts embedded in the URL to
|
|
execute.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-1061</cvename>
|
|
<url>http://www.bugzilla.org/security/2.16.7-nr/</url>
|
|
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=272620</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-12-01</discovery>
|
|
<entry>2005-01-24</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="b0911985-6e2a-11d9-9557-000a95bc6fae">
|
|
<topic>web browsers -- window injection vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>firefox</name>
|
|
<range><lt>1.0.1,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>mozilla</name>
|
|
<range><lt>1.7.6,2</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-mozilla</name>
|
|
<name>linux-mozilla-devel</name>
|
|
<range><lt>1.7.6</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>de-linux-mozillafirebird</name>
|
|
<name>el-linux-mozillafirebird</name>
|
|
<name>ja-linux-mozillafirebird-gtk1</name>
|
|
<name>ja-mozillafirebird-gtk2</name>
|
|
<name>linux-mozillafirebird</name>
|
|
<name>ru-linux-mozillafirebird</name>
|
|
<name>zhCN-linux-mozillafirebird</name>
|
|
<name>zhTW-linux-mozillafirebird</name>
|
|
<name>de-netscape7</name>
|
|
<name>fr-netscape7</name>
|
|
<name>ja-netscape7</name>
|
|
<name>netscape7</name>
|
|
<name>pt_BR-netscape7</name>
|
|
<name>mozilla-gtk1</name>
|
|
<range><ge>0</ge></range>
|
|
</package>
|
|
<package>
|
|
<!-- These package names are obsolete. -->
|
|
<name>de-linux-netscape</name>
|
|
<name>fr-linux-netscape</name>
|
|
<name>ja-linux-netscape</name>
|
|
<name>linux-netscape</name>
|
|
<name>linux-phoenix</name>
|
|
<name>mozilla+ipv6</name>
|
|
<name>mozilla-embedded</name>
|
|
<name>mozilla-firebird</name>
|
|
<name>mozilla-gtk2</name>
|
|
<name>mozilla-gtk</name>
|
|
<name>mozilla-thunderbird</name>
|
|
<name>phoenix</name>
|
|
<range><ge>0</ge></range>
|
|
</package>
|
|
<package>
|
|
<name>kdebase</name>
|
|
<name>kdelibs</name>
|
|
<range><lt>3.3.2</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>opera</name>
|
|
<name>opera-devel</name>
|
|
<name>linux-opera</name>
|
|
<range><lt>7.54.20050131</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A Secunia Research advisory reports:</p>
|
|
<blockquote cite="http://secunia.com/secunia_research/2004-13/advisory/">
|
|
<p>Secunia Research has reported a vulnerability in multiple
|
|
browsers, which can be exploited by malicious people to
|
|
spoof the content of websites.</p>
|
|
<p>The problem is that a website can inject content into
|
|
another site's window if the target name of the window is
|
|
known. This can e.g. be exploited by a malicious website
|
|
to spoof the content of a pop-up window opened on a
|
|
trusted website.</p>
|
|
<p>Secunia has constructed a test, which can be used to
|
|
check if your browser is affected by this issue:
|
|
<a href="http://secunia.com/multiple_browsers_window_injection_vulnerability_test/">http://secunia.com/multiple_browsers_window_injection_vulnerability_test/</a></p>
|
|
</blockquote>
|
|
<p>A <a href="http://mozillanews.org/?article_date=2004-12-08+06-48-46">workaround
|
|
for Mozilla-based browsers</a> is available.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://secunia.com/secunia_research/2004-13/advisory/</url>
|
|
<url>http://secunia.com/multiple_browsers_window_injection_vulnerability_test/</url>
|
|
<!-- mozilla -->
|
|
<cvename>CVE-2004-1156</cvename>
|
|
<url>http://secunia.com/advisories/13129/</url>
|
|
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=273699</url>
|
|
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=103638</url>
|
|
<url>http://mozillanews.org/?article_date=2004-12-08+06-48-46</url>
|
|
<!-- opera -->
|
|
<cvename>CVE-2004-1157</cvename>
|
|
<url>http://secunia.com/advisories/13253/</url>
|
|
<!-- konqueror -->
|
|
<cvename>CVE-2004-1158</cvename>
|
|
<url>http://secunia.com/advisories/13254/</url>
|
|
<url>http://www.kde.org/info/security/advisory-20041213-1.txt</url>
|
|
<!-- netscape -->
|
|
<cvename>CVE-2004-1160</cvename>
|
|
<url>http://secunia.com/advisories/13402/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-12-08</discovery>
|
|
<entry>2005-01-24</entry>
|
|
<modified>2005-02-26</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="d4a7054a-6d96-11d9-a9e7-0001020eed82">
|
|
<topic>yamt -- arbitrary command execution vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>yamt</name>
|
|
<range><lt>0.5_2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Manigandan Radhakrishnan discovered a security
|
|
vulnerability in YAMT which can lead to execution of
|
|
arbitrary commands with the privileges of the user running
|
|
YAMT when sorting based on MP3 tags. The problem exist in
|
|
the <code>id3tag_sort()</code> routine which does not
|
|
properly sanitize the artist tag from the MP3 file before
|
|
using it as an argument to the mv command.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>11999</bid>
|
|
<cvename>CVE-2004-1302</cvename>
|
|
<url>http://tigger.uic.edu/~jlongs2/holes/yamt.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-12-15</discovery>
|
|
<entry>2005-01-23</entry>
|
|
<modified>2005-01-25</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="4e4bd2c2-6bd5-11d9-9e1e-c296ac722cb3">
|
|
<topic>squid -- HTTP response splitting cache pollution attack</topic>
|
|
<affects>
|
|
<package>
|
|
<name>squid</name>
|
|
<range><lt>2.5.7_8</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>According to a whitepaper published by Sanctum, Inc., it
|
|
is possible to mount cache poisoning attacks against, among others,
|
|
squid proxies by inserting false replies into the HTTP stream.</p>
|
|
<p>The squid patches page notes:</p>
|
|
<blockquote cite="http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-response_splitting">
|
|
<p>This patch additionally strengthens Squid from the HTTP response
|
|
attack described by Sanctum.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-0175</cvename>
|
|
<url>http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-response_splitting</url>
|
|
<url>http://www.squid-cache.org/bugs/show_bug.cgi?id=1200</url>
|
|
<url>https://www.watchfire.com/securearea/whitepapers.aspx?id=8</url>
|
|
<certvu>625878</certvu>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-03-01</discovery>
|
|
<entry>2005-01-22</entry>
|
|
<modified>2005-02-07</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="338d1723-5f03-11d9-92a7-000bdb1444a4">
|
|
<topic>horde -- XSS vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>horde</name>
|
|
<name>horde-php5</name>
|
|
<range><gt>3.*</gt><lt>3.0.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A Hyperdose Security Advisory reports:</p>
|
|
<blockquote cite="http://lists.horde.org/archives/announce/2005/000159.html">
|
|
<p>Horde contains two XSS attacks that can be exploited
|
|
through GET requests. Once exploited, these requests
|
|
could be used to execute any javascript commands in the
|
|
context of that user, potentially including but not
|
|
limited to reading and deleting email, and stealing auth
|
|
tokens.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>12255</bid>
|
|
<mlist msgid="1105593825.8638@mx249a.mysite4now.com">http://marc.theaimsgroup.com/?l=bugtraq&m=110564059322774</mlist>
|
|
<mlist>http://lists.horde.org/archives/announce/2005/000159.html</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-01-04</discovery>
|
|
<entry>2005-01-22</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="2b2b333b-6bd3-11d9-95f8-000a95bc6fae">
|
|
<topic>mc -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>mc</name>
|
|
<range><lt>4.6.0</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Andrew V. Samoilov reported several vulnerabilities that
|
|
were corrected in MidnightCommand 4.6.0:</p>
|
|
<ul>
|
|
<li>Format string issues (CVE-2004-1004)</li>
|
|
<li>Buffer overflows (CVE-2004-1005)</li>
|
|
<li>Denial-of-service, infinite loop (CVE-2004-1009)</li>
|
|
<li>Denial-of-service, corrupted section header
|
|
(CVE-2004-1090)</li>
|
|
<li>Denial-of-service, null pointer dereference (CVE-2004-1091)</li>
|
|
<li>Freeing unallocated memory (CVE-2004-1092)</li>
|
|
<li>Using already freed memory (CVE-2004-1093)</li>
|
|
</ul>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-1004</cvename>
|
|
<cvename>CVE-2004-1005</cvename>
|
|
<cvename>CVE-2004-1009</cvename>
|
|
<cvename>CVE-2004-1090</cvename>
|
|
<cvename>CVE-2004-1091</cvename>
|
|
<cvename>CVE-2004-1092</cvename>
|
|
<cvename>CVE-2004-1093</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-12-01</discovery>
|
|
<entry>2005-01-21</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="c418d472-6bd1-11d9-93ca-000a95bc6fae">
|
|
<topic>perl -- File::Path insecure file/directory permissions</topic>
|
|
<affects>
|
|
<package>
|
|
<name>perl</name>
|
|
<name>perl-threaded</name>
|
|
<range><ge>0</ge><lt>5.6.2</lt></range>
|
|
<range><ge>5.8.0</ge><lt>5.8.6</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Jeroen van Wolffelaar reports that the Perl module File::Path
|
|
contains a race condition wherein traversed directories and files
|
|
are temporarily made world-readable/writable.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0452</cvename>
|
|
<url>http://www.debian.org/security/2004/dsa-620</url>
|
|
<url>http://xforce.iss.net/xforce/xfdb/18650</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-12-30</discovery>
|
|
<entry>2005-01-21</entry>
|
|
<modified>2007-11-07</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="e8c6ade2-6bcc-11d9-8e6f-000a95bc6fae">
|
|
<cancelled superseded="e3cf89f0-53da-11d9-92b7-ceadd4ac2edd"/>
|
|
</vuln>
|
|
|
|
<vuln vid="1489df94-6bcb-11d9-a21e-000a95bc6fae">
|
|
<topic>opera -- multiple vulnerabilities in Java implementation</topic>
|
|
<affects>
|
|
<package>
|
|
<name>opera</name>
|
|
<name>opera-devel</name>
|
|
<name>linux-opera</name>
|
|
<range><lt>7.54.20041210</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Marc Schoenefeld reports:</p>
|
|
<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&m=110088923127820">
|
|
<p>Opera 7.54 is vulnerable to leakage of the java sandbox,
|
|
allowing malicious applets to gain unacceptable
|
|
privileges. This allows them to be used for information
|
|
gathering (spying) of local identity information and
|
|
system configurations as well as causing annoying crash
|
|
effects.</p>
|
|
<p>Opera 754 <em>[sic]</em> which was released Aug 5,2004 is
|
|
vulnerable to the XSLT processor covert channel attack,
|
|
which was corrected with JRE 1.4.2_05 [released in July
|
|
04], but in disadvantage to the users the opera packaging
|
|
guys chose to bundle the JRE 1.4.2_04 <em>[...]</em></p>
|
|
<p>Internal pointer DoS exploitation: Opera.jar contains the
|
|
opera replacement of the java plugin. It therefore handles
|
|
communication between javascript and the Java VM via the
|
|
liveconnect protocol. The public class EcmaScriptObject
|
|
exposes a system memory pointer to the java address space,
|
|
by constructing a special variant of this type an internal
|
|
cache table can be polluted by false entries that infer
|
|
proper function of the JSObject class and in the following
|
|
proof-of-concept crash the browser.</p>
|
|
<p>Exposure of location of local java installation Sniffing
|
|
the URL classpath allows to retrieve the URLs of the
|
|
bootstrap class path and therefore the JDK installation
|
|
directory.</p>
|
|
<p>Exposure of local user name to an untrusted applet An
|
|
attacker could use the sun.security.krb5.Credentials class
|
|
to retrieve the name of the currently logged in user and
|
|
parse his home directory from the information which is
|
|
provided by the thrown
|
|
java.security.AccessControlException.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<mlist msgid="Pine.A41.4.58.0411191800510.57436@zivunix.uni-muenster.de">http://marc.theaimsgroup.com/?l=bugtraq&m=110088923127820</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-11-19</discovery>
|
|
<entry>2005-01-24</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="045944a0-6bca-11d9-aaa6-000a95bc6fae">
|
|
<topic>sudo -- environmental variable CDPATH is not cleared</topic>
|
|
<affects>
|
|
<package>
|
|
<name>sudo</name>
|
|
<range><lt>1.6.8.4</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A sudo bug report says:</p>
|
|
<blockquote cite="http://www.sudo.ws/bugs/show_bug.cgi?id=155">
|
|
<p>sudo doesn't unset the CDPATH variable, which leads to
|
|
possible security problems.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://www.sudo.ws/bugs/show_bug.cgi?id=155</url>
|
|
<mlist>http://www.sudo.ws/pipermail/sudo-announce/2004-November/000044.html</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-10-18</discovery>
|
|
<entry>2005-01-21</entry>
|
|
<modified>2013-06-19</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="e480ccb2-6bc8-11d9-8dbe-000a95bc6fae">
|
|
<topic>fcron -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>fcron</name>
|
|
<range><lt>2.9.5.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>An iDEFENSE Security Advisory states:</p>
|
|
<blockquote cite="http://www.idefense.com/application/poi/display?id=157&type=vulnerabilities&flashstatus=false">
|
|
<p>Multiple vulnerabilities have been found in Fcron.</p>
|
|
<ol>
|
|
<li>File contents disclosure</li>
|
|
<li>Configuration Bypass Vulnerability</li>
|
|
<li>File Removal and Empty File Creation Vulnerability</li>
|
|
<li>Information Disclosure Vulnerability</li>
|
|
</ol>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://www.idefense.com/application/poi/display?id=157&type=vulnerabilities&flashstatus=false</url>
|
|
<cvename>CVE-2004-1030</cvename>
|
|
<cvename>CVE-2004-1031</cvename>
|
|
<cvename>CVE-2004-1032</cvename>
|
|
<cvename>CVE-2004-1033</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-11-15</discovery>
|
|
<entry>2005-01-21</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="02274fd9-6bc5-11d9-8edb-000a95bc6fae">
|
|
<topic>realplayer -- arbitrary file deletion and other vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>linux-realplayer</name>
|
|
<range><lt>10.0.2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>An NGSSoftware Insight Security Research Advisory reports:</p>
|
|
<blockquote cite="http://www.ngssoftware.com/advisories/real-03full.txt">
|
|
<p>Two vulnerabilities have been discovered in RealPlayer
|
|
which may potentially be leveraged to allow remote code
|
|
execution, or may used in combination with the Real
|
|
Metadata Package File Deletion vulnerability to reliably
|
|
delete files from a users system.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://www.ngssoftware.com/advisories/real-02full.txt</url>
|
|
<url>http://www.ngssoftware.com/advisories/real-03full.txt</url>
|
|
<url>http://service.real.com/help/faq/security/040928_player/EN/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-10-06</discovery>
|
|
<entry>2005-01-21</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="2001103a-6bbd-11d9-851d-000a95bc6fae">
|
|
<topic>imlib -- xpm heap buffer overflows and integer overflows</topic>
|
|
<affects>
|
|
<package>
|
|
<name>imlib</name>
|
|
<range><lt>1.9.15_2</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>imlib2</name>
|
|
<range><lt>1.1.2_1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Pavel Kankovsky reports:</p>
|
|
<blockquote cite="https://bugzilla.fedora.us/show_bug.cgi?id=2051#c11">
|
|
<p>Imlib affected by a variant of CAN-2004-0782 too.</p>
|
|
<p>I've discovered more vulnerabilities in Imlib
|
|
(1.9.13). In particular, it appears to be affected by a
|
|
variant of Chris Evans' libXpm flaw #1 (CAN-2004-0782, see
|
|
http://scary.beasts.org/security/CESA-2004-003.txt). Look
|
|
at the attached image, it kills ee on my 7.3.</p>
|
|
</blockquote>
|
|
<p>The flaws also affect imlib2.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-1025</cvename>
|
|
<cvename>CVE-2004-1026</cvename>
|
|
<bid>11830</bid>
|
|
<url>https://bugzilla.fedora.us/show_bug.cgi?id=2051#c11</url>
|
|
<url>https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=138516</url>
|
|
<url>http://cvs.sourceforge.net/viewcvs.py/enlightenment/e17/libs/imlib2/src/modules/loaders/loader_xpm.c#rev1.3</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-12-06</discovery>
|
|
<entry>2005-01-21</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="39953788-6bbb-11d9-8bc9-000a95bc6fae">
|
|
<topic>egroupware -- arbitrary file download in JiNN</topic>
|
|
<affects>
|
|
<package>
|
|
<name>eGroupWare</name>
|
|
<range><lt>1.0.0.006</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>eGroupWare contains a bug in the JiNN component that allows
|
|
a remote attacker to download arbitrary files.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://cvs.sourceforge.net/viewcvs.py/egroupware/jinn/CHANGELOG#rev1.24</url>
|
|
<mlist>http://sourceforge.net/mailarchive/forum.php?thread_id=5915445&forum_id=35178</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-10-15</discovery>
|
|
<entry>2005-01-21</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="2c25e762-6bb9-11d9-93db-000a95bc6fae">
|
|
<topic>quake2 -- multiple critical vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>quake2forge</name>
|
|
<range><ge>0</ge></range>
|
|
</package>
|
|
<package>
|
|
<name>quake2lnx</name>
|
|
<range><lt>0.16.2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>An advisory published by Richard Stanway describes numerous
|
|
critical vulnerabilities in the Quake II engine:</p>
|
|
<blockquote cite="http://secur1ty.net/advisories/001">
|
|
<p>Due to unchecked input at various stages in the server,
|
|
remote users are able to cause the server to crash, reveal
|
|
sensitive information or potentially execute arbitrary
|
|
code.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://secur1ty.net/advisories/001</url>
|
|
<mlist msgid="NGEHLEPKOGIHAIJAMDPKOEHJCGAA.bugtraq@secur1ty.net">http://marc.theaimsgroup.com/?l=bugtraq&m=109892527321706</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-10-27</discovery>
|
|
<entry>2005-01-21</entry>
|
|
<modified>2005-03-15</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="5c7bb4dd-6a56-11d9-97ec-000c6e8f12ef">
|
|
<topic>konversation -- shell script command injection</topic>
|
|
<affects>
|
|
<package>
|
|
<name>konversation</name>
|
|
<range><lt>0.15</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Konversation comes with Perl scripts that do not properly escape
|
|
shell characters on executing a script. This makes it possible
|
|
to attack Konversation with shell script command injection.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-0129</cvename>
|
|
<cvename>CVE-2005-0130</cvename>
|
|
<cvename>CVE-2005-0131</cvename>
|
|
<mlist msgid="200501191739.56585.wouter@coekaerts.be">http://marc.theaimsgroup.com/?l=full-disclosure&m=110616016509114</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-01-19</discovery>
|
|
<entry>2005-01-19</entry>
|
|
<modified>2005-01-21</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="7a921e9e-68b1-11d9-9e1e-c296ac722cb3">
|
|
<topic>squid -- no sanity check of usernames in squid_ldap_auth</topic>
|
|
<affects>
|
|
<package>
|
|
<name>squid</name>
|
|
<range><lt>2.5.7_7</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The LDAP authentication helper did not strip
|
|
leading or trailing spaces from the login name.
|
|
According to the squid patches page:</p>
|
|
<blockquote cite="http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-ldap_spaces">
|
|
<p>LDAP is very forgiving about spaces in search
|
|
filters and this could be abused to log in
|
|
using several variants of the login name,
|
|
possibly bypassing explicit access controls
|
|
or confusing accounting.</p>
|
|
<p>Workaround: Block logins with spaces</p>
|
|
<pre>
|
|
acl login_with_spaces proxy_auth_regex [:space:]
|
|
http_access deny login_with_spaces
|
|
</pre>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-0173</cvename>
|
|
<url>http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-ldap_spaces</url>
|
|
<url>http://www.squid-cache.org/bugs/show_bug.cgi?id=1187</url>
|
|
<certvu>924198</certvu>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-01-10</discovery>
|
|
<entry>2005-01-19</entry>
|
|
<modified>2005-02-08</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="990cf07e-6988-11d9-a9e7-0001020eed82">
|
|
<topic>cups-base -- CUPS server remote DoS vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>cups-base</name>
|
|
<range><ge>1.1.21</ge><lt>1.1.23</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Kenshi Muto discovered that the CUPS server would enter an
|
|
infinite loop when processing a URL containing
|
|
<q><code>/..</code></q>.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>12200</bid>
|
|
<cvename>CVE-2005-2874</cvename>
|
|
<url>http://www.cups.org/str.php?L1042</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-12-30</discovery>
|
|
<entry>2005-01-18</entry>
|
|
<modified>2005-09-21</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="b58ff497-6977-11d9-ae49-000c41e2cdad">
|
|
<topic>tiff -- divide-by-zero denial-of-service</topic>
|
|
<affects>
|
|
<package>
|
|
<name>tiff</name>
|
|
<name>linux-tiff</name>
|
|
<range><lt>3.6.0</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>pdflib</name>
|
|
<name>pdflib-perl</name>
|
|
<range><lt>6.0.1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>gdal</name>
|
|
<range><lt>1.2.1_2</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>ivtools</name>
|
|
<range><lt>1.2.3</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>paraview</name>
|
|
<range><lt>2.4.3</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>fractorama</name>
|
|
<range><lt>1.6.7_1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>iv</name>
|
|
<name>ja-iv</name>
|
|
<name>ja-libimg</name>
|
|
<range><gt>0</gt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A US-CERT vulnerability note reports:</p>
|
|
<blockquote cite="http://www.kb.cert.org/vuls/id/555304">
|
|
<p>An Integer overflow in the LibTIFF library may allow a
|
|
remote attacker to cause a divide-by-zero error that results
|
|
in a denial-of-service condition.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0804</cvename>
|
|
<certvu>555304</certvu>
|
|
<url>http://bugzilla.remotesensing.org/show_bug.cgi?id=111</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2002-03-27</discovery>
|
|
<entry>2005-01-18</entry>
|
|
<modified>2006-06-08</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="249a8c42-6973-11d9-ae49-000c41e2cdad">
|
|
<topic>zgv -- exploitable heap overflows</topic>
|
|
<affects>
|
|
<package>
|
|
<name>zgv</name>
|
|
<range><lt>5.8_1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>xzgv</name>
|
|
<range><lt>0.8_2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>infamous41md reports:</p>
|
|
<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&m=109886210702781">
|
|
<p>zgv uses malloc() frequently to allocate memory for storing
|
|
image data. When calculating how much to allocate, user
|
|
supplied data from image headers is multiplied and/or added
|
|
without any checks for arithmetic overflows. We can
|
|
overflow numerous calculations, and cause small buffers to
|
|
be allocated. Then we can overflow the buffer, and
|
|
eventually execute code. There are a total of
|
|
11 overflows that are exploitable to execute arbitrary
|
|
code.</p>
|
|
</blockquote>
|
|
<p>These bugs exist in both zgv and xzgv.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<mlist msgid="20041025210717.2799d9c1.infamous41md@hotpop.com">http://marc.theaimsgroup.com/?l=bugtraq&m=109886210702781</mlist>
|
|
<mlist msgid="20041027233907.A3678@netdirect.ca">http://marc.theaimsgroup.com/?l=bugtraq&m=109898111915661</mlist>
|
|
<url>http://rus.members.beeb.net/xzgv.html</url>
|
|
<url>http://www.svgalib.org/rus/zgv/</url>
|
|
<cvename>CVE-2004-0994</cvename>
|
|
<url>http://www.idefense.com/application/poi/display?id=160&type=vulnerabilities&flashstatus=false</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-10-26</discovery>
|
|
<entry>2005-01-18</entry>
|
|
<modified>2005-01-21</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="a77849a5-696f-11d9-ae49-000c41e2cdad">
|
|
<topic>mozilla -- insecure permissions for some downloaded files</topic>
|
|
<affects>
|
|
<package>
|
|
<name>thunderbird</name>
|
|
<range><lt>0.9</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>de-linux-mozillafirebird</name>
|
|
<name>el-linux-mozillafirebird</name>
|
|
<name>firefox</name>
|
|
<name>ja-linux-mozillafirebird-gtk1</name>
|
|
<name>ja-mozillafirebird-gtk2</name>
|
|
<name>linux-mozillafirebird</name>
|
|
<name>ru-linux-mozillafirebird</name>
|
|
<name>zhCN-linux-mozillafirebird</name>
|
|
<name>zhTW-linux-mozillafirebird</name>
|
|
<range><lt>1.0.r2,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>de-netscape7</name>
|
|
<name>fr-netscape7</name>
|
|
<name>ja-netscape7</name>
|
|
<name>netscape7</name>
|
|
<name>pt_BR-netscape7</name>
|
|
<range><le>7.2</le></range>
|
|
</package>
|
|
<package>
|
|
<name>mozilla-gtk1</name>
|
|
<name>linux-mozilla</name>
|
|
<name>linux-mozilla-devel</name>
|
|
<range><lt>1.7.5</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>mozilla</name>
|
|
<range><lt>1.7.5,2</lt></range>
|
|
</package>
|
|
<package>
|
|
<!-- These package names are obsolete. -->
|
|
<name>de-linux-netscape</name>
|
|
<name>fr-linux-netscape</name>
|
|
<name>ja-linux-netscape</name>
|
|
<name>linux-netscape</name>
|
|
<name>linux-phoenix</name>
|
|
<name>mozilla+ipv6</name>
|
|
<name>mozilla-embedded</name>
|
|
<name>mozilla-firebird</name>
|
|
<name>mozilla-gtk2</name>
|
|
<name>mozilla-gtk</name>
|
|
<name>mozilla-thunderbird</name>
|
|
<name>phoenix</name>
|
|
<range><ge>0</ge></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>In a Mozilla bug report, Daniel Kleinsinger writes:</p>
|
|
<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=251297">
|
|
<p>I was comparing treatment of attachments opened directly
|
|
from emails on different platforms. I discovered that Linux
|
|
builds save attachments in /tmp with world readable rights.
|
|
This doesn't seem like a good thing. Couldn't someone else
|
|
logged onto the same machine read your attachments?</p>
|
|
</blockquote>
|
|
<p>This could expose the contents of downloaded files or email
|
|
attachments to other users on a multi-user system.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=251297</url>
|
|
<mlist msgid="417C19F1.2040107@ptraced.net">http://marc.theaimsgroup.com/?l=full-disclosure&m=109865078103911</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-07-13</discovery>
|
|
<entry>2005-01-18</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="0f5a2b4d-694b-11d9-a9e7-0001020eed82">
|
|
<topic>awstats -- remote command execution vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>awstats</name>
|
|
<range><lt>6.3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>An iDEFENSE Security Advisory reports:</p>
|
|
<blockquote cite="http://marc.theaimsgroup.com/?l=full-disclosure&m=110600949323439">
|
|
<p>Remote exploitation of an input validation vulnerability
|
|
in AWStats allows attackers to execute arbitrary commands
|
|
under the privileges of the web server.</p>
|
|
<p>The problem specifically exists when the application is
|
|
running as a CGI script on a web server. The "configdir"
|
|
parameter contains unfiltered user-supplied data that is
|
|
utilized in a call to the Perl routine open()...</p>
|
|
<p>Successful exploitation allows remote attackers to
|
|
execute arbitrary commands under the privileges of the web
|
|
server. This can lead to further compromise as it provides
|
|
remote attackers with local access.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>12270</bid>
|
|
<cvename>CVE-2005-0116</cvename>
|
|
<certvu>272296</certvu>
|
|
<mlist msgid="FB24803D1DF2A34FA59FC157B77C970503C8B20C@idserv04.idef.com">http://marc.theaimsgroup.com/?l=full-disclosure&m=110600949323439</mlist>
|
|
<url>http://awstats.sourceforge.net/docs/awstats_changelog.txt</url>
|
|
<url>http://www.idefense.com/application/poi/display?id=185&type=vulnerabilities&flashstatus=false</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-10-21</discovery>
|
|
<entry>2005-01-18</entry>
|
|
<modified>2005-02-23</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="597e2bee-68ea-11d9-a9e7-0001020eed82">
|
|
<topic>ImageMagick -- PSD handler heap overflow vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>ImageMagick</name>
|
|
<name>ImageMagick-nox11</name>
|
|
<range><lt>6.1.8.8</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>An iDEFENSE Security Advisory reports:</p>
|
|
<blockquote cite="http://www.idefense.com/application/poi/display?id=184&type=vulnerabilities">
|
|
<p>Remote exploitation of a buffer overflow vulnerability in
|
|
The ImageMagick's Project's ImageMagick PSD image-decoding
|
|
module could allow an attacker to execute arbitrary
|
|
code.</p>
|
|
<p>Exploitation may allow attackers to run arbitrary code on
|
|
a victim's computer if the victim opens a specially
|
|
formatted image. Such images could be delivered by e-mail
|
|
or HTML, in some cases, and would likely not raise
|
|
suspicion on the victim's part. Exploitation is also
|
|
possible when a web-based application uses ImageMagick to
|
|
process user-uploaded image files.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-0005</cvename>
|
|
<url>http://www.idefense.com/application/poi/display?id=184&type=vulnerabilities</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-12-21</discovery>
|
|
<entry>2005-01-18</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="7850a238-680a-11d9-a9e7-0001020eed82">
|
|
<topic>cups-lpr -- lppasswd multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>cups-lpr</name>
|
|
<name>fr-cups-lpr</name>
|
|
<range><lt>1.1.23</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>D. J. Bernstein reports that Bartlomiej Sieka has
|
|
discovered several security vulnerabilities in lppasswd,
|
|
which is part of CUPS. In the following excerpt from
|
|
Bernstein's email, CVE names have been added for each issue:</p>
|
|
<blockquote cite="http://tigger.uic.edu/~jlongs2/holes/cups2.txt">
|
|
<p>First, lppasswd blithely ignores write errors in
|
|
fputs(line,outfile) at lines 311 and 315 of lppasswd.c,
|
|
and in fprintf(...) at line 346. An attacker who fills up
|
|
the disk at the right moment can arrange for
|
|
/usr/local/etc/cups/passwd to be truncated.
|
|
<em>(CAN-2004-1268)</em></p>
|
|
<p>Second, if lppasswd bumps into a file-size resource limit
|
|
while writing passwd.new, it leaves passwd.new in place,
|
|
disabling all subsequent invocations of lppasswd. Any
|
|
local user can thus disable lppasswd...
|
|
<em>(CAN-2004-1269)</em></p>
|
|
<p>Third, line 306 of lppasswd.c prints an error message to
|
|
stderr but does not exit. This is not a problem on systems
|
|
that ensure that file descriptors 0, 1, and 2 are open for
|
|
setuid programs, but it is a problem on other systems;
|
|
lppasswd does not check that passwd.new is different from
|
|
stderr, so it ends up writing a user-controlled error
|
|
message to passwd if the user closes file descriptor
|
|
2. <em>(CAN-2004-1270)</em></p>
|
|
</blockquote>
|
|
<p><strong>Note:</strong> The third issue, CVE-2004-1270, does
|
|
not affect FreeBSD 4.6-RELEASE or later systems, as these
|
|
systems ensure that the file descriptors 0, 1, and 2 are
|
|
always open for set-user-ID and set-group-ID programs.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-1268</cvename>
|
|
<cvename>CVE-2004-1269</cvename>
|
|
<cvename>CVE-2004-1270</cvename>
|
|
<bid>12007</bid>
|
|
<bid>12004</bid>
|
|
<url>http://www.cups.org/str.php?L1023</url>
|
|
<url>http://tigger.uic.edu/~jlongs2/holes/cups2.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-12-11</discovery>
|
|
<entry>2005-01-17</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="40a3bca2-6809-11d9-a9e7-0001020eed82">
|
|
<topic>cups-base -- HPGL buffer overflow vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>cups-base</name>
|
|
<name>fr-cups-base</name>
|
|
<range><lt>1.1.22.0_2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Ariel Berkman has discovered a buffer overflow
|
|
vulnerability in CUPS's HPGL input driver. This
|
|
vulnerability could be exploited to execute arbitrary code
|
|
with the permission of the CUPS server by printing a
|
|
specially crated HPGL file.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>11968</bid>
|
|
<cvename>CVE-2004-1267</cvename>
|
|
<url>http://tigger.uic.edu/~jlongs2/holes/cups.txt</url>
|
|
<url>http://www.cups.org/str.php?L1024</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-12-15</discovery>
|
|
<entry>2005-01-17</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="ce109fd4-67f3-11d9-a9e7-0001020eed82">
|
|
<topic>mysql-scripts -- mysqlaccess insecure temporary file creation</topic>
|
|
<affects>
|
|
<package>
|
|
<name>mysql-scripts</name>
|
|
<range><lt>3.23.58_2</lt></range>
|
|
<range><gt>4.*</gt><lt>4.0.23a_1</lt></range>
|
|
<range><gt>4.1.*</gt><lt>4.1.9_1</lt></range>
|
|
<range><gt>5.*</gt><lt>5.0.2_1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Debian Security Team reports:</p>
|
|
<blockquote>
|
|
<p>Javier Fernández-Sanguino Peña from the Debian Security
|
|
Audit Project discovered a temporary file vulnerability in
|
|
the mysqlaccess script of MySQL that could allow an
|
|
unprivileged user to let root overwrite arbitrary files
|
|
via a symlink attack and could also could unveil the
|
|
contents of a temporary file which might contain sensitive
|
|
information.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-0004</cvename>
|
|
<url>http://lists.mysql.com/internals/20600</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-01-12</discovery>
|
|
<entry>2005-01-16</entry>
|
|
<modified>2005-01-17</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="f2d5e56e-67eb-11d9-a9e7-0001020eed82">
|
|
<topic>unrtf -- buffer overflow vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>unrtf</name>
|
|
<range><lt>0.19.3_1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Yosef Klein and Limin Wang have found a buffer overflow
|
|
vulnerability in unrtf that can allow an attacker to execute
|
|
arbitrary code with the permissions of the user running
|
|
unrtf, by running unrtf on a specially crafted rtf
|
|
document.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>12030</bid>
|
|
<cvename>CVE-2004-1297</cvename>
|
|
<url>http://tigger.uic.edu/~jlongs2/holes/unrtf.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-12-15</discovery>
|
|
<entry>2005-01-16</entry>
|
|
<modified>2005-02-11</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="3fbf9db2-658b-11d9-abad-000a95bc6fae">
|
|
<topic>mozilla -- heap overflow in NNTP handler</topic>
|
|
<affects>
|
|
<package>
|
|
<name>de-netscape7</name>
|
|
<name>fr-netscape7</name>
|
|
<name>ja-netscape7</name>
|
|
<name>netscape7</name>
|
|
<name>pt_BR-netscape7</name>
|
|
<range><gt>0</gt></range>
|
|
</package>
|
|
<package>
|
|
<name>mozilla-gtk1</name>
|
|
<name>linux-mozilla</name>
|
|
<name>linux-mozilla-devel</name>
|
|
<range><lt>1.7.5</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>mozilla</name>
|
|
<range><lt>1.7.5,2</lt></range>
|
|
</package>
|
|
<package>
|
|
<!-- These package names are obsolete. -->
|
|
<name>de-linux-netscape</name>
|
|
<name>fr-linux-netscape</name>
|
|
<name>ja-linux-netscape</name>
|
|
<name>linux-netscape</name>
|
|
<name>mozilla+ipv6</name>
|
|
<name>mozilla-embedded</name>
|
|
<name>mozilla-gtk2</name>
|
|
<name>mozilla-gtk</name>
|
|
<range><ge>0</ge></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Maurycy Prodeus reports a critical vulnerability in
|
|
Mozilla-based browsers:</p>
|
|
<blockquote cite="http://isec.pl/vulnerabilities/isec-0020-mozilla.txt">
|
|
<p>Mozilla browser supports NNTP urls. Remote side is able to
|
|
trigger news:// connection to any server. I found a flaw in
|
|
NNTP handling code which may cause heap overflow and allow
|
|
remote attacker to execute arbitrary code on client
|
|
machine.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-1316</cvename>
|
|
<url>http://isec.pl/vulnerabilities/isec-0020-mozilla.txt</url>
|
|
<mlist msgid="Pine.LNX.4.44.0412292228440.19239-200000@isec.pl">http://marc.theaimsgroup.com/?l=bugtraq&m=110436284718949</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-12-29</discovery>
|
|
<entry>2005-01-13</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="3cc84400-6576-11d9-a9e7-0001020eed82">
|
|
<topic>mpg123 -- buffer overflow vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>mpg123</name>
|
|
<name>mpg123-nas</name>
|
|
<name>mpg123-esound</name>
|
|
<range><lt>0.59r_17</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Yuri D'Elia has found a buffer overflow vulnerability in
|
|
mpg123's parsing of frame headers in input streams. This
|
|
vulnerability can potentially lead to execution of arbitrary
|
|
code with the permissions of the user running mpg123, if the
|
|
user runs mpg123 on a specially crafted MP2 or MP3 file.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0991</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-01-01</discovery>
|
|
<entry>2005-01-13</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="5fe7e27a-64cb-11d9-9e1e-c296ac722cb3">
|
|
<topic>squid -- denial of service with forged WCCP messages</topic>
|
|
<affects>
|
|
<package>
|
|
<name>squid</name>
|
|
<range><lt>2.5.7_6</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The squid patches page notes:</p>
|
|
<blockquote cite="http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-wccp_denial_of_service">
|
|
<p>WCCP_I_SEE_YOU messages contain a 'number of caches'
|
|
field which should be between 1 and 32. Values outside
|
|
that range may crash Squid if WCCP is enabled, and if an
|
|
attacker can spoof UDP packets with the WCCP router's IP
|
|
address.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-0095</cvename>
|
|
<url>http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-wccp_denial_of_service</url>
|
|
<url>http://www.squid-cache.org/bugs/show_bug.cgi?id=1190</url>
|
|
<url>http://www.squid-cache.org/Advisories/SQUID-2005_2.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-01-07</discovery>
|
|
<entry>2005-01-12</entry>
|
|
<modified>2005-01-22</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="184ab9e0-64cd-11d9-9e1e-c296ac722cb3">
|
|
<topic>squid -- buffer overflow vulnerability in gopherToHTML</topic>
|
|
<affects>
|
|
<package>
|
|
<name>squid</name>
|
|
<range><lt>2.5.7_6</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The squid patches page notes:</p>
|
|
<blockquote cite="http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-gopher_html_parsing">
|
|
<p>A malicious gopher server may return a response with very
|
|
long lines that cause a buffer overflow in Squid.</p>
|
|
<p>Workaround: Since gopher is very obscure these days, do
|
|
not allow Squid to any gopher servers. Use an ACL rule
|
|
like:</p>
|
|
<pre>acl Gopher proto gopher
|
|
http_access deny Gopher</pre>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-0094</cvename>
|
|
<url>http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-gopher_html_parsing</url>
|
|
<url>http://www.squid-cache.org/bugs/show_bug.cgi?id=1189</url>
|
|
<url>http://www.squid-cache.org/Advisories/SQUID-2005_1.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-01-11</discovery>
|
|
<entry>2005-01-12</entry>
|
|
<modified>2005-01-22</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="131bd7c4-64a3-11d9-829a-000a95bc6fae">
|
|
<topic>libxine -- DVD subpicture decoder heap overflow</topic>
|
|
<affects>
|
|
<package>
|
|
<name>libxine</name>
|
|
<range><lt>1.0.r6</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A xine security announcement states:</p>
|
|
<blockquote cite="http://xinehq.de/index.php/security/XSA-2004-5">
|
|
<p>A heap overflow has been found in the DVD subpicture
|
|
decoder of xine-lib. This can be used for a remote heap
|
|
overflow exploit, which can, on some systems, lead to or
|
|
help in executing malicious code with the permissions of the
|
|
user running a xine-lib based media application.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-1379</cvename>
|
|
<url>http://xinehq.de/index.php/security/XSA-2004-5</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-09-06</discovery>
|
|
<entry>2005-01-12</entry>
|
|
<modified>2005-01-19</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="b6939d5b-64a1-11d9-9106-000a95bc6fae">
|
|
<topic>libxine -- multiple vulnerabilities in VideoCD handling</topic>
|
|
<affects>
|
|
<package>
|
|
<name>libxine</name>
|
|
<range><ge>1.0.r2</ge><lt>1.0.r6</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A xine security announcement states:</p>
|
|
<blockquote cite="http://xinehq.de/index.php/security/XSA-2004-4">
|
|
<p>Several string overflows on the stack have been fixed in
|
|
xine-lib, some of them can be used for remote buffer
|
|
overflow exploits leading to the execution of arbitrary code
|
|
with the permissions of the user running a xine-lib based
|
|
media application.</p>
|
|
<p>Stack-based string overflows have been found:</p>
|
|
<ol>
|
|
<li>in the code which handles VideoCD MRLs</li>
|
|
<li>in VideoCD code reading the disc label</li>
|
|
<li>in the code which parses text subtitles and prepares
|
|
them for display</li>
|
|
</ol>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://xinehq.de/index.php/security/XSA-2004-4</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-09-07</discovery>
|
|
<entry>2005-01-12</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="1b70bef4-649f-11d9-a30e-000a95bc6fae">
|
|
<topic>libxine -- multiple buffer overflows in RTSP</topic>
|
|
<affects>
|
|
<package>
|
|
<name>mplayer</name>
|
|
<name>mplayer-gtk</name>
|
|
<name>mplayer-gtk2</name>
|
|
<name>mplayer-esound</name>
|
|
<name>mplayer-gtk-esound</name>
|
|
<name>mplayer-gtk2-esound</name>
|
|
<range><lt>0.99.4</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>libxine</name>
|
|
<range><lt>1.0.r4</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A xine security announcement states:</p>
|
|
<blockquote cite="http://xinehq.de/index.php/security/XSA-2004-3">
|
|
<p>Multiple vulnerabilities have been found and fixed in the
|
|
Real-Time Streaming Protocol (RTSP) client for RealNetworks
|
|
servers, including a series of potentially remotely
|
|
exploitable buffer overflows. This is a joint advisory by
|
|
the MPlayer and xine teams as the code in question is common
|
|
to these projects.</p>
|
|
<p>Severity: High (arbitrary remote code execution under the
|
|
user ID running the player) when playing Real RTSP streams.
|
|
At this time, there is no known exploit for these
|
|
vulnerabilities.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0433</cvename>
|
|
<url>http://xinehq.de/index.php/security/XSA-2004-3</url>
|
|
<url>http://xforce.iss.net/xforce/xfdb/16019</url>
|
|
<bid>10245</bid>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-05-25</discovery>
|
|
<entry>2005-01-12</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="8eabaad9-641f-11d9-92a7-000a95bc6fae">
|
|
<topic>hylafax -- unauthorized login vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>hylafax</name>
|
|
<range><lt>4.2.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A flaw in HylaFAX may allow an attacker to bypass normal
|
|
authentication by spoofing their DNS PTR records.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-1182</cvename>
|
|
<mlist msgid="20050111155949.GU9853@bilbo.x101.com">http://marc.theaimsgroup.com/?l=bugtraq&m=110546971307585</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-01-11</discovery>
|
|
<entry>2005-01-11</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="56971fa6-641c-11d9-a097-000854d03344">
|
|
<topic>xshisen -- local buffer overflows</topic>
|
|
<affects>
|
|
<package>
|
|
<name>xshisen</name>
|
|
<range><lt>1.36_1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Steve Kemp has found buffer overflows in the handling
|
|
of the command line flag -KCONV and the XSHISENLIB environment
|
|
variable. Ulf Härnhammer has detected an unbounded copy from
|
|
the GECOS field to a char array. All overflows can be exploited
|
|
to gain group games privileges.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=213957</url>
|
|
<url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=289784</url>
|
|
<cvename>CVE-2003-1053</cvename>
|
|
<cvename>CVE-2005-0117</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-01-11</discovery>
|
|
<entry>2005-01-11</entry>
|
|
<modified>2005-01-19</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="0cf3480d-5fdf-11d9-b721-00065be4b5b6">
|
|
<topic>helvis -- arbitrary file deletion problem</topic>
|
|
<affects>
|
|
<package>
|
|
<name>ko-helvis</name>
|
|
<range><le>1.8h2_1</le></range>
|
|
</package>
|
|
<package>
|
|
<name>helvis</name>
|
|
<range><le>1.8h2_1</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The setuid root elvprsv utility, used to preserve
|
|
recovery helvis files, can be abused by local users to delete
|
|
with root privileges.</p>
|
|
<p>The problem is that elvprsv deletes files when it thinks they
|
|
have become corrupt. When elvprsv is pointed to a normal file then
|
|
it will almost always think the file is corrupt and deletes it.
