aboutsummaryrefslogtreecommitdiffstats
path: root/security
diff options
context:
space:
mode:
authornaddy <naddy@FreeBSD.org>2005-10-31 06:17:54 +0800
committernaddy <naddy@FreeBSD.org>2005-10-31 06:17:54 +0800
commitfacd36e5c072e7116a6c29a26355c527a3b5fd06 (patch)
tree3d108a32c24eb7e2ddd9bdcd66bfde91ab112317 /security
parentda41f00ff9e25f02707c389a4d8beef3297db043 (diff)
downloadfreebsd-ports-gnome-facd36e5c072e7116a6c29a26355c527a3b5fd06.tar.gz
freebsd-ports-gnome-facd36e5c072e7116a6c29a26355c527a3b5fd06.tar.zst
freebsd-ports-gnome-facd36e5c072e7116a6c29a26355c527a3b5fd06.zip
Document lynx remote buffer overflow in NNTP header handling.
Diffstat (limited to 'security')
-rw-r--r--security/vuxml/vuln.xml21955
1 files changed, 8995 insertions, 12960 deletions
diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml
index 02fec9b55a77..d279797400fe 100644
--- a/security/vuxml/vuln.xml
+++ b/security/vuxml/vuln.xml
@@ -34,58 +34,83 @@ Note: Please add new entries to the beginning of this file.
-->
<vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">
+ <vuln vid="c01170bf-4990-11da-a1b8-000854d03344">
+ <topic>lynx -- remote buffer overflow</topic>
+ <affects>
+ <package>
+ <name>lynx</name>
+ <range><lt>2.8.5_1</lt></range>
+ <range><gt>2.8.6*</gt><lt>2.8.6d14</lt></range>
+ </package>
+ </affects>
+ <description>
+ <body xmlns="http://www.w3.org/1999/xhtml">
+ <p>Ulf Härnhammar reports:</p>
+ <blockquote cite="http://lists.grok.org.uk/pipermail/full-disclosure/2005-October/038019.html">
+ <p>When Lynx connects to an NNTP server to fetch information
+ about the available articles in a newsgroup, it will
+ call a function called HTrjis() with the information
+ from certain article headers. The function adds missing
+ ESC characters to certain data, to support Asian character
+ sets. However, it does not check if it writes outside
+ of the char array buf, and that causes a remote stack-based
+ buffer overflow.
+ </p>
+ </blockquote>
+ </body>
+ </description> <references>
+ <cvename>CVE-2005-3120</cvename>
+ <url>http://lists.grok.org.uk/pipermail/full-disclosure/2005-October/038019.html</url>
+ </references> <dates>
+ <discovery>2005-10-17</discovery>
+ <entry>2005-10-30</entry>
+ </dates>
+ </vuln>
+
<vuln vid="1daea60a-4719-11da-b5c6-0004614cc33d">
<topic>ruby -- vulnerability in the safe level settings</topic>
<affects>
<package>
- <name>ruby</name>
- <name>ruby_static</name>
+ <name>ruby</name> <name>ruby_static</name>
<range><gt>1.6.*</gt><lt>1.6.8.2004.07.28_2</lt></range>
<range><gt>1.8.*</gt><lt>1.8.2_5</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>Ruby home page reports:</p>
- <blockquote cite="http://www.ruby-lang.org/en/20051003.html">
+ <p>Ruby home page reports:</p> <blockquote
+ cite="http://www.ruby-lang.org/en/20051003.html">
<p>The Object Oriented Scripting Language Ruby supports
safely executing an untrusted code with two mechanisms:
safe level and taint flag on objects.</p>
<p>A vulnerability has been found that allows bypassing
these mechanisms.</p>
- <p>By using the vulnerability, arbitrary code can be executed
+ <p>By using the vulnerability, arbitrary code can be
+ executed
beyond the restrictions specified in each safe level.
- Therefore, Ruby has to be updated on all systems that use
- safe level to execute untrusted code.</p>
+ Therefore, Ruby has to be updated on all systems that
+ use safe level to execute untrusted code.</p>
</blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CAN-2005-2337</cvename>
<url>http://www.ruby-lang.org/en/20051003.html</url>
- </references>
- <dates>
- <discovery>2005-10-02</discovery>
- <entry>2005-10-27</entry>
+ </references> <dates>
+ <discovery>2005-10-02</discovery> <entry>2005-10-27</entry>
</dates>
</vuln>
<vuln vid="2f0cb4bb-416d-11da-99fe-000854d03344">
- <topic>xloadimage -- buffer overflows in NIFF image title handling</topic>
- <affects>
+ <topic>xloadimage -- buffer overflows in NIFF image title
+ handling</topic> <affects>
<package>
- <name>xloadimage</name>
- <range><lt>4.1.15</lt></range>
+ <name>xloadimage</name> <range><lt>4.1.15</lt></range>
+ </package> <package>
+ <name>xli</name> <range><lt>1.17.0_4</lt></range>
</package>
- <package>
- <name>xli</name>
- <range><lt>1.17.0_4</lt></range>
- </package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>Ariel Berkman reports:</p>
- <blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=112862493918840&amp;w=2">
+ <p>Ariel Berkman reports:</p> <blockquote
+ cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=112862493918840&amp;w=2">
<p>Unlike most of the supported image formats in xloadimage,
the NIFF image format can store a title name of arbitrary
length as part of the image file.</p>
@@ -101,15 +126,11 @@ Note: Please add new entries to the beginning of this file.
be overflowed.</p>
</blockquote>
</body>
- </description>
- <references>
- <bid>15051</bid>
- <cvename>CVE-2005-3178</cvename>
- <mlist msgid="BOEKKJLADFNHIEFBHCECMEONCFAA.aberkm1@uic.edu">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=112862493918840&amp;w=2</mlist>
- </references>
- <dates>
- <discovery>2005-10-05</discovery>
- <entry>2005-10-20</entry>
+ </description> <references>
+ <bid>15051</bid> <cvename>CVE-2005-3178</cvename> <mlist
+ msgid="BOEKKJLADFNHIEFBHCECMEONCFAA.aberkm1@uic.edu">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=112862493918840&amp;w=2</mlist>
+ </references> <dates>
+ <discovery>2005-10-05</discovery> <entry>2005-10-20</entry>
<modified>2005-10-23</modified>
</dates>
</vuln>
@@ -119,69 +140,59 @@ Note: Please add new entries to the beginning of this file.
vulnerability</topic>
<affects>
<package>
- <name>snort</name>
- <range><ge>2.4.0</ge><lt>2.4.3</lt></range>
+ <name>snort</name> <range><ge>2.4.0</ge><lt>2.4.3</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>Jennifer Steffens reports:</p>
- <blockquote cite="http://www.snort.org/pub-bin/snortnews.cgi#99">
+ <p>Jennifer Steffens reports:</p> <blockquote
+ cite="http://www.snort.org/pub-bin/snortnews.cgi#99">
<p>The Back Orifice preprocessor contains a stack-based
- buffer overflow. This vulnerability could be leveraged by
- an attacker to execute code remotely on a Snort sensor
- where the Back Orifice preprocessor is enabled. However,
- there are a number of factors that make remote code
- execution difficult to achieve across different builds of
- Snort on different platforms, even on the same platform
- with different compiler versions, and it is more likely
- that an attacker could use the vulnerability as a denial
- of service attack.</p>
+ buffer overflow. This vulnerability could be leveraged
+ by an attacker to execute code remotely on a Snort
+ sensor where the Back Orifice preprocessor is enabled.
+ However, there are a number of factors that make remote
+ code execution difficult to achieve across different
+ builds of Snort on different platforms, even on the
+ same platform with different compiler versions, and it
+ is more likely that an attacker could use the vulnerability
+ as a denial of service attack.</p>
<p>The Back Orifice preprocessor can be disabled by
- commenting out the line "preprocessor bo" in
- snort.conf. This can be done in any text editor using the
- following procedure:</p>
+ commenting out the line "preprocessor bo" in snort.conf.
+ This can be done in any text editor using the following
+ procedure:</p>
<ol>
- <li>Locate the line "preprocessor bo"</li>
- <li>Comment out this line by preceding it with a hash
- (#). The new line will look like "#preprocessor bo"</li>
- <li>Save the file</li>
- <li>Restart snort</li>
+ <li>Locate the line "preprocessor bo"</li> <li>Comment
+ out this line by preceding it with a hash
+ (#). The new line will look like "#preprocessor
+ bo"</li>
+ <li>Save the file</li> <li>Restart snort</li>
</ol>
</blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<certvu>175500</certvu>
<url>http://www.snort.org/pub-bin/snortnews.cgi#99</url>
<url>http://xforce.iss.net/xforce/alerts/id/207</url>
- </references>
- <dates>
- <discovery>2005-10-18</discovery>
- <entry>2005-10-18</entry>
+ </references> <dates>
+ <discovery>2005-10-18</discovery> <entry>2005-10-18</entry>
</dates>
</vuln>
<vuln vid="60f8fe7b-3cfb-11da-baa2-0004614cc33d">
- <topic>webcalendar -- multiple reports of websites getting defaced</topic>
- <affects>
+ <topic>webcalendar -- multiple reports of websites getting
+ defaced</topic> <affects>
<package>
- <name>WebCalendar</name>
- <range><lt>1.0.1</lt></range>
+ <name>WebCalendar</name> <range><lt>1.0.1</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>There is a vulnerability in includes/functions.php file.
No details available.</p>
</body>
- </description>
- <references>
+ </description> <references>
<url>http://sourceforge.net/forum/forum.php?thread_id=1342085&amp;forum_id=11587</url>
- </references>
- <dates>
- <discovery>2005-08-26</discovery>
- <entry>2005-10-15</entry>
+ </references> <dates>
+ <discovery>2005-08-26</discovery> <entry>2005-10-15</entry>
<modified>2005-10-18</modified>
</dates>
</vuln>
@@ -190,97 +201,83 @@ Note: Please add new entries to the beginning of this file.
<topic>gallery2 -- a vulnerability has been discovered</topic>
<affects>
<package>
- <name>gallery2</name>
- <range><lt>2.0.1</lt></range>
+ <name>gallery2</name> <range><lt>2.0.1</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>Michael Dipper wrote:</p>
- <blockquote cite="http://dipper.info/security/20051012/">
+ <p>Michael Dipper wrote:</p> <blockquote
+ cite="http://dipper.info/security/20051012/">
<p>A vulnerability has been discovered in gallery,
which allows remote users unauthorized access to files
on the webserver.</p>
<p>A remote user accessing gallery over the web may use
specially crafted HTTP parameters to access arbitrary
files located on the webserver. All files readable by
- the webserver process are subject to disclosure.
- The vulnerability is *not* restricted to the webserver's
- document root but extends to the whole server file space.</p>
+ the webserver process are subject to disclosure. The
+ vulnerability is *not* restricted to the webserver's
+ document root but extends to the whole server file
+ space.</p>
<p>The vulnerabilty may be used by any anonymous user,
there is no login to the application required.</p>
</blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<url>http://dipper.info/security/20051012/</url>
- </references>
- <dates>
- <discovery>2005-10-12</discovery>
- <entry>2005-10-15</entry>
+ </references> <dates>
+ <discovery>2005-10-12</discovery> <entry>2005-10-15</entry>
</dates>
</vuln>
<vuln vid="60e26a40-3b25-11da-9484-00123ffe8333">
- <topic>openssl -- potential SSL 2.0 rollback</topic>
- <affects>
+ <topic>openssl -- potential SSL 2.0 rollback</topic> <affects>
<package>
- <name>openssl</name>
- <name>openssl-overwrite-base</name>
+ <name>openssl</name> <name>openssl-overwrite-base</name>
<range><le>0.9.7g</le></range>
<range><ge>0.9.8</ge><le>0.9.8_1</le></range>
<range><ge>0.9.*_20050325</ge><le>0.9.*_20051011</le></range>
- </package>
- <package>
- <name>openssl-beta</name>
- <name>openssl-beta-overwrite-base</name>
+ </package> <package>
+ <name>openssl-beta</name> <name>openssl-beta-overwrite-base</name>
<range><le>0.9.8_1</le></range>
<range><ge>0.9.*_20050325</ge><le>0.9.*_20051011</le></range>
- </package>
- <package>
- <name>compat5x-alpha</name>
- <name>compat5x-amd64</name>
- <name>compat5x-i386</name>
- <name>compat5x-sparc64</name>
+ </package> <package>
+ <name>compat5x-alpha</name> <name>compat5x-amd64</name>
+ <name>compat5x-i386</name> <name>compat5x-sparc64</name>
<range><lt>5.4.0.8</lt></range>
- </package>
- <system>
- <name>FreeBSD</name>
- <range><lt>4.10_19</lt></range>
+ </package> <system>
+ <name>FreeBSD</name> <range><lt>4.10_19</lt></range>
<range><ge>4.11</ge><lt>4.11_13</lt></range>
<range><ge>5.3</ge><lt>5.3_23</lt></range>
<range><ge>5.4</ge><lt>5.4_8</lt></range>
</system>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>Vulnerability:</p>
- <blockquote cite="http://www.openssl.org/news/secadv_20051011.txt">
+ <p>Vulnerability:</p> <blockquote
+ cite="http://www.openssl.org/news/secadv_20051011.txt">
<p>Such applications are affected if they use the option
- SSL_OP_MSIE_SSLV2_RSA_PADDING. This option is implied by use of
- SSL_OP_ALL, which is intended to work around various bugs in
- third-party software that might prevent interoperability. The
- SSL_OP_MSIE_SSLV2_RSA_PADDING option disables a verification step in
- the SSL 2.0 server supposed to prevent active protocol-version
- rollback attacks. With this verification step disabled, an attacker
- acting as a "man in the middle" can force a client and a server to
- negotiate the SSL 2.0 protocol even if these parties both support SSL
- 3.0 or TLS 1.0. The SSL 2.0 protocol is known to have severe
- cryptographic weaknesses and is supported as a fallback only.</p>
- <p>Applications using neither SSL_OP_MSIE_SSLV2_RSA_PADDING nor
- SSL_OP_ALL are not affected. Also, applications that disable
- use of SSL 2.0 are not affected.</p>
- </blockquote>
- </body>
- </description>
- <references>
+ SSL_OP_MSIE_SSLV2_RSA_PADDING. This option is implied
+ by use of SSL_OP_ALL, which is intended to work around
+ various bugs in third-party software that might prevent
+ interoperability. The SSL_OP_MSIE_SSLV2_RSA_PADDING
+ option disables a verification step in the SSL 2.0
+ server supposed to prevent active protocol-version
+ rollback attacks. With this verification step disabled,
+ an attacker acting as a "man in the middle" can force
+ a client and a server to negotiate the SSL 2.0 protocol
+ even if these parties both support SSL 3.0 or TLS 1.0.
+ The SSL 2.0 protocol is known to have severe cryptographic
+ weaknesses and is supported as a fallback only.</p>
+ <p>Applications using neither SSL_OP_MSIE_SSLV2_RSA_PADDING
+ nor
+ SSL_OP_ALL are not affected. Also, applications that
+ disable use of SSL 2.0 are not affected.</p>
+ </blockquote>
+ </body>
+ </description> <references>
<freebsdsa>SA-05:21.openssl</freebsdsa>
<cvename>CVE-2005-2969</cvename>
<url>http://www.openssl.org/news/secadv_20051011.txt</url>
- </references>
- <dates>
- <discovery>2005-10-11</discovery>
- <entry>2005-10-12</entry>
+ </references> <dates>
+ <discovery>2005-10-11</discovery> <entry>2005-10-12</entry>
<modified>2005-10-25</modified>
</dates>
</vuln>
@@ -292,125 +289,110 @@ Note: Please add new entries to the beginning of this file.
<name>phpMyAdmin</name>
<range><ge>2.6.4.r1</ge><le>2.6.4.1</le></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>A phpMyAdmin security announcement reports:</p>
- <blockquote cite="http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-4">
+ <p>A phpMyAdmin security announcement reports:</p> <blockquote
+ cite="http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-4">
<p>In libraries/grab_globals.lib.php, the $__redirect
- parameter was not correctly validated, opening the door to
- a local file inclusion attack.</p>
+ parameter was not correctly validated, opening the door
+ to a local file inclusion attack.</p>
<p>We consider this vulnerability to be serious.</p>
</blockquote>
</body>
- </description>
- <references>
- <bid>15053</bid>
- <mlist msgid="20051010161119.1689.qmail@securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=112907764728209</mlist>
+ </description> <references>
+ <bid>15053</bid> <mlist
+ msgid="20051010161119.1689.qmail@securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=112907764728209</mlist>
<url>http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-4</url>
- </references>
- <dates>
- <discovery>2005-10-11</discovery>
- <entry>2005-10-11</entry>
+ </references> <dates>
+ <discovery>2005-10-11</discovery> <entry>2005-10-11</entry>
<modified>2005-10-13</modified>
</dates>
</vuln>
<vuln vid="d2b80c7c-3aae-11da-9484-00123ffe8333">
- <topic>zope28 -- expose RestructuredText functionality to untrusted users</topic>
- <affects>
+ <topic>zope28 -- expose RestructuredText functionality to
+ untrusted users</topic> <affects>
<package>
- <name>zope</name>
- <range><ge>2.6.0</ge><lt>2.7.8</lt></range>
+ <name>zope</name> <range><ge>2.6.0</ge><lt>2.7.8</lt></range>
<range><ge>2.8.0</ge><le>2.8.1_2</le></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>A Zope Hotfix Alert reports:</p>
- <blockquote cite="http://www.zope.org/Products/Zope/Hotfix_2005-10-09/security_alert">
+ <p>A Zope Hotfix Alert reports:</p> <blockquote
+ cite="http://www.zope.org/Products/Zope/Hotfix_2005-10-09/security_alert">
<p>This hotfix resolves a security issue with docutils.</p>
<p>Affected are possibly all Zope instances that expose
RestructuredText functionalies to untrusted users through
the web.</p>
</blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<bid>15082</bid>
<url>http://www.zope.org/Products/Zope/Hotfix_2005-10-09/security_alert</url>
- </references>
- <dates>
- <discovery>2005-10-09</discovery>
- <entry>2005-10-11</entry>
+ </references> <dates>
+ <discovery>2005-10-09</discovery> <entry>2005-10-11</entry>
<modified>2005-10-23</modified>
</dates>
</vuln>
<vuln vid="3bc5691e-38dd-11da-92f5-020039488e34">
- <topic>libxine -- format string vulnerability</topic>
- <affects>
+ <topic>libxine -- format string vulnerability</topic> <affects>
<package>
- <name>libxine</name>
- <range><lt>1.1.0_1</lt></range>
+ <name>libxine</name> <range><lt>1.1.0_1</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>Gentoo Linux Security Advisory reports:</p>
- <blockquote cite="http://www.gentoo.org/security/en/glsa/glsa-200510-08.xml">
- <p>Ulf Harnhammar discovered a format string bug in the routines
+ <p>Gentoo Linux Security Advisory reports:</p> <blockquote
+ cite="http://www.gentoo.org/security/en/glsa/glsa-200510-08.xml">
+ <p>Ulf Harnhammar discovered a format string bug in the
+ routines
handling CDDB server response contents.</p>
- <p>An attacker could submit malicious information about an audio
- CD to a public CDDB server (or impersonate a public CDDB server).
- When the victim plays this CD on a multimedia frontend relying
- on xine-lib, it could end up executing arbitrary code.</p>
+ <p>An attacker could submit malicious information about
+ an audio
+ CD to a public CDDB server (or impersonate a public
+ CDDB server). When the victim plays this CD on a
+ multimedia frontend relying on xine-lib, it could end
+ up executing arbitrary code.</p>
</blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2005-2967</cvename>
<url>http://www.gentoo.org/security/en/glsa/glsa-200510-08.xml</url>
<url>http://xinehq.de/index.php/security/XSA-2005-1</url>
- </references>
- <dates>
- <discovery>2005-10-08</discovery>
- <entry>2005-10-09</entry>
+ </references> <dates>
+ <discovery>2005-10-08</discovery> <entry>2005-10-09</entry>
</dates>
</vuln>
<vuln vid="1f6e2ade-35c2-11da-811d-0050bf27ba24">
- <topic>imap-uw -- mailbox name handling remote buffer vulnerability</topic>
- <affects>
+ <topic>imap-uw -- mailbox name handling remote buffer
+ vulnerability</topic> <affects>
<package>
- <name>imap-uw</name>
- <range><lt>2004g</lt></range>
+ <name>imap-uw</name> <range><lt>2004g</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>FrSIRT reports:</p>
- <blockquote cite="http://www.frsirt.com/english/advisories/2005/1953">
- <p>A vulnerability has been identified in UW-IMAP, which could
- be exploited by remote attackers to execute arbitrary commands.
- This flaw is due to a stack overflow error in the
- "mail_valid_net_parse_work()" [src/c-client/mail.c] function that
- does not properly handle specially crafted mailbox names containing
- a quote (") character, which could be exploited by authenticated
- remote attackers to execute arbitrary commands with the privileges
- of the IMAP server.</p>
+ <p>FrSIRT reports:</p> <blockquote
+ cite="http://www.frsirt.com/english/advisories/2005/1953">
+ <p>A vulnerability has been identified in UW-IMAP, which
+ could
+ be exploited by remote attackers to execute arbitrary
+ commands. This flaw is due to a stack overflow error
+ in the "mail_valid_net_parse_work()" [src/c-client/mail.c]
+ function that does not properly handle specially crafted
+ mailbox names containing a quote (") character, which
+ could be exploited by authenticated remote attackers
+ to execute arbitrary commands with the privileges of
+ the IMAP server.</p>
</blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2005-2933</cvename>
<url>http://www.frsirt.com/english/advisories/2005/1953</url>
<url>http://www.idefense.com/application/poi/display?id=313&amp;type=vulnerabilities</url>
<url>http://www.washington.edu/imap/documentation/RELNOTES.html</url>
- </references>
- <dates>
- <discovery>2005-10-05</discovery>
- <entry>2005-10-05</entry>
+ </references> <dates>
+ <discovery>2005-10-05</discovery> <entry>2005-10-05</entry>
</dates>
</vuln>
@@ -418,45 +400,40 @@ Note: Please add new entries to the beginning of this file.
<topic>weex -- remote format string vulnerability</topic>
<affects>
<package>
- <name>weex</name>
- <range><lt>2.6.1.5_1</lt></range>
+ <name>weex</name> <range><lt>2.6.1.5_1</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>Emanuel Haupt reports:</p>
- <blockquote cite="http://www.freebsd.org/cgi/query-pr.cgi?pr=ports/86833">
- <p>Someone who controls an FTP server that weex will log in to
- can set up malicious data in the account that weex will use,
- and that will cause a format string bug that will allow remote
- code execution. It will only happen when weex is first run or
- when its cache files are rebuilt with the -r option,
- though. The vulnerability was found by Ulf Harnhammar.</p>
+ <p>Emanuel Haupt reports:</p> <blockquote
+ cite="http://www.freebsd.org/cgi/query-pr.cgi?pr=ports/86833">
+ <p>Someone who controls an FTP server that weex will log
+ in to
+ can set up malicious data in the account that weex will
+ use, and that will cause a format string bug that will
+ allow remote code execution. It will only happen when
+ weex is first run or when its cache files are rebuilt
+ with the -r option, though. The vulnerability was found
+ by Ulf Harnhammar.</p>
</blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<freebsdpr>ports/86833</freebsdpr>
- </references>
- <dates>
- <discovery>2005-10-02</discovery>
- <entry>2005-10-02</entry>
+ </references> <dates>
+ <discovery>2005-10-02</discovery> <entry>2005-10-02</entry>
</dates>
</vuln>
<vuln vid="8a3ece40-3315-11da-a263-0001020eed82">
- <topic>picasm -- buffer overflow vulnerability</topic>
- <affects>
+ <topic>picasm -- buffer overflow vulnerability</topic> <affects>
<package>
- <name>picasm</name>
- <range><lt>1.12c</lt></range>
+ <name>picasm</name> <range><lt>1.12c</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>Shaun Colley reports:</p>
- <blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=111661253517089">
- <p>When generating error and warning messages, picasm copies
+ <p>Shaun Colley reports:</p> <blockquote
+ cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=111661253517089">
+ <p>When generating error and warning messages, picasm
+ copies
strings into fixed length buffers without bounds
checking.</p>
<p>If an attacker could trick a user into assembling a
@@ -465,46 +442,36 @@ Note: Please add new entries to the beginning of this file.
This could result in full system compromise.</p>
</blockquote>
</body>
- </description>
- <references>
- <bid>13698</bid>
- <cvename>CVE-2005-1679</cvename>
- <mlist msgid="c522a35a0505200807744163c4@mail.gmail.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=111661253517089</mlist>
- </references>
- <dates>
- <discovery>2005-05-20</discovery>
- <entry>2005-10-02</entry>
+ </description> <references>
+ <bid>13698</bid> <cvename>CVE-2005-1679</cvename> <mlist
+ msgid="c522a35a0505200807744163c4@mail.gmail.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=111661253517089</mlist>
+ </references> <dates>
+ <discovery>2005-05-20</discovery> <entry>2005-10-02</entry>
</dates>
</vuln>
<vuln vid="1e606080-3293-11da-ac91-020039488e34">
- <topic>uim -- privilege escalation vulnerability</topic>
- <affects>
+ <topic>uim -- privilege escalation vulnerability</topic> <affects>
<package>
- <name>ja-uim</name>
- <range><lt>0.4.9.1</lt></range>
+ <name>ja-uim</name> <range><lt>0.4.9.1</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>The uim developers reports:</p>
- <blockquote cite="http://lists.freedesktop.org/archives/uim/2005-September/001346.html">
+ <p>The uim developers reports:</p> <blockquote
+ cite="http://lists.freedesktop.org/archives/uim/2005-September/001346.html">
<p>Masanari Yamamoto discovered that incorrect use
- of environment variables in uim. This bug causes
- privilege escalation if setuid/setgid applications
- was linked to libuim.</p>
- <p>This bug appears in 'immodule for Qt' enabled Qt.
- (Normal Qt is also safe.) In some distribution,
- mlterm is also an setuid/setgid application.</p>
+ of environment variables in uim. This bug causes privilege
+ escalation if setuid/setgid applications was linked to
+ libuim.</p>
+ <p>This bug appears in 'immodule for Qt' enabled Qt.
+ (Normal Qt is also safe.) In some distribution, mlterm
+ is also an setuid/setgid application.</p>
</blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<url>http://lists.freedesktop.org/archives/uim/2005-September/001346.html</url>
- </references>
- <dates>
- <discovery>2005-09-28</discovery>
- <entry>2005-10-01</entry>
+ </references> <dates>
+ <discovery>2005-09-28</discovery> <entry>2005-10-01</entry>
</dates>
</vuln>
@@ -512,36 +479,28 @@ Note: Please add new entries to the beginning of this file.
<topic>cfengine -- arbitrary file overwriting vulnerability</topic>
<affects>
<package>
- <name>cfengine</name>
- <range><lt>2.1.6_1</lt></range>
- </package>
- <package>
- <name>cfengine2</name>
- <range><gt>0</gt></range>
+ <name>cfengine</name> <range><lt>2.1.6_1</lt></range>
+ </package> <package>
+ <name>cfengine2</name> <range><gt>0</gt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>A Debian Security Advisory reports:</p>
- <blockquote cite="http://www.debian.org/security/2005/dsa-835">
+ <p>A Debian Security Advisory reports:</p> <blockquote
+ cite="http://www.debian.org/security/2005/dsa-835">
<p>Javier Fernández-Sanguino Peña discovered several
insecure temporary file uses in cfengine, a tool for
- configuring and maintaining networked machines, that can
- be exploited by a symlink attack to overwrite arbitrary
- files owned by the user executing cfengine, which is
- probably root.</p>
+ configuring and maintaining networked machines, that
+ can be exploited by a symlink attack to overwrite
+ arbitrary files owned by the user executing cfengine,
+ which is probably root.</p>
</blockquote>
</body>
- </description>
- <references>
- <cvename>CVE-2005-2960</cvename>
- <bid>14994</bid>
+ </description> <references>
+ <cvename>CVE-2005-2960</cvename> <bid>14994</bid>
<url>http://www.debian.org/security/2005/dsa-835</url>
<url>http://www.debian.org/security/2005/dsa-836</url>
- </references>
- <dates>
- <discovery>2005-10-01</discovery>
- <entry>2005-10-01</entry>
+ </references> <dates>
+ <discovery>2005-10-01</discovery> <entry>2005-10-01</entry>
<modified>2005-10-07</modified>
</dates>
</vuln>
@@ -551,38 +510,30 @@ Note: Please add new entries to the beginning of this file.
vulnerabilities</topic>
<affects>
<package>
- <name>clamav</name>
- <range><lt>0.87</lt></range>
- </package>
- <package>
- <name>clamav-devel</name>
- <range><lt>20050917</lt></range>
+ <name>clamav</name> <range><lt>0.87</lt></range>
+ </package> <package>
+ <name>clamav-devel</name> <range><lt>20050917</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>Gentoo Linux Security Advisory reports:</p>
- <blockquote cite="http://www.gentoo.org/security/en/glsa/glsa-200509-13.xml">
+ <p>Gentoo Linux Security Advisory reports:</p> <blockquote
+ cite="http://www.gentoo.org/security/en/glsa/glsa-200509-13.xml">
<p>Clam AntiVirus is vulnerable to a buffer overflow in
"libclamav/upx.c" when processing malformed UPX-packed
- executables. It can also be sent into an infinite loop in
- "libclamav/fsg.c" when processing specially-crafted
+ executables. It can also be sent into an infinite loop
+ in "libclamav/fsg.c" when processing specially-crafted
FSG-packed executables.</p>
<p>By sending a specially-crafted file an attacker could
execute arbitrary code with the permissions of the user
running Clam AntiVirus, or cause a Denial of Service.</p>
</blockquote>
</body>
- </description>
- <references>
- <certvu>363713</certvu>
- <cvename>CVE-2005-2919</cvename>
+ </description> <references>
+ <certvu>363713</certvu> <cvename>CVE-2005-2919</cvename>
<cvename>CVE-2005-2920</cvename>
<url>http://www.gentoo.org/security/en/glsa/glsa-200509-13.xml</url>
- </references>
- <dates>
- <discovery>2005-09-16</discovery>
- <entry>2005-09-24</entry>
+ </references> <dates>
+ <discovery>2005-09-16</discovery> <entry>2005-09-24</entry>
<modified>2005-10-22</modified>
</dates>
</vuln>
@@ -591,31 +542,19 @@ Note: Please add new entries to the beginning of this file.
<topic>firefox &amp; mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
- <name>firefox</name>
- <range><lt>1.0.7,1</lt></range>
- </package>
- <package>
- <name>linux-firefox</name>
- <range><lt>1.0.7</lt></range>
- </package>
- <package>
- <name>mozilla</name>
- <range><lt>1.7.12,2</lt></range>
+ <name>firefox</name> <range><lt>1.0.7,1</lt></range>
+ </package> <package>
+ <name>linux-firefox</name> <range><lt>1.0.7</lt></range>
+ </package> <package>
+ <name>mozilla</name> <range><lt>1.7.12,2</lt></range>
<range><ge>1.8.*,2</ge></range>
- </package>
- <package>
- <name>linux-mozilla</name>
- <range><lt>1.7.12</lt></range>
- </package>
- <package>
- <name>linux-mozilla-devel</name>
- <range><gt>0</gt></range>
- </package>
- <package>
- <name>netscape7</name>
- <range><ge>0</ge></range>
- </package>
- <package>
+ </package> <package>
+ <name>linux-mozilla</name> <range><lt>1.7.12</lt></range>
+ </package> <package>
+ <name>linux-mozilla-devel</name> <range><gt>0</gt></range>
+ </package> <package>
+ <name>netscape7</name> <range><ge>0</ge></range>
+ </package> <package>
<!-- These ports are obsolete. -->
<name>de-linux-mozillafirebird</name>
<name>el-linux-mozillafirebird</name>
@@ -624,112 +563,96 @@ Note: Please add new entries to the beginning of this file.