|
|
This behavior may be exploited by local attackers to delete critical
|
|
files.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-0120</cvename>
|
|
<url>http://people.freebsd.org/~niels/ports/korean/helvis/issues.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-11-24</discovery>
|
|
<entry>2005-01-10</entry>
|
|
<modified>2005-01-19</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="bb99f803-5fde-11d9-b721-00065be4b5b6">
|
|
<topic>helvis -- information leak vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>ko-helvis</name>
|
|
<range><le>1.8h2_1</le></range>
|
|
</package>
|
|
<package>
|
|
<name>helvis</name>
|
|
<range><le>1.8h2_1</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Once a recovery file has been preserved by the setuid root elvprsv
|
|
utility it is placed in a worldreadable directory with worldreadable
|
|
permissions. This possibly allows sensitive information to leak.</p>
|
|
<p>In addition to this information leak, it is possible for users
|
|
to recover files that belong to other users by using elvrec, another
|
|
setuid root binary.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-0118</cvename>
|
|
<cvename>CVE-2005-0119</cvename>
|
|
<url>http://people.freebsd.org/~niels/ports/korean/helvis/issues.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-11-24</discovery>
|
|
<entry>2005-01-10</entry>
|
|
<modified>2005-01-19</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="28ab7ddf-61ab-11d9-a9e7-0001020eed82">
|
|
<topic>dillo -- format string vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>dillo</name>
|
|
<range><lt>0.8.3_1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>dillo contains a format string vulnerability which could
|
|
lead to execution of arbitrary code simply by viewing a web
|
|
page or opening a HTML file.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-0012</cvename>
|
|
<url>http://bugs.gentoo.org/show_bug.cgi?id=76665</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-01-04</discovery>
|
|
<entry>2005-01-08</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="f92e1bbc-5e18-11d9-839a-0050da134090">
|
|
<topic>tnftp -- mget does not check for directory escapes</topic>
|
|
<affects>
|
|
<package>
|
|
<name>tnftp</name>
|
|
<range><lt>20050103</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>When downloading a batch of files from an FTP server the
|
|
mget command does not check for directory escapes. A
|
|
specially crafted file on the FTP server could then
|
|
potentially overwrite an existing file of the user.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-1294</cvename>
|
|
<url>http://tigger.uic.edu/~jlongs2/holes/tnftp.txt</url>
|
|
<url>http://cvsweb.netbsd.org/bsdweb.cgi/othersrc/usr.bin/tnftp/src/cmds.c?rev=1.1.1.3&content-type=text/x-cvsweb-markup</url>
|
|
<url>http://it.slashdot.org/article.pl?sid=04/12/15/2113202</url>
|
|
<mlist msgid="653D74053BA6F54A81ED83DCF969DF08CFA2AA@pivxes1.pivx.com">http://marc.theaimsgroup.com/?l=bugtraq&m=110321888413132</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-12-15</discovery>
|
|
<entry>2005-01-07</entry>
|
|
<modified>2005-01-13</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="8f86d8b5-6025-11d9-a9e7-0001020eed82">
|
|
<topic>tiff -- tiffdump integer overflow vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>tiff</name>
|
|
<range><lt>3.7.1_2</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-tiff</name>
|
|
<range><lt>3.6.1_1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Dmitry V. Levin found a potential integer overflow in the
|
|
tiffdump utility which could lead to execution of arbitrary
|
|
code. This could be exploited by tricking an user into
|
|
executing tiffdump on a specially crafted tiff image.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-1183</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-01-06</discovery>
|
|
<entry>2005-01-06</entry>
|
|
<modified>2005-03-01</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="fc7e6a42-6012-11d9-a9e7-0001020eed82">
|
|
<topic>tiff -- directory entry count integer overflow vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>tiff</name>
|
|
<range><lt>3.7.1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-tiff</name>
|
|
<range><lt>3.6.1_1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>pdflib</name>
|
|
<name>pdflib-perl</name>
|
|
<range><lt>6.0.1_1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>gdal</name>
|
|
<range><lt>1.2.1_2</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>ivtools</name>
|
|
<range><lt>1.2.3</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>paraview</name>
|
|
<range><lt>2.4.3</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>fractorama</name>
|
|
<range><lt>1.6.7_1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>iv</name>
|
|
<name>ja-iv</name>
|
|
<name>ja-libimg</name>
|
|
<range><gt>0</gt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>In an iDEFENSE Security Advisory infamous41md reports:</p>
|
|
<blockquote cite="http://www.idefense.com/application/poi/display?id=174&type=vulnerabilities">
|
|
<p>Remote exploitation of a heap-based buffer overflow
|
|
vulnerability within the LibTIFF package could allow
|
|
attackers to execute arbitrary code.</p>
|
|
<p>The vulnerability specifically exists due to insufficient
|
|
validation of user-supplied data when calculating the size
|
|
of a directory entry. A TIFF file includes a number of
|
|
directory entry header fields that describe the data in
|
|
the file. Included in these entries is an entry count and
|
|
offset value that are calculated to determine the size and
|
|
location of the data for that entry.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>12075</bid>
|
|
<cvename>CVE-2004-1308</cvename>
|
|
<url>http://www.idefense.com/application/poi/display?id=174&type=vulnerabilities</url>
|
|
<certvu>125598</certvu>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-12-17</discovery>
|
|
<entry>2005-01-06</entry>
|
|
<modified>2006-06-08</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="14e8f315-600e-11d9-a9e7-0001020eed82">
|
|
<cancelled superseded="3897a2f8-1d57-11d9-bc4a-000c41e2cdad"/>
|
|
</vuln>
|
|
|
|
<vuln vid="bd9fc2bf-5ffe-11d9-a11a-000a95bc6fae">
|
|
<topic>vim -- vulnerabilities in modeline handling</topic>
|
|
<affects>
|
|
<package>
|
|
<name>vim</name>
|
|
<name>vim-lite</name>
|
|
<name>vim+ruby</name>
|
|
<range><lt>6.3.45</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Ciaran McCreesh discovered news ways in which a VIM modeline
|
|
can be used to trojan a text file. The patch by Bram
|
|
Moolenaar reads:</p>
|
|
<blockquote cite="ftp://ftp.vim.org/pub/vim/patches/6.3/6.3.045">
|
|
<p>Problem: Unusual characters in an option value may cause
|
|
unexpected behavior, especially for a modeline. (Ciaran
|
|
McCreesh)</p>
|
|
<p>Solution: Don't allow setting termcap options or
|
|
'printdevice' or 'titleold' in a modeline. Don't list
|
|
options for "termcap" and "all" in a modeline. Don't allow
|
|
unusual characters in 'filetype', 'syntax', 'backupext',
|
|
'keymap', 'patchmode' and 'langmenu'.</p>
|
|
</blockquote>
|
|
<p><strong>Note:</strong> It is generally recommended that VIM
|
|
users use <code>set nomodeline</code> in
|
|
<code>~/.vimrc</code> to avoid the possibility of trojaned
|
|
text files.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-1138</cvename>
|
|
<url>ftp://ftp.vim.org/pub/vim/patches/6.3/6.3.045</url>
|
|
<mlist>http://groups.yahoo.com/group/vimdev/message/38084</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-12-09</discovery>
|
|
<entry>2005-01-06</entry>
|
|
<modified>2005-01-13</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="58fc2752-5f74-11d9-a9e7-0001020eed82">
|
|
<topic>pcal -- buffer overflow vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>pcal</name>
|
|
<range><lt>4.8.0</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Danny Lungstrom has found two buffer overflow
|
|
vulnerabilities in pcal which can lead to execution of
|
|
arbitrary code by making a user run pcal on a specially
|
|
crafted calendar file.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-1289</cvename>
|
|
<bid>12035</bid>
|
|
<bid>12036</bid>
|
|
<mlist msgid="20041215083219.56092.qmail@cr.yp.to">http://securesoftware.list.cr.yp.to/archive/0/46</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-12-15</discovery>
|
|
<entry>2005-01-06</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="ca9ce879-5ebb-11d9-a01c-0050569f0001">
|
|
<topic>exim -- two buffer overflow vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>exim</name>
|
|
<name>exim-ldap</name>
|
|
<name>exim-ldap2</name>
|
|
<name>exim-mysql</name>
|
|
<name>exim-postgresql</name>
|
|
<name>exim-sa-exim</name>
|
|
<range><lt>4.43+28_1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>1. The function host_aton() can overflow a buffer
|
|
if it is presented with an illegal IPv6 address
|
|
that has more than 8 components.</p>
|
|
<p>2. The second report described a buffer overflow
|
|
in the function spa_base64_to_bits(), which is part
|
|
of the code for SPA authentication.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<mlist msgid="Pine.SOC.4.61.0501041452540.1114@draco.cus.cam.ac.uk">http://www.exim.org/mail-archives/exim-announce/2005/msg00000.html</mlist>
|
|
<mlist msgid="1CE07882ECEE894CA2D5A89B8DEBC4011CFDE5@porgy.admin.idefense.com">http://marc.theaimsgroup.com/?l=bugtraq&m=110573573800377</mlist>
|
|
<cvename>CVE-2005-0021</cvename>
|
|
<cvename>CVE-2005-0022</cvename>
|
|
<bid>12185</bid>
|
|
<bid>12188</bid>
|
|
<bid>12268</bid>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-01-05</discovery>
|
|
<entry>2005-01-05</entry>
|
|
<modified>2005-01-18</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="877e918e-5362-11d9-96d4-00065be4b5b6">
|
|
<topic>mpg123 -- playlist processing buffer overflow vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>mpg123</name>
|
|
<name>mpg123-nas</name>
|
|
<name>mpg123-esound</name>
|
|
<range><le>0.59r_15</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A buffer overflow vulnerability exists in the playlist
|
|
processing of mpg123. A specially crafted playlist entry
|
|
can cause a stack overflow that can be used to inject
|
|
arbitrary code into the mpg123 process.</p>
|
|
<p>Note that a malicious playlist, demonstrating this
|
|
vulnerability, was released by the bug finder and may be
|
|
used as a template by attackers.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-1284</cvename>
|
|
<url>http://tigger.uic.edu/~jlongs2/holes/mpg123.txt</url>
|
|
<url>http://secunia.com/advisories/13511/</url>
|
|
<url>http://xforce.iss.net/xforce/xfdb/18626</url>
|
|
<bid>11958</bid>
|
|
<mlist msgid="653D74053BA6F54A81ED83DCF969DF08CFA2AA@pivxes1.pivx.com">http://marc.theaimsgroup.com/?l=bugtraq&m=110321888413132</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-12-15</discovery>
|
|
<entry>2005-01-03</entry>
|
|
<modified>2005-01-13</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="bd579366-5290-11d9-ac20-00065be4b5b6">
|
|
<topic>greed -- insecure GRX file processing</topic>
|
|
<affects>
|
|
<package>
|
|
<name>greed</name>
|
|
<range><le>0.81p</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A buffer overflow vulnerability has been detected in the greed
|
|
URL handling code. This bug can especially be a problem when greed is
|
|
used to process GRX (GetRight) files that originate from untrusted
|
|
sources.</p>
|
|
<p>The bug finder, Manigandan Radhakrishnan, gave the following
|
|
description:</p>
|
|
<blockquote cite="http://tigger.uic.edu/~jlongs2/holes/greed.txt">
|
|
<p>Here are the bugs. First, in main.c, DownloadLoop() uses strcat()
|
|
to copy an input filename to the end of a 128-byte COMMAND array.
|
|
Second, DownloadLoop() passes the input filename to system() without
|
|
checking for special characters such as semicolons.</p></blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-1273</cvename>
|
|
<cvename>CVE-2004-1274</cvename>
|
|
<url>http://tigger.uic.edu/~jlongs2/holes/greed.txt</url>
|
|
<url>http://secunia.com/advisories/13534/</url>
|
|
<mlist msgid="653D74053BA6F54A81ED83DCF969DF08CFA2AA@pivxes1.pivx.com">http://marc.theaimsgroup.com/?l=bugtraq&m=110321888413132</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-12-15</discovery>
|
|
<entry>2005-01-03</entry>
|
|
<modified>2005-01-13</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="949c470e-528f-11d9-ac20-00065be4b5b6">
|
|
<topic>golddig -- local buffer overflow vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>golddig</name>
|
|
<range><le>2.0</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Two buffer overflow vulnerabilities where detected. Both issues can
|
|
be used by local users to gain group games privileges on affected
|
|
systems.</p>
|
|
<p>The first overflow exists in the map name handling and can be
|
|
triggered when a very long name is given to the program during
|
|
command-line execution</p>
|
|
<p>The second overflow exists in the username processing while writing
|
|
the players score to disk. Excessivly long usernames, set via the USER
|
|
environment variable, are stored without any length checks in a memory
|
|
buffer.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-0121</cvename>
|
|
<mlist msgid="200412021055.iB2AtweU067125@repoman.freebsd.org">http://docs.FreeBSD.org/cgi/mid.cgi?200412021055.iB2AtweU067125</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-11-11</discovery>
|
|
<entry>2005-01-03</entry>
|
|
<modified>2005-01-19</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="927743d4-5ca9-11d9-a9e7-0001020eed82">
|
|
<topic>up-imapproxy -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>up-imapproxy</name>
|
|
<range><lt>1.2.4</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>pop3proxy</name>
|
|
<range><le>1.1</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Timo Sirainen reports:</p>
|
|
<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&m=109995749510773">
|
|
<p>There are various bugs in up-imapproxy which can crash
|
|
it. Since up-imapproxy runs in a single process with each
|
|
connection handled in a separate thread, any crash kills
|
|
all the connections and stops listening for new ones.</p>
|
|
<p>In 64bit systems it might be possible to make it leak
|
|
data (mails, passwords, ..) from other connections to
|
|
attacker's connection. However I don't think up-imapproxy
|
|
actually works in any 64bit system so this is just a
|
|
theoretical problem.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-1035</cvename>
|
|
<bid>11630</bid>
|
|
<mlist msgid="1099851138.3716.3.camel@hurina">http://marc.theaimsgroup.com/?l=bugtraq&m=109995749510773</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-11-17</discovery>
|
|
<entry>2005-01-02</entry>
|
|
<modified>2008-02-27</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="832e9d75-5bfc-11d9-a9e7-0001020eed82">
|
|
<topic>kdelibs3 -- konqueror FTP command injection vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>ja-kdelibs</name>
|
|
<name>kdelibs</name>
|
|
<range><lt>3.3.2_2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Albert Puigsech Galicia reports that Konqueror (more
|
|
specifically kio_ftp) and Microsoft Internet Explorer are
|
|
vulnerable to a FTP command injection vulnerability which
|
|
can be exploited by tricking an user into clicking a
|
|
specially crafted FTP URI.</p>
|
|
<p>It is also reported by Ian Gulliver and Emanuele Balla that
|
|
this vulnerability can be used to tricking a client into
|
|
sending out emails without user interaction.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>11827</bid>
|
|
<cvename>CVE-2004-1165</cvename>
|
|
<mlist msgid="200412051011.54045.ripe@7a69ezine.org">http://marc.theaimsgroup.com/?l=bugtraq&m=110245752232681</mlist>
|
|
<mlist msgid="20041223235620.GA2846@penguinhosting.net">http://marc.theaimsgroup.com/?l=full-disclosure&m=110387390226693</mlist>
|
|
<mlist msgid="20041224142506.GB12939@penguinhosting.net">http://marc.theaimsgroup.com/?l=full-disclosure&m=110390734925183</mlist>
|
|
<url>http://www.kde.org/info/security/advisory-20050101-1.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-12-01</discovery>
|
|
<entry>2005-01-01</entry>
|
|
<modified>2005-01-04</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="9168253c-5a6d-11d9-a9e7-0001020eed82">
|
|
<topic>a2ps -- insecure temporary file creation</topic>
|
|
<affects>
|
|
<package>
|
|
<name>a2ps-a4</name>
|
|
<name>a2ps-letter</name>
|
|
<name>a2ps-letterdj</name>
|
|
<range><lt>4.13b_3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A Secunia Security Advisory reports that Javier
|
|
Fernández-Sanguino Peña has found temporary file
|
|
creation vulnerabilities in the fixps and psmandup scripts
|
|
which are part of a2ps. These vulnerabilities could lead to
|
|
an attacker overwriting arbitrary files with the credentials
|
|
of the user running the vulnerable scripts.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-1377</cvename>
|
|
<bid>12108</bid>
|
|
<bid>12109</bid>
|
|
<url>http://secunia.com/advisories/13641/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-12-27</discovery>
|
|
<entry>2004-12-30</entry>
|
|
<modified>2005-01-19</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="64c8cc2a-59b1-11d9-8a99-000c6e8f12ef">
|
|
<topic>libxine -- buffer-overflow vulnerability in aiff support</topic>
|
|
<affects>
|
|
<package>
|
|
<name>libxine</name>
|
|
<range><le>1.0.r5_3</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Due to a buffer overflow in the open_aiff_file function in
|
|
demux_aiff.c, a remote attacker is able to execute arbitrary
|
|
code via a modified AIFF file.</p></body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-1300</cvename>
|
|
<url>http://tigger.uic.edu/~jlongs2/holes/xine-lib.txt</url>
|
|
<url>http://xinehq.de/index.php/security/XSA-2004-7</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-12-15</discovery>
|
|
<entry>2004-12-29</entry>
|
|
<modified>2005-01-12</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="2e25d38b-54d1-11d9-b612-000c6e8f12ef">
|
|
<topic>jabberd -- denial-of-service vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>jabber</name>
|
|
<range><lt>1.4.3.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>José Antonio Calvo discovered a bug in the Jabber 1.x server.
|
|
According to Matthias Wimmer:</p>
|
|
<blockquote cite="http://devel.amessage.info/jabberd14/README.html">
|
|
<p>Without this patch, it is possible to remotly crash
|
|
jabberd14, if there is access to one of the following types
|
|
of network sockets:</p>
|
|
<ul>
|
|
<li>Socket accepting client connections</li>
|
|
<li>Socket accepting connections from other servers</li>
|
|
<li>Socket connecting to an other Jabber server</li>
|
|
<li>Socket accepting connections from server components</li>
|
|
<li>Socket connecting to server components</li>
|
|
</ul>
|
|
<p>This is any socket on which the jabberd server parses
|
|
XML!</p>
|
|
<p>The problem existed in the included expat XML parser code.
|
|
This patch removes the included expat code from jabberd14
|
|
and links jabberd against an installed version of expat.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-1378</cvename>
|
|
<url>http://devel.amessage.info/jabberd14/README.html</url>
|
|
<url>http://mail.jabber.org/pipermail/jabberd/2004-September/002004.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-09-19</discovery>
|
|
<entry>2004-12-26</entry>
|
|
<modified>2005-01-19</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="a30e5e44-5440-11d9-9e1e-c296ac722cb3">
|
|
<topic>squid -- confusing results on empty acl declarations</topic>
|
|
<affects>
|
|
<package>
|
|
<name>squid</name>
|
|
<range><lt>2.5.7_5</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Applying an empty ACL list results in unexpected behavior:
|
|
anything will match an empty ACL list. For example,</p>
|
|
<blockquote cite="http://www.squid-cache.org/bugs/show_bug.cgi?id=1166">
|
|
<p>The meaning of the configuration gets very confusing when
|
|
we encounter empty ACLs such as</p>
|
|
<p><code>acl something src "/path/to/empty_file.txt"<br/>
|
|
http_access allow something somewhere</code></p>
|
|
<p>gets parsed (with warnings) as</p>
|
|
<p><code>http_access allow somwhere</code></p>
|
|
<p>And similarily if you are using proxy_auth acls without
|
|
having any auth schemes defined.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-0194</cvename>
|
|
<url>http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-empty_acls</url>
|
|
<url>http://www.squid-cache.org/bugs/show_bug.cgi?id=1166</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-12-21</discovery>
|
|
<entry>2004-12-23</entry>
|
|
<modified>2005-02-08</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="efa1344b-5477-11d9-a9e7-0001020eed82">
|
|
<topic>ethereal -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>ethereal</name>
|
|
<name>ethereal-lite</name>
|
|
<name>tethereal</name>
|
|
<name>tethereal-lite</name>
|
|
<range><lt>0.10.8</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>An Ethreal Security Advisories reports:</p>
|
|
<blockquote cite="http://www.ethereal.com/appnotes/enpa-sa-00016.html">
|
|
<p>Issues have been discovered in the following protocol
|
|
dissectors:</p>
|
|
<ul>
|
|
<li>Matthew Bing discovered a bug in DICOM dissection that
|
|
could make Ethereal crash.</li>
|
|
<li>An invalid RTP timestamp could make Ethereal hang and
|
|
create a large temporary file, possibly filling
|
|
available disk space.</li>
|
|
<li>The HTTP dissector could access previously-freed
|
|
memory, causing a crash.</li>
|
|
<li>Brian Caswell discovered that an improperly formatted
|
|
SMB packet could make Ethereal hang, maximizing CPU
|
|
utilization.</li>
|
|
</ul>
|
|
<p>Impact: It may be possible to make Ethereal crash or run
|
|
arbitrary code by injecting a purposefully malformed
|
|
packet onto the wire or by convincing someone to read a
|
|
malformed packet trace file.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-1139</cvename>
|
|
<cvename>CVE-2004-1140</cvename>
|
|
<cvename>CVE-2004-1141</cvename>
|
|
<cvename>CVE-2004-1142</cvename>
|
|
<url>http://www.ethereal.com/appnotes/enpa-sa-00016.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-12-14</discovery>
|
|
<entry>2004-12-23</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="e3e266e9-5473-11d9-a9e7-0001020eed82">
|
|
<topic>xpdf -- buffer overflow vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>xpdf</name>
|
|
<range><lt>3.00_5</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>kdegraphics</name>
|
|
<range><lt>3.3.2_1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>gpdf</name>
|
|
<range><le>2.8.1</le></range>
|
|
</package>
|
|
<package>
|
|
<name>teTeX-base</name>
|
|
<range><le>2.0.2_6</le></range>
|
|
</package>
|
|
<package>
|
|
<name>cups-base</name>
|
|
<range><le>1.1.22.0</le></range>
|
|
</package>
|
|
<package>
|
|
<name>koffice</name>
|
|
<range><le>1.3.5,1</le></range>
|
|
</package>
|
|
<package>
|
|
<name>pdftohtml</name>
|
|
<range><lt>0.36_1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>An iDEFENSE Security Advisory reports:</p>
|
|
<blockquote cite="http://www.idefense.com/application/poi/display?id=172&type=vulnerabilities">
|
|
<p>Remote exploitation of a buffer overflow vulnerability in
|
|
the xpdf PDF viewer, as included in multiple Linux
|
|
distributions, could allow attackers to execute arbitrary
|
|
code as the user viewing a PDF file. The offending code
|
|
can be found in the Gfx::doImage() function in the source
|
|
file xpdf/Gfx.cc.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-1125</cvename>
|
|
<url>http://www.idefense.com/application/poi/display?id=172&type=vulnerabilities</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-11-23</discovery>
|
|
<entry>2004-12-23</entry>
|
|
<modified>2005-01-13</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="28e93883-539f-11d9-a9e7-0001020eed82">
|
|
<topic>acroread5 -- mailListIsPdf() buffer overflow vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>acroread</name>
|
|
<name>acroread4</name>
|
|
<name>acroread5</name>
|
|
<range><lt>5.10</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>An iDEFENSE Security Advisory reports:</p>
|
|
<blockquote cite="http://www.idefense.com/application/poi/display?id=161&type=vulnerabilities">
|
|
<p>Remote exploitation of a buffer overflow in version 5.09
|
|
of Adobe Acrobat Reader for Unix could allow for execution
|
|
of arbitrary code.</p>
|
|
<p>The vulnerability specifically exists in a the function
|
|
mailListIsPdf(). This function checks if the input file
|
|
is an email message containing a PDF. It unsafely copies
|
|
user supplied data using strcat into a fixed sized
|
|
buffer.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-1152</cvename>
|
|
<certvu>253024</certvu>
|
|
<url>http://www.adobe.com/support/techdocs/331153.html</url>
|
|
<url>http://www.idefense.com/application/poi/display?id=161&type=vulnerabilities</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-10-14</discovery>
|
|
<entry>2004-12-21</entry>
|
|
<modified>2005-01-06</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="be543d74-539a-11d9-a9e7-0001020eed82">
|
|
<topic>ecartis -- unauthorised access to admin interface</topic>
|
|
<affects>
|
|
<package>
|
|
<name>ecartis</name>
|
|
<range><lt>1.0.0.s20031228_2,1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A Debian security advisory reports:</p>
|
|
<blockquote cite="http://www.debian.org/security/2004/dsa-572">
|
|
<p>A problem has been discovered in ecartis, a mailing-list
|
|
manager, which allows an attacker in the same domain as
|
|
the list admin to gain administrator privileges and alter
|
|
list settings.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0913</cvename>
|
|
<url>http://www.debian.org/security/2004/dsa-572</url>
|
|
<url>http://secunia.com/advisories/12918/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-10-12</discovery>
|
|
<entry>2004-12-21</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="85d76f02-5380-11d9-a9e7-0001020eed82">
|
|
<topic>mplayer -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>mplayer</name>
|
|
<name>mplayer-gtk</name>
|
|
<name>mplayer-gtk2</name>
|
|
<name>mplayer-esound</name>
|
|
<name>mplayer-gtk-esound</name>
|
|
<name>mplayer-gtk2-esound</name>
|
|
<range><lt>0.99.5_5</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>libxine</name>
|
|
<range><le>1.0.r5_3</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>iDEFENSE and the MPlayer Team have found multiple
|
|
vulnerabilities in MPlayer:</p>
|
|
<ul>
|
|
<li>Potential heap overflow in Real RTSP streaming code</li>
|
|
<li>Potential stack overflow in MMST streaming code</li>
|
|
<li>Multiple buffer overflows in BMP demuxer</li>
|
|
<li>Potential heap overflow in pnm streaming code</li>
|
|
<li>Potential buffer overflow in mp3lib</li>
|
|
</ul>
|
|
<p>These vulnerabilities could allow a remote attacker to
|
|
execute arbitrary code as the user running MPlayer. The
|
|
problem in the pnm streaming code also affects xine.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-1187</cvename>
|
|
<cvename>CVE-2004-1188</cvename>
|
|
<url>http://mplayerhq.hu/homepage/design7/news.html#mplayer10pre5try2</url>
|
|
<mlist msgid="IDSERV04yz5b6KZmcK80000000c@exchange.idefense.com">http://marc.theaimsgroup.com/?l=bugtraq&m=110322526210300</mlist>
|
|
<url>http://www.idefense.com/application/poi/display?id=166</url>
|
|
<mlist msgid="IDSERV04FVjCRGryWtI0000000f@exchange.idefense.com">http://marc.theaimsgroup.com/?l=bugtraq&m=110322829807443</mlist>
|
|
<url>http://www.idefense.com/application/poi/display?id=167</url>
|
|
<mlist msgid="IDSERV046beUzmRf6Ci00000012@exchange.idefense.com">http://marc.theaimsgroup.com/?l=bugtraq&m=110323022605345</mlist>
|
|
<url>http://www.idefense.com/application/poi/display?id=168</url>
|
|
<url>http://xinehq.de/index.php/security/XSA-2004-6</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-12-10</discovery>
|
|
<entry>2004-12-21</entry>
|
|
<modified>2005-01-12</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="0bb7677d-52f3-11d9-a9e7-0001020eed82">
|
|
<topic>krb5 -- heap buffer overflow vulnerability in libkadm5srv</topic>
|
|
<affects>
|
|
<package>
|
|
<name>krb5</name>
|
|
<name>krb5-beta</name>
|
|
<range><lt>1.3.6</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A MIT krb5 Security Advisory reports:</p>
|
|
<blockquote cite="http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2004-004-pwhist.txt">
|
|
<p>The MIT Kerberos 5 administration library (libkadm5srv)
|
|
contains a heap buffer overflow in password history
|
|
handling code which could be exploited to execute
|
|
arbitrary code on a Key Distribution Center (KDC)
|
|
host. The overflow occurs during a password change of a
|
|
principal with a certain password history state. An
|
|
administrator must have performed a certain password
|
|
policy change in order to create the vulnerable state.</p>
|
|
<p>An authenticated user, not necessarily one with
|
|
administrative privileges, could execute arbitrary code on
|
|
the KDC host, compromising an entire Kerberos realm.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-1189</cvename>
|
|
<url>http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2004-004-pwhist.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-12-06</discovery>
|
|
<entry>2004-12-21</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="3b3676be-52e1-11d9-a9e7-0001020eed82">
|
|
<topic>samba -- integer overflow vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>samba</name>
|
|
<range><lt>3.0.10</lt></range>
|
|
<range><gt>*,1</gt><lt>3.0.10,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>ja-samba</name>
|
|
<range><lt>2.2.12.j1.0beta1_2</lt></range>
|
|
<range><gt>3.*</gt><lt>3.0.10</lt></range>
|
|
<range><gt>3.*,1</gt><lt>3.0.10,1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Greg MacManus, iDEFENSE Labs reports:</p>
|
|
<blockquote cite="http://www.samba.org/samba/security/CAN-2004-1154.html">
|
|
<p>Remote exploitation of an integer overflow vulnerability
|
|
in the smbd daemon included in Samba 2.0.x, Samba 2.2.x,
|
|
and Samba 3.0.x prior to and including 3.0.9 could allow
|
|
an attacker to cause controllable heap corruption, leading
|
|
to execution of arbitrary commands with root
|
|
privileges.</p>
|
|
<p>Successful remote exploitation allows an attacker to gain
|
|
root privileges on a vulnerable system. In order to
|
|
exploit this vulnerability an attacker must possess
|
|
credentials that allow access to a share on the Samba
|
|
server. Unsuccessful exploitation attempts will cause the
|
|
process serving the request to crash with signal 11, and
|
|
may leave evidence of an attack in logs.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-1154</cvename>
|
|
<url>http://www.idefense.com/application/poi/display?id=165&type=vulnerabilities</url>
|
|
<url>http://www.samba.org/samba/security/CAN-2004-1154.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-12-02</discovery>
|
|
<entry>2004-12-21</entry>
|
|
<modified>2008-09-26</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="d47e9d19-5016-11d9-9b5f-0050569f0001">
|
|
<topic>php -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>mod_php4-twig</name>
|
|
<name>php4-cgi</name>
|
|
<name>php4-cli</name>
|
|
<name>php4-dtc</name>
|
|
<name>php4-horde</name>
|
|
<name>php4-nms</name>
|
|
<name>php4</name>
|
|
<range><lt>4.3.10</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>mod_php</name>
|
|
<name>mod_php4</name>
|
|
<range><ge>4</ge><lt>4.3.10,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>php5</name>
|
|
<name>php5-cgi</name>
|
|
<name>php5-cli</name>
|
|
<range><lt>5.0.3</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>mod_php5</name>
|
|
<range><lt>5.0.3,1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Secunia reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/13481/">
|
|
<p>Multiple vulnerabilities have been reported in PHP,
|
|
which can be exploited to gain escalated privileges,
|
|
bypass certain security restrictions, gain knowledge
|
|
of sensitive information, or compromise a vulnerable
|
|
system.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://secunia.com/advisories/13481/</url>
|
|
<cvename>CVE-2004-1019</cvename>
|
|
<cvename>CVE-2004-1065</cvename>
|
|
<url>http://www.php.net/release_4_3_10.php</url>
|
|
<url>http://www.hardened-php.net/advisories/012004.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-12-16</discovery>
|
|
<entry>2004-12-17</entry>
|
|
<modified>2004-12-18</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="01c231cd-4393-11d9-8bb9-00065be4b5b6">
|
|
<topic>mysql -- GRANT access restriction problem</topic>
|
|
<affects>
|
|
<package>
|
|
<name>mysql-server</name>
|
|
<range><le>3.23.58_3</le></range>
|
|
<range><ge>4.*</ge><lt>4.0.21</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>When a user is granted access to a database with a name containing
|
|
an underscore and the underscore is not escaped then that user might
|
|
also be able to access other, similarly named, databases on the
|
|
affected system.</p>
|
|
<p>The problem is that the underscore is seen as a wildcard by MySQL
|
|
and therefore it is possible that an admin might accidently GRANT a
|
|
user access to multiple databases.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0957</cvename>
|
|
<bid>11435</bid>
|
|
<url>http://bugs.mysql.com/bug.php?id=3933</url>
|
|
<url>http://rhn.redhat.com/errata/RHSA-2004-611.html</url>
|
|
<url>http://www.openpkg.org/security/OpenPKG-SA-2004.045-mysql.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-03-29</discovery>
|
|
<entry>2004-12-16</entry>
|
|
<modified>2005-03-15</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="06a6b2cf-484b-11d9-813c-00065be4b5b6">
|
|
<topic>mysql -- ALTER MERGE denial of service vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>mysql-server</name>
|
|
<range><le>3.23.58_3</le></range>
|
|
<range><ge>4.*</ge><lt>4.0.21</lt></range>
|
|
<range><ge>4.1.*</ge><lt>4.1.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Dean Ellis reported a denial of service vulnerability in the MySQL
|
|
server:</p>
|
|
<blockquote cite="http://bugs.mysql.com/bug.php?id=4017">
|
|
<p> Multiple threads ALTERing the same (or different) MERGE tables to
|
|
change the UNION eventually crash the server or hang the individual
|
|
threads.</p>
|
|
</blockquote>
|
|
<p>Note that a script demonstrating the problem is included in the
|
|
MySQL bug report. Attackers that have control of a MySQL account can
|
|
easily use a modified version of that script during an attack.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0837</cvename>
|
|
<bid>11357</bid>
|
|
<url>http://bugs.mysql.com/bug.php?id=2408</url>
|
|
<url>http://rhn.redhat.com/errata/RHSA-2004-611.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-01-15</discovery>
|
|
<entry>2004-12-16</entry>
|
|
<modified>2005-03-15</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="29edd807-438d-11d9-8bb9-00065be4b5b6">
|
|
<topic>mysql -- FTS request denial of service vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>mysql-server</name>
|
|
<range><ge>4.*</ge><lt>4.0.21</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A special crafted MySQL FTS request can cause the server to crash.
|
|
Malicious MySQL users can abuse this bug in a denial of service
|
|
attack against systems running an affected MySQL daemon.</p>
|
|
<p>Note that because this bug is related to the parsing of requests,
|
|
it may happen that this bug is triggered accidently by a user when he
|
|
or she makes a typo.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://bugs.mysql.com/bug.php?id=3870</url>
|
|
<cvename>CVE-2004-0956</cvename>
|
|
<bid>11432</bid>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-03-23</discovery>
|
|
<entry>2004-12-16</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="835256b8-46ed-11d9-8ce0-00065be4b5b6">
|
|
<topic>mysql -- mysql_real_connect buffer overflow vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>mysql-server</name>
|
|
<range><le>3.23.58_3</le></range>
|
|
<range><ge>4.*</ge><lt>4.0.21</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>mysql-client</name>
|
|
<range><le>3.23.58_3</le></range>
|
|
<range><ge>4.*</ge><lt>4.0.21</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The mysql_real_connect function doesn't properly handle DNS replies
|
|
by copying the IP address into a buffer without any length checking.
|
|
A specially crafted DNS reply may therefore be used to cause a buffer
|
|
overflow on affected systems.</p>
|
|
<p>Note that whether this issue can be exploitable depends on the
|
|
system library responsible for the gethostbyname function. The bug
|
|
finder, Lukasz Wojtow, explaines this with the following words:</p>
|
|
<blockquote cite="http://bugs.mysql.com/bug.php?id=4017">
|
|
<p>In glibc there is a limitation for an IP address to have only 4
|
|
bytes (obviously), but generally speaking the length of the address
|
|
comes with a response for dns query (i know it sounds funny but
|
|
read rfc1035 if you don't believe). This bug can occur on libraries
|
|
where gethostbyname function takes length from dns's response</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0836</cvename>
|
|
<bid>10981</bid>
|
|
<url>http://bugs.mysql.com/bug.php?id=4017</url>
|
|
<url>http://lists.mysql.com/internals/14726</url>
|
|
<url>http://rhn.redhat.com/errata/RHSA-2004-611.html</url>
|
|
<url>http://www.osvdb.org/displayvuln.php?osvdb_id=10658</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-06-04</discovery>
|
|
<entry>2004-12-16</entry>
|
|
<modified>2005-03-15</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="035d17b2-484a-11d9-813c-00065be4b5b6">
|
|
<topic>mysql -- erroneous access restrictions applied to table renames</topic>
|
|
<affects>
|
|
<package>
|
|
<name>mysql-server</name>
|
|
<range><le>3.23.58_3</le></range>
|
|
<range><ge>4.*</ge><lt>4.0.21</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A Red Hat advisory reports:</p>
|
|
<blockquote cite="http://rhn.redhat.com/errata/RHSA-2004-611.html">
|
|
<p>Oleksandr Byelkin discovered that "ALTER TABLE ... RENAME" checked
|
|
the CREATE/INSERT rights of the old table instead of the new
|
|
one.</p>
|
|
</blockquote>
|
|
<p>Table access restrictions, on the affected MySQL servers, may
|
|
accidently or intentially be bypassed due to this bug.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0835</cvename>
|
|
<bid>11357</bid>
|
|
<url>http://bugs.mysql.com/bug.php?id=3270</url>
|
|
<url>http://rhn.redhat.com/errata/RHSA-2004-611.html</url>
|
|
<url>http://xforce.iss.net/xforce/xfdb/17666</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-03-23</discovery>
|
|
<entry>2004-12-16</entry>
|
|
<modified>2005-03-15</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="0ff0e9a6-4ee0-11d9-a9e7-0001020eed82">
|
|
<topic>phpmyadmin -- command execution vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>phpMyAdmin</name>
|
|
<range><ge>2.6.0.2</ge><lt>2.6.1.r1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A phpMyAdmin security announcement reports:</p>
|
|
<blockquote cite="http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2004-4">
|
|
<p>Command execution: since phpMyAdmin 2.6.0-pl2, on a
|
|
system where external MIME-based transformations are
|
|
activated, an attacker can put into MySQL data an
|
|
offensive value that starts a shell command when
|
|
browsed.</p>
|
|
</blockquote>
|
|
<p>Enabling <q>PHP safe mode</q> on the server can be used as
|
|
a workaround for this vulnerability.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-1147</cvename>
|
|
<url>http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2004-4</url>
|
|
<url>http://www.exaprobe.com/labs/advisories/esa-2004-1213.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-12-13</discovery>
|
|
<entry>2004-12-15</entry>
|
|
<modified>2004-12-19</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="9f0a405e-4edd-11d9-a9e7-0001020eed82">
|
|
<topic>phpmyadmin -- file disclosure vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>phpMyAdmin</name>
|
|
<range><lt>2.6.1.r1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A phpMyAdmin security announcement reports:</p>
|
|
<blockquote cite="http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2004-4">
|
|
<p>File disclosure: on systems where the UploadDir mecanism
|
|
is active, read_dump.php can be called with a crafted
|
|
form; using the fact that the sql_localfile variable is
|
|
not sanitized can lead to a file disclosure.</p>
|
|
</blockquote>
|
|
<p>Enabling <q>PHP safe mode</q> on the server can be used as
|
|
a workaround for this vulnerability.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-1148</cvename>
|
|
<url>http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2004-4</url>
|
|
<url>http://www.exaprobe.com/labs/advisories/esa-2004-1213.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-12-13</discovery>
|
|
<entry>2004-12-15</entry>
|
|
<modified>2004-12-19</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="06f142ff-4df3-11d9-a9e7-0001020eed82">
|
|
<topic>wget -- multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>wget</name>
|
|
<name>wget-devel</name>
|
|
<range><lt>1.10.a1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>wgetpro</name>
|
|
<name>wget+ipv6</name>
|
|
<range><ge>0</ge></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Jan Minar reports that there exists multiple
|
|
vulnerabilities in wget:</p>
|
|
<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&m=110269474112384">
|
|
<p>Wget erroneously thinks that the current directory is a
|
|
fair game, and will happily write in any file in and below
|
|
it. Malicious HTTP response or malicious HTML file can
|
|
redirect wget to a file that is vital to the system, and
|
|
wget will create/append/overwrite it.</p>
|
|
<p>Wget apparently has at least two methods of
|
|
``sanitizing'' the potentially malicious data it receives
|
|
from the HTTP stream, therefore a malicious redirects can
|
|
pass the check. We haven't find a way to trick wget into
|
|
writing above the parent directory, which doesn't mean
|
|
it's not possible.</p>
|
|
<p>Malicious HTTP response can overwrite parts of the
|
|
terminal so that the user will not notice anything wrong,
|
|
or will believe the error was not fatal.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-1487</cvename>
|
|
<cvename>CVE-2004-1488</cvename>
|
|
<bid>11871</bid>
|
|
<mlist msgid="20041209091438.GA15010@kontryhel.haltyr.dyndns.org">http://marc.theaimsgroup.com/?l=bugtraq&m=110269474112384</mlist>
|
|
<url>http://bugs.debian.org/261755</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-12-09</discovery>
|
|
<entry>2004-12-14</entry>
|
|
<modified>2005-04-15</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="4593cb09-4c81-11d9-983e-000c6e8f12ef">
|
|
<topic>konqueror -- Password Disclosure for SMB Shares</topic>
|
|
<affects>
|
|
<package>
|
|
<name>kdebase</name>
|
|
<name>kdelibs</name>
|
|
<range><ge>3.2.0</ge><le>3.3.1</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>When browsing SMB shares with Konqueror, shares with
|
|
authentication show up with hidden password in the browser
|
|
bar. It is possible to store the URL as a shortcut on the
|
|
desktop where the password is then available in plain text.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-1171</cvename>
|
|
<certvu>305294</certvu>
|
|
<url>http://www.kde.org/info/security/advisory-20041209-1.txt</url>
|
|
<mlist msgid="ICEEJPLEDKODPNFKJEGAIEBJGFAA.df@sec-consult.com">http://marc.theaimsgroup.com/?l=bugtraq&m=110178786809694</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-10-06</discovery>
|
|
<entry>2004-12-12</entry>
|
|
<modified>2005-01-13</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="af747389-42ba-11d9-bd37-00065be4b5b6">
|
|
<topic>mod_access_referer -- null pointer dereference vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>mod_access_referer</name>
|
|
<range><lt>1.0.2_1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A malformed <q>Referer</q> header field causes the Apache
|
|
ap_parse_uri_components function to discard it with the
|
|
result that a pointer is not initialized. The
|
|
mod_access_referer module does not take this into account
|
|
with the result that it may use such a pointer.</p>
|
|
<p>The null pointer vulnerability may possibly be used in a
|
|
remote denial of service attack against affected Apache
|
|
servers.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2003-1054</cvename>
|
|
<bid>7375</bid>
|
|
<url>http://secunia.com/advisories/8612/</url>
|
|
<mlist>http://marc.theaimsgroup.com/?l=full-disclosure&m=105053485515811</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2003-04-16</discovery>
|
|
<entry>2004-12-11</entry>
|
|
<modified>2005-01-19</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="f0db930b-496b-11d9-bf86-0050569f0001">
|
|
<topic>squid -- possible information disclosure</topic>
|
|
<affects>
|
|
<package>
|
|
<name>squid</name>
|
|
<range><lt>2.5.7_4</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The squid-2.5 patches pages notes:</p>
|
|
<blockquote cite="http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-dothost">
|
|
<p>In certain conditions Squid returns random data as error messages
|
|
in response to malformed host name, possibly leaking random
|
|
internal information which may come from other requests.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-dothost</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-11-23</discovery>
|
|
<entry>2004-12-09</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="323784cf-48a6-11d9-a9e7-0001020eed82">
|
|
<topic>viewcvs -- information leakage</topic>
|
|
<affects>
|
|
<package>
|
|
<name>viewcvs</name>
|
|
<range><lt>0.9.2_2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The <code>hide_cvsroot</code> and <code>forbidden</code>
|
|
configuration options are not properly honored by viewcvs
|
|
when exporting to a tar file which can lead to information
|
|
leakage.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0915</cvename>
|
|
<bid>11819</bid>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-11-25</discovery>
|
|
<entry>2004-12-08</entry>
|
|
<modified>2004-12-12</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="a7bfd423-484f-11d9-a9e7-0001020eed82">
|
|
<topic>cscope -- symlink attack vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>cscope</name>
|
|
<range><lt>15.5_1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>cscope is vulnerable to a symlink attack which could lead
|
|
to an attacker overwriting arbitrary files with the
|
|
permissions of the user running cscope.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0996</cvename>
|
|
<bid>11697</bid>
|
|
<mlist msgid="20041124025903.9337.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&m=110133485519690</mlist>
|
|
<mlist msgid="20041118012718.78b07d79.research@rexotec.com">http://marc.theaimsgroup.com/?l=bugtraq&m=110072752707293</mlist>
|
|
<url>http://sourceforge.net/tracker/index.php?func=detail&aid=1062807&group_id=4664&atid=104664</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2003-04-03</discovery>
|
|
<entry>2004-12-07</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="9be819c6-4633-11d9-a9e7-0001020eed82">
|
|
<topic>bnc -- remotely exploitable buffer overflow in getnickuserhost</topic>
|
|
<affects>
|
|
<package>
|
|
<name>bnc</name>
|
|
<range><lt>2.9.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A LSS Security Advisory reports:</p>
|
|
<blockquote cite="http://security.lss.hr/en/index.php?page=details&ID=LSS-2004-11-03">
|
|
<p>There is a buffer overflow vulnerability in
|
|
getnickuserhost() function that is called when BNC is
|
|
processing response from IRC server.</p>
|
|
<p>Vulnerability can be exploited if attacker tricks user to
|
|
connect to his fake IRC server that will exploit this
|
|
vulnerability. If the attacker has access to BNC proxy
|
|
server, this vulnerability can be used to gain shell
|
|
access on machine where BNC proxy server is set.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-1052</cvename>
|
|
<mlist msgid="20041110131046.GA21604@cecilija.zesoi.fer.hr">http://marc.theaimsgroup.com/?l=bugtraq&m=110011817627839</mlist>
|
|
<url>http://security.lss.hr/en/index.php?page=details&ID=LSS-2004-11-03</url>
|
|
<url>http://www.gotbnc.com/changes.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-11-10</discovery>
|
|
<entry>2004-12-04</entry>
|
|
<modified>2005-02-22</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="f11b219a-44b6-11d9-ae2f-021106004fd6">
|
|
<topic>rssh & scponly -- arbitrary command execution</topic>
|
|
<affects>
|
|
<package>
|
|
<name>rssh</name>
|
|
<range><le>2.2.2</le></range>
|
|
</package>
|
|
<package>
|
|
<name>scponly</name>
|
|
<range><lt>4.0</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Jason Wies identified both rssh & scponly have a vulnerability
|
|
that allows arbitrary command execution. He reports:</p>
|
|
<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&m=110202047507273">
|
|
<p>The problem is compounded when you recognize that the main use of
|
|
rssh and scponly is to allow file transfers, which in turn allows a
|
|
malicious user to transfer and execute entire custom scripts on the
|
|
remote machine.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>11791</bid>
|
|
<bid>11792</bid>
|
|
<freebsdpr>ports/74633</freebsdpr>
|
|
<mlist msgid="20041202135143.GA7105@xc.net">http://marc.theaimsgroup.com/?l=bugtraq&m=110202047507273</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-11-28</discovery>
|
|
<entry>2004-12-02</entry>
|
|
<modified>2004-12-12</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="2b4d5288-447e-11d9-9ebb-000854d03344">
|
|
<topic>rockdodger -- buffer overflows</topic>
|
|
<affects>
|
|
<package>
|
|
<name>rockdodger</name>
|
|
<range><lt>0.6_3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The environment variable HOME is copied without regard
|
|
to buffer size, which can be used to gain elevated privilege
|
|
if the binary is installed setgid games, and a string is
|
|
read from the high score file without bounds check.</p>
|
|
<p>The port installs the binary without setgid, but with a
|
|
world-writable high score file.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=278878</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-10-29</discovery>
|
|
<entry>2004-12-02</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="40549bbf-43b5-11d9-a9e7-0001020eed82">
|
|
<topic>zip -- long path buffer overflow</topic>
|
|
<affects>
|
|
<package>
|
|
<name>zip</name>
|
|
<range><lt>2.3_2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A HexView security advisory reports:</p>
|
|
<blockquote cite="http://www.hexview.com/docs/20041103-1.txt">
|
|
<p>When zip performs recursive folder compression, it does
|
|
not check for the length of resulting path. If the path is
|
|
too long, a buffer overflow occurs leading to stack
|
|
corruption and segmentation fault. It is possible to
|
|
exploit this vulnerability by embedding a shellcode in
|
|
directory or file name. While the issue is not of primary
|
|
concern for regular users, it can be critical for
|
|
environments where zip archives are re-compressed
|
|
automatically using Info-Zip application.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-1010</cvename>
|
|
<bid>11603</bid>
|
|
<url>http://www.hexview.com/docs/20041103-1.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-10-03</discovery>
|
|
<entry>2004-12-01</entry>
|
|
<modified>2004-12-12</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="85edfb6a-43a5-11d9-a9e7-0001020eed82">
|
|
<topic>sudoscript -- signal delivery vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>sudoscript</name>
|
|
<range><lt>2.1.2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>If non-root access is enabled in sudoscript, any member of
|
|
the ssers group can send a SIGHUP signal to any process.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://egbok.com/sudoscript/archives/2004/11/sudoscript_212.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-11-14</discovery>
|
|
<entry>2004-12-01</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="553224e7-4325-11d9-a3d5-000c6e8f12ef">
|
|
<topic>jabberd -- remote buffer overflow vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>jabberd</name>
|
|
<range><ge>2.*</ge><le>2.0.4</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Caused by improper bounds-checking of username
|
|
and password in the C2S module, it is possible
|
|
for an attacker to cause a remote buffer overflow.
|
|
The server directly handles the userinput with
|
|
SQL backend functions - malicious input may lead
|
|
to buffer overflow.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<mlist msgid="41A3FEE1.5030701@0x557.org">http://marc.theaimsgroup.com/?l=bugtraq&m=110144303826709</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-11-24</discovery>
|
|
<entry>2004-11-30</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="cdf14b68-3ff9-11d9-8405-00065be4b5b6">
|
|
<topic>Open DC Hub -- remote buffer overflow vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>opendchub</name>
|
|
<range><lt>0.7.14_2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Donato Ferrante reported an exploitable buffer overflow in
|
|
this software package. Any user that can login with 'admin'
|
|
privileges can abuse it, trough the $RedirectAll command,
|
|
to execute arbitrary code.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<mlist msgid="20041124155429.893852455E@chernobyl.investici.org">http://marc.theaimsgroup.com/?l=bugtraq&m=110144606411674</mlist>
|
|
<url>http://www.gentoo.org/security/en/glsa/glsa-200411-37.xml</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-11-24</discovery>
|
|
<entry>2004-11-27</entry>
|
|
<modified>2005-02-13</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="a163baff-3fe1-11d9-a9e7-0001020eed82">
|
|
<topic>unarj -- long filename buffer overflow</topic>
|
|
<affects>
|
|
<package>
|
|
<name>unarj</name>
|
|
<range><lt>2.43_2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Ludwig Nussel has discovered a buffer overflow
|
|
vulnerability in unarj's handling of long filenames which
|
|
could potentially lead to execution of arbitrary code with
|
|
the permissions of the user running unarj.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0947</cvename>
|
|
<bid>11665</bid>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-11-09</discovery>
|
|
<entry>2004-11-26</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="1f922de0-3fe5-11d9-a9e7-0001020eed82">
|
|
<topic>unarj -- directory traversal vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>unarj</name>
|
|
<range><lt>2.43_2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>unarj has insufficient checks for filenames that contain
|
|
<q>..</q>. This can allow an attacker to overwrite
|
|
arbitrary files with the permissions of the user running
|
|
unarj.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-1027</cvename>
|
|
<bid>11436</bid>
|
|
<mlist msgid="200410102243.i9AMhA9F083398@mailserver2.hushmail.com">http://marc.theaimsgroup.com/?l=full-disclosure&m=109748984030292</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-10-10</discovery>
|
|
<entry>2004-11-26</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="ac619d06-3ef8-11d9-8741-c942c075aa41">
|
|
<topic>jdk/jre -- Security Vulnerability With Java Plugin</topic>
|
|
<affects>
|
|
<package>
|
|
<name>jdk</name>
|
|
<range><ge>1.4.0</ge><le>1.4.2p6_6</le></range>
|
|
<range><ge>1.3.0</ge><le>1.3.1p9_5</le></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-jdk</name>
|
|
<name>linux-sun-jdk</name>
|
|
<range><ge>1.4.0</ge><le>1.4.2.05</le></range>
|
|
<range><ge>1.3.0</ge><le>1.3.1.13</le></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-blackdown-jdk</name>
|
|
<range><ge>1.3.0</ge><le>1.4.2</le></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-ibm-jdk</name>
|
|
<range><ge>1.3.0</ge><le>1.4.2</le></range>
|
|
</package>
|
|
<package>
|
|
<name>diablo-jdk</name>
|
|
<name>diablo-jre</name>
|
|
<range><ge>1.3.1.0</ge><le>1.3.1.0_1</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Sun Java Plugin capability in Java 2 Runtime Environment
|
|
(JRE) 1.4.2_01, 1.4.2_04, and possibly earlier versions, does
|
|
not properly restrict access between Javascript and Java
|
|
applets during data transfer, which allows remote attackers to
|
|
load unsafe classes and execute arbitrary code.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://sunsolve.sun.com/search/document.do?assetkey=1-26-57591-1&searchclause=%22category:security%22%20%22availability,%20security%22</url>
|
|
<url>http://www.securityfocus.com/archive/1/382072</url>
|
|
<cvename>CVE-2004-1029</cvename>
|
|
<mlist msgid="20041123070248.GA25385@jouko.iki.fi">http://marc.theaimsgroup.com/?l=bugtraq&m=110125046627909</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-11-24</discovery>
|
|
<entry>2004-11-25</entry>
|
|
<modified>2005-04-27</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="1a32e8ee-3edb-11d9-8699-00065be4b5b6">
|
|
<topic>ProZilla -- server response buffer overflow vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>prozilla</name>
|
|
<range><le>1.3.6_3</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Buffer overflow vulnerabilities have been reported to exist
|
|
in this software package. The vulnerabilities can be triggered by
|
|
a remote server and can be used to inject malicious code in the
|
|
ProZilla process.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-1120</cvename>
|
|
<url>http://www.gentoo.org/security/en/glsa/glsa-200411-31.xml</url>
|
|
<url>http://bugs.gentoo.org/show_bug.cgi?id=70090</url>
|
|
<mlist msgid="41A411E0.2010907@gmx.net">http://marc.theaimsgroup.com/?l=bugtraq&m=110136626320497</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-11-23</discovery>
|
|
<entry>2004-11-25</entry>
|
|
<modified>2005-10-01</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="31952117-3d17-11d9-8818-008088034841">
|
|
<topic>Cyrus IMAPd -- APPEND command uses undefined programming construct</topic>
|
|
<affects>
|
|
<package>
|
|
<name>cyrus-imapd</name>
|
|
<range><ge>2.2.7</ge><le>2.2.8</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>To support MULTIAPPENDS the cmd_append handler uses the
|
|
global stage array. This array is one of the things that gets
|
|
destructed when the fatal() function is triggered. When the
|
|
Cyrus IMAP code adds new entries to this array this is done
|
|
with the help of the postfix increment operator in combination
|
|
with memory allocation functions. The increment is performed
|
|
on a global variable counting the number of allocated
|
|
stages. Because the memory allocation function can fail and
|
|
therefore internally call fatal() this construct is undefined
|
|
arcording to ANSI C. This means that it is not clearly defined
|
|
if the numstage counter is already increased when fatal() is
|
|
called or not. While older gcc versions increase the counter
|
|
after the memory allocation function has returned, on newer
|
|
gcc versions (3.x) the counter gets actually increased
|
|
before. In such a case the stage destructing process will try
|
|
to free an uninitialised and maybe attacker supplied
|
|
pointer. Which again could lead to remote code
|
|
execution. (Because it is hard for an attacker to let the
|
|
memory allocation functions fail in the right moment no PoC
|
|
code for this problem was designed)</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://security.e-matters.de/advisories/152004.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-11-06</discovery>
|
|
<entry>2004-11-22</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="c0a269d5-3d16-11d9-8818-008088034841">
|
|
<topic>Cyrus IMAPd -- FETCH command out of bounds memory corruption</topic>
|
|
<affects>
|
|
<package>
|
|
<name>cyrus-imapd</name>
|
|
<range><lt>2.1.17</lt></range>
|
|
<range><ge>2.2.*</ge><le>2.2.8</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The argument parser of the fetch command suffers a bug very
|
|
similiar to the partial command problem. Arguments like
|
|
"body[p", "binary[p" or "binary[p" will be wrongly detected
|
|
and the bufferposition can point outside of the allocated
|
|
buffer for the rest of the parsing process. When the parser
|
|
triggers the PARSE_PARTIAL macro after such a malformed
|
|
argument was received this can lead to a similiar one byte
|
|
memory corruption and allows remote code execution, when the
|
|
heap layout was successfully controlled by the attacker.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-1013</cvename>
|
|
<url>http://security.e-matters.de/advisories/152004.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-11-06</discovery>
|
|
<entry>2004-11-22</entry>
|
|
<modified>2004-11-24</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="114d70f3-3d16-11d9-8818-008088034841">
|
|
<topic>Cyrus IMAPd -- PARTIAL command out of bounds memory corruption</topic>
|
|
<affects>
|
|
<package>
|
|
<name>cyrus-imapd</name>
|
|
<range><lt>2.1.17</lt></range>
|
|
<range><ge>2.2.*</ge><le>2.2.6</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Due to a bug within the argument parser of the partial
|
|
command an argument like "body[p" will be wrongly detected as
|
|
"body.peek". Because of this the bufferposition gets increased
|
|
by 10 instead of 5 and could therefore point outside the
|
|
allocated memory buffer for the rest of the parsing
|
|
process. In imapd versions prior to 2.2.7 the handling of
|
|
"body" or "bodypeek" arguments was broken so that the
|
|
terminating ']' got overwritten by a '\0'. Combined the two
|
|
problems allow a potential attacker to overwrite a single byte
|
|
of malloc() control structures, which leads to remote code
|
|
execution if the attacker successfully controls the heap
|
|
layout.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-1012</cvename>
|
|
<url>http://security.e-matters.de/advisories/152004.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-11-06</discovery>
|
|
<entry>2004-11-22</entry>
|
|
<modified>2004-11-24</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="816fdd8b-3d14-11d9-8818-008088034841">
|
|
<topic>Cyrus IMAPd -- IMAPMAGICPLUS preauthentification overflow</topic>
|
|
<affects>
|
|
<package>
|
|
<name>cyrus-imapd</name>
|
|
<range><ge>2.2.4</ge><le>2.2.8</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>When the option imapmagicplus is activated on a server the
|
|
PROXY and LOGIN commands suffer a standard stack overflow,
|
|
because the username is not checked against a maximum length
|
|
when it is copied into a temporary stack buffer. This bug is
|
|
especially dangerous because it can be triggered before any
|
|
kind of authentification took place.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-1011</cvename>
|
|
<url>http://security.e-matters.de/advisories/152004.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-11-06</discovery>
|
|
<entry>2004-11-22</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="6a33477e-3a9c-11d9-84ad-000c6e8f12ef">
|
|
<topic>phpMyAdmin -- cross-site scripting vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>phpMyAdmin</name>
|
|
<range><le>2.6.0.2</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Multiple cross-site scripting vulnerabilities, caused
|
|
by improper input parameter sanitizing, were
|
|
detected in phpMyAdmin, which may enable an attacker
|
|
to do cross-site scripting attacks.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2004-3</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-11-18</discovery>
|
|
<entry>2004-11-20</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="759b8dfe-3972-11d9-a9e7-0001020eed82">
|
|
<topic>Overflow error in fetch</topic>
|
|
<affects>
|
|
<system>
|
|
<name>FreeBSD</name>
|
|
<range><ge>5.3</ge><lt>5.3_1</lt></range>
|
|
<range><ge>5.2.1</ge><lt>5.2.1_12</lt></range>
|
|
<range><ge>5.1</ge><lt>5.1_18</lt></range>
|
|
<range><ge>5.0</ge><lt>5.0_22</lt></range>
|
|
<range><ge>4.10</ge><lt>4.10_4</lt></range>
|
|
<range><ge>4.9</ge><lt>4.9_13</lt></range>
|
|
<range><ge>4.8</ge><lt>4.8_26</lt></range>
|
|
<range><lt>4.7_28</lt></range>
|
|
</system>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>An integer overflow condition in <a href="http://www.freebsd.org/cgi/man.cgi?query=fetch">fetch(1)</a>
|
|
in the processing of HTTP headers can result in a buffer
|
|
overflow.</p>
|
|
<p>A malicious server or CGI script can respond to an HTTP or
|
|
HTTPS request in such a manner as to cause arbitrary
|
|
portions of the client's memory to be overwritten, allowing
|
|
for arbitrary code execution.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<freebsdsa>SA-04:16.fetch</freebsdsa>
|
|
<cvename>CVE-2004-1053</cvename>
|
|
<bid>11702</bid>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-11-14</discovery>
|
|
<entry>2004-11-18</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="f3d3f621-38d8-11d9-8fff-000c6e8f12ef">
|
|
<topic>smbd -- buffer-overrun vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>samba</name>
|
|
<range><ge>3.*</ge><lt>3.0.8</lt></range>
|
|
<range><ge>3.*,1</ge><lt>3.0.8,1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Caused by improper bounds checking of certain trans2
|
|
requests, there is a possible buffer overrun in smbd.
|
|
The attacker needs to be able to create files with
|
|
very specific Unicode filenames on the share to take
|
|
advantage of this issue.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0882</cvename>
|
|
<bid>11678</bid>
|
|
<mlist msgid="4198AE84.7020509@samba.org">http://marc.theaimsgroup.com/?l=bugtraq&m=110055646329581</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-11-15</discovery>
|
|
<entry>2004-11-17</entry>
|
|
<modified>2008-09-26</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="b4af3ede-36e9-11d9-a9e7-0001020eed82">
|
|
<topic>twiki -- arbitrary shell command execution</topic>
|
|
<affects>
|
|
<package>
|
|
<name>twiki</name>
|
|
<range><lt>20040902</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Hans Ulrich Niedermann reports:</p>
|
|
<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&m=110037207516456">
|
|
<p>The TWiki search function uses a user supplied search
|
|
string to compose a command line executed by the Perl
|
|
backtick (``) operator.</p>
|
|
<p>The search string is not checked properly for shell
|
|
metacharacters and is thus vulnerable to search string
|
|
containing quotes and shell commands.</p>
|
|
<p>IMPACT: An attacker is able to execute arbitrary shell
|
|
commands with the privileges of the TWiki process.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-1037</cvename>
|
|
<mlist msgid="86zn1mhchx.fsf@n-dimensional.de">http://marc.theaimsgroup.com/?l=bugtraq&m=110037207516456</mlist>
|
|
<url>http://twiki.org/cgi-bin/view/Codev/SecurityAlertExecuteCommandsWithSearch</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-11-12</discovery>
|
|
<entry>2004-11-15</entry>
|
|
<modified>2004-11-23</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="50744596-368f-11d9-a9e7-0001020eed82">
|
|
<topic>proxytunnel -- format string vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>proxytunnel</name>
|
|
<range><lt>1.2.3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A Gentoo Linux Security Advisory reports:</p>
|
|
<blockquote cite="http://www.gentoo.org/security/en/glsa/glsa-200411-07.xml">
|
|
<p>Florian Schilhabel of the Gentoo Linux Security Audit
|
|
project found a format string vulnerability in
|
|
Proxytunnel. When the program is started in daemon mode
|
|
(-a [port]), it improperly logs invalid proxy answers to
|
|
syslog.</p>
|
|
<p>A malicious remote server could send specially-crafted
|
|
invalid answers to exploit the format string
|
|
vulnerability, potentially allowing the execution of
|
|
arbitrary code on the tunnelling host with the rights of
|
|
the Proxytunnel process.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0992</cvename>
|
|
<url>http://proxytunnel.sourceforge.net/news.html</url>
|
|
<url>http://www.gentoo.org/security/en/glsa/glsa-200411-07.xml</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-11-01</discovery>
|
|
<entry>2004-11-15</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="bdd1537b-354c-11d9-a9e7-0001020eed82">
|
|
<topic>sudo -- privilege escalation with bash scripts</topic>
|
|
<affects>
|
|
<package>
|
|
<name>sudo</name>
|
|
<range><lt>1.6.8.2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A Sudo Security Alerts reports:</p>
|
|
<blockquote cite="http://www.courtesan.com/sudo/alerts/bash_functions.html">
|
|
<p>A flaw in exists in sudo's environment sanitizing prior
|
|
to sudo version 1.6.8p2 that could allow a malicious user
|
|
with permission to run a shell script that utilized the
|
|
bash shell to run arbitrary commands.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://www.courtesan.com/sudo/alerts/bash_functions.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-11-11</discovery>
|
|
<entry>2004-11-13</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="d656296b-33ff-11d9-a9e7-0001020eed82">
|
|
<topic>ruby -- CGI DoS</topic>
|
|
<affects>
|
|
<package>
|
|
<name>ruby</name>
|
|
<name>ruby_r</name>
|
|
<range><gt>1.7.*</gt><lt>1.8.2.p2_2</lt></range>
|
|
<range><lt>1.6.8.2004.07.28_1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>ruby-1.7.0</name>
|
|
<range><ge>a2001.05.12</ge><le>a2001.05.26</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Ruby CGI.rb module contains a bug which can cause the
|
|
CGI module to go into an infinite loop, thereby causing a
|
|
denial-of-service situation on the web server by using all
|
|
available CPU time.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0983</cvename>
|
|
<url>http://www.debian.org/security/2004/dsa-586</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-11-06</discovery>
|
|
<entry>2004-11-13</entry>
|
|
<modified>2004-11-25</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="ba13dc13-340d-11d9-ac1b-000d614f7fad">
|
|
<topic>samba -- potential remote DoS vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>samba</name>
|
|
<range><gt>3.*</gt><lt>3.0.8</lt></range>
|
|
<range><gt>3.*,1</gt><lt>3.0.8,1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Karol Wiesek at iDEFENSE reports:</p>
|
|
<blockquote cite="http://us4.samba.org/samba/security/CAN-2004-0930.html">
|
|
<p>A remote attacker could cause an smbd process to consume
|
|
abnormal amounts of system resources due to an input
|
|
validation error when matching filenames containing
|
|
wildcard characters.</p>
|
|
</blockquote>
|
|
<p>Although samba.org classifies this as a DoS vulnerability,
|
|
several members of the security community believe it may be
|
|
exploitable for arbitrary code execution.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<freebsdpr>ports/73701</freebsdpr>
|
|
<cvename>CVE-2004-0930</cvename>
|
|
<url>http://us4.samba.org/samba/security/CAN-2004-0930.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-09-30</discovery>
|
|
<entry>2004-11-12</entry>
|
|
<modified>2008-09-26</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="fc99c736-3499-11d9-98a7-0090962cff2a">
|
|
<topic>gnats -- format string vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>gnats</name>
|
|
<range><ge>4.*</ge><le>4.0_2</le></range>
|
|
<range><le>3.113.1_9</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Gnats suffers from a format string bug, which may enable an
|
|
attacker to execute arbitary code.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0623</cvename>
|
|
<mlist msgid="20040625164231.7437.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&m=108820000823191</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-06-21</discovery>
|
|
<entry>2004-11-12</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="7fbfe159-3438-11d9-a9e7-0001020eed82">
|
|
<topic>squirrelmail -- cross site scripting vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>ja-squirrelmail</name>
|
|
<range><lt>1.4.3a_4,2</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>squirrelmail</name>
|
|
<range><lt>1.4.3a_3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A SquirrelMail Security Notice reports:</p>
|
|
<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&m=110012133608004">
|
|
<p>There is a cross site scripting issue in the decoding of
|
|
encoded text in certain headers. SquirrelMail correctly
|
|
decodes the specially crafted header, but doesn't sanitize
|
|
the decoded strings.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<mlist msgid="544475695.20041110000451@netdork.net">http://marc.theaimsgroup.com/?l=bugtraq&m=110012133608004</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-11-03</discovery>
|
|
<entry>2004-11-12</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="1f8dea68-3436-11d9-952f-000c6e8f12ef">
|
|
<cancelled superseded="9be819c6-4633-11d9-a9e7-0001020eed82"/>
|
|
</vuln>
|
|
|
|
<vuln vid="027380b7-3404-11d9-ac1b-000d614f7fad">
|
|
<topic>hafiye -- lack of terminal escape sequence filtering</topic>
|
|
<affects>
|
|
<package>
|
|
<name>hafiye</name>
|
|
<range><lt>1.0_1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A siyahsapka.org advisory reads:</p>
|
|
<blockquote cite="http://deicide.siyahsapka.org/hafiye_esc.txt">
|
|
<p>Hafiye-1.0 doesnt filter the payload when printing it to
|
|
the terminal. A malicious attacker can send packets with
|
|
escape sequence payloads to exploit this vulnerability.</p>
|
|
<p>If Hafiye has been started with -n packet count option ,
|
|
the vulnerability could allow remote code execution. For
|
|
remote code execution the victim must press Enter after
|
|
program exit.</p>
|
|
</blockquote>
|
|
<p>Note that it appears that this bug can only be exploited in
|
|
conjunction with a terminal emulator that honors the
|
|
appropriate escape sequences.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<freebsdpr>ports/70978</freebsdpr>
|
|
<url>http://deicide.siyahsapka.org/hafiye_esc.txt</url>
|
|
<url>http://www.enderunix.org/hafiye/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-08-23</discovery>
|
|
<entry>2004-11-11</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="e69ba632-326f-11d9-b5b7-000854d03344">
|
|
<topic>ez-ipupdate -- format string vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>ez-ipupdate</name>
|
|
<range><lt>3.0.11b8_2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Data supplied by a remote server is used as the format string
|
|
instead of as parameters in a syslog() call. This may lead
|
|
to crashes or potential running of arbitrary code. It is
|
|
only a problem when running in daemon mode (very common) and
|
|
when using some service types.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0980</cvename>
|
|
<mlist>http://lists.netsys.com/pipermail/full-disclosure/2004-November/028590.html</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-11-11</discovery>
|
|
<entry>2004-11-11</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="eeb1c128-33e7-11d9-a9e7-0001020eed82">
|
|
<topic>ImageMagick -- EXIF parser buffer overflow</topic>
|
|
<affects>
|
|
<package>
|
|
<name>ImageMagick</name>
|
|
<name>ImageMagick-nox11</name>
|
|
<range><lt>6.1.3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>There exists a buffer overflow vulnerability in
|
|
ImageMagick's EXIF parsing code which may lead to execution
|
|
of arbitrary code.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>11548</bid>
|
|
<cvename>CVE-2004-0981</cvename>
|
|
<url>http://secunia.com/advisories/12995/</url>
|
|
<url>http://www.imagemagick.org/www/Changelog.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-10-25</discovery>
|
|
<entry>2004-11-11</entry>
|
|
<modified>2004-12-12</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="282dfea0-3378-11d9-b404-000c6e8f12ef">
|
|
<topic>apache2 multiple space header denial-of-service vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>apache</name>
|
|
<range><gt>2.*</gt><le>2.0.52_2</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>It is possible for remote attackers to cause a denial-of-service
|
|
scenario on Apache 2.0.52 and earlier by sending an HTTP GET
|
|
request with a MIME header containing multiple lines full of
|
|
whitespaces.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0942</cvename>
|
|
<mlist msgid="a62f45480411010157571febcc.mail@gmail.com">http://marc.theaimsgroup.com/?l=full-disclosure&m=109930632317208</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-11-01</discovery>
|
|
<entry>2004-11-10</entry>
|
|
<modified>2004-11-11</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="f3017ce1-32a4-11d9-a9e7-0001020eed82">
|
|
<topic>socat -- format string vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>socat</name>
|
|
<range><lt>1.4.0.3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Socat Security Advisory 1 states:</p>
|
|
<blockquote cite="http://www.dest-unreach.org/socat/advisory/socat-adv-1.html">
|
|
<p>socat up to version 1.4.0.2 contains a syslog() based
|
|
format string vulnerability. This issue was originally
|
|
reported by CoKi on 19 Oct.2004 <a href="http://www.nosystem.com.ar/advisories/advisory-07.txt">http://www.nosystem.com.ar/advisories/advisory-07.txt</a>.
|
|
Further investigation showed that this vulnerability could
|
|
under some circumstances lead to local or remote execution
|
|
of arbitrary code with the privileges of the socat
|
|
process.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://www.dest-unreach.org/socat/advisory/socat-adv-1.html</url>
|
|
<url>http://www.nosystem.com.ar/advisories/advisory-07.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-10-18</discovery>
|
|
<entry>2004-11-10</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="9ff4c91e-328c-11d9-a9e7-0001020eed82">
|
|
<topic>libxml -- remote buffer overflows</topic>
|
|
<affects>
|
|
<package>
|
|
<name>libxml</name>
|
|
<range><lt>1.8.17_3</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>libxml2</name>
|
|
<range><lt>2.6.15</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p><q>infamous41md</q> reports that libxml contains multiple
|
|
buffer overflows in the URL parsing and DNS name resolving
|
|
functions. These vulnerabilities could lead to execution of
|
|
arbitrary code.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0989</cvename>
|
|
<bid>11526</bid>
|
|
<mlist msgid="20041025205132.1f1620a8.infamous41md@hotpop.com">http://marc.theaimsgroup.com/?l=bugtraq&m=109880813013482</mlist>
|
|
<url>http://www.debian.org/security/2004/dsa-582</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-10-26</discovery>
|
|
<entry>2004-11-09</entry>
|
|
<modified>2004-11-10</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="a5742055-300a-11d9-a9e7-0001020eed82">
|
|
<topic>p5-Archive-Zip -- virus detection evasion</topic>
|
|
<affects>
|
|
<package>
|
|
<name>p5-Archive-Zip</name>
|
|
<range><lt>1.14</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>An AMaViS Security Announcement reports that a
|
|
vulnerability exist in the Archive::Zip Perl module which
|
|
may lead to bypass of malicious code in anti-virus programs
|
|
by creating specially crafted ZIP files.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://www.idefense.com/application/poi/display?id=153&type=vulnerabilities</url>
|
|
<url>http://www.amavis.org/security/asa-2004-6.txt</url>
|
|
<url>http://rt.cpan.org/NoAuth/Bug.html?id=8077</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-10-18</discovery>
|
|
<entry>2004-11-08</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="6e6a6b8a-2fde-11d9-b3a2-0050fc56d258">
|
|
<topic>apache mod_include buffer overflow vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>apache</name>
|
|
<range><lt>1.3.33</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>apache+mod_ssl</name>
|
|
<range><lt>1.3.32+2.8.21_1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>apache+mod_ssl+ipv6</name>
|
|
<range><lt>1.3.32+2.8.21_1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>apache+mod_perl</name>
|
|
<range><le>1.3.31</le></range>
|
|
</package>
|
|
<package>
|
|
<name>apache+ipv6</name>
|
|
<range><lt>1.3.33</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>apache+ssl</name>
|
|
<range><le>1.3.29.1.55</le></range>
|
|
</package>
|
|
<package>
|
|
<name>ru-apache</name>
|
|
<range><lt>1.3.33+30.21</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>ru-apache+mod_ssl</name>
|
|
<range><lt>1.3.33+30.21+2.8.22</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>There is a buffer overflow in a function used by mod_include
|
|
that may enable a local user to gain privileges of a httpd
|
|
child. Only users that are able to create SSI documents can
|
|
take advantage of that vulnerability.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0940</cvename>
|
|
<url>http://www.securitylab.ru/48807.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-10-22</discovery>
|
|
<entry>2004-11-06</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="6a164d84-2f7f-11d9-a9e7-0001020eed82">
|
|
<topic>postgresql-contrib -- insecure temporary file creation</topic>
|
|
<affects>
|
|
<package>
|
|
<name>postgresql-contrib</name>
|
|
<range><lt>7.2.6</lt></range>
|
|
<range><gt>7.3.*</gt><lt>7.3.8</lt></range>
|
|
<range><gt>7.4.*</gt><lt>7.4.6</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The make_oidjoins_check script in the PostgreSQL RDBMS has
|
|
insecure handling of temporary files, which could lead to an
|
|
attacker overwriting arbitrary files with the credentials of
|
|
the user running the make_oidjoins_check script.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0977</cvename>
|
|
<bid>11295</bid>
|
|
<url>http://www.postgresql.org/news/234.html</url>
|
|
<url>http://www.trustix.net/errata/2004/0050/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-09-10</discovery>
|
|
<entry>2004-11-06</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="62239968-2f2a-11d9-a9e7-0001020eed82">
|
|
<topic>gd -- integer overflow</topic>
|
|
<affects>
|
|
<package>
|
|
<name>gd</name>
|
|
<name>uk-gd</name>
|
|
<name>ja-gd</name>
|
|
<range><lt>2.0.29,1</lt></range>
|
|
<range><gt>1.*,2</gt><lt>2.*,2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>infamous41md reports about the GD Graphics Library:</p>
|
|
<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&m=109882489302099">
|
|
<p>There is an integer overflow when allocating memory in
|
|
the routine that handles loading PNG image files. This
|
|
later leads to heap data structures being overwritten. If
|
|
an attacker tricked a user into loading a malicious PNG
|
|
image, they could leverage this into executing arbitrary
|
|
code in the context of the user opening image.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>11523</bid>
|
|
<cvename>CVE-2004-0990</cvename>
|
|
<mlist msgid="20041025204303.4341d907.infamous41md@hotpop.com">http://marc.theaimsgroup.com/?l=bugtraq&m=109882489302099</mlist>
|
|
<url>http://www.boutell.com/gd/manual2.0.29.html#whatsnew2.0.29</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-10-26</discovery>
|
|
<entry>2004-11-05</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="19518d22-2d05-11d9-8943-0050fc56d258">
|
|
<topic>putty -- buffer overflow vulnerability in ssh2 support</topic>
|
|
<affects>
|
|
<package>
|
|
<name>putty</name>
|
|
<range><lt>0.56</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>There is a bug in SSH2 support that allows a server to execute
|
|
malicious code on a connecting PuTTY client.
|
|
This attack can be performed before host key verification happens,
|
|
so a different machine -- man in the middle attack -- could fake
|
|
the machine you are connecting to.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<mlist msgid="1CE07882ECEE894CA2D5A89B8DEBC4010A2DD2@porgy.admin.idefense.com">http://marc.theaimsgroup.com/?l=bugtraq&m=109890310929207</mlist>
|
|
<url>http://www.gentoo.org/security/en/glsa/glsa-200410-29.xml</url>
|
|
<url>http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-ssh2-debug.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-10-26</discovery>
|
|
<entry>2004-11-04</entry>
|
|
<modified>2005-01-19</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="e0070221-2dd8-11d9-a9e7-0001020eed82">
|
|
<topic>wzdftpd -- remote DoS</topic>
|
|
<affects>
|
|
<package>
|
|
<name>wzdftpd</name>
|
|
<range><lt>0.4.3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>wzdftpd contains a potential remote Denial-of-Service.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://sourceforge.net/project/shownotes.php?release_id=263573</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-10-28</discovery>
|
|
<entry>2004-11-03</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="1f826757-26be-11d9-ad2d-0050fc56d258">
|
|
<topic>rssh -- format string vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>rssh</name>
|
|
<range><le>2.2.1</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>There is a format string bug in rssh that enables an attacker
|
|
to execute arbitrary code from an account configured to use
|
|
rssh. On FreeBSD it is only possible to compromise the rssh
|
|
running account, not root.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://www.pizzashack.org/rssh/security.shtml</url>
|
|
<mlist msgid="20041023084829.GA16819@sophic.org">http://marc.theaimsgroup.com/?l=bugtraq&m=109855982425122</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-10-23</discovery>
|
|
<entry>2004-10-25</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="ed1d404d-2784-11d9-b954-000bdb1444a4">
|
|
<topic>horde -- cross-site scripting vulnerability in help window</topic>
|
|
<affects>
|
|
<package>
|
|
<name>horde</name>
|
|
<name>horde-devel</name>
|
|
<range><lt>2.2.7</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A Horde Team announcement states that a potential cross-site
|
|
scripting vulnerability in the help window has been
|
|
corrected. The vulnerability appears to involve the handling
|
|
of the <code>topic</code> and <code>module</code> parameters
|
|
of the help window template.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<mlist msgid="20041026115303.10FBEC046E@neo.wg.de">http://marc.theaimsgroup.com/?l=horde-announce&m=109879164718625</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-10-06</discovery>
|
|
<entry>2004-10-27</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="f4428842-a583-4a4c-89b7-297c3459a1c3">
|
|
<topic>bogofilter -- RFC 2047 decoder denial-of-service vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>bogofilter</name>
|
|
<name>bogofilter-qdbm</name>
|
|
<name>bogofilter-tdb</name>
|
|
<name>ru-bogofilter</name>
|
|
<range><ge>0.17.4</ge><lt>0.92.8</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The bogofilter team has been provided with a test case of a
|
|
malformatted (non-conformant) RFC-2047 encoded word that can cause
|
|
bogofilter versions 0.92.7 and prior to try to write a NUL byte into
|
|
a memory location that is either one byte past the end of a flex
|
|
buffer or to a location that is the negative of the encoded word's
|
|
start of payload data, causing a segmentation fault.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<freebsdpr>73144</freebsdpr>
|
|
<cvename>CVE-2004-1007</cvename>
|
|
<mlist msgid="20041008143604.GA14934@scowler.net">http://article.gmane.org/gmane.mail.bogofilter.devel/3308</mlist>
|
|
<mlist msgid="m3r7o892vj.fsf@merlin.emma.line.org">http://article.gmane.org/gmane.mail.bogofilter.devel/3317</mlist>
|
|
<url>http://bugs.debian.org/275373</url>
|
|
<url>http://bogofilter.sourceforge.net/security/bogofilter-SA-2004-01</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-10-09</discovery>
|
|
<entry>2004-10-26</entry>
|
|
<modified>2004-11-03</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="ad2f3337-26bf-11d9-9289-000c41e2cdad">
|
|
<topic>xpdf -- integer overflow vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>gpdf</name>
|
|
<name>cups-base</name>
|
|
<range><lt>1.1.22.0</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>xpdf</name>
|
|
<range><lt>3.00_4</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>kdegraphics</name>
|
|
<range><lt>3.3.0_1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>koffice</name>
|
|
<range><lt>1.3.2_1,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>teTeX-base</name>
|
|
<range><lt>2.0.2_4</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Chris Evans discovered several integer arithmetic overflows
|
|
in the xpdf 2 and xpdf 3 code bases. The flaws have impacts
|
|
ranging from denial-of-service to arbitrary code execution.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0888</cvename>
|
|
<cvename>CVE-2004-0889</cvename>
|
|
<url>http://scary.beasts.org/security/CESA-2004-002.txt</url>
|
|
<url>http://scary.beasts.org/security/CESA-2004-007.txt</url>
|
|
<url>http://www.kde.org/info/security/advisory-20041021-1.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-10-21</discovery>
|
|
<entry>2004-10-25</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="f2d6a5e1-26b9-11d9-9289-000c41e2cdad">
|
|
<topic>gaim -- MSN denial-of-service vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>gaim</name>
|
|
<name>ja-gaim</name>
|
|
<name>ko-gaim</name>
|
|
<name>ru-gaim</name>
|
|
<range><lt>1.0.2</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>gaim</name>
|
|
<range><gt>20030000</gt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Gaim team discovered denial-of-service vulnerabilities in
|
|
the MSN protocol handler:</p>
|
|
<blockquote cite="http://gaim.sourceforge.net/security/?id=7">
|
|
<p>After accepting a file transfer request, Gaim will attempt
|
|
to allocate a buffer of a size equal to the entire filesize,
|
|
this allocation attempt will cause Gaim to crash if the size
|
|
exceeds the amount of available memory.</p>
|
|
</blockquote>
|
|
<blockquote cite="http://gaim.sourceforge.net/security/?id=8">
|
|
<p>Gaim allocates a buffer for the payload of each message
|
|
received based on the size field in the header of the
|
|
message. A malicious peer could specify an invalid size that
|
|
exceeds the amount of available memory.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://gaim.sourceforge.net/security/?id=7</url>
|
|
<url>http://gaim.sourceforge.net/security/?id=8</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-10-19</discovery>
|
|
<entry>2004-10-25</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="ad61657d-26b9-11d9-9289-000c41e2cdad">
|
|
<topic>gaim -- Content-Length header denial-of-service vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>gaim</name>
|
|
<name>ja-gaim</name>
|
|
<name>ko-gaim</name>
|
|
<name>ru-gaim</name>
|
|
<range><lt>0.82</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>gaim</name>
|
|
<range><gt>20030000</gt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Sean <q>infamous42md</q> reports:</p>
|
|
<blockquote cite="http://gaim.sourceforge.net/security/?id=6">
|
|
<p>When a remote server provides a large "content-length"
|
|
header value, Gaim will attempt to allocate a buffer to
|
|
store the content, however this allocation attempt will
|
|
cause Gaim to crash if the length exceeds the amount of
|
|
possible memory. This happens when reading profile
|
|
information on some protocols. It also happens when smiley
|
|
themes are installed via drag and drop.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://gaim.sourceforge.net/security/?id=6</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-08-26</discovery>
|
|
<entry>2004-10-25</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="4260eacb-26b8-11d9-9289-000c41e2cdad">
|
|
<topic>gaim -- multiple buffer overflows</topic>
|
|
<affects>
|
|
<package>
|
|
<name>gaim</name>
|
|
<name>ja-gaim</name>
|
|
<name>ko-gaim</name>
|
|
<name>ru-gaim</name>
|
|
<range><lt>0.82</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>gaim</name>
|
|
<range><gt>20030000</gt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Sean <q>infamous42md</q> reports several situations in gaim
|
|
that may result in exploitable buffer overflows:</p>
|
|
<ul>
|
|
<li>Rich Text Format (RTF) messages in Novell GroupWise
|
|
protocol</li>
|
|
<li>Unsafe use of gethostbyname in zephyr protocol</li>
|
|
<li>URLs which are over 2048 bytes long once decoded</li>
|
|
</ul>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0785</cvename>
|
|
<url>http://gaim.sourceforge.net/security/?id=3</url>
|
|
<url>http://gaim.sourceforge.net/security/?id=4</url>
|
|
<url>http://gaim.sourceforge.net/security/?id=5</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-08-26</discovery>
|
|
<entry>2004-10-25</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="e16293f0-26b7-11d9-9289-000c41e2cdad">
|
|
<topic>gaim -- heap overflow exploitable by malicious GroupWise server</topic>
|
|
<affects>
|
|
<package>
|
|
<name>gaim</name>
|
|
<name>ja-gaim</name>
|
|
<name>ko-gaim</name>
|
|
<name>ru-gaim</name>
|
|
<range><lt>0.82</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>gaim</name>
|
|
<range><gt>20030000</gt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Sean <q>infamous42md</q> reports that a malicous GroupWise
|
|
messaging server may be able to exploit a heap buffer
|
|
overflow in gaim, leading to arbitrary code execution.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0754</cvename>
|
|
<url>http://gaim.sourceforge.net/security/?id=2</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-08-26</discovery>
|
|
<entry>2004-10-25</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="635bf5f4-26b7-11d9-9289-000c41e2cdad">
|
|
<topic>gaim -- malicious smiley themes</topic>
|
|
<affects>
|
|
<package>
|
|
<name>gaim</name>
|
|
<name>ja-gaim</name>
|
|
<name>ko-gaim</name>
|
|
<name>ru-gaim</name>
|
|
<range><lt>0.82</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>gaim</name>
|
|
<range><gt>20030000</gt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Gaim Security Issues page documents a problem with
|
|
installing smiley themes from an untrusted source:</p>
|
|
<blockquote cite="http://gaim.sourceforge.net/security/?id=1">
|
|
<p>To install a new smiley theme, a user can drag a tarball
|
|
from a graphical file manager, or a hypertext link to one
|
|
from a web browser. When a tarball is dragged, Gaim executes
|
|
a shell command to untar it. However, it does not escape the
|
|
filename before sending it to the shell. Thus, a specially
|
|
crafted filename could execute arbitrary commands if the
|
|
user could be convinced to drag a file into the smiley theme
|
|
selector.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0784</cvename>
|
|
<url>http://gaim.sourceforge.net/security/?id=1</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-08-22</discovery>
|
|
<entry>2004-10-25</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="1e6c4008-245f-11d9-b584-0050fc56d258">
|
|
<topic>gaim -- buffer overflow in MSN protocol support</topic>
|
|
<affects>
|
|
<package>
|
|
<name>gaim</name>
|
|
<name>ja-gaim</name>
|
|
<name>ru-gaim</name>
|
|
<range><ge>0.79</ge><le>1.0.1</le></range>
|
|
</package>
|
|
<package>
|
|
<name>gaim</name>
|
|
<range><gt>20030000</gt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Due to a buffer overflow in the MSN protocol support for
|
|
gaim 0.79 to 1.0.1, it is possible for remote clients to do a
|
|
denial-of-service attack on the application.
|
|
This is caused by an unbounded copy operation, which writes
|
|
to the wrong buffer.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0891</cvename>
|
|
<url>http://gaim.sourceforge.net/security/?id=9</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-10-19</discovery>
|
|
<entry>2004-10-25</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="4238151d-207a-11d9-bfe2-0090962cff2a">
|
|
<topic>mod_ssl -- SSLCipherSuite bypass</topic>
|
|
<affects>
|
|
<package>
|
|
<name>ru-apache+mod_ssl</name>
|
|
<range><le>1.3.31+30.20+2.8.18</le></range>
|
|
</package>
|
|
<package>
|
|
<name>apache+mod_ssl</name>
|
|
<range><lt>1.3.31+2.8.20</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>apache+mod_ssl+ipv6</name>
|
|
<range><le>1.3.31+2.8.18_4</le></range>
|
|
</package>
|
|
<package>
|
|
<name>apache2</name>
|
|
<range><le>2.0.52_1</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>It is possible for clients to use any cipher suite configured by
|
|
the virtual host, whether or not a certain cipher suite is selected
|
|
for a specific directory. This might result in clients using a
|
|
weaker encryption than originally configured.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0885</cvename>
|
|
<mlist msgid="20041008152510.GE8385@redhat.com">http://marc.theaimsgroup.com/?l=apache-modssl&m=109724918128044</mlist>
|
|
<url>http://issues.apache.org/bugzilla/show_bug.cgi?id=31505</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-10-01</discovery>
|
|
<entry>2004-10-23</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="20d16518-2477-11d9-814e-0001020eed82">
|
|
<topic>mpg123 -- buffer overflow in URL handling</topic>
|
|
<affects>
|
|
<package>
|
|
<name>mpg123</name>
|
|
<name>mpg123-nas</name>
|
|
<name>mpg123-esound</name>
|
|
<range><lt>0.59r_15</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Carlos Barros reports that mpg123 contains two buffer
|
|
overflows. These vulnerabilities can potentially lead to
|
|
execution of arbitrary code.</p>
|
|
<p>The first buffer overflow can occur when mpg123 parses a
|
|
URL with a user-name/password field that is more than 256
|
|
characters long. This problem can be triggered either
|
|
locally or remotely via a specially crafted play list. The
|
|
second potential buffer overflow may be triggered locally by
|
|
a specially crafted symlink to the mpg123 binary. This
|
|
problem is not as serious, since mpg123 is not installed
|
|
setuid by default.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>11468</bid>
|
|
<cvename>CVE-2004-0982</cvename>
|
|
<mlist msgid="200410200119.42801.barros@barrossecurity.com">http://marc.theaimsgroup.com/?l=bugtraq&m=109834486312407</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-10-02</discovery>
|
|
<entry>2004-10-23</entry>
|
|
<modified>2004-12-30</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="7b81fc47-239f-11d9-814e-0001020eed82">
|
|
<topic>apache2 -- SSL remote DoS</topic>
|
|
<affects>
|
|
<package>
|
|
<name>apache</name>
|
|
<range><gt>2.0</gt><lt>2.0.51</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Apache HTTP Server 2.0.51 release notes report that the
|
|
following issues have been fixed:</p>
|
|
<blockquote cite="http://marc.theaimsgroup.com/?l=apache-httpd-announce&m=109527608022322">
|
|
<p>A segfault in mod_ssl which can be triggered by a
|
|
malicious remote server, if proxying to SSL servers has
|
|
been configured. [CAN-2004-0751]</p>
|
|
<p>A potential infinite loop in mod_ssl which could be
|
|
triggered given particular timing of a connection
|
|
abort. [CAN-2004-0748]</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>11094</bid>
|
|
<bid>11154</bid>
|
|
<cvename>CVE-2004-0748</cvename>
|
|
<cvename>CVE-2004-0751</cvename>
|
|
<mlist msgid="029f01c49b54$dec30f20$1500a8c0@Cougar">http://marc.theaimsgroup.com/?l=apache-httpd-announce&m=109527608022322</mlist>
|
|
<url>http://nagoya.apache.org/bugzilla/show_bug.cgi?id=29964</url>
|
|
<url>http://nagoya.apache.org/bugzilla/show_bug.cgi?id=30134</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-07-07</discovery>
|
|
<entry>2004-10-21</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="fc07c9ca-22ce-11d9-814e-0001020eed82">
|
|
<topic>phpmyadmin -- remote command execution vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>phpMyAdmin</name>
|
|
<name>phpmyadmin</name>
|
|
<range><lt>2.6.0.2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>From the phpMyAdmin 2.6.0p2 release notes:</p>
|
|
<blockquote cite="http://sourceforge.net/project/shownotes.php?release_id=274709">
|
|
<p>If PHP is not running in safe mode, a problem in the
|
|
MIME-based transformation system (with an "external"
|
|
transformation) allows to execute any command with the
|
|
privileges of the web server's user.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>11391</bid>
|
|
<url>http://sourceforge.net/project/shownotes.php?release_id=274709</url>
|
|
<url>http://sourceforge.net/tracker/index.php?func=detail&aid=1044864&group_id=23067&atid=377408</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-10-11</discovery>
|
|
<entry>2004-10-20</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="61480a9a-22b2-11d9-814e-0001020eed82">
|
|
<topic>cabextract -- insecure directory handling</topic>
|
|
<affects>
|
|
<package>
|
|
<name>cabextract</name>
|
|
<range><lt>1.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>cabextract has insufficient checks for file names that
|
|
contain <q>../</q>. This can cause files to be extracted to
|
|
the parent directory.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0916</cvename>
|
|
<url>http://www.kyz.uklinux.net/cabextract.php#changes</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-10-18</discovery>
|
|
<entry>2004-10-20</entry>
|
|
<modified>2004-10-22</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="8091fcea-f35e-11d8-81b0-000347a4fa7d">
|
|
<topic>a2ps -- insecure command line argument handling</topic>
|
|
<affects>
|
|
<package>
|
|
<name>a2ps-a4</name>
|
|
<range><lt>4.13b_2</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>a2ps-letter</name>
|
|
<range><lt>4.13b_2</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>a2ps-letterdj</name>
|
|
<range><lt>4.13b_2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Rudolf Polzer reports:</p>
|
|
<blockquote cite="http://www.freebsd.org/cgi/query-pr.cgi?pr=ports/70618">
|
|
<p>a2ps builds a command line for file() containing an
|
|
unescaped version of the file name, thus might call
|
|
external programs described by the file name. Running a
|
|
cronjob over a public writable directory a2ps-ing all
|
|
files in it - or simply typing "a2ps *.txt" in /tmp - is
|
|
therefore dangerous.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-1170</cvename>
|
|
<freebsdpr>ports/70618</freebsdpr>
|
|
<bid>11025</bid>
|
|
<url>http://www.osvdb.org/9176</url>
|
|
<mlist msgid="e5312d6a040824040119840c7c@mail.gmail.com">http://marc.theaimsgroup.com/?l=full-disclosure&m=109334851517137</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-08-18</discovery>
|
|
<entry>2004-10-20</entry>
|
|
<modified>2004-12-30</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="746ca1ac-21ec-11d9-9289-000c41e2cdad">
|
|
<topic>ifmail -- unsafe set-user-ID application</topic>
|
|
<affects>
|
|
<package>
|
|
<name>ifmail</name>
|
|
<range><le>ifmail-2.15_4</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Niels Heinen reports that ifmail allows one to specify
|
|
a configuration file. Since ifmail runs set-user-ID `news',
|
|
this may allow a local attacker to write to arbitrary files
|
|
or execute arbitrary commands as the `news' user.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://cvsweb.freebsd.org/ports/news/ifmail</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-08-23</discovery>
|
|
<entry>2004-10-19</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="e31d44a2-21e3-11d9-9289-000c41e2cdad">
|
|
<topic>imwheel -- insecure handling of PID file</topic>
|
|
<affects>
|
|
<package>
|
|
<name>imwheel</name>
|
|
<range><lt>1.0.0.p12</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A Computer Academic Underground advisory describes the
|
|
consequences of imwheel's handling of the process ID file (PID
|
|
file):</p>
|
|
<blockquote cite="http://www.caughq.org/advisories/CAU-2004-0002.txt">
|
|
<p>imwheel exclusively uses a predictably named PID file for
|
|
management of multiple imwheel processes. A race condition
|
|
exists when the -k command-line option is used to kill
|
|
existing imwheel processes. This race condition may be
|
|
used by a local user to Denial of Service another user
|
|
using imwheel, lead to resource exhaustion of the host
|
|
system, or append data to arbitrary files.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://www.caughq.org/advisories/CAU-2004-0002.txt</url>
|
|
<url>http://imwheel.sourceforge.net/files/DEVELOPMENT.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-08-20</discovery>
|
|
<entry>2004-10-19</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="064225c5-1f53-11d9-836a-0090962cff2a">
|
|
<topic>squid -- NTLM authentication denial-of-service vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>squid</name>
|
|
<range><lt>2.5.7</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A remote attacker is able to cause a denial-of-service
|
|
situation, when NTLM authentication is enabled in squid.