<name>linux-mozillafirebird</name>
<name>ru-linux-mozillafirebird</name>
<name>zhCN-linux-mozillafirebird</name>
- <name>zhTW-linux-mozillafirebird</name>
- <range><ge>0</ge></range>
- </package>
- <package>
+ <name>zhTW-linux-mozillafirebird</name> <range><ge>0</ge></range>
+ </package> <package>
<!-- These package names are obsolete. -->
- <name>de-linux-netscape</name>
- <name>de-netscape7</name>
- <name>fr-linux-netscape</name>
- <name>fr-netscape7</name>
- <name>ja-linux-netscape</name>
- <name>ja-netscape7</name>
- <name>linux-netscape</name>
- <name>linux-phoenix</name>
- <name>mozilla+ipv6</name>
- <name>mozilla-embedded</name>
- <name>mozilla-firebird</name>
- <name>mozilla-gtk1</name>
- <name>mozilla-gtk2</name>
- <name>mozilla-gtk</name>
- <name>mozilla-thunderbird</name>
- <name>phoenix</name>
- <name>pt_BR-netscape7</name>
- <range><ge>0</ge></range>
- </package>
- </affects>
- <description>
+ <name>de-linux-netscape</name> <name>de-netscape7</name>
+ <name>fr-linux-netscape</name> <name>fr-netscape7</name>
+ <name>ja-linux-netscape</name> <name>ja-netscape7</name>
+ <name>linux-netscape</name> <name>linux-phoenix</name>
+ <name>mozilla+ipv6</name> <name>mozilla-embedded</name>
+ <name>mozilla-firebird</name> <name>mozilla-gtk1</name>
+ <name>mozilla-gtk2</name> <name>mozilla-gtk</name>
+ <name>mozilla-thunderbird</name> <name>phoenix</name>
+ <name>pt_BR-netscape7</name> <range><ge>0</ge></range>
+ </package>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Mozilla Foundation Security Advisory reports of multiple
issues:</p>
- <blockquote cite="http://www.mozilla.org/security/announce/mfsa2005-58.html">
- <h1>Heap overrun in XBM image processing</h1>
- <p>jackerror reports that an improperly terminated XBM image
- ending with space characters instead of the expected end
- tag can lead to a heap buffer overrun. This appears to be
- exploitable to install or run malicious code on the user's
- machine.</p>
+ <blockquote
+ cite="http://www.mozilla.org/security/announce/mfsa2005-58.html">
+ <h1>Heap overrun in XBM image processing</h1> <p>jackerror
+ reports that an improperly terminated XBM image
+ ending with space characters instead of the expected
+ end tag can lead to a heap buffer overrun. This appears
+ to be exploitable to install or run malicious code on
+ the user's machine.</p>
<p>Thunderbird does not support the XBM format and is not
affected by this flaw.</p>
- <h1>Crash on "zero-width non-joiner" sequence</h1>
- <p>Mats Palmgren discovered that a reported crash on Unicode
- sequences with "zero-width non-joiner" characters was due
- to stack corruption that may be exploitable.</p>
- <h1>XMLHttpRequest header spoofing</h1>
- <p>It was possible to add illegal and malformed headers to
+ <h1>Crash on "zero-width non-joiner" sequence</h1> <p>Mats
+ Palmgren discovered that a reported crash on Unicode
+ sequences with "zero-width non-joiner" characters was
+ due to stack corruption that may be exploitable.</p>
+ <h1>XMLHttpRequest header spoofing</h1> <p>It was possible
+ to add illegal and malformed headers to
an XMLHttpRequest. This could have been used to exploit
- server or proxy flaws from the user's machine, or to fool
- a server or proxy into thinking a single request was a
- stream of separate requests. The severity of this
- vulnerability depends on the value of servers which might
- be vulnerable to HTTP request smuggling and similar
+ server or proxy flaws from the user's machine, or to
+ fool a server or proxy into thinking a single request
+ was a stream of separate requests. The severity of this
+ vulnerability depends on the value of servers which
+ might be vulnerable to HTTP request smuggling and similar
attacks, or which share an IP address (virtual hosting)
with the attacker's page.</p>
- <p>For users connecting to the web through a proxy this flaw
+ <p>For users connecting to the web through a proxy this
+ flaw
could be used to bypass the same-origin restriction on
XMLHttpRequests by fooling the proxy into handling a
- single request as multiple pipe-lined requests directed at
- arbitrary hosts. This could be used, for example, to read
- files on intranet servers behind a firewall.</p>
+ single request as multiple pipe-lined requests directed
+ at arbitrary hosts. This could be used, for example,
+ to read files on intranet servers behind a firewall.</p>
<h1>Object spoofing using XBL &lt;implements&gt;</h1>
<p>moz_bug_r_a4 demonstrated a DOM object spoofing bug
similar to <a
href="http://www.mozilla.org/security/announce/mfsa2005-55.html">MFSA
2005-55</a> using an XBL control that &lt;implements&gt;
- an internal interface. The severity depends on the version
- of Firefox: investigation so far indicates Firefox 1.0.x
- releases don't expose any vulnerable functionality to
- interfaces spoofed in this way, but that early Deer Park
- Alpha 1 versions did.</p>
+ an internal interface. The severity depends on the
+ version of Firefox: investigation so far indicates
+ Firefox 1.0.x releases don't expose any vulnerable
+ functionality to interfaces spoofed in this way, but
+ that early Deer Park Alpha 1 versions did.</p>
<p>XBL was changed to no longer allow unprivileged controls
from web content to implement XPCOM interfaces.</p>
- <h1>JavaScript integer overflow</h1>
- <p>Georgi Guninski reported an integer overflow in the
- JavaScript engine. We presume this could be exploited to
- run arbitrary code under favorable conditions.</p>
- <h1>Privilege escalation using about: scheme</h1>
- <p>heatsync and shutdown report two different ways to bypass
- the restriction on loading high privileged "chrome" pages
- from an unprivileged "about:" page. By itself this is
- harmless--once the "about" page's privilege is raised the
- original page no longer has access--but should this be
- combined with a same-origin violation this could lead to
- arbitrary code execution.</p>
- <h1>Chrome window spoofing</h1>
- <p>moz_bug_r_a4 demonstrates a way to get a blank "chrome"
+ <h1>JavaScript integer overflow</h1> <p>Georgi Guninski
+ reported an integer overflow in the
+ JavaScript engine. We presume this could be exploited
+ to run arbitrary code under favorable conditions.</p>
+ <h1>Privilege escalation using about: scheme</h1> <p>heatsync
+ and shutdown report two different ways to bypass
+ the restriction on loading high privileged "chrome"
+ pages from an unprivileged "about:" page. By itself
+ this is harmless--once the "about" page's privilege is
+ raised the original page no longer has access--but
+ should this be combined with a same-origin violation
+ this could lead to arbitrary code execution.</p>
+ <h1>Chrome window spoofing</h1> <p>moz_bug_r_a4 demonstrates
+ a way to get a blank "chrome"
canvas by opening a window from a reference to a closed
window. The resulting window is not privileged, but the
normal browser UI is missing and can be used to construct
a spoof page without any of the safety features of the
- browser chrome designed to alert users to phishing sites,
- such as the address bar and the status bar.</p>
+ browser chrome designed to alert users to phishing
+ sites, such as the address bar and the status bar.</p>
</blockquote>
</body>
- </description>
- <references>
- <cvename>CVE-2005-2701</cvename>
- <cvename>CVE-2005-2702</cvename>
- <cvename>CVE-2005-2703</cvename>
- <cvename>CVE-2005-2704</cvename>
- <cvename>CVE-2005-2705</cvename>
- <cvename>CVE-2005-2706</cvename>
+ </description> <references>
+ <cvename>CVE-2005-2701</cvename> <cvename>CVE-2005-2702</cvename>
+ <cvename>CVE-2005-2703</cvename> <cvename>CVE-2005-2704</cvename>
+ <cvename>CVE-2005-2705</cvename> <cvename>CVE-2005-2706</cvename>
<cvename>CVE-2005-2707</cvename>
<url>http://www.mozilla.org/security/announce/mfsa2005-58.html</url>
- </references>
- <dates>
- <discovery>2005-09-22</discovery>
- <entry>2005-09-23</entry>
+ </references> <dates>
+ <discovery>2005-09-22</discovery> <entry>2005-09-23</entry>
<modified>2005-10-26</modified>
</dates>
</vuln>
@@ -739,31 +662,19 @@ Note: Please add new entries to the beginning of this file.
injection</topic>
<affects>
<package>
- <name>firefox</name>
- <range><lt>1.0.7,1</lt></range>
- </package>
- <package>
- <name>linux-firefox</name>
- <range><lt>1.0.7</lt></range>
- </package>
- <package>
- <name>mozilla</name>
- <range><lt>1.7.12,2</lt></range>
+ <name>firefox</name> <range><lt>1.0.7,1</lt></range>
+ </package> <package>
+ <name>linux-firefox</name> <range><lt>1.0.7</lt></range>
+ </package> <package>
+ <name>mozilla</name> <range><lt>1.7.12,2</lt></range>
<range><ge>1.8.*,2</ge></range>
- </package>
- <package>
- <name>linux-mozilla</name>
- <range><lt>1.7.12</lt></range>
- </package>
- <package>
- <name>linux-mozilla-devel</name>
- <range><gt>0</gt></range>
- </package>
- <package>
- <name>netscape7</name>
- <range><ge>0</ge></range>
- </package>
- <package>
+ </package> <package>
+ <name>linux-mozilla</name> <range><lt>1.7.12</lt></range>
+ </package> <package>
+ <name>linux-mozilla-devel</name> <range><gt>0</gt></range>
+ </package> <package>
+ <name>netscape7</name> <range><ge>0</ge></range>
+ </package> <package>
<!-- These ports are obsolete. -->
<name>de-linux-mozillafirebird</name>
<name>el-linux-mozillafirebird</name>
@@ -772,70 +683,54 @@ Note: Please add new entries to the beginning of this file.
<name>linux-mozillafirebird</name>
<name>ru-linux-mozillafirebird</name>
<name>zhCN-linux-mozillafirebird</name>
- <name>zhTW-linux-mozillafirebird</name>
- <range><ge>0</ge></range>
- </package>
- <package>
+ <name>zhTW-linux-mozillafirebird</name> <range><ge>0</ge></range>
+ </package> <package>
<!-- These package names are obsolete. -->
- <name>de-linux-netscape</name>
- <name>de-netscape7</name>
- <name>fr-linux-netscape</name>
- <name>fr-netscape7</name>
- <name>ja-linux-netscape</name>
- <name>ja-netscape7</name>
- <name>linux-netscape</name>
- <name>linux-phoenix</name>
- <name>mozilla+ipv6</name>
- <name>mozilla-embedded</name>
- <name>mozilla-firebird</name>
- <name>mozilla-gtk1</name>
- <name>mozilla-gtk2</name>
- <name>mozilla-gtk</name>
- <name>mozilla-thunderbird</name>
- <name>phoenix</name>
- <name>pt_BR-netscape7</name>
- <range><ge>0</ge></range>
- </package>
- </affects>
- <description>
- <body xmlns="http://www.w3.org/1999/xhtml">
- <p>A Secunia Advisory reports:</p>
- <blockquote cite="http://secunia.com/advisories/16869/">
+ <name>de-linux-netscape</name> <name>de-netscape7</name>
+ <name>fr-linux-netscape</name> <name>fr-netscape7</name>
+ <name>ja-linux-netscape</name> <name>ja-netscape7</name>
+ <name>linux-netscape</name> <name>linux-phoenix</name>
+ <name>mozilla+ipv6</name> <name>mozilla-embedded</name>
+ <name>mozilla-firebird</name> <name>mozilla-gtk1</name>
+ <name>mozilla-gtk2</name> <name>mozilla-gtk</name>
+ <name>mozilla-thunderbird</name> <name>phoenix</name>
+ <name>pt_BR-netscape7</name> <range><ge>0</ge></range>
+ </package>
+ </affects> <description>
+ <body xmlns="http://www.w3.org/1999/xhtml">
+ <p>A Secunia Advisory reports:</p> <blockquote
+ cite="http://secunia.com/advisories/16869/">
<p>Peter Zelezny has discovered a vulnerability in Firefox,
- which can be exploited by malicious people to compromise a
- user's system.</p>
- <p>The vulnerability is caused due to the shell script used
- to launch Firefox parsing shell commands that are enclosed
- within backticks in the URL provided via the command
- line. This can e.g. be exploited to execute arbitrary
- shell commands by tricking a user into following a
- malicious link in an external application which uses
+ which can be exploited by malicious people to compromise
+ a user's system.</p>
+ <p>The vulnerability is caused due to the shell script
+ used
+ to launch Firefox parsing shell commands that are
+ enclosed within backticks in the URL provided via the
+ command line. This can e.g. be exploited to execute
+ arbitrary shell commands by tricking a user into following
+ a malicious link in an external application which uses
Firefox as the default browser.</p>
</blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2005-2968</cvename>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=307185</url>
<url>http://secunia.com/advisories/16869/</url>
<url>http://www.mozilla.org/security/announce/mfsa2005-59.html</url>
- </references>
- <dates>
- <discovery>2005-09-06</discovery>
- <entry>2005-09-22</entry>
+ </references> <dates>
+ <discovery>2005-09-06</discovery> <entry>2005-09-22</entry>
<modified>2005-10-26</modified>
</dates>
</vuln>
<vuln vid="e936d612-253f-11da-bc01-000e0c2e438a">
- <topic>apache -- Certificate Revocation List (CRL) off-by-one vulnerability</topic>
- <affects>
+ <topic>apache -- Certificate Revocation List (CRL) off-by-one
+ vulnerability</topic> <affects>
<package>
- <name>apache</name>
- <range><gt>2.*</gt><lt>2.0.54_1</lt></range>
+ <name>apache</name> <range><gt>2.*</gt><lt>2.0.54_1</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Marc Stern reports an off-by-one vulnerability in within
mod_ssl. The vulnerability lies in mod_ssl's Certificate
@@ -843,47 +738,40 @@ Note: Please add new entries to the beginning of this file.
CRL this could allow an attacker to crash a child process
causing a Denial of Service.</p>
</body>
- </description>
- <references>
- <bid>14366</bid>
- <cvename>CVE-2005-1268</cvename>
- </references>
- <dates>
- <discovery>2005-07-12</discovery>
- <entry>2005-09-17</entry>
+ </description> <references>
+ <bid>14366</bid> <cvename>CVE-2005-1268</cvename>
+ </references> <dates>
+ <discovery>2005-07-12</discovery> <entry>2005-09-17</entry>
</dates>
</vuln>
<vuln vid="7d52081f-2795-11da-bc01-000e0c2e438a">
- <topic>squirrelmail -- _$POST variable handling allows for various
+ <topic>squirrelmail -- _$POST variable handling allows for
+ various
attacks</topic>
<affects>
<package>
- <name>squirrelmail</name>
- <name>ja-squirrelmail</name>
+ <name>squirrelmail</name> <name>ja-squirrelmail</name>
<range><ge>1.4.0</ge><lt>1.4.5</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>A Squirrelmail Advisory reports:</p>
- <blockquote cite="http://www.squirrelmail.org/security/issue/2005-07-13">
- <p>An extract($_POST) was done in options_identities.php which
+ <p>A Squirrelmail Advisory reports:</p> <blockquote
+ cite="http://www.squirrelmail.org/security/issue/2005-07-13">
+ <p>An extract($_POST) was done in options_identities.php
+ which
allowed for an attacker to set random variables in that
file. This could lead to the reading (and possible
- writing) of other people's preferences, cross site scripting
- or writing files in webserver-writable locations.</p>
+ writing) of other people's preferences, cross site
+ scripting or writing files in webserver-writable
+ locations.</p>
</blockquote>
</body>
- </description>
- <references>
- <bid>14254</bid>
- <cvename>CVE-2005-2095</cvename>
+ </description> <references>
+ <bid>14254</bid> <cvename>CVE-2005-2095</cvename>
<url>http://www.squirrelmail.org/security/issue/2005-07-13</url>
- </references>
- <dates>
- <discovery>2005-07-13</discovery>
- <entry>2005-09-17</entry>
+ </references> <dates>
+ <discovery>2005-07-13</discovery> <entry>2005-09-17</entry>
<modified>2005-09-19</modified>
</dates>
</vuln>
@@ -892,65 +780,51 @@ Note: Please add new entries to the beginning of this file.
<topic>X11 server -- pixmap allocation vulnerability</topic>
<affects>
<package>
- <name>XFree86-Server</name>
- <range><lt>4.5.0_2</lt></range>
- </package>
- <package>
- <name>xorg-server</name>
- <range><lt>6.8.2_5</lt></range>
+ <name>XFree86-Server</name> <range><lt>4.5.0_2</lt></range>
+ </package> <package>
+ <name>xorg-server</name> <range><lt>6.8.2_5</lt></range>
<range><gt>6.8.99</gt><lt>6.8.99.12_1</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>Allocating large pixmaps by a client can trigger an integer
- overflow in the X server, potentially leading to execution of
- arbitrary code with elevated (root) privileges.</p>
+ <p>Allocating large pixmaps by a client can trigger an
+ integer
+ overflow in the X server, potentially leading to execution
+ of arbitrary code with elevated (root) privileges.</p>
</body>
- </description>
- <references>
- <bid>14807</bid>
- <certvu>102441</certvu>
+ </description> <references>
+ <bid>14807</bid> <certvu>102441</certvu>
<cvename>CVE-2005-2495</cvename>
<url>https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=166856</url>
<url>https://bugs.freedesktop.org/show_bug.cgi?id=594</url>
- </references>
- <dates>
- <discovery>2005-09-12</discovery>
- <entry>2005-09-15</entry>
+ </references> <dates>
+ <discovery>2005-09-12</discovery> <entry>2005-09-15</entry>
</dates>
</vuln>
<vuln vid="9750cf22-216d-11da-bc01-000e0c2e438a">
- <topic>unzip -- permission race vulnerability</topic>
- <affects>
+ <topic>unzip -- permission race vulnerability</topic> <affects>
<package>
- <name>unzip</name>
- <name>zh-unzip</name>
- <name>ko-unzip</name>
+ <name>unzip</name> <name>zh-unzip</name> <name>ko-unzip</name>
<range><lt>5.52_2</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Imran Ghory reports a vulnerability within unzip. The
vulnerability is caused by a race condition between
extracting an archive and changing the permissions of the
- extracted files. This would give an attacker enough time to
- remove a file and hardlink it to another file owned by the
- user running unzip. When unzip changes the permissions of
- the file it could give the attacker access to files that
- normally would not have been accessible for others.</p>
+ extracted files. This would give an attacker enough time
+ to remove a file and hardlink it to another file owned
+ by the user running unzip. When unzip changes the
+ permissions of the file it could give the attacker access
+ to files that normally would not have been accessible for
+ others.</p>
</body>
- </description>
- <references>
- <bid>14450</bid>
- <cvename>CVE-2005-2475</cvename>
- <mlist msgid="7389fc4b05080116031536adf7@mail.gmail.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=112300046224117</mlist>
- </references>
- <dates>
- <discovery>2005-08-02</discovery>
- <entry>2005-09-13</entry>
+ </description> <references>
+ <bid>14450</bid> <cvename>CVE-2005-2475</cvename> <mlist
+ msgid="7389fc4b05080116031536adf7@mail.gmail.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=112300046224117</mlist>
+ </references> <dates>
+ <discovery>2005-08-02</discovery> <entry>2005-09-13</entry>
</dates>
</vuln>
@@ -959,31 +833,19 @@ Note: Please add new entries to the beginning of this file.
vulnerability</topic>
<affects>
<package>
- <name>firefox</name>
- <range><lt>1.0.6_5,1</lt></range>
- </package>
- <package>
- <name>linux-firefox</name>
- <range><lt>1.0.7</lt></range>
- </package>
- <package>
- <name>mozilla</name>
- <range><lt>1.7.11_1,2</lt></range>
+ <name>firefox</name> <range><lt>1.0.6_5,1</lt></range>
+ </package> <package>
+ <name>linux-firefox</name> <range><lt>1.0.7</lt></range>
+ </package> <package>
+ <name>mozilla</name> <range><lt>1.7.11_1,2</lt></range>
<range><ge>1.8.*,2</ge><lt>1.8.b1_5,2</lt></range>
- </package>
- <package>
- <name>linux-mozilla</name>
- <range><lt>1.7.12</lt></range>
- </package>
- <package>
- <name>linux-mozilla-devel</name>
- <range><gt>0</gt></range>
- </package>
- <package>
- <name>netscape7</name>
- <range><ge>0</ge></range>
- </package>
- <package>
+ </package> <package>
+ <name>linux-mozilla</name> <range><lt>1.7.12</lt></range>
+ </package> <package>
+ <name>linux-mozilla-devel</name> <range><gt>0</gt></range>
+ </package> <package>
+ <name>netscape7</name> <range><ge>0</ge></range>
+ </package> <package>
<!-- These ports are obsolete. -->
<name>de-linux-mozillafirebird</name>
<name>el-linux-mozillafirebird</name>
@@ -992,66 +854,50 @@ Note: Please add new entries to the beginning of this file.
<name>linux-mozillafirebird</name>
<name>ru-linux-mozillafirebird</name>
<name>zhCN-linux-mozillafirebird</name>
- <name>zhTW-linux-mozillafirebird</name>
- <range><ge>0</ge></range>
- </package>
- <package>
+ <name>zhTW-linux-mozillafirebird</name> <range><ge>0</ge></range>
+ </package> <package>
<!-- These package names are obsolete. -->
- <name>de-linux-netscape</name>
- <name>de-netscape7</name>
- <name>fr-linux-netscape</name>
- <name>fr-netscape7</name>
- <name>ja-linux-netscape</name>
- <name>ja-netscape7</name>
- <name>linux-netscape</name>
- <name>linux-phoenix</name>
- <name>mozilla+ipv6</name>
- <name>mozilla-embedded</name>
- <name>mozilla-firebird</name>
- <name>mozilla-gtk1</name>
- <name>mozilla-gtk2</name>
- <name>mozilla-gtk</name>
- <name>mozilla-thunderbird</name>
- <name>phoenix</name>
- <name>pt_BR-netscape7</name>
- <range><ge>0</ge></range>
- </package>
- </affects>
- <description>
- <body xmlns="http://www.w3.org/1999/xhtml">
- <p>Tom Ferris reports:</p>
- <blockquote cite="http://marc.theaimsgroup.com/?l=full-disclosure&amp;m=112624614008387">
+ <name>de-linux-netscape</name> <name>de-netscape7</name>
+ <name>fr-linux-netscape</name> <name>fr-netscape7</name>
+ <name>ja-linux-netscape</name> <name>ja-netscape7</name>
+ <name>linux-netscape</name> <name>linux-phoenix</name>
+ <name>mozilla+ipv6</name> <name>mozilla-embedded</name>
+ <name>mozilla-firebird</name> <name>mozilla-gtk1</name>
+ <name>mozilla-gtk2</name> <name>mozilla-gtk</name>
+ <name>mozilla-thunderbird</name> <name>phoenix</name>
+ <name>pt_BR-netscape7</name> <range><ge>0</ge></range>
+ </package>
+ </affects> <description>
+ <body xmlns="http://www.w3.org/1999/xhtml">
+ <p>Tom Ferris reports:</p> <blockquote
+ cite="http://marc.theaimsgroup.com/?l=full-disclosure&amp;m=112624614008387">
<p>A buffer overflow vulnerability exists within Firefox
version 1.0.6 and all other prior versions which allows
- for an attacker to remotely execute arbitrary code on an
- affected host.</p>
+ for an attacker to remotely execute arbitrary code on
+ an affected host.</p>
<p>The problem seems to be when a hostname which has all
dashes causes the NormalizeIDN call in
- nsStandardURL::BuildNormalizedSpec to return true, but is
- sets encHost to an empty string. Meaning, Firefox appends
- 0 to approxLen and then appends the long string of dashes
- to the buffer instead.</p>
- </blockquote>
- <p><strong>Note:</strong> It is possible to disable IDN
+ nsStandardURL::BuildNormalizedSpec to return true, but
+ is sets encHost to an empty string. Meaning, Firefox
+ appends 0 to approxLen and then appends the long string
+ of dashes to the buffer instead.</p>
+ </blockquote> <p><strong>Note:</strong> It is possible to
+ disable IDN
support as a workaround to protect against this buffer
overflow. How to do this is described on the <em><a
- href="http://www.mozilla.org/security/idn.html">What Firefox
- and Mozilla users should know about the IDN buffer overflow
- security issue</a></em> web page.</p>
+ href="http://www.mozilla.org/security/idn.html">What
+ Firefox and Mozilla users should know about the IDN buffer
+ overflow security issue</a></em> web page.</p>
</body>
- </description>
- <references>
- <bid>14784</bid>
- <certvu>573857</certvu>
+ </description> <references>
+ <bid>14784</bid> <certvu>573857</certvu>
<cvename>CVE-2005-2871</cvename>
<url>http://marc.theaimsgroup.com/?l=full-disclosure&amp;m=112624614008387</url>
<url>http://www.mozilla.org/security/idn.html</url>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=307259</url>
<url>http://www.mozilla.org/security/announce/mfsa2005-57.html</url>
- </references>
- <dates>
- <discovery>2005-09-08</discovery>
- <entry>2005-09-10</entry>
+ </references> <dates>
+ <discovery>2005-09-08</discovery> <entry>2005-09-10</entry>
<modified>2005-10-26</modified>
</dates>
</vuln>
@@ -1060,228 +906,183 @@ Note: Please add new entries to the beginning of this file.
<topic>htdig -- cross site scripting vulnerability</topic>
<affects>
<package>
- <name>htdig</name>
- <range><lt>3.2.0.b6_1</lt></range>
+ <name>htdig</name> <range><lt>3.2.0.b6_1</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Michael Krax reports a vulnerability within htdig. The
vulnerability lies within an unsanitized config parameter,
allowing a malicious attacker to execute arbitrary scripting
- code on the target's browser. This might allow the attacker
- to obtain the user's cookies which are associated with the
- site, including cookies used for authentication.</p>
+ code on the target's browser. This might allow the
+ attacker to obtain the user's cookies which are associated
+ with the site, including cookies used for authentication.</p>
</body>
- </description>
- <references>
- <bid>12442</bid>
- <cvename>CVE-2005-0085</cvename>
+ </description> <references>
+ <bid>12442</bid> <cvename>CVE-2005-0085</cvename>
<url>http://www.securitytracker.com/alerts/2005/Feb/1013078.html</url>
- </references>
- <dates>
- <discovery>2005-02-03</discovery>
- <entry>2005-09-04</entry>
+ </references> <dates>
+ <discovery>2005-02-03</discovery> <entry>2005-09-04</entry>
<modified>2005-09-13</modified>
</dates>
</vuln>
<vuln vid="4e210d72-1c5c-11da-92ce-0048543d60ce">
- <topic>squid -- Denial Of Service Vulnerability in sslConnectTimeout</topic>
- <affects>
+ <topic>squid -- Denial Of Service Vulnerability in
+ sslConnectTimeout</topic> <affects>
<package>
- <name>squid</name>
- <range><lt>2.5.10_5</lt></range>
+ <name>squid</name> <range><lt>2.5.10_5</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>The squid patches page notes:</p>
- <blockquote cite="http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE10-sslConnectTimeout">
- <p>After certain slightly odd requests Squid crashes with a segmentation fault in sslConnectTimeout.</p>
+ <p>The squid patches page notes:</p> <blockquote
+ cite="http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE10-sslConnectTimeout">
+ <p>After certain slightly odd requests Squid crashes with
+ a segmentation fault in sslConnectTimeout.</p>
</blockquote>
</body>
- </description>
- <references>
- <bid>14731</bid>
- <cvename>CVE-2005-2796</cvename>
+ </description> <references>
+ <bid>14731</bid> <cvename>CVE-2005-2796</cvename>
<url>http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE10-sslConnectTimeout</url>
<url>http://www.squid-cache.org/bugs/show_bug.cgi?id=1355</url>
<url>http://secunia.com/advisories/16674/</url>
- </references>
- <dates>
- <discovery>2005-07-21</discovery>
- <entry>2005-09-04</entry>
+ </references> <dates>
+ <discovery>2005-07-21</discovery> <entry>2005-09-04</entry>
<modified>2005-10-02</modified>
</dates>
</vuln>
<vuln vid="0c0dc409-1c5e-11da-92ce-0048543d60ce">
- <topic>squid -- Possible Denial Of Service Vulnerability in store.c</topic>
- <affects>
+ <topic>squid -- Possible Denial Of Service Vulnerability in
+ store.c</topic> <affects>
<package>
- <name>squid</name>
- <range><lt>2.5.10_5</lt></range>
+ <name>squid</name> <range><lt>2.5.10_5</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>The squid patches page notes:</p>
- <blockquote cite="http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE10-STORE_PENDING">
- <p>Squid crashes with the above assertion failure [assertion failed:
- store.c:523: "e->store_status == STORE_PENDING"] in certain
- conditions involving aborted requests.</p>
+ <p>The squid patches page notes:</p> <blockquote
+ cite="http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE10-STORE_PENDING">
+ <p>Squid crashes with the above assertion failure [assertion
+ failed:
+ store.c:523: "e->store_status == STORE_PENDING"] in
+ certain conditions involving aborted requests.</p>
</blockquote>
</body>
- </description>
- <references>
- <bid>14761</bid>
- <cvename>CVE-2005-2794</cvename>
+ </description> <references>
+ <bid>14761</bid> <cvename>CVE-2005-2794</cvename>
<url>http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE10-STORE_PENDING</url>
<url>http://www.squid-cache.org/bugs/show_bug.cgi?id=1368</url>
<url>http://secunia.com/advisories/16708/</url>
- </references>
- <dates>
- <discovery>2005-08-02</discovery>
- <entry>2005-09-04</entry>
+ </references> <dates>
+ <discovery>2005-08-02</discovery> <entry>2005-09-04</entry>
<modified>2005-10-02</modified>
</dates>
</vuln>
<vuln vid="30e4ed7b-1ca6-11da-bc01-000e0c2e438a">
- <topic>bind9 -- denial of service</topic>
- <affects>
+ <topic>bind9 -- denial of service</topic> <affects>
<package>
- <name>bind9</name>
- <range><eq>9.3.0</eq></range>
- </package>
- <system>
- <name>FreeBSD</name>
- <range><ge>5.3</ge><lt>5.3_16</lt></range>
+ <name>bind9</name> <range><eq>9.3.0</eq></range>
+ </package> <system>
+ <name>FreeBSD</name> <range><ge>5.3</ge><lt>5.3_16</lt></range>
</system>
- </affects>
- <description>
- <body xmlns="http://www.w3.org/1999/xhtml">
- <p>Problem description</p>
- <p>A DNSSEC-related validator function in BIND 9.3.0 contains an
- inappropriate internal consistency test. When this test is
- triggered, named(8) will exit.</p>
- <p>Impact</p>
- <p>On systems with DNSSEC enabled, a remote attacker may be able
+ </affects> <description>
+ <body xmlns="http://www.w3.org/1999/xhtml">
+ <p>Problem description</p> <p>A DNSSEC-related validator
+ function in BIND 9.3.0 contains an
+ inappropriate internal consistency test. When this test
+ is triggered, named(8) will exit.</p>
+ <p>Impact</p> <p>On systems with DNSSEC enabled, a remote
+ attacker may be able
to inject a specially crafted packet that will cause the
internal consistency test to trigger, and named(8) to
- terminate. As a result, the name server will no longer be
- available to service requests.</p>
- <p>Workaround</p>
- <p>DNSSEC is not enabled by default, and the "dnssec-enable"
+ terminate. As a result, the name server will no longer
+ be available to service requests.</p>
+ <p>Workaround</p> <p>DNSSEC is not enabled by default, and
+ the "dnssec-enable"
directive is not normally present. If DNSSEC has been
- enabled, disable it by changing the "dnssec-enable" directive
- to "dnssec-enable no;" in the named.conf(5) configuration
- file.</p>
+ enabled, disable it by changing the "dnssec-enable"
+ directive to "dnssec-enable no;" in the named.conf(5)
+ configuration file.</p>
</body>
- </description>
- <references>
- <certvu>938617</certvu>
- <cvename>CVE-2005-0034</cvename>
+ </description> <references>
+ <certvu>938617</certvu> <cvename>CVE-2005-0034</cvename>
<url>http://www.uniras.gov.uk/niscc/docs/al-20050125-00060.html?lang=en</url>
<url>http://www.isc.org/sw/bind/bind9.3.php#security</url>
- </references>
- <dates>
- <discovery>2005-01-25</discovery>
- <entry>2005-09-03</entry>
+ </references> <dates>
+ <discovery>2005-01-25</discovery> <entry>2005-09-03</entry>
</dates>
</vuln>
<vuln vid="947f4b14-1c89-11da-bc01-000e0c2e438a">
- <topic>bind -- buffer overrun vulnerability</topic>
- <affects>
+ <topic>bind -- buffer overrun vulnerability</topic> <affects>
<package>
- <name>bind84</name>
- <range><ge>8.4.4</ge><lt>8.4.6</lt></range>
+ <name>bind84</name> <range><ge>8.4.4</ge><lt>8.4.6</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>An ISC advisory reports a buffer overrun vulnerability within
- bind. The vulnerability could result in a Denial of Service.