|
|
NTLM authentication uses two functions which lack correct
|
|
offset checking.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0832</cvename>
|
|
<url>http://www.squid-cache.org/bugs/show_bug.cgi?id=1045</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-08-18</discovery>
|
|
<entry>2004-10-18</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="ca543e06-207a-11d9-814e-0001020eed82">
|
|
<topic>cacti -- SQL injection</topic>
|
|
<affects>
|
|
<package>
|
|
<name>cacti</name>
|
|
<range><lt>0.8.6</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Fernando Quintero reports that Cacti 0.8.5a suffers from a
|
|
SQL injection attack where an attacker can change the
|
|
password for any Cacti user. This attack is not possible if
|
|
the PHP option magic_quotes_gpc is set to On, which is the
|
|
default for PHP in FreeBSD.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<mlist msgid="1092686621.818.8.camel@mitnick.nadied.org">http://marc.theaimsgroup.com/?l=full-disclosure&m=109269427427368</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-08-16</discovery>
|
|
<entry>2004-10-17</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="18974c8a-1fbd-11d9-814e-0001020eed82">
|
|
<topic>apache13-modssl -- format string vulnerability in proxy support</topic>
|
|
<affects>
|
|
<package>
|
|
<name>apache+mod_ssl</name>
|
|
<range><lt>1.3.31+2.8.19</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>apache+mod_ssl+ipv6</name>
|
|
<range><lt>1.3.31+2.8.19</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>ru-apache+mod_ssl</name>
|
|
<range><lt>1.3.31+30.20+2.8.19</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A OpenPKG Security Advisory reports:</p>
|
|
<blockquote cite="http://www.openpkg.org/security/OpenPKG-SA-2004.032-apache.html">
|
|
<p>Triggered by a report to Packet Storm from Virulent, a
|
|
format string vulnerability was found in mod_ssl, the
|
|
Apache SSL/TLS interface to OpenSSL, version (up to and
|
|
including) 2.8.18 for Apache 1.3. The mod_ssl in Apache
|
|
2.x is not affected. The vulnerability could be
|
|
exploitable if Apache is used as a proxy for HTTPS URLs
|
|
and the attacker established a own specially prepared DNS
|
|
and origin server environment.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>10736</bid>
|
|
<certvu>303448</certvu>
|
|
<cvename>CVE-2004-0700</cvename>
|
|
<url>http://www.openpkg.org/security/OpenPKG-SA-2004.032-apache.html</url>
|
|
<url>http://packetstormsecurity.org/0407-advisories/modsslFormat.txt</url>
|
|
<mlist msgid="20040716204207.GA45678@engelschall.com">http://marc.theaimsgroup.com/?l=apache-modssl&m=109001100906749</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-07-16</discovery>
|
|
<entry>2004-10-17</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="8e2e6ad8-1720-11d9-9fb9-00902788733b">
|
|
<topic>tor -- remote DoS and loss of anonymity</topic>
|
|
<affects>
|
|
<package>
|
|
<name>tor</name>
|
|
<range><lt>0.0.8.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Tor has various remote crashes which could lead to a remote
|
|
denial-of-service and be used to defeat clients anonymity.
|
|
It is not expected that these vulnerabilities are
|
|
exploitable for arbitrary code execution.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<mlist>http://archives.seul.org/or/announce/Aug-2004/msg00001.html</mlist>
|
|
<mlist>http://archives.seul.org/or/announce/Oct-2004/msg00000.html</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-08-25</discovery>
|
|
<entry>2004-10-15</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="b2cfb400-1df0-11d9-a859-0050fc56d258">
|
|
<topic>icecast -- Cross-Site Scripting Vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>icecast</name>
|
|
<range><lt>1.3.12_2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Caused by improper filtering of HTML code in the
|
|
status display, it is possible for a remote user
|
|
to execute scripting code in the target user's
|
|
browser.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0781</cvename>
|
|
<url>http://www.securitytracker.com/alerts/2004/Aug/1011047.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-08-24</discovery>
|
|
<entry>2004-10-13</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="741c3957-1d69-11d9-a804-0050fc56d258">
|
|
<topic>icecast -- HTTP header overflow</topic>
|
|
<affects>
|
|
<package>
|
|
<name>icecast2</name>
|
|
<range><lt>2.0.2,1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>It is possible to execute remote code simply using
|
|
HTTP request plus 31 headers followed by a shellcode that will be
|
|
executed directly.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<mlist msgid="20040928184943.0a82b6f6.aluigi@autistici.org">http://marc.theaimsgroup.com/?l=full-disclosure&m=109646043512722</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-09-29</discovery>
|
|
<entry>2004-10-13</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="20dfd134-1d39-11d9-9be9-000c6e8f12ef">
|
|
<topic>freeradius -- denial-of-service vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>freeradius</name>
|
|
<range><ge>0.8.0</ge><lt>1.0.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A remote attacker may be able to crash the freeRADIUS Server
|
|
due to three independant bugs in the function which does
|
|
improper checking values while processing RADIUS
|
|
attributes.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0938</cvename>
|
|
<cvename>CVE-2004-0960</cvename>
|
|
<cvename>CVE-2004-0961</cvename>
|
|
<url>http://www.securitytracker.com/alerts/2004/Sep/1011364.html</url>
|
|
<certvu>541574</certvu>
|
|
<bid>11222</bid>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-09-20</discovery>
|
|
<entry>2004-10-13</entry>
|
|
<modified>2004-10-19</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="76301302-1d59-11d9-814e-0001020eed82">
|
|
<topic>xerces-c2 -- Attribute blowup denial-of-service</topic>
|
|
<affects>
|
|
<package>
|
|
<name>xerces-c2</name>
|
|
<range><lt>2.6.0</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Amit Klein reports about Xerces-C++:</p>
|
|
<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&m=109674050017645">
|
|
<p>An attacker can craft a malicious XML document, which
|
|
uses XML attributes in a way that inflicts a denial of
|
|
service condition on the target machine (XML parser). The
|
|
result of this attack is that the XML parser consumes all
|
|
the CPU.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>11312</bid>
|
|
<mlist msgid="415F00A8.13029.1FAADB7@localhost">http://marc.theaimsgroup.com/?l=bugtraq&m=109674050017645</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-10-02</discovery>
|
|
<entry>2004-10-13</entry>
|
|
<modified>2004-10-14</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="12b7b4cf-1d53-11d9-814e-0001020eed82">
|
|
<topic>wordpress -- XSS in administration panel</topic>
|
|
<affects>
|
|
<package>
|
|
<name>wordpress</name>
|
|
<range><lt>1.2.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Pages in the administration panel of Wordpress are
|
|
vulnerable for XSS attacks.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://wordpress.org/development/2004/10/wp-121/</url>
|
|
<mlist msgid="20040927231608.19365.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&m=109641484723194</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-09-27</discovery>
|
|
<entry>2004-10-13</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="3897a2f8-1d57-11d9-bc4a-000c41e2cdad">
|
|
<topic>tiff -- multiple integer overflows</topic>
|
|
<affects>
|
|
<package>
|
|
<name>tiff</name>
|
|
<range><le>3.6.1_2</le></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-tiff</name>
|
|
<range><lt>3.6.1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>pdflib</name>
|
|
<name>pdflib-perl</name>
|
|
<range><lt>6.0.1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>gdal</name>
|
|
<range><lt>1.2.1_2</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>ivtools</name>
|
|
<range><lt>1.2.3</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>paraview</name>
|
|
<range><lt>2.4.3</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>fractorama</name>
|
|
<range><lt>1.6.7_1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>iv</name>
|
|
<name>ja-iv</name>
|
|
<name>ja-libimg</name>
|
|
<range><gt>0</gt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Dmitry V. Levin discovered numerous integer overflow bugs in
|
|
libtiff. Most of these bugs are related to memory management,
|
|
and are believed to be exploitable for arbitrary code
|
|
execution.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<certvu>687568</certvu>
|
|
<cvename>CVE-2004-0886</cvename>
|
|
<url>http://www.idefense.com/application/poi/display?id=173&type=vulnerabilities</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-10-13</discovery>
|
|
<entry>2004-10-13</entry>
|
|
<modified>2006-06-08</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="30cea6be-1d0c-11d9-814e-0001020eed82">
|
|
<topic>CUPS -- local information disclosure</topic>
|
|
<affects>
|
|
<package>
|
|
<name>cups-base</name>
|
|
<range><lt>1.1.22</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Certain methods of authenticated remote printing in CUPS
|
|
can disclose user names and passwords in the log files.</p>
|
|
<p>A workaround for this problem is to set more strict
|
|
access permissions on the CUPS logfiles.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://docs.info.apple.com/article.html?artnum=61798</url>
|
|
<url>http://secunia.com/advisories/12690/</url>
|
|
<url>http://www.cups.org/str.php?L920</url>
|
|
<cvename>CVE-2004-0923</cvename>
|
|
<certvu>557062</certvu>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-09-23</discovery>
|
|
<entry>2004-10-13</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="30cf9485-1c2c-11d9-9ecb-000c6e8f12ef">
|
|
<topic>zinf -- potential buffer overflow playlist support</topic>
|
|
<affects>
|
|
<package>
|
|
<name>zinf</name>
|
|
<range><lt>2.2.5</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>freeamp</name>
|
|
<range><gt>0</gt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The audio player Zinf is vulnerable to a buffer-overflow
|
|
bug in the management of the playlist files.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<mlist msgid="20040924213102.7fb91138.aluigi@autistici.org">http://marc.theaimsgroup.com/?l=bugtraq&m=109608092609200</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-09-24</discovery>
|
|
<entry>2004-10-12</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="f6680c03-0bd8-11d9-8a8a-000c41e2cdad">
|
|
<topic>tiff -- RLE decoder heap overflows</topic>
|
|
<affects>
|
|
<package>
|
|
<name>tiff</name>
|
|
<range><le>3.6.1_1</le></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-tiff</name>
|
|
<range><lt>3.6.1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>pdflib</name>
|
|
<name>pdflib-perl</name>
|
|
<range><lt>6.0.1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>gdal</name>
|
|
<range><lt>1.2.1_2</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>ivtools</name>
|
|
<range><lt>1.2.3</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>paraview</name>
|
|
<range><lt>2.4.3</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>fractorama</name>
|
|
<range><lt>1.6.7_1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>iv</name>
|
|
<name>ja-iv</name>
|
|
<name>ja-libimg</name>
|
|
<range><gt>0</gt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Chris Evans discovered several heap buffer overflows in
|
|
libtiff's RLE decoder. These overflows could be triggered
|
|
by a specially-crafted TIFF image file, resulting in an
|
|
application crash and possibly arbitrary code execution.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<certvu>948752</certvu>
|
|
<cvename>CVE-2004-0803</cvename>
|
|
<url>http://scary.beasts.org/security/CESA-2004-006.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-10-13</discovery>
|
|
<entry>2004-10-13</entry>
|
|
<modified>2006-06-08</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="26c9e8c6-1c99-11d9-814e-0001020eed82">
|
|
<topic>sharutils -- buffer overflows</topic>
|
|
<affects>
|
|
<package>
|
|
<name>sharutils</name>
|
|
<range><lt>4.2.1_2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>From Gentoo advisory GLSA 200410-01:</p>
|
|
<blockquote cite="http://www.gentoo.org/security/en/glsa/glsa-200410-01.xml">
|
|
<p>sharutils contains two buffer overflows. Ulf Harnhammar
|
|
discovered a buffer overflow in shar.c, where the length
|
|
of data returned by the wc command is not checked.
|
|
Florian Schilhabel discovered another buffer overflow in
|
|
unshar.c.</p>
|
|
<p>An attacker could exploit these vulnerabilities to
|
|
execute arbitrary code as the user running one of the
|
|
sharutils programs.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>11298</bid>
|
|
<url>http://www.gentoo.org/security/en/glsa/glsa-200410-01.xml</url>
|
|
<url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=265904</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-08-15</discovery>
|
|
<entry>2004-10-13</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="3030ae22-1c7f-11d9-81a4-0050fc56d258">
|
|
<topic>mail-notification -- denial-of-service vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>mail-notification</name>
|
|
<range><lt>0.7.0</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Caused by an untested return value, and a resulting
|
|
null pointer dereference, it is possible for an attacker
|
|
to crash the application. However, the attacker must first
|
|
hijack the connection between Mail Notification and the
|
|
Gmail or IMAP server.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://www.nongnu.org/mailnotify/sa/mail-notification-SA-04:2.asc</url>
|
|
<url>http://www.nongnu.org/mailnotify/sa/mail-notification-SA-04:3.asc</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-10-06</discovery>
|
|
<entry>2004-10-12</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="65e99f52-1c5f-11d9-bc4a-000c41e2cdad">
|
|
<topic>squid -- SNMP module denial-of-service vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>squid</name>
|
|
<range><lt>2.5.7</lt></range>
|
|
<range><ge>3.0.0</ge><lt>3.0.7</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Squid-2.5 patches page notes:</p>
|
|
<blockquote cite="http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE6-SNMP_core_dump">
|
|
<p>If a certain malformed SNMP request is received squid
|
|
restarts with a Segmentation Fault error.</p>
|
|
</blockquote>
|
|
<p>This only affects squid installations where SNMP is
|
|
explicitly enabled via "make config". As a workaround,
|
|
SNMP can be disabled by defining "snmp_port 0" in
|
|
squid.conf.</p>
|
|
<p>Squid security advisory SQUID-2008:1 explains that Squid-3 versions
|
|
up to and including Squid-3.0.STABLE6 are affected by this error,
|
|
too.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0918</cvename>
|
|
<url>http://www.idefense.com/application/poi/display?id=152&type=vulnerabilities</url>
|
|
<url>http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE6-SNMP_core_dump</url>
|
|
<url>http://www.squid-cache.org/Advisories/SQUID-2004_3.txt</url>
|
|
<url>http://www.squid-cache.org/Advisories/SQUID-2008_1.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-09-29</discovery>
|
|
<entry>2004-10-12</entry>
|
|
<modified>2008-06-28</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="0c592c4a-1bcc-11d9-a3ec-00061bd2d56f">
|
|
<topic>cyrus-sasl -- potential buffer overflow in DIGEST-MD5 plugin</topic>
|
|
<affects>
|
|
<package>
|
|
<name>cyrus-sasl</name>
|
|
<range><ge>2.*</ge><lt>2.1.19</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Cyrus SASL DIGEST-MD5 plugin contains a potential
|
|
buffer overflow when quoting is required in the output.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>https://bugzilla.andrew.cmu.edu/cgi-bin/cvsweb.cgi/src/sasl/plugins/digestmd5.c#rev1.171</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-07-06</discovery>
|
|
<entry>2004-10-12</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="92268205-1947-11d9-bc4a-000c41e2cdad">
|
|
<topic>cyrus-sasl -- dynamic library loading and set-user-ID applications</topic>
|
|
<affects>
|
|
<package>
|
|
<name>cyrus-sasl</name>
|
|
<range><le>1.5.28_3</le></range>
|
|
<range><ge>2.*</ge><le>2.1.19</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Cyrus SASL library, libsasl, contains functions which
|
|
may load dynamic libraries. These libraries may be loaded
|
|
from the path specified by the environmental variable
|
|
SASL_PATH, which in some situations may be fully controlled
|
|
by a local attacker. Thus, if a set-user-ID application
|
|
(such as chsh) utilizes libsasl, it may be possible for a
|
|
local attacker to gain superuser privileges.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0884</cvename>
|
|
<url>https://bugzilla.andrew.cmu.edu/cgi-bin/cvsweb.cgi/src/sasl/lib/common.c#rev1.104</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-09-22</discovery>
|
|
<entry>2004-10-08</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="efc4819b-0b2d-11d9-bfe1-000bdb1444a4">
|
|
<topic>imp3 -- XSS hole in the HTML viewer</topic>
|
|
<affects>
|
|
<package>
|
|
<name>imp</name>
|
|
<range><lt>3.2.6</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The script vulnerabilities can only be exposed with
|
|
certain browsers and allow XSS attacks when viewing
|
|
HTML messages with the HTML MIME viewer</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://thread.gmane.org/gmane.comp.horde.imp/15488</url>
|
|
<url>http://cvs.horde.org/diff.php/imp/docs/CHANGES?r1=1.389.2.109&r2=1.389.2.111&ty=h</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-08-20</discovery>
|
|
<entry>2004-10-05</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="938f357c-16dd-11d9-bc4a-000c41e2cdad">
|
|
<topic>bmon -- unsafe set-user-ID application</topic>
|
|
<affects>
|
|
<package>
|
|
<name>bmon</name>
|
|
<range><lt>1.2.1_2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Jon Nistor reported that the FreeBSD port of bmon was
|
|
installed set-user-ID root, and executes commands using
|
|
relative paths. This could allow local user to easily obtain
|
|
root privileges.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<freebsdpr>ports/67340</freebsdpr>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-05-29</discovery>
|
|
<entry>2004-10-05</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="84ab58cf-e4ac-11d8-9b0a-000347a4fa7d">
|
|
<topic>gnutls -- certificate chain verification DoS</topic>
|
|
<affects>
|
|
<package>
|
|
<name>gnutls</name>
|
|
<range><lt>1.0.17</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>gnutls-devel</name>
|
|
<range><ge>1.1.*</ge><lt>1.1.12</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Patric Hornik reports on a problem in the certificate chain
|
|
verification procedures of GnuTLS that may result in a
|
|
denial-of-service vulnerability:</p>
|
|
<blockquote cite="http://www.hornik.sk/SA/SA-20040802.txt">
|
|
<p>The certificate chain should be verified from last root
|
|
certificate to the first certificate. Otherwise a lot
|
|
of unauthorized CPU processing can be forced to check
|
|
certificate signatures signed with arbitrary RSA/DSA keys
|
|
chosen by attacker.</p>
|
|
<p>In GnuTLS the signatures are checked from first to last
|
|
certificate, there is no limit on size of keys and no
|
|
limit on length of certificate chain.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://www.hornik.sk/SA/SA-20040802.txt</url>
|
|
<url>http://secunia.com/advisories/12156</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-08-02</discovery>
|
|
<entry>2004-10-05</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="562a3fdf-16d6-11d9-bc4a-000c41e2cdad">
|
|
<topic>php -- vulnerability in RFC 1867 file upload processing</topic>
|
|
<affects>
|
|
<package>
|
|
<name>php4</name>
|
|
<name>php4-cgi</name>
|
|
<range><le>4.3.8_2</le></range>
|
|
</package>
|
|
<package>
|
|
<name>mod_php4</name>
|
|
<range><le>4.3.8_2,1</le></range>
|
|
</package>
|
|
<package>
|
|
<name>php5</name>
|
|
<name>php5-cgi</name>
|
|
<range><le>5.0.1</le></range>
|
|
</package>
|
|
<package>
|
|
<name>mod_php5</name>
|
|
<range><le>5.0.1,1</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Stefano Di Paola discovered an issue with PHP that
|
|
could allow someone to upload a file to any directory
|
|
writeable by the httpd process. Any sanitizing performed on
|
|
the prepended directory path is ignored. This bug can only
|
|
be triggered if the $_FILES element name contains an
|
|
underscore.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<mlist msgid="1095268057.2818.20.camel@localhost">http://marc.theaimsgroup.com/?l=bugtraq&m=109534848430404</mlist>
|
|
<mlist msgid="1096478151.3220.6.camel@localhost">http://marc.theaimsgroup.com/?l=bugtraq&m=109648426331965</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-09-15</discovery>
|
|
<entry>2004-09-15</entry>
|
|
<modified>2004-10-12</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="ad74a1bd-16d2-11d9-bc4a-000c41e2cdad">
|
|
<topic>php -- php_variables memory disclosure</topic>
|
|
<affects>
|
|
<package>
|
|
<name>mod_php4-twig</name>
|
|
<name>php4-cgi</name>
|
|
<name>php4-cli</name>
|
|
<name>php4-dtc</name>
|
|
<name>php4-horde</name>
|
|
<name>php4-nms</name>
|
|
<name>php4</name>
|
|
<range><le>4.3.8_2</le></range>
|
|
</package>
|
|
<package>
|
|
<name>mod_php</name>
|
|
<name>mod_php4</name>
|
|
<range><ge>4</ge><le>4.3.8_2,1</le></range>
|
|
</package>
|
|
<package>
|
|
<name>php5</name>
|
|
<name>php5-cgi</name>
|
|
<name>php5-cli</name>
|
|
<range><le>5.0.1</le></range>
|
|
</package>
|
|
<package>
|
|
<name>mod_php5</name>
|
|
<range><le>5.0.1,1</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Stefano Di Paola reports:</p>
|
|
<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&m=109527531130492">
|
|
<p>Bad array parsing in php_variables.c could lead to show
|
|
arbitrary memory content such as pieces of php code
|
|
and other data. This affects all GET, POST or COOKIES
|
|
variables.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<mlist msgid="1095267581.2818.13.camel@localhost">http://marc.theaimsgroup.com/?l=bugtraq&m=109527531130492</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-09-15</discovery>
|
|
<entry>2004-10-05</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="fffacc93-16cb-11d9-bc4a-000c41e2cdad">
|
|
<topic>xv -- exploitable buffer overflows</topic>
|
|
<affects>
|
|
<package>
|
|
<name>xv</name>
|
|
<name>xv-m17n</name>
|
|
<range><lt>3.10a_4</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>In a Bugtraq posting, infamous41md(at)hotpop.com reported:</p>
|
|
<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&m=109302498125092">
|
|
<p>there are at least 5 exploitable buffer and heap
|
|
overflows in the image handling code. this allows someone
|
|
to craft a malicious image, trick a user into viewing the
|
|
file in xv, and upon viewing that image execute arbitrary
|
|
code under privileges of the user viewing image. note
|
|
the AT LEAST part of the above sentence. there is such a
|
|
plethora of bad code that I just stopped reading after
|
|
a while. there are at least 100 calls to sprintf() and
|
|
strcpy() with no regards for bounds of buffers. 95% of
|
|
these deal with program arguments or filenames, so they
|
|
are of no interest to exploit. however I just got sick of
|
|
reading this code after not too long. so im sure there are
|
|
still other overflows in the image handling code for other
|
|
image types.</p>
|
|
</blockquote>
|
|
<p>The posting also included an exploit.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<mlist msgid="20040820032605.360e43e3.infamous41md@hotpop.com">http://marc.theaimsgroup.com/?l=bugtraq&m=109302498125092</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-08-20</discovery>
|
|
<entry>2004-10-05</entry>
|
|
<modified>2004-10-12</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="8c33b299-163b-11d9-ac1b-000d614f7fad">
|
|
<topic>getmail -- symlink vulnerability during maildir delivery</topic>
|
|
<affects>
|
|
<package>
|
|
<name>getmail</name>
|
|
<range><lt>3.2.5</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>David Watson reports a symlink vulnerability in getmail.
|
|
If run as root (not the recommended mode of operation), a
|
|
local user may be able to cause getmail to write files in
|
|
arbitrary directories via a symlink attack on subdirectories
|
|
of the maildir.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<mlist msgid="200409191532.38997.baikie@ehwat.freeserve.co.uk">http://marc.theaimsgroup.com/?l=bugtraq&m=109571883130372</mlist>
|
|
<cvename>CVE-2004-0881</cvename>
|
|
<bid>11224</bid>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-09-19</discovery>
|
|
<entry>2004-10-04</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="67710833-1626-11d9-bc4a-000c41e2cdad">
|
|
<topic>Boundary checking errors in syscons</topic>
|
|
<affects>
|
|
<system>
|
|
<name>FreeBSD</name>
|
|
<range><ge>5.0</ge><lt>5.2.1_11</lt></range>
|
|
</system>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The syscons CONS_SCRSHOT <a href="http://www.freebsd.org/cgi/man.cgi?query=ioctl">ioctl(2)</a>
|
|
does insufficient validation of its input arguments. In
|
|
particular, negative coordinates or large coordinates may
|
|
cause unexpected behavior.</p>
|
|
<p>It may be possible to cause the CONS_SCRSHOT ioctl to
|
|
return portions of kernel memory. Such memory might
|
|
contain sensitive information, such as portions of the
|
|
file cache or terminal buffers. This information might be
|
|
directly useful, or it might be leveraged to obtain elevated
|
|
privileges in some way. For example, a terminal buffer
|
|
might include a user-entered password.</p>
|
|
<p>This bug may be exploitable by users who have access to the
|
|
physical console or can otherwise open a /dev/ttyv* device
|
|
node.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0919</cvename>
|
|
<freebsdsa>SA-04:15.syscons</freebsdsa>
|
|
<url>http://www.freebsd.org/cgi/cvsweb.cgi/src/sys/dev/syscons/syscons.c#rev1.429</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-09-30</discovery>
|
|
<entry>2004-10-04</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="2328adef-157c-11d9-8402-000d93664d5c">
|
|
<topic>racoon -- improper certificate handling</topic>
|
|
<affects>
|
|
<package>
|
|
<name>racoon</name>
|
|
<range><lt>20040818a</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Thomas Walpuski noted when OpenSSL would detect an error
|
|
condition for a peer certificate, racoon mistakenly ignored
|
|
the error. This could allow five invalid certificate states
|
|
to properly be used for authentication.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<mlist msgid="20040614185623.GA10290@unproved.org">http://marc.theaimsgroup.com/?l=bugtraq&m=108726102304507</mlist>
|
|
<url>http://www.kame.net/racoon/racoon-ml/msg00517.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-01-31</discovery>
|
|
<entry>2004-10-03</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="e8d4800f-1547-11d9-90a3-00010327614a">
|
|
<topic>distcc -- incorrect parsing of IP access control rules</topic>
|
|
<affects>
|
|
<package>
|
|
<name>distcc</name>
|
|
<range><lt>2.16</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<blockquote cite="http://distcc.samba.org/ftp/distcc/distcc-2.16.NEWS">
|
|
<p>Fix bug that might cause IP-based access control rules not to
|
|
be interpreted correctly on 64-bit platforms.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0601</cvename>
|
|
<url>http://distcc.samba.org/ftp/distcc/distcc-2.16.NEWS</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-06-23</discovery>
|
|
<entry>2004-10-03</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="b2e6d1d6-1339-11d9-bc4a-000c41e2cdad">
|
|
<topic>mozilla -- scripting vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>thunderbird</name>
|
|
<range><lt>0.8</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>de-linux-mozillafirebird</name>
|
|
<name>el-linux-mozillafirebird</name>
|
|
<name>firefox</name>
|
|
<name>ja-linux-mozillafirebird-gtk1</name>
|
|
<name>ja-mozillafirebird-gtk2</name>
|
|
<name>linux-mozillafirebird</name>
|
|
<name>ru-linux-mozillafirebird</name>
|
|
<name>zhCN-linux-mozillafirebird</name>
|
|
<name>zhTW-linux-mozillafirebird</name>
|
|
<range><lt>1.p</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>de-netscape7</name>
|
|
<name>fr-netscape7</name>
|
|
<name>ja-netscape7</name>
|
|
<name>netscape7</name>
|
|
<name>pt_BR-netscape7</name>
|
|
<range><le>7.2</le></range>
|
|
</package>
|
|
<package>
|
|
<name>mozilla-gtk1</name>
|
|
<name>linux-mozilla</name>
|
|
<name>linux-mozilla-devel</name>
|
|
<range><lt>1.7.3</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>mozilla</name>
|
|
<range><lt>1.7.3,2</lt></range>
|
|
</package>
|
|
<package>
|
|
<!-- These package names are obsolete. -->
|
|
<name>de-linux-netscape</name>
|
|
<name>fr-linux-netscape</name>
|
|
<name>ja-linux-netscape</name>
|
|
<name>linux-netscape</name>
|
|
<name>linux-phoenix</name>
|
|
<name>mozilla+ipv6</name>
|
|
<name>mozilla-embedded</name>
|
|
<name>mozilla-firebird</name>
|
|
<name>mozilla-gtk2</name>
|
|
<name>mozilla-gtk</name>
|
|
<name>mozilla-thunderbird</name>
|
|
<name>phoenix</name>
|
|
<range><ge>0</ge></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Several scripting vulnerabilities were discovered and
|
|
corrected in Mozilla:</p>
|
|
<dl>
|
|
<dt>CVE-2004-0905</dt>
|
|
<dd>
|
|
<blockquote cite="http://www.mozilla.org/projects/security/known-vulnerabilities.html">
|
|
<p>javascript; links dragged onto another frame or
|
|
page allows an attacker to steal or modify sensitive
|
|
information from other sites. The user could be convinced
|
|
to drag obscurred links in the context of a game or even a
|
|
fake scrollbar. If the user could be convinced to drag two
|
|
links in sequence into a separate window (not frame) the
|
|
attacker would be able to run arbitrary programs.</p>
|
|
</blockquote>
|
|
</dd>
|
|
<dt>CVE-2004-0908</dt>
|
|
<dd>
|
|
<blockquote cite="http://www.mozilla.org/projects/security/known-vulnerabilities.html">
|
|
<p>Untrusted javascript code can read and write to the
|
|
clipboard, stealing any sensitive data the user might
|
|
have copied. <strong>Workaround:</strong> disable
|
|
javascript</p>
|
|
</blockquote>
|
|
</dd>
|
|
<dt>CVE-2004-0909</dt>
|
|
<dd>
|
|
<blockquote cite="http://www.mozilla.org/projects/security/known-vulnerabilities.html">
|
|
<p>Signed scripts requesting enhanced abilities could
|
|
construct the request in a way that led to a confusing
|
|
grant dialog, possibly fooling the user into thinking
|
|
the privilege requested was inconsequential while
|
|
actually obtaining explicit permission to run and
|
|
install software. <strong>Workaround:</strong> Never
|
|
grant enhanced abilities of any kind to untrusted web
|
|
pages.</p>
|
|
</blockquote>
|
|
</dd>
|
|
</dl>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0905</cvename>
|
|
<cvename>CVE-2004-0908</cvename>
|
|
<cvename>CVE-2004-0909</cvename>
|
|
<url>http://bugzilla.mozilla.org/show_bug.cgi?id=250862</url>
|
|
<url>http://bugzilla.mozilla.org/show_bug.cgi?id=257523</url>
|
|
<url>http://bugzilla.mozilla.org/show_bug.cgi?id=253942</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-09-13</discovery>
|
|
<entry>2004-09-30</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="a7e0d783-131b-11d9-bc4a-000c41e2cdad">
|
|
<topic>mozilla -- users may be lured into bypassing security dialogs</topic>
|
|
<affects>
|
|
<package>
|
|
<name>thunderbird</name>
|
|
<range><lt>0.7</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>de-linux-mozillafirebird</name>
|
|
<name>el-linux-mozillafirebird</name>
|
|
<name>firefox</name>
|
|
<name>ja-linux-mozillafirebird-gtk1</name>
|
|
<name>ja-mozillafirebird-gtk2</name>
|
|
<name>linux-mozillafirebird</name>
|
|
<name>ru-linux-mozillafirebird</name>
|
|
<name>zhCN-linux-mozillafirebird</name>
|
|
<name>zhTW-linux-mozillafirebird</name>
|
|
<range><lt>0.9.2</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>de-netscape7</name>
|
|
<name>fr-netscape7</name>
|
|
<name>ja-netscape7</name>
|
|
<name>netscape7</name>
|
|
<name>pt_BR-netscape7</name>
|
|
<range><le>7.2</le></range>
|
|
</package>
|
|
<package>
|
|
<name>mozilla-gtk1</name>
|
|
<name>linux-mozilla</name>
|
|
<name>linux-mozilla-devel</name>
|
|
<range><lt>1.7</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>mozilla</name>
|
|
<range><lt>1.7,2</lt></range>
|
|
</package>
|
|
<package>
|
|
<!-- These package names are obsolete. -->
|
|
<name>de-linux-netscape</name>
|
|
<name>fr-linux-netscape</name>
|
|
<name>ja-linux-netscape</name>
|
|
<name>linux-netscape</name>
|
|
<name>linux-phoenix</name>
|
|
<name>mozilla+ipv6</name>
|
|
<name>mozilla-embedded</name>
|
|
<name>mozilla-firebird</name>
|
|
<name>mozilla-gtk2</name>
|
|
<name>mozilla-gtk</name>
|
|
<name>mozilla-thunderbird</name>
|
|
<name>phoenix</name>
|
|
<range><ge>0</ge></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>According to the Mozilla project:</p>
|
|
<blockquote cite="http://www.mozilla.org/projects/security/known-vulnerabilities.html">
|
|
<p>An attacker who could lure users into clicking in
|
|
particular places, or typing specific text, could cause a
|
|
security permission or software installation dialog to pop
|
|
up under the user's mouse click, clicking on the grant (or
|
|
install) button.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0762</cvename>
|
|
<url>http://bugzilla.mozilla.org/show_bug.cgi?id=162020</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-06-05</discovery>
|
|
<entry>2004-09-30</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="5360a659-131c-11d9-bc4a-000c41e2cdad">
|
|
<topic>mozilla -- hostname spoofing bug</topic>
|
|
<affects>
|
|
<package>
|
|
<name>thunderbird</name>
|
|
<range><lt>0.7</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>de-linux-mozillafirebird</name>
|
|
<name>el-linux-mozillafirebird</name>
|
|
<name>firefox</name>
|
|
<name>ja-linux-mozillafirebird-gtk1</name>
|
|
<name>ja-mozillafirebird-gtk2</name>
|
|
<name>linux-mozillafirebird</name>
|
|
<name>ru-linux-mozillafirebird</name>
|
|
<name>zhCN-linux-mozillafirebird</name>
|
|
<name>zhTW-linux-mozillafirebird</name>
|
|
<range><lt>0.9.2</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>de-netscape7</name>
|
|
<name>fr-netscape7</name>
|
|
<name>ja-netscape7</name>
|
|
<name>netscape7</name>
|
|
<name>pt_BR-netscape7</name>
|
|
<range><le>7.2</le></range>
|
|
</package>
|
|
<package>
|
|
<name>mozilla-gtk1</name>
|
|
<name>linux-mozilla</name>
|
|
<name>linux-mozilla-devel</name>
|
|
<range><lt>1.7</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>mozilla</name>
|
|
<range><lt>1.7,2</lt></range>
|
|
</package>
|
|
<package>
|
|
<!-- These package names are obsolete. -->
|
|
<name>de-linux-netscape</name>
|
|
<name>fr-linux-netscape</name>
|
|
<name>ja-linux-netscape</name>
|
|
<name>linux-netscape</name>
|
|
<name>linux-phoenix</name>
|
|
<name>mozilla+ipv6</name>
|
|
<name>mozilla-embedded</name>
|
|
<name>mozilla-firebird</name>
|
|
<name>mozilla-gtk2</name>
|
|
<name>mozilla-gtk</name>
|
|
<name>mozilla-thunderbird</name>
|
|
<name>phoenix</name>
|
|
<range><ge>0</ge></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>When processing URIs that contain an unqualified host name--
|
|
specifically, a domain name of only one component--
|
|
Mozilla will perform matching against the first component
|
|
of the domain name in SSL certificates. In other words, in
|
|
some situations, a certificate issued to "www.example.com"
|
|
will be accepted as matching "www".</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0765</cvename>
|
|
<url>http://bugzilla.mozilla.org/show_bug.cgi?id=234058</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-02-12</discovery>
|
|
<entry>2004-09-30</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="de16b056-132e-11d9-bc4a-000c41e2cdad">
|
|
<topic>samba -- remote file disclosure</topic>
|
|
<affects>
|
|
<package>
|
|
<name>samba</name>
|
|
<range><lt>2.2.12</lt></range>
|
|
<range><gt>3.*</gt><le>3.0.2a</le></range>
|
|
<range><gt>3.*,1</gt><le>3.0.2a_1,1</le></range>
|
|
</package>
|
|
<package>
|
|
<name>ja-samba</name>
|
|
<range><lt>2.2.11.j1.0_1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>According to a Samba Team security notice:</p>
|
|
<blockquote cite="http://www.samba.org/samba/news/#security_2.2.12">
|
|
<p>A security vulnerability has been located in Samba
|
|
2.2.x <= 2.2.11 and Samba 3.0.x <= 3.0.5. A remote
|
|
attacker may be able to gain access to files which exist
|
|
outside of the share's defined path. Such files must still
|
|
be readable by the account used for the connection.</p>
|
|
</blockquote>
|
|
<blockquote cite="http://www.samba.org/samba/news/#errata_05oct">
|
|
<p>The original notice for CAN-2004-0815 indicated that
|
|
Samba 3.0.x <= 3.0.5 was vulnerable to the security
|
|
issue. After further research, Samba developers have
|
|
confirmed that only Samba 3.0.2a and earlier releases
|
|
contain the exploitable code.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0815</cvename>
|
|
<url>http://www.samba.org/samba/news/#security_2.2.12</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-09-30</discovery>
|
|
<entry>2004-09-30</entry>
|
|
<modified>2008-09-26</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="ab9c559e-115a-11d9-bc4a-000c41e2cdad">
|
|
<topic>mozilla -- BMP decoder vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>thunderbird</name>
|
|
<range><lt>0.7.3_1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>de-linux-mozillafirebird</name>
|
|
<name>el-linux-mozillafirebird</name>
|
|
<name>firefox</name>
|
|
<name>ja-linux-mozillafirebird-gtk1</name>
|
|
<name>ja-mozillafirebird-gtk2</name>
|
|
<name>linux-mozillafirebird</name>
|
|
<name>linux-phoenix</name>
|
|
<name>phoenix</name>
|
|
<name>ru-linux-mozillafirebird</name>
|
|
<name>zhCN-linux-mozillafirebird</name>
|
|
<name>zhTW-linux-mozillafirebird</name>
|
|
<range><lt>0.9.3_1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>de-netscape7</name>
|
|
<name>fr-netscape7</name>
|
|
<name>ja-netscape7</name>
|
|
<name>netscape7</name>
|
|
<name>pt_BR-netscape7</name>
|
|
<range><le>7.2</le></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-mozilla</name>
|
|
<name>linux-mozilla-devel</name>
|
|
<range><lt>1.7.3</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>mozilla-gtk1</name>
|
|
<range><lt>1.7.2_3</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>mozilla</name>
|
|
<range><lt>1.7.2_2,2</lt></range>
|
|
<range><ge>1.8.a,2</ge><lt>1.8.a3_1,2</lt></range>
|
|
</package>
|
|
<package>
|
|
<!-- These package names are obsolete. -->
|
|
<name>mozilla+ipv6</name>
|
|
<name>mozilla-embedded</name>
|
|
<name>mozilla-firebird</name>
|
|
<name>mozilla-gtk</name>
|
|
<name>mozilla-gtk2</name>
|
|
<name>mozilla-thunderbird</name>
|
|
<name>linux-netscape</name>
|
|
<name>de-linux-netscape</name>
|
|
<name>fr-linux-netscape</name>
|
|
<name>ja-linux-netscape</name>
|
|
<range><ge>0</ge></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Gael Delalleau discovered several integer overflows in
|
|
Mozilla's BMP decoder that can result in denial-of-service or
|
|
arbitrary code execution.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0904</cvename>
|
|
<url>http://bugzilla.mozilla.org/show_bug.cgi?id=255067</url>
|
|
<uscertta>TA04-261A</uscertta>
|
|
<certvu>847200</certvu>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-09-13</discovery>
|
|
<entry>2004-09-28</entry>
|
|
<modified>2004-09-30</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="da690355-1159-11d9-bc4a-000c41e2cdad">
|
|
<topic>mozilla -- vCard stack buffer overflow</topic>
|
|
<affects>
|
|
<package>
|
|
<name>thunderbird</name>
|
|
<range><lt>0.7.3_1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>mozilla</name>
|
|
<range><lt>1.7.2_2,2</lt></range>
|
|
<range><ge>1.8.a,2</ge><lt>1.8.a3_1,2</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>mozilla-gtk1</name>
|
|
<range><lt>1.7.2_3</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-mozilla</name>
|
|
<range><lt>1.7.3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Georgi Guninski discovered a stack buffer overflow which
|
|
may be triggered when viewing email messages with vCard
|
|
attachments.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0903</cvename>
|
|
<url>http://bugzilla.mozilla.org/show_bug.cgi?id=257314</url>
|
|
<uscertta>TA04-261A</uscertta>
|
|
<certvu>414240</certvu>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-09-13</discovery>
|
|
<entry>2004-09-28</entry>
|
|
<modified>2004-09-30</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="93d6162f-1153-11d9-bc4a-000c41e2cdad">
|
|
<topic>mozilla -- multiple heap buffer overflows</topic>
|
|
<affects>
|
|
<package>
|
|
<name>thunderbird</name>
|
|
<range><lt>0.7.3_1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>firefox</name>
|
|
<range><lt>0.9.3_1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>mozilla</name>
|
|
<range><lt>1.7.2_2,2</lt></range>
|
|
<range><ge>1.8.a,2</ge><lt>1.8.a3_1,2</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>mozilla-gtk1</name>
|
|
<range><lt>1.7.2_3</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-mozilla</name>
|
|
<range><lt>1.7.3</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-mozillafirebird</name>
|
|
<range><ge>0</ge></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Several heap buffer overflows were discovered and fixed in the
|
|
most recent versions of Mozilla, Firefox, and Thunderbird.
|
|
These overflows may occur when:</p>
|
|
<ul>
|
|
<li>Using the "Send Page" function.</li>
|
|
<li>Checking mail on a malicious POP3 server.</li>
|
|
<li>Processing non-ASCII URLs.</li>
|
|
</ul>
|
|
<p>Each of these vulnerabilities may be exploited for remote
|
|
code execution.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0902</cvename>
|
|
<url>http://bugzilla.mozilla.org/show_bug.cgi?id=258005</url>
|
|
<url>http://bugzilla.mozilla.org/show_bug.cgi?id=245066</url>
|
|
<url>http://bugzilla.mozilla.org/show_bug.cgi?id=226669</url>
|
|
<url>http://bugzilla.mozilla.org/show_bug.cgi?id=256316</url>
|
|
<uscertta>TA04-261A</uscertta>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-09-13</discovery>
|
|
<entry>2004-09-28</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="edf61c61-0f07-11d9-8393-000103ccf9d6">
|
|
<topic>php -- strip_tags cross-site scripting vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>mod_php4-twig</name>
|
|
<name>php4</name>
|
|
<name>php4-cgi</name>
|
|
<name>php4-cli</name>
|
|
<name>php4-dtc</name>
|
|
<name>php4-horde</name>
|
|
<name>php4-nms</name>
|
|
<range><le>4.3.7_3</le></range>
|
|
</package>
|
|
<package>
|
|
<name>mod_php4</name>
|
|
<range><le>4.3.7_3,1</le></range>
|
|
</package>
|
|
<package>
|
|
<name>php5</name>
|
|
<name>php5-cgi</name>
|
|
<name>php5-cli</name>
|
|
<range><le>5.0.0.r3_2</le></range>
|
|
</package>
|
|
<package>
|
|
<name>mod_php5</name>
|
|
<range><le>5.0.0.r3_2,1</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Stefan Esser of e-matters discovered that PHP's strip_tags()
|
|
function would ignore certain characters during parsing of tags,
|
|
allowing these tags to pass through. Select browsers could then
|
|
parse these tags, possibly allowing cross-site scripting attacks.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0595</cvename>
|
|
<mlist msgid="20040713225525.GB26865@e-matters.de">http://marc.theaimsgroup.com/?l=bugtraq&m=108981589117423</mlist>
|
|
<url>http://security.e-matters.de/advisories/122004.html</url>
|
|
<bid>10724</bid>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-07-07</discovery>
|
|
<entry>2004-09-27</entry>
|
|
<modified>2013-06-19</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="dd7aa4f1-102f-11d9-8a8a-000c41e2cdad">
|
|
<topic>php -- memory_limit related vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>mod_php4-twig</name>
|
|
<name>php4</name>
|
|
<name>php4-cgi</name>
|
|
<name>php4-cli</name>
|
|
<name>php4-dtc</name>
|
|
<name>php4-horde</name>
|
|
<name>php4-nms</name>
|
|
<range><le>4.3.7_3</le></range>
|
|
</package>
|
|
<package>
|
|
<name>mod_php4</name>
|
|
<range><le>4.3.7_3,1</le></range>
|
|
</package>
|
|
<package>
|
|
<name>php5</name>
|
|
<name>php5-cgi</name>
|
|
<name>php5-cli</name>
|
|
<range><le>5.0.0.r3_2</le></range>
|
|
</package>
|
|
<package>
|
|
<name>mod_php5</name>
|
|
<range><le>5.0.0.r3_2,1</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Stefan Esser of e-matters discovered a condition within PHP
|
|
that may lead to remote execution of arbitrary code. The
|
|
memory_limit facility is used to notify functions when memory
|
|
contraints have been met. Under certain conditions, the entry
|
|
into this facility is able to interrupt functions such as
|
|
zend_hash_init() at locations not suitable for interruption.
|
|
The result would leave these functions in a vulnerable state.</p>
|
|
<blockquote cite="http://security.e-matters.de/advisories/112004.html">
|
|
<p>An attacker that is able to trigger the memory_limit abort
|
|
within zend_hash_init() and is additionally able to control
|
|
the heap before the HashTable itself is allocated, is able to
|
|
supply his own HashTable destructor pointer. [...]</p>
|
|
<p>All mentioned places outside of the extensions are quite easy
|
|
to exploit, because the memory allocation up to those places
|
|
is deterministic and quite static throughout different PHP
|
|
versions. [...]</p>
|
|
<p>Because the exploit itself consist of supplying an arbitrary
|
|
destructor pointer this bug is exploitable on any platform.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0594</cvename>
|
|
<mlist msgid="20040713225329.GA26865@e-matters.de">http://marc.theaimsgroup.com/?l=bugtraq&m=108981780109154</mlist>
|
|
<url>http://security.e-matters.de/advisories/112004.html</url>
|
|
<bid>10725</bid>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-07-07</discovery>
|
|
<entry>2004-09-27</entry>
|
|
<modified>2004-10-02</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="184f5d0b-0fe8-11d9-8a8a-000c41e2cdad">
|
|
<topic>subversion -- WebDAV fails to protect metadata</topic>
|
|
<affects>
|
|
<package>
|
|
<name>subversion</name>
|
|
<name>subversion-perl</name>
|
|
<name>subversion-python</name>
|
|
<range><lt>1.0.8</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>In some situations, subversion metadata may be unexpectedly
|
|
disclosed via WebDAV. A subversion advisory states:</p>
|
|
<blockquote cite="http://subversion.tigris.org/security/CAN-2004-0749-advisory.txt">
|
|
<p>mod_authz_svn, the Apache httpd module which does path-based
|
|
authorization on Subversion repositories, is not correctly
|
|
protecting all metadata on unreadable paths.</p>
|
|
<p>This security issue is not about revealing the contents
|
|
of protected files: it only reveals metadata about
|
|
protected areas such as paths and log messages. This may
|
|
or may not be important to your organization, depending
|
|
on how you're using path-based authorization, and the
|
|
sensitivity of the metadata.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0749</cvename>
|
|
<url>http://subversion.tigris.org/security/CAN-2004-0749-advisory.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-09-15</discovery>
|
|
<entry>2004-09-26</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="273cc1a3-0d6b-11d9-8a8a-000c41e2cdad">
|
|
<topic>lha -- numerous vulnerabilities when extracting archives</topic>
|
|
<affects>
|
|
<package>
|
|
<name>lha</name>
|
|
<range><lt>1.14i_6</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Source code reviews of lha by Lukasz Wojtow, Thomas Biege,
|
|
and others uncovered a number of vulnerabilities affecting
|
|
lha:</p>
|
|
<ul>
|
|
<li>Buffer overflows when handling archives and filenames.