- A workaround is available by disabling recursion and glue
- fetching.</p>
+ <p>An ISC advisory reports a buffer overrun vulnerability
+ within
+ bind. The vulnerability could result in a Denial of
+ Service. A workaround is available by disabling recursion
+ and glue fetching.</p>
</body>
- </description>
- <references>
- <certvu>327633</certvu>
- <cvename>CVE-2005-0033</cvename>
+ </description> <references>
+ <certvu>327633</certvu> <cvename>CVE-2005-0033</cvename>
<url>http://www.uniras.gov.uk/niscc/docs/al-20050125-00059.html?lang=en</url>
<url>http://www.isc.org/sw/bind/bind-security.php</url>
- </references>
- <dates>
- <discovery>2005-01-25</discovery>
- <entry>2005-09-03</entry>
+ </references> <dates>
+ <discovery>2005-01-25</discovery> <entry>2005-09-03</entry>
<modified>2005-09-21</modified>
</dates>
</vuln>
<vuln vid="08df5d46-1baf-11da-8038-0040f42d58c6">
- <topic>urban -- stack overflow vulnerabilities</topic>
- <affects>
+ <topic>urban -- stack overflow vulnerabilities</topic> <affects>
<package>
- <name>urban</name>
- <range><lt>1.5.3_2</lt></range>
+ <name>urban</name> <range><lt>1.5.3_2</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>Several filename-related stack overflow bugs allow a local
- attacker to elevate its privileges to the games group, since
- urban is installed setgid games.</p>
+ <p>Several filename-related stack overflow bugs allow a
+ local
+ attacker to elevate its privileges to the games group,
+ since urban is installed setgid games.</p>
<p>Issue discovered and fixed by &lt;shaun@rsc.cx&gt;.</p>
</body>
- </description>
- <references>
- <cvename>CVE-2005-2864</cvename>
- <mlist msgid="55104.213.107.125.108.1125844783.squirrel@webmail.rsc.cx">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=112604855119036</mlist>
- </references>
- <dates>
- <discovery>2005-09-02</discovery>
- <entry>2005-09-02</entry>
+ </description> <references>
+ <cvename>CVE-2005-2864</cvename> <mlist
+ msgid="55104.213.107.125.108.1125844783.squirrel@webmail.rsc.cx">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=112604855119036</mlist>
+ </references> <dates>
+ <discovery>2005-09-02</discovery> <entry>2005-09-02</entry>
<modified>2005-09-22</modified>
</dates>
</vuln>
<vuln vid="6e27f3b6-189b-11da-b6be-0090274e8dbb">
- <topic>fswiki - command injection vulnerability</topic>
- <affects>
+ <topic>fswiki - command injection vulnerability</topic> <affects>
<package>
- <name>fswiki</name>
- <range><lt>3.5.9</lt></range>
+ <name>fswiki</name> <range><lt>3.5.9</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>There is a command injection vulnerability in admin page
of fswiki.</p>
</body>
- </description>
- <references>
+ </description> <references>
<url>http://jvn.jp/jp/JVN%2342435855/index.html</url>
- </references>
- <dates>
- <discovery>2005-08-29</discovery>
- <entry>2005-08-29</entry>
+ </references> <dates>
+ <discovery>2005-08-29</discovery> <entry>2005-08-29</entry>
</dates>
- </vuln>
- <vuln vid="e5afdf63-1746-11da-978e-0001020eed82">
+ </vuln> <vuln vid="e5afdf63-1746-11da-978e-0001020eed82">
<topic>evolution -- remote format string vulnerabilities</topic>
<affects>
<package>
- <name>evolution</name>
- <range><gt>1.5</gt><lt>2.2.3_1</lt></range>
+ <name>evolution</name> <range><gt>1.5</gt><lt>2.2.3_1</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>A SITIC Vulnerability Advisory reports:</p>
- <blockquote cite="http://www.sitic.se/eng/advisories_and_recommendations/sa05-001.html">
+ <p>A SITIC Vulnerability Advisory reports:</p> <blockquote
+ cite="http://www.sitic.se/eng/advisories_and_recommendations/sa05-001.html">
<p>Evolution suffers from several format string bugs when
handling data from remote sources. These bugs lead to
crashes or the execution of arbitrary assembly language
@@ -1294,22 +1095,18 @@ Note: Please add new entries to the beginning of this file.
<li>The third format string bug occurs when displaying
task list data from remote servers.</li>
<li>The fourth, and least serious, format string bug
- occurs when the user goes to the Calendars tab to save
- task list data that is vulnerable to problem 3
- above. Other calendar entries that do not come from task
- lists are also affected.</li>
+ occurs when the user goes to the Calendars tab to
+ save task list data that is vulnerable to problem 3
+ above. Other calendar entries that do not come from
+ task lists are also affected.</li>
</ol>
</blockquote>
</body>
- </description>
- <references>
- <cvename>CVE-2005-2549</cvename>
- <cvename>CVE-2005-2550</cvename>
+ </description> <references>
+ <cvename>CVE-2005-2549</cvename> <cvename>CVE-2005-2550</cvename>
<url>http://www.sitic.se/eng/advisories_and_recommendations/sa05-001.html</url>
- </references>
- <dates>
- <discovery>2005-08-10</discovery>
- <entry>2005-08-27</entry>
+ </references> <dates>
+ <discovery>2005-08-10</discovery> <entry>2005-08-27</entry>
<modified>2005-08-29</modified>
</dates>
</vuln>
@@ -1318,31 +1115,25 @@ Note: Please add new entries to the beginning of this file.
<topic>pam_ldap -- authentication bypass vulnerability</topic>
<affects>
<package>
- <name>pam_ldap</name>
- <range><lt>1.8.0</lt></range>
+ <name>pam_ldap</name> <range><lt>1.8.0</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>Luke Howard reports:</p>
- <blockquote cite="https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=166163">
- <p>If a pam_ldap client authenticates against an LDAP server
+ <p>Luke Howard reports:</p> <blockquote
+ cite="https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=166163">
+ <p>If a pam_ldap client authenticates against an LDAP
+ server
that returns a passwordPolicyResponse control, but omits
- the optional "error" field of the
- PasswordPolicyResponseValue, then the LDAP authentication
- result will be ignored and the authentication step will
- always succeed.</p>
+ the optional "error" field of the PasswordPolicyResponseValue,
+ then the LDAP authentication result will be ignored and
+ the authentication step will always succeed.</p>
</blockquote>
</body>
- </description>
- <references>
- <cvename>CVE-2005-2641</cvename>
- <certvu>778916</certvu>
+ </description> <references>
+ <cvename>CVE-2005-2641</cvename> <certvu>778916</certvu>
<url>https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=166163</url>
- </references>
- <dates>
- <discovery>2005-08-22</discovery>
- <entry>2005-08-27</entry>
+ </references> <dates>
+ <discovery>2005-08-22</discovery> <entry>2005-08-27</entry>
</dates>
</vuln>
@@ -1350,12 +1141,10 @@ Note: Please add new entries to the beginning of this file.
<topic>pcre -- regular expression buffer overflow</topic>
<affects>
<package>
- <name>pcre</name>
- <name>pcre-utf8</name>
+ <name>pcre</name> <name>pcre-utf8</name>
<range><lt>6.2</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The pcre library is vulnerable to a buffer overflow
vulnerability due to insufficient validation of quantifier
@@ -1363,15 +1152,11 @@ Note: Please add new entries to the beginning of this file.
the permissions of the program using pcre by way of a
specially crated regular expression.</p>
</body>
- </description>
- <references>
- <bid>14620</bid>
- <cvename>CVE-2005-2491</cvename>
+ </description> <references>
+ <bid>14620</bid> <cvename>CVE-2005-2491</cvename>
<url>http://www.pcre.org/changelog.txt</url>
- </references>
- <dates>
- <discovery>2005-08-01</discovery>
- <entry>2005-08-26</entry>
+ </references> <dates>
+ <discovery>2005-08-01</discovery> <entry>2005-08-26</entry>
</dates>
</vuln>
@@ -1379,188 +1164,166 @@ Note: Please add new entries to the beginning of this file.
<topic>elm -- remote buffer overflow in Expires header</topic>
<affects>
<package>
- <name>elm</name>
- <range><lt>2.5.8</lt></range>
+ <name>elm</name> <range><lt>2.5.8</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>Ulf Harnhammar has discovered a remotely exploitable buffer
- overflow in Elm e-mail client when parsing the Expires header
- of an e-mail message:</p>
- <blockquote cite="http://archives.neohapsis.com/archives/fulldisclosure/2005-08/0688.html">
+ <p>Ulf Harnhammar has discovered a remotely exploitable
+ buffer
+ overflow in Elm e-mail client when parsing the Expires
+ header of an e-mail message:</p>
+ <blockquote
+ cite="http://archives.neohapsis.com/archives/fulldisclosure/2005-08/0688.html">
<p>The attacker only needs to send the victim an e-mail
- message. When the victim with that message in his or her
- inbox starts Elm or simply views the inbox in an already
- started copy of Elm, the buffer overflow will happen
- immediately. The overflow is stack-based, and it gives full
- control over EIP, EBP and EBX. It is caused by a bad
- sscanf(3) call, using a format string containing &quot;%s&quot;
- to copy from a long char array to a shorter array.</p>
+ message. When the victim with that message in his or
+ her inbox starts Elm or simply views the inbox in an
+ already started copy of Elm, the buffer overflow will
+ happen immediately. The overflow is stack-based, and
+ it gives full control over EIP, EBP and EBX. It is
+ caused by a bad sscanf(3) call, using a format string
+ containing &quot;%s&quot; to copy from a long char array
+ to a shorter array.</p>
</blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<url>http://archives.neohapsis.com/archives/fulldisclosure/2005-08/0688.html</url>
- </references>
- <dates>
- <discovery>2005-08-20</discovery>
- <entry>2005-08-23</entry>
+ </references> <dates>
+ <discovery>2005-08-20</discovery> <entry>2005-08-23</entry>
</dates>
</vuln>
<vuln vid="5ad3e437-e527-4514-b9ed-280b2ca1a8c9">
- <topic>openvpn -- multiple TCP clients connecting with the same certificate at the same time can crash the server</topic>
+ <topic>openvpn -- multiple TCP clients connecting with the same
+ certificate at the same time can crash the server</topic>
<affects>
<package>
- <name>openvpn</name>
- <range><lt>2.0.1</lt></range>
+ <name>openvpn</name> <range><lt>2.0.1</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>James Yonan reports:</p>
- <blockquote cite="http://openvpn.net/changelog.html">
- <p>If two or more client machines try to connect to the server
- at the same time via TCP, using the same client certificate,
- and when --duplicate-cn is not enabled on the server, a race
- condition can crash the server with "Assertion failed at
- mtcp.c:411"</p>
+ <p>James Yonan reports:</p> <blockquote
+ cite="http://openvpn.net/changelog.html">
+ <p>If two or more client machines try to connect to the
+ server
+ at the same time via TCP, using the same client
+ certificate, and when --duplicate-cn is not enabled on
+ the server, a race condition can crash the server with
+ "Assertion failed at mtcp.c:411"</p>
</blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2005-2534</cvename>
<url>http://openvpn.net/changelog.html</url>
- </references>
- <dates>
- <discovery>2005-08-03</discovery>
- <entry>2005-08-19</entry>
+ </references> <dates>
+ <discovery>2005-08-03</discovery> <entry>2005-08-19</entry>
</dates>
</vuln>
<vuln vid="1986449a-8b74-40fa-b7cc-0d8def8aad65">
- <topic>openvpn -- denial of service: malicious authenticated &quot;tap&quot; client can deplete server virtual memory</topic>
+ <topic>openvpn -- denial of service: malicious authenticated
+ &quot;tap&quot; client can deplete server virtual memory</topic>
<affects>
<package>
- <name>openvpn</name>
- <range><lt>2.0.1</lt></range>
+ <name>openvpn</name> <range><lt>2.0.1</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>James Yonan reports:</p>
- <blockquote cite="http://openvpn.net/changelog.html">
+ <p>James Yonan reports:</p> <blockquote
+ cite="http://openvpn.net/changelog.html">
<p>A malicious [authenticated] client in &quot;dev tap&quot;
- ethernet bridging mode could theoretically flood the server
- with packets appearing to come from hundreds of thousands
- of different MAC addresses, causing the OpenVPN process to
- deplete system virtual memory as it expands its internal
- routing table.</p>
+ ethernet bridging mode could theoretically flood the
+ server with packets appearing to come from hundreds of
+ thousands of different MAC addresses, causing the OpenVPN
+ process to deplete system virtual memory as it expands
+ its internal routing table.</p>
</blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2005-2533</cvename>
<url>http://openvpn.net/changelog.html</url>
- </references>
- <dates>
- <discovery>2005-07-27</discovery>
- <entry>2005-08-19</entry>
+ </references> <dates>
+ <discovery>2005-07-27</discovery> <entry>2005-08-19</entry>
</dates>
</vuln>
<vuln vid="d1c39c8e-05ab-4739-870f-765490fa2052">
- <topic>openvpn -- denial of service: undecryptable packet from authorized client can disconnect unrelated clients</topic>
+ <topic>openvpn -- denial of service: undecryptable packet from
+ authorized client can disconnect unrelated clients</topic>
<affects>
<package>
- <name>openvpn</name>
- <range><lt>2.0.1</lt></range>
+ <name>openvpn</name> <range><lt>2.0.1</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>James Yonan reports:</p>
- <blockquote cite="http://openvpn.net/changelog.html">
- <p>If the client sends a packet which fails to decrypt on the
+ <p>James Yonan reports:</p> <blockquote
+ cite="http://openvpn.net/changelog.html">
+ <p>If the client sends a packet which fails to decrypt
+ on the
server, the OpenSSL error queue is not properly flushed,
- which can result in another unrelated client instance on the
- server seeing the error and responding to it, resulting in
- disconnection of the unrelated client.</p>
+ which can result in another unrelated client instance
+ on the server seeing the error and responding to it,
+ resulting in disconnection of the unrelated client.</p>
</blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2005-2532</cvename>
<url>http://openvpn.net/changelog.html</url>
- </references>
- <dates>
- <discovery>2005-07-27</discovery>
- <entry>2005-08-19</entry>
+ </references> <dates>
+ <discovery>2005-07-27</discovery> <entry>2005-08-19</entry>
</dates>
</vuln>
<vuln vid="a51ad838-2077-48b2-a136-e888a7db5f8d">
- <topic>openvpn -- denial of service: client certificate validation can disconnect unrelated clients</topic>
- <affects>
+ <topic>openvpn -- denial of service: client certificate validation
+ can disconnect unrelated clients</topic> <affects>
<package>
- <name>openvpn</name>
- <range><lt>2.0.1</lt></range>
+ <name>openvpn</name> <range><lt>2.0.1</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>James Yonan reports:</p>
- <blockquote cite="http://openvpn.net/changelog.html">
+ <p>James Yonan reports:</p> <blockquote
+ cite="http://openvpn.net/changelog.html">
<p>DoS attack against server when run with "verb 0" and
- without "tls-auth". If a client connection to the server
- fails certificate verification, the OpenSSL error queue is
- not properly flushed, which can result in another unrelated
- client instance on the server seeing the error and
- responding to it, resulting in disconnection of the
- unrelated client.</p>
+ without "tls-auth". If a client connection to the
+ server fails certificate verification, the OpenSSL error
+ queue is not properly flushed, which can result in
+ another unrelated client instance on the server seeing
+ the error and responding to it, resulting in disconnection
+ of the unrelated client.</p>
</blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2005-2531</cvename>
<url>http://openvpn.net/changelog.html</url>
- </references>
- <dates>
- <discovery>2005-08-03</discovery>
- <entry>2005-08-19</entry>
+ </references> <dates>
+ <discovery>2005-08-03</discovery> <entry>2005-08-19</entry>
</dates>
</vuln>
<vuln vid="5fde5c30-0f4e-11da-bc01-000e0c2e438a">
- <topic>tor -- diffie-hellman handshake flaw</topic>
- <affects>
+ <topic>tor -- diffie-hellman handshake flaw</topic> <affects>
<package>
- <name>tor</name>
- <range><lt>0.1.0.14</lt></range>
+ <name>tor</name> <range><lt>0.1.0.14</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>A tor advisory reports</p>
- <blockquote cite="http://archives.seul.org/or/announce/Aug-2005/msg00002.html">
+ <p>A tor advisory reports</p> <blockquote
+ cite="http://archives.seul.org/or/announce/Aug-2005/msg00002.html">
<p>Tor clients can completely loose anonymity, confidentiality,
- and data integrity if the first Tor server in their path is
- malicious. Specifically, if the Tor client chooses a
- malicious Tor server for her first hop in the circuit, that
- server can learn all the keys she negotiates for the rest of
- the circuit (or just spoof the whole circuit), and then read
- and/or modify all her traffic over that circuit.</p>
+ and data integrity if the first Tor server in their
+ path is malicious. Specifically, if the Tor client
+ chooses a malicious Tor server for her first hop in the
+ circuit, that server can learn all the keys she negotiates
+ for the rest of the circuit (or just spoof the whole
+ circuit), and then read and/or modify all her traffic
+ over that circuit.</p>
</blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2005-2643</cvename>
<url>http://archives.seul.org/or/announce/Aug-2005/msg00002.html</url>
- </references>
- <dates>
- <discovery>2005-08-11</discovery>
- <entry>2005-08-17</entry>
+ </references> <dates>
+ <discovery>2005-08-11</discovery> <entry>2005-08-17</entry>
<modified>2005-09-21</modified>
</dates>
</vuln>
@@ -1569,41 +1332,33 @@ Note: Please add new entries to the beginning of this file.
<topic>acroread -- plug-in buffer overflow vulnerability</topic>
<affects>
<package>
- <name>acroread</name>
- <range><lt>7.0.1</lt></range>
+ <name>acroread</name> <range><lt>7.0.1</lt></range>
<range><gt>5.*,1</gt><lt>7.0.1,1</lt></range>
- </package>
- <package>
- <name>acroread4</name>
- <name>acroread5</name>
+ </package> <package>
+ <name>acroread4</name> <name>acroread5</name>
<range><ge>0</ge></range>
+ </package> <package>
+ <name>acroread7</name> <range><lt>7.0.1</lt></range>
</package>
- <package>
- <name>acroread7</name>
- <range><lt>7.0.1</lt></range>
- </package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>A Adobe Security Advisory reports:</p>
- <blockquote cite="http://www.adobe.com/support/techdocs/321644.html">
- <p>The identified vulnerability is a buffer overflow within
- a core application plug-in, which is part of Adobe Acrobat
- and Adobe Reader. If a malicious file were opened it could
- trigger a buffer overflow as the file is being loaded into
- Adobe Acrobat and Adobe Reader. A buffer overflow can
- cause the application to crash and increase the risk of
- malicious code execution.</p>
+ <p>A Adobe Security Advisory reports:</p> <blockquote
+ cite="http://www.adobe.com/support/techdocs/321644.html">
+ <p>The identified vulnerability is a buffer overflow
+ within
+ a core application plug-in, which is part of Adobe
+ Acrobat and Adobe Reader. If a malicious file were
+ opened it could trigger a buffer overflow as the file
+ is being loaded into Adobe Acrobat and Adobe Reader. A
+ buffer overflow can cause the application to crash and
+ increase the risk of malicious code execution.</p>
</blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2005-2470</cvename>
<url>http://www.adobe.com/support/techdocs/321644.html</url>
- </references>
- <dates>
- <discovery>2005-08-16</discovery>
- <entry>2005-08-16</entry>
+ </references> <dates>
+ <discovery>2005-08-16</discovery> <entry>2005-08-16</entry>
</dates>
</vuln>
@@ -1611,56 +1366,45 @@ Note: Please add new entries to the beginning of this file.
<topic>pear-XML_RPC -- remote PHP code injection vulnerability</topic>
<affects>
<package>
- <name>pear-XML_RPC</name>
- <range><lt>1.4.0</lt></range>
- </package>
- <package>
- <name>phpmyfaq</name>
- <range><lt>1.4.11</lt></range>
- </package>
- <package>
- <name>drupal</name>
- <range><lt>4.6.3</lt></range>
- </package>
- <package>
- <name>eGroupWare</name>
- <range><lt>1.0.0.009</lt></range>
- </package>
- <package>
- <name>phpAdsNew</name>
- <range><lt>2.0.5</lt></range>
- </package>
- <package>
- <name>phpgroupware</name>
- <range><lt>0.9.16.007</lt></range>
- </package>
- <package>
- <name>b2evolution</name>
- <range><lt>0.9.0.12_2</lt></range>
+ <name>pear-XML_RPC</name> <range><lt>1.4.0</lt></range>
+ </package> <package>
+ <name>phpmyfaq</name> <range><lt>1.4.11</lt></range>
+ </package> <package>
+ <name>drupal</name> <range><lt>4.6.3</lt></range>
+ </package> <package>
+ <name>eGroupWare</name> <range><lt>1.0.0.009</lt></range>
+ </package> <package>
+ <name>phpAdsNew</name> <range><lt>2.0.5</lt></range>
+ </package> <package>
+ <name>phpgroupware</name> <range><lt>0.9.16.007</lt></range>
+ </package> <package>
+ <name>b2evolution</name> <range><lt>0.9.0.12_2</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Hardened-PHP Project Security Advisory reports:</p>
- <blockquote cite="http://www.hardened-php.net/advisory_142005.66.html">
- <p>When the library parses XMLRPC requests/responses, it constructs
- a string of PHP code, that is later evaluated. This means any
- failure to properly handle the construction of this string can
- result in arbitrary execution of PHP code.</p>
- <p>This new injection vulnerability is cause by not properly
+ <blockquote
+ cite="http://www.hardened-php.net/advisory_142005.66.html">
+ <p>When the library parses XMLRPC requests/responses, it
+ constructs
+ a string of PHP code, that is later evaluated. This
+ means any failure to properly handle the construction
+ of this string can result in arbitrary execution of PHP
+ code.</p>
+ <p>This new injection vulnerability is cause by not
+ properly
handling the situation, when certain XML tags are nested
- in the parsed document, that were never meant to be nested
- at all. This can be easily exploited in a way, that
- user-input is placed outside of string delimiters within
- the evaluation string, which obviously results in
- arbitrary code execution.</p>
- </blockquote>
- <p>Note that several applications contains an embedded version
- on XML_RPC, therefor making them the vulnerable to the same
- code injection vulnerability.</p>
- </body>
- </description>
- <references>
+ in the parsed document, that were never meant to be
+ nested at all. This can be easily exploited in a way,
+ that user-input is placed outside of string delimiters
+ within the evaluation string, which obviously results
+ in arbitrary code execution.</p>
+ </blockquote> <p>Note that several applications contains
+ an embedded version
+ on XML_RPC, therefor making them the vulnerable to the
+ same code injection vulnerability.</p>
+ </body>
+ </description> <references>
<cvename>CVE-2005-2498</cvename>
<url>http://b2evolution.net/news/2005/08/31/fix_for_xml_rpc_vulnerability_again_1</url>
<url>http://downloads.phpgroupware.org/changelog</url>
@@ -1670,10 +1414,8 @@ Note: Please add new entries to the beginning of this file.
<url>http://www.hardened-php.net/advisory_142005.66.html</url>
<url>http://www.hardened-php.net/advisory_152005.67.html</url>
<url>http://www.phpmyfaq.de/advisory_2005-08-15.php</url>
- </references>
- <dates>
- <discovery>2005-08-15</discovery>
- <entry>2005-08-15</entry>
+ </references> <dates>
+ <discovery>2005-08-15</discovery> <entry>2005-08-15</entry>
<modified>2005-09-04</modified>
</dates>
</vuln>
@@ -1682,83 +1424,68 @@ Note: Please add new entries to the beginning of this file.
<topic>awstats -- arbitrary code execution vulnerability</topic>
<affects>
<package>
- <name>awstats</name>
- <range><lt>6.4_1</lt></range>
+ <name>awstats</name> <range><lt>6.4_1</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>An iDEFENSE Security Advisory reports:</p>
- <blockquote cite="http://www.idefense.com/application/poi/display?id=290&amp;type=vulnerabilities">
+ <p>An iDEFENSE Security Advisory reports:</p> <blockquote
+ cite="http://www.idefense.com/application/poi/display?id=290&amp;type=vulnerabilities">
<p>Remote exploitation of an input validation vulnerability
in AWStats allows remote attackers to execute arbitrary
commands.</p>
<p>The problem specifically exists because of insufficient
- input filtering before passing user-supplied data to an
- <code>eval()</code> function. As part of the statistics
- reporting function, AWStats displays information about the
- most common referrer values that caused users to visit the
- website. The referrer data is used without proper
- sanitation in an <code>eval()</code> statement, resulting
- in the execution of arbitrary perl code.</p>
+ input filtering before passing user-supplied data to
+ an <code>eval()</code> function. As part of the statistics
+ reporting function, AWStats displays information about
+ the most common referrer values that caused users to
+ visit the website. The referrer data is used without
+ proper sanitation in an <code>eval()</code> statement,
+ resulting in the execution of arbitrary perl code.</p>
<p>Successful exploitation results in the execution of
- arbitrary commands with permissions of the web
- service. Exploitation will not occur until the stats page
- has been regenerated with the tainted referrer values from
+ arbitrary commands with permissions of the web service.
+ Exploitation will not occur until the stats page has
+ been regenerated with the tainted referrer values from
the http access log. Note that AWStats is only vulnerable
in situations where at least one URLPlugin is enabled.</p>
</blockquote>
</body>
- </description>
- <references>
- <cvename>CVE-2005-1527</cvename>
- <mlist msgid="20050811155502.61E3C7A00B4@mail.idefense.com">http://marc.theaimsgroup.com/?l=full-disclosure&amp;m=112377934108902</mlist>
+ </description> <references>
+ <cvename>CVE-2005-1527</cvename> <mlist
+ msgid="20050811155502.61E3C7A00B4@mail.idefense.com">http://marc.theaimsgroup.com/?l=full-disclosure&amp;m=112377934108902</mlist>
<url>http://www.idefense.com/application/poi/display?id=290&amp;type=vulnerabilities</url>
- </references>
- <dates>
- <discovery>2005-08-09</discovery>
- <entry>2005-08-14</entry>
+ </references> <dates>
+ <discovery>2005-08-09</discovery> <entry>2005-08-14</entry>
<modified>2005-08-23</modified>
</dates>
</vuln>
<vuln vid="3b4a6982-0b24-11da-bc08-0001020eed82">
- <topic>libgadu -- multiple vulnerabilities</topic>
- <affects>
- <package>
- <name>gaim</name>
- <name>ja-gaim</name>
- <name>ko-gaim</name>
- <name>ru-gaim</name>
- <range><lt>1.4.0_1</lt></range>
- </package>
- <package>
- <name>kdenetwork</name>
- <range><gt>3.2.2</gt><lt>3.4.2</lt></range>
- </package>
- <package>
- <name>pl-ekg</name>
- <range><lt>1.6r3,1</lt></range>
- </package>
- <package>
- <name>centericq</name>
- <range><lt>4.21.0_1</lt></range>
- </package>
- </affects>
- <description>
- <body xmlns="http://www.w3.org/1999/xhtml">
- <p>Wojtek Kaniewski reports:</p>
- <blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=112198499417250">
- <p>Multiple vulnerabilities have been found in libgadu, a
- library for handling Gadu-Gadu instant messaging
- protocol. It is a part of ekg, a Gadu-Gadu client, but is
- widely used in other clients. Also some of the user
- contributed scripts were found to behave in an insecure
- manner.</p>
+ <topic>libgadu -- multiple vulnerabilities</topic> <affects>
+ <package>
+ <name>gaim</name> <name>ja-gaim</name> <name>ko-gaim</name>
+ <name>ru-gaim</name> <range><lt>1.4.0_1</lt></range>
+ </package> <package>
+ <name>kdenetwork</name> <range><gt>3.2.2</gt><lt>3.4.2</lt></range>
+ </package> <package>
+ <name>pl-ekg</name> <range><lt>1.6r3,1</lt></range>
+ </package> <package>
+ <name>centericq</name> <range><lt>4.21.0_1</lt></range>
+ </package>
+ </affects> <description>
+ <body xmlns="http://www.w3.org/1999/xhtml">
+ <p>Wojtek Kaniewski reports:</p> <blockquote
+ cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=112198499417250">
+ <p>Multiple vulnerabilities have been found in libgadu,
+ a
+ library for handling Gadu-Gadu instant messaging protocol.
+ It is a part of ekg, a Gadu-Gadu client, but is widely
+ used in other clients. Also some of the user contributed
+ scripts were found to behave in an insecure manner.</p>
<ul>
- <li>integer overflow in libgadu (CVE-2005-1852) that could
+ <li>integer overflow in libgadu (CVE-2005-1852) that
+ could
be triggered by an incomming message and lead to
application crash and/or remote code execution</li>
<li>insecure file creation (CVE-2005-1850) and shell
@@ -1769,49 +1496,37 @@ Note: Please add new entries to the beginning of this file.
triggered by an incomming network data or an application
passing invalid user input to the library</li>
<li>memory alignment errors in libgadu that could be
- triggered by an incomming message and lead to bus errors
- on architectures like SPARC</li>
+ triggered by an incomming message and lead to bus
+ errors on architectures like SPARC</li>
<li>endianness errors in libgadu that could cause invalid
- behaviour of applications on big-endian
- architectures</li>
+ behaviour of applications on big-endian architectures</li>
</ul>
</blockquote>
</body>
- </description>
- <references>
- <bid>14345</bid>
- <cvename>CVE-2005-1850</cvename>
- <cvename>CVE-2005-1851</cvename>
- <cvename>CVE-2005-1852</cvename>
- <cvename>CVE-2005-2369</cvename>
- <cvename>CVE-2005-2370</cvename>
- <cvename>CVE-2005-2448</cvename>
- <mlist msgid="42DFF06F.7060005@toxygen.net">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=112198499417250</mlist>
+ </description> <references>
+ <bid>14345</bid> <cvename>CVE-2005-1850</cvename>
+ <cvename>CVE-2005-1851</cvename> <cvename>CVE-2005-1852</cvename>
+ <cvename>CVE-2005-2369</cvename> <cvename>CVE-2005-2370</cvename>
+ <cvename>CVE-2005-2448</cvename> <mlist
+ msgid="42DFF06F.7060005@toxygen.net">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=112198499417250</mlist>
<url>http://gaim.sourceforge.net/security/?id=20</url>
<url>http://www.kde.org/info/security/advisory-20050721-1.txt</url>
- </references>
- <dates>
- <discovery>2005-07-21</discovery>
- <entry>2005-08-12</entry>
+ </references> <dates>
+ <discovery>2005-07-21</discovery> <entry>2005-08-12</entry>
<modified>2005-10-23</modified>
</dates>
</vuln>
<vuln vid="09db2844-0b21-11da-bc08-0001020eed82">
- <topic>gaim -- AIM/ICQ non-UTF-8 filename crash</topic>
- <affects>
+ <topic>gaim -- AIM/ICQ non-UTF-8 filename crash</topic> <affects>
<package>
- <name>gaim</name>
- <name>ja-gaim</name>
- <name>ko-gaim</name>
- <name>ru-gaim</name>
- <range><lt>1.4.0_1</lt></range>
+ <name>gaim</name> <name>ja-gaim</name> <name>ko-gaim</name>
+ <name>ru-gaim</name> <range><lt>1.4.0_1</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>The GAIM team reports:</p>
- <blockquote cite="http://gaim.sourceforge.net/security/?id=21">
+ <p>The GAIM team reports:</p> <blockquote
+ cite="http://gaim.sourceforge.net/security/?id=21">
<p>A remote user could cause Gaim to crash on some systems
by sending the Gaim user a file whose filename contains
certain invalid characters. It is unknown what combination
@@ -1820,14 +1535,11 @@ Note: Please add new entries to the beginning of this file.
especially susceptible.</p>
</blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2005-2102</cvename>
<url>http://gaim.sourceforge.net/security/?id=21</url>
- </references>
- <dates>
- <discovery>2005-08-09</discovery>
- <entry>2005-08-12</entry>
+ </references> <dates>
+ <discovery>2005-08-09</discovery> <entry>2005-08-12</entry>
</dates>
</vuln>
@@ -1835,74 +1547,56 @@ Note: Please add new entries to the beginning of this file.
<topic>gaim -- AIM/ICQ away message buffer overflow</topic>
<affects>
<package>
- <name>gaim</name>
- <name>ja-gaim</name>
- <name>ko-gaim</name>
- <name>ru-gaim</name>
- <range><lt>1.4.0_1</lt></range>
+ <name>gaim</name> <name>ja-gaim</name> <name>ko-gaim</name>
+ <name>ru-gaim</name> <range><lt>1.4.0_1</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>The GAIM team reports:</p>
- <blockquote cite="http://gaim.sourceforge.net/security/?id=22">
- <p>A remote AIM or ICQ user can cause a buffer overflow in
+ <p>The GAIM team reports:</p> <blockquote
+ cite="http://gaim.sourceforge.net/security/?id=22">
+ <p>A remote AIM or ICQ user can cause a buffer overflow
+ in
Gaim by setting an away message containing many AIM
substitution strings (such as %t or %n).</p>
</blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2005-2103</cvename>
<url>http://gaim.sourceforge.net/security/?id=22</url>
- </references>
- <dates>
- <discovery>2005-08-09</discovery>
- <entry>2005-08-12</entry>
+ </references> <dates>
+ <discovery>2005-08-09</discovery> <entry>2005-08-12</entry>
</dates>
</vuln>
<vuln vid="24eee285-09c7-11da-bc08-0001020eed82">
- <topic>xpdf -- disk fill DoS vulnerability</topic>
- <affects>
+ <topic>xpdf -- disk fill DoS vulnerability</topic> <affects>
<package>
- <name>xpdf</name>
- <range><lt>3.00_7</lt></range>
- </package>
- <package>
- <name>kdegraphics</name>
- <range><lt>3.4.2</lt></range>
- </package>
- <package>
- <name>gpdf</name>
- <range><lt>2.10.0_2</lt></range>
- </package>
- <package>
- <name>cups-base</name>
- <range><lt>1.1.23.0_5</lt></range>
+ <name>xpdf</name> <range><lt>3.00_7</lt></range>
+ </package> <package>
+ <name>kdegraphics</name> <range><lt>3.4.2</lt></range>
+ </package> <package>
+ <name>gpdf</name> <range><lt>2.10.0_2</lt></range>
+ </package> <package>
+ <name>cups-base</name> <range><lt>1.1.23.0_5</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>xpdf is vulnerable to a denial of service vulnerability
which can cause xpdf to create an infinitely large file,
thereby filling up the /tmp partition, when opening a
specially crafted PDF file.</p>
- <p>Note that several applications contains an embedded version
+ <p>Note that several applications contains an embedded
+ version
of xpdf, therefor making them the vulnerable to the same
DoS. In CUPS this vulnerability would cause the pdftops
filter to crash.</p>
</body>
- </description>
- <references>
- <bid>14529</bid>
- <cvename>CVE-2005-2097</cvename>
+ </description> <references>
+ <bid>14529</bid> <cvename>CVE-2005-2097</cvename>
<url>http://rhn.redhat.com/errata/RHSA-2005-670.html</url>
<url>http://www.kde.org/info/security/advisory-20050809-1.txt</url>
- </references>
- <dates>
- <discovery>2005-08-09</discovery>
- <entry>2005-08-12</entry>
+ </references> <dates>
+ <discovery>2005-08-09</discovery> <entry>2005-08-12</entry>
<modified>2005-09-07</modified>
</dates>
</vuln>
@@ -1911,115 +1605,101 @@ Note: Please add new entries to the beginning of this file.
<topic>gforge -- XSS and email flood vulnerabilities</topic>
<affects>
<package>
- <name>gforge</name>
- <range><gt>0</gt></range>
+ <name>gforge</name> <range><gt>0</gt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jose Antonio Coret reports that GForge contains multiple
Cross Site Scripting vulnerabilities and an e-mail flood
vulnerability:</p>
- <blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=112259845904350">
+ <blockquote
+ cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=112259845904350">
<p>The login form is also vulnerable to XSS (Cross Site
- Scripting) attacks. This may be used to launch phising
+ Scripting) attacks. This may be used to launch phising
attacks by sending HTML e-mails (i.e.: saying that you
need to upgrade to the latest GForge version due to a
- security problem) and putting in the e-mail an HTML link
- that points to an specially crafted url that inserts an
- html form in the GForge login page and when the user press
- the login button, he/she send the credentials to the
- attackers website.</p>
-
- <p>The 'forgot your password?' feature allows a remote user
+ security problem) and putting in the e-mail an HTML
+ link that points to an specially crafted url that inserts
+ an html form in the GForge login page and when the user
+ press the login button, he/she send the credentials to
+ the attackers website.</p>
+
+ <p>The 'forgot your password?' feature allows a remote
+ user
to load a certain URL to cause the service to send a
validation e-mail to the specified user's e-mail address.
- There is no limit to the number of messages sent over a
- period of time, so a remote user can flood the target
+ There is no limit to the number of messages sent over
+ a period of time, so a remote user can flood the target
user's secondary e-mail address. E-Mail Flood, E-Mail
bomber.</p>
</blockquote>
</body>
- </description>
- <references>
- <bid>14405</bid>
- <cvename>CVE-2005-2430</cvename>
- <cvename>CVE-2005-2431</cvename>
- <mlist msgid="1122496636.26878.2.camel@localhost.localdomain">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=112259845904350</mlist>
- </references>
- <dates>
- <discovery>2005-07-27</discovery>
- <entry>2005-08-09</entry>
+ </description> <references>
+ <bid>14405</bid> <cvename>CVE-2005-2430</cvename>
+ <cvename>CVE-2005-2431</cvename> <mlist
+ msgid="1122496636.26878.2.camel@localhost.localdomain">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=112259845904350</mlist>
+ </references> <dates>
+ <discovery>2005-07-27</discovery> <entry>2005-08-09</entry>
</dates>
</vuln>
<vuln vid="0274a9f1-0759-11da-bc08-0001020eed82">
- <topic>postnuke -- multiple vulnerabilities</topic>
- <affects>
+ <topic>postnuke -- multiple vulnerabilities</topic> <affects>
<package>
- <name>postnuke</name>
- <range><lt>0.760</lt></range>
+ <name>postnuke</name> <range><lt>0.760</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Postnuke Security Announcementss reports of the following
vulnerabilities:</p>
<blockquote cite="http://news.postnuke.com/Article2691.html">
<ul>
- <li>missing input validation within /modules/Messages/readpmsg.php</li>
- <li>possible path disclosure within /user.php</li>
- <li>possible path disclosure within /modules/News/article.php</li>
- <li>possible remote code injection within /includes/pnMod.php</li>
- <li>possible cross-site-scripting in /index.php</li>
+ <li>missing input validation within
+ /modules/Messages/readpmsg.php</li> <li>possible path
+ disclosure within /user.php</li> <li>possible path
+ disclosure within /modules/News/article.php</li>
+ <li>possible remote code injection within
+ /includes/pnMod.php</li> <li>possible cross-site-scripting
+ in /index.php</li>
</ul>
- </blockquote>
- <blockquote cite="http://news.postnuke.com/Article2699.html">
+ </blockquote> <blockquote
+ cite="http://news.postnuke.com/Article2699.html">
<ul>
<li>remote code injection via xml rpc library</li>
</ul>
</blockquote>
</body>
- </description>
- <references>
- <cvename>CVE-2005-1621</cvename>
- <cvename>CVE-2005-1695</cvename>
- <cvename>CVE-2005-1696</cvename>
- <cvename>CVE-2005-1698</cvename>
- <cvename>CVE-2005-1777</cvename>
- <cvename>CVE-2005-1778</cvename>
- <cvename>CVE-2005-1921</cvename>
- <mlist msgid="20050527223753.21735.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=111721364707520</mlist>
+ </description> <references>
+ <cvename>CVE-2005-1621</cvename> <cvename>CVE-2005-1695</cvename>
+ <cvename>CVE-2005-1696</cvename> <cvename>CVE-2005-1698</cvename>
+ <cvename>CVE-2005-1777</cvename> <cvename>CVE-2005-1778</cvename>
+ <cvename>CVE-2005-1921</cvename> <mlist
+ msgid="20050527223753.21735.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=111721364707520</mlist>
<url>http://secunia.com/advisories/15450/</url>
<url>http://news.postnuke.com/Article2691.html</url>
<url>http://news.postnuke.com/Article2699.html</url>
- </references>
- <dates>
- <discovery>2005-05-27</discovery>
- <entry>2005-08-08</entry>
+ </references> <dates>
+ <discovery>2005-05-27</discovery> <entry>2005-08-08</entry>
</dates>
</vuln>
<vuln vid="0bf9d7fb-05b3-11da-bc08-0001020eed82">
- <topic>mambo -- multiple vulnerabilities</topic>
- <affects>
+ <topic>mambo -- multiple vulnerabilities</topic> <affects>
<package>
- <name>mambo</name>
- <range><lt>4.5.2.3</lt></range>
+ <name>mambo</name> <range><lt>4.5.2.3</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>A Secunia Advisory reports:</p>
- <blockquote cite="http://secunia.com/advisories/15710/">
+ <p>A Secunia Advisory reports:</p> <blockquote
+ cite="http://secunia.com/advisories/15710/">
<p>Some vulnerabilities have been reported in Mambo, where
- some have unknown impacts and others can be exploited by
- malicious people to conduct spoofing and SQL injection
+ some have unknown impacts and others can be exploited
+ by malicious people to conduct spoofing and SQL injection
attacks.</p>
<ol>
<li>Input passed to the "user_rating" parameter when
- voting isn't properly sanitised before being used in a
- SQL query. This can be exploited to manipulate SQL
+ voting isn't properly sanitised before being used in
+ a SQL query. This can be exploited to manipulate SQL
queries by injecting arbitrary SQL code.</li>
<li>Some unspecified vulnerabilities in the "mosDBTable"
class and the "DOMIT" library have an unknown
@@ -2029,15 +1709,11 @@ Note: Please add new entries to the beginning of this file.
</ol>
</blockquote>
</body>
- </description>
- <references>
- <bid>13966</bid>
- <cvename>CVE-2005-2002</cvename>
+ </description> <references>
+ <bid>13966</bid> <cvename>CVE-2005-2002</cvename>
<url>http://secunia.com/advisories/15710/</url>
- </references>
- <dates>
- <discovery>2005-06-15</discovery>
- <entry>2005-08-05</entry>
+ </references> <dates>
+ <discovery>2005-06-15</discovery> <entry>2005-08-05</entry>
</dates>
</vuln>
@@ -2045,189 +1721,156 @@ Note: Please add new entries to the beginning of this file.
<topic>ipsec -- Incorrect key usage in AES-XCBC-MAC</topic>
<affects>
<system>
- <name>FreeBSD</name>
- <range><ge>5.4</ge><lt>5.4_6</lt></range>
+ <name>FreeBSD</name> <range><ge>5.4</ge><lt>5.4_6</lt></range>
<range><ge>5.*</ge><lt>5.3_20</lt></range>
</system>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <h1>Problem description</h1>
- <p>A programming error in the implementation of the
+ <h1>Problem description</h1> <p>A programming error in the
+ implementation of the
AES-XCBC-MAC algorithm for authentication resulted in a
- constant key being used instead of the key specified by the
- system administrator.</p>
- <h1>Impact</h1>
- <p>If the AES-XCBC-MAC algorithm is used for authentication in
- the absence of any encryption, then an attacker may be able to
- forge packets which appear to originate from a different
- system and thereby succeed in establishing an IPsec session.
- If access to sensitive information or systems is controlled
- based on the identity of the source system, this may result
- in information disclosure or privilege escalation.</p>
+ constant key being used instead of the key specified by
+ the system administrator.</p>
+ <h1>Impact</h1> <p>If the AES-XCBC-MAC algorithm is used
+ for authentication in
+ the absence of any encryption, then an attacker may be
+ able to forge packets which appear to originate from a
+ different system and thereby succeed in establishing an
+ IPsec session. If access to sensitive information or
+ systems is controlled based on the identity of the source
+ system, this may result in information disclosure or
+ privilege escalation.</p>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2005-2359</cvename>
<freebsdsa>SA-05:19.ipsec</freebsdsa>
- </references>
- <dates>
- <discovery>2005-07-27</discovery>
- <entry>2005-08-05</entry>
+ </references> <dates>
+ <discovery>2005-07-27</discovery> <entry>2005-08-05</entry>
</dates>
</vuln>
<vuln vid="837b9fb2-0595-11da-86bc-000e0c2e438a">
- <topic>zlib -- buffer overflow vulnerability</topic>
- <affects>
+ <topic>zlib -- buffer overflow vulnerability</topic> <affects>
<package>
- <name>linux_base-suse</name>
- <range><lt>9.3_1</lt></range>
- </package>
- <system>
- <name>FreeBSD</name>
- <range><ge>5.4</ge><lt>5.4_6</lt></range>
+ <name>linux_base-suse</name> <range><lt>9.3_1</lt></range>
+ </package> <system>
+ <name>FreeBSD</name> <range><ge>5.4</ge><lt>5.4_6</lt></range>
<range><ge>5.3</ge><lt>5.3_20</lt></range>
</system>
- </affects>
- <description>
- <body xmlns="http://www.w3.org/1999/xhtml">
- <h1>Problem description</h1>
- <p>A fixed-size buffer is used in the decompression of data
- streams. Due to erronous analysis performed when zlib was
- written, this buffer, which was belived to be sufficiently
- large to handle any possible input stream, is in fact too
- small.</p>
- <h1>Impact</h1>
- <p>A carefully constructed compressed data stream can result in
+ </affects> <description>
+ <body xmlns="http://www.w3.org/1999/xhtml">
+ <h1>Problem description</h1> <p>A fixed-size buffer is used
+ in the decompression of data
+ streams. Due to erronous analysis performed when zlib
+ was written, this buffer, which was belived to be
+ sufficiently large to handle any possible input stream,
+ is in fact too small.</p>
+ <h1>Impact</h1> <p>A carefully constructed compressed data
+ stream can result in
zlib overwriting some data structures. This may cause
- applications to halt, resulting in a denial of service; or
- it may result in an attacker gaining elevated privileges.</p>
+ applications to halt, resulting in a denial of service;
+ or it may result in an attacker gaining elevated
+ privileges.</p>
</body>
- </description>
- <references>
- <cvename>CVE-2005-1849</cvename>
- <freebsdsa>SA-05:18.zlib</freebsdsa>
- </references>
- <dates>
- <discovery>2005-07-27</discovery>
- <entry>2005-08-05</entry>
+ </description> <references>
+ <cvename>CVE-2005-1849</cvename> <freebsdsa>SA-05:18.zlib</freebsdsa>
+ </references> <dates>
+ <discovery>2005-07-27</discovery> <entry>2005-08-05</entry>
<modified>2005-09-24</modified>
</dates>
</vuln>
<vuln vid="7257b26f-0597-11da-86bc-000e0c2e438a">
- <topic>devfs -- ruleset bypass</topic>
- <affects>
+ <topic>devfs -- ruleset bypass</topic> <affects>
<system>
- <name>FreeBSD</name>
- <range><ge>5.4</ge><lt>5.4_5</lt></range>
+ <name>FreeBSD</name> <range><ge>5.4</ge><lt>5.4_5</lt></range>
<range><ge>5.*</ge><lt>5.3_19</lt></range>
</system>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <h1>Problem description</h1>
- <p>Due to insufficient parameter checking of the node type
+ <h1>Problem description</h1> <p>Due to insufficient parameter
+ checking of the node type
during device creation, any user can expose hidden device
nodes on devfs mounted file systems within their jail.
Device nodes will be created in the jail with their normal
default access permissions.</p>
- <h1>Impact</h1>
- <p>Jailed processes can get access to restricted resources on
- the host system. For jailed processes running with superuser
- privileges this implies access to all devices on the system.
- This level of access can lead to information leakage and
- privilege escalation.</p>
- </body>
- </description>
- <references>
+ <h1>Impact</h1> <p>Jailed processes can get access to
+ restricted resources on
+ the host system. For jailed processes running with
+ superuser privileges this implies access to all devices
+ on the system. This level of access can lead to information
+ leakage and privilege escalation.</p>
+ </body>
+ </description> <references>
<cvename>CVE-2005-2218</cvename>
<freebsdsa>SA-05:17.devfs</freebsdsa>
- </references>
- <dates>
- <discovery>2005-07-20</discovery>
- <entry>2005-08-05</entry>
+ </references> <dates>
+ <discovery>2005-07-20</discovery> <entry>2005-08-05</entry>
</dates>
</vuln>
<vuln vid="c28f4705-043f-11da-bc08-0001020eed82">
- <topic>proftpd -- format string vulnerabilities</topic>
- <affects>
+ <topic>proftpd -- format string vulnerabilities</topic> <affects>
<package>
- <name>proftpd</name>
- <name>proftpd-mysql</name>
+ <name>proftpd</name> <name>proftpd-mysql</name>
<range><lt>1.3.0.rc2</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>The ProFTPD release notes states:</p>
- <blockquote cite="http://www.proftpd.org/docs/RELEASE_NOTES-1.3.0rc2">
- <p>sean &lt;infamous42md at hotpop.com&gt; found two format
+ <p>The ProFTPD release notes states:</p> <blockquote
+ cite="http://www.proftpd.org/docs/RELEASE_NOTES-1.3.0rc2">
+ <p>sean &lt;infamous42md at hotpop.com&gt; found two
+ format
string vulnerabilities, one in mod_sql's SQLShowInfo
- directive, and one involving the 'ftpshut' utility. Both
- can be considered low risk, as they require active
- involvement on the part of the site administrator in order
- to be exploited.</p>
- </blockquote>
- <p>These vulnerabilities could potentially lead to information
- disclosure, a denial-of-server situation, or execution of
- arbitrary code with the permissions of the user running
+ directive, and one involving the 'ftpshut' utility.
+ Both can be considered low risk, as they require active
+ involvement on the part of the site administrator in
+ order to be exploited.</p>
+ </blockquote> <p>These vulnerabilities could potentially
+ lead to information
+ disclosure, a denial-of-server situation, or execution
+ of arbitrary code with the permissions of the user running
ProFTPD.</p>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2005-2390</cvename>
<url>http://www.gentoo.org/security/en/glsa/glsa-200508-02.xml</url>
<url>http://www.proftpd.org/docs/RELEASE_NOTES-1.3.0rc2</url>
- </references>
- <dates>
- <discovery>2005-07-26</discovery>
- <entry>2005-08-03</entry>
+ </references> <dates>
+ <discovery>2005-07-26</discovery> <entry>2005-08-03</entry>
</dates>
</vuln>
<vuln vid="debbb39c-fdb3-11d9-a30d-00b0d09acbfc">
- <topic>nbsmtp -- format string vulnerability</topic>
- <affects>
+ <topic>nbsmtp -- format string vulnerability</topic> <affects>
<package>
- <name>nbsmtp</name>
- <range><lt>0.99_1</lt></range>
+ <name>nbsmtp</name> <range><lt>0.99_1</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>When nbsmtp is executed in debug mode, server messages
- will be printed to stdout and logged via syslog. Syslog is
- used insecurely and user-supplied format characters are
- directly fed to the syslog function, which results in a
- format string vulnerability.</p>
- <p>Under some circumstances, an SMTP server may be able to
- abuse this vulnerability in order to alter the nbsmtp
- process and execute malicious code.</p>
+ <p>When nbsmtp is executed in debug mode, server messages
+ will be printed to stdout and logged via syslog. Syslog is
+ used insecurely and user-supplied format characters are
+ directly fed to the syslog function, which results in a
+ format string vulnerability.</p> <p>Under some circumstances,
+ an SMTP server may be able to abuse this vulnerability in
+ order to alter the nbsmtp process and execute malicious
+ code.</p>
</body>
- </description>
- <references>
+ </description> <references>
<url>http://people.freebsd.org/~niels/issues/nbsmtp-20050726.txt</url>
- </references>
- <dates>
- <discovery>2005-07-25</discovery>
- <entry>2005-08-01</entry>
+ </references> <dates>
+ <discovery>2005-07-25</discovery> <entry>2005-08-01</entry>
</dates>
- </vuln>
- <vuln vid="b1e8c810-01d0-11da-bc08-0001020eed82">
+ </vuln> <vuln vid="b1e8c810-01d0-11da-bc08-0001020eed82">
<topic>sylpheed -- MIME-encoded file name buffer overflow
vulnerability</topic>
<affects>
<package>
- <name>sylpheed</name>
- <name>sylpheed-gtk2</name>
- <name>sylpheed-claws</name>
- <range><lt>1.0.4</lt></range>
+ <name>sylpheed</name> <name>sylpheed-gtk2</name>
+ <name>sylpheed-claws</name> <range><lt>1.0.4</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Sylpheed is vulnerable to a buffer overflow when displaying
emails with attachments that have MIME-encoded file names.
@@ -2235,15 +1878,11 @@ Note: Please add new entries to the beginning of this file.
potentially allowing execution of arbitrary code with the
permissions of the user running sylpheed.</p>
</body>
- </description>
- <references>
- <bid>12934</bid>
- <cvename>CVE-2005-0926</cvename>
+ </description> <references>
+ <bid>12934</bid> <cvename>CVE-2005-0926</cvename>
<url>http://sylpheed.good-day.net/changelog.html.en</url>
- </references>
- <dates>
- <discovery>2005-03-29</discovery>
- <entry>2005-07-31</entry>
+ </references> <dates>
+ <discovery>2005-03-29</discovery> <entry>2005-07-31</entry>
</dates>
</vuln>
@@ -2251,29 +1890,23 @@ Note: Please add new entries to the beginning of this file.
<topic>phpmyadmin -- cross site scripting vulnerability</topic>
<affects>
<package>
- <name>phpmyadmin</name>
- <name>phpMyAdmin</name>
+ <name>phpmyadmin</name> <name>phpMyAdmin</name>
<range><lt>2.6.2.r1</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>A phpMyAdmin security announcement reports:</p>
- <blockquote cite="http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-3">
+ <p>A phpMyAdmin security announcement reports:</p> <blockquote
+ cite="http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-3">
<p>The convcharset parameter was not correctly validated,
opening the door to a XSS attack. </p>
</blockquote>
</body>
- </description>
- <references>
- <bid>12982</bid>
- <cvename>CVE-2005-0992</cvename>
- <mlist msgid="4f9e4516050404101223fbdeed@mail.gmail.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=111264361622660</mlist>
+ </description> <references>
+ <bid>12982</bid> <cvename>CVE-2005-0992</cvename> <mlist
+ msgid="4f9e4516050404101223fbdeed@mail.gmail.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=111264361622660</mlist>
<url>http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-3</url>
- </references>
- <dates>
- <discovery>2005-04-03</discovery>
- <entry>2005-07-31</entry>
+ </references> <dates>
+ <discovery>2005-04-03</discovery> <entry>2005-07-31</entry>
</dates>
</vuln>
@@ -2281,66 +1914,56 @@ Note: Please add new entries to the beginning of this file.
<topic>gnupg -- OpenPGP symmetric encryption vulnerability</topic>
<affects>
<package>
- <name>gnupg</name>
- <range><lt>1.4.1</lt></range>
- </package>
- <package>
- <name>p5-Crypt-OpenPGP</name>
- <name>pgp</name>
- <name>pgpin</name>
+ <name>gnupg</name> <range><lt>1.4.1</lt></range>
+ </package> <package>
+ <name>p5-Crypt-OpenPGP</name> <name>pgp</name> <name>pgpin</name>
<range><gt>0</gt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>Serge Mister and Robert Zuccherato reports that the OpenPGP
- protocol is vulnerable to a cryptographic attack when using
- symmetric encryption in an automated way.</p>
- <p>David Shaw reports about the impact:</p>
- <blockquote cite="http://lists.gnupg.org/pipermail/gnupg-announce/2005q1/000191.html">
+ <p>Serge Mister and Robert Zuccherato reports that the
+ OpenPGP
+ protocol is vulnerable to a cryptographic attack when
+ using symmetric encryption in an automated way.</p>
+ <p>David Shaw reports about the impact:</p> <blockquote
+ cite="http://lists.gnupg.org/pipermail/gnupg-announce/2005q1/000191.html">
<p>This attack, while very significant from a cryptographic
point of view, is not generally effective in the real
world. To be specific, unless you have your OpenPGP
program set up as part of an automated system to accept
encrypted messages, decrypt them, and then provide a
- response to the submitter, then this does not affect you
- at all.</p>
- </blockquote>
- <p>Note that the <q>fix</q> in GnuPG does note completely
+ response to the submitter, then this does not affect
+ you at all.</p>
+ </blockquote> <p>Note that the <q>fix</q> in GnuPG does
+ note completely
eliminate the potential problem:</p>
- <blockquote cite="http://lists.gnupg.org/pipermail/gnupg-announce/2005q1/000191.html">
+ <blockquote
+ cite="http://lists.gnupg.org/pipermail/gnupg-announce/2005q1/000191.html">
<p>These patches disable a portion of the OpenPGP protocol
- that the attack is exploiting. This change should not be
- user visible. With the patch in place, this attack will
- not work using a public-key encrypted message. It will
- still work using a passphrase-encrypted message.</p>
+ that the attack is exploiting. This change should not
+ be user visible. With the patch in place, this attack
+ will not work using a public-key encrypted message. It
+ will still work using a passphrase-encrypted message.</p>
</blockquote>
</body>
- </description>
- <references>
- <certvu>303094</certvu>
- <cvename>CVE-2005-0366</cvename>
+ </description> <references>
+ <certvu>303094</certvu> <cvename>CVE-2005-0366</cvename>
<url>http://eprint.iacr.org/2005/033</url>
<url>http://lists.gnupg.org/pipermail/gnupg-announce/2005q1/000191.html</url>
- </references>
- <dates>
- <discovery>2005-02-08</discovery>
- <entry>2005-07-31</entry>
+ </references> <dates>
+ <discovery>2005-02-08</discovery> <entry>2005-07-31</entry>
<modified>2005-08-03</modified>
</dates>
</vuln>
<vuln vid="81f127a8-0038-11da-86bc-000e0c2e438a">
- <topic>vim -- vulnerabilities in modeline handling: glob, expand</topic>
- <affects>
+ <topic>vim -- vulnerabilities in modeline handling: glob,
+ expand</topic> <affects>
<package>
- <name>vim</name>
- <name>vim-lite</name>
- <name>vim+ruby</name>
+ <name>vim</name> <name>vim-lite</name> <name>vim+ruby</name>
<range><ge>6.3</ge><lt>6.3.82</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Georgi Guninski discovered a way to construct Vim modelines
that execute arbitrary shell commands. The vulnerability
@@ -2348,117 +1971,94 @@ Note: Please add new entries to the beginning of this file.
that call the glob() or expand() functions. An attacker
could trick an user to read or edit a trojaned file with
modelines enabled, after which the attacker is able to
- execute arbitrary commands with the privileges of the user.</p>
- <p><strong>Note:</strong> It is generally recommended that VIM
- users use <code>set nomodeline</code> in
- <code>~/.vimrc</code> to avoid the possibility of trojaned
- text files.</p>
+ execute arbitrary commands with the privileges of the
+ user.</p>
+ <p><strong>Note:</strong> It is generally recommended that
+ VIM
+ users use <code>set nomodeline</code> in <code>~/.vimrc</code>
+ to avoid the possibility of trojaned text files.</p>
</body>
- </description>
- <references>
- <bid>14374</bid>
- <cvename>CVE-2005-2368</cvename>
+ </description> <references>
+ <bid>14374</bid> <cvename>CVE-2005-2368</cvename>
<url>http://www.guninski.com/where_do_you_want_billg_to_go_today_5.html</url>
- </references>
- <dates>
- <discovery>2005-07-25</discovery>
- <entry>2005-07-31</entry>
+ </references> <dates>
+ <discovery>2005-07-25</discovery> <entry>2005-07-31</entry>
</dates>
</vuln>
<vuln vid="68222076-010b-11da-bc08-0001020eed82">
- <topic>tiff -- buffer overflow vulnerability</topic>
- <affects>
+ <topic>tiff -- buffer overflow vulnerability</topic> <affects>
<package>
- <name>tiff</name>
- <range><lt>3.7.3</lt></range>
- </package>
- <package>
- <name>linux-tiff</name>
- <range><lt>3.6.1_3</lt></range>
- </package>
- <package>
- <name>pdflib</name>
- <name>pdflib-perl</name>
+ <name>tiff</name> <range><lt>3.7.3</lt></range>
+ </package> <package>
+ <name>linux-tiff</name> <range><lt>3.6.1_3</lt></range>
+ </package> <package>
+ <name>pdflib</name> <name>pdflib-perl</name>
<range><lt>6.0.1_2</lt></range>
- </package>
- <package>
- <name>gdal</name>
- <range><lt>1.2.1_2</lt></range>
- </package>
- <package>
- <name>fractorama</name>
- <name>iv</name>
- <name>ivtools</name>
- <name>ja-iv</name>
- <name>ja-libimg</name>
- <name>paraview</name>
+ </package> <package>
+ <name>gdal</name> <range><lt>1.2.1_2</lt></range>
+ </package> <package>
+ <name>fractorama</name> <name>iv</name> <name>ivtools</name>
+ <name>ja-iv</name> <name>ja-libimg</name> <name>paraview</name>
<range><gt>0</gt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>A Gentoo Linux Security Advisory reports:</p>
- <blockquote cite="http://www.gentoo.org/security/en/glsa/glsa-200505-07.xml">
+ <p>A Gentoo Linux Security Advisory reports:</p> <blockquote
+ cite="http://www.gentoo.org/security/en/glsa/glsa-200505-07.xml">
<p>Tavis Ormandy of the Gentoo Linux Security Audit Team
discovered a stack based buffer overflow in the libTIFF
library when reading a TIFF image with a malformed
BitsPerSample tag.</p>
- <p>Successful exploitation would require the victim to open
+ <p>Successful exploitation would require the victim to
+ open
a specially crafted TIFF image, resulting in the execution
of arbitrary code.</p>
</blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2005-1544</cvename>
<url>http://bugzilla.remotesensing.org/show_bug.cgi?id=843</url>
<url>http://www.gentoo.org/security/en/glsa/glsa-200505-07.xml</url>
<url>http://www.remotesensing.org/libtiff/v3.7.3.html</url>
- </references>
- <dates>
- <discovery>2005-05-10</discovery>
- <entry>2005-07-30</entry>
+ </references> <dates>
+ <discovery>2005-05-10</discovery> <entry>2005-07-30</entry>
<modified>2005-08-01</modified>
</dates>
</vuln>
<vuln vid="934b1de4-00d7-11da-bc08-0001020eed82">
- <topic>opera -- image dragging vulnerability</topic>
- <affects>
+ <topic>opera -- image dragging vulnerability</topic> <affects>
<package>
- <name>linux-opera</name>
- <name>opera-devel</name>
- <name>opera</name>
- <range><lt>8.02</lt></range>
+ <name>linux-opera</name> <name>opera-devel</name>
+ <name>opera</name> <range><lt>8.02</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>A Secunia Advisory reports:</p>
- <blockquote cite="http://secunia.com/advisories/15756/">
- <p>Secunia Research has discovered a vulnerability in Opera,
+ <p>A Secunia Advisory reports:</p> <blockquote
+ cite="http://secunia.com/advisories/15756/">
+ <p>Secunia Research has discovered a vulnerability in
+ Opera,
which can be exploited by malicious people to conduct
cross-site scripting attacks and retrieve a user's
files.</p>
- <p>The vulnerability is caused due to Opera allowing a user
+ <p>The vulnerability is caused due to Opera allowing a
+ user
to drag e.g. an image, which is actually a "javascript:"
URI, resulting in cross-site scripting if dropped over
another site. This may also be used to populate a file
- upload form, resulting in uploading of arbitrary files to
- a malicious web site.</p>
- <p>Successful exploitation requires that the user is tricked
+ upload form, resulting in uploading of arbitrary files
+ to a malicious web site.</p>
+ <p>Successful exploitation requires that the user is
+ tricked
into dragging and dropping e.g. an image or a link.</p>
</blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<url>http://secunia.com/advisories/15756/</url>
<url>http://www.opera.com/freebsd/changelogs/802/</url>
- </references>
- <dates>
- <discovery>2005-07-28</discovery>
- <entry>2005-07-30</entry>
+ </references> <dates>
+ <discovery>2005-07-28</discovery> <entry>2005-07-30</entry>
</dates>
</vuln>
@@ -2466,38 +2066,34 @@ Note: Please add new entries to the beginning of this file.