|
|
(CVE-2004-0694)</li>
|
|
<li>Possible command execution via shell meta-characters when
|
|
built with NOMKDIR. (CVE-2004-0745)</li>
|
|
<li>Buffer overflow resulting in arbitrary code execution when
|
|
handling long pathnames in LHZ archives. (CVE-2004-0769)</li>
|
|
<li>Buffer overflow in the extract_one. (CVE-2004-0771)</li>
|
|
</ul>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0694</cvename>
|
|
<cvename>CVE-2004-0745</cvename>
|
|
<cvename>CVE-2004-0769</cvename>
|
|
<cvename>CVE-2004-0771</cvename>
|
|
<mlist msgid="20040515110900.24784.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&m=108464470103227</mlist>
|
|
<mlist msgid="20040606162856.29866.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&m=108668791510153</mlist>
|
|
<url>http://bugs.gentoo.org/show_bug.cgi?id=51285</url>
|
|
<url>http://xforce.iss.net/xforce/xfdb/16196</url>
|
|
<bid>10354</bid>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-05-17</discovery>
|
|
<entry>2004-09-23</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="77420ebb-0cf4-11d9-8a8a-000c41e2cdad">
|
|
<topic>mysql -- heap buffer overflow with prepared statements</topic>
|
|
<affects>
|
|
<package>
|
|
<name>mysql-server</name>
|
|
<name>mysql-client</name>
|
|
<range><ge>4.1.0</ge><le>4.1.4</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>There is a buffer overflow in the prepared statements API
|
|
(libmysqlclient) when a statement containing thousands of
|
|
placeholders is executed.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://bugs.mysql.com/bug.php?id=5194</url>
|
|
<url>http://dev.mysql.com/doc/mysql/en/News-4.1.5.html</url>
|
|
<url>http://mysql.bkbits.net:8080/mysql-4.1/cset@1.1932.152.4</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-09-08</discovery>
|
|
<entry>2004-09-23</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="e9f9d232-0cb2-11d9-8a8a-000c41e2cdad">
|
|
<topic>mozilla -- security icon spoofing</topic>
|
|
<affects>
|
|
<package>
|
|
<name>firefox</name>
|
|
<range><lt>0.9</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-mozilla</name>
|
|
<name>linux-mozilla-devel</name>
|
|
<range><lt>1.7</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>mozilla</name>
|
|
<range><lt>1.7,2</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>mozilla-gtk1</name>
|
|
<range><lt>1.7</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Under certain situations it is possible for the security icon
|
|
which Mozilla displays when connected to a site using SSL to
|
|
be spoofed. This could be used to make so-called "phishing
|
|
attacks" more difficult to detect.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0761</cvename>
|
|
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=240053</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-04-08</discovery>
|
|
<entry>2004-09-22</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="7c188c55-0cb0-11d9-8a8a-000c41e2cdad">
|
|
<topic>mozilla -- NULL bytes in FTP URLs</topic>
|
|
<affects>
|
|
<package>
|
|
<name>firefox</name>
|
|
<range><lt>0.9.3</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-mozilla</name>
|
|
<name>linux-mozilla-devel</name>
|
|
<range><lt>1.7.2</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>mozilla</name>
|
|
<range><lt>1.7.2,2</lt></range>
|
|
<range><ge>1.8.a,2</ge></range>
|
|
</package>
|
|
<package>
|
|
<name>mozilla-gtk1</name>
|
|
<range><lt>1.7.2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>When handling FTP URLs containing NULL bytes, Mozilla will
|
|
interpret the file content as HTML. This may allow unexpected
|
|
execution of Javascript when viewing plain text or other file
|
|
types via FTP.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0760</cvename>
|
|
<url>http://bugzilla.mozilla.org/show_bug.cgi?id=250906</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-07-11</discovery>
|
|
<entry>2004-09-22</entry>
|
|
<modified>2004-09-24</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="6e740881-0cae-11d9-8a8a-000c41e2cdad">
|
|
<topic>mozilla -- automated file upload</topic>
|
|
<affects>
|
|
<package>
|
|
<name>mozilla</name>
|
|
<range><ge>1.7.a,2</ge><lt>1.7,2</lt></range>
|
|
<range><ge>1.8.a,2</ge><lt>1.8.a2,2</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>mozilla-gtk1</name>
|
|
<range><ge>1.7.a</ge><lt>1.7</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A malicious web page can cause an automated file upload
|
|
from the victim's machine when viewed with Mozilla with
|
|
Javascript enabled. This is due to a bug permitting
|
|
default values for type="file" <input> elements in
|
|
certain situations.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0759</cvename>
|
|
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=241924</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-04-28</discovery>
|
|
<entry>2004-09-22</entry>
|
|
<modified>2004-09-26</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="8d823883-0ca9-11d9-8a8a-000c41e2cdad">
|
|
<topic>mozilla -- built-in CA certificates may be overridden</topic>
|
|
<affects>
|
|
<package>
|
|
<name>firefox</name>
|
|
<range><lt>0.9.3</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-mozilla</name>
|
|
<name>linux-mozilla-devel</name>
|
|
<range><lt>1.7.2</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>mozilla</name>
|
|
<range><lt>1.7.2,2</lt></range>
|
|
<range><ge>1.8.a,2</ge></range>
|
|
</package>
|
|
<package>
|
|
<name>mozilla-gtk1</name>
|
|
<range><lt>1.7.2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Under some situations, Mozilla will automatically import
|
|
a certificate from an email message or web site. This
|
|
behavior can be used as a denial-of-service attack: if the
|
|
certificate has a distinguished name (DN) identical to one
|
|
of the built-in Certificate Authorities (CAs), then Mozilla
|
|
will no longer be able to certify sites with certificates
|
|
issued from that CA.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0758</cvename>
|
|
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=249004</url>
|
|
<certvu>160360</certvu>
|
|
<url>http://banquo.inf.ethz.ch:8080/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-06-29</discovery>
|
|
<entry>2004-09-22</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="a4815970-c5cc-11d8-8898-000d6111a684">
|
|
<topic>rssh -- file name disclosure bug</topic>
|
|
<affects>
|
|
<package>
|
|
<name>rssh</name>
|
|
<range><lt>2.2.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>rssh expands command line paramters before invoking chroot.
|
|
This could result in the disclosure to the client of file
|
|
names outside of the chroot directory. A posting by the rssh
|
|
author explains:</p>
|
|
<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&m=108787373022844">
|
|
<p>The cause of the problem identified by Mr. McCaw is that
|
|
rssh expanded command-line arguments prior to entering
|
|
the chroot jail. This bug DOES NOT allow a user to
|
|
access any of the files outside the jail, but can allow
|
|
them to discover what files are in a directory which is
|
|
outside the jail, if their credentials on the server would
|
|
normally allow them read/execute access in the specified
|
|
directory.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0609</cvename>
|
|
<mlist msgid="20040619074141.GG13649@sophic.org">http://marc.theaimsgroup.com/?l=bugtraq&m=108787373022844</mlist>
|
|
<bid>10574</bid>
|
|
<url>http://www.osvdb.org/7239</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-06-19</discovery>
|
|
<entry>2004-09-21</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="e6f0edd8-0b40-11d9-8a8a-000c41e2cdad">
|
|
<topic>gnu-radius -- SNMP-related denial-of-service</topic>
|
|
<affects>
|
|
<package>
|
|
<name>gnu-radius</name>
|
|
<range><lt>1.2.94</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>An iDEFENSE security advisory reports:</p>
|
|
<blockquote cite="http://www.idefense.com/application/poi/display?id=141&type=vulnerabilities">
|
|
<p>Remote exploitation of an input validation error in
|
|
version 1.2 of GNU radiusd could allow a denial of
|
|
service.</p>
|
|
<p>The vulnerability specifically exists within
|
|
the asn_decode_string() function defined in
|
|
snmplib/asn1.c. When a very large unsigned number is
|
|
supplied, it is possible that an integer overflow will
|
|
occur in the bounds-checking code. The daemon will then
|
|
attempt to reference unallocated memory, resulting in an
|
|
access violation that causes the process to terminate.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0849</cvename>
|
|
<url>http://www.idefense.com/application/poi/display?id=141&type=vulnerabilities</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-09-15</discovery>
|
|
<entry>2004-09-20</entry>
|
|
<modified>2005-05-03</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="a268ef4a-0b35-11d9-8a8a-000c41e2cdad">
|
|
<topic>sudo -- sudoedit information disclosure</topic>
|
|
<affects>
|
|
<package>
|
|
<name>sudo</name>
|
|
<range><eq>1.6.8</eq></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A new feature of sudo 1.6.8 called "sudoedit" (a safe
|
|
editing facility) may allow users to read files to which
|
|
they normally have no access.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://www.sudo.ws/sudo/alerts/sudoedit.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-09-18</discovery>
|
|
<entry>2004-09-20</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="ca6c8f35-0a5f-11d9-ad6f-00061bc2ad93">
|
|
<topic>apache -- heap overflow in mod_proxy</topic>
|
|
<affects>
|
|
<package>
|
|
<name>apache</name>
|
|
<range><lt>1.3.31_1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>apache13-ssl</name>
|
|
<range><le>1.3.29.1.53_2</le></range>
|
|
</package>
|
|
<package>
|
|
<name>apache13-modssl</name>
|
|
<range><lt>1.3.31+2.8.18_4</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>apache13+ipv6</name>
|
|
<range><le>1.3.29_2</le></range>
|
|
</package>
|
|
<package>
|
|
<name>apache13-modperl</name>
|
|
<range><le>1.3.31</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A buffer overflow exists in mod_proxy which may
|
|
allow an attacker to launch local DoS attacks
|
|
and possibly execute arbitrary code.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0492</cvename>
|
|
<url>http://www.guninski.com/modproxy1.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-06-10</discovery>
|
|
<entry>2004-09-19</entry>
|
|
<modified>2004-10-05</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="d2102505-f03d-11d8-81b0-000347a4fa7d">
|
|
<topic>cvs -- numerous vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>cvs+ipv6</name>
|
|
<range><lt>1.11.17</lt></range>
|
|
</package>
|
|
<system>
|
|
<name>FreeBSD</name>
|
|
<range><ge>5.2</ge><lt>5.2.1_10</lt></range>
|
|
<range><ge>4.10</ge><lt>4.10_3</lt></range>
|
|
<range><ge>4.9</ge><lt>4.9_12</lt></range>
|
|
<range><ge>4.8</ge><lt>4.8_25</lt></range>
|
|
</system>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A number of vulnerabilities were discovered in CVS by
|
|
Stefan Esser, Sebastian Krahmer, and Derek Price.</p>
|
|
<ul>
|
|
<li>Insufficient input validation while processing "Entry"
|
|
lines. (CVE-2004-0414)</li>
|
|
<li>A double-free resulting from erroneous state handling while
|
|
processing "Argumentx" commands. (CVE-2004-0416)</li>
|
|
<li>Integer overflow while processing "Max-dotdot" commands.
|
|
(CVE-2004-0417)</li>
|
|
<li>Erroneous handling of empty entries handled while processing
|
|
"Notify" commands. (CVE-2004-0418)</li>
|
|
<li>A format string bug while processing CVS wrappers.</li>
|
|
<li>Single-byte buffer underflows while processing configuration files
|
|
from CVSROOT.</li>
|
|
<li>Various other integer overflows.</li>
|
|
</ul>
|
|
<p>Additionally, iDEFENSE reports an undocumented command-line
|
|
flag used in debugging does not perform input validation on
|
|
the given path names.</p>
|
|
<p>CVS servers ("cvs server" or :pserver: modes) are
|
|
affected by these vulnerabilities. They vary in impact
|
|
but include information disclosure (the iDEFENSE-reported
|
|
bug), denial-of-service (CVE-2004-0414, CVE-2004-0416,
|
|
CVE-2004-0417 and other bugs), or possibly arbitrary code
|
|
execution (CVE-2004-0418). In very special situations where
|
|
the attacker may somehow influence the contents of CVS
|
|
configuration files in CVSROOT, additional attacks may be
|
|
possible.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0414</cvename>
|
|
<cvename>CVE-2004-0416</cvename>
|
|
<cvename>CVE-2004-0417</cvename>
|
|
<cvename>CVE-2004-0418</cvename>
|
|
<cvename>CVE-2004-0778</cvename>
|
|
<url>http://secunia.com/advisories/11817</url>
|
|
<url>http://secunia.com/advisories/12309</url>
|
|
<url>http://security.e-matters.de/advisories/092004.html</url>
|
|
<url>http://www.idefense.com/application/poi/display?id=130&type=vulnerabilities&flashstatus=false</url>
|
|
<url>https://ccvs.cvshome.org/source/browse/ccvs/NEWS?rev=1.116.2.104</url>
|
|
<url>http://www.osvdb.org/6830</url>
|
|
<url>http://www.osvdb.org/6831</url>
|
|
<url>http://www.osvdb.org/6832</url>
|
|
<url>http://www.osvdb.org/6833</url>
|
|
<url>http://www.osvdb.org/6834</url>
|
|
<url>http://www.osvdb.org/6835</url>
|
|
<url>http://www.osvdb.org/6836</url>
|
|
<bid>10499</bid>
|
|
<freebsdsa>SA-04:14.cvs</freebsdsa>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-05-20</discovery>
|
|
<entry>2004-08-17</entry>
|
|
<modified>2004-09-19</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="3d1e9267-073f-11d9-b45d-000c41e2cdad">
|
|
<topic>gdk-pixbuf -- image decoding vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>linux-gdk-pixbuf</name>
|
|
<range><lt>0.22.0.11.3.5</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>gtk</name>
|
|
<range><ge>2.0</ge><lt>2.4.9_1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>gdk-pixbuf</name>
|
|
<range><lt>0.22.0_2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Chris Evans discovered several flaws in the gdk-pixbuf
|
|
XPM image decoder:</p>
|
|
<ul>
|
|
<li>Heap-based overflow in pixbuf_create_from_xpm</li>
|
|
<li>Stack-based overflow in xpm_extract_color</li>
|
|
<li>Integer overflows in io-ico.c</li>
|
|
</ul>
|
|
<p>Some of these flaws are believed to be exploitable.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0782</cvename>
|
|
<cvename>CVE-2004-0783</cvename>
|
|
<cvename>CVE-2004-0788</cvename>
|
|
<url>http://scary.beasts.org/security/CESA-2004-005.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-09-15</discovery>
|
|
<entry>2004-09-15</entry>
|
|
<modified>2004-11-09</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="ef253f8b-0727-11d9-b45d-000c41e2cdad">
|
|
<topic>xpm -- image decoding vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>agenda-snow-libs</name>
|
|
<name>linux_base</name>
|
|
<name>open-motif-devel</name>
|
|
<name>mupad</name>
|
|
<name>zh-cle_base</name>
|
|
<range><ge>0</ge></range>
|
|
</package>
|
|
<package>
|
|
<name>libXpm</name>
|
|
<range><lt>3.5.1_1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>XFree86-libraries</name>
|
|
<range><lt>4.4.0_1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>xorg-libraries</name>
|
|
<range><lt>6.7.0_2</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>lesstif</name>
|
|
<range><lt>0.93.96,2</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>xpm</name>
|
|
<range><lt>3.4k_1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-openmotif</name>
|
|
<range><lt>2.2.4</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>open-motif</name>
|
|
<range><lt>2.2.3_1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Chris Evans discovered several vulnerabilities in the libXpm
|
|
image decoder:</p>
|
|
<ul>
|
|
<li>A stack-based buffer overflow in xpmParseColors</li>
|
|
<li>An integer overflow in xpmParseColors</li>
|
|
<li>A stack-based buffer overflow in ParsePixels and
|
|
ParseAndPutPixels</li>
|
|
</ul>
|
|
<p>The X11R6.8.1 release announcement reads:</p>
|
|
<blockquote cite="http://freedesktop.org/pipermail/xorg/2004-September/003172.html">
|
|
<p>This version is purely a security release, addressing
|
|
multiple integer and stack overflows in libXpm, the X
|
|
Pixmap library; all known versions of X (both XFree86
|
|
and X.Org) are affected, so all users of X are strongly
|
|
encouraged to upgrade.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0687</cvename>
|
|
<cvename>CVE-2004-0688</cvename>
|
|
<url>http://freedesktop.org/pipermail/xorg/2004-September/003172.html</url>
|
|
<url>http://scary.beasts.org/security/CESA-2004-003.txt</url>
|
|
<certvu>537878</certvu>
|
|
<certvu>882750</certvu>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-09-15</discovery>
|
|
<entry>2004-09-15</entry>
|
|
<modified>2005-01-03</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="05dcf751-0733-11d9-b45d-000c41e2cdad">
|
|
<topic>cups -- print queue browser denial-of-service</topic>
|
|
<affects>
|
|
<package>
|
|
<name>cups-base</name>
|
|
<range><lt>1.1.21</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>If the CUPS server (cupsd) receives a zero-length UDP
|
|
message, it will disable its print queue browser service.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0558</cvename>
|
|
<url>http://www.cups.org/str.php?L863</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-08-23</discovery>
|
|
<entry>2004-09-15</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="762d1c6d-0722-11d9-b45d-000c41e2cdad">
|
|
<topic>apache -- apr_uri_parse IPv6 address handling vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>apache</name>
|
|
<range><ge>2.0</ge><lt>2.0.50_3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Apache Software Foundation Security Team discovered a
|
|
programming error in the apr-util library function apr_uri_parse.
|
|
When parsing IPv6 literal addresses, it is possible that a
|
|
length is incorrectly calculated to be negative, and this
|
|
value is passed to memcpy. This may result in an exploitable
|
|
vulnerability on some platforms, including FreeBSD.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0786</cvename>
|
|
<url>http://httpd.apache.org</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-09-15</discovery>
|
|
<entry>2004-09-15</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="013fa252-0724-11d9-b45d-000c41e2cdad">
|
|
<topic>mod_dav -- lock related denial-of-service</topic>
|
|
<affects>
|
|
<package>
|
|
<name>apache</name>
|
|
<range><ge>2.0</ge><lt>2.0.50_3</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>mod_dav</name>
|
|
<range><le>1.0.3_1</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A malicious user with DAV write privileges can trigger a null
|
|
pointer dereference in the Apache mod_dav module. This
|
|
could cause the server to become unavailable.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0809</cvename>
|
|
<url>http://nagoya.apache.org/bugzilla/show_bug.cgi?id=31183</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-09-15</discovery>
|
|
<entry>2004-09-15</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="4d49f4ba-071f-11d9-b45d-000c41e2cdad">
|
|
<topic>apache -- ap_resolve_env buffer overflow</topic>
|
|
<affects>
|
|
<package>
|
|
<name>apache</name>
|
|
<range><ge>2.0</ge><lt>2.0.50_3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>SITIC discovered a vulnerability in Apache 2's handling of
|
|
environmental variable settings in the httpd configuration
|
|
files (the main `httpd.conf' and `.htaccess' files).
|
|
According to a SITIC advisory:</p>
|
|
<blockquote cite="http://lists.netsys.com/pipermail/full-disclosure/2004-September/026463.html">
|
|
<p>The buffer overflow occurs when expanding ${ENVVAR}
|
|
constructs in .htaccess or httpd.conf files. The function
|
|
ap_resolve_env() in server/util.c copies data from
|
|
environment variables to the character array tmp with
|
|
strcat(3), leading to a buffer overflow.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0747</cvename>
|
|
<mlist>http://lists.netsys.com/pipermail/full-disclosure/2004-September/026463.html</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-09-15</discovery>
|
|
<entry>2004-09-15</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="ae7b7f65-05c7-11d9-b45d-000c41e2cdad">
|
|
<topic>webmin -- insecure temporary file creation at installation time</topic>
|
|
<affects>
|
|
<package>
|
|
<name>webmin</name>
|
|
<range><lt>1.150_5</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Webmin developers documented a security issue in the
|
|
release notes for version 1.160:</p>
|
|
<blockquote cite="http://www.webmin.com/changes-1.160.html">
|
|
<p>Fixed a security hole in the maketemp.pl script, used
|
|
to create the /tmp/.webmin directory at install time. If
|
|
an un-trusted user creates this directory before Webmin
|
|
is installed, he could create in it a symbolic link
|
|
pointing to a critical file on the system, which would be
|
|
overwritten when Webmin writes to the link filename.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0559</cvename>
|
|
<url>http://www.webmin.com/changes-1.160.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-09-05</discovery>
|
|
<entry>2004-09-14</entry>
|
|
<modified>2004-09-15</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="a711de5c-05fa-11d9-a9b2-00061bc2ad93">
|
|
<topic>samba3 DoS attack</topic>
|
|
<affects>
|
|
<package>
|
|
<name>samba3</name>
|
|
<range><lt>3.0.7</lt></range>
|
|
<range><gt>*,1</gt><lt>3.0.7,1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Code found in nmbd and smbd may allow a remote attacker
|
|
to effectively crash the nmbd server or use the smbd
|
|
server to exhaust the system memory.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0807</cvename>
|
|
<cvename>CVE-2004-0808</cvename>
|
|
<url>http://www.idefense.com/application/poi/display?id=139&type=vulnerabilities</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-09-02</discovery>
|
|
<entry>2004-09-14</entry>
|
|
<modified>2008-09-26</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="c1d97a8b-05ed-11d9-b45d-000c41e2cdad">
|
|
<topic>mozilla -- POP client heap overflow</topic>
|
|
<affects>
|
|
<package>
|
|
<name>mozilla</name>
|
|
<range><lt>1.7,2</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-mozilla</name>
|
|
<range><lt>1.7</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>netscape7</name>
|
|
<range><lt>7.2</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>thunderbird</name>
|
|
<range><lt>0.7</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>zen-parse discovered a heap buffer overflow in Mozilla's
|
|
POP client implementation. A malicious POP server
|
|
could exploit this vulnerability to cause Mozilla to execute
|
|
arbitrary code.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0757</cvename>
|
|
<url>http://bugzilla.mozilla.org/show_bug.cgi?id=229374</url>
|
|
<url>http://bugzilla.mozilla.org/show_bug.cgi?id=157644</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-07-22</discovery>
|
|
<entry>2004-09-14</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="a4fd8f53-05eb-11d9-b45d-000c41e2cdad">
|
|
<topic>mozilla -- SOAPParameter integer overflow</topic>
|
|
<affects>
|
|
<package>
|
|
<name>firefox</name>
|
|
<range><lt>0.9</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-mozilla</name>
|
|
<name>linux-mozilla-devel</name>
|
|
<name>mozilla-gtk1</name>
|
|
<range><lt>1.7</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>mozilla</name>
|
|
<range><lt>1.7,2</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>netscape7</name>
|
|
<range><lt>7.2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>zen-parse discovered and iDEFENSE reported an exploitable
|
|
integer overflow in a scriptable Mozilla component
|
|
`SOAPParameter':</p>
|
|
<blockquote cite="http://www.idefense.com/application/poi/display?id=117&type=vulnerabilities">
|
|
<p>Improper input validation to the SOAPParameter object
|
|
constructor in Netscape and Mozilla allows execution of
|
|
arbitrary code. The SOAPParameter object's constructor
|
|
contains an integer overflow which allows controllable
|
|
heap corruption. A web page can be constructed to
|
|
leverage this into remote execution of arbitrary code.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0722</cvename>
|
|
<url>http://bugzilla.mozilla.org/show_bug.cgi?id=236618</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-08-02</discovery>
|
|
<entry>2004-09-14</entry>
|
|
<modified>2004-09-22</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="c62dc69f-05c8-11d9-b45d-000c41e2cdad">
|
|
<topic>openoffice -- document disclosure</topic>
|
|
<affects>
|
|
<package>
|
|
<name>openoffice</name>
|
|
<name>ar-openoffice</name>
|
|
<name>ca-openoffice</name>
|
|
<name>cs-openoffice</name>
|
|
<name>de-openoffice</name>
|
|
<name>dk-openoffice</name>
|
|
<name>el-openoffice</name>
|
|
<name>es-openoffice</name>
|
|
<name>et-openoffice</name>
|
|
<name>fi-openoffice</name>
|
|
<name>fr-openoffice</name>
|
|
<name>gr-openoffice</name>
|
|
<name>hu-openoffice</name>
|
|
<name>it-openoffice</name>
|
|
<name>ja-openoffice</name>
|
|
<name>ko-openoffice</name>
|
|
<name>nl-openoffice</name>
|
|
<name>pl-openoffice</name>
|
|
<name>pt-openoffice</name>
|
|
<name>pt_BR-openoffice</name>
|
|
<name>ru-openoffice</name>
|
|
<name>se-openoffice</name>
|
|
<name>sk-openoffice</name>
|
|
<name>sl-openoffice-SI</name>
|
|
<name>tr-openoffice</name>
|
|
<name>zh-openoffice-CN</name>
|
|
<name>zh-openoffice-TW</name>
|
|
<range><lt>1.1.2_1</lt></range>
|
|
<range><ge>2.0</ge></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>OpenOffice creates a working directory in /tmp on startup,
|
|
and uses this directory to temporarily store document
|
|
content. However, the permissions of the created directory
|
|
may allow other user on the system to read these files,
|
|
potentially exposing information the user likely assumed was
|
|
inaccessible.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0752</cvename>
|
|
<url>http://www.openoffice.org/issues/show_bug.cgi?id=33357</url>
|
|
<url>http://securitytracker.com/alerts/2004/Sep/1011205.html</url>
|
|
<mlist msgid="20040910152759.7739.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&m=109483308421566</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-08-24</discovery>
|
|
<entry>2004-09-14</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="15e0e963-02ed-11d9-a209-00061bc2ad93">
|
|
<topic>mpg123 buffer overflow</topic>
|
|
<affects>
|
|
<package>
|
|
<name>mpg123</name>
|
|
<name>mpg123-nas</name>
|
|
<name>mpg123-esound</name>
|
|
<range><le>0.59r</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The mpg123 software version 0.59r contains a
|
|
buffer overflow vulnerability which may permit
|
|
the execution of arbitrary code as the owner of
|
|
the mpg123 process.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0805</cvename>
|
|
<url>http://www.alighieri.org/advisories/advisory-mpg123.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2003-08-16</discovery>
|
|
<entry>2004-09-14</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="b6cad7f3-fb59-11d8-9837-000c41e2cdad">
|
|
<topic>ImageMagick -- BMP decoder buffer overflow</topic>
|
|
<affects>
|
|
<package>
|
|
<name>ImageMagick</name>
|
|
<name>ImageMagick-nox11</name>
|
|
<range><lt>6.0.6.2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Marcus Meissner discovered that ImageMagick's BMP decoder would
|
|
crash when loading the test BMP file created by Chris Evans
|
|
for testing the previous Qt vulnerability.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0827</cvename>
|
|
<url>http://www.imagemagick.org/www/Changelog.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-08-25</discovery>
|
|
<entry>2004-08-31</entry>
|
|
<modified>2004-09-14</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="641859e8-eca1-11d8-b913-000c41e2cdad">
|
|
<topic>Mutiple browser frame injection vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>kdelibs</name>
|
|
<range><lt>3.2.3_3</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>kdebase</name>
|
|
<range><lt>3.2.3_1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-opera</name>
|
|
<name>opera</name>
|
|
<range><ge>7.50</ge><lt>7.52</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>firefox</name>
|
|
<range><lt>0.9</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-mozilla</name>
|
|
<name>linux-mozilla-devel</name>
|
|
<name>mozilla-gtk1</name>
|
|
<range><lt>1.7</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>mozilla</name>
|
|
<range><lt>1.7,2</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>netscape7</name>
|
|
<range><lt>7.2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A class of bugs affecting many web browsers in the same way
|
|
was discovered. A Secunia advisory reports:</p>
|
|
<blockquote cite="http://secunia.com/advisories/11978">
|
|
<p>The problem is that the browsers don't check if a target
|
|
frame belongs to a website containing a malicious link,
|
|
which therefore doesn't prevent one browser window from
|
|
loading content in a named frame in another window.</p>
|
|
<p>Successful exploitation allows a malicious website to load
|
|
arbitrary content in an arbitrary frame in another browser
|
|
window owned by e.g. a trusted site.</p>
|
|
</blockquote>
|
|
<p>A KDE Security Advisory reports:</p>
|
|
<blockquote cite="http://www.kde.org/info/security/advisory-20040811-3.txt">
|
|
<p>A malicious website could abuse Konqueror to insert
|
|
its own frames into the page of an otherwise trusted
|
|
website. As a result the user may unknowingly send
|
|
confidential information intended for the trusted website
|
|
to the malicious website.</p>
|
|
</blockquote>
|
|
<p>Secunia has provided a demonstration of the vulnerability at <a href="http://secunia.com/multiple_browsers_frame_injection_vulnerability_test/">http://secunia.com/multiple_browsers_frame_injection_vulnerability_test/</a>.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0717</cvename>
|
|
<cvename>CVE-2004-0718</cvename>
|
|
<cvename>CVE-2004-0721</cvename>
|
|
<url>http://secunia.com/advisories/11978/</url>
|
|
<url>http://bugzilla.mozilla.org/show_bug.cgi?id=246448</url>
|
|
<url>ftp://ftp.kde.org/pub/kde/security_patches/post-3.2.3-kdelibs-htmlframes.patch</url>
|
|
<url>ftp://ftp.kde.org/pub/kde/security_patches/post-3.2.3-kdebase-htmlframes.patch</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-08-11</discovery>
|
|
<entry>2004-08-12</entry>
|
|
<modified>2004-09-14</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="b7cb488c-8349-11d8-a41f-0020ed76ef5a">
|
|
<topic>isakmpd payload handling denial-of-service vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>isakmpd</name>
|
|
<range><le>20030903</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Numerous errors in isakmpd's input packet validation lead to
|
|
denial-of-service vulnerabilities. From the Rapid7 advisory:</p>
|
|
<blockquote cite="http://www.rapid7.com/advisories/R7-0018.html">
|
|
<p>The ISAKMP packet processing functions in OpenBSD's
|
|
isakmpd daemon contain multiple payload handling flaws
|
|
that allow a remote attacker to launch a denial of
|
|
service attack against the daemon.</p>
|
|
<p>Carefully crafted ISAKMP packets will cause the isakmpd
|
|
daemon to attempt out-of-bounds reads, exhaust available
|
|
memory, or loop endlessly (consuming 100% of the CPU).</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0218</cvename>
|
|
<cvename>CVE-2004-0219</cvename>
|
|
<cvename>CVE-2004-0220</cvename>
|
|
<cvename>CVE-2004-0221</cvename>
|
|
<cvename>CVE-2004-0222</cvename>
|
|
<url>http://www.rapid7.com/advisories/R7-0018.html</url>
|
|
<url>http://www.openbsd.org/errata34.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-03-17</discovery>
|
|
<entry>2004-03-31</entry>
|
|
<modified>2004-09-14</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="00644f03-fb58-11d8-9837-000c41e2cdad">
|
|
<topic>imlib -- BMP decoder heap buffer overflow</topic>
|
|
<affects>
|
|
<package>
|
|
<name>imlib</name>
|
|
<range><lt>1.9.14_4</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Marcus Meissner discovered that imlib's BMP decoder would
|
|
crash when loading the test BMP file created by Chris Evans
|
|
for testing the previous Qt vulnerability. It is believed
|
|
that this bug could be exploited for arbitrary code execution.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0817</cvename>
|
|
<url>http://bugzilla.gnome.org/show_bug.cgi?id=151034</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-08-25</discovery>
|
|
<entry>2004-08-31</entry>
|
|
<modified>2004-09-02</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="86a98b57-fb8e-11d8-9343-000a95bc6fae">
|
|
<topic>krb5 -- double-free vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>krb5</name>
|
|
<range><le>1.3.4_1</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>An advisory published by the MIT Kerberos team says:</p>
|
|
<blockquote cite="http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2004-002-dblfree.txt">
|
|
<p>The MIT Kerberos 5 implementation's Key Distribution Center
|
|
(KDC) program contains a double-free vulnerability that
|
|
potentially allows a remote attacker to execute arbitrary code.
|
|
Compromise of a KDC host compromises the security of the entire
|
|
authentication realm served by the KDC. Additionally, double-free
|
|
vulnerabilities exist in MIT Kerberos 5 library code, making
|
|
client programs and application servers vulnerable.</p>
|
|
</blockquote>
|
|
<p>Double-free vulnerabilities of this type are not believed to be
|
|
exploitable for code execution on FreeBSD systems. However,
|
|
the potential for other ill effects may exist.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0642</cvename>
|
|
<cvename>CVE-2004-0643</cvename>
|
|
<cvename>CVE-2004-0772</cvename>
|
|
<certvu>795632</certvu>
|
|
<certvu>866472</certvu>
|
|
<certvu>350792</certvu>
|
|
<url>http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2004-002-dblfree.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-08-31</discovery>
|
|
<entry>2004-08-31</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="bd60922b-fb8d-11d8-a13e-000a95bc6fae">
|
|
<topic>krb5 -- ASN.1 decoder denial-of-service vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>krb5</name>
|
|
<range><ge>1.2.2</ge><le>1.3.4</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>An advisory published by the MIT Kerberos team says:</p>
|
|
<blockquote cite="http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2004-003-asn1.txt">
|
|
<p>The ASN.1 decoder library in the MIT Kerberos 5 distribution
|
|
is vulnerable to a denial-of-service attack causing an infinite
|
|
loop in the decoder. The KDC is vulnerable to this attack.</p>
|
|
<p>An unauthenticated remote attacker can cause a KDC or application
|
|
server to hang inside an infinite loop.</p>
|
|
<p>An attacker impersonating a legitimate KDC or application
|
|
server may cause a client program to hang inside an infinite
|
|
loop.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0644</cvename>
|
|
<certvu>550464</certvu>
|
|
<url>http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2004-003-asn1.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-08-31</discovery>
|
|
<entry>2004-08-31</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="ba005226-fb5b-11d8-9837-000c41e2cdad">
|
|
<topic>imlib2 -- BMP decoder buffer overflow</topic>
|
|
<affects>
|
|
<package>
|
|
<name>imlib2</name>
|
|
<range><le>1.1.1</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Marcus Meissner discovered that imlib2's BMP decoder would
|
|
crash when loading the test BMP file created by Chris Evans
|
|
for testing the previous Qt vulnerability. There appears to
|
|
be both a stack-based and a heap-based buffer overflow that
|
|
are believed to be exploitable for arbitrary code execution.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0802</cvename>
|
|
<url>http://cvs.sourceforge.net/viewcvs.py/enlightenment/e17/libs/imlib2/ChangeLog?rev=1.20&view=markup</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-08-31</discovery>
|
|
<entry>2004-08-31</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="0d3a5148-f512-11d8-9837-000c41e2cdad">
|
|
<topic>SpamAssassin -- denial-of-service in tokenize_headers</topic>
|
|
<affects>
|
|
<package>
|
|
<name>p5-Mail-SpamAssassin</name>
|
|
<range><lt>2.64</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>According to the SpamAssassin 2.64 release announcement:</p>
|
|
<blockquote cite="http://marc.theaimsgroup.com/?l=spamassassin-announce&m=109168121628767">
|
|
<p>Security fix prevents a denial of service attack open
|
|
to certain malformed messages; this DoS affects all
|
|
SpamAssassin 2.5x and 2.6x versions to date.</p>
|
|
</blockquote>
|
|
<p>The issue appears to be triggered by overly long message
|
|
headers.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0796</cvename>
|
|
<bid>10957</bid>
|
|
<mlist>http://marc.theaimsgroup.com/?l=spamassassin-announce&m=109168121628767</mlist>
|
|
<url>http://search.cpan.org/src/JMASON/Mail-SpamAssassin-2.64/Changes</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-08-04</discovery>
|
|
<entry>2004-08-23</entry>
|
|
<modified>2004-08-28</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="c4b025bb-f05d-11d8-9837-000c41e2cdad">
|
|
<topic>tnftpd -- remotely exploitable vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>tnftpd</name>
|
|
<range><lt>20040810</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>lukemftpd</name>
|
|
<range><ge>0</ge></range>
|
|
</package>
|
|
<system>
|
|
<name>FreeBSD</name>
|
|
<range><ge>4.7</ge></range>
|
|
</system>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>lukemftpd(8) is an enhanced BSD FTP server produced
|
|
within the NetBSD project. The sources for lukemftpd are
|
|
shipped with some versions of FreeBSD, however it is not
|
|
built or installed by default. The build system option
|
|
WANT_LUKEMFTPD must be set to build and install lukemftpd.
|
|
[<strong>NOTE</strong>: An exception is FreeBSD 4.7-RELEASE,
|
|
wherein lukemftpd was installed, but not enabled, by
|
|
default.]</p>
|
|
<p>Przemyslaw Frasunek discovered several vulnerabilities
|
|
in lukemftpd arising from races in the out-of-band signal
|
|
handling code used to implement the ABOR command. As a
|
|
result of these races, the internal state of the FTP server
|
|
may be manipulated in unexpected ways.</p>
|
|
<p>A remote attacker may be able to cause FTP commands to
|
|
be executed with the privileges of the running lukemftpd
|
|
process. This may be a low-privilege `ftp' user if the `-r'
|
|
command line option is specified, or it may be superuser
|
|
privileges if `-r' is *not* specified.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0794</cvename>
|
|
<bid>10967</bid>
|
|
<url>http://cvsweb.netbsd.org/bsdweb.cgi/src/libexec/ftpd/ftpd.c#rev1.158</url>
|
|
<url>ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2004-009.txt.asc</url>
|
|
<mlist msgid="412239E7.1070807@freebsd.lublin.pl">http://lists.netsys.com/pipermail/full-disclosure/2004-August/025418.html</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-08-17</discovery>
|
|
<entry>2004-08-17</entry>
|
|
<modified>2004-08-28</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="e5e2883d-ceb9-11d8-8898-000d6111a684">
|
|
<topic>MySQL authentication bypass / buffer overflow</topic>
|
|
<affects>
|
|
<package>
|
|
<name>mysql-server</name>
|
|
<range><ge>4.1</ge><lt>4.1.3</lt></range>
|
|
<range><ge>5</ge><le>5.0.0_2</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>By submitting a carefully crafted authentication packet, it is
|
|
possible for an attacker to bypass password authentication in MySQL
|
|
4.1. Using a similar method, a stack buffer used in the authentication
|
|
mechanism can be overflowed.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0627</cvename>
|
|
<cvename>CVE-2004-0628</cvename>
|
|
<certvu>184030</certvu>
|
|
<certvu>645326</certvu>
|
|
<url>http://www.nextgenss.com/advisories/mysql-authbypass.txt</url>
|
|
<url>http://dev.mysql.com/doc/mysql/en/News-4.1.3.html</url>
|
|
<url>http://secunia.com/advisories/12020</url>
|
|
<url>http://www.osvdb.org/7475</url>
|
|
<url>http://www.osvdb.org/7476</url>
|
|
<mlist msgid="Pine.LNX.4.44.0407080940550.9602-200000@pineapple.shacknet.nu">http://archives.neohapsis.com/archives/vulnwatch/2004-q3/0003.html</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-07-01</discovery>
|
|
<entry>2004-07-05</entry>
|
|
<modified>2004-08-28</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="e811aaf1-f015-11d8-876f-00902714cc7c">
|
|
<topic>Ruby insecure file permissions in the CGI session management</topic>
|
|
<affects>
|
|
<package>
|
|
<name>ruby</name>
|
|
<range><lt>1.6.8.2004.07.26</lt></range>
|
|
<range><ge>1.7.0</ge><lt>1.8.1.2004.07.23</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>According to a Debian Security Advisory:</p>
|
|
<blockquote cite="http://www.debian.org/security/2004/dsa-537">
|
|
<p>Andres Salomon noticed a problem in the CGI session
|
|
management of Ruby, an object-oriented scripting language.
|
|
CGI::Session's FileStore (and presumably PStore [...])
|
|
implementations store session information insecurely.
|
|
They simply create files, ignoring permission issues.
|
|
This can lead an attacker who has also shell access to the
|
|
webserver to take over a session.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0755</cvename>
|
|
<url>http://xforce.iss.net/xforce/xfdb/16996</url>
|
|
<url>http://www.debian.org/security/2004/dsa-537</url>
|
|
<mlist>http://marc.theaimsgroup.com/?l=bugtraq&m=109267579822250&w=2</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-08-16</discovery>
|
|
<entry>2004-08-16</entry>
|
|
<modified>2004-08-28</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="207f8ff3-f697-11d8-81b0-000347a4fa7d">
|
|
<topic>nss -- exploitable buffer overflow in SSLv2 protocol handler</topic>
|
|
<affects>
|
|
<package>
|
|
<name>nss</name>
|
|
<range><lt>3.9.2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>ISS X-Force reports that a remotely exploitable buffer
|
|
overflow exists in the Netscape Security Services (NSS)
|
|
library's implementation of SSLv2. From their advisory:</p>
|
|
<blockquote cite="http://xforce.iss.net/xforce/alerts/id/180">
|
|
<p>The NSS library contains a flaw in SSLv2 record parsing
|
|
that may lead to remote compromise. When parsing the
|
|
first record in an SSLv2 negotiation, the client hello
|
|
message, the server fails to validate the length of a
|
|
record field. As a result, it is possible for an attacker
|
|
to trigger a heap-based overflow of arbitrary length.</p>
|
|
</blockquote>
|
|
<p>Note that the vulnerable NSS library is also present in
|
|
Mozilla-based browsers. However, it is not believed that
|
|
browsers are affected, as the vulnerability is present only in
|
|
code used by SSLv2 *servers*.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://xforce.iss.net/xforce/alerts/id/180</url>
|
|
<url>http://www.osvdb.org/9116</url>
|
|
<url>http://secunia.com/advisories/12362</url>
|
|
<bid>11015</bid>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-08-23</discovery>
|
|
<entry>2004-08-27</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="85e19dff-e606-11d8-9b0a-000347a4fa7d">
|
|
<topic>ripMIME -- decoding bug allowing content filter bypass</topic>
|
|
<affects>
|
|
<package>
|
|
<name>ripmime</name>
|
|
<range><lt>1.3.2.3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>ripMIME may prematurely terminate decoding Base64 encoded
|
|
messages when it encounters multiple blank lines or other
|
|
non-standard Base64 constructs. Virus scanning and content
|
|
filtering tools that use ripMIME may therefore be
|
|
bypassed.</p>
|
|
<p>The ripMIME CHANGELOG file says:</p>
|
|
<blockquote cite="http://www.pldaniels.com/ripmime/CHANGELOG">
|
|
<p>There's viruses going around exploiting the ability to
|
|
hide the majority of their data in an attachment by using
|
|
blank lines and other tricks to make scanning systems
|
|
prematurely terminate their base64 decoding.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>10848</bid>
|
|
<url>http://www.osvdb.org/8287</url>
|
|
<url>http://www.pldaniels.com/ripmime/CHANGELOG</url>
|
|
<url>http://secunia.com/advisories/12201</url>
|
|
<url>http://xforce.iss.net/xforce/xfdb/16867</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-07-30</discovery>
|
|
<entry>2004-08-27</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="1ecf4ca1-f7ad-11d8-96c9-00061bc2ad93">
|
|
<topic>moinmoin -- ACL group bypass</topic>
|
|
<affects>
|
|
<package>
|
|
<name>moinmoin</name>
|
|
<range><lt>1.2.3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The moinmoin package contains two bugs with ACLs and anonymous
|
|
users. Both bugs may permit anonymous users to gain access to
|
|
administrative functions; for example the delete function.</p>
|
|
<p>There is no known workaround, the vulnerability exists regardless
|
|
if a site is using ACLs or not.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://www.osvdb.org/8194</url>
|
|
<url>http://www.osvdb.org/8195</url>
|
|
<url>http://security.gentoo.org/glsa/glsa-200408-25.xml</url>
|
|
<url>http://secunia.com/advisories/11832</url>
|
|
<bid>10805</bid>
|
|
<bid>10801</bid>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-07-21</discovery>
|
|
<entry>2004-08-26</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="2689f4cb-ec4c-11d8-9440-000347a4fa7d">
|
|
<topic>rsync -- path sanitizing vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>rsync</name>
|
|
<range><lt>2.6.2_2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>An rsync security advisory reports:</p>
|
|
<blockquote cite="http://samba.org/rsync/#security_aug04">
|
|
<p>There is a path-sanitizing bug that affects daemon mode in
|
|
all recent rsync versions (including 2.6.2) but only if
|
|
chroot is disabled.</p>
|
|
</blockquote>
|
|
<p>The bug may allow a remote user to access files outside
|
|
of an rsync module's configured path with the privileges
|
|
configured for that module.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0792</cvename>
|
|
<url>http://samba.org/rsync/#security_aug04</url>
|
|
<mlist>http://lists.samba.org/archive/rsync-announce/2004/000017.html</mlist>
|
|
<url>http://secunia.com/advisories/12294</url>
|
|
<url>http://www.osvdb.org/8829</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-08-12</discovery>
|
|
<entry>2004-08-26</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="7884d56f-f7a1-11d8-9837-000c41e2cdad">
|
|
<topic>gnomevfs -- unsafe URI handling</topic>
|
|
<affects>
|
|
<package>
|
|
<name>gnomevfs2</name>
|
|
<range><lt>2.6.2_1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>gnomevfs</name>
|
|
<range><lt>1.0.5_6</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>mc</name>
|
|
<range><le>4.6.0_12</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Alexander Larsson reports that some versions of gnome-vfs and
|
|
MidnightCommander contain a number of `extfs' scripts that do not
|
|
properly validate user input. If an attacker can cause her
|
|
victim to process a specially-crafted URI, arbitrary commands
|
|
can be executed with the privileges of the victim.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0494</cvename>
|
|
<bid>10864</bid>
|
|
<url>http://www.ciac.org/ciac/bulletins/o-194.shtml</url>
|
|
<url>http://xforce.iss.net/xforce/xfdb/16897</url>
|
|
<url>https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=127263</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-08-04</discovery>
|
|
<entry>2004-08-26</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="3e4ffe76-e0d4-11d8-9b0a-000347a4fa7d">
|
|
<topic>SoX buffer overflows when handling .WAV files</topic>
|
|
<affects>
|
|
<package>
|
|
<name>sox</name>
|
|
<range><gt>12.17.1</gt><le>12.17.4_1</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Ulf Härnhammar discovered a pair of buffer overflows in the
|
|
WAV file handling code of SoX. If an attacker can cause her
|
|
victim to process a specially-crafted WAV file with SoX (e.g.
|
|
through social engineering or through some other program that
|
|
relies on SoX), arbitrary code can be executed with the
|
|
privileges of the victim.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0557</cvename>
|
|
<mlist msgid="1091040793.4107f6193d81a@webmail.uu.se">http://archives.neohapsis.com/archives/vulnwatch/2004-q3/0014.html</mlist>
|
|
<url>http://secunia.com/advisories/12175</url>
|
|
<url>http://www.osvdb.org/8267</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-07-28</discovery>
|
|
<entry>2004-08-26</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="2797b27a-f55b-11d8-81b0-000347a4fa7d">
|
|
<topic>kdelibs -- konqueror cross-domain cookie injection</topic>
|
|
<affects>
|
|
<package>
|
|
<name>kdelibs</name>
|
|
<range><lt>3.2.3_3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>According to a KDE Security Advisory:</p>
|
|
<blockquote cite="http://www.kde.org/info/security/advisory-20040823-1.txt">
|
|
<p>WESTPOINT internet reconnaissance services alerted the
|
|
KDE security team that the KDE web browser Konqueror
|
|
allows websites to set cookies for certain country
|
|
specific secondary top level domains.</p>
|
|
<p>Web sites operating under the affected domains can
|
|
set HTTP cookies in such a way that the Konqueror web
|
|
browser will send them to all other web sites operating
|
|
under the same domain. A malicious website can use
|
|
this as part of a session fixation attack. See e.g.