<topic>opera -- download dialog spoofing vulnerability</topic>
<affects>
<package>
- <name>linux-opera</name>
- <name>opera-devel</name>
- <name>opera</name>
- <range><lt>8.02</lt></range>
+ <name>linux-opera</name> <name>opera-devel</name>
+ <name>opera</name> <range><lt>8.02</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>A Secunia Advisory reports:</p>
- <blockquote cite="http://secunia.com/advisories/15870/">
- <p>Secunia Research has discovered a vulnerability in Opera,
- which can be exploited by malicious people to trick users
- into executing malicious files.</p>
+ <p>A Secunia Advisory reports:</p> <blockquote
+ cite="http://secunia.com/advisories/15870/">
+ <p>Secunia Research has discovered a vulnerability in
+ Opera,
+ which can be exploited by malicious people to trick
+ users into executing malicious files.</p>
<p>The vulnerability is caused due to an error in the
- handling of extended ASCII codes in the download
- dialog. This can be exploited to spoof the file extension
- in the file download dialog via a specially crafted
+ handling of extended ASCII codes in the download dialog.
+ This can be exploited to spoof the file extension in
+ the file download dialog via a specially crafted
"Content-Disposition" HTTP header.</p>
- <p>Successful exploitation may result in users being tricked
+ <p>Successful exploitation may result in users being
+ tricked
into executing a malicious file via the download dialog,
- but requires that the "Arial Unicode MS" font
- (ARIALUNI.TTF) has been installed on the system.</p>
+ but requires that the "Arial Unicode MS" font (ARIALUNI.TTF)
+ has been installed on the system.</p>
</blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<url>http://secunia.com/advisories/15870/</url>
<url>http://www.opera.com/freebsd/changelogs/802/</url>
- </references>
- <dates>
- <discovery>2005-07-28</discovery>
- <entry>2005-07-30</entry>
+ </references> <dates>
+ <discovery>2005-07-28</discovery> <entry>2005-07-30</entry>
</dates>
</vuln>
@@ -2505,93 +2101,76 @@ Note: Please add new entries to the beginning of this file.
<topic>ethereal -- multiple protocol dissectors vulnerabilities</topic>
<affects>
<package>
- <name>ethereal</name>
- <name>ethereal-lite</name>
- <name>tethereal</name>
- <name>tethereal-lite</name>
+ <name>ethereal</name> <name>ethereal-lite</name>
+ <name>tethereal</name> <name>tethereal-lite</name>
<range><ge>0.8.5</ge><lt>0.10.12</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>An Ethreal Security Advisories reports:</p>
- <blockquote cite="http://www.ethereal.com/appnotes/enpa-sa-00020.html">
+ <p>An Ethreal Security Advisories reports:</p> <blockquote
+ cite="http://www.ethereal.com/appnotes/enpa-sa-00020.html">
<p>Our testing program has turned up several more security
issues:</p>
<ul>
- <li>The LDAP dissector could free static memory and crash.</li>
- <li>The AgentX dissector could crash.</li>
- <li>The 802.3 dissector could go into an infinite loop.</li>
- <li>The PER dissector could abort.</li>
- <li>The DHCP dissector could go into an infinite loop.</li>
- <li>The BER dissector could abort or loop infinitely.</li>
- <li>The MEGACO dissector could go into an infinite loop.</li>
- <li>The GIOP dissector could dereference a null pointer.</li>
- <li>The SMB dissector was susceptible to a buffer overflow.</li>
- <li>The WBXML could dereference a null pointer.</li>
- <li>The H1 dissector could go into an infinite loop.</li>
- <li>The DOCSIS dissector could cause a crash.</li>
- <li>The SMPP dissector could go into an infinite loop.</li>
- <li>SCTP graphs could crash.</li>
- <li>The HTTP dissector could crash.</li>
- <li>The SMB dissector could go into a large loop.</li>
- <li>The DCERPC dissector could crash.</li>
- <li>Several dissectors could crash while reassembling packets.</li>
- </ul>
- <p>Steve Grubb at Red Hat found the following issues:</p>
- <ul>
- <li>The CAMEL dissector could dereference a null pointer.</li>
- <li>The DHCP dissector could crash.</li>
- <li>The CAMEL dissector could crash.</li>
- <li>The PER dissector could crash.</li>
- <li>The RADIUS dissector could crash.</li>
- <li>The Telnet dissector could crash.</li>
- <li>The IS-IS LSP dissector could crash.</li>
+ <li>The LDAP dissector could free static memory and
+ crash.</li> <li>The AgentX dissector could crash.</li>
+ <li>The 802.3 dissector could go into an infinite
+ loop.</li> <li>The PER dissector could abort.</li>
+ <li>The DHCP dissector could go into an infinite
+ loop.</li> <li>The BER dissector could abort or loop
+ infinitely.</li> <li>The MEGACO dissector could go into
+ an infinite loop.</li> <li>The GIOP dissector could
+ dereference a null pointer.</li> <li>The SMB dissector
+ was susceptible to a buffer overflow.</li> <li>The WBXML
+ could dereference a null pointer.</li> <li>The H1
+ dissector could go into an infinite loop.</li> <li>The
+ DOCSIS dissector could cause a crash.</li> <li>The SMPP
+ dissector could go into an infinite loop.</li> <li>SCTP
+ graphs could crash.</li> <li>The HTTP dissector could
+ crash.</li> <li>The SMB dissector could go into a large
+ loop.</li> <li>The DCERPC dissector could crash.</li>
+ <li>Several dissectors could crash while reassembling
+ packets.</li>
+ </ul> <p>Steve Grubb at Red Hat found the following
+ issues:</p> <ul>
+ <li>The CAMEL dissector could dereference a null
+ pointer.</li> <li>The DHCP dissector could crash.</li>
+ <li>The CAMEL dissector could crash.</li> <li>The PER
+ dissector could crash.</li> <li>The RADIUS dissector
+ could crash.</li> <li>The Telnet dissector could
+ crash.</li> <li>The IS-IS LSP dissector could crash.</li>
<li>The NCP dissector could crash.</li>
- </ul>
- <p>iDEFENSE found the following issues:</p>
- <ul>
- <li>Several dissectors were susceptible to a format string
+ </ul> <p>iDEFENSE found the following issues:</p> <ul>
+ <li>Several dissectors were susceptible to a format
+ string
overflow.</li>
- </ul>
- <h1>Impact:</h1>
- <p>It may be possible to make Ethereal crash, use up
+ </ul> <h1>Impact:</h1> <p>It may be possible to make
+ Ethereal crash, use up
available memory, or run arbitrary code by injecting a
purposefully malformed packet onto the wire or by
convincing someone to read a malformed packet trace
file.</p>
</blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<url>http://www.ethereal.com/appnotes/enpa-sa-00020.html</url>
- </references>
- <dates>
- <discovery>2005-07-26</discovery>
- <entry>2005-07-30</entry>
+ </references> <dates>
+ <discovery>2005-07-26</discovery> <entry>2005-07-30</entry>
</dates>
</vuln>
<vuln vid="651996e0-fe07-11d9-8329-000e0c2e438a">
- <topic>apache -- http request smuggling</topic>
- <affects>
+ <topic>apache -- http request smuggling</topic> <affects>
<package>
- <name>apache</name>
- <range><lt>1.3.33_2</lt></range>
+ <name>apache</name> <range><lt>1.3.33_2</lt></range>
<range><gt>2.*</gt><lt>2.0.54_1</lt></range>
<range><gt>2.1.0</gt><lt>2.1.6_1</lt></range>
- </package>
- <package>
- <name>apache+ssl</name>
- <range><lt>1.3.33.1.55_1</lt></range>
- </package>
- <package>
- <name>apache+mod_perl</name>
- <range><lt>1.3.33_3</lt></range>
- </package>
- <package>
- <name>apache+mod_ssl</name>
- <name>apache+mod_ssl+ipv6</name>
+ </package> <package>
+ <name>apache+ssl</name> <range><lt>1.3.33.1.55_1</lt></range>
+ </package> <package>
+ <name>apache+mod_perl</name> <range><lt>1.3.33_3</lt></range>
+ </package> <package>
+ <name>apache+mod_ssl</name> <name>apache+mod_ssl+ipv6</name>
<name>apache+mod_ssl+mod_accel</name>
<name>apache+mod_ssl+mod_accel+ipv6</name>
<name>apache+mod_ssl+mod_accel+mod_deflate</name>
@@ -2605,16 +2184,12 @@ Note: Please add new entries to the beginning of this file.
<name>apache+mod_ssl+mod_snmp+mod_deflate+ipv6</name>
<name>apache+mod_ssl+mod_snmp+mod_accel+mod_deflate+ipv6</name>
<range><lt>1.3.33+2.8.22_1</lt></range>
- </package>
- <package>
- <name>apache_fp</name>
- <name>apache+ipv6</name>
- <name>ru-apache+mod_ssl</name>
- <name>ru-apache</name>
+ </package> <package>
+ <name>apache_fp</name> <name>apache+ipv6</name>
+ <name>ru-apache+mod_ssl</name> <name>ru-apache</name>
<range><gt>0</gt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Watchfire whitepaper reports an vulnerability in the
Apache webserver. The vulnerability can be exploited by
@@ -2622,29 +2197,22 @@ Note: Please add new entries to the beginning of this file.
poisoining, session hijacking and most importantly the
ability to bypass web application firewall protection.
Exploiting this vulnerability requires multiple carefully
- crafted HTTP requests, taking advantage of an caching server,
- proxy server, web application firewall etc. This only affects
- installations where Apache is used as HTTP proxy in
- combination with the following web servers:</p>
+ crafted HTTP requests, taking advantage of an caching
+ server, proxy server, web application firewall etc. This
+ only affects installations where Apache is used as HTTP
+ proxy in combination with the following web servers:</p>
<ul>
- <li>IIS/6.0 and 5.0</li>
- <li>Apache 2.0.45 (as web server)</li>
- <li>apache 1.3.29</li>
- <li>WebSphere 5.1 and 5.0</li>
- <li>WebLogic 8.1 SP1</li>
- <li>Oracle9iAS web server 9.0.2</li>
- <li>SunONE web server 6.1 SP4</li>
+ <li>IIS/6.0 and 5.0</li> <li>Apache 2.0.45 (as web
+ server)</li> <li>apache 1.3.29</li> <li>WebSphere 5.1 and
+ 5.0</li> <li>WebLogic 8.1 SP1</li> <li>Oracle9iAS web
+ server 9.0.2</li> <li>SunONE web server 6.1 SP4</li>
</ul>
</body>
- </description>
- <references>
- <bid>14106</bid>
- <cvename>CVE-2005-2088</cvename>
+ </description> <references>
+ <bid>14106</bid> <cvename>CVE-2005-2088</cvename>
<url>http://www.watchfire.com/resources/HTTP-Request-Smuggling.pdf</url>
- </references>
- <dates>
- <discovery>2005-07-25</discovery>
- <entry>2005-07-26</entry>
+ </references> <dates>
+ <discovery>2005-07-25</discovery> <entry>2005-07-26</entry>
<modified>2005-08-11</modified>
</dates>
</vuln>
@@ -2653,18 +2221,14 @@ Note: Please add new entries to the beginning of this file.
<topic>clamav -- multiple remote buffer overflows</topic>
<affects>
<package>
- <name>clamav</name>
- <range><lt>0.86.2</lt></range>
- </package>
- <package>
- <name>clamav-devel</name>
- <range><le>20050704</le></range>
+ <name>clamav</name> <range><lt>0.86.2</lt></range>
+ </package> <package>
+ <name>clamav-devel</name> <range><le>20050704</le></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>An Secunia Advisory reports:</p>
- <blockquote cite="http://secunia.com/advisories/16180/">
+ <p>An Secunia Advisory reports:</p> <blockquote
+ cite="http://secunia.com/advisories/16180/">
<p>Neel Mehta and Alex Wheeler have reported some
vulnerabilities in Clam AntiVirus, which can be exploited
by malicious people to cause a DoS (Denial of Service)
@@ -2676,22 +2240,19 @@ Note: Please add new entries to the beginning of this file.
TNEF file with a length value of -1 in the header.</li>
<li>An integer overflow error in "libclamav/chmunpack.c"
can be exploited to cause a heap-based buffer overflow
- via a specially crafted CHM file with a chunk entry that
- has a filename length of -1.</li>
+ via a specially crafted CHM file with a chunk entry
+ that has a filename length of -1.</li>
<li>A boundary error in "libclamav/fsg.c" when
processing a FSG compressed file can cause a heap-based
buffer overflow.</li>
</ol>
</blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<url>http://www.rem0te.com/public/images/clamav.pdf</url>
<url>http://secunia.com/advisories/16180/</url>
- </references>
- <dates>
- <discovery>2005-07-24</discovery>
- <entry>2005-07-25</entry>
+ </references> <dates>
+ <discovery>2005-07-24</discovery> <entry>2005-07-25</entry>
</dates>
</vuln>
@@ -2699,78 +2260,64 @@ Note: Please add new entries to the beginning of this file.
<topic>isc-dhcpd -- format string vulnerabilities</topic>
<affects>
<package>
- <name>isc-dhcp3-client</name>
- <name>isc-dhcp3-devel</name>
- <name>isc-dhcp3-relay</name>
- <name>isc-dhcp3-server</name>
- <name>isc-dhcp3</name>
- <name>isc-dhcp</name>
- <name>isc-dhcpd</name>
+ <name>isc-dhcp3-client</name> <name>isc-dhcp3-devel</name>
+ <name>isc-dhcp3-relay</name> <name>isc-dhcp3-server</name>
+ <name>isc-dhcp3</name> <name>isc-dhcp</name> <name>isc-dhcpd</name>
<range><lt>3.0.1</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The ISC DHCP programs are vulnerable to several format
- string vulnerabilities which may allow a remote attacker to
- execute arbitrary code with the permissions of the DHCP
- programs, typically root for the DHCP server.</p>
+ string vulnerabilities which may allow a remote attacker
+ to execute arbitrary code with the permissions of the
+ DHCP programs, typically root for the DHCP server.</p>
</body>
- </description>
- <references>
- <bid>11591</bid>
- <certvu>448384</certvu>
- <cvename>CVE-2004-1006</cvename>
- <mlist msgid="20041109003345.GG763@isc.org">http://marc.theaimsgroup.com/?l=dhcp-announce&amp;m=109996073218290</mlist>
- </references>
- <dates>
- <discovery>2004-11-08</discovery>
- <entry>2005-07-23</entry>
+ </description> <references>
+ <bid>11591</bid> <certvu>448384</certvu>
+ <cvename>CVE-2004-1006</cvename> <mlist
+ msgid="20041109003345.GG763@isc.org">http://marc.theaimsgroup.com/?l=dhcp-announce&amp;m=109996073218290</mlist>
+ </references> <dates>
+ <discovery>2004-11-08</discovery> <entry>2005-07-23</entry>
</dates>
</vuln>
<vuln vid="b4892b5b-fb1c-11d9-96ba-00909925db3e">
- <topic>egroupware -- multiple cross-site scripting (XSS) and SQL
+ <topic>egroupware -- multiple cross-site scripting (XSS) and
+ SQL
injection vulnerabilities</topic>
<affects>
<package>
- <name>egroupware</name>
- <range><lt>1.0.0.007</lt></range>
+ <name>egroupware</name> <range><lt>1.0.0.007</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>Multiple cross-site scripting (XSS) vulnerabilities in eGroupware
- before 1.0.0.007 allow remote attackers to inject arbitrary web
- script or HTML via the (1) ab_id, (2) page, (3) type,
- or (4) lang parameter to index.php or (5) category_id parameter.
- </p>
- <p>Multiple SQL injection vulnerabilities in index.php in eGroupware
- before 1.0.0.007 allow remote attackers to execute arbitrary SQL
- commands via the (1) filter or (2) cats_app parameter.
+ <p>Multiple cross-site scripting (XSS) vulnerabilities in
+ eGroupware
+ before 1.0.0.007 allow remote attackers to inject arbitrary
+ web script or HTML via the (1) ab_id, (2) page, (3) type,
+ or (4) lang parameter to index.php or (5) category_id
+ parameter.
+ </p> <p>Multiple SQL injection vulnerabilities in index.php
+ in eGroupware
+ before 1.0.0.007 allow remote attackers to execute arbitrary
+ SQL commands via the (1) filter or (2) cats_app parameter.
</p>
</body>
- </description>
- <references>
- <cvename>CVE-2005-1202</cvename>
- <cvename>CVE-2005-1203</cvename>
+ </description> <references>
+ <cvename>CVE-2005-1202</cvename> <cvename>CVE-2005-1203</cvename>
<url>http://sourceforge.net/project/shownotes.php?release_id=320768</url>
- </references>
- <dates>
- <discovery>2005-04-20</discovery>
- <entry>2005-07-23</entry>
+ </references> <dates>
+ <discovery>2005-04-20</discovery> <entry>2005-07-23</entry>
</dates>
</vuln>
<vuln vid="3f4ac724-fa8b-11d9-afcf-0060084a00e5">
- <topic>fetchmail -- denial of service/crash from malicious POP3 server</topic>
- <affects>
+ <topic>fetchmail -- denial of service/crash from malicious POP3
+ server</topic> <affects>
<package>
- <name>fetchmail</name>
- <range><eq>6.2.5.1</eq></range>
+ <name>fetchmail</name> <range><eq>6.2.5.1</eq></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>In fetchmail 6.2.5.1, the the remote code injection via
POP3 UIDL was fixed, but a denial of service attack was
@@ -2778,17 +2325,15 @@ Note: Please add new entries to the beginning of this file.
<p>Two possible NULL-pointer dereferences allow a malicous
POP3 server to crash fetchmail by respondig with UID lines
containing only the article number but no UID (in violation
- of RFC-1939), or a message without Message-ID when no UIDL
- support is available.</p>
+ of RFC-1939), or a message without Message-ID when no
+ UIDL support is available.</p>
</body>
- </description>
- <references>
- <mlist msgid="20050721172317.GB3071@amilo.ms.mff.cuni.cz">http://lists.berlios.de/pipermail/fetchmail-devel/2005-July/000397.html</mlist>
+ </description> <references>
+ <mlist
+ msgid="20050721172317.GB3071@amilo.ms.mff.cuni.cz">http://lists.berlios.de/pipermail/fetchmail-devel/2005-July/000397.html</mlist>
<url>http://fetchmail.berlios.de/fetchmail-SA-2005-01.txt</url>
- </references>
- <dates>
- <discovery>2005-07-21</discovery>
- <entry>2005-07-22</entry>
+ </references> <dates>
+ <discovery>2005-07-21</discovery> <entry>2005-07-22</entry>
</dates>
</vuln>
@@ -2796,11 +2341,9 @@ Note: Please add new entries to the beginning of this file.
<topic>dnrd -- remote buffer and stack overflow vulnerabilities</topic>
<affects>
<package>
- <name>dnrd</name>
- <range><lt>2.19.1</lt></range>
+ <name>dnrd</name> <range><lt>2.19.1</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Natanael Copa reports that dnrd is vulnerable to a remote
buffer overflow and a remote stack overflow. These
@@ -2813,15 +2356,11 @@ Note: Please add new entries to the beginning of this file.
<p>The stack overflow vulnerability can cause dnrd to
crash.</p>
</body>
- </description>
- <references>
- <cvename>CVE-2005-2315</cvename>
- <cvename>CVE-2005-2316</cvename>
+ </description> <references>
+ <cvename>CVE-2005-2315</cvename> <cvename>CVE-2005-2316</cvename>
<freebsdpr>ports/83851</freebsdpr>
- </references>
- <dates>
- <discovery>2005-07-21</discovery>
- <entry>2005-07-21</entry>
+ </references> <dates>
+ <discovery>2005-07-21</discovery> <entry>2005-07-21</entry>
</dates>
</vuln>
@@ -2829,11 +2368,9 @@ Note: Please add new entries to the beginning of this file.
<topic>PowerDNS -- LDAP backend fails to escape all queries</topic>
<affects>
<package>
- <name>powerdns</name>
- <range><lt>2.9.18</lt></range>
+ <name>powerdns</name> <range><lt>2.9.18</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The LDAP backend in PowerDNS has issues with escaping
queries which could cause connection errors. This would
@@ -2843,45 +2380,38 @@ Note: Please add new entries to the beginning of this file.
<p>This is known to affect all releases prior to 2.9.18.</p>
</blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2005-2302</cvename>
<url>http://doc.powerdns.com/security-policy.html</url>
<url>http://marc.theaimsgroup.com/?l=bugtraq&amp;m=112155941310297&amp;w=2</url>
- </references>
- <dates>
- <discovery>2005-07-16</discovery>
- <entry>2005-07-21</entry>
+ </references> <dates>
+ <discovery>2005-07-16</discovery> <entry>2005-07-21</entry>
</dates>
</vuln>
<vuln vid="3497d7be-2fef-45f4-8162-9063751b573a">
- <topic>fetchmail -- remote root/code injection from malicious POP3 server</topic>
- <affects>
+ <topic>fetchmail -- remote root/code injection from malicious
+ POP3 server</topic> <affects>
<package>
- <name>fetchmail</name>
- <range><lt>6.2.5.1</lt></range>
+ <name>fetchmail</name> <range><lt>6.2.5.1</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>fetchmail's POP3/UIDL code does not truncate received UIDs properly.
- A malicious or compromised POP3 server can thus corrupt fetchmail's
- stack and inject code when fetchmail is using UIDL, either through
- configuration, or as a result of certain server capabilities. Note
- that fetchmail is run as root on some sites, so an attack might
- compromise the root account and thus the whole machine.</p>
+ <p>fetchmail's POP3/UIDL code does not truncate received
+ UIDs properly.
+ A malicious or compromised POP3 server can thus corrupt
+ fetchmail's stack and inject code when fetchmail is using
+ UIDL, either through configuration, or as a result of
+ certain server capabilities. Note that fetchmail is run
+ as root on some sites, so an attack might compromise the
+ root account and thus the whole machine.</p>
</body>
- </description>
- <references>
- <cvename>CVE-2005-2335</cvename>
- <freebsdpr>ports/83805</freebsdpr>
+ </description> <references>
+ <cvename>CVE-2005-2335</cvename> <freebsdpr>ports/83805</freebsdpr>
<url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=212762</url>
<url>http://fetchmail.berlios.de/fetchmail-SA-2005-01.txt</url>
- </references>
- <dates>
- <discovery>2005-07-20</discovery>
- <entry>2005-07-20</entry>
+ </references> <dates>
+ <discovery>2005-07-20</discovery> <entry>2005-07-20</entry>
<modified>2005-07-21</modified>
</dates>
</vuln>
@@ -2890,36 +2420,32 @@ Note: Please add new entries to the beginning of this file.
<topic>kdebase -- Kate backup file permission leak</topic>
<affects>
<package>
- <name>kdebase</name>
- <range><ge>3.2.0</ge><lt>3.4.1</lt></range>
- </package>
- <package>
+ <name>kdebase</name> <range><ge>3.2.0</ge><lt>3.4.1</lt></range>
+ </package> <package>
<name>linux_base-suse</name>
<range><ge>9.3</ge><lt>9.3_2</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>A KDE Security Advisory explains:</p>
- <blockquote cite="http://www.kde.org/info/security/advisory-20050718-1.txt">
- <p>Kate / Kwrite create a file backup before saving a modified
- file. These backup files are created with default permissions,
- even if the original file had more strict permissions set.</p>
+ <p>A KDE Security Advisory explains:</p> <blockquote
+ cite="http://www.kde.org/info/security/advisory-20050718-1.txt">
+ <p>Kate / Kwrite create a file backup before saving a
+ modified
+ file. These backup files are created with default
+ permissions, even if the original file had more strict
+ permissions set.</p>
<p>Depending on the system security settings, backup files
might be readable by other users. Kate / Kwrite are
network transparent applications and therefore this
vulnerability might not be restricted to local users.</p>
</blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2005-1920</cvename>
<url>https://bugs.kde.org/show_bug.cgi?id=103331</url>
<url>http://www.kde.org/info/security/advisory-20050718-1.txt</url>
- </references>
- <dates>
- <discovery>2005-07-18</discovery>
- <entry>2005-07-18</entry>
+ </references> <dates>
+ <discovery>2005-07-18</discovery> <entry>2005-07-18</entry>
<modified>2005-10-09</modified>
</dates>
</vuln>
@@ -2928,29 +2454,18 @@ Note: Please add new entries to the beginning of this file.
<topic>firefox &amp; mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
- <name>firefox</name>
- <range><lt>1.0.5,1</lt></range>
- </package>
- <package>
- <name>linux-firefox</name>
- <range><lt>1.0.5</lt></range>
- </package>
- <package>
- <name>mozilla</name>
- <range><lt>1.7.9,2</lt></range>
+ <name>firefox</name> <range><lt>1.0.5,1</lt></range>
+ </package> <package>
+ <name>linux-firefox</name> <range><lt>1.0.5</lt></range>
+ </package> <package>
+ <name>mozilla</name> <range><lt>1.7.9,2</lt></range>
<range><ge>1.8.*,2</ge></range>
- </package>
- <package>
- <name>linux-mozilla</name>
- <name>linux-mozilla-devel</name>
- <range><lt>1.7.9</lt></range>
- <range><ge>1.8.*</ge></range>
- </package>
- <package>
- <name>netscape7</name>
- <range><ge>0</ge></range>
- </package>
- <package>
+ </package> <package>
+ <name>linux-mozilla</name> <name>linux-mozilla-devel</name>
+ <range><lt>1.7.9</lt></range> <range><ge>1.8.*</ge></range>
+ </package> <package>
+ <name>netscape7</name> <range><ge>0</ge></range>
+ </package> <package>
<!-- These ports are obsolete. -->
<name>de-linux-mozillafirebird</name>
<name>el-linux-mozillafirebird</name>
@@ -2959,76 +2474,65 @@ Note: Please add new entries to the beginning of this file.
<name>linux-mozillafirebird</name>
<name>ru-linux-mozillafirebird</name>
<name>zhCN-linux-mozillafirebird</name>
- <name>zhTW-linux-mozillafirebird</name>
- <range><ge>0</ge></range>
- </package>
- <package>
+ <name>zhTW-linux-mozillafirebird</name> <range><ge>0</ge></range>
+ </package> <package>
<!-- These package names are obsolete. -->
- <name>de-linux-netscape</name>
- <name>de-netscape7</name>
- <name>fr-linux-netscape</name>
- <name>fr-netscape7</name>
- <name>ja-linux-netscape</name>
- <name>ja-netscape7</name>
- <name>linux-netscape</name>
- <name>linux-phoenix</name>
- <name>mozilla+ipv6</name>
- <name>mozilla-embedded</name>
- <name>mozilla-firebird</name>
- <name>mozilla-gtk1</name>
- <name>mozilla-gtk2</name>
- <name>mozilla-gtk</name>
- <name>mozilla-thunderbird</name>
- <name>phoenix</name>
- <name>pt_BR-netscape7</name>
- <range><ge>0</ge></range>
- </package>
- </affects>
- <description>
+ <name>de-linux-netscape</name> <name>de-netscape7</name>
+ <name>fr-linux-netscape</name> <name>fr-netscape7</name>
+ <name>ja-linux-netscape</name> <name>ja-netscape7</name>
+ <name>linux-netscape</name> <name>linux-phoenix</name>
+ <name>mozilla+ipv6</name> <name>mozilla-embedded</name>
+ <name>mozilla-firebird</name> <name>mozilla-gtk1</name>
+ <name>mozilla-gtk2</name> <name>mozilla-gtk</name>
+ <name>mozilla-thunderbird</name> <name>phoenix</name>
+ <name>pt_BR-netscape7</name> <range><ge>0</ge></range>
+ </package>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Foundation reports of multiple security
vulnerabilities in Firefox and Mozilla:</p>
- <blockquote cite="http://www.mozilla.org/projects/security/known-vulnerabilities.html">
+ <blockquote
+ cite="http://www.mozilla.org/projects/security/known-vulnerabilities.html">
<ul>
- <li><em>MFSA 2005-56</em> Code execution through shared function
+ <li><em>MFSA 2005-56</em> Code execution through shared
+ function
objects</li>
<li><em>MFSA 2005-55</em> XHTML node spoofing</li>
- <li><em>MFSA 2005-54</em> Javascript prompt origin spoofing</li>
- <li><em>MFSA 2005-53</em> Standalone applications can run arbitrary
+ <li><em>MFSA 2005-54</em> Javascript prompt origin
+ spoofing</li> <li><em>MFSA 2005-53</em> Standalone
+ applications can run arbitrary
code through the browser</li>
- <li><em>MFSA 2005-52</em> Same origin violation: frame calling
+ <li><em>MFSA 2005-52</em> Same origin violation: frame
+ calling
top.focus()</li>
<li><em>MFSA 2005-51</em> The return of frame-injection
spoofing</li>
- <li><em>MFSA 2005-50</em> Possibly exploitable crash in
+ <li><em>MFSA 2005-50</em> Possibly exploitable crash
+ in
InstallVersion.compareTo()</li>
- <li><em>MFSA 2005-49</em> Script injection from Firefox sidebar
+ <li><em>MFSA 2005-49</em> Script injection from Firefox
+ sidebar
panel using data:</li>
- <li><em>MFSA 2005-48</em> Same-origin violation with InstallTrigger
+ <li><em>MFSA 2005-48</em> Same-origin violation with
+ InstallTrigger
callback</li>
<li><em>MFSA 2005-47</em> Code execution via "Set as
Wallpaper"</li>
- <li><em>MFSA 2005-46</em> XBL scripts ran even when Javascript
+ <li><em>MFSA 2005-46</em> XBL scripts ran even when
+ Javascript
disabled</li>
<li><em>MFSA 2005-45</em> Content-generated event
vulnerabilities</li>
</ul>
</blockquote>
</body>
- </description>
- <references>
- <cvename>CVE-2005-1937</cvename>
- <cvename>CVE-2005-2260</cvename>
- <cvename>CVE-2005-2261</cvename>
- <cvename>CVE-2005-2262</cvename>
- <cvename>CVE-2005-2263</cvename>
- <cvename>CVE-2005-2264</cvename>
- <cvename>CVE-2005-2265</cvename>
- <cvename>CVE-2005-2266</cvename>
- <cvename>CVE-2005-2267</cvename>
- <cvename>CVE-2005-2268</cvename>
- <cvename>CVE-2005-2269</cvename>
- <cvename>CVE-2005-2270</cvename>
+ </description> <references>
+ <cvename>CVE-2005-1937</cvename> <cvename>CVE-2005-2260</cvename>
+ <cvename>CVE-2005-2261</cvename> <cvename>CVE-2005-2262</cvename>
+ <cvename>CVE-2005-2263</cvename> <cvename>CVE-2005-2264</cvename>
+ <cvename>CVE-2005-2265</cvename> <cvename>CVE-2005-2266</cvename>
+ <cvename>CVE-2005-2267</cvename> <cvename>CVE-2005-2268</cvename>
+ <cvename>CVE-2005-2269</cvename> <cvename>CVE-2005-2270</cvename>
<url>http://www.mozilla.org/projects/security/known-vulnerabilities.html</url>
<url>http://www.mozilla.org/security/announce/mfsa2005-45.html</url>
<url>http://www.mozilla.org/security/announce/mfsa2005-46.html</url>
@@ -3042,10 +2546,8 @@ Note: Please add new entries to the beginning of this file.
<url>http://www.mozilla.org/security/announce/mfsa2005-54.html</url>
<url>http://www.mozilla.org/security/announce/mfsa2005-55.html</url>
<url>http://www.mozilla.org/security/announce/mfsa2005-56.html</url>
- </references>
- <dates>
- <discovery>2005-07-12</discovery>
- <entry>2005-07-16</entry>
+ </references> <dates>
+ <discovery>2005-07-12</discovery> <entry>2005-07-16</entry>
</dates>
</vuln>
@@ -3053,26 +2555,21 @@ Note: Please add new entries to the beginning of this file.
<topic>drupal -- PHP code execution vulnerabilities</topic>
<affects>
<package>
- <name>drupal</name>
- <range><lt>4.6.2</lt></range>
+ <name>drupal</name> <range><lt>4.6.2</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>Kuba Zygmunt discovered a flaw in the input validation routines
+ <p>Kuba Zygmunt discovered a flaw in the input validation
+ routines
of Drupal's filter mechanism. An attacker could execute
- arbitrary PHP code on a target site when public comments or
- postings are allowed.</p>
+ arbitrary PHP code on a target site when public comments
+ or postings are allowed.</p>
</body>
- </description>
- <references>
- <cvename>CVE-2005-1921</cvename>
- <cvename>CVE-2005-2106</cvename>
+ </description> <references>
+ <cvename>CVE-2005-1921</cvename> <cvename>CVE-2005-2106</cvename>
<url>http://drupal.org/files/sa-2005-002/advisory.txt</url>
- </references>
- <dates>
- <discovery>2005-06-29</discovery>
- <entry>2005-07-16</entry>
+ </references> <dates>
+ <discovery>2005-06-29</discovery> <entry>2005-07-16</entry>
</dates>
</vuln>
@@ -3080,30 +2577,24 @@ Note: Please add new entries to the beginning of this file.
<topic>phpSysInfo -- cross site scripting vulnerability</topic>
<affects>
<package>
- <name>phpSysInfo</name>
- <range><gt>0</gt></range>
+ <name>phpSysInfo</name> <range><gt>0</gt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Securityreason.com advisory reports that various cross
site scripting vulnerabilities have been found in phpSysInfo.
- Input is not properly sanitised before it is returned to the
- user. A malicious person could exploit this to execute
+ Input is not properly sanitised before it is returned to
+ the user. A malicious person could exploit this to execute
arbitrary HTML and script code in a users browser session.
- Also it is possible to view the full path of certain scripts
- by accessing them directly.</p>
+ Also it is possible to view the full path of certain
+ scripts by accessing them directly.</p>
</body>
- </description>
- <references>
- <bid>12887</bid>
- <cvename>CVE-2005-0869</cvename>
- <cvename>CVE-2005-0870</cvename>
- <mlist msgid="20050323180207.11987.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=111161017209422</mlist>
- </references>
- <dates>
- <discovery>2005-03-22</discovery>
- <entry>2005-07-09</entry>
+ </description> <references>
+ <bid>12887</bid> <cvename>CVE-2005-0869</cvename>
+ <cvename>CVE-2005-0870</cvename> <mlist
+ msgid="20050323180207.11987.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=111161017209422</mlist>
+ </references> <dates>
+ <discovery>2005-03-22</discovery> <entry>2005-07-09</entry>
</dates>
</vuln>
@@ -3115,8 +2606,7 @@ Note: Please add new entries to the beginning of this file.
<range><gt>4.1</gt><lt>4.1.12</lt></range>
<range><gt>5.0</gt><lt>5.0.6</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Zataz advisory reports that MySQL contains a security
flaw which could allow a malicious local user to inject
@@ -3126,15 +2616,11 @@ Note: Please add new entries to the beginning of this file.
creates temporary files based on the PID used by the
script.</p>
</body>
- </description>
- <references>
- <bid>13660</bid>
- <cvename>CVE-2005-1636</cvename>
+ </description> <references>
+ <bid>13660</bid> <cvename>CVE-2005-1636</cvename>
<url>http://www.zataz.net/adviso/mysql-05172005.txt</url>
- </references>
- <dates>
- <discovery>2005-05-07</discovery>
- <entry>2005-07-09</entry>
+ </references> <dates>
+ <discovery>2005-05-07</discovery> <entry>2005-07-09</entry>
</dates>
</vuln>
@@ -3142,48 +2628,39 @@ Note: Please add new entries to the beginning of this file.
<topic>net-snmp -- fixproc insecure temporary file creation</topic>
<affects>
<package>
- <name>net-snmp</name>
- <range><lt>5.2.1.2</lt></range>
+ <name>net-snmp</name> <range><lt>5.2.1.2</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>A Gentoo advisory reports:</p>
- <blockquote cite="http://www.gentoo.org/security/en/glsa/glsa-200505-18.xml">
+ <p>A Gentoo advisory reports:</p> <blockquote
+ cite="http://www.gentoo.org/security/en/glsa/glsa-200505-18.xml">
<p>Net-SNMP creates temporary files in an insecure manner,
possibly allowing the execution of arbitrary code.</p>
<p>A malicious local attacker could exploit a race condition
- to change the content of the temporary files before they
- are executed by fixproc, possibly leading to the execution
- of arbitrary code. A local attacker could also create
- symbolic links in the temporary files directory, pointing
- to a valid file somewhere on the filesystem. When fixproc
- is executed, this would result in the file being
- overwritten.</p>
+ to change the content of the temporary files before
+ they are executed by fixproc, possibly leading to the
+ execution of arbitrary code. A local attacker could
+ also create symbolic links in the temporary files
+ directory, pointing to a valid file somewhere on the
+ filesystem. When fixproc is executed, this would result
+ in the file being overwritten.</p>
</blockquote>
</body>
- </description>
- <references>
- <bid>13715</bid>
- <cvename>CVE-2005-1740</cvename>
+ </description> <references>
+ <bid>13715</bid> <cvename>CVE-2005-1740</cvename>
<url>http://security.gentoo.org/glsa/glsa-200505-18.xml</url>
- </references>
- <dates>
- <discovery>2005-05-23</discovery>
- <entry>2005-07-09</entry>
+ </references> <dates>
+ <discovery>2005-05-23</discovery> <entry>2005-07-09</entry>
<modified>2005-07-13</modified>
</dates>
</vuln>
<vuln vid="326c517a-d029-11d9-9aed-000e0c2e438a">
- <topic>phpbb -- multiple vulnerabilities</topic>
- <affects>
+ <topic>phpbb -- multiple vulnerabilities</topic> <affects>
<package>
- <name>phpbb</name>
- <range><lt>2.0.12</lt></range>
+ <name>phpbb</name> <range><lt>2.0.12</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>phpBB is vulnerable to remote exploitation of an input
validation vulnerability allows attackers to read the
@@ -3192,18 +2669,13 @@ Note: Please add new entries to the beginning of this file.
unlink arbitrary system files under the privileges of the
webserver.</p>
</body>
- </description>
- <references>
- <bid>12618</bid>
- <bid>12621</bid>
- <bid>12623</bid>
- <cvename>CVE-2005-0258</cvename>
- <cvename>CVE-2005-0259</cvename>
+ </description> <references>
+ <bid>12618</bid> <bid>12621</bid> <bid>12623</bid>
+ <cvename>CVE-2005-0258</cvename> <cvename>CVE-2005-0259</cvename>
<url>http://security.gentoo.org/glsa/glsa-200503-02.xml</url>
<url>http://www.idefense.com/application/poi/display?id=205&amp;type=vulnerabilities</url>
<url>http://www.idefense.com/application/poi/display?id=204&amp;type=vulnerabilities</url>
- </references>
- <dates>
+ </references> <dates>
<discovery>2005-02-22</discovery>
<entry>2005-07-09</entry>
</dates>
@@ -3213,62 +2685,51 @@ Note: Please add new entries to the beginning of this file.
<topic>shtool -- insecure temporary file creation</topic>
<affects>
<package>
- <name>shtool</name>
- <range><le>2.0.1</le></range>
+ <name>shtool</name> <range><le>2.0.1</le></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Zataz advisory reports that shtool contains a security
- flaw which could allow a malicious local user to create or
- overwrite the contents of arbitrary files. The attacker
- could fool a user into executing the arbitrary file possibly
- executing arbitrary code.</p>
+ flaw which could allow a malicious local user to create
+ or overwrite the contents of arbitrary files. The attacker
+ could fool a user into executing the arbitrary file
+ possibly executing arbitrary code.</p>
</body>
- </description>
- <references>
+ </description> <references>
<bid>13767</bid>
<url>http://www.zataz.net/adviso/shtool-05252005.txt</url>
- </references>
- <dates>
- <discovery>2005-05-25</discovery>
- <entry>2005-07-09</entry>
+ </references> <dates>
+ <discovery>2005-05-25</discovery> <entry>2005-07-09</entry>
</dates>
</vuln>
<vuln vid="88188a8c-eff6-11d9-8310-0001020eed82">
- <topic>phppgadmin -- "formLanguage" local file inclusion vulnerability</topic>
- <affects>
+ <topic>phppgadmin -- "formLanguage" local file inclusion
+ vulnerability</topic> <affects>
<package>
- <name>phppgadmin</name>
- <range><lt>3.5.4</lt></range>
+ <name>phppgadmin</name> <range><lt>3.5.4</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>A Secunia Advisory reports:</p>
- <blockquote cite="http://secunia.com/advisories/15941/">
+ <p>A Secunia Advisory reports:</p> <blockquote
+ cite="http://secunia.com/advisories/15941/">
<p>A vulnerability has been reported in phpPgAdmin, which
can be exploited by malicious people to disclose sensitive
information.</p>
<p>Input passed to the "formLanguage" parameter in
- "index.php" isn't properly verified, before it is used to
- include files. This can be exploited to include arbitrary
- files from local resources.</p>
+ "index.php" isn't properly verified, before it is used
+ to include files. This can be exploited to include
+ arbitrary files from local resources.</p>
<p>Successful exploitation requires that "magic_quotes_gpc"
is disabled.</p>
</blockquote>
</body>
- </description>
- <references>
- <bid>14142</bid>
- <cvename>CVE-2005-2256</cvename>
+ </description> <references>
+ <bid>14142</bid> <cvename>CVE-2005-2256</cvename>
<url>http://secunia.com/advisories/15941/</url>
<url>http://sourceforge.net/project/shownotes.php?release_id=342261</url>
- </references>
- <dates>
- <discovery>2005-07-05</discovery>
- <entry>2005-07-08</entry>
+ </references> <dates>
+ <discovery>2005-07-05</discovery> <entry>2005-07-08</entry>
<modified>2005-07-21</modified>
</dates>
</vuln>
@@ -3278,116 +2739,98 @@ Note: Please add new entries to the beginning of this file.
vulnerabilities</topic>
<affects>
<package>
- <name>pear-XML_RPC</name>
- <range><lt>1.3.2</lt></range>
+ <name>pear-XML_RPC</name> <range><lt>1.3.2</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The pear-XML_RPC release notes reports that the following
issues has been fixed:</p>
- <blockquote cite="http://pear.php.net/package/XML_RPC/download/1.3.2">
+ <blockquote
+ cite="http://pear.php.net/package/XML_RPC/download/1.3.2">
<p>Eliminate path disclosure vulnerabilities by suppressing
error messages when eval()'ing.</p>
- <p>Eliminate path disclosure vulnerability by catching bogus
+ <p>Eliminate path disclosure vulnerability by catching
+ bogus
parameters submitted to
<code>XML_RPC_Value::serializeval()</code>.</p>
</blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<url>http://pear.php.net/package/XML_RPC/download/1.3.2</url>
- </references>
- <dates>
- <discovery>2005-07-07</discovery>
- <entry>2005-07-08</entry>
+ </references> <dates>
+ <discovery>2005-07-07</discovery> <entry>2005-07-08</entry>
</dates>
</vuln>
<vuln vid="9a035a56-eff0-11d9-8310-0001020eed82">
- <topic>ekg -- insecure temporary file creation</topic>
- <affects>
+ <topic>ekg -- insecure temporary file creation</topic> <affects>
<package>
- <name>pl-ekg</name>
- <range><lt>1.6r2,1</lt></range>
+ <name>pl-ekg</name> <range><lt>1.6r2,1</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>Eric Romang reports that ekg creates temporary files in an
- insecure manner. This can be exploited by an attacker using
- a symlink attack to overwrite arbitrary files and possibly
- execute arbitrary commands with the permissions of the user
- running ekg.</p>
+ <p>Eric Romang reports that ekg creates temporary files in
+ an
+ insecure manner. This can be exploited by an attacker
+ using a symlink attack to overwrite arbitrary files and
+ possibly execute arbitrary commands with the permissions
+ of the user running ekg.</p>
</body>
- </description>
- <references>
- <bid>14146</bid>
- <cvename>CVE-2005-1916</cvename>
- <mlist msgid="42CA2DDB.5030606@zataz.net">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=112060146011122</mlist>
+ </description> <references>
+ <bid>14146</bid> <cvename>CVE-2005-1916</cvename> <mlist
+ msgid="42CA2DDB.5030606@zataz.net">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=112060146011122</mlist>
<url>http://bugs.gentoo.org/show_bug.cgi?id=94172</url>
- </references>
- <dates>
- <discovery>2005-07-05</discovery>
- <entry>2005-07-08</entry>
+ </references> <dates>
+ <discovery>2005-07-05</discovery> <entry>2005-07-08</entry>
<modified>2005-07-31</modified>
</dates>
</vuln>
<vuln vid="6e33f4ab-efed-11d9-8310-0001020eed82">
- <topic>bugzilla -- multiple vulnerabilities</topic>
- <affects>
+ <topic>bugzilla -- multiple vulnerabilities</topic> <affects>
<package>
- <name>bugzilla</name>
- <name>ja-bugzilla</name>
+ <name>bugzilla</name> <name>ja-bugzilla</name>
<range><ge>2.17.1</ge><lt>2.18.2 </lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>A Bugzilla Security Advisory reports:</p>
- <blockquote cite="http://www.bugzilla.org/security/2.18.1/">
+ <p>A Bugzilla Security Advisory reports:</p> <blockquote
+ cite="http://www.bugzilla.org/security/2.18.1/">
<p>Any user can change any flag on any bug, even if they
don't have access to that bug, or even if they can't
- normally make bug changes. This also allows them to expose
- the summary of a bug.</p>
+ normally make bug changes. This also allows them to
+ expose the summary of a bug.</p>
<p>Bugs are inserted into the database before they are
marked as private, in Bugzilla code. Thus, MySQL
- replication can lag in between the time that the bug is
- inserted and when it is marked as private (usually less
- than a second). If replication lags at this point, the bug
- summary will be accessible to all users until replication
- catches up. Also, on a very slow machine, there may be a
- pause longer than a second that allows users to see the
- title of the newly-filed bug.</p>
+ replication can lag in between the time that the bug
+ is inserted and when it is marked as private (usually
+ less than a second). If replication lags at this point,
+ the bug summary will be accessible to all users until
+ replication catches up. Also, on a very slow machine,
+ there may be a pause longer than a second that allows
+ users to see the title of the newly-filed bug.</p>
</blockquote>
</body>
- </description>
- <references>
- <cvename>CVE-2005-2173</cvename>
- <cvename>CVE-2005-2174</cvename>
+ </description> <references>
+ <cvename>CVE-2005-2173</cvename> <cvename>CVE-2005-2174</cvename>
<url>http://www.bugzilla.org/security/2.18.1/</url>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=292544</url>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=293159</url>
- </references>
- <dates>
- <discovery>2005-07-07</discovery>
- <entry>2005-07-08</entry>
+ </references> <dates>
+ <discovery>2005-07-07</discovery> <entry>2005-07-08</entry>
<modified>2005-07-18</modified>
</dates>
</vuln>
<vuln vid="d177d9f9-e317-11d9-8088-00123f0f7307">
- <topic>nwclient -- multiple vulnerabilities</topic>
- <affects>
+ <topic>nwclient -- multiple vulnerabilities</topic> <affects>
<package>
- <name>nwclient</name>
- <range><gt>0</gt></range>
+ <name>nwclient</name> <range><gt>0</gt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>Insecure file permissions, network access control and DNS
+ <p>Insecure file permissions, network access control and
+ DNS
usage put systems that use Legato NetWorker at risk.</p>
<p>When the software is running, several files that contain
sensitive information are created with insecure permissions.
@@ -3395,26 +2838,20 @@ Note: Please add new entries to the beginning of this file.
be used for privilege elevation.</p>
<p>An empty &quot;servers&quot; file, which should normally
contain hostnames of authorized backup servers, may allow
- unauthorized backups to be made. Sensitive information can
- be extracted from these backups.</p>
+ unauthorized backups to be made. Sensitive information
+ can be extracted from these backups.</p>
<p>When reverse DNS fails for the Legato client IP a weak
authorization scheme, containing a flaw that allows
unauthorized access, is used. This may allow unauthorized
access.</p>
</body>
- </description>
- <references>
- <bid>3564</bid>
- <bid>3840</bid>
- <bid>3842</bid>
- <cvename>CVE-2001-0910</cvename>
- <cvename>CVE-2002-0113</cvename>
+ </description> <references>
+ <bid>3564</bid> <bid>3840</bid> <bid>3842</bid>
+ <cvename>CVE-2001-0910</cvename> <cvename>CVE-2002-0113</cvename>
<cvename>CVE-2002-0114</cvename>
<url>http://portal1.legato.com/resources/bulletins/372.html</url>
- </references>
- <dates>
- <discovery>2002-01-10</discovery>
- <entry>2005-07-08</entry>
+ </references> <dates>
+ <discovery>2002-01-10</discovery> <entry>2005-07-08</entry>
</dates>
</vuln>
@@ -3422,20 +2859,16 @@ Note: Please add new entries to the beginning of this file.
<topic>acroread -- insecure temporary file creation</topic>
<affects>
<package>
- <name>acroread4</name>
- <name>acroread5</name>
+ <name>acroread4</name> <name>acroread5</name>
<range><ge>0</ge></range>
- </package>
- <package>
- <name>acroread</name>
- <range><lt>7.0.0</lt></range>
+ </package> <package>
+ <name>acroread</name> <range><lt>7.0.0</lt></range>
<range><gt>5.*,1</gt><lt>7.0.0,1</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>Secunia Research reports:</p>
- <blockquote cite="http://secunia.com/secunia_research/2005-6/advisory/">
+ <p>Secunia Research reports:</p> <blockquote
+ cite="http://secunia.com/secunia_research/2005-6/advisory/">
<p>Secunia has discovered a security issue in Adobe Reader
for Linux, which can be exploited by malicious, local
users to gain knowledge of sensitive information.</p>
@@ -3443,18 +2876,16 @@ Note: Please add new entries to the beginning of this file.
created with permissions based on a user's umask in the
"/tmp" folder under certain circumstances when documents
are opened.</p>
- <p>Successful exploitation allows an unprivileged user to
+ <p>Successful exploitation allows an unprivileged user
+ to
read arbitrary users' documents.</p>
</blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2005-1912</cvename>
<url>http://secunia.com/secunia_research/2005-6/advisory/</url>
- </references>
- <dates>
- <discovery>2005-06-29</discovery>
- <entry>2005-07-06</entry>
+ </references> <dates>
+ <discovery>2005-06-29</discovery> <entry>2005-07-06</entry>
</dates>
</vuln>
@@ -3462,46 +2893,40 @@ Note: Please add new entries to the beginning of this file.
<topic>clamav -- cabinet file handling DoS vulnerability</topic>
<affects>
<package>
- <name>clamav</name>
- <range><lt>0.86</lt></range>
- </package>
- <package>
- <name>clamav-devel</name>
- <range><lt>20050620</lt></range>
+ <name>clamav</name> <range><lt>0.86</lt></range>
+ </package> <package>
+ <name>clamav-devel</name> <range><lt>20050620</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>An iDEFENSE Security Advisory reports:</p>
- <blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=112006456809016">
- <p>Remote exploitation of an input validation error in Clam
+ <p>An iDEFENSE Security Advisory reports:</p> <blockquote
+ cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=112006456809016">
+ <p>Remote exploitation of an input validation error in
+ Clam
AntiVirus ClamAV allows attackers to cause a denial of
service condition.</p>
<p>The vulnerability specifically exists due to insufficient
validation on cabinet file header data. The
- <code>ENSURE_BITS()</code> macro fails to check for zero
- length reads, allowing a carefully constructed cabinet
- file to cause an infinite loop.</p>
+ <code>ENSURE_BITS()</code> macro fails to check for
+ zero length reads, allowing a carefully constructed
+ cabinet file to cause an infinite loop.</p>
<p>ClamAV is used in a number of mail gateway
- products. Successful exploitation requires an attacker to
- send a specially constructed CAB file through a mail
- gateway or personal anti-virus client utilizing the ClamAV
- scanning engine. The infinate loop will cause the ClamAV
- software to use all available processor resources,
- resulting in a denial of service or severe degradation to
- system performance. Remote exploitation can be achieved by
- sending a malicious file in an e-mail message or during an
- HTTP session.</p>
+ products. Successful exploitation requires an attacker
+ to send a specially constructed CAB file through a mail
+ gateway or personal anti-virus client utilizing the
+ ClamAV scanning engine. The infinate loop will cause
+ the ClamAV software to use all available processor
+ resources, resulting in a denial of service or severe
+ degradation to system performance. Remote exploitation
+ can be achieved by sending a malicious file in an e-mail
+ message or during an HTTP session.</p>
</blockquote>
</body>
- </description>
- <references>
- <cvename>CVE-2005-1923</cvename>
- <mlist msgid="FB24803D1DF2A34FA59FC157B77C97050462A3AB@IDSERV04.idef.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=112006456809016</mlist>
- </references>
- <dates>
- <discovery>2005-06-29</discovery>
- <entry>2005-07-06</entry>
+ </description> <references>
+ <cvename>CVE-2005-1923</cvename> <mlist
+ msgid="FB24803D1DF2A34FA59FC157B77C97050462A3AB@IDSERV04.idef.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=112006456809016</mlist>
+ </references> <dates>
+ <discovery>2005-06-29</discovery> <entry>2005-07-06</entry>
</dates>
</vuln>
@@ -3509,24 +2934,22 @@ Note: Please add new entries to the beginning of this file.
<topic>clamav -- MS-Expand file handling DoS vulnerability</topic>
<affects>
<package>
- <name>clamav</name>
- <range><lt>0.86</lt></range>
- </package>
- <package>
- <name>clamav-devel</name>
- <range><lt>20050620</lt></range>
+ <name>clamav</name> <range><lt>0.86</lt></range>
+ </package> <package>
+ <name>clamav-devel</name> <range><lt>20050620</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>An iDEFENSE Security Advisory reports:</p>
- <blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=112006402411598">
- <p>Remote exploitation of an input validation error in Clam
+ <p>An iDEFENSE Security Advisory reports:</p> <blockquote
+ cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=112006402411598">
+ <p>Remote exploitation of an input validation error in
+ Clam
AntiVirus ClamAV allows attackers to cause a denial of
service condition.</p>
<p>The vulnerability specifically exists due to improper
behavior during exceptional conditions.</p>
- <p>Successful exploitation allows attackers to exhaust file
+ <p>Successful exploitation allows attackers to exhaust
+ file
descriptors pool and memory. Anti-virus detection
functionality will fail if there is no file descriptors
available with which to open files. Remote exploitation
@@ -3534,144 +2957,114 @@ Note: Please add new entries to the beginning of this file.
message or during an HTTP session.</p>
</blockquote>
</body>
- </description>
- <references>
- <cvename>CVE-2005-1922</cvename>
- <mlist msgid="FB24803D1DF2A34FA59FC157B77C97050462A3AC@IDSERV04.idef.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=112006402411598</mlist>
- </references>
- <dates>
- <discovery>2005-06-29</discovery>
- <entry>2005-07-06</entry>
+ </description> <references>
+ <cvename>CVE-2005-1922</cvename> <mlist
+ msgid="FB24803D1DF2A34FA59FC157B77C97050462A3AC@IDSERV04.idef.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=112006402411598</mlist>
+ </references> <dates>
+ <discovery>2005-06-29</discovery> <entry>2005-07-06</entry>
</dates>
</vuln>
<vuln vid="8efe93e2-ee62-11d9-8310-0001020eed82">
- <topic>zlib -- buffer overflow vulnerability</topic>
- <affects>
+ <topic>zlib -- buffer overflow vulnerability</topic> <affects>
<package>
- <name>zsync</name>
- <range><lt>0.4.1</lt></range>
- </package>
- <system>
- <name>FreeBSD</name>
- <range><ge>5.4</ge><lt>5.4_4</lt></range>
+ <name>zsync</name> <range><lt>0.4.1</lt></range>
+ </package> <system>
+ <name>FreeBSD</name> <range><ge>5.4</ge><lt>5.4_4</lt></range>
<range><ge>5.3</ge><lt>5.3_18</lt></range>
</system>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <h1>Problem Description</h1>
- <p>An error in the handling of corrupt compressed data streams
+ <h1>Problem Description</h1> <p>An error in the handling
+ of corrupt compressed data streams
can result in a buffer being overflowed.</p>
- <h1>Impact</h1>
- <p>By carefully crafting a corrupt compressed data stream, an
+ <h1>Impact</h1> <p>By carefully crafting a corrupt compressed
+ data stream, an
attacker can overwrite data structures in a zlib-using
- application. This may cause the application to halt,
+ application. This may cause the application to halt,
causing a denial of service; or it may result in the
attacker gaining elevated privileges.</p>
</body>
- </description>
- <references>
- <cvename>CVE-2005-2096</cvename>
- <freebsdsa>SA-05:16.zlib</freebsdsa>
- </references>
- <dates>
- <discovery>2005-07-06</discovery>
- <entry>2005-07-06</entry>
+ </description> <references>
+ <cvename>CVE-2005-2096</cvename> <freebsdsa>SA-05:16.zlib</freebsdsa>
+ </references> <dates>
+ <discovery>2005-07-06</discovery> <entry>2005-07-06</entry>
<modified>2005-10-01</modified>
</dates>
</vuln>
<vuln vid="70c59485-ee5a-11d9-8310-0001020eed82">
- <topic>acroread -- buffer overflow vulnerability</topic>
- <affects>
+ <topic>acroread -- buffer overflow vulnerability</topic> <affects>
<package>
- <name>acroread4</name>
- <name>acroread5</name>
+ <name>acroread4</name> <name>acroread5</name>
<range><ge>0</ge></range>
- </package>
- <package>
- <name>acroread</name>
- <range><lt>7.0.0</lt></range>
+ </package> <package>
+ <name>acroread</name> <range><lt>7.0.0</lt></range>
<range><gt>5.*,1</gt><lt>7.0.0,1</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>An Adobe Security Advisory reports:</p>
- <blockquote cite="http://www.adobe.com/support/techdocs/329083.html">
+ <p>An Adobe Security Advisory reports:</p> <blockquote
+ cite="http://www.adobe.com/support/techdocs/329083.html">
<p>A vulnerability within Adobe Reader has been
identified. Under certain circumstances, remote
exploitation of a buffer overflow in Adobe Reader could
allow an attacker to execute arbitrary code.</p>
<p>If exploited, it could allow the execution of arbitrary
code under the privileges of the local user. Remote
- exploitation is possible if the malicious PDF document is
- sent as an email attachment or if the PDF document is
- accessed via a web link.</p>
+ exploitation is possible if the malicious PDF document
+ is sent as an email attachment or if the PDF document
+ is accessed via a web link.</p>
</blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2005-1625</cvename>
- <url>http://www.adobe.com/support/techdocs/329083.html</url>
- <mlist msgid="FB24803D1DF2A34FA59FC157B77C97050462A5E2@IDSERV04.idef.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=112059685332569</mlist>
- </references>
- <dates>
- <discovery>2005-07-05</discovery>
- <entry>2005-07-06</entry>
+ <url>http://www.adobe.com/support/techdocs/329083.html</url> <mlist
+ msgid="FB24803D1DF2A34FA59FC157B77C97050462A5E2@IDSERV04.idef.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=112059685332569</mlist>
+ </references> <dates>
+ <discovery>2005-07-05</discovery> <entry>2005-07-06</entry>
</dates>
</vuln>
<vuln vid="b2a1a3b5-ed95-11d9-8310-0001020eed82">
- <topic>net-snmp -- remote DoS vulnerability</topic>
- <affects>
+ <topic>net-snmp -- remote DoS vulnerability</topic> <affects>
<package>
- <name>net-snmp</name>
- <range><lt>5.2.1.2</lt></range>
+ <name>net-snmp</name> <range><lt>5.2.1.2</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>A Net-SNMP release announcement reports:</p>
- <blockquote cite="http://marc.theaimsgroup.com/?l=net-snmp-announce&amp;m=112059518426328">
+ <p>A Net-SNMP release announcement reports:</p> <blockquote
+ cite="http://marc.theaimsgroup.com/?l=net-snmp-announce&amp;m=112059518426328">
<p>A security vulnerability has been found in Net-SNMP
releases that could allow a denial of service attack
- against Net-SNMP agent's which have opened a stream based
- protocol (EG, TCP but not UDP; it should be noted that
- Net-SNMP does not by default open a TCP port).</p>
+ against Net-SNMP agent's which have opened a stream
+ based protocol (EG, TCP but not UDP; it should be noted
+ that Net-SNMP does not by default open a TCP port).</p>
</blockquote>
</body>
- </description>
- <references>
- <bid>14168</bid>
- <cvename>CVE-2005-2177</cvename>
- <mlist msgid="sdzmt5sul0.fsf@wes.hardakers.net">http://marc.theaimsgroup.com/?l=net-snmp-announce&amp;m=112059518426328</mlist>
- </references>
- <dates>
- <discovery>2005-07-02</discovery>
- <entry>2005-07-05</entry>
+ </description> <references>
+ <bid>14168</bid> <cvename>CVE-2005-2177</cvename> <mlist
+ msgid="sdzmt5sul0.fsf@wes.hardakers.net">http://marc.theaimsgroup.com/?l=net-snmp-announce&amp;m=112059518426328</mlist>
+ </references> <dates>
+ <discovery>2005-07-02</discovery> <entry>2005-07-05</entry>
<modified>2005-10-26</modified>
</dates>
</vuln>
<vuln vid="1cf00643-ed8a-11d9-8310-0001020eed82">
- <topic>cacti -- multiple vulnerabilities</topic>
- <affects>
+ <topic>cacti -- multiple vulnerabilities</topic> <affects>
<package>
- <name>cacti</name>
- <range><lt>0.8.6f</lt></range>
+ <name>cacti</name> <range><lt>0.8.6f</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>Stefan Esser reports:</p>
- <blockquote cite="http://www.hardened-php.net/advisory-032005.php">
+ <p>Stefan Esser reports:</p> <blockquote
+ cite="http://www.hardened-php.net/advisory-032005.php">
<p>Wrongly implemented user input filters lead to multiple
SQL Injection vulnerabilities which can lead f.e. to
disclosure of the admin password hash.</p>
- </blockquote>
- <blockquote cite="http://www.hardened-php.net/advisory-042005.php">
+ </blockquote> <blockquote
+ cite="http://www.hardened-php.net/advisory-042005.php">
<p>Wrongly implemented user input filters allows injection
of user input into executed commandline.</p>
<p>Alberto Trivero posted his Remote Command Execution
@@ -3680,92 +3073,84 @@ Note: Please add new entries to the beginning of this file.
that the malfunctioning input filters, which were already
mentioned in the previous advisory are also responsible
for this bug still being exploitable.</p>
- </blockquote>
- <blockquote cite="http://www.hardened-php.net/advisory-052005.php">
+ </blockquote> <blockquote
+ cite="http://www.hardened-php.net/advisory-052005.php">
<p>A HTTP headers bypass switch can also be used to
- completely bypass the authentification system of Cacti. As
- admin it is possible to execute shell commands with the
- permission of the webserver.</p>
+ completely bypass the authentification system of Cacti.