|
|
http://www.acros.si/papers/session_fixation.pdf</p>
|
|
<p>Affected are all country specific secondary top level
|
|
domains that use more than 2 characters in the secondary
|
|
part of the domain name and that use a secondary part other
|
|
than com, net, mil, org, gov, edu or int. Examples of
|
|
affected domains are .ltd.uk, .plc.uk and .firm.in</p>
|
|
<p>It should be noted that popular domains such as .co.uk, .co.in
|
|
and .com are NOT affected.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0746</cvename>
|
|
<url>http://www.kde.org/info/security/advisory-20040823-1.txt</url>
|
|
<url>http://www.osvdb.org/9117</url>
|
|
<url>http://secunia.com/advisories/12341</url>
|
|
<url>http://www.acros.si/papers/session_fixation.pdf</url>
|
|
<bid>10991</bid>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-08-23</discovery>
|
|
<entry>2004-08-26</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="bef4515b-eaa9-11d8-9440-000347a4fa7d">
|
|
<cancelled superseded="b6939d5b-64a1-11d9-9106-000a95bc6fae"/>
|
|
</vuln>
|
|
|
|
<vuln vid="3243e839-f489-11d8-9837-000c41e2cdad">
|
|
<topic>fidogate -- write files as `news' user</topic>
|
|
<affects>
|
|
<package>
|
|
<name>fidogate</name>
|
|
<range><lt>4.4.9_3</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>fidogate-ds</name>
|
|
<range><lt>5.1.1_1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Neils Heinen reports that the setuid `news' binaries
|
|
installed as part of fidogate may be used to create files or
|
|
append to file with the privileges of the `news' user by
|
|
setting the LOGFILE environmental variable.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://cvs.sourceforge.net/viewcvs.py/fidogate/fidogate/ChangeLog?rev=4.320&view=markup</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-08-21</discovery>
|
|
<entry>2004-08-22</entry>
|
|
<modified>2004-08-23</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="65a17a3f-ed6e-11d8-aff1-00061bc2ad93">
|
|
<topic>Arbitrary code execution via a format string vulnerability in jftpgw</topic>
|
|
<affects>
|
|
<package>
|
|
<name>jftpgw</name>
|
|
<range><lt>0.13.5</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The log functions in jftpgw may allow
|
|
remotely authenticated user to execute
|
|
arbitrary code via the format string
|
|
specifiers in certain syslog messages.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0448</cvename>
|
|
<url>http://www.debian.org/security/2004/dsa-510</url>
|
|
<bid>10438</bid>
|
|
<url>http://xforce.iss.net/xforce/xfdb/16271</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-05-30</discovery>
|
|
<entry>2004-08-13</entry>
|
|
<modified>2004-08-23</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="ebffe27a-f48c-11d8-9837-000c41e2cdad">
|
|
<topic>qt -- image loader vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>qt</name>
|
|
<range><lt>3.3.3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Qt contains several vulnerabilities related to image
|
|
loading, including possible crashes when loading corrupt
|
|
GIF, BMP, or JPEG images. Most seriously, Chris Evans
|
|
reports that the BMP crash is actually due to a heap
|
|
buffer overflow. It is believed that an attacker may be
|
|
able to construct a BMP image that could cause a Qt-using
|
|
application to execute arbitrary code when it is loaded.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0691</cvename>
|
|
<cvename>CVE-2004-0692</cvename>
|
|
<cvename>CVE-2004-0693</cvename>
|
|
<url>http://www.trolltech.com/developer/changes/changes-3.3.3.html</url>
|
|
<url>http://scary.beasts.org/security/CESA-2004-004.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-08-11</discovery>
|
|
<entry>2004-08-22</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="616cf823-f48b-11d8-9837-000c41e2cdad">
|
|
<topic>courier-imap -- format string vulnerability in debug mode</topic>
|
|
<affects>
|
|
<package>
|
|
<name>courier-imap</name>
|
|
<range><lt>3.0.7,1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>An iDEFENSE security advisory describes a format string
|
|
vulnerability that could be exploited when Courier-IMAP is run
|
|
in debug mode (DEBUG_LOGIN set).</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0777</cvename>
|
|
<mlist>http://lists.netsys.com/pipermail/full-disclosure/2004-August/025478.html</mlist>
|
|
<url>http://www.idefense.com/application/poi/display?id=131&type=vulnerabilities&flashstatus=false</url>
|
|
<bid>10976</bid>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-08-18</discovery>
|
|
<entry>2004-08-22</entry>
|
|
<modified>2013-06-19</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="0c4d5973-f2ab-11d8-9837-000c41e2cdad">
|
|
<topic>mysql -- mysqlhotcopy insecure temporary file creation</topic>
|
|
<affects>
|
|
<package>
|
|
<name>mysql-scripts</name>
|
|
<range><le>3.23.58</le></range>
|
|
<range><gt>4</gt><le>4.0.20</le></range>
|
|
<range><gt>4.1</gt><le>4.1.3</le></range>
|
|
<range><gt>5</gt><le>5.0.0_1</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>According to Christian Hammers:</p>
|
|
<blockquote cite="http://packages.debian.org/changelogs/pool/main/m/mysql-dfsg/mysql-dfsg_4.0.20-11/changelog">
|
|
<p>[mysqlhotcopy created] temporary files in /tmp which
|
|
had predictable filenames and such could be used for a
|
|
tempfile run attack.</p>
|
|
</blockquote>
|
|
<p>Jeroen van Wolffelaar is credited with discovering the issue.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0457</cvename>
|
|
<url>http://www.debian.org/security/2004/dsa-540</url>
|
|
<mlist>http://lists.mysql.com/internals/15185</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-08-18</discovery>
|
|
<entry>2004-08-22</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="2de14f7a-dad9-11d8-b59a-00061bc2ad93">
|
|
<topic>Multiple Potential Buffer Overruns in Samba</topic>
|
|
<affects>
|
|
<package>
|
|
<name>samba</name>
|
|
<range><gt>3.*</gt><lt>3.0.5</lt></range>
|
|
<range><gt>3.*,1</gt><lt>3.0.5,1</lt></range>
|
|
<range><lt>2.2.10</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>ja-samba</name>
|
|
<range><lt>2.2.10.j1.0</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Evgeny Demidov discovered that the Samba server has a
|
|
buffer overflow in the Samba Web Administration Tool (SWAT)
|
|
on decoding Base64 data during HTTP Basic Authentication.
|
|
Versions 3.0.2 through 3.0.4 are affected.</p>
|
|
<p>Another buffer overflow bug has been found in the code
|
|
used to support the "mangling method = hash" smb.conf
|
|
option. The default setting for this parameter is "mangling
|
|
method = hash2" and therefore not vulnerable. Versions
|
|
between 2.2.0 through 2.2.9 and 3.0.0 through 3.0.4 are affected.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0600</cvename>
|
|
<cvename>CVE-2004-0686</cvename>
|
|
<mlist msgid="web-53121174@cgp.agava.net">http://www.securityfocus.com/archive/1/369698</mlist>
|
|
<mlist msgid="200407222031.25086.bugtraq@beyondsecurity.com">http://www.securityfocus.com/archive/1/369706</mlist>
|
|
<url>http://www.samba.org/samba/whatsnew/samba-3.0.5.html</url>
|
|
<url>http://www.samba.org/samba/whatsnew/samba-2.2.10.html</url>
|
|
<url>http://www.osvdb.org/8190</url>
|
|
<url>http://www.osvdb.org/8191</url>
|
|
<url>http://secunia.com/advisories/12130</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-07-14</discovery>
|
|
<entry>2004-07-21</entry>
|
|
<modified>2008-09-26</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="730db824-e216-11d8-9b0a-000347a4fa7d">
|
|
<topic>Mozilla / Firefox user interface spoofing vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>firefox</name>
|
|
<range><le>0.9.1_1</le></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-mozilla</name>
|
|
<range><le>1.7.1</le></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-mozilla-devel</name>
|
|
<range><le>1.7.1</le></range>
|
|
</package>
|
|
<package>
|
|
<name>mozilla</name>
|
|
<range><le>1.7.1,2</le></range>
|
|
<range><ge>1.8.a,2</ge><le>1.8.a2,2</le></range>
|
|
</package>
|
|
<package>
|
|
<name>mozilla-gtk1</name>
|
|
<range><le>1.7.1_1</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Mozilla project's family of browsers contain a design
|
|
flaw that can allow a website to spoof almost perfectly any
|
|
part of the Mozilla user interface, including spoofing web
|
|
sites for phishing or internal elements such as the "Master
|
|
Password" dialog box. This achieved by manipulating "chrome"
|
|
through remote XUL content. Recent versions of Mozilla have
|
|
been fixed to not allow untrusted documents to utilize
|
|
"chrome" in this way.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0764</cvename>
|
|
<url>http://bugzilla.mozilla.org/show_bug.cgi?id=22183</url>
|
|
<url>http://bugzilla.mozilla.org/show_bug.cgi?id=244965</url>
|
|
<url>http://bugzilla.mozilla.org/show_bug.cgi?id=252198</url>
|
|
<url>http://www.nd.edu/~jsmith30/xul/test/spoof.html</url>
|
|
<url>http://secunia.com/advisories/12188</url>
|
|
<bid>10832</bid>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-07-19</discovery>
|
|
<entry>2004-07-30</entry>
|
|
<modified>2004-08-15</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="f9e3e60b-e650-11d8-9b0a-000347a4fa7d">
|
|
<topic>libpng stack-based buffer overflow and other code concerns</topic>
|
|
<affects>
|
|
<package>
|
|
<name>png</name>
|
|
<range><le>1.2.5_7</le></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-png</name>
|
|
<range><le>1.0.14_3</le></range>
|
|
<range><ge>1.2</ge><le>1.2.2</le></range>
|
|
</package>
|
|
<package>
|
|
<name>firefox</name>
|
|
<range><lt>0.9.3</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>thunderbird</name>
|
|
<range><lt>0.7.3</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-mozilla</name>
|
|
<range><lt>1.7.2</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-mozilla-devel</name>
|
|
<range><lt>1.7.2</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>mozilla</name>
|
|
<range><lt>1.7.2,2</lt></range>
|
|
<range><ge>1.8.a,2</ge><le>1.8.a2,2</le></range>
|
|
</package>
|
|
<package>
|
|
<name>mozilla-gtk1</name>
|
|
<range><lt>1.7.2</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>netscape-communicator</name>
|
|
<name>netscape-navigator</name>
|
|
<range><le>4.78</le></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-netscape-communicator</name>
|
|
<name>linux-netscape-navigator</name>
|
|
<name>ko-netscape-navigator-linux</name>
|
|
<name>ko-netscape-communicator-linux</name>
|
|
<name>ja-netscape-communicator-linux</name>
|
|
<name>ja-netscape-navigator-linux</name>
|
|
<range><le>4.8</le></range>
|
|
</package>
|
|
<package>
|
|
<name>netscape7</name>
|
|
<name>ja-netscape7</name>
|
|
<range><le>7.1</le></range>
|
|
</package>
|
|
<package>
|
|
<name>pt_BR-netscape7</name>
|
|
<name>fr-netscape7</name>
|
|
<name>de-netscape7</name>
|
|
<range><le>7.02</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Chris Evans has discovered multiple vulnerabilities in libpng,
|
|
which can be exploited by malicious people to compromise a
|
|
vulnerable system or cause a DoS (Denial of Service).</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<mlist msgid="Pine.LNX.4.58.0408041840080.20655@sphinx.mythic-beasts.com">http://www.securityfocus.com/archive/1/370853</mlist>
|
|
<url>http://scary.beasts.org/security/CESA-2004-001.txt</url>
|
|
<url>http://www.osvdb.org/8312</url>
|
|
<url>http://www.osvdb.org/8313</url>
|
|
<url>http://www.osvdb.org/8314</url>
|
|
<url>http://www.osvdb.org/8315</url>
|
|
<url>http://www.osvdb.org/8316</url>
|
|
<cvename>CVE-2004-0597</cvename>
|
|
<cvename>CVE-2004-0598</cvename>
|
|
<cvename>CVE-2004-0599</cvename>
|
|
<certvu>388984</certvu>
|
|
<certvu>236656</certvu>
|
|
<certvu>160448</certvu>
|
|
<certvu>477512</certvu>
|
|
<certvu>817368</certvu>
|
|
<certvu>286464</certvu>
|
|
<url>http://secunia.com/advisories/12219</url>
|
|
<url>http://secunia.com/advisories/12232</url>
|
|
<url>http://bugzilla.mozilla.org/show_bug.cgi?id=251381</url>
|
|
<uscertta>TA04-217A</uscertta>
|
|
<url>http://dl.sourceforge.net/sourceforge/libpng/ADVISORY.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-08-04</discovery>
|
|
<entry>2004-08-04</entry>
|
|
<modified>2004-08-15</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="603fe36d-ec9d-11d8-b913-000c41e2cdad">
|
|
<topic>kdelibs insecure temporary file handling</topic>
|
|
<affects>
|
|
<package>
|
|
<name>kdelibs</name>
|
|
<range><le>3.2.3_3</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>According to a KDE Security Advisory, KDE may sometimes
|
|
create temporary files without properly checking the ownership
|
|
and type of the target path. This could allow a local
|
|
attacker to cause KDE applications to overwrite arbitrary
|
|
files.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0689</cvename>
|
|
<cvename>CVE-2004-0690</cvename>
|
|
<url>http://www.kde.org/info/security/advisory-20040811-1.txt</url>
|
|
<url>http://www.kde.org/info/security/advisory-20040811-2.txt</url>
|
|
<url>ftp://ftp.kde.org/pub/kde/security_patches/post-3.2.3-kdelibs-kstandarddirs.patch</url>
|
|
<url>ftp://ftp.kde.org/pub/kde/security_patches/post-3.2.3-kdelibs-dcopserver.patch</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-08-11</discovery>
|
|
<entry>2004-08-12</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="5b8f9a02-ec93-11d8-b913-000c41e2cdad">
|
|
<topic>gaim remotely exploitable vulnerabilities in MSN component</topic>
|
|
<affects>
|
|
<package>
|
|
<name>gaim</name>
|
|
<name>ja-gaim</name>
|
|
<name>ko-gaim</name>
|
|
<name>ru-gaim</name>
|
|
<range><lt>0.81_1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>gaim</name>
|
|
<range><ge>20030000</ge></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Sebastian Krahmer discovered several remotely exploitable
|
|
buffer overflow vulnerabilities in the MSN component of
|
|
gaim.</p>
|
|
<blockquote cite="http://gaim.sourceforge.net/security/?id=0">
|
|
<p>In two places in the MSN protocol plugins (object.c and
|
|
slp.c), strncpy was used incorrectly; the size of the array
|
|
was not checked before copying to it. Both bugs affect MSN's
|
|
MSNSLP protocol, which is peer-to-peer, so this could
|
|
potentially be easy to exploit.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0500</cvename>
|
|
<url>http://gaim.sourceforge.net/security/?id=0</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-08-12</discovery>
|
|
<entry>2004-08-12</entry>
|
|
<modified>2004-10-25</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="78348ea2-ec91-11d8-b913-000c41e2cdad">
|
|
<topic>acroread uudecoder input validation error</topic>
|
|
<affects>
|
|
<package>
|
|
<name>acroread</name>
|
|
<name>acroread4</name>
|
|
<name>acroread5</name>
|
|
<range><lt>5.0.9</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>An iDEFENSE security advisory reports:</p>
|
|
<blockquote cite="www.idefense.com/application/poi/display?id=124&type=vulnerabilities">
|
|
<p>Remote exploitation of an input validation error in the
|
|
uudecoding feature of Adobe Acrobat Reader (Unix) 5.0
|
|
allows an attacker to execute arbitrary code.</p>
|
|
<p>The Unix and Linux versions of Adobe Acrobat Reader 5.0
|
|
automatically attempt to convert uuencoded documents
|
|
back into their original format. The vulnerability
|
|
specifically exists in the failure of Acrobat Reader to
|
|
check for the backtick shell metacharacter in the filename
|
|
before executing a command with a shell. This allows a
|
|
maliciously constructed filename to execute arbitrary
|
|
programs.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0630</cvename>
|
|
<url>http://www.idefense.com/application/poi/display?id=124&type=vulnerabilities</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-08-12</discovery>
|
|
<entry>2004-08-12</entry>
|
|
<modified>2005-01-06</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="12c7b7ae-ec90-11d8-b913-000c41e2cdad">
|
|
<topic>popfile file disclosure</topic>
|
|
<affects>
|
|
<package>
|
|
<name>popfile</name>
|
|
<range><le>0.21.1_2</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>John Graham-Cumming reports that certain configurations of
|
|
POPFile may allow the retrieval of any files with the
|
|
extensions .gif, .png, .ico, .css, as well as some files with
|
|
the extension .html.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<mlist>http://sourceforge.net/mailarchive/forum.php?thread_id=5248725&forum_id=12356</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-08-02</discovery>
|
|
<entry>2004-08-12</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="7a9d5dfe-c507-11d8-8898-000d6111a684">
|
|
<topic>isc-dhcp3-server buffer overflow in logging mechanism</topic>
|
|
<affects>
|
|
<package>
|
|
<name>isc-dhcp3-relay</name>
|
|
<name>isc-dhcp3-server</name>
|
|
<range><ge>3.0.1.r12</ge><lt>3.0.1.r14</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A buffer overflow exists in the logging functionality
|
|
of the DHCP daemon which could lead to Denial of Service
|
|
attacks and has the potential to allow attackers to
|
|
execute arbitrary code.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0460</cvename>
|
|
<url>http://www.osvdb.org/7237</url>
|
|
<uscertta>TA04-174A</uscertta>
|
|
<certvu>317350</certvu>
|
|
<mlist msgid="BAY13-F94UHMuEEkHMz0005c4f7@hotmail.com">http://www.securityfocus.com/archive/1/366801</mlist>
|
|
<mlist msgid="40DFAB69.1060909@sympatico.ca">http://www.securityfocus.com/archive/1/367286</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-06-22</discovery>
|
|
<entry>2004-06-25</entry>
|
|
<modified>2004-08-12</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="3a408f6f-9c52-11d8-9366-0020ed76ef5a">
|
|
<topic>libpng denial-of-service</topic>
|
|
<affects>
|
|
<package>
|
|
<name>linux-png</name>
|
|
<range><le>1.0.14_3</le></range>
|
|
<range><ge>1.2</ge><le>1.2.2</le></range>
|
|
</package>
|
|
<package>
|
|
<name>png</name>
|
|
<range><lt>1.2.5_4</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Steve Grubb reports a buffer read overrun in
|
|
libpng's png_format_buffer function. A specially
|
|
constructed PNG image processed by an application using
|
|
libpng may trigger the buffer read overrun and possibly
|
|
result in an application crash.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0421</cvename>
|
|
<url>http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=120508</url>
|
|
<url>http://rhn.redhat.com/errata/RHSA-2004-181.html</url>
|
|
<url>http://secunia.com/advisories/11505</url>
|
|
<url>http://www.osvdb.org/5726</url>
|
|
<bid>10244</bid>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-04-29</discovery>
|
|
<entry>2004-05-02</entry>
|
|
<modified>2004-08-12</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="4764cfd6-d630-11d8-b479-02e0185c0b53">
|
|
<cancelled superseded="dd7aa4f1-102f-11d9-8a8a-000c41e2cdad"/>
|
|
</vuln>
|
|
|
|
<vuln vid="abe47a5a-e23c-11d8-9b0a-000347a4fa7d">
|
|
<topic>Mozilla certificate spoofing</topic>
|
|
<affects>
|
|
<package>
|
|
<name>firefox</name>
|
|
<range><ge>0.9.1</ge><le>0.9.2</le></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-mozilla</name>
|
|
<range><lt>1.7.2</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>linux-mozilla-devel</name>
|
|
<range><lt>1.7.2</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>mozilla</name>
|
|
<range><lt>1.7.2,2</lt></range>
|
|
<range><ge>1.8,2</ge><le>1.8.a2,2</le></range>
|
|
</package>
|
|
<package>
|
|
<name>mozilla-gtk1</name>
|
|
<range><lt>1.7.2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Mozilla and Mozilla Firefox contains a flaw that may
|
|
allow a malicious user to spoof SSL certification.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<mlist msgid="003a01c472ba$b2060900$6501a8c0@sec">http://www.securityfocus.com/archive/1/369953</mlist>
|
|
<url>http://www.cipher.org.uk/index.php?p=advisories/Certificate_Spoofing_Mozilla_FireFox_25-07-2004.advisory</url>
|
|
<url>http://secunia.com/advisories/12160</url>
|
|
<url>http://bugzilla.mozilla.org/show_bug.cgi?id=253121</url>
|
|
<url>http://www.osvdb.org/8238</url>
|
|
<bid>10796</bid>
|
|
<cvename>CVE-2004-0763</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-07-25</discovery>
|
|
<entry>2004-07-30</entry>
|
|
<modified>2004-08-12</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="a713c0f9-ec54-11d8-9440-000347a4fa7d">
|
|
<topic>ImageMagick png vulnerability fix</topic>
|
|
<affects>
|
|
<package>
|
|
<name>ImageMagick</name>
|
|
<name>ImageMagick-nox11</name>
|
|
<range><lt>6.0.4.2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Glenn Randers-Pehrson has contributed a fix for the png
|
|
vulnerabilities discovered by Chris Evans.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://studio.imagemagick.org/pipermail/magick-users/2004-August/013218.html</url>
|
|
<url>http://freshmeat.net/releases/169228</url>
|
|
<url>http://secunia.com/advisories/12236</url>
|
|
<url>http://www.freebsd.org/ports/portaudit/f9e3e60b-e650-11d8-9b0a-000347a4fa7d.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-08-04</discovery>
|
|
<entry>2004-08-04</entry>
|
|
<modified>2004-08-12</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="98bd69c3-834b-11d8-a41f-0020ed76ef5a">
|
|
<topic>Courier mail services: remotely exploitable buffer overflows</topic>
|
|
<affects>
|
|
<package>
|
|
<name>courier</name>
|
|
<range><lt>0.45</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>courier-imap</name>
|
|
<range><lt>3.0,1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>sqwebmail</name>
|
|
<range><lt>4.0</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Courier set of mail services use a common Unicode
|
|
library. This library contains buffer overflows in the
|
|
converters for two popular Japanese character encodings.
|
|
These overflows may be remotely exploitable, triggered by
|
|
a maliciously formatted email message that is later processed
|
|
by one of the Courier mail services.
|
|
From the release notes for the corrected versions of the
|
|
Courier set of mail services:</p>
|
|
<blockquote>
|
|
<p>iso2022jp.c: Converters became (upper-)compatible with
|
|
ISO-2022-JP (RFC1468 / JIS X 0208:1997 Annex 2) and
|
|
ISO-2022-JP-1 (RFC2237). Buffer overflow vulnerability
|
|
(when Unicode character is out of BMP range) has been
|
|
closed. Convert error handling was implemented.</p>
|
|
<p>shiftjis.c: Broken SHIFT_JIS converters has been fixed
|
|
and became (upper-)compatible with Shifted Encoding Method
|
|
(JIS X 0208:1997 Annex 1). Buffer overflow vulnerability
|
|
(when Unicode character is out of BMP range) has been
|
|
closed. Convert error handling was implemented.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0224</cvename>
|
|
<url>http://cvs.sourceforge.net/viewcvs.py/courier/libs/unicode/iso2022jp.c?rev=1.10&view=markup</url>
|
|
<url>http://cvs.sourceforge.net/viewcvs.py/courier/libs/unicode/shiftjis.c?rev=1.6&view=markup</url>
|
|
<bid>9845</bid>
|
|
<url>http://secunia.com/advisories/11087</url>
|
|
<url>http://www.osvdb.org/4194</url>
|
|
<url>http://www.osvdb.org/6927</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-02-01</discovery>
|
|
<entry>2004-03-31</entry>
|
|
<modified>2004-07-16</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="cdf18ed9-7f4a-11d8-9645-0020ed76ef5a">
|
|
<topic>multiple vulnerabilities in ethereal</topic>
|
|
<affects>
|
|
<package>
|
|
<name>ethereal</name>
|
|
<name>tethereal</name>
|
|
<range><lt>0.10.3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Stefan Esser of e-matters Security discovered a baker's dozen
|
|
of buffer overflows in Ethereal's decoders, including:</p>
|
|
<ul>
|
|
<li>NetFlow</li>
|
|
<li>IGAP</li>
|
|
<li>EIGRP</li>
|
|
<li>PGM</li>
|
|
<li>IRDA</li>
|
|
<li>BGP</li>
|
|
<li>ISUP</li>
|
|
<li>TCAP</li>
|
|
<li>UCP</li>
|
|
</ul>
|
|
<p>In addition, a vulnerability in the RADIUS decoder was found
|
|
by Jonathan Heusser.</p>
|
|
<p>Finally, there is one uncredited vulnerability described by the
|
|
Ethereal team as:</p>
|
|
<blockquote cite="http://www.ethereal.com/appnotes/enpa-sa-00013.html">
|
|
<p>A zero-length Presentation protocol selector could make
|
|
Ethereal crash.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://www.ethereal.com/appnotes/enpa-sa-00013.html</url>
|
|
<cvename>CVE-2004-0176</cvename>
|
|
<cvename>CVE-2004-0365</cvename>
|
|
<cvename>CVE-2004-0367</cvename>
|
|
<certvu>119876</certvu>
|
|
<certvu>124454</certvu>
|
|
<certvu>125156</certvu>
|
|
<certvu>433596</certvu>
|
|
<certvu>591820</certvu>
|
|
<certvu>644886</certvu>
|
|
<certvu>659140</certvu>
|
|
<certvu>695486</certvu>
|
|
<certvu>740188</certvu>
|
|
<certvu>792286</certvu>
|
|
<certvu>864884</certvu>
|
|
<certvu>931588</certvu>
|
|
<url>http://security.e-matters.de/advisories/032004.html</url>
|
|
<url>http://secunia.com/advisories/11185</url>
|
|
<bid>9952</bid>
|
|
<url>http://www.osvdb.org/4462</url>
|
|
<url>http://www.osvdb.org/4463</url>
|
|
<url>http://www.osvdb.org/4464</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-03-23</discovery>
|
|
<entry>2004-03-26</entry>
|
|
<modified>2004-07-11</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="74d06b67-d2cf-11d8-b479-02e0185c0b53">
|
|
<topic>multiple vulnerabilities in ethereal</topic>
|
|
<affects>
|
|
<package>
|
|
<name>ethereal</name>
|
|
<name>ethereal-lite</name>
|
|
<name>tethereal</name>
|
|
<name>tethereal-lite</name>
|
|
<range><lt>0.10.4</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Issues have been discovered in multiple protocol dissectors.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://www.ethereal.com/appnotes/enpa-sa-00014.html</url>
|
|
<cvename>CVE-2004-0504</cvename>
|
|
<cvename>CVE-2004-0505</cvename>
|
|
<cvename>CVE-2004-0506</cvename>
|
|
<cvename>CVE-2004-0507</cvename>
|
|
<url>http://secunia.com/advisories/11608</url>
|
|
<bid>10347</bid>
|
|
<url>http://www.osvdb.org/6131</url>
|
|
<url>http://www.osvdb.org/6132</url>
|
|
<url>http://www.osvdb.org/6133</url>
|
|
<url>http://www.osvdb.org/6134</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-05-13</discovery>
|
|
<entry>2004-07-11</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="265c8b00-d2d0-11d8-b479-02e0185c0b53">
|
|
<topic>multiple vulnerabilities in ethereal</topic>
|
|
<affects>
|
|
<package>
|
|
<name>ethereal</name>
|
|
<name>ethereal-lite</name>
|
|
<name>tethereal</name>
|
|
<name>tethereal-lite</name>
|
|
<range><lt>0.10.5</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Issues have been discovered in multiple protocol dissectors.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://www.ethereal.com/appnotes/enpa-sa-00015.html</url>
|
|
<cvename>CVE-2004-0633</cvename>
|
|
<cvename>CVE-2004-0634</cvename>
|
|
<cvename>CVE-2004-0635</cvename>
|
|
<url>http://secunia.com/advisories/12024</url>
|
|
<bid>10672</bid>
|
|
<url>http://www.osvdb.org/7536</url>
|
|
<url>http://www.osvdb.org/7537</url>
|
|
<url>http://www.osvdb.org/7538</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-07-06</discovery>
|
|
<entry>2004-07-11</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="4aec9d58-ce7b-11d8-858d-000d610a3b12">
|
|
<topic>Format string vulnerability in SSLtelnet</topic>
|
|
<affects>
|
|
<package>
|
|
<name>SSLtelnet</name>
|
|
<range><le>0.13_1</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>SSLtelnet contains a format string vulnerability that could
|
|
allow remote code execution and privilege escalation.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0640</cvename>
|
|
<url>http://www.idefense.com/application/poi/display?id=114&type=vulnerabilities</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2003-04-03</discovery>
|
|
<entry>2004-07-05</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="c5519420-cec2-11d8-8898-000d6111a684">
|
|
<topic>"Content-Type" XSS vulnerability affecting other webmail systems</topic>
|
|
<affects>
|
|
<package>
|
|
<name>openwebmail</name>
|
|
<range><le>2.32</le></range>
|
|
</package>
|
|
<package>
|
|
<name>ilohamail</name>
|
|
<range><lt>0.8.13</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Roman Medina-Heigl Hernandez did a survey which other webmail systems
|
|
where vulnerable to a bug he discovered in SquirrelMail. This advisory
|
|
summarizes the results.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://www.rs-labs.com/adv/RS-Labs-Advisory-2004-2.txt</url>
|
|
<url>http://www.freebsd.org/ports/portaudit/89a0de27-bf66-11d8-a252-02e0185c0b53.html</url>
|
|
<url>http://www.freebsd.org/ports/portaudit/911f1b19-bd20-11d8-84f9-000bdb1444a4.html</url>
|
|
<url>http://www.freebsd.org/ports/portaudit/c3e56efa-c42f-11d8-864c-02e0185c0b53.html</url>
|
|
<cvename>CVE-2004-0519</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-05-29</discovery>
|
|
<entry>2004-07-05</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="76904dce-ccf3-11d8-babb-000854d03344">
|
|
<topic>Pavuk HTTP Location header overflow</topic>
|
|
<affects>
|
|
<package>
|
|
<name>pavuk</name>
|
|
<range><lt>0.9.28_5</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>When pavuk sends a request to a web server and the server
|
|
sends back the HTTP status code 305 (Use Proxy), pavuk
|
|
copies data from the HTTP Location header in an unsafe
|
|
manner. This leads to a stack-based buffer overflow with
|
|
control over EIP.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0456</cvename>
|
|
<mlist>http://lists.netsys.com/pipermail/full-disclosure/2004-July/023322.html</mlist>
|
|
<url>http://www.osvdb.org/7319</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-06-30</discovery>
|
|
<entry>2004-07-03</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="33ab4a47-bfc1-11d8-b00e-000347a4fa7d">
|
|
<topic>Several vulnerabilities found in PHPNuke</topic>
|
|
<affects>
|
|
<package>
|
|
<name>phpnuke</name>
|
|
<range><lt>7.3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Janek Vind "waraxe" reports that several issues in the
|
|
PHPNuke software may be exploited via carefully crafted
|
|
URL requests. These URLs will permit the injection of
|
|
SQL code, cookie theft, and the readability of the
|
|
PHPNuke administrator account.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2003-0279</cvename>
|
|
<cvename>CVE-2003-0318</cvename>
|
|
<cvename>CVE-2004-0266</cvename>
|
|
<cvename>CVE-2004-0269</cvename>
|
|
<url>http://www.waraxe.us/index.php?modname=sa&id=27</url>
|
|
<url>http://secunia.com/advisories/11920</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-05-05</discovery>
|
|
<entry>2004-07-03</entry>
|
|
<modified>2004-09-28</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="0d4c31ac-cb91-11d8-8898-000d6111a684">
|
|
<topic>Remote code injection in phpMyAdmin</topic>
|
|
<affects>
|
|
<package>
|
|
<name>phpMyAdmin</name>
|
|
<range><lt>2.5.7.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>This vulnerability would allow remote user to inject PHP code
|
|
to be executed by eval() function. This vulnerability is only
|
|
exploitable if variable $cfg['LeftFrameLight'] is set to FALSE (in
|
|
file config.inc.php).</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://sf.net/forum/forum.php?forum_id=387635</url>
|
|
<mlist msgid="20040629025752.976.qmail@www.securityfocus.com">http://www.securityfocus.com/archive/1/367486</mlist>
|
|
<url>http://secunia.com/advisories/11974</url>
|
|
<url>http://eagle.kecapi.com/sec/fd/phpMyAdmin.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-06-29</discovery>
|
|
<entry>2004-07-02</entry>
|
|
<modified>2004-09-28</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="4d837296-cc28-11d8-a54c-02e0185c0b53">
|
|
<topic>GNATS local privilege elevation</topic>
|
|
<affects>
|
|
<package>
|
|
<name>gnats</name>
|
|
<range><le>3.113.1_9</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>GNATS 3.113.1 contains multiple buffer overflows, through which a
|
|
local attacker could gain elevated privileges on the system.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<freebsdpr>ports/56006</freebsdpr>
|
|
<mlist msgid="20040625164231.7437.qmail@www.securityfocus.com">http://www.securityfocus.com/archive/1/326337</mlist>
|
|
<url>http://www.securiteam.com/unixfocus/5CP0N0UAAA.html</url>
|
|
<url>http://secunia.com/advisories/9096</url>
|
|
<url>http://x82.inetcop.org/h0me/adv1sor1es/INCSA.2003-0x82-018-GNATS-bt.txt</url>
|
|
<url>http://www.gnu.org/software/gnats/gnats.html</url>
|
|
<url>http://www.osvdb.org/2190</url>
|
|
<url>http://www.osvdb.org/4600</url>
|
|
<url>http://www.osvdb.org/4601</url>
|
|
<url>http://www.osvdb.org/4607</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2003-06-21</discovery>
|
|
<entry>2004-07-02</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="8ecaaca2-cc07-11d8-858d-000d610a3b12">
|
|
<topic>Linux binary compatibility mode input validation error</topic>
|
|
<affects>
|
|
<system>
|
|
<name>FreeBSD</name>
|
|
<range><ge>4.9</ge><lt>4.9_10</lt></range>
|
|
<range><ge>4.8</ge><lt>4.8_23</lt></range>
|
|
</system>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A programming error in the handling of some Linux system
|
|
calls may result in memory locations being accessed without
|
|
proper validation.</p>
|
|
<p>It may be possible for a local attacker to read and/or
|
|
overwrite portions of kernel memory, resulting in disclosure
|
|
of sensitive information or potential privilege escalation.
|
|
A local attacker can cause a system panic.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0602</cvename>
|
|
<freebsdsa>SA-04:13.linux</freebsdsa>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-06-18</discovery>
|
|
<entry>2004-06-30</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="1f738bda-c6ac-11d8-8898-000d6111a684">
|
|
<topic>Remote Denial of Service of HTTP server and client</topic>
|
|
<affects>
|
|
<package>
|
|
<name>giFT-FastTrack</name>
|
|
<range><lt>0.8.7</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>giFT-FastTrack is susceptible to a remote
|
|
Denial of Service attack which could allow
|
|
a remote attacker to render HTTP services
|
|
unusable. According to the developers, no
|
|
code execution is possible; however, they
|
|
recommend an immediate upgrade.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://developer.berlios.de/forum/forum.php?forum_id=5814</url>
|
|
<url>http://www.osvdb.org/7266</url>
|
|
<url>http://secunia.com/advisories/11941</url>
|
|
<bid>10604</bid>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-06-19</discovery>
|
|
<entry>2004-06-25</entry>
|
|
<modified>2004-06-29</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="ff00f2ce-c54c-11d8-b708-00061bc2ad93">
|
|
<topic>XFree86 opens a chooserFd TCP socket even when DisplayManager.requestPort is 0</topic>
|
|
<affects>
|
|
<package>
|
|
<name>xorg-clients</name>
|
|
<range><eq>6.7.0</eq></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>When the IPv6 code was added to xdm a critical
|
|
test to disable xdmcp was accidentally removed. This
|
|
caused xdm to create the chooser socket regardless if
|
|
DisplayManager.requestPort was disabled in xdm-config
|
|
or not.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0419</cvename>
|
|
<url>http://bugs.xfree86.org/show_bug.cgi?id=1376</url>
|
|
<url>https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=124900</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-05-19</discovery>
|
|
<entry>2004-06-28</entry>
|
|
<modified>2004-06-28</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="da9e6438-bfc0-11d8-b00e-000347a4fa7d">
|
|
<topic>MoinMoin administrative group name privilege escalation vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>moinmoin</name>
|
|
<range><lt>1.2.2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A serious flaw exists in the MoinMoin software
|
|
which may allow a malicious user to gain access to
|
|
unauthorized privileges.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://www.osvdb.org/6704</url>
|
|
<cvename>CVE-2004-0708</cvename>
|
|
<bid>10568</bid>
|
|
<url>http://secunia.com/advisories/11807</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-05-04</discovery>
|
|
<entry>2004-06-28</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="35f6fdf8-a425-11d8-9c6d-0020ed76ef5a">
|
|
<topic>Cyrus IMAP pre-authentication heap overflow vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>cyrus</name>
|
|
<range><lt>2.0.17</lt></range>
|
|
<range><ge>2.1</ge><lt>2.1.11</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>In December 2002, Timo Sirainen reported:</p>
|
|
<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&m=103886607825605">
|
|
<p>Cyrus IMAP server has a remotely exploitable pre-login
|
|
buffer overflow. [...] Note that you don't have to log in
|
|
before exploiting this, and since Cyrus
|
|
runs everything under one UID, it's possible to read every
|
|
user's mail in the system.</p>
|
|
</blockquote>
|
|
<p>It is unknown whether this vulnerability is exploitable for code
|
|
execution on FreeBSD systems.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2002-1580</cvename>
|
|
<bid>6298</bid>
|
|
<certvu>740169</certvu>
|
|
<mlist msgid="20021202175606.GA26254@irccrew.org">http://marc.theaimsgroup.com/?l=bugtraq&m=103886607825605</mlist>
|
|
<mlist>http://asg.web.cmu.edu/archive/message.php?mailbox=archive.info-cyrus&msg=19349</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2002-12-02</discovery>
|
|
<entry>2004-05-12</entry>
|
|
<modified>2004-06-27</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="700d43b4-a42a-11d8-9c6d-0020ed76ef5a">
|
|
<topic>Cyrus IMSPd multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>cyrus-imspd</name>
|
|
<range><lt>1.6a5</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Cyrus team reported multiple vulnerabilities in older
|
|
versions of Cyrus IMSPd:</p>
|
|
<blockquote cite="http://asg.web.cmu.edu/archive/message.php?mailbox=archive.cyrus-announce&msg=25">
|
|
<p>These releases correct a recently discovered buffer
|
|
overflow vulnerability, as well as clean up a significant
|
|
amount of buffer handling throughout the code.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<mlist>http://asg.web.cmu.edu/archive/message.php?mailbox=archive.cyrus-announce&msg=25</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-05-12</discovery>
|
|
<entry>2004-09-20</entry>
|
|
<modified>2013-06-19</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="5e7f58c3-b3f8-4258-aeb8-795e5e940ff8">
|
|
<topic>mplayer heap overflow in http requests</topic>
|
|
<affects>
|
|
<package>
|
|
<name>mplayer</name>
|
|
<name>mplayer-gtk</name>
|
|
<name>mplayer-esound</name>
|
|
<name>mplayer-gtk-esound</name>
|
|
<range><lt>0.92.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A remotely exploitable heap buffer overflow vulnerability was
|
|
found in MPlayer's URL decoding code. If an attacker can
|
|
cause MPlayer to visit a specially crafted URL, arbitrary code
|
|
execution with the privileges of the user running MPlayer may
|
|
occur. A `visit' might be caused by social engineering, or a
|
|
malicious web server could use HTTP redirects which MPlayer
|
|
would then process.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://www.mplayerhq.hu/homepage/design6/news.html</url>
|
|
<mlist>http://marc.theaimsgroup.com/?l=bugtraq&m=108066964709058</mlist>
|
|
<freebsdpr>ports/64974</freebsdpr>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-03-30</discovery>
|
|
<entry>2004-03-31</entry>
|
|
<modified>2004-06-27</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="3e9be8c4-8192-11d8-9645-0020ed76ef5a">
|
|
<topic>ecartis buffer overflows and input validation bugs</topic>
|
|
<affects>
|
|
<package>
|
|
<name>ecartis</name>
|
|
<range><lt>1.0.0.s20030814,1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Timo Sirainen reports multiple buffer overflows that may be
|
|
triggered while parsing messages, as well as input validation
|
|
errors that could result in disclosure of mailing list
|
|
passwords.</p>
|
|
<p>These bugs were resolved in the August 2003 snapshot of
|
|
ecartis.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2003-0781</cvename>
|
|
<cvename>CVE-2003-0782</cvename>
|
|
<url>http://www.securiteam.com/unixfocus/5YP0H2AAUY.html</url>
|
|
<freebsdpr>ports/57082</freebsdpr>
|
|
</references>
|
|
<dates>
|
|
<discovery>2003-08-14</discovery>
|
|
<entry>2004-03-29</entry>
|
|
<modified>2004-06-27</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="c2e10368-77ab-11d8-b9e8-00e04ccb0a62">
|
|
<topic>ModSecurity for Apache 2.x remote off-by-one overflow</topic>
|
|
<affects>
|
|
<package>
|
|
<name>mod_security</name>
|
|
<range><lt>1.7.5</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>When the directive "SecFilterScanPost" is enabled,
|
|
the Apache 2.x version of ModSecurity is vulnerable
|
|
to an off-by-one overflow</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://www.s-quadra.com/advisories/Adv-20040315.txt</url>
|
|
<bid>9885</bid>
|
|
<url>http://secunia.com/advisories/11138</url>
|
|
<certvu>779438</certvu>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-02-09</discovery>
|
|
<entry>2004-03-17</entry>
|
|
<modified>2004-06-27</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="74a9541d-5d6c-11d8-80e3-0020ed76ef5a">
|
|
<topic>clamav remote denial-of-service</topic>
|
|
<affects>
|
|
<package>
|
|
<name>clamav</name>
|
|
<range><lt>0.65_7</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>clamav will exit when a programming
|
|
assertion is not met. A malformed uuencoded message can
|
|
trigger this assertion, allowing an attacker to trivially
|
|
crash clamd or other components of clamav.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<freebsdpr>ports/62586</freebsdpr>
|
|
<mlist msgid="40279811.9050407@fillmore-labs.com">http://www.securityfocus.com/archive/1/353186</mlist>
|
|
<url>http://www.osvdb.org/3894</url>
|
|
<bid>9610</bid>
|
|
<url>http://secunia.com/advisories/10826</url>
|
|
<cvename>CVE-2004-0270</cvename>
|
|
<url>http://xforce.iss.net/xforce/xfdb/15077</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-02-09</discovery>
|
|
<entry>2004-02-12</entry>
|
|
<modified>2004-06-27</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="8d075001-a9ce-11d8-9c6d-0020ed76ef5a">
|
|
<topic>neon date parsing vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>neon</name>
|
|
<range><lt>0.24.5_1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>sitecopy</name>
|
|
<range><le>0.13.4_1</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Stefan Esser reports:</p>
|
|
<blockquote cite="http://security.e-matters.de/advisories/062004.html">
|
|
<p>A vulnerability within a libneon date parsing function
|
|
could cause a heap overflow which could lead to remote
|
|
code execution, depending on the application using
|
|
libneon.</p>
|
|
</blockquote>
|
|
<p>The vulnerability is in the function ne_rfc1036_parse,
|
|
which is in turn used by the function ne_httpdate_parse.
|
|
Applications using either of these neon functions may be
|
|
vulnerable.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0398</cvename>
|
|
<url>http://security.e-matters.de/advisories/062004.html</url>
|
|
<url>http://secunia.com/advisories/11785</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-05-19</discovery>
|
|
<entry>2004-05-19</entry>
|
|
<modified>2004-06-25</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="84237895-8f39-11d8-8b29-0020ed76ef5a">
|
|
<topic>neon format string vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>neon</name>
|
|
<range><lt>0.24.5</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>tla</name>
|
|
<range><lt>1.2_1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>sitecopy</name>
|
|
<range><le>0.13.4_1</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Greuff reports that the neon WebDAV client library contains
|
|
several format string bugs within error reporting code. A
|
|
malicious server may exploit these bugs by sending specially
|
|
crafted PROPFIND or PROPPATCH responses.</p>
|
|
<p>Although several applications include neon, such as cadaver and
|
|
subversion, the FreeBSD Ports of these applications are not
|
|
impacted. They are specifically configured to NOT use the
|
|
included neon. Only packages listed as affected in this
|
|
notice are believed to be impacted.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0179</cvename>
|
|
<url>http://www.webdav.org/neon/</url>
|
|
<url>http://secunia.com/advisories/11785</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-04-14</discovery>
|
|
<entry>2004-04-15</entry>
|
|
<modified>2004-06-25</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="253ea131-bd12-11d8-b071-00e08110b673">
|
|
<topic>Gallery 1.4.3 and ealier user authentication bypass</topic>
|
|
<affects>
|
|
<package>
|
|
<name>gallery</name>
|
|
<range><lt>1.4.3.2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A flaw exists in Gallery versions previous to
|
|
1.4.3-pl1 and post 1.2 which may give an attacker
|
|
the potential to log in under the "admin" account.