+ As admin it is possible to execute shell commands with
+ the permission of the webserver.</p>
<p>While looking at the source of Cacti a HTTP headers
bypass switch was discovered, that also switches off a
call to <code>session_start()</code> and the manual
application of <code>addslashes()</code> in case of
<code>magic_quotes_gpc=Off</code>.</p>
- <p>When register_globals is turned on* an attacker can use
+ <p>When register_globals is turned on* an attacker can
+ use
this switch to disables Cacti's use of PHP's session
- support and therefore supply the session variables on his
- own through f.e. the URL. Additionally using the switch
- renders several SQL statements vulnerable to SQL
- Injections attacks, when magic_quotes_gpc is turned off,
- which is the recommended setting.</p>
+ support and therefore supply the session variables on
+ his own through f.e. the URL. Additionally using the
+ switch renders several SQL statements vulnerable to SQL
+ Injections attacks, when magic_quotes_gpc is turned
+ off, which is the recommended setting.</p>
<p>Logged in as an admin it is possible to issue shell
commands.</p>
- <p>(*) register_globals is turned off by default since PHP
+ <p>(*) register_globals is turned off by default since
+ PHP
4.2 but is activated on most servers because of older
scripts requiring it.</p>
</blockquote>
</body>
- </description>
- <references>
- <mlist msgid="007301c57753$5ab17f60$0100a8c0@alberto">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=111954136315248</mlist>
+ </description> <references>
+ <mlist
+ msgid="007301c57753$5ab17f60$0100a8c0@alberto">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=111954136315248</mlist>
<url>http://www.hardened-php.net/advisory-032005.php</url>
<url>http://www.hardened-php.net/advisory-042005.php</url>
<url>http://www.hardened-php.net/advisory-052005.php</url>
- </references>
- <dates>
- <discovery>2005-06-22</discovery>
- <entry>2005-07-05</entry>
+ </references> <dates>
+ <discovery>2005-06-22</discovery> <entry>2005-07-05</entry>
</dates>
</vuln>
<vuln vid="dca0a345-ed81-11d9-8310-0001020eed82">
- <topic>wordpress -- multiple vulnerabilities</topic>
- <affects>
+ <topic>wordpress -- multiple vulnerabilities</topic> <affects>
<package>
- <name>wordpress</name>
- <range><lt>1.5.1.3,1</lt></range>
+ <name>wordpress</name> <range><lt>1.5.1.3,1</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>GulfTech Security Research reports:</p>
- <blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=112006967221438">
- <p>There are a number of vulnerabilities in WordPress that
- may allow an attacker to ultimately run arbitrary code on
- the vulnerable system. These vulnerabilities include SQL
- Injection, Cross Site Scripting, and also issues that may
- aid an attacker in social engineering.</p>
+ <p>GulfTech Security Research reports:</p> <blockquote
+ cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=112006967221438">
+ <p>There are a number of vulnerabilities in WordPress
+ that
+ may allow an attacker to ultimately run arbitrary code
+ on the vulnerable system. These vulnerabilities include
+ SQL Injection, Cross Site Scripting, and also issues
+ that may aid an attacker in social engineering.</p>
</blockquote>
</body>
- </description>
- <references>
- <cvename>CVE-2005-2107</cvename>
- <cvename>CVE-2005-2108</cvename>
- <cvename>CVE-2005-2109</cvename>
- <cvename>CVE-2005-2110</cvename>
- <mlist msgid="42C2BE6E.2050408@gulftech.org">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=112006967221438</mlist>
- </references>
- <dates>
- <discovery>2005-06-28</discovery>
- <entry>2005-07-05</entry>
+ </description> <references>
+ <cvename>CVE-2005-2107</cvename> <cvename>CVE-2005-2108</cvename>
+ <cvename>CVE-2005-2109</cvename> <cvename>CVE-2005-2110</cvename>
+ <mlist
+ msgid="42C2BE6E.2050408@gulftech.org">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=112006967221438</mlist>
+ </references> <dates>
+ <discovery>2005-06-28</discovery> <entry>2005-07-05</entry>
</dates>
</vuln>
<vuln vid="a4955b32-ed84-11d9-8310-0001020eed82">
- <topic>wordpress -- multiple vulnerabilities</topic>
- <affects>
+ <topic>wordpress -- multiple vulnerabilities</topic> <affects>
<package>
- <name>wordpress</name>
- <range><lt>1.5.1.2,1</lt></range>
+ <name>wordpress</name> <range><lt>1.5.1.2,1</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>A Gentoo Linux Security Advisory reports:</p>
- <blockquote cite="http://www.gentoo.org/security/en/glsa/glsa-200506-04.xml">
+ <p>A Gentoo Linux Security Advisory reports:</p> <blockquote
+ cite="http://www.gentoo.org/security/en/glsa/glsa-200506-04.xml">
<p>Due to a lack of input validation, WordPress is
vulnerable to SQL injection and XSS attacks.</p>
- <p>An attacker could use the SQL injection vulnerabilites to
+ <p>An attacker could use the SQL injection vulnerabilites
+ to
gain information from the database. Furthermore the
cross-site scripting issues give an attacker the ability
to inject and execute malicious script code or to steal
@@ -3773,14 +3158,11 @@ Note: Please add new entries to the beginning of this file.
compromising the victim's browser.</p>
</blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2005-1810</cvename>
<url>http://www.gentoo.org/security/en/glsa/glsa-200506-04.xml</url>
- </references>
- <dates>
- <discovery>2005-04-12</discovery>
- <entry>2005-07-05</entry>
+ </references> <dates>
+ <discovery>2005-04-12</discovery> <entry>2005-07-05</entry>
</dates>
</vuln>
@@ -3788,32 +3170,28 @@ Note: Please add new entries to the beginning of this file.
<topic>phpbb -- remote PHP code execution vulnerability</topic>
<affects>
<package>
- <name>phpbb</name>
- <range><lt>2.0.16</lt></range>
+ <name>phpbb</name> <range><lt>2.0.16</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>FrSIRT Advisory reports:</p>
- <blockquote cite="http://www.frsirt.com/english/advisories/2005/0904">
+ <p>FrSIRT Advisory reports:</p> <blockquote
+ cite="http://www.frsirt.com/english/advisories/2005/0904">
<p>A vulnerability was identified in phpBB, which
may be exploited by attackers to compromise a vulnerable
- web server. This flaw is due to an input validation error
- in the "viewtopic.php" script that does not properly filter
- the "highlight" parameter before calling the "preg_replace()"
- function, which may be exploited by remote attackers to execute
- arbitrary PHP commands with the privileges of the web server.</p>
+ web server. This flaw is due to an input validation
+ error in the "viewtopic.php" script that does not
+ properly filter the "highlight" parameter before calling
+ the "preg_replace()" function, which may be exploited
+ by remote attackers to execute arbitrary PHP commands
+ with the privileges of the web server.</p>
</blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2005-2086</cvename>
<url>http://www.frsirt.com/english/advisories/2005/0904</url>
<url>http://www.phpbb.com/phpBB/viewtopic.php?t=302011</url>
- </references>
- <dates>
- <discovery>2005-06-28</discovery>
- <entry>2005-07-03</entry>
+ </references> <dates>
+ <discovery>2005-06-28</discovery> <entry>2005-07-03</entry>
<modified>2005-07-07</modified>
</dates>
</vuln>
@@ -3822,126 +3200,108 @@ Note: Please add new entries to the beginning of this file.
<topic>pear-XML_RPC -- arbitrary remote code execution</topic>
<affects>
<package>
- <name>pear-XML_RPC</name>
- <range><lt>1.3.1</lt></range>
+ <name>pear-XML_RPC</name> <range><lt>1.3.1</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>GulfTech Security Research Team reports:</p>
- <blockquote cite="http://www.gulftech.org/?node=research&amp;article_id=00087-07012005">
- <p>PEAR XML_RPC is vulnerable to a very high risk php code
+ <p>GulfTech Security Research Team reports:</p> <blockquote
+ cite="http://www.gulftech.org/?node=research&amp;article_id=00087-07012005">
+ <p>PEAR XML_RPC is vulnerable to a very high risk php
+ code
injection vulnerability due to unsanatized data being
passed into an eval() call.</p>
</blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2005-1921</cvename>
<url>http://www.gulftech.org/?node=research&amp;article_id=00087-07012005</url>
<url>http://www.hardened-php.net/advisory-022005.php</url>
- </references>
- <dates>
- <discovery>2005-06-29</discovery>
- <entry>2005-07-03</entry>
+ </references> <dates>
+ <discovery>2005-06-29</discovery> <entry>2005-07-03</entry>
</dates>
</vuln>
<vuln vid="f70f8860-e8ee-11d9-b875-0001020eed82">
- <topic>kernel -- ipfw packet matching errors with address tables</topic>
- <affects>
+ <topic>kernel -- ipfw packet matching errors with address
+ tables</topic> <affects>
<system>
- <name>FreeBSD</name>
- <range><ge>5.4</ge><lt>5.4_3</lt></range>
+ <name>FreeBSD</name> <range><ge>5.4</ge><lt>5.4_3</lt></range>
</system>
- </affects>
- <description>
- <body xmlns="http://www.w3.org/1999/xhtml">
- <h1>Problem Description</h1>
- <p>The ipfw tables lookup code caches the result of the last
- query. The kernel may process multiple packets
- concurrently, performing several concurrent table lookups.
- Due to an insufficient locking, a cached result can become
- corrupted that could cause some addresses to be incorrectly
- matched against a lookup table.</p>
- <h1>Impact</h1>
- <p>When lookup tables are used with ipfw, packets may on very
- rare occasions incorrectly match a lookup table. This could
- result in a packet being treated contrary to the defined
- packet filtering ruleset. For example, a packet may be
- allowed to pass through when it should have been
+ </affects> <description>
+ <body xmlns="http://www.w3.org/1999/xhtml">
+ <h1>Problem Description</h1> <p>The ipfw tables lookup code
+ caches the result of the last
+ query. The kernel may process multiple packets concurrently,
+ performing several concurrent table lookups. Due to an
+ insufficient locking, a cached result can become corrupted
+ that could cause some addresses to be incorrectly matched
+ against a lookup table.</p>
+ <h1>Impact</h1> <p>When lookup tables are used with ipfw,
+ packets may on very
+ rare occasions incorrectly match a lookup table. This
+ could result in a packet being treated contrary to the
+ defined packet filtering ruleset. For example, a packet
+ may be allowed to pass through when it should have been
discarded.</p>
<p>The problem can only occur on Symmetric Multi-Processor
(SMP) systems, or on Uni Processor (UP) systems with the
PREEMPTION kernel option enabled (not the default).</p>
- <h1>Workaround</h1>
- <p>a) Do not use lookup tables.</p>
- <p>OR</p>
- <p>b) Disable concurrent processing of packets in the network
+ <h1>Workaround</h1> <p>a) Do not use lookup tables.</p>
+ <p>OR</p> <p>b) Disable concurrent processing of packets
+ in the network
stack by setting the "debug.mpsafenet=0" tunable:</p>
<p># echo "debug.mpsafenet=0" &lt;&lt; /boot/loader.conf</p>
</body>
- </description>
- <references>
- <cvename>CVE-2005-2019</cvename>
- <freebsdsa>SA-05:13.ipfw</freebsdsa>
- </references>
- <dates>
- <discovery>2005-06-29</discovery>
- <entry>2005-06-29</entry>
+ </description> <references>
+ <cvename>CVE-2005-2019</cvename> <freebsdsa>SA-05:13.ipfw</freebsdsa>
+ </references> <dates>
+ <discovery>2005-06-29</discovery> <entry>2005-06-29</entry>
<modified>2005-07-06</modified>
</dates>
</vuln>
<vuln vid="197f444f-e8ef-11d9-b875-0001020eed82">
- <topic>bzip2 -- denial of service and permission race vulnerabilities</topic>
- <affects>
+ <topic>bzip2 -- denial of service and permission race
+ vulnerabilities</topic> <affects>
<system>
- <name>FreeBSD</name>
- <range><ge>5.4</ge><lt>5.4_3</lt></range>
+ <name>FreeBSD</name> <range><ge>5.4</ge><lt>5.4_3</lt></range>
<range><ge>5.*</ge><lt>5.3_17</lt></range>
<range><ge>4.11</ge><lt>4.11_11</lt></range>
<range><lt>4.10_16</lt></range>
- </system>
- <package>
- <name>bzip2</name>
- <range><lt>1.0.3_1</lt></range>
+ </system> <package>
+ <name>bzip2</name> <range><lt>1.0.3_1</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <h1>Problem Description</h1>
- <p>Two problems have been discovered relating to the
- extraction of bzip2-compressed files. First, a carefully
+ <h1>Problem Description</h1> <p>Two problems have been
+ discovered relating to the
+ extraction of bzip2-compressed files. First, a carefully
constructed invalid bzip2 archive can cause bzip2 to enter
an infinite loop. Second, when creating a new file, bzip2
closes the file before setting its permissions.</p>
- <h1>Impact</h1>
- <p>The first problem can cause bzip2 to extract a bzip2
- archive to an infinitely large file. If bzip2 is used in
- automated processing of untrusted files this could be
+ <h1>Impact</h1> <p>The first problem can cause bzip2 to
+ extract a bzip2
+ archive to an infinitely large file. If bzip2 is used
+ in automated processing of untrusted files this could be
exploited by an attacker to create an denial-of-service
situation by exhausting disk space or by consuming all
available cpu time.</p>
- <p>The second problem can allow a local attacker to change the
- permissions of local files owned by the user executing bzip2
- providing that they have write access to the directory in
- which the file is being extracted.</p>
- <h1>Workaround</h1>
- <p>Do not uncompress bzip2 archives from untrusted sources and
- do not uncompress files in directories where untrusted users
- have write access.</p>
+ <p>The second problem can allow a local attacker to change
+ the
+ permissions of local files owned by the user executing
+ bzip2 providing that they have write access to the directory
+ in which the file is being extracted.</p>
+ <h1>Workaround</h1> <p>Do not uncompress bzip2 archives
+ from untrusted sources and
+ do not uncompress files in directories where untrusted
+ users have write access.</p>
</body>
- </description>
- <references>
- <cvename>CVE-2005-0953</cvename>
- <cvename>CVE-2005-1260</cvename>
+ </description> <references>
+ <cvename>CVE-2005-0953</cvename> <cvename>CVE-2005-1260</cvename>
<freebsdsa>SA-05:14.bzip2</freebsdsa>
<url>http://scary.beasts.org/security/CESA-2005-002.txt</url>
- </references>
- <dates>
- <discovery>2005-03-30</discovery>
- <entry>2005-06-29</entry>
+ </references> <dates>
+ <discovery>2005-03-30</discovery> <entry>2005-06-29</entry>
<modified>2005-07-06</modified>
</dates>
</vuln>
@@ -3950,46 +3310,40 @@ Note: Please add new entries to the beginning of this file.
<topic>kernel -- TCP connection stall denial of service</topic>
<affects>
<system>
- <name>FreeBSD</name>
- <range><ge>5.4</ge><lt>5.4_3</lt></range>
+ <name>FreeBSD</name> <range><ge>5.4</ge><lt>5.4_3</lt></range>
<range><ge>5.*</ge><lt>5.3_17</lt></range>
<range><ge>4.11</ge><lt>4.11_11</lt></range>
<range><lt>4.10_16</lt></range>
</system>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <h1>Problem Description</h1>
- <p>Two problems have been discovered in the FreeBSD TCP stack.</p>
- <p>First, when a TCP packets containing a timestamp is
+ <h1>Problem Description</h1> <p>Two problems have been
+ discovered in the FreeBSD TCP stack.</p> <p>First, when a
+ TCP packets containing a timestamp is
received, inadequate checking of sequence numbers is
- performed, allowing an attacker to artificially increase the
- internal "recent" timestamp for a connection.</p>
- <p>Second, a TCP packet with the SYN flag set is accepted for
+ performed, allowing an attacker to artificially increase
+ the internal "recent" timestamp for a connection.</p>
+ <p>Second, a TCP packet with the SYN flag set is accepted
+ for
established connections, allowing an attacker to overwrite
certain TCP options.</p>
- <h1>Impact</h1>
- <p>Using either of the two problems an attacker with knowledge
- of the local and remote IP and port numbers associated with
- a connection can cause a denial of service situation by
- stalling the TCP connection. The stalled TCP connection my
- be closed after some time by the other host.</p>
- <h1>Workaround</h1>
- <p>In some cases it may be possible to defend against these
+ <h1>Impact</h1> <p>Using either of the two problems an
+ attacker with knowledge
+ of the local and remote IP and port numbers associated
+ with a connection can cause a denial of service situation
+ by stalling the TCP connection. The stalled TCP connection
+ my be closed after some time by the other host.</p>
+ <h1>Workaround</h1> <p>In some cases it may be possible to
+ defend against these
attacks by blocking the attack packets using a firewall.
Packets used to effect either of these attacks would have
spoofed source IP addresses.</p>
</body>
- </description>
- <references>
- <certvu>637934</certvu>
- <cvename>CVE-2005-0356</cvename>
- <cvename>CVE-2005-2068</cvename>
- <freebsdsa>SA-05:15.tcp</freebsdsa>
- </references>
- <dates>
- <discovery>2005-06-29</discovery>
- <entry>2005-06-29</entry>
+ </description> <references>
+ <certvu>637934</certvu> <cvename>CVE-2005-0356</cvename>
+ <cvename>CVE-2005-2068</cvename> <freebsdsa>SA-05:15.tcp</freebsdsa>
+ </references> <dates>
+ <discovery>2005-06-29</discovery> <entry>2005-06-29</entry>
<modified>2005-07-06</modified>
</dates>
</vuln>
@@ -3998,25 +3352,23 @@ Note: Please add new entries to the beginning of this file.
<topic>ethereal -- multiple protocol dissectors vulnerabilities</topic>
<affects>
<package>
- <name>ethereal</name>
- <name>ethereal-lite</name>
- <name>tethereal</name>
- <name>tethereal-lite</name>
+ <name>ethereal</name> <name>ethereal-lite</name>
+ <name>tethereal</name> <name>tethereal-lite</name>
<range><ge>0.8.14</ge><lt>0.10.11</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>An Ethreal Security Advisories reports:</p>
- <blockquote cite="http://www.ethereal.com/appnotes/enpa-sa-00019.html">
+ <p>An Ethreal Security Advisories reports:</p> <blockquote
+ cite="http://www.ethereal.com/appnotes/enpa-sa-00019.html">
<p>An aggressive testing program as well as independent
discovery has turned up a multitude of security issues:</p>
<ul>
- <li>The ANSI A dissector was susceptible to format string
+ <li>The ANSI A dissector was susceptible to format
+ string
vulnerabilities. Discovered by Bryan Fulton.</li>
- <li>The GSM MAP dissector could crash.</li>
- <li>The AIM dissector could cause a crash.</li>
- <li>The DISTCC dissector was susceptible to a buffer
+ <li>The GSM MAP dissector could crash.</li> <li>The AIM
+ dissector could cause a crash.</li> <li>The DISTCC
+ dissector was susceptible to a buffer
overflow. Discovered by Ilja van Sprundel</li>
<li>The FCELS dissector was susceptible to a buffer
overflow. Discovered by Neil Kettle</li>
@@ -4026,21 +3378,23 @@ Note: Please add new entries to the beginning of this file.
exception, endless looping, and other problems.</li>
<li>The LMP dissector was susceptible to an endless
loop.</li>
- <li>The Telnet dissector could abort.</li>
- <li>The TZSP dissector could cause a segmentation
+ <li>The Telnet dissector could abort.</li> <li>The TZSP
+ dissector could cause a segmentation
fault.</li>
<li>The WSP dissector was susceptible to a null pointer
exception and assertions.</li>
<li>The 802.3 Slow protocols dissector could throw an
assertion.</li>
<li>The BER dissector could throw assertions.</li>
- <li>The SMB Mailslot dissector was susceptible to a null
+ <li>The SMB Mailslot dissector was susceptible to a
+ null
pointer exception and could throw assertions.</li>
<li>The H.245 dissector was susceptible to a null pointer
exception.</li>
<li>The Bittorrent dissector could cause a segmentation
fault.</li>
- <li>The SMB dissector could cause a segmentation fault and
+ <li>The SMB dissector could cause a segmentation fault
+ and
throw assertions.</li>
<li>The Fibre Channel dissector could cause a crash.</li>
<li>The DICOM dissector could attempt to allocate large
@@ -4050,7 +3404,8 @@ Note: Please add new entries to the beginning of this file.
<li>The RSVP dissector could loop indefinitely.</li>
<li>The DHCP dissector was susceptible to format string
vulnerabilities, and could abort.</li>
- <li>The SRVLOC dissector could crash unexpectedly or go
+ <li>The SRVLOC dissector could crash unexpectedly or
+ go
into an infinite loop.</li>
<li>The EIGRP dissector could loop indefinitely.</li>
<li>The ISIS dissector could overflow a buffer.</li>
@@ -4070,85 +3425,70 @@ Note: Please add new entries to the beginning of this file.
loop.</li>
<li>The RPC dissector was susceptible to a null pointer
exception.</li>
- <li>The NCP dissector could overflow a buffer or loop for
+ <li>The NCP dissector could overflow a buffer or loop
+ for
a large amount of time.</li>
<li>The RADIUS dissector could throw an assertion.</li>
<li>The GSM dissector could access an invalid
pointer.</li>
<li>The SMB PIPE dissector could throw an assertion.</li>
- <li>The L2TP dissector was susceptible to an infinite loop.</li>
- <li>The SMB NETLOGON dissector could dereference a null
+ <li>The L2TP dissector was susceptible to an infinite
+ loop.</li> <li>The SMB NETLOGON dissector could dereference
+ a null
pointer.</li>
<li>The MRDISC dissector could throw an assertion.</li>
- <li>The ISUP dissector could overflow a buffer or cause a
+ <li>The ISUP dissector could overflow a buffer or cause
+ a
segmentation fault.</li>
- <li>The LDAP dissector could crash.</li>
- <li>The TCAP dissector could overflow a buffer or throw an
+ <li>The LDAP dissector could crash.</li> <li>The TCAP
+ dissector could overflow a buffer or throw an
assertion.</li>
- <li>The NTLMSSP dissector could crash.</li>
- <li>The Presentation dissector could overflow a
+ <li>The NTLMSSP dissector could crash.</li> <li>The
+ Presentation dissector could overflow a
buffer.</li>
- <li>Additionally, a number of dissectors could throw an
+ <li>Additionally, a number of dissectors could throw
+ an
assertion when passing an invalid protocol tree item
length.</li>
</ul>
</blockquote>
</body>
- </description>
- <references>
- <bid>13391</bid>
- <bid>13504</bid>
- <bid>13567</bid>
- <cvename>CVE-2005-1281</cvename>
- <cvename>CVE-2005-1456</cvename>
- <cvename>CVE-2005-1457</cvename>
- <cvename>CVE-2005-1458</cvename>
- <cvename>CVE-2005-1459</cvename>
- <cvename>CVE-2005-1460</cvename>
- <cvename>CVE-2005-1461</cvename>
- <cvename>CVE-2005-1462</cvename>
- <cvename>CVE-2005-1463</cvename>
- <cvename>CVE-2005-1464</cvename>
- <cvename>CVE-2005-1465</cvename>
- <cvename>CVE-2005-1466</cvename>
- <cvename>CVE-2005-1467</cvename>
- <cvename>CVE-2005-1468</cvename>
- <cvename>CVE-2005-1469</cvename>
- <cvename>CVE-2005-1470</cvename>
+ </description> <references>
+ <bid>13391</bid> <bid>13504</bid> <bid>13567</bid>
+ <cvename>CVE-2005-1281</cvename> <cvename>CVE-2005-1456</cvename>
+ <cvename>CVE-2005-1457</cvename> <cvename>CVE-2005-1458</cvename>
+ <cvename>CVE-2005-1459</cvename> <cvename>CVE-2005-1460</cvename>
+ <cvename>CVE-2005-1461</cvename> <cvename>CVE-2005-1462</cvename>
+ <cvename>CVE-2005-1463</cvename> <cvename>CVE-2005-1464</cvename>
+ <cvename>CVE-2005-1465</cvename> <cvename>CVE-2005-1466</cvename>
+ <cvename>CVE-2005-1467</cvename> <cvename>CVE-2005-1468</cvename>
+ <cvename>CVE-2005-1469</cvename> <cvename>CVE-2005-1470</cvename>
<url>http://www.ethereal.com/appnotes/enpa-sa-00019.html</url>
- </references>
- <dates>
- <discovery>2005-05-04</discovery>
- <entry>2005-06-24</entry>
+ </references> <dates>
+ <discovery>2005-05-04</discovery> <entry>2005-06-24</entry>
</dates>
</vuln>
<vuln vid="691ed622-e499-11d9-a8bd-000cf18bbe54">
- <topic>tor -- information disclosure</topic>
- <affects>
+ <topic>tor -- information disclosure</topic> <affects>
<package>
- <name>tor</name>
- <range><lt>0.1.0.10</lt></range>
+ <name>tor</name> <range><lt>0.1.0.10</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>Roger Dingledine reports:</p>
- <blockquote cite="http://archives.seul.org/or/announce/Jun-2005/msg00001.html">
+ <p>Roger Dingledine reports:</p> <blockquote
+ cite="http://archives.seul.org/or/announce/Jun-2005/msg00001.html">
<p>The Tor 0.1.0.10 release from a few days ago
includes a fix for a bug that might allow an attacker
to read arbitrary memory (maybe even keys) from an exit
- server's process space. We haven't heard any reports of
- exploits yet, but hey.</p>
+ server's process space. We haven't heard any reports
+ of exploits yet, but hey.</p>
</blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<mlist>http://archives.seul.org/or/announce/Jun-2005/msg00001.html</mlist>
- </references>
- <dates>
- <discovery>2005-06-16</discovery>
- <entry>2005-06-24</entry>
+ </references> <dates>
+ <discovery>2005-06-16</discovery> <entry>2005-06-24</entry>
</dates>
</vuln>
@@ -4156,30 +3496,25 @@ Note: Please add new entries to the beginning of this file.
<topic>linux-realplayer -- RealText parsing heap overflow</topic>
<affects>
<package>
- <name>linux-realplayer</name>
- <range><le>10.0.4_1</le></range>
+ <name>linux-realplayer</name> <range><le>10.0.4_1</le></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>An iDEFENSE Security Advisory reports:</p>
- <blockquote cite="http://www.idefense.com/application/poi/display?id=250&amp;type=vulnerabilities&amp;flashstatus=false">
+ <p>An iDEFENSE Security Advisory reports:</p> <blockquote
+ cite="http://www.idefense.com/application/poi/display?id=250&amp;type=vulnerabilities&amp;flashstatus=false">
<p>Remote exploitation of a heap-based buffer
overflow vulnerability in the RealText file format
- parser within various versions of RealNetworks
- Inc.'s RealPlayer could allow attackers to
- execute arbitrary code.</p>
+ parser within various versions of RealNetworks Inc.'s
+ RealPlayer could allow attackers to execute arbitrary
+ code.</p>
</blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2005-1277</cvename>
<url>http://www.idefense.com/application/poi/display?id=250&amp;type=vulnerabilities&amp;flashstatus=false</url>
<url>http://service.real.com/help/faq/security/050623_player/EN/</url>
- </references>
- <dates>
- <discovery>2005-06-23</discovery>
- <entry>2005-06-24</entry>
+ </references> <dates>
+ <discovery>2005-06-23</discovery> <entry>2005-06-24</entry>
</dates>
</vuln>
@@ -4187,95 +3522,79 @@ Note: Please add new entries to the beginning of this file.