|
|
Data outside of the gallery is unaffected and the
|
|
attacker cannot modify any data other than the
|
|
photos or photo albums.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0522</cvename>
|
|
<url>http://gallery.menalto.com/modules.php?op=modload&name=News&file=article&sid=123</url>
|
|
<url>http://secunia.com/advisories/11752</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-06-01</discovery>
|
|
<entry>2004-06-24</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="0c6f3fde-9c51-11d8-9366-0020ed76ef5a">
|
|
<topic>Midnight Commander buffer overflows, format string bugs, and insecure temporary file handling</topic>
|
|
<affects>
|
|
<package>
|
|
<name>mc</name>
|
|
<range><lt>4.6.0_10</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Jakub Jelinek reports several security related bugs in
|
|
Midnight Commander, including:</p>
|
|
<ul>
|
|
<li>Multiple buffer overflows (CVE-2004-0226)</li>
|
|
<li>Insecure temporary file handling (CVE-2004-0231)</li>
|
|
<li>Format string bug (CVE-2004-0232)</li>
|
|
</ul>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0226</cvename>
|
|
<cvename>CVE-2004-0231</cvename>
|
|
<cvename>CVE-2004-0232</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-04-29</discovery>
|
|
<entry>2004-05-02</entry>
|
|
<modified>2004-06-14</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="6f955451-ba54-11d8-b88c-000d610a3b12">
|
|
<topic>Buffer overflow in Squid NTLM authentication helper</topic>
|
|
<affects>
|
|
<package>
|
|
<name>squid</name>
|
|
<range><lt>2.5.5_9</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Remote exploitation of a buffer overflow vulnerability in
|
|
the NTLM authentication helper routine of the Squid Web
|
|
Proxy Cache could allow a remote attacker to execute
|
|
arbitrary code. A remote attacker can compromise a target
|
|
system if the Squid Proxy is configured to use the NTLM
|
|
authentication helper. The attacker can send an overly long
|
|
password to overflow the buffer and execute arbitrary
|
|
code.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://www.idefense.com/application/poi/display?id=107&type=vulnerabilities&flashstatus=false</url>
|
|
<cvename>CVE-2004-0541</cvename>
|
|
<url>http://www.osvdb.org/6791</url>
|
|
<url>http://secunia.com/advisories/11804</url>
|
|
<bid>10500</bid>
|
|
<url>http://www.squid-cache.org/bugs/show_bug.cgi?id=998</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-05-20</discovery>
|
|
<entry>2004-06-09</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="27c331d5-64c7-11d8-80e3-0020ed76ef5a">
|
|
<topic>Vulnerabilities in H.323 implementations</topic>
|
|
<affects>
|
|
<package>
|
|
<name>pwlib</name>
|
|
<range><lt>1.5.0_5</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>asterisk</name>
|
|
<range><le>0.7.2</le></range>
|
|
</package>
|
|
<package>
|
|
<name>openh323</name>
|
|
<range><lt>1.12.0_4</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The <a href="http://www.niscc.gov.uk/">NISCC</a> and the <a href="http://www.ee.oulu.fi/research/ouspg/">OUSPG</a>
|
|
developed a test suite for the H.323 protocol. This test
|
|
suite has uncovered vulnerabilities in several H.323
|
|
implementations with impacts ranging from denial-of-service
|
|
to arbitrary code execution.</p>
|
|
<p>In the FreeBSD Ports Collection, `pwlib' is directly
|
|
affected. Other applications such as `asterisk' and
|
|
`openh323' incorporate `pwlib' statically and so are also
|
|
independently affected.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<!-- General references -->
|
|
<url>http://www.uniras.gov.uk/vuls/2004/006489/h323.htm</url>
|
|
<url>http://www.ee.oulu.fi/research/ouspg/protos/testing/c07/h2250v4/index.html</url>
|
|
<certsa>CA-2004-01</certsa>
|
|
<certvu>749342</certvu>
|
|
<!-- pwlib and pwlib-using applications -->
|
|
<cvename>CVE-2004-0097</cvename>
|
|
<url>http://www.southeren.com/blog/archives/000055.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-01-13</discovery>
|
|
<entry>2004-02-22</entry>
|
|
<modified>2004-06-08</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="fb5e227e-b8c6-11d8-b88c-000d610a3b12">
|
|
<topic>jailed processes can manipulate host routing tables</topic>
|
|
<affects>
|
|
<system>
|
|
<name>FreeBSD</name>
|
|
<range><ge>4.9</ge><lt>4.9_10</lt></range>
|
|
<range><ge>4.8</ge><lt>4.8_23</lt></range>
|
|
</system>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A programming error resulting in a failure to verify that
|
|
an attempt to manipulate routing tables originated from a
|
|
non-jailed process.</p>
|
|
|
|
<p>Jailed processes running with superuser privileges could
|
|
modify host routing tables. This could result in a variety
|
|
of consequences including packets being sent via an
|
|
incorrect network interface and packets being discarded
|
|
entirely.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0125</cvename>
|
|
<freebsdsa>SA-04:12.jailroute</freebsdsa>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-02-03</discovery>
|
|
<entry>2004-06-07</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="1db1ed59-af07-11d8-acb9-000d610a3b12">
|
|
<topic>buffer cache invalidation implementation issues</topic>
|
|
<affects>
|
|
<system>
|
|
<name>FreeBSD</name>
|
|
<range><ge>5.0</ge><lt>5.2_8</lt></range>
|
|
<range><ge>4.9</ge><lt>4.9_9</lt></range>
|
|
<range><ge>4.0</ge><lt>4.8_22</lt></range>
|
|
</system>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Programming errors in the implementation of the msync(2)
|
|
system call involving the MS_INVALIDATE operation lead to
|
|
cache consistency problems between the virtual memory system
|
|
and on-disk contents.</p>
|
|
|
|
<p>In some situations, a user with read access to a file may
|
|
be able to prevent changes to that file from being committed
|
|
to disk.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0435</cvename>
|
|
<freebsdsa>SA-04:11.msync</freebsdsa>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-04-24</discovery>
|
|
<entry>2004-05-26</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="f7a3b18c-624c-4703-9756-b6b27429e5b0">
|
|
<topic>leafnode denial-of-service triggered by article request</topic>
|
|
<affects>
|
|
<package>
|
|
<name>leafnode</name>
|
|
<range><ge>1.9.20</ge><lt>1.9.30</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The leafnode NNTP server may go into an unterminated loop with 100%
|
|
CPU use when an article is requested by Message-ID that has been
|
|
crossposted to several news groups when one of the group names is the
|
|
prefix of another group name that the article was cross-posted
|
|
to. Found by Jan Knutar.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://leafnode.sourceforge.net/leafnode-SA-2002-01.txt</url>
|
|
<cvename>CVE-2002-1661</cvename>
|
|
<mlist msgid="20021229205023.GA5216@merlin.emma.line.org">http://sourceforge.net/mailarchive/message.php?msg_id=2796226</mlist>
|
|
<mlist msgid="20021229205023.GA5216@merlin.emma.line.org">http://article.gmane.org/gmane.network.leafnode.announce/8</mlist>
|
|
<bid>6490</bid>
|
|
<freebsdpr>ports/46613</freebsdpr>
|
|
</references>
|
|
<dates>
|
|
<discovery>2002-11-06</discovery>
|
|
<entry>2004-05-21</entry>
|
|
<modified>2005-05-13</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="7b0208ff-3f65-4e16-8d4d-48fd9851f085">
|
|
<topic>leafnode fetchnews denial-of-service triggered by missing header</topic>
|
|
<affects>
|
|
<package>
|
|
<name>leafnode</name>
|
|
<range><ge>1.9.3</ge><le>1.9.41</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Fetchnews could hang when a news article to be downloaded lacked one
|
|
of the mandatory headers. Found by Joshua Crawford.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2003-0744</cvename>
|
|
<url>http://leafnode.sourceforge.net/leafnode-SA-2003-01.txt</url>
|
|
<mlist msgid="20030904011904.GB12350@merlin.emma.line.org">http://sourceforge.net/mailarchive/message.php?msg_id=5975563</mlist>
|
|
<mlist msgid="20030904011904.GB12350@merlin.emma.line.org">http://article.gmane.org/gmane.network.leafnode.announce/21</mlist>
|
|
<bid>8541</bid>
|
|
<freebsdpr>ports/53838</freebsdpr>
|
|
</references>
|
|
<dates>
|
|
<discovery>2003-06-20</discovery>
|
|
<entry>2004-05-21</entry>
|
|
<modified>2005-05-13</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="a051a4ec-3aa1-4dd1-9bdc-a61eb5700153">
|
|
<topic>leafnode fetchnews denial-of-service triggered by truncated transmission</topic>
|
|
<affects>
|
|
<package>
|
|
<name>leafnode</name>
|
|
<range><le>1.9.47</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>When a downloaded news article ends prematurely, i. e. when the
|
|
server sends [CR]LF.[CR]LF before sending a blank line, fetchnews may
|
|
wait indefinitely for data that never arrives. Workaround: configure
|
|
"minlines=1" (or use a bigger value) in the configuration file. Found
|
|
by Toni Viemerö.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-2068</cvename>
|
|
<url>http://leafnode.sourceforge.net/leafnode-SA-2004-01.txt</url>
|
|
<url>http://sourceforge.net/tracker/index.php?func=detail&aid=873149&group_id=57767&atid=485349</url>
|
|
<mlist msgid="20040109015625.GA12319@merlin.emma.line.org">http://article.gmane.org/gmane.network.leafnode.announce/32</mlist>
|
|
<mlist msgid="20040109015625.GA12319@merlin.emma.line.org">http://sourceforge.net/mailarchive/message.php?msg_id=6922570</mlist>
|
|
<freebsdpr>ports/61105</freebsdpr>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-01-08</discovery>
|
|
<entry>2004-05-21</entry>
|
|
<modified>2005-05-13</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="2e129846-8fbb-11d8-8b29-0020ed76ef5a">
|
|
<topic>MySQL insecure temporary file creation (mysqlbug)</topic>
|
|
<affects>
|
|
<package>
|
|
<name>mysql-client</name>
|
|
<range><ge>4.0</ge><lt>4.0.20</lt></range>
|
|
<range><ge>4.1</ge><lt>4.1.1_2</lt></range>
|
|
<range><ge>5.0</ge><lt>5.0.0_2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Shaun Colley reports that the script `mysqlbug' included
|
|
with MySQL sometimes creates temporary files in an unsafe
|
|
manner. As a result, an attacker may create a symlink in
|
|
/tmp so that if another user invokes `mysqlbug' and <em>quits
|
|
without making <strong>any</strong> changes</em>, an
|
|
arbitrary file may be overwritten with the bug report
|
|
template.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<mlist>http://marc.theaimsgroup.com/?l=bugtraq&m=108023246916294&w=2</mlist>
|
|
<url>http://bugs.mysql.com/bug.php?id=3284</url>
|
|
<bid>9976</bid>
|
|
<cvename>CVE-2004-0381</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-03-25</discovery>
|
|
<entry>2004-04-16</entry>
|
|
<modified>2004-05-21</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="5d36ef32-a9cf-11d8-9c6d-0020ed76ef5a">
|
|
<topic>subversion date parsing vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>subversion</name>
|
|
<range><lt>1.0.2_1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Stefan Esser reports:</p>
|
|
<blockquote cite="http://security.e-matters.de/advisories/082004.html">
|
|
<p>Subversion versions up to 1.0.2 are vulnerable to a date
|
|
parsing vulnerability which can be abused to allow remote
|
|
code execution on Subversion servers and therefore could
|
|
lead to a repository compromise.</p>
|
|
</blockquote>
|
|
<p><em>NOTE:</em> This vulnerability is similar to the date
|
|
parsing issue that affected neon. However, it is a different
|
|
and distinct bug.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0397</cvename>
|
|
<url>http://security.e-matters.de/advisories/082004.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-05-19</discovery>
|
|
<entry>2004-05-19</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="f93be979-a992-11d8-aecc-000d610a3b12">
|
|
<topic>cvs pserver remote heap buffer overflow</topic>
|
|
<affects>
|
|
<system>
|
|
<name>FreeBSD</name>
|
|
<range><ge>5.2</ge><lt>5.2_7</lt></range>
|
|
<range><ge>5.1</ge><lt>5.1_17</lt></range>
|
|
<range><ge>5.0</ge><lt>5.0_21</lt></range>
|
|
<range><ge>4.9</ge><lt>4.9_8</lt></range>
|
|
<range><ge>4.8</ge><lt>4.8_21</lt></range>
|
|
<range><ge>4.0</ge><lt>4.7_27</lt></range>
|
|
</system>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Due to a programming error in code used to parse data
|
|
received from the client, malformed data can cause a heap
|
|
buffer to overflow, allowing the client to overwrite
|
|
arbitrary portions of the server's memory.</p>
|
|
<p>A malicious CVS client can exploit this to run arbitrary
|
|
code on the server at the privilege level of the CVS server
|
|
software.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0396</cvename>
|
|
<freebsdsa>SA-04:10.cvs</freebsdsa>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-05-02</discovery>
|
|
<entry>2004-05-19</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="492f8896-70fa-11d8-873f-0020ed76ef5a">
|
|
<topic>Apache 2 mod_ssl denial-of-service</topic>
|
|
<affects>
|
|
<package>
|
|
<name>apache</name>
|
|
<range><ge>2.0</ge><le>2.0.48_3</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Joe Orton reports a memory leak in Apache 2's mod_ssl.
|
|
A remote attacker may issue HTTP requests on an HTTPS
|
|
port, causing an error. Due to a bug in processing this
|
|
condition, memory associated with the connection is
|
|
not freed. Repeated requests can result in consuming
|
|
all available memory resources, probably resulting in
|
|
termination of the Apache process.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0113</cvename>
|
|
<url>http://www.apacheweek.com/features/security-20</url>
|
|
<url>http://cvs.apache.org/viewcvs.cgi/httpd-2.0/modules/ssl/ssl_engine_io.c?r1=1.100.2.11&r2=1.100.2.12</url>
|
|
<mlist>http://marc.theaimsgroup.com/?l=apache-cvs&m=107869699329638</mlist>
|
|
<url>http://nagoya.apache.org/bugzilla/show_bug.cgi?id=27106</url>
|
|
<bid>9826</bid>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-02-20</discovery>
|
|
<entry>2004-03-08</entry>
|
|
<modified>2004-05-19</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="df333ede-a8ce-11d8-9c6d-0020ed76ef5a">
|
|
<topic>URI handler vulnerabilities in several browsers</topic>
|
|
<affects>
|
|
<package>
|
|
<name>linux-opera</name>
|
|
<name>opera</name>
|
|
<range><lt>7.50</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>kdelibs</name>
|
|
<range><lt>3.2.2_3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Karol Wiesek and Greg MacManus reported via iDEFENSE that the
|
|
Opera web browser contains a flaw in the handling of
|
|
certain URIs. When presented with these URIs, Opera would
|
|
invoke external commands to process them after some
|
|
validation. However, if the hostname component of a URI
|
|
begins with a `-', it may be treated as an option by an external
|
|
command. This could have undesirable side-effects, from
|
|
denial-of-service to code execution. The impact is very
|
|
dependent on local configuration.</p>
|
|
<p>After the iDEFENSE advisory was published, the KDE team
|
|
discovered similar problems in KDE's URI handlers.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0411</cvename>
|
|
<url>http://www.idefense.com/application/poi/display?id=104&type=vulnerabilities</url>
|
|
<url>http://www.kde.org/info/security/advisory-20040517-1.txt</url>
|
|
<url>http://freebsd.kde.org/index.php#n20040517</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-05-12</discovery>
|
|
<entry>2004-05-18</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="20be2982-4aae-11d8-96f2-0020ed76ef5a">
|
|
<topic>fsp buffer overflow and directory traversal vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>fspd</name>
|
|
<range><lt>2.8.1.19</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The <a href="http://www.debian.org/security">Debian
|
|
security team</a> reported a pair of vulnerabilities in
|
|
fsp:</p>
|
|
<blockquote cite="http://www.debian.org/security/2004/dsa-416">
|
|
<p>A vulnerability was discovered in fsp, client utilities
|
|
for File Service Protocol (FSP), whereby a remote user could
|
|
both escape from the FSP root directory (CAN-2003-1022), and
|
|
also overflow a fixed-length buffer to execute arbitrary
|
|
code (CAN-2004-0011).</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2003-1022</cvename>
|
|
<cvename>CVE-2004-0011</cvename>
|
|
<url>http://www.debian.org/security/2004/dsa-416</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-01-06</discovery>
|
|
<entry>2004-01-19</entry>
|
|
<modified>2004-05-17</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="cb6c6c29-9c4f-11d8-9366-0020ed76ef5a">
|
|
<topic>proftpd IP address access control list breakage</topic>
|
|
<affects>
|
|
<package>
|
|
<name>proftpd</name>
|
|
<range><ge>1.2.9</ge><lt>1.2.10.r1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Jindrich Makovicka reports a regression in proftpd's
|
|
handling of IP address access control lists (IP ACLs). Due
|
|
to this regression, some IP ACLs are treated as ``allow
|
|
all''.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0432</cvename>
|
|
<url>http://bugs.proftpd.org/show_bug.cgi?id=2267</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2003-11-04</discovery>
|
|
<entry>2004-05-02</entry>
|
|
<modified>2004-05-15</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="fde53204-7ea6-11d8-9645-0020ed76ef5a">
|
|
<topic>insecure temporary file creation in xine-check, xine-bugreport</topic>
|
|
<affects>
|
|
<package>
|
|
<name>xine</name>
|
|
<range><lt>0.9.23_3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Some scripts installed with xine create temporary files
|
|
insecurely. It is recommended that these scripts (xine-check,
|
|
xine-bugreport) not be used. They are not needed for normal
|
|
operation.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<mlist>http://marc.theaimsgroup.com/?l=bugtraq&m=107997911025558</mlist>
|
|
<bid>9939</bid>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-03-20</discovery>
|
|
<entry>2004-03-26</entry>
|
|
<modified>2004-05-09</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="5f29c2e4-9f6a-11d8-abbc-00e08110b673">
|
|
<topic>exim buffer overflow when verify = header_syntax is used</topic>
|
|
<affects>
|
|
<package>
|
|
<name>exim</name>
|
|
<name>exim-ldap2</name>
|
|
<name>exim-mysql</name>
|
|
<name>exim-postgresql</name>
|
|
<range><lt>4.33+20_1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A remote exploitable buffer overflow has been discovered
|
|
in exim when verify = header_syntax is used in the
|
|
configuration file. This does not affect the default
|
|
configuration.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://www.guninski.com/exim1.html</url>
|
|
<cvename>CVE-2004-0400</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-05-06</discovery>
|
|
<entry>2004-05-06</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="a56a72bb-9f72-11d8-9585-0020ed76ef5a">
|
|
<topic>phpBB session table exhaustion</topic>
|
|
<affects>
|
|
<package>
|
|
<name>phpbb</name>
|
|
<range><le>2.0.8_2</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The includes/sessions.php unnecessarily adds session item into
|
|
session table and therefore vulnerable to a denial-of-service
|
|
attack.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<mlist msgid="20040421011055.GA1448@frontfree.net">http://marc.theaimsgroup.com/?l=bugtraq&m=108256462710010</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-03-05</discovery>
|
|
<entry>2004-05-06</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="446dbecb-9edc-11d8-9366-0020ed76ef5a">
|
|
<topic>heimdal kadmind remote heap buffer overflow</topic>
|
|
<affects>
|
|
<package>
|
|
<name>heimdal</name>
|
|
<range><lt>0.6.1_1</lt></range>
|
|
</package>
|
|
<system>
|
|
<name>FreeBSD</name>
|
|
<range><ge>4.9</ge><lt>4.9_7</lt></range>
|
|
<range><ge>4.0</ge><lt>4.8_20</lt></range>
|
|
</system>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>An input validation error was discovered in the kadmind
|
|
code that handles the framing of Kerberos 4 compatibility
|
|
administration requests. The code assumed that the length
|
|
given in the framing was always two or more bytes. Smaller
|
|
lengths will cause kadmind to read an arbitrary amount of
|
|
data into a minimally-sized buffer on the heap.</p>
|
|
<p>A remote attacker may send a specially formatted message
|
|
to kadmind, causing it to crash or possibly resulting in
|
|
arbitrary code execution.</p>
|
|
<p>The kadmind daemon is part of Kerberos 5 support. However,
|
|
this bug will only be present if kadmind was built with
|
|
additional Kerberos 4 support. Thus, only systems that have
|
|
*both* Heimdal Kerberos 5 and Kerberos 4 installed might
|
|
be affected.</p>
|
|
<p><em>NOTE:</em> On FreeBSD 4 systems, `kadmind' may be
|
|
installed as `k5admind'.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0434</cvename>
|
|
<freebsdsa>SA-04:09.kadmind</freebsdsa>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-05-05</discovery>
|
|
<entry>2004-05-05</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="0792e7a7-8e37-11d8-90d1-0020ed76ef5a">
|
|
<topic>CVS path validation errors</topic>
|
|
<affects>
|
|
<package>
|
|
<name>cvs+ipv6</name>
|
|
<range><le>1.11.5_1</le></range>
|
|
</package>
|
|
<system>
|
|
<name>FreeBSD</name>
|
|
<range><ge>5.2</ge><lt>5.2.1_5</lt></range>
|
|
<range><ge>4.9</ge><lt>4.9_5</lt></range>
|
|
<range><ge>4.8</ge><lt>4.8_18</lt></range>
|
|
</system>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Two programming errors were discovered in which path names
|
|
handled by CVS were not properly validated. In one case,
|
|
the CVS client accepts absolute path names from the server
|
|
when determining which files to update. In another case,
|
|
the CVS server accepts relative path names from the client
|
|
when determining which files to transmit, including those
|
|
containing references to parent directories (`../').</p>
|
|
<p>These programming errors generally only have a security
|
|
impact when dealing with remote CVS repositories.</p>
|
|
<p>A malicious CVS server may cause a CVS client to overwrite
|
|
arbitrary files on the client's system.</p>
|
|
<p>A CVS client may request RCS files from a remote system
|
|
other than those in the repository specified by $CVSROOT.
|
|
These RCS files need not be part of any CVS repository
|
|
themselves.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0180</cvename>
|
|
<cvename>CVE-2004-0405</cvename>
|
|
<url>http://ccvs.cvshome.org/servlets/NewsItemView?newsID=102</url>
|
|
<freebsdsa>SA-04:07.cvs</freebsdsa>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-04-14</discovery>
|
|
<entry>2004-04-14</entry>
|
|
<modified>2004-05-05</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="7229d900-88af-11d8-90d1-0020ed76ef5a">
|
|
<topic>mksnap_ffs clears file system options</topic>
|
|
<affects>
|
|
<system>
|
|
<name>FreeBSD</name>
|
|
<range><ge>5.2</ge><lt>5.2_1</lt></range>
|
|
<range><ge>5.1</ge><lt>5.1_12</lt></range>
|
|
</system>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The kernel interface for creating a snapshot of a
|
|
filesystem is the same as that for changing the flags on
|
|
that filesystem. Due to an oversight, the <a href="http://www.freebsd.org/cgi/man.cgi?query=mksnap_ffs">mksnap_ffs(8)</a>
|
|
command called that interface with only the snapshot flag
|
|
set, causing all other flags to be reset to the default
|
|
value.</p>
|
|
<p>A regularly scheduled backup of a live filesystem, or
|
|
any other process that uses the mksnap_ffs command
|
|
(for instance, to provide a rough undelete functionality
|
|
on a file server), will clear any flags in effect on the
|
|
filesystem being snapshot. Possible consequences depend
|
|
on local usage, but can include disabling extended access
|
|
control lists or enabling the use of setuid executables
|
|
stored on an untrusted filesystem.</p>
|
|
<p>The mksnap_ffs command is normally only available to
|
|
the superuser and members of the `operator' group. There
|
|
is therefore no risk of a user gaining elevated privileges
|
|
directly through use of the mksnap_ffs command unless
|
|
it has been intentionally made available to unprivileged
|
|
users.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0099</cvename>
|
|
<freebsdsa>SA-04:01.mksnap_ffs</freebsdsa>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-01-30</discovery>
|
|
<entry>2004-04-07</entry>
|
|
<modified>2004-05-05</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="f95a9005-88ae-11d8-90d1-0020ed76ef5a">
|
|
<topic>shmat reference counting bug</topic>
|
|
<affects>
|
|
<system>
|
|
<name>FreeBSD</name>
|
|
<range><ge>5.2</ge><lt>5.2_2</lt></range>
|
|
<range><ge>5.1</ge><lt>5.1_14</lt></range>
|
|
<range><ge>5.0</ge><lt>5.0_20</lt></range>
|
|
<range><ge>4.9</ge><lt>4.9_2</lt></range>
|
|
<range><ge>4.8</ge><lt>4.8_15</lt></range>
|
|
<range><lt>4.7_25</lt></range>
|
|
</system>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A programming error in the <a href="http://www.freebsd.org/cgi/man.cgi?query=shmat">shmat(2)</a> system call can result
|
|
in a shared memory segment's reference count being erroneously
|
|
incremented.</p>
|
|
<p>It may be possible to cause a shared memory segment to
|
|
reference unallocated kernel memory, but remain valid.
|
|
This could allow a local attacker to gain read or write
|
|
access to a portion of kernel memory, resulting in sensitive
|
|
information disclosure, bypass of access control mechanisms,
|
|
or privilege escalation.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0114</cvename>
|
|
<freebsdsa>SA-04:02.shmat</freebsdsa>
|
|
<url>http://www.pine.nl/press/pine-cert-20040201.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-02-01</discovery>
|
|
<entry>2004-04-07</entry>
|
|
<modified>2004-05-05</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="9082a85a-88ae-11d8-90d1-0020ed76ef5a">
|
|
<topic>jailed processes can attach to other jails</topic>
|
|
<affects>
|
|
<system>
|
|
<name>FreeBSD</name>
|
|
<range><ge>5.1</ge><lt>5.1_14</lt></range>
|
|
<range><ge>5.2</ge><lt>5.2.1</lt></range>
|
|
</system>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A programming error has been found in the <a href="http://www.freebsd.org/cgi/man.cgi?query=jail_attach">jail_attach(2)</a>
|
|
system call which affects the way that system call verifies
|
|
the privilege level of the calling process. Instead of
|
|
failing immediately if the calling process was already
|
|
jailed, the jail_attach system call would fail only after
|
|
changing the calling process's root directory.</p>
|
|
<p>A process with superuser privileges inside a jail could
|
|
change its root directory to that of a different jail,
|
|
and thus gain full read and write access to files and
|
|
directories within the target jail.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0126</cvename>
|
|
<freebsdsa>SA-04:03.jail</freebsdsa>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-02-19</discovery>
|
|
<entry>2004-04-07</entry>
|
|
<modified>2004-05-05</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="e289f7fd-88ac-11d8-90d1-0020ed76ef5a">
|
|
<topic>many out-of-sequence TCP packets denial-of-service</topic>
|
|
<affects>
|
|
<system>
|
|
<name>FreeBSD</name>
|
|
<range><ge>5.2</ge><lt>5.2.1_2</lt></range>
|
|
<range><ge>5.0</ge><lt>5.1_15</lt></range>
|
|
<range><ge>4.9</ge><lt>4.9_3</lt></range>
|
|
<range><ge>4.8</ge><lt>4.8_16</lt></range>
|
|
<range><lt>4.7_26</lt></range>
|
|
</system>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>FreeBSD does not limit the number of TCP segments that
|
|
may be held in a reassembly queue. A remote attacker may
|
|
conduct a low-bandwidth denial-of-service attack against
|
|
a machine providing services based on TCP (there are many
|
|
such services, including HTTP, SMTP, and FTP). By sending
|
|
many out-of-sequence TCP segments, the attacker can cause
|
|
the target machine to consume all available memory buffers
|
|
(``mbufs''), likely leading to a system crash.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0171</cvename>
|
|
<freebsdsa>SA-04:04.tcp</freebsdsa>
|
|
<url>http://www.idefense.com/application/poi/display?id=78&type=vulnerabilities</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-02-18</discovery>
|
|
<entry>2004-04-07</entry>
|
|
<modified>2004-05-05</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="2c6acefd-8194-11d8-9645-0020ed76ef5a">
|
|
<topic>setsockopt(2) IPv6 sockets input validation error</topic>
|
|
<affects>
|
|
<system>
|
|
<name>FreeBSD</name>
|
|
<range><ge>5.2</ge><lt>5.2.1_4</lt></range>
|
|
</system>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>From the FreeBSD Security Advisory:</p>
|
|
<blockquote>
|
|
<p>A programming error in the handling of some IPv6 socket
|
|
options within the <a href="http://www.freebsd.org/cgi/man.cgi?query=setsockopt">setsockopt(2)</a> system call may result
|
|
in memory locations being accessed without proper
|
|
validation.</p>
|
|
<p>It may be possible for a local attacker to read portions
|
|
of kernel memory, resulting in disclosure of sensitive
|
|
information. A local attacker can cause a system
|
|
panic.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0370</cvename>
|
|
<freebsdsa>SA-04:06.ipv6</freebsdsa>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-03-29</discovery>
|
|
<entry>2004-03-29</entry>
|
|
<modified>2004-05-05</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="68233cba-7774-11d8-89ed-0020ed76ef5a">
|
|
<topic>OpenSSL ChangeCipherSpec denial-of-service vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>openssl</name>
|
|
<name>openssl-beta</name>
|
|
<range><lt>0.9.7d</lt></range>
|
|
</package>
|
|
<system>
|
|
<name>FreeBSD</name>
|
|
<range><ge>4.0</ge><lt>4.8_17</lt></range>
|
|
<range><ge>4.9</ge><lt>4.9_4</lt></range>
|
|
<range><ge>5.0</ge><lt>5.1_16</lt></range>
|
|
<range><ge>5.2</ge><lt>5.2.1_3</lt></range>
|
|
</system>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A remote attacker could cause an application using OpenSSL to
|
|
crash by performing a specially crafted SSL/TLS handshake.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0079</cvename>
|
|
<url>http://www.openssl.org/news/secadv_20040317.txt</url>
|
|
<freebsdsa>SA-04:05.openssl</freebsdsa>
|
|
<certvu>288574</certvu>
|
|
<bid>9899</bid>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-03-17</discovery>
|
|
<entry>2004-03-17</entry>
|
|
<modified>2004-05-05</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="f04cc5cb-2d0b-11d8-beaf-000a95c4d922">
|
|
<topic>bind8 negative cache poison attack</topic>
|
|
<affects>
|
|
<package>
|
|
<name>bind</name>
|
|
<range><ge>8.3</ge><lt>8.3.7</lt></range>
|
|
<range><ge>8.4</ge><lt>8.4.3</lt></range>
|
|
</package>
|
|
<system>
|
|
<name>FreeBSD</name>
|
|
<range><ge>5.1</ge><lt>5.1_11</lt></range>
|
|
<range><ge>5.0</ge><lt>5.0_19</lt></range>
|
|
<range><ge>4.9</ge><lt>4.9_1</lt></range>
|
|
<range><ge>4.8</ge><lt>4.8_14</lt></range>
|
|
<range><ge>4.7</ge><lt>4.7_24</lt></range>
|
|
<range><ge>4.6</ge><lt>4.6.2_27</lt></range>
|
|
<range><ge>4.5</ge><lt>4.5_37</lt></range>
|
|
<range><lt>4.4_47</lt></range>
|
|
</system>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A programming error in BIND 8 named can result in a DNS
|
|
message being incorrectly cached as a negative response. As
|
|
a result, an attacker may arrange for malicious DNS messages
|
|
to be delivered to a target name server, and cause that name
|
|
server to cache a negative response for some target domain
|
|
name. The name server would thereafter respond negatively
|
|
to legitimate queries for that domain name, resulting in a
|
|
denial-of-service for applications that require DNS.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2003-0914</cvename>
|
|
<freebsdsa>SA-03:19.bind</freebsdsa>
|
|
<certvu>734644</certvu>
|
|
</references>
|
|
<dates>
|
|
<discovery>2003-11-28</discovery>
|
|
<entry>2003-12-12</entry>
|
|
<modified>2004-05-05</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="bfb36941-84fa-11d8-a41f-0020ed76ef5a">
|
|
<topic>Incorrect cross-realm trust handling in Heimdal</topic>
|
|
<affects>
|
|
<package>
|
|
<name>heimdal</name>
|
|
<range><lt>0.6.1</lt></range>
|
|
</package>
|
|
<system>
|
|
<name>FreeBSD</name>
|
|
<range><ge>5.0</ge><lt>5.2_6</lt></range>
|
|
<range><ge>4.9</ge><lt>4.9_6</lt></range>
|
|
<range><ge>4.0</ge><lt>4.8_19</lt></range>
|
|
</system>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Heimdal does not correctly validate the `transited' field of
|
|
Kerberos tickets when computing the authentication path. This
|
|
could allow a rogue KDC with which cross-realm relationships
|
|
have been established to impersonate any KDC in the
|
|
authentication path.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0371</cvename>
|
|
<freebsdsa>SA-04:08.heimdal</freebsdsa>
|
|
<url>http://www.pdc.kth.se/heimdal/advisory/2004-04-01/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-04-01</discovery>
|
|
<entry>2004-04-02</entry>
|
|
<modified>2004-05-05</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="a2ffb627-9c53-11d8-9366-0020ed76ef5a">
|
|
<topic>lha buffer overflows and path traversal issues</topic>
|
|
<affects>
|
|
<package>
|
|
<name>lha</name>
|
|
<range><lt>1.14i_4</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Ulf Härnhammar discovered several vulnerabilities in
|
|
LHa for UNIX's path name handling code. Specially constructed
|
|
archive files may cause LHa to overwrite files or
|
|
execute arbitrary code with the privileges of the user
|
|
invoking LHa. This could be particularly harmful for
|
|
automated systems that might handle archives such as
|
|
virus scanning processes.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0234</cvename>
|
|
<cvename>CVE-2004-0235</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-04-29</discovery>
|
|
<entry>2004-05-02</entry>
|
|
<modified>2004-05-03</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="8338a20f-9573-11d8-9366-0020ed76ef5a">
|
|
<topic>xchat remotely exploitable buffer overflow (Socks5)</topic>
|
|
<affects>
|
|
<package>
|
|
<name>xchat2</name>
|
|
<range><ge>1.8</ge><lt>2.0.8_2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A straightforward stack buffer overflow exists in XChat's
|
|
Socks5 proxy support.</p>
|
|
<p>The XChat developers report that `tsifra' discovered this
|
|
issue.</p>
|
|
<p>NOTE: XChat Socks5 support is disabled by support in the
|
|
FreeBSD Ports Collection.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0409</cvename>
|
|
<url>http://xchat.org/files/source/2.0/patches/xc208-fixsocks5.diff</url>
|
|
<mlist msgid="20040405171305.04f19c44.zed@xchat.org">http://marc.theaimsgroup.com/?l=xchat-announce&m=108114935507357</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-04-05</discovery>
|
|
<entry>2004-04-23</entry>
|
|
<modified>2004-05-03</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="73ea0706-9c57-11d8-9366-0020ed76ef5a">
|
|
<topic>rsync path traversal issue</topic>
|
|
<affects>
|
|
<package>
|
|
<name>rsync</name>
|
|
<range><lt>2.6.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>When running rsync in daemon mode, no checks were made
|
|
to prevent clients from writing outside of a module's
|
|
`path' setting.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0426</cvename>
|
|
<url>http://rsync.samba.org/#security_apr04</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-04-26</discovery>
|
|
<entry>2004-05-02</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="e50b04e8-9c55-11d8-9366-0020ed76ef5a">
|
|
<topic>xine-lib arbitrary file overwrite</topic>
|
|
<affects>
|
|
<package>
|
|
<name>libxine</name>
|
|
<range><gt>0.9</gt><lt>1.0.r3_5</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>From the xinehq advisory:</p>
|
|
<blockquote cite="http://www.xinehq.de/index.php/security/XSA-2004-1">
|
|
<p>By opening a malicious MRL in any xine-lib based media
|
|
player, an attacker can write arbitrary content to an
|
|
arbitrary file, only restricted by the permissions of the
|
|
user running the application.</p>
|
|
</blockquote>
|
|
<p>The flaw is a result of a feature that allows MRLs (media
|
|
resource locator URIs) to specify arbitrary configuration
|
|
options.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>10193</bid>
|
|
<url>http://www.xinehq.de/index.php/security/XSA-2004-1</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-04-20</discovery>
|
|
<entry>2004-05-02</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="fb521119-9bc4-11d8-9366-0020ed76ef5a">
|
|
<topic>pound remotely exploitable vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>pound</name>
|
|
<range><lt>1.6</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>An unknown remotely exploitable vulnerability was disclosed.
|
|
Robert Segall writes:</p>
|
|
<blockquote cite="http://www.apsis.ch/pound/pound_list/archive/2003/2003-12/1070234315000">
|
|
<p>a security vulnerability was brought to my attention
|
|
(many thanks to Akira Higuchi). Everyone running any
|
|
previous version should upgrade to 1.6 immediately - the
|
|
vulnerability may allow a remote exploit. No exploits are
|
|
currently known and none have been observed in the wild
|
|
till now. The danger is minimised if you run Pound in a
|
|
root jail and/or you run Pound as non-root user.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<mlist>http://www.apsis.ch/pound/pound_list/archive/2003/2003-12/1070234315000</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2003-12-01</discovery>
|
|
<entry>2004-05-02</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="cfe17ca6-6858-4805-ba1d-a60a61ec9b4d">
|
|
<topic>phpBB IP address spoofing</topic>
|
|
<affects>
|
|
<package>
|
|
<name>phpbb</name>
|
|
<range><le>2.0.8_2</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The common.php script always trusts the `X-Forwarded-For'
|
|
header in the client's HTTP request. A remote user could
|
|
forge this header in order to bypass any IP address access
|
|
control lists (ACLs).</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<mlist msgid="20040419000129.28917.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&m=108239864203144</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-04-18</discovery>
|
|
<entry>2004-04-23</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="c7705712-92e6-11d8-8b29-0020ed76ef5a">
|
|
<topic>TCP denial-of-service attacks against long lived connections</topic>
|
|
<affects>
|
|
<system>
|
|
<name>FreeBSD</name>
|
|
<range><ge>0</ge></range>
|
|
</system>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p><a href="http://www.niscc.gov.uk/">NISCC</a> /
|
|
<a href="http://www.uniras.gov.uk/">UNIRAS</a> has published
|
|
an advisory that re-visits the long discussed spoofed TCP RST
|
|
denial-of-service vulnerability. This new look emphasizes
|
|
the fact that for some applications such attacks are
|
|
practically feasible.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0230</cvename>
|
|
<url>http://www.uniras.gov.uk/vuls/2004/236929/index.htm</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>1995-06-01</discovery>
|
|
<entry>2004-04-23</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="99230277-8fb4-11d8-8b29-0020ed76ef5a">
|
|
<topic>ident2 double byte buffer overflow</topic>
|
|
<affects>
|
|
<package>
|
|
<name>ident2</name>
|
|
<range><le>1.04</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Jack of RaptureSecurity reported a double byte buffer
|
|
overflow in ident2. The bug may allow a remote attacker to
|
|
execute arbitrary code within the context of the ident2
|
|
daemon. The daemon typically runs as user-ID `nobody', but
|
|
with group-ID `wheel'.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0408</cvename>
|
|
<url>http://cvsweb.freebsd.org/ports/security/ident2/files/patch-common.c</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-04-15</discovery>
|
|
<entry>2004-04-23</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="da6f265b-8f3d-11d8-8b29-0020ed76ef5a">
|
|
<topic>kdepim exploitable buffer overflow in VCF reader</topic>
|
|
<affects>
|
|
<package>
|
|
<name>kdepim</name>
|
|
<range><ge>3.1.0</ge><lt>3.1.4_1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A buffer overflow is present in some versions of the KDE
|
|
personal information manager (kdepim) which may be triggered
|
|
when processing a specially crafted VCF file.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2003-0988</cvename>
|
|
<url>http://www.kde.org/info/security/advisory-20040114-1.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-01-14</discovery>
|
|
<entry>2004-04-15</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="ccd698df-8e20-11d8-90d1-0020ed76ef5a">
|
|
<topic>racoon remote denial of service vulnerability (ISAKMP header length field)</topic>
|
|
<affects>
|
|
<package>
|
|
<name>racoon</name>
|
|
<range><lt>20040408a</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>When racoon receives an ISAKMP header, it will attempt to
|
|
allocate sufficient memory for the entire ISAKMP message
|
|
according to the header's length field. If an attacker
|
|
crafts an ISAKMP header with a ridiculously large value
|
|
in the length field, racoon may exceed operating system
|
|
resource limits and be terminated, resulting in a denial of
|
|
service.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0403</cvename>
|
|
<url>http://www.kame.net/dev/cvsweb2.cgi/kame/kame/kame/racoon/isakmp.c.diff?r1=1.180&r2=1.181</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-03-31</discovery>
|
|
<entry>2004-04-14</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="40fcf20f-8891-11d8-90d1-0020ed76ef5a">
|
|
<topic>racoon remote denial of service vulnerability (IKE Generic Payload Header)</topic>
|
|
<affects>
|
|
<package>
|
|
<name>racoon</name>
|
|
<range><lt>20040407b</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>When racoon receives an IKE message with an incorrectly
|
|
constructed Generic Payload Header, it may behave erratically,
|
|
going into a tight loop and dropping connections.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0392</cvename>
|
|
<url>http://orange.kame.net/dev/query-pr.cgi?pr=555</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2003-12-03</discovery>
|
|
<entry>2004-04-07</entry>
|
|
<modified>2004-04-14</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="f8551668-de09-4d7b-9720-f1360929df07">
|
|
<topic>tcpdump ISAKMP payload handling remote denial-of-service</topic>
|
|
<affects>
|
|
<package>
|
|
<name>tcpdump</name>
|
|
<range><lt>3.8.3</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>racoon</name>
|
|
<range><lt>20040408a</lt></range>
|
|
</package>
|
|
<system>
|
|
<name>FreeBSD</name>
|
|
<range><ge>0</ge></range>
|
|
</system>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Chad Loder has discovered vulnerabilities in tcpdump's
|
|
ISAKMP protocol handler. During an audit to repair these
|
|
issues, Bill Fenner discovered some related problems.</p>
|
|
<p>These vulnerabilities may be used by an attacker to crash a
|
|
running `tcpdump' process. They can only be triggered if
|
|
the `-v' command line option is being used.</p>
|
|
<p>NOTE: the racoon ISAKMP/IKE daemon incorporates the ISAKMP
|
|
protocol handler from tcpdump, and so is also affected by
|
|
this issue.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<mlist>http://marc.theaimsgroup.com/?l=bugtraq&m=108067265931525</mlist>
|
|
<url>http://www.rapid7.com/advisories/R7-0017.html</url>
|
|
<cvename>CVE-2004-0183</cvename>
|
|
<cvename>CVE-2004-0184</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-03-12</discovery>
|
|
<entry>2004-03-31</entry>
|
|
<modified>2004-04-14</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="322d4ff6-85c3-11d8-a41f-0020ed76ef5a">
|
|
<topic>Midnight Commander buffer overflow during symlink resolution</topic>
|
|
<affects>
|
|
<package>
|
|
<name>mc</name>
|
|
<range><lt>4.6.0_9</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Midnight Commander uses a fixed sized stack buffer while
|
|
resolving symbolic links within file archives (tar or cpio).
|
|
If an attacker can cause a user to process a specially
|
|
crafted file archive with Midnight Commander,
|
|
the attacker may be able to obtain the privileges of the
|
|
target user.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2003-1023</cvename>
|
|
<mlist msgid="E1A0LbX-000NPk-00.alienhard-mail-ru@f9.mail.ru">http://marc.theaimsgroup.com/?l=bugtraq&m=106399528518704</mlist>
|
|
<bid>8658</bid>
|
|
</references>
|
|
<dates>
|
|
<discovery>2003-09-19</discovery>
|
|
<entry>2004-04-03</entry>
|
|
<modified>2004-04-13</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="d8769838-8814-11d8-90d1-0020ed76ef5a">
|
|
<topic>racoon fails to verify signature during Phase 1</topic>
|
|
<affects>
|
|
<package>
|
|
<name>racoon</name>
|
|
<range><lt>20040407b</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Ralf Spenneberg discovered a serious flaw in racoon.
|
|
When using Phase 1 main or aggressive mode, racoon does
|
|
not verify the client's RSA signature. Any installations
|
|
using <em>X.509 authentication</em> are <strong>strongly
|
|
urged</strong> to upgrade.</p>
|
|
<p>Installations using <em>pre-shared keys</em> are believed
|
|
to be unaffected.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0155</cvename>
|
|
<url>http://www.kame.net/dev/cvsweb2.cgi/kame/kame/kame/racoon/crypto_openssl.c?rev=1.84&content-type=text/x-cvsweb-markup</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-04-05</discovery>
|
|
<entry>2004-04-07</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="6fd02439-5d70-11d8-80e3-0020ed76ef5a">
|
|
<topic>Several remotely exploitable buffer overflows in gaim</topic>
|
|
<affects>
|
|
<package>
|
|
<name>gaim</name>
|
|
<name>ja-gaim</name>
|
|
<name>ko-gaim</name>
|
|
<name>ru-gaim</name>
|
|
<range><lt>0.75_3</lt></range>
|
|
<range><eq>0.75_5</eq></range>
|
|
<range><eq>0.76</eq></range>
|
|
</package>
|
|
<package>
|
|
<name>gaim</name>
|
|
<range><ge>20030000</ge></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Stefan Esser of e-matters found almost a dozen remotely
|
|
exploitable vulnerabilities in Gaim. From the e-matters
|
|
advisory:</p>
|
|
<blockquote cite="http://security.e-matters.de/advisories/012004.txt">
|
|
<p>While developing a custom add-on, an integer overflow
|
|
in the handling of AIM DirectIM packets was revealed that
|
|
could lead to a remote compromise of the IM client. After
|
|
disclosing this bug to the vendor, they had to make a
|
|
hurried release because of a change in the Yahoo connection
|
|
procedure that rendered GAIM useless. Unfourtunately at the
|
|
same time a closer look onto the sourcecode revealed 11 more
|
|
vulnerabilities.</p>
|
|
|
|
<p>The 12 identified problems range from simple standard
|
|
stack overflows, over heap overflows to an integer overflow
|
|
that can be abused to cause a heap overflow. Due to the
|
|
nature of instant messaging many of these bugs require
|
|
man-in-the-middle attacks between client and server. But the
|
|
underlying protocols are easy to implement and MIM attacks
|
|
on ordinary TCP sessions is a fairly simple task.</p>
|
|
|
|
<p>In combination with the latest kernel vulnerabilities or
|
|
the habit of users to work as root/administrator these bugs
|
|
can result in remote root compromises.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://security.e-matters.de/advisories/012004.txt</url>
|
|
<cvename>CVE-2004-0005</cvename>
|
|
<cvename>CVE-2004-0006</cvename>
|
|
<cvename>CVE-2004-0007</cvename>
|
|
<cvename>CVE-2004-0008</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-01-26</discovery>
|
|
<entry>2004-02-12</entry>
|
|
<modified>2004-10-25</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="290d81b9-80f1-11d8-9645-0020ed76ef5a">
|
|
<topic>oftpd denial-of-service vulnerability (PORT command)</topic>
|
|
<affects>
|
|
<package>
|
|
<name>oftpd</name>
|
|
<range><lt>0.3.7</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Philippe Oechslin reported a denial-of-service vulnerability
|
|
in oftpd. The oftpd server can be crashed by sending a PORT
|
|
command containing an integer over 8 bits long (over 255).</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://www.time-travellers.org/oftpd/oftpd-dos.html</url>
|
|
<bid>9980</bid>
|
|
<cvename>CVE-2004-0376</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-03-04</discovery>
|
|
<entry>2004-03-28</entry>
|
|
<modified>2004-04-05</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="705e003a-7f36-11d8-9645-0020ed76ef5a">
|
|
<topic>squid ACL bypass due to URL decoding bug</topic>
|
|
<affects>
|
|
<package>
|
|
<name>squid</name>
|
|
<range><lt>squid-2.5.5</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>From the Squid advisory:</p>
|
|
<blockquote cite="http://www.squid-cache.org/Advisories/SQUID-2004_1.txt">
|
|
<p>Squid versions 2.5.STABLE4 and earlier contain a bug
|
|
in the "%xx" URL decoding function. It may insert a NUL
|
|
character into decoded URLs, which may allow users to bypass
|
|
url_regex ACLs.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://www.squid-cache.org/Advisories/SQUID-2004_1.txt</url>
|
|
<cvename>CVE-2004-0189</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-02-29</discovery>
|
|
<entry>2004-03-26</entry>
|
|
<modified>2004-03-30</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="cad045c0-81a5-11d8-9645-0020ed76ef5a">
|
|
<topic>zebra/quagga denial of service vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>zebra</name>
|
|
<range><lt>0.93b_7</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>quagga</name>
|
|
<range><lt>0.96.4</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A remote attacker could cause zebra/quagga to crash by
|
|
sending a malformed telnet command to their management
|
|
port.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2003-0858</cvename>
|
|
<url>http://rhn.redhat.com/errata/RHSA-2003-305.html</url>
|
|
<url>http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=107140</url>
|
|
<mlist>http://lists.quagga.net/pipermail/quagga-users/2003-November/000906.html</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2003-11-20</discovery>
|
|
<entry>2004-03-29</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="c551ae17-7f00-11d8-868e-000347dd607f">
|
|
<topic>multiple vulnerabilities in phpBB</topic>
|
|
<affects>
|
|
<package>
|
|
<name>phpbb</name>
|
|
<range><lt>2.0.8</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Users with admin rights can severly damage an phpBB installation,
|
|
potentially triggered by viewing a page with a malicious link sent
|
|
by an attacker.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://www.gulftech.org/03202004.php</url>
|
|
<url>http://www.phpbb.com/phpBB/viewtopic.php?t=183982</url>
|
|
<bid>9942</bid>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-03-20</discovery>
|
|
<entry>2004-03-26</entry>
|
|
<modified>2004-03-29</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="c480eb5e-7f00-11d8-868e-000347dd607f">
|
|
<topic>ezbounce remote format string vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>ezbounce</name>
|
|
<range><lt>1.04.a_1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A security hole exists that can be used to crash the proxy and
|
|
execute arbitrary code. An exploit is circulating that takes
|
|
advantage of this, and in some cases succeeds in obtaining a login
|
|
shell on the machine.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2003-0510</cvename>
|
|
<url>http://ezbounce.dc-team.com/</url>
|
|
<bid>8071</bid>
|
|
</references>
|
|
<dates>
|
|
<discovery>2003-07-01</discovery>
|
|
<entry>2004-03-26</entry>
|
|
<modified>2004-03-29</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="739bb51d-7e82-11d8-9645-0020ed76ef5a">
|
|
<topic>racoon security association deletion vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>racoon</name>
|
|
<range><lt>20040116a</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A remote attacker may use specially crafted IKE/ISAKMP
|
|
messages to cause racoon to delete security associations.
|
|
This could result in denial-of-service or possibly cause
|
|
sensitive traffic to be transmitted in plaintext, depending
|
|
upon configuration.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<mlist msgid="20040113213940.GA1727@hzeroseven.org">http://www.securityfocus.com/archive/1/349756</mlist>
|
|
<bid>9416</bid>
|
|
<bid>9417</bid>
|
|
<cvename>CVE-2004-0164</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-01-13</discovery>
|
|
<entry>2004-03-25</entry>
|
|
<modified>2004-03-29</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="3b7c7f6c-7102-11d8-873f-0020ed76ef5a">
|
|
<topic>wu-ftpd ftpaccess `restricted-uid'/`restricted-gid' directive may be bypassed</topic>
|
|
<affects>
|
|
<package>
|
|
<name>wu-ftpd</name>
|
|
<range><le>2.6.2_3</le></range>
|
|
</package>
|
|
<package>
|
|
<name>wu-ftpd+ipv6</name>
|
|
<range><le>2.6.2_5</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Glenn Stewart reports a bug in wu-ftpd's ftpaccess
|
|
`restricted-uid'/`restricted-gid' directives:</p>
|
|
<blockquote>
|
|
<p>Users can get around the restriction to their home
|
|
directory by issuing a simple chmod command on their home
|
|
directory. On the next ftp log in, the user will have '/'
|
|
as their root directory.</p>
|
|
</blockquote>
|
|
<p>Matt Zimmerman discovered that the cause of the bug was a
|
|
missing check for a restricted user within a code path that
|
|
is executed only when a certain error is encountered.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0148</cvename>
|
|
<bid>9832</bid>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-02-17</discovery>
|
|
<entry>2004-03-08</entry>
|
|
<modified>2004-03-29</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="8471bb85-6fb0-11d8-873f-0020ed76ef5a">
|
|
<topic>GNU Anubis buffer overflows and format string vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>anubis</name>
|
|
<range><le>3.6.2_1</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Ulf Härnhammar discovered several vulnerabilities in GNU
|
|
Anubis.</p>
|
|
<ul>
|
|
<li>Unsafe uses of `sscanf'. The `%s' format specifier is
|
|
used, which allows a classical buffer overflow. (auth.c)</li>
|
|
<li>Format string bugs invoking `syslog'. (log.c, errs.c,
|
|
ssl.c)</li>
|
|
</ul>
|
|
<p>Ulf notes that these vulnerabilities can be exploited by a
|
|
malicious IDENT server as a denial-of-service attack.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<mlist>http://lists.netsys.com/pipermail/full-disclosure/2004-March/018290.html</mlist>
|
|
<bid>9772</bid>
|
|
<cvename>CVE-2004-0353</cvename>
|
|
<cvename>CVE-2004-0354</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-03-04</discovery>
|
|
<entry>2004-03-06</entry>
|
|
<modified>2004-03-29</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="3837f462-5d6b-11d8-80e3-0020ed76ef5a">
|
|
<topic>Buffer overflows in XFree86 servers</topic>
|
|
<affects>
|
|
<package>
|
|
<name>XFree86-Server</name>
|
|
<range><le>4.3.0_13</le></range>
|
|
<range><ge>4.3.99</ge><le>4.3.99.15_1</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A number of buffer overflows were recently discovered in
|
|
XFree86, prompted by initial discoveries by iDEFENSE. These
|
|
buffer overflows are present in the font alias handling. An
|
|
attacker with authenticated access to a running X server may
|
|
exploit these vulnerabilities to obtain root privileges on
|
|
the machine running the X server.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://www.idefense.com/application/poi/display?id=72</url>
|
|
<url>http://www.idefense.com/application/poi/display?id=73</url>
|
|
<cvename>CVE-2004-0083</cvename>
|
|
<cvename>CVE-2004-0084</cvename>
|
|
<cvename>CVE-2004-0106</cvename>
|
|
<bid>9636</bid>
|
|
<bid>9652</bid>
|
|
<bid>9655</bid>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-02-10</discovery>
|
|
<entry>2004-02-12</entry>
|
|
<modified>2004-03-29</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="e25566d5-6d3f-11d8-83a4-000a95bc6fae">
|
|
<topic>multiple buffer overflows in xboing</topic>
|
|
<affects>
|
|
<package>
|
|
<name>xboing</name>
|
|
<range><lt>2.4_2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Steve Kemp reports (in a Debian bug submission):</p>
|
|
<blockquote cite="http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=174924">
|
|
<p>Due to improper bounds checking it is possible for a
|
|
malicious user to gain a shell with membership group
|
|
'games'. (The binary is installed setgid games).</p>
|
|
<p>Environmental variables are used without being bounds-checked
|
|
in any way, from the source code:</p>
|
|
<pre>
|
|
highscore.c:
|
|
/* Use the environment variable if it exists */
|
|
if ((str = getenv("XBOING_SCORE_FILE")) != NULL)
|
|
strcpy(filename, str);
|
|
else
|
|
strcpy(filename, HIGH_SCORE_FILE);
|
|
|
|
misc.c:
|
|
if ((ptr = getenv("HOME")) != NULL)
|
|
(void) strcpy(dest, ptr);
|
|
</pre>
|
|
<p>Neither of these checks are boundschecked, and will allow
|
|
arbitary shell code to be run.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0149</cvename>
|
|
<url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=174924</url>
|
|
<bid>9764</bid>
|
|
</references>
|
|
<dates>
|
|
<discovery>2003-01-01</discovery>
|
|
<entry>2004-03-05</entry>
|
|
<modified>2004-03-29</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="a20082c3-6255-11d8-80e3-0020ed76ef5a">
|
|
<topic>metamail format string bugs and buffer overflows</topic>
|
|
<affects>
|
|
<package>
|
|
<name>metamail</name>
|
|
<range><lt>2.7_2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Ulf Härnhammar reported four bugs in metamail: two are format
|
|
string bugs and two are buffer overflows. The bugs are in
|
|
SaveSquirrelFile(), PrintHeader(), and ShareThisHeader().</p>
|
|
<p>These vulnerabilities could be triggered by a maliciously
|
|
formatted email message if `metamail' or `splitmail' is used
|
|
to process it, possibly resulting in arbitrary code execution
|
|
with the privileges of the user reading mail.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0104</cvename>
|
|
<cvename>CVE-2004-0105</cvename>
|
|
<bid>9692</bid>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-02-18</discovery>
|
|
<entry>2004-02-18</entry>
|
|
<modified>2004-03-29</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="ce46b93a-80f2-11d8-9645-0020ed76ef5a">
|
|
<topic>Buffer overflows and format string bugs in Emil</topic>
|
|
<affects>
|
|
<package>
|
|
<name>emil</name>
|
|
<range><le>2.1b9</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Ulf Härnhammar reports multiple buffer overflows in
|
|
Emil, some of which are triggered during the parsing
|
|
of attachment filenames. In addition, some format string bugs
|
|
are present in the error reporting code.</p>
|
|
<p>Depending upon local configuration, these vulnerabilities
|
|
may be exploited using specially crafted messages in order
|
|
to execute arbitrary code running with the privileges of
|
|
the user invoking Emil.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<mlist>http://lists.netsys.com/pipermail/full-disclosure/2004-March/019325.html</mlist>
|
|
<url>http://www.debian.org/security/2004/dsa-468</url>
|
|
<cvename>CVE-2004-0152</cvename>
|
|
<cvename>CVE-2004-0153</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-03-24</discovery>
|
|
<entry>2004-03-28</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="70f5b3c6-80f0-11d8-9645-0020ed76ef5a">
|
|
<topic>Critical SQL injection in phpBB</topic>
|
|
<affects>
|
|
<package>
|
|
<name>phpbb</name>
|
|
<range><le>2.0.8</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Anyone can get admin's username and password's md5 hash via a
|
|
single web request.
|
|
A working example is provided in the advisory.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<mlist>http://marc.theaimsgroup.com/?l=bugtraq&m=108032454818873</mlist>
|
|
<bid>9984</bid>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-03-26</discovery>
|
|
<entry>2004-03-28</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="6c7661ff-7912-11d8-9645-0020ed76ef5a">
|
|
<topic>uudeview buffer overflows</topic>
|
|
<affects>
|
|
<package>
|
|
<name>uulib</name>
|
|
<name>uudeview</name>
|
|
<name>xdeview</name>
|
|
<range><lt>0.5.20</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The authors of UUDeview report repairing two buffer
|
|
overflows in their software.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://www.fpx.de/fp/Software/UUDeview/HISTORY.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-03-01</discovery>
|
|
<entry>2004-03-18</entry>
|
|
<modified>2004-03-25</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="09d418db-70fd-11d8-873f-0020ed76ef5a">
|
|
<topic>Apache 1.3 IP address access control failure on some 64-bit platforms</topic>
|
|
<affects>
|
|
<package>
|
|
<name>apache</name>
|
|
<range><lt>1.3.29_2</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>apache+mod_ssl</name>
|
|
<range><lt>1.3.29+2.8.16_1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>apache+ssl</name>
|
|
<range><lt>1.3.29.1.53_1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>ru-apache</name>
|
|
<range><lt>1.3.29+30.19_1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>ru-apache+mod_ssl</name>
|
|
<range><lt>1.3.29+30.19+2.8.16_1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Henning Brauer discovered a programming error in Apache
|
|
1.3's mod_access that results in the netmasks in IP address
|
|
access control rules being interpreted incorrectly on
|
|
64-bit, big-endian platforms. In some cases, this could
|
|
cause a `deny from' IP address access control rule including
|
|
a netmask to fail.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2003-0993</cvename>
|
|
<url>http://cvs.apache.org/viewcvs.cgi/apache-1.3/src/modules/standard/mod_access.c?r1=1.46&r2=1.47</url>
|
|
<url>http://www.apacheweek.com/features/security-13</url>
|
|
<url>http://nagoya.apache.org/bugzilla/show_bug.cgi?id=23850</url>
|
|
<mlist>http://marc.theaimsgroup.com/?l=apache-cvs&m=107869603013722</mlist>
|
|
<bid>9829</bid>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-03-07</discovery>
|
|
<entry>2004-03-08</entry>
|
|
<modified>2004-03-12</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="1a448eb7-6988-11d8-873f-0020ed76ef5a">
|
|
<topic>mod_python denial-of-service vulnerability in parse_qs</topic>
|
|
<affects>
|
|
<package>
|
|
<name>mod_python</name>
|
|
<range><ge>2.7</ge><lt>2.7.10</lt></range>
|
|
<range><ge>3.0</ge><lt>3.0.4</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>An attacker may cause Apache with mod_python to crash
|
|
by using a specially constructed query string.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2003-0973</cvename>
|
|
<bid>9129</bid>
|
|
<url>http://www.modpython.org/pipermail/mod_python/2003-November/014532.html</url>
|
|
<url>http://www.modpython.org/pipermail/mod_python/2004-January/014879.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2003-11-28</discovery>
|
|
<entry>2004-03-03</entry>
|
|
<modified>2004-03-11</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="9fccad5a-7096-11d8-873f-0020ed76ef5a">
|
|
<topic>mpg123 vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>mpg123</name>
|
|
<name>mpg123-nas</name>
|
|
<name>mpg123-esound</name>
|
|
<range><le>0.59r_12</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>In 2003, two vulnerabilities were discovered in mpg123
|
|
that could result in remote code execution when using
|
|
untrusted input or streaming from an untrusted server.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2003-0577</cvename>
|
|
<cvename>CVE-2003-0865</cvename>
|
|
<bid>6629</bid>
|
|
<bid>8680</bid>
|
|
</references>
|
|
<dates>
|
|
<discovery>2003-01-16</discovery>
|
|
<entry>2004-03-07</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="ac4b9d18-67a9-11d8-80e3-0020ed76ef5a">
|
|
<topic>fetchmail -- denial-of-service vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>fetchmail</name>
|
|
<range><lt>6.2.5</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Dave Jones discovered a denial-of-service vulnerability
|
|
in fetchmail. An email message containing a very long line
|
|
could cause fetchmail to segfault due to missing NUL
|
|
termination in transact.c.</p>
|
|
<p>Eric Raymond decided not to mention this issue in the
|
|
release notes for fetchmail 6.2.5, but it was fixed
|
|
there.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2003-0792</cvename>
|
|
<bid>8843</bid>
|
|
<url>http://xforce.iss.net/xforce/xfdb/13450</url>
|
|
<url>http://www.openbsd.org/cgi-bin/cvsweb/ports/mail/fetchmail/patches/Attic/patch-rfc822_c?rev=1.1</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2003-10-16</discovery>
|
|
<entry>2004-02-25</entry>
|
|
<modified>2012-09-04</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="b0e76877-67a8-11d8-80e3-0020ed76ef5a">
|
|
<topic>mailman denial-of-service vulnerability in MailCommandHandler</topic>
|
|
<affects>
|
|
<package>
|
|
<name>mailman</name>
|
|
<range><lt>2.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A malformed message could cause mailman to crash.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2003-0991</cvename>
|
|
<url>http://umn.dl.sourceforge.net/sourceforge/mailman/mailman-2.0.13-2.0.14-diff.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2003-11-18</discovery>
|
|
<entry>2004-02-25</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="3cb88bb2-67a6-11d8-80e3-0020ed76ef5a">
|
|
<topic>mailman XSS in admin script</topic>
|
|
<affects>
|
|
<package>
|
|
<name>mailman</name>
|
|
<range><lt>2.1.4</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Dirk Mueller reports:</p>
|
|
<blockquote><p>I've found a cross-site scripting
|
|
vulnerability in the admin interface of mailman 2.1.3 that
|
|
allows, under certain circumstances, for anyone to retrieve
|
|
the (valid) session cookie.</p></blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2003-0965</cvename>
|
|
<url>http://mail.python.org/pipermail/mailman-announce/2003-December/000066.html</url>
|
|
<url>http://xforce.iss.net/xforce/xfdb/14121</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2003-12-31</discovery>
|
|
<entry>2004-02-25</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="429249d2-67a7-11d8-80e3-0020ed76ef5a">
|
|
<topic>mailman XSS in create script</topic>
|
|
<affects>
|
|
<package>
|
|
<name>mailman</name>
|
|
<range><lt>2.1.3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>From the 2.1.3 release notes:</p>
|
|
<blockquote><p>Closed a cross-site scripting exploit in the
|
|
create cgi script.</p></blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2003-0992</cvename>
|
|
<url>http://mail.python.org/pipermail/mailman-announce/2003-September/000061.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2003-09-28</discovery>
|
|
<entry>2004-02-25</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="00263aa3-67a8-11d8-80e3-0020ed76ef5a">
|
|
<topic>mailman XSS in user options page</topic>
|
|
<affects>
|
|
<package>
|
|
<name>mailman</name>
|
|
<range><lt>2.1.1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>From the 2.1.1 release notes:</p>
|
|
<blockquote><p>Closed a cross-site scripting vulnerability in
|
|
the user options page.</p></blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2003-0038</cvename>
|
|
<url>http://mail.python.org/pipermail/mailman-announce/2003-February/000056.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2003-02-08</discovery>
|
|
<entry>2004-02-25</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="75770425-67a2-11d8-80e3-0020ed76ef5a">
|
|
<topic>SQL injection vulnerability in phpnuke</topic>
|
|
<affects>
|
|
<package>
|
|
<name>phpnuke</name>
|
|
<range><le>6.9</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Multiple researchers have discovered multiple SQL injection
|
|
vulnerabilities in some versions of Php-Nuke. These
|
|
vulnerabilities may lead to information disclosure, compromise
|
|
of the Php-Nuke site, or compromise of the back-end
|
|
database.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://security.nnov.ru/search/document.asp?docid=5748</url>
|
|
<mlist>http://www.securityfocus.com/archive/1/348375</mlist>
|
|
<url>http://www.security-corporation.com/advisories-027.html</url>
|
|
<mlist>http://www.securityfocus.com/archive/1/353201</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2003-12-12</discovery>
|
|
<entry>2004-02-25</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="ad4f6ca4-6720-11d8-9fb5-000a95bc6fae">
|
|
<topic>lbreakout2 vulnerability in environment variable handling</topic>
|
|
<affects>
|
|
<package>
|
|
<name>lbreakout2</name>
|
|
<range><le>2.2.2_1</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Ulf Härnhammar discovered an exploitable vulnerability in
|
|
lbreakout2's environmental variable handling. In several
|
|
instances, the contents of the HOME environmental variable
|
|
are copied to a stack or global buffer without range
|
|
checking. A local attacker may use this vulnerability to
|
|
acquire group-ID `games' privileges.</p>
|
|
<p>An exploit for this vulnerability has been published by
|
|
``Li0n7 voila fr''.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0158</cvename>
|
|
<url>http://www.debian.org/security/2004/dsa-445</url>
|
|
<mlist>http://www.securityfocus.com/archive/1/354760</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-02-21</discovery>
|
|
<entry>2004-02-25</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="316e1c9b-671c-11d8-9aad-000a95bc6fae">
|
|
<topic>hsftp format string vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>hsftp</name>
|
|
<range><lt>1.14</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Ulf Härnhammar discovered a format string bug in hsftp's file
|
|
listing code may allow a malicious server to cause arbitrary
|
|
code execution by the client.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<mlist>http://lists.debian.org/debian-security-announce/debian-security-announce-2004/msg00044.html</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-02-22</discovery>
|
|
<entry>2004-02-25</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="c7cad0f0-671a-11d8-bdeb-000a95bc6fae">
|
|
<topic>Darwin Streaming Server denial-of-service vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>DarwinStreamingServer</name>
|
|
<range><le>4.1.3g</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>An attacker can cause an assertion to trigger by sending
|
|
a long User-Agent field in a request.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0169</cvename>
|
|
<url>http://www.idefense.com/application/poi/display?id=75</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-02-23</discovery>
|
|
<entry>2004-02-25</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="847ade05-6717-11d8-b321-000a95bc6fae">
|
|
<topic>libxml2 stack buffer overflow in URI parsing</topic>
|
|
<affects>
|
|
<package>
|
|
<name>libxml2</name>
|
|
<range><lt>2.6.6</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Yuuichi Teranishi reported a crash in libxml2's URI handling
|
|
when a long URL is supplied. The implementation in nanohttp.c
|
|
and nanoftp.c uses a 4K stack buffer, and longer URLs will
|
|
overwrite the stack. This could result in denial-of-service
|
|
or arbitrary code execution in applications using libxml2
|
|
to parse documents.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0110</cvename>
|
|
<url>http://www.xmlsoft.org/news.html</url>
|
|
<url>http://mail.gnome.org/archives/xml/2004-February/msg00070.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-02-08</discovery>
|
|
<entry>2004-02-25</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="cc0fb686-6550-11d8-80e3-0020ed76ef5a">
|
|
<topic>file disclosure in phpMyAdmin</topic>
|
|
<affects>
|
|
<package>
|
|
<name>phpMyAdmin</name>
|
|
<range><le>2.5.4</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Lack of proper input validation in phpMyAdmin may allow an
|
|
attacker to obtain the contents of any file on the target
|
|
system that is readable by the web server.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0129</cvename>
|
|
<mlist>http://marc.theaimsgroup.com/?l=bugtraq&m=107582619125932&w=2</mlist>
|
|
<url>http://cvs.sourceforge.net/viewcvs.py/phpmyadmin/phpMyAdmin/export.php#rev2.3.2.1</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-02-17</discovery>
|
|
<entry>2004-02-22</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="87cc48fd-5fdd-11d8-80e3-0020ed76ef5a">
|
|
<topic>mnGoSearch buffer overflow in UdmDocToTextBuf()</topic>
|
|
<affects>
|
|
<package>
|
|
<name>mnogosearch</name>
|
|
<range><ge>3.2.*</ge><lt>3.2.15</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Jedi/Sector One <j@pureftpd.org> reported the following
|
|
on the full-disclosure list:</p>
|
|
<blockquote>
|
|
<p>Every document is stored in multiple parts according to
|
|
its sections (description, body, etc) in databases. And
|
|
when the content has to be sent to the client,
|
|
UdmDocToTextBuf() concatenates those parts together and
|
|
skips metadata.</p>
|
|
<p>Unfortunately, that function lacks bounds checking and
|
|
a buffer overflow can be triggered by indexing a large
|
|
enough document.</p>
|
|
<p>'len' is fixed to 10K [in UdmDocToTextBuf] in searchd.c
|
|
. S->val length depends on the length of the original
|
|
document and on the indexer settings (the sample
|
|
configuration file has low limits that work around the
|
|
bug, though).</p>
|
|
<p>Exploitation should be easy, moreover textbuf points to
|
|
the stack.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<mlist>http://lists.netsys.com/pipermail/full-disclosure/2004-February/017366.html</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-02-15</discovery>
|
|
<entry>2004-02-15</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="cacaffbc-5e64-11d8-80e3-0020ed76ef5a">
|
|
<topic>GNU libtool insecure temporary file handling</topic>
|
|
<affects>
|
|
<package>
|
|
<name>libtool</name>
|
|
<range><ge>1.3</ge><lt>1.3.5_2</lt></range>
|
|
<range><ge>1.4</ge><lt>1.4.3_3</lt></range>
|
|
<range><ge>1.5</ge><lt>1.5.2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>libtool attempts to create a temporary directory in
|
|
which to write scratch files needed during processing. A
|
|
malicious user may create a symlink and then manipulate
|
|
the directory so as to write to files to which she normally
|
|
has no permissions.</p>
|
|
<p>This has been reported as a ``symlink vulnerability'',
|
|
although I do not think that is an accurate description.</p>
|
|
<p>This vulnerability could possibly be used on a multi-user
|
|
system to gain elevated privileges, e.g. root builds some
|
|
packages, and another user successfully exploits this
|
|
vulnerability to write to a system file.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<mlist>http://www.geocrawler.com/mail/msg.php3?msg_id=3438808&list=405</mlist>
|
|
<mlist>http://www.securityfocus.com/archive/1/352333</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-01-30</discovery>
|
|
<entry>2004-02-13</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="0e154a9c-5d7a-11d8-80e3-0020ed76ef5a">
|
|
<topic>seti@home remotely exploitable buffer overflow</topic>
|
|
<affects>
|
|
<package>
|
|
<name>setiathome</name>
|
|
<range><lt>3.0.8</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The seti@home client contains a buffer overflow in the HTTP
|
|
response handler. A malicious, spoofed seti@home server can
|
|
exploit this buffer overflow to cause remote code execution
|
|
on the client. Exploit programs are widely available.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://setiathome.berkeley.edu/version308.html</url>
|
|
<url>http://web.archive.org/web/20030609204812/http://spoor12.edup.tudelft.nl/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2003-04-08</discovery>
|
|
<entry>2004-02-12</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="5e92e8a2-5d7b-11d8-80e3-0020ed76ef5a">
|
|
<topic>icecast 1.x multiple vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>icecast</name>
|
|
<range><lt>1.3.12</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>icecast 1.3.11 and earlier contained numerous security
|
|
vulnerabilities, the most severe allowing a remote attacker
|
|
to execute arbitrary code as root.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2002-0177</cvename>
|
|
<cvename>CVE-2001-1230</cvename>
|
|
<cvename>CVE-2001-1229</cvename>
|
|
<cvename>CVE-2001-1083</cvename>
|
|
<cvename>CVE-2001-0784</cvename>
|
|
<bid>4415</bid>
|
|
<bid>2933</bid>
|
|
</references>
|
|
<dates>
|
|
<discovery>2002-04-28</discovery>
|
|
<entry>2004-02-12</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="83119e27-5d7c-11d8-80e3-0020ed76ef5a">
|
|
<topic>nap allows arbitrary file access</topic>
|
|
<affects>
|
|
<package>
|
|
<name>nap</name>
|
|
<range><lt>1.4.5</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>According to the author:</p>
|
|
<blockquote>
|
|
<p>Fixed security loophole which allowed remote
|
|
clients to access arbitrary files on our
|
|
system.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://quasar.mathstat.uottawa.ca/~selinger/nap/NEWS</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2001-04-12</discovery>
|
|
<entry>2004-02-12</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="a736deab-5d7d-11d8-80e3-0020ed76ef5a">
|
|
<topic>CCE contains exploitable buffer overflows</topic>
|
|
<affects>
|
|
<package>
|
|
<name>zh-cce</name>
|
|
<range><lt>0.40</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The Chinese Console Environment contains exploitable buffer
|
|
overflows.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://programmer.lib.sjtu.edu.cn/cce/cce.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2000-06-22</discovery>
|
|
<entry>2004-02-12</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="49ad1bf8-5d7e-11d8-80e3-0020ed76ef5a">
|
|
<topic>ChiTeX/ChiLaTeX unsafe set-user-id root</topic>
|
|
<affects>
|
|
<package>
|
|
<name>zh-chitex</name>
|
|
<range><gt>0</gt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Niels Heinen reports that ChiTeX installs set-user-id root
|
|
executables that invoked system(3) without setting up the
|
|
environment, trivially allowing local root compromise.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://cvsweb.freebsd.org/ports/chinese/chitex/Attic/Makefile?rev=1.5&content-type=text/x-cvsweb-markup</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2003-04-25</discovery>
|
|
<entry>2004-02-12</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="5789a92e-5d7f-11d8-80e3-0020ed76ef5a">
|
|
<topic>pine remotely exploitable buffer overflow in newmail.c</topic>
|
|
<affects>
|
|
<package>
|
|
<name>zh-pine</name>
|
|
<name>iw-pine</name>
|
|
<name>pine</name>
|
|
<name>pine4-ssl</name>
|
|
<range><le>4.21</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Kris Kennaway reports a remotely exploitable buffer overflow
|
|
in newmail.c. Mike Silbersack submitted the fix.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://www.freebsd.org/cgi/cvsweb.cgi/ports/mail/pine4/Makefile?rev=1.43&content-type=text/x-cvsweb-markup</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2000-09-29</discovery>
|
|
<entry>2004-02-12</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="34134fd4-5d81-11d8-80e3-0020ed76ef5a">
|
|
<topic>pine insecure URL handling</topic>
|
|
<affects>
|
|
<package>
|
|
<name>pine</name>
|
|
<name>zh-pine</name>
|
|
<name>iw-pine</name>
|
|
<range><lt>4.44</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>An attacker may send an email message containing a specially
|
|
constructed URL that will execute arbitrary commands when
|
|
viewed.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<freebsdsa>SA-02:05.pine</freebsdsa>
|
|
</references>
|
|
<dates>
|
|
<discovery>2002-01-04</discovery>
|
|
<entry>2004-02-12</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="5abfee2d-5d82-11d8-80e3-0020ed76ef5a">
|
|
<topic>pine remote denial-of-service attack</topic>
|
|
<affects>
|
|
<package>
|
|
<name>pine</name>
|
|
<name>zh-pine</name>
|
|
<name>iw-pine</name>
|
|
<range><lt>4.50</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>An attacker may send a specially-formatted email message
|
|
that will cause pine to crash.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<mlist>http://marc.theaimsgroup.com/?l=bugtraq&m=103668430620531&w=2</mlist>
|
|
<cvename>CVE-2002-1320</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2002-10-23</discovery>
|
|
<entry>2004-02-12</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="39bd57e6-5d83-11d8-80e3-0020ed76ef5a">
|
|
<topic>pine remotely exploitable vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>pine</name>
|
|
<name>zh-pine</name>
|
|
<name>iw-pine</name>
|
|
<range><lt>4.58</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Pine versions prior to 4.58 are affected by two
|
|
vulnerabilities discovered by iDEFENSE, a buffer overflow
|
|
in mailview.c and an integer overflow in strings.c. Both
|
|
vulnerabilities can result in arbitrary code execution
|
|
when processing a malicious message.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2003-0720</cvename>
|
|
<cvename>CVE-2003-0721</cvename>
|
|
<url>http://www.idefense.com/application/poi/display?id=5</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2003-09-10</discovery>
|
|
<entry>2004-02-12</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="5729b8ed-5d75-11d8-80e3-0020ed76ef5a">
|
|
<topic>rsync buffer overflow in server mode</topic>
|
|
<affects>
|
|
<package>
|
|
<name>rsync</name>
|
|
<range><lt>2.5.7</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>When rsync is run in server mode, a buffer overflow could
|
|
allow a remote attacker to execute arbitrary code with the
|
|
privileges of the rsync server. Anonymous rsync servers are
|
|
at the highest risk.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2003-0962</cvename>
|
|
<mlist>http://lists.samba.org/archive/rsync-announce/2003/000011.html</mlist>
|
|
<url>http://rsync.samba.org/#security</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2003-12-04</discovery>
|
|
<entry>2004-02-12</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="3388eff9-5d6e-11d8-80e3-0020ed76ef5a">
|
|
<topic>Samba 3.0.x password initialization bug</topic>
|
|
<affects>
|
|
<package>
|
|
<name>samba</name>
|
|
<range><ge>3.0,1</ge><lt>3.0.1_2,1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>From the Samba 3.0.2 release notes:</p>
|
|
<blockquote cite="http://www.samba.org/samba/whatsnew/samba-3.0.2.html">
|
|
<p>Security Announcement: It has been confirmed that
|
|
previous versions of Samba 3.0 are susceptible to a password
|
|
initialization bug that could grant an attacker unauthorized
|
|
access to a user account created by the mksmbpasswd.sh shell
|
|
script.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://www.samba.org/samba/whatsnew/samba-3.0.2.html</url>
|
|
<cvename>CVE-2004-0082</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-02-09</discovery>
|
|
<entry>2004-02-12</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="67c05283-5d62-11d8-80e3-0020ed76ef5a">
|
|
<topic>Buffer overflow in Mutt 1.4</topic>
|
|
<affects>
|
|
<package>
|
|
<name>mutt</name>
|
|
<name>ja-mutt</name>
|
|
<range><ge>1.4</ge><lt>1.4.2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Mutt 1.4 contains a buffer overflow that could be exploited
|
|
with a specially formed message, causing Mutt to crash or
|
|
possibly execute arbitrary code.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-0078</cvename>
|
|
<url>http://www.mutt.org/news.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-02-11</discovery>
|
|
<entry>2004-02-12</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="7557a2b1-5d63-11d8-80e3-0020ed76ef5a">
|
|
<topic>Apache-SSL optional client certificate vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>apache+ssl</name>
|
|
<range><lt>1.3.29.1.53</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>From the Apache-SSL security advisory:</p>
|
|
<blockquote>
|
|
<p>If configured with SSLVerifyClient set to 1 or 3 (client
|
|
certificates optional) and SSLFakeBasicAuth, Apache-SSL
|
|
1.3.28+1.52 and all earlier versions would permit a
|
|
client to use real basic authentication to forge a client
|
|
certificate.</p>
|
|
|
|
<p>All the attacker needed is the "one-line DN" of a valid
|
|
user, as used by faked basic auth in Apache-SSL, and the
|
|
fixed password ("password" by default).</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://www.apache-ssl.org/advisory-20040206.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-02-06</discovery>
|
|
<entry>2004-02-10</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="96ba2dae-4ab0-11d8-96f2-0020ed76ef5a">
|
|
<topic>L2TP, ISAKMP, and RADIUS parsing vulnerabilities in tcpdump</topic>
|
|
<affects>
|
|
<package>
|
|
<name>tcpdump</name>
|
|
<range><lt>3.8.1_351</lt></range>
|
|
</package>
|
|
<system>
|
|
<name>FreeBSD</name>
|
|
<range><lt>5.2.1</lt></range>
|
|
</system>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Jonathan Heusser discovered vulnerabilities in tcpdump's
|
|
L2TP, ISAKMP, and RADIUS protocol handlers. These
|
|
vulnerabilities may be used by an attacker to crash a running
|
|
`tcpdump' process.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2003-0989</cvename>
|
|
<cvename>CVE-2003-1029</cvename>
|
|
<cvename>CVE-2004-0057</cvename>
|
|
<mlist>http://www.tcpdump.org/lists/workers/2003/12/msg00083.html</mlist>
|
|
<mlist>http://marc.theaimsgroup.com/?l=tcpdump-workers&m=107325073018070&w=2</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2003-12-24</discovery>
|
|
<entry>2004-01-19</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="fd376b8b-41e1-11d8-b096-0020ed76ef5a">
|
|
<topic>Buffer overflow in INN control message handling</topic>
|
|
<affects>
|
|
<package>
|
|
<name>inn</name>
|
|
<range><ge>2.4.*</ge><lt>2.4.1</lt></range>
|
|
</package>
|
|
<package>
|
|
<name>inn-stable</name>
|
|
<range><lt>20031022_1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A small, fixed-size stack buffer is used to construct a
|
|
filename based on a received control message. This could
|
|
result in a stack buffer overflow.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<mlist msgid="87d69v7222.fsf@windlord.stanford.edu">http://marc.theaimsgroup.com/?l=inn-workers&m=107351974008605</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-01-07</discovery>
|
|
<entry>2004-01-08</entry>
|
|
<modified>2004-10-21</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="cf0fb426-3f96-11d8-b096-0020ed76ef5a">
|
|
<topic>ProFTPD ASCII translation bug resulting in remote root compromise</topic>
|
|
<affects>
|
|
<package>
|
|
<name>proftpd</name>
|
|
<range><lt>1.2.8_1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A buffer overflow exists in the ProFTPD code that handles
|
|
translation of newline characters during ASCII-mode file
|
|
uploads. An attacker may exploit this buffer overflow by
|
|
uploading a specially crafted file, resulting in code
|
|
execution and ultimately a remote root compromise.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://xforce.iss.net/xforce/alerts/id/154</url>
|
|
<cvename>CVE-2003-0831</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2003-09-23</discovery>
|
|
<entry>2004-01-05</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="81313647-2d03-11d8-9355-0020ed76ef5a">
|
|
<topic>ElGamal sign+encrypt keys created by GnuPG can be compromised</topic>
|
|
<affects>
|
|
<package>
|
|
<name>gnupg</name>
|
|
<range><ge>1.0.2</ge><lt>1.2.3_4</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Any ElGamal sign+encrypt keys created by GnuPG contain a
|
|
cryptographic weakness that may allow someone to obtain
|
|
the private key. <strong>These keys should be considered
|
|
unusable and should be revoked.</strong></p>
|
|
<p>The following summary was written by Werner Koch, GnuPG
|
|
author:</p>
|
|
<blockquote cite="http://lists.gnupg.org/pipermail/gnupg-devel/2003-November/020570.html">
|
|
<p>Phong Nguyen identified a severe bug in the way GnuPG
|
|
creates and uses ElGamal keys for signing. This is
|
|
a significant security failure which can lead to a
|
|
compromise of almost all ElGamal keys used for signing.
|
|
Note that this is a real world vulnerability which will
|
|
reveal your private key within a few seconds.</p>
|
|
<p>...</p>
|
|
<p>Please <em>take immediate action and revoke your ElGamal
|
|
signing keys</em>. Furthermore you should take whatever
|
|
measures necessary to limit the damage done for signed or
|
|
encrypted documents using that key.</p>
|
|
<p>Note that the standard keys as generated by GnuPG (DSA
|
|
and ElGamal encryption) as well as RSA keys are NOT
|
|
vulnerable. Note also that ElGamal signing keys cannot
|
|
be generated without the use of a special flag to enable
|
|
hidden options and even then overriding a warning message
|
|
about this key type. See below for details on how to
|
|
identify vulnerable keys.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2003-0971</cvename>
|
|
<mlist>http://lists.gnupg.org/pipermail/gnupg-devel/2003-November/020570.html</mlist>
|
|
</references>
|
|
<dates>
|
|
<discovery>2003-11-27</discovery>
|
|
<entry>2003-12-12</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="96fdbf5b-2cfd-11d8-9355-0020ed76ef5a">
|
|
<topic>Mathopd buffer overflow</topic>
|
|
<affects>
|
|
<package>
|
|
<name>mathopd</name>
|
|
<range><lt>1.4p2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Mathopd contains a buffer overflow in the prepare_reply()
|
|
function that may be remotely exploitable.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://www.mail-archive.com/mathopd%40mathopd.org/msg00136.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2003-12-04</discovery>
|
|
<entry>2003-12-12</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="d7af61c8-2cc0-11d8-9355-0020ed76ef5a">
|
|
<topic>lftp HTML parsing vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>lftp</name>
|
|
<range><le>2.6.10</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>A buffer overflow exists in lftp which may be triggered when
|
|
requesting a directory listing from a malicious server over
|
|
HTTP.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2003-0963</cvename>
|
|
<url>http://lftp.yar.ru/news.html#2.6.10</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2003-12-11</discovery>
|
|
<entry>2003-12-12</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="ebdf65c7-2ca6-11d8-9355-0020ed76ef5a">
|
|
<topic>qpopper format string vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>qpopper</name>
|
|
<range><lt>2.53_1</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>An authenticated user may trigger a format string
|
|
vulnerability present in qpopper's UIDL code, resulting
|
|
in arbitrary code execution with group ID `mail'
|
|
privileges.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>1241</bid>
|
|
<cvename>CVE-2000-0442</cvename>
|
|
<url>http://www.netsys.com/suse-linux-security/2000-May/att-0137/01-b0f5-Qpopper.txt</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2000-05-23</discovery>
|
|
<entry>2003-12-12</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="af0296be-2455-11d8-82e5-0020ed76ef5a">
|
|
<topic>fetchmail -- address parsing vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>fetchmail</name>
|
|
<range><le>6.2.0</le></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Fetchmail can be crashed by a malicious email message.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://security.e-matters.de/advisories/052002.html</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2003-10-25</discovery>
|
|
<entry>2003-10-25</entry>
|
|
<modified>2012-09-04</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="2bcd2d24-24ca-11d8-82e5-0020ed76ef5a">
|
|
<topic>Buffer overflow in pam_smb password handling</topic>
|
|
<affects>
|
|
<package>
|
|
<name>pam_smb</name>
|
|
<range><lt>1.9.9_3</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>Applications utilizing pam_smb can be compromised by
|
|
any user who can enter a password. In many cases,
|
|
this is a remote root compromise.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://www.skynet.ie/~airlied/pam_smb/</url>
|
|
<cvename>CVE-2003-0686</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2003-10-25</discovery>
|
|
<entry>2003-10-25</entry>
|
|
<modified>2003-10-25</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="c4b7badf-24ca-11d8-82e5-0020ed76ef5a">
|
|
<topic>Buffer overflows in libmcrypt</topic>
|
|
<affects>
|
|
<package>
|
|
<name>libmcrypt</name>
|
|
<range><lt>2.5.6</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>libmcrypt does incomplete input validation, leading to
|
|
several buffer overflows. Additionally,
|
|
a memory leak is present. Both of these problems may be
|
|
exploited in a denial-of-service attack.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<mlist>http://marc.theaimsgroup.com/?l=bugtraq&m=104162752401212&w=2</mlist>
|
|
<cvename>CVE-2003-0031</cvename>
|
|
<cvename>CVE-2003-0032</cvename>
|
|
</references>
|
|
<dates>
|
|
<discovery>2003-10-25</discovery>
|
|
<entry>2003-10-25</entry>
|
|
<modified>2003-10-25</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="6fd9a1e9-efd3-11d8-9837-000c41e2cdad">
|
|
<cancelled/>
|
|
</vuln>
|
|
|
|
<vuln vid="3362f2c1-8344-11d8-a41f-0020ed76ef5a">
|
|
<cancelled/>
|
|
</vuln>
|
|
|
|
<vuln vid="e3cf89f0-53da-11d9-92b7-ceadd4ac2edd">
|
|
<topic>phpbb -- arbitrary command execution and other vulnerabilities</topic>
|
|
<affects>
|
|
<package>
|
|
<name>phpbb</name>
|
|
<range><lt>2.0.11</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The ChangeLog for phpBB 2.0.11 states:</p>
|
|
<blockquote cite="http://www.phpbb.com/support/documents.php?mode=changelog">
|
|
<p>Changes since 2.0.10</p>
|
|
<ul>
|
|
<li>Fixed vulnerability in highlighting code (<strong>very
|
|
high severity, please update your installation as soon
|
|
as possible</strong>)</li>
|
|
<li>Fixed unsetting global vars - <strong>Matt
|
|
Kavanagh</strong></li>
|
|
<li>Fixed XSS vulnerability in username handling
|
|
- <strong>AnthraX101</strong></li>
|
|
<li>Fixed not confirmed sql injection in username handling
|
|
- <strong>warmth</strong></li>
|
|
<li>Added check for empty topic id in topic_review
|
|
function</li>
|
|
<li>Added visual confirmation mod to code base</li>
|
|
</ul>
|
|
</blockquote>
|
|
<p>Additionally, a US-CERT Technical Cyber Security Alert reports:</p>
|
|
<blockquote cite="http://www.us-cert.gov/cas/techalerts/TA04-356A.html">
|
|
<p>phpBB contains an user input validation problem with
|
|
regard to the parsing of the URL. An intruder can deface a
|
|
phpBB website, execute arbitrary commands, or gain
|
|
administrative privileges on a compromised bulletin
|
|
board.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2004-1315</cvename>
|
|
<freebsdpr>ports/74106</freebsdpr>
|
|
<uscertta>TA04-356A</uscertta>
|
|
<certvu>497400</certvu>
|
|
<url>http://www.phpbb.com/support/documents.php?mode=changelog</url>
|
|
<mlist msgid="20041113030542.11396.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&m=110029415208724</mlist>
|
|
<mlist msgid="20041118123055.28647.qmail@mail.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&m=110079436714518</mlist>
|
|
<url>http://www.phpbb.com/phpBB/viewtopic.php?f=14&t=240636</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2004-11-18</discovery>
|
|
<entry>2004-12-22</entry>
|
|
<modified>2005-01-24</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="a395397c-c7c8-11d9-9e1e-c296ac722cb3">
|
|
<topic>squid -- possible abuse of cachemgr.cgi</topic>
|
|
<affects>
|
|
<package>
|
|
<name>squid</name>
|
|
<range><lt>2.5.10</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The squid patches page notes:</p>
|
|
<blockquote cite="http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE9-cachemgr_conf">
|
|
<p>This patch adds access controls to the cachemgr.cgi script,
|
|
preventing it from being abused to reach other servers than
|
|
allowed in a local configuration file.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-1999-0710</cvename>
|
|
<url>http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE9-cachemgr_conf</url>
|
|
<url>http://www.squid-cache.org/bugs/show_bug.cgi?id=1094</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>1999-07-29</discovery>
|
|
<entry>2005-05-19</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="7e97b288-c7ca-11d9-9e1e-c296ac722cb3">
|
|
<topic>squid -- DNS lookup spoofing vulnerability</topic>
|
|
<affects>
|
|
<package>
|
|
<name>squid</name>
|
|
<range><lt>2.5.10</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The squid patches page notes:</p>
|
|
<blockquote cite="http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE9-dns_query">
|
|
<p>Malicious users may spoof DNS lookups if the DNS client UDP port
|
|
(random, assigned by OS as startup) is unfiltered and your network
|
|
is not protected from IP spoofing.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<cvename>CVE-2005-1519</cvename>
|
|
<url>http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE9-dns_reply</url>
|
|
<url>http://secunia.com/advisories/15294</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-05-11</discovery>
|
|
<entry>2005-05-19</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="55041d37-ff62-11d9-a9a5-000ae4641456">
|
|
<topic>jabberd -- 3 buffer overflows</topic>
|
|
<affects>
|
|
<package>
|
|
<name>jabberd</name>
|
|
<range><lt>2.0.9</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>There are 3 buffer overflows in jid.c that are triggered
|
|
during parsing of JID strings when components (user, host or
|
|
resource) are too long.</p>
|
|
<ol>
|
|
<li>jid.c, line 103: overflow in `str' buffer through
|
|
<code>strcpy()</code> when "user" part is too long.</li>
|
|
<li>jid.c, line 115: overflow in `str' buffer through
|
|
<code>strcpy()</code> when "host" part is too long.</li>
|
|
<li>jid.c, line 127: overflow in `str' buffer through
|
|
<code>strcpy()</code> when "resource" part is too
|
|
long.</li>
|
|
</ol>
|
|
<p>These overflows can be used to perform a DoS attack on the
|
|
server (sm process segfaults) and can possible be used for
|
|
arbitrary code execution.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<url>http://j2.openaether.org/bugzilla/show_bug.cgi?id=99</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-07-25</discovery>
|
|
<entry>2005-07-30</entry>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="44e7764c-2614-11da-9e1e-c296ac722cb3">
|
|
<topic>squid -- possible denial of service condition regarding NTLM authentication</topic>
|
|
<affects>
|
|
<package>
|
|
<name>squid</name>
|
|
<range><lt>2.5.10_6</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>The squid patches page notes:</p>
|
|
<blockquote cite="http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE10-NTLM-scheme_assert">
|
|
<p>Squid may crash with the above error [FATAL: Incorrect scheme in
|
|
auth header] when given certain request sentences.</p>
|
|
<p>Workaround: disable NTLM authentication.</p>
|
|
</blockquote>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>14977</bid>
|
|
<cvename>CVE-2005-2917</cvename>
|
|
<url>http://www.squid-cache.org/bugs/show_bug.cgi?id=1391</url>
|
|
<url>http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE10-NTLM-scheme_assert</url>
|
|
<url>http://secunia.com/advisories/16992/</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-09-12</discovery>
|
|
<entry>2005-09-15</entry>
|
|
<modified>2005-10-02</modified>
|
|
</dates>
|
|
</vuln>
|
|
|
|
<vuln vid="c6b9aee8-3071-11da-af18-000ae4641456">
|
|
<topic>phpmyfaq -- SQL injection, takeover, path disclosure, remote code execution</topic>
|
|
<affects>
|
|
<package>
|
|
<name>phpmyfaq</name>
|
|
<range><lt>1.5.2</lt></range>
|
|
</package>
|
|
</affects>
|
|
<description>
|
|
<body xmlns="http://www.w3.org/1999/xhtml">
|
|
<p>If magic quotes are off there's a SQL injection when
|
|
sending a forgotten password. It's possible to overwrite
|
|
the admin password and to take over the whole system. In
|
|
some files in the admin section there are some cross site
|
|
scripting vulnerabilities. In the public frontend it's
|
|
possible to include arbitrary php files.</p>
|
|
</body>
|
|
</description>
|
|
<references>
|
|
<bid>14927</bid>
|
|
<bid>14928</bid>
|
|
<bid>14929</bid>
|
|
<bid>14930</bid>
|
|
<cvename>CVE-2005-3046</cvename>
|
|
<cvename>CVE-2005-3047</cvename>
|
|
<cvename>CVE-2005-3048</cvename>
|
|
<cvename>CVE-2005-3049</cvename>
|
|
<cvename>CVE-2005-3050</cvename>
|
|
<url>http://www.phpmyfaq.de/advisory_2005-09-23.php</url>
|
|
</references>
|
|
<dates>
|
|
<discovery>2005-09-23</discovery>
|
|
<entry>2005-09-29</entry>
|
|
</dates>
|
|
</vuln>
|
|
</vuxml><!-- EOF -->
|
|
<!-- Note: Please add new entries to the beginning of this file. -->
|
|
<!-- ex: set ts=8 tw=80 sw=2: -->
|
|
<!-- vim: set softtabstop=2 noexpandtab: -->
|