<topic>ruby -- arbitrary command execution on XMLRPC server</topic>
<affects>
<package>
- <name>ruby</name>
- <name>ruby_static</name>
+ <name>ruby</name> <name>ruby_static</name>
<range><le>1.8.2_3</le></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>Nobuhiro IMAI reports:</p>
- <blockquote cite="http://blade.nagaokaut.ac.jp/cgi-bin/scat.rb/ruby/ruby-core/5237">
+ <p>Nobuhiro IMAI reports:</p> <blockquote
+ cite="http://blade.nagaokaut.ac.jp/cgi-bin/scat.rb/ruby/ruby-core/5237">
<p>the default value modification on
- Module#public_instance_methods (from false to true) breaks
- s.add_handler(XMLRPC::iPIMethods("sample"), MyHandler.new) style
- security protection.</p>
- <p>This problem could allow a remote attacker to execute arbitrary
+ Module#public_instance_methods (from false to true)
+ breaks s.add_handler(XMLRPC::iPIMethods("sample"),
+ MyHandler.new) style security protection.</p>
+ <p>This problem could allow a remote attacker to execute
+ arbitrary
commands on XMLRPC server of libruby.</p>
</blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2005-1992</cvename>
<url>http://blade.nagaokaut.ac.jp/cgi-bin/scat.rb/ruby/ruby-core/5237</url>
<url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=315064</url>
- </references>
- <dates>
- <discovery>2005-06-22</discovery>
- <entry>2005-06-23</entry>
+ </references> <dates>
+ <discovery>2005-06-22</discovery> <entry>2005-06-23</entry>
</dates>
</vuln>
<vuln vid="96948a6a-e239-11d9-83cf-0010dc5df42d">
- <topic>cacti -- potential SQL injection and cross site scripting attacks</topic>
- <affects>
+ <topic>cacti -- potential SQL injection and cross site scripting
+ attacks</topic> <affects>
<package>
- <name>cacti</name>
- <range><le>0.8.6d</le></range>
+ <name>cacti</name> <range><le>0.8.6d</le></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>iDEFENSE security group disclosed potential SQL injection
+ <p>iDEFENSE security group disclosed potential SQL injection
attacks from unchecked user input and two security holes
regarding potential cross site scripting attacks</p>
</body>
- </description>
- <references>
+ </description> <references>
<url>http://www.cacti.net/release_notes_0_8_6e.php</url>
- </references>
- <dates>
- <discovery>2005-06-21</discovery>
- <entry>2005-06-21</entry>
+ </references> <dates>
+ <discovery>2005-06-21</discovery> <entry>2005-06-21</entry>
</dates>
</vuln>
<vuln vid="79217c9b-e1d9-11d9-b875-0001020eed82">
- <topic>opera -- XMLHttpRequest security bypass</topic>
- <affects>
+ <topic>opera -- XMLHttpRequest security bypass</topic> <affects>
<package>
- <name>linux-opera</name>
- <name>opera-devel</name>
- <name>opera</name>
- <range><gt>8.*</gt><lt>8.01</lt></range>
+ <name>linux-opera</name> <name>opera-devel</name>
+ <name>opera</name> <range><gt>8.*</gt><lt>8.01</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>A Secunia Advisory reports:</p>
- <blockquote cite="http://secunia.com/advisories/15008/">
- <p>Secunia Research has discovered a vulnerability in Opera,
+ <p>A Secunia Advisory reports:</p> <blockquote
+ cite="http://secunia.com/advisories/15008/">
+ <p>Secunia Research has discovered a vulnerability in
+ Opera,
which can be exploited by malicious people to steal
- content or to perform actions on other web sites with the
- privileges of the user.</p>
+ content or to perform actions on other web sites with
+ the privileges of the user.</p>
<p>Normally, it should not be possible for the
<code>XMLHttpRequest</code> object to access resources
- from outside the domain of which the object was
- opened. However, due to insufficient validation of server
- side redirects, it is possible to circumvent this
- restriction.</p>
+ from outside the domain of which the object was opened.
+ However, due to insufficient validation of server side
+ redirects, it is possible to circumvent this restriction.</p>
</blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2005-1475</cvename>
<url>http://secunia.com/advisories/15008/</url>
<url>http://secunia.com/secunia_research/2005-4/advisory/</url>
<url>http://www.opera.com/freebsd/changelogs/801/#security</url>
- </references>
- <dates>
- <discovery>2005-06-16</discovery>
- <entry>2005-06-20</entry>
+ </references> <dates>
+ <discovery>2005-06-16</discovery> <entry>2005-06-20</entry>
</dates>
</vuln>
@@ -4284,17 +3603,15 @@ Note: Please add new entries to the beginning of this file.
vulnerability</topic>
<affects>
<package>
- <name>linux-opera</name>
- <name>opera-devel</name>
- <name>opera</name>
- <range><lt>8.01</lt></range>
+ <name>linux-opera</name> <name>opera-devel</name>
+ <name>opera</name> <range><lt>8.01</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>A Secunia Advisory reports:</p>
- <blockquote cite="http://secunia.com/advisories/15411/">
- <p>Secunia Research has discovered a vulnerability in Opera,
+ <p>A Secunia Advisory reports:</p> <blockquote
+ cite="http://secunia.com/advisories/15411/">
+ <p>Secunia Research has discovered a vulnerability in
+ Opera,
which can be exploited by malicious people to conduct
cross-site scripting attacks and to read local files.</p>
<p>The vulnerability is caused due to Opera not properly
@@ -4302,15 +3619,12 @@ Note: Please add new entries to the beginning of this file.
opened in e.g. new windows or frames.</p>
</blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2005-1669</cvename>
<url>http://secunia.com/advisories/15411/</url>
<url>http://www.opera.com/freebsd/changelogs/801/#security</url>
- </references>
- <dates>
- <discovery>2005-06-16</discovery>
- <entry>2005-06-20</entry>
+ </references> <dates>
+ <discovery>2005-06-16</discovery> <entry>2005-06-20</entry>
</dates>
</vuln>
@@ -4318,34 +3632,29 @@ Note: Please add new entries to the beginning of this file.
<topic>opera -- redirection cross-site scripting vulnerability</topic>
<affects>
<package>
- <name>linux-opera</name>
- <name>opera-devel</name>
- <name>opera</name>
- <range><gt>8.*</gt><lt>8.01</lt></range>
+ <name>linux-opera</name> <name>opera-devel</name>
+ <name>opera</name> <range><gt>8.*</gt><lt>8.01</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>A Secunia Advisory reports:</p>
- <blockquote cite="http://secunia.com/advisories/15423/">
- <p>Secunia Research has discovered a vulnerability in Opera,
+ <p>A Secunia Advisory reports:</p> <blockquote
+ cite="http://secunia.com/advisories/15423/">
+ <p>Secunia Research has discovered a vulnerability in
+ Opera,
which can be exploited by malicious people to conduct
cross-site scripting attacks against users.</p>
<p>The vulnerability is caused due to input not being
sanitised, when Opera generates a temporary page for
- displaying a redirection when "Automatic redirection" is
- disabled (not default setting).</p>
+ displaying a redirection when "Automatic redirection"
+ is disabled (not default setting).</p>
</blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<url>http://secunia.com/advisories/15423/</url>
<url>http://secunia.com/secunia_research/2003-1/advisory/</url>
<url>http://www.opera.com/freebsd/changelogs/801/#security</url>
- </references>
- <dates>
- <discovery>2005-06-16</discovery>
- <entry>2005-06-20</entry>
+ </references> <dates>
+ <discovery>2005-06-16</discovery> <entry>2005-06-20</entry>
</dates>
</vuln>
@@ -4353,33 +3662,29 @@ Note: Please add new entries to the beginning of this file.
<topic>sudo -- local race condition vulnerability</topic>
<affects>
<package>
- <name>sudo</name>
- <range><lt>1.6.8.9</lt></range>
+ <name>sudo</name> <range><lt>1.6.8.9</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>Todd C. Miller reports:</p>
- <blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=111928183431376">
+ <p>Todd C. Miller reports:</p> <blockquote
+ cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=111928183431376">
<p>A race condition in Sudo's command pathname handling
- prior to Sudo version 1.6.8p9 that could allow a user with
- Sudo privileges to run arbitrary commands.</p>
- <p>Exploitation of the bug requires that the user be allowed
- to run one or more commands via Sudo and be able to create
- symbolic links in the filesystem. Furthermore, a sudoers
- entry giving another user access to the ALL pseudo-command
- must follow the user's sudoers entry for the race to
- exist.</p>
+ prior to Sudo version 1.6.8p9 that could allow a user
+ with Sudo privileges to run arbitrary commands.</p>
+ <p>Exploitation of the bug requires that the user be
+ allowed
+ to run one or more commands via Sudo and be able to
+ create symbolic links in the filesystem. Furthermore,
+ a sudoers entry giving another user access to the ALL
+ pseudo-command must follow the user's sudoers entry for
+ the race to exist.</p>
</blockquote>
</body>
- </description>
- <references>
- <bid>13993</bid>
- <mlist msgid="200506201424.j5KEOhQI024645@xerxes.courtesan.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=111928183431376</mlist>
- </references>
- <dates>
- <discovery>2005-06-20</discovery>
- <entry>2005-06-20</entry>
+ </description> <references>
+ <bid>13993</bid> <mlist
+ msgid="200506201424.j5KEOhQI024645@xerxes.courtesan.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=111928183431376</mlist>
+ </references> <dates>
+ <discovery>2005-06-20</discovery> <entry>2005-06-20</entry>
</dates>
</vuln>
@@ -4387,46 +3692,43 @@ Note: Please add new entries to the beginning of this file.
<topic>trac -- file upload/download vulnerability</topic>
<affects>
<package>
- <name>trac</name>
- <range><lt>0.8.4</lt></range>
+ <name>trac</name> <range><lt>0.8.4</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>Stefan Esser reports:</p>
- <blockquote cite="http://www.hardened-php.net/advisory-012005.php">
+ <p>Stefan Esser reports:</p> <blockquote
+ cite="http://www.hardened-php.net/advisory-012005.php">
<p>Trac's wiki and ticket systems allows to add attachments
to wiki entries and bug tracker tickets. These attachments
- are stored within directories that are determined by the
- id of the corresponding ticket or wiki entry.</p>
+ are stored within directories that are determined by
+ the id of the corresponding ticket or wiki entry.</p>
<p>Due to a missing validation of the id parameter it is
- possible for an attacker to supply arbitrary paths to the
- upload and attachment viewer scripts. This means that a
- potential attacker can retrieve any file accessible by the
- webserver user.</p>
- <p>Additionally it is possible to upload arbitrary files (up
+ possible for an attacker to supply arbitrary paths to
+ the upload and attachment viewer scripts. This means
+ that a potential attacker can retrieve any file accessible
+ by the webserver user.</p>
+ <p>Additionally it is possible to upload arbitrary files
+ (up
to a configured file length) to any place the webserver
has write access too.</p>
<p>For obvious reasons this can lead to the execution of
arbitrary code if it possible to upload files to the
document root or it's subdirectories. One example of a
- configuration would be f.e. running Trac and
- s9y/wordpress with writeable content directories on the
- same webserver.</p>
- <p>Another potential usage of this exploit would be to abuse
+ configuration would be f.e. running Trac and s9y/wordpress
+ with writeable content directories on the same
+ webserver.</p>
+ <p>Another potential usage of this exploit would be to
+ abuse
Trac powered webservers as storage for f.e. torrent
files.</p>
</blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<bid>13990</bid>
<url>http://www.hardened-php.net/advisory-012005.php</url>
<url>http://projects.edgewall.com/trac/wiki/ChangeLog</url>
- </references>
- <dates>
- <discovery>2005-06-20</discovery>
- <entry>2005-06-20</entry>
+ </references> <dates>
+ <discovery>2005-06-20</discovery> <entry>2005-06-20</entry>
</dates>
</vuln>
@@ -4434,34 +3736,30 @@ Note: Please add new entries to the beginning of this file.
<topic>razor-agents -- denial of service vulnerability</topic>
<affects>
<package>
- <name>razor-agents</name>
- <range><le>2.71</le></range>
+ <name>razor-agents</name> <range><le>2.71</le></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>A Secunia security advisory reports:</p>
- <blockquote cite="http://secunia.com/advisories/15739/">
+ <p>A Secunia security advisory reports:</p> <blockquote
+ cite="http://secunia.com/advisories/15739/">
<p>Two vulnerabilities have been reported in Razor-agents,
- which can be exploited by malicious people to cause a DoS
- (Denial of Service).</p>
+ which can be exploited by malicious people to cause a
+ DoS (Denial of Service).</p>
<ol>
<li>An unspecified error in the preprocessing of certain
HTML messages can be exploited to crash the
application.</li>
- <li>A bug in the discovery logic causes Razor-agents to go
+ <li>A bug in the discovery logic causes Razor-agents
+ to go
into an infinite loop and consume a large amount of
memory when discovery fails.</li>
</ol>
</blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<url>http://secunia.com/advisories/15739/</url>
- </references>
- <dates>
- <discovery>2005-06-17</discovery>
- <entry>2005-06-20</entry>
+ </references> <dates>
+ <discovery>2005-06-17</discovery> <entry>2005-06-20</entry>
</dates>
</vuln>
@@ -4472,63 +3770,57 @@ Note: Please add new entries to the beginning of this file.
<name>p5-Mail-SpamAssassin</name>
<range><ge>3.0.1</ge><lt>3.0.4</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>Apache SpamAssassin Security Team reports:</p>
- <blockquote cite="http://mail-archives.apache.org/mod_mbox/spamassassin-announce/200506.mbox/%3c17072.35054.586017.822288@proton.pathname.com%3e">
+ <p>Apache SpamAssassin Security Team reports:</p> <blockquote
+ cite="http://mail-archives.apache.org/mod_mbox/spamassassin-announce/200506.mbox/%3c17072.35054.586017.822288@proton.pathname.com%3e">
<p>Apache SpamAssassin 3.0.4 was recently released, and
- fixes a denial of service vulnerability in versions 3.0.1, 3.0.2,
- and 3.0.3. The vulnerability allows certain misformatted
- long message headers to cause spam checking to
- take a very long time.</p>
+ fixes a denial of service vulnerability in versions
+ 3.0.1, 3.0.2, and 3.0.3. The vulnerability allows
+ certain misformatted long message headers to cause spam
+ checking to take a very long time.</p>
<p>While the exploit has yet to be seen in the wild,
we are concerned that there may be attempts to abuse
the vulnerability in the future. Therefore, we strongly
- recommend all users of these versions upgrade to
- Apache SpamAssassin 3.0.4 as soon as possible.</p>
+ recommend all users of these versions upgrade to Apache
+ SpamAssassin 3.0.4 as soon as possible.</p>
</blockquote>
</body>
- </description>
- <references>
- <cvename>CVE-2005-1266</cvename>
- <mlist msgid="c17072.35054.586017.822288@proton.pathname.com">http://mail-archives.apache.org/mod_mbox/spamassassin-announce/200506.mbox/%3c17072.35054.586017.822288@proton.pathname.com%3e</mlist>
- </references>
- <dates>
- <discovery>2005-06-15</discovery>
- <entry>2005-06-18</entry>
+ </description> <references>
+ <cvename>CVE-2005-1266</cvename> <mlist
+ msgid="c17072.35054.586017.822288@proton.pathname.com">http://mail-archives.apache.org/mod_mbox/spamassassin-announce/200506.mbox/%3c17072.35054.586017.822288@proton.pathname.com%3e</mlist>
+ </references> <dates>
+ <discovery>2005-06-15</discovery> <entry>2005-06-18</entry>
</dates>
</vuln>
<vuln vid="e879ca68-e01b-11d9-a8bd-000cf18bbe54">
- <topic>squirrelmail -- Several cross site scripting vulnerabilities</topic>
- <affects>
+ <topic>squirrelmail -- Several cross site scripting
+ vulnerabilities</topic> <affects>
<package>
- <name>squirrelmail</name>
- <name>ja-squirrelmail</name>
+ <name>squirrelmail</name> <name>ja-squirrelmail</name>
<range><ge>1.4.0</ge><le>1.4.4</le></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>A SquirrelMail Security Advisory reports:</p>
- <blockquote cite="http://www.squirrelmail.org/security/issue/2005-06-15">
- <p>Several cross site scripting (XSS) vulnerabilities have been discovered
+ <p>A SquirrelMail Security Advisory reports:</p> <blockquote
+ cite="http://www.squirrelmail.org/security/issue/2005-06-15">
+ <p>Several cross site scripting (XSS) vulnerabilities
+ have been discovered
in SquirrelMail versions 1.4.0 - 1.4.4.</p>
- <p>The vulnerabilities are in two categories: the majority can be
- exploited through URL manipulation, and some by sending a specially
- crafted email to a victim. When done very carefully,
- this can cause the session of the user to be hijacked.</p>
+ <p>The vulnerabilities are in two categories: the majority
+ can be
+ exploited through URL manipulation, and some by sending
+ a specially crafted email to a victim. When done very
+ carefully, this can cause the session of the user to
+ be hijacked.</p>
</blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2005-1769</cvename>
<url>http://www.squirrelmail.org/security/issue/2005-06-15</url>
- </references>
- <dates>
- <discovery>2005-06-15</discovery>
- <entry>2005-06-18</entry>
+ </references> <dates>
+ <discovery>2005-06-15</discovery> <entry>2005-06-18</entry>
</dates>
</vuln>
@@ -4536,28 +3828,24 @@ Note: Please add new entries to the beginning of this file.
<topic>acroread -- XML External Entity vulnerability</topic>
<affects>
<package>
- <name>acroread7</name>
- <name>ja-acroread</name>
+ <name>acroread7</name> <name>ja-acroread</name>
<range><ge>7.0.0</ge><lt>7.0.1</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>Sverre H. Huseby discovered a vulnerability in Adobe Acrobat
- and Adobe Reader.
- Under certain circumstances, using XML scripts it is possible
- to discover the existence of local files.</p>
+ <p>Sverre H. Huseby discovered a vulnerability in Adobe
+ Acrobat
+ and Adobe Reader. Under certain circumstances, using XML
+ scripts it is possible to discover the existence of local
+ files.</p>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2005-1306</cvename>
<url>http://shh.thathost.com/secadv/adobexxe/</url>
<url>http://www.adobe.com/support/techdocs/331710.html</url>
<url>http://support.adobe.co.jp/faq/faq/qadoc.sv?226360+002+3</url>
- </references>
- <dates>
- <discovery>2005-06-15</discovery>
- <entry>2005-06-18</entry>
+ </references> <dates>
+ <discovery>2005-06-15</discovery> <entry>2005-06-18</entry>
<modified>2005-08-28</modified>
</dates>
</vuln>
@@ -4567,54 +3855,49 @@ Note: Please add new entries to the beginning of this file.
vulnerabilities</topic>
<affects>
<system>
- <name>FreeBSD</name>
- <range><ge>5.4</ge><lt>5.4_2</lt></range>
+ <name>FreeBSD</name> <range><ge>5.4</ge><lt>5.4_2</lt></range>
<range><ge>5.0</ge><lt>5.3_16</lt></range>
<range><ge>4.11</ge><lt>4.11_10</lt></range>
<range><ge>4.10</ge><lt>4.10_15</lt></range>
<range><ge>4.9</ge><lt>4.9_18</lt></range>
<range><lt>4.8_33</lt></range>
- </system>
- <package>
- <name>gzip</name>
- <range><lt>1.3.5_2</lt></range>
- </package>
- </affects>
- <description>
- <body xmlns="http://www.w3.org/1999/xhtml">
- <h1>Problem Description</h1>
- <p>Two problems related to extraction of files exist in gzip:</p>
- <p>The first problem is that gzip does not properly sanitize
- filenames containing "/" when uncompressing files using the
- -N command line option.</p>
- <p>The second problem is that gzip does not set permissions on
+ </system> <package>
+ <name>gzip</name> <range><lt>1.3.5_2</lt></range>
+ </package>
+ </affects> <description>
+ <body xmlns="http://www.w3.org/1999/xhtml">
+ <h1>Problem Description</h1> <p>Two problems related to
+ extraction of files exist in gzip:</p> <p>The first problem
+ is that gzip does not properly sanitize
+ filenames containing "/" when uncompressing files using
+ the -N command line option.</p>
+ <p>The second problem is that gzip does not set permissions
+ on
newly extracted files until after the file has been created
and the file descriptor has been closed.</p>
- <h1>Impact</h1>
- <p>The first problem can allow an attacker to overwrite
- arbitrary local files when uncompressing a file using the -N
- command line option.</p>
- <p>The second problem can allow a local attacker to change the
+ <h1>Impact</h1> <p>The first problem can allow an attacker
+ to overwrite
+ arbitrary local files when uncompressing a file using the
+ -N command line option.</p>
+ <p>The second problem can allow a local attacker to change
+ the
permissions of arbitrary local files, on the same partition
as the one the user is uncompressing a file on, by removing
- the file the user is uncompressing and replacing it with a
- hardlink before the uncompress operation is finished.</p>
- <h1>Workaround</h1>
- <p>Do not use the -N command line option on untrusted files
+ the file the user is uncompressing and replacing it with
+ a hardlink before the uncompress operation is finished.</p>
+ <h1>Workaround</h1> <p>Do not use the -N command line option
+ on untrusted files
and do not uncompress files in directories where untrusted
users have write access.</p>
</body>
- </description>
- <references>
- <cvename>CVE-2005-0988</cvename>
- <cvename>CVE-2005-1228</cvename>
- <freebsdsa>SA-05:11.gzip</freebsdsa>
- <mlist msgid="7389fc4b05040412574f819112@mail.gmail.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=111271860708210</mlist>
- <mlist msgid="7389fc4b0504201224759f31b@mail.gmail.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=111402732406477</mlist>
- </references>
- <dates>
- <discovery>2005-04-20</discovery>
- <entry>2005-06-18</entry>
+ </description> <references>
+ <cvename>CVE-2005-0988</cvename> <cvename>CVE-2005-1228</cvename>
+ <freebsdsa>SA-05:11.gzip</freebsdsa> <mlist
+ msgid="7389fc4b05040412574f819112@mail.gmail.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=111271860708210</mlist>
+ <mlist
+ msgid="7389fc4b0504201224759f31b@mail.gmail.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=111402732406477</mlist>
+ </references> <dates>
+ <discovery>2005-04-20</discovery> <entry>2005-06-18</entry>
<modified>2005-07-06</modified>
</dates>
</vuln>
@@ -4623,104 +3906,80 @@ Note: Please add new entries to the beginning of this file.
<topic>tcpdump -- infinite loops in protocol decoding</topic>
<affects>
<system>
- <name>FreeBSD</name>
- <range><ge>5.4</ge><lt>5.4_2</lt></range>
- <range><ge>5.3</ge><lt>5.3_16</lt></range>
- </system>
- <package>
- <name>tcpdump</name>
- <range><lt>3.8.3_2</lt></range>
- </package>
- </affects>
- <description>
- <body xmlns="http://www.w3.org/1999/xhtml">
- <h1>Problem Description</h1>
- <p>Several tcpdump protocol decoders contain programming
- errors which can cause them to go into infinite loops.</p>
- <h1>Impact</h1>
- <p>An attacker can inject specially crafted packets into the
- network which, when processed by tcpdump, could lead to a
- denial-of-service. After the attack, tcpdump would no
- longer capture traffic, and would potentially use all
- available processor time.</p>
- </body>
- </description>
- <references>
- <cvename>CVE-2005-1267</cvename>
- <cvename>CVE-2005-1278</cvename>
- <cvename>CVE-2005-1279</cvename>
- <cvename>CVE-2005-1280</cvename>
- <freebsdsa>SA-05:10.tcpdump</freebsdsa>
- <mlist msgid="20050426100140.1945.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=111454406222040</mlist>
- <mlist msgid="20050426100057.1748.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=111454461300644</mlist>
- <mlist msgid="20050619091553.GB982@zaphod.nitro.dk">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=111928309502304</mlist>
- </references>
- <dates>
- <discovery>2005-06-09</discovery>
- <entry>2005-06-18</entry>
+ <name>FreeBSD</name> <range><ge>5.4</ge><lt>5.4_2</lt></range>
+ <range><ge>5.3</ge><lt>5.3_16</lt></range>
+ </system> <package>
+ <name>tcpdump</name> <range><lt>3.8.3_2</lt></range>
+ </package>
+ </affects> <description>
+ <body xmlns="http://www.w3.org/1999/xhtml">
+ <h1>Problem Description</h1> <p>Several tcpdump protocol
+ decoders contain programming
+ errors which can cause them to go into infinite loops.</p>
+ <h1>Impact</h1> <p>An attacker can inject specially crafted
+ packets into the
+ network which, when processed by tcpdump, could lead to
+ a denial-of-service. After the attack, tcpdump would no
+ longer capture traffic, and would potentially use all
+ available processor time.</p>
+ </body>
+ </description> <references>
+ <cvename>CVE-2005-1267</cvename> <cvename>CVE-2005-1278</cvename>
+ <cvename>CVE-2005-1279</cvename> <cvename>CVE-2005-1280</cvename>
+ <freebsdsa>SA-05:10.tcpdump</freebsdsa> <mlist
+ msgid="20050426100140.1945.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=111454406222040</mlist>
+ <mlist
+ msgid="20050426100057.1748.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=111454461300644</mlist>
+ <mlist
+ msgid="20050619091553.GB982@zaphod.nitro.dk">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=111928309502304</mlist>
+ </references> <dates>
+ <discovery>2005-06-09</discovery> <entry>2005-06-18</entry>
<modified>2005-06-20</modified>
</dates>
</vuln>
<vuln vid="2701611f-df5c-11d9-b875-0001020eed82">
- <topic>gaim -- Yahoo! remote crash vulnerability</topic>
- <affects>
+ <topic>gaim -- Yahoo! remote crash vulnerability</topic> <affects>
<package>
- <name>gaim</name>
- <name>ja-gaim</name>
- <name>ko-gaim</name>
- <name>ru-gaim</name>
- <range><lt>1.3.1</lt></range>
+ <name>gaim</name> <name>ja-gaim</name> <name>ko-gaim</name>
+ <name>ru-gaim</name> <range><lt>1.3.1</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>Jacopo Ottaviani reports that Gaim can be crashed by being
- offered files with names containing non-ASCII
- characters via the Yahoo! protocol.</p>
+ <p>Jacopo Ottaviani reports that Gaim can be crashed by
+ being
+ offered files with names containing non-ASCII characters
+ via the Yahoo! protocol.</p>
</body>
- </description>
- <references>
- <bid>13931</bid>
- <cvename>CVE-2005-1269</cvename>
+ </description> <references>
+ <bid>13931</bid> <cvename>CVE-2005-1269</cvename>
<url>http://gaim.sourceforge.net/security/index.php?id=18</url>
- </references>
- <dates>
- <discovery>2005-06-10</discovery>
- <entry>2005-06-17</entry>
+ </references> <dates>
+ <discovery>2005-06-10</discovery> <entry>2005-06-17</entry>
</dates>
</vuln>
<vuln vid="b6612eee-df5f-11d9-b875-0001020eed82">
- <topic>gaim -- MSN Remote DoS vulnerability</topic>
- <affects>
+ <topic>gaim -- MSN Remote DoS vulnerability</topic> <affects>
<package>
- <name>gaim</name>
- <name>ja-gaim</name>
- <name>ko-gaim</name>
- <name>ru-gaim</name>
- <range><lt>1.3.1</lt></range>
+ <name>gaim</name> <name>ja-gaim</name> <name>ko-gaim</name>
+ <name>ru-gaim</name> <range><lt>1.3.1</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>The GAIM team reports:</p>
- <blockquote cite="http://gaim.sourceforge.net/security/index.php?id=19">
+ <p>The GAIM team reports:</p> <blockquote
+ cite="http://gaim.sourceforge.net/security/index.php?id=19">
<p>Remote attackers can cause a denial of service (crash)
via a malformed MSN message that leads to a memory
allocation of a large size, possibly due to an integer
signedness error.</p>
</blockquote>
</body>
- </description>
- <references>
- <bid>13932</bid>
- <cvename>CVE-2005-1934</cvename>
+ </description> <references>
+ <bid>13932</bid> <cvename>CVE-2005-1934</cvename>
<url>http://gaim.sourceforge.net/security/index.php?id=19</url>
- </references>
- <dates>
- <discovery>2005-06-10</discovery>
- <entry>2005-06-17</entry>
+ </references> <dates>
+ <discovery>2005-06-10</discovery> <entry>2005-06-17</entry>
</dates>
</vuln>
@@ -4728,54 +3987,40 @@ Note: Please add new entries to the beginning of this file.
<topic>gallery -- remote code injection via HTTP_POST_VARS</topic>
<affects>
<package>
- <name>gallery</name>
- <range><lt>1.4.1.1</lt></range>
+ <name>gallery</name> <range><lt>1.4.1.1</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A web server running Gallery can be exploited for arbitrary
PHP code execution through the use of a maliciously crafted
URL.</p>
</body>
- </description>
- <references>
- <cvename>CVE-2004-2124</cvename>
- <mlist msgid="0c0a01c3e525$1c0ed2b0$c90c030a@bmedirattatg">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=107524414317693</mlist>
- </references>
- <dates>
- <discovery>2004-01-27</discovery>
- <entry>2005-06-17</entry>
+ </description> <references>
+ <cvename>CVE-2004-2124</cvename> <mlist
+ msgid="0c0a01c3e525$1c0ed2b0$c90c030a@bmedirattatg">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=107524414317693</mlist>
+ </references> <dates>
+ <discovery>2004-01-27</discovery> <entry>2005-06-17</entry>
</dates>
</vuln>
<vuln vid="5752a0df-60c5-4876-a872-f12f9a02fa05">
- <topic>gallery -- cross-site scripting</topic>
- <affects>
+ <topic>gallery -- cross-site scripting</topic> <affects>
<package>
- <name>gallery</name>
- <range><lt>1.4.4.5</lt></range>
+ <name>gallery</name> <range><lt>1.4.4.5</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gallery includes several cross-site scripting vulnerabilities
that could allow malicious content to be injected.</p>
</body>
- </description>
- <references>
- <cvename>CVE-2004-1106</cvename>
- <cvename>CVE-2005-0219</cvename>
- <cvename>CVE-2005-0220</cvename>
- <cvename>CVE-2005-0221</cvename>
- <cvename>CVE-2005-0222</cvename>
- <bid>11602</bid>
+ </description> <references>
+ <cvename>CVE-2004-1106</cvename> <cvename>CVE-2005-0219</cvename>
+ <cvename>CVE-2005-0220</cvename> <cvename>CVE-2005-0221</cvename>
+ <cvename>CVE-2005-0222</cvename> <bid>11602</bid>
<url>http://gallery.menalto.com/modules.php?op=modload&amp;name=News&amp;file=article&amp;sid=147</url>
<url>http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110608459222364</url>
- </references>
- <dates>
- <discovery>2005-01-26</discovery>
- <entry>2005-06-17</entry>
+ </references> <dates>
+ <discovery>2005-01-26</discovery> <entry>2005-06-17</entry>
</dates>
</vuln>
@@ -4783,39 +4028,33 @@ Note: Please add new entries to the beginning of this file.
<topic>kstars -- exploitable set-user-ID application fliccd</topic>
<affects>
<package>
- <name>kdeedu</name>
- <range><lt>3.3.2_1</lt></range>
+ <name>kdeedu</name> <range><lt>3.3.2_1</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>A KDE Security Advisory explains:</p>
- <blockquote cite="http://www.kde.org/info/security/advisory-20050215-1.txt">
- <h1>Overview</h1>
- <p>KStars includes support for the Instrument Neutral
- Distributed Interface (INDI). The build system of this
- extra 3rd party software contained an installation hook to
- install fliccd (part of INDI) as SUID root
- application.</p>
- <p>Erik Sjölund discovered that the code contains several
- vulnerabilities that allow stack based buffer
- overflows.</p>
- <h1>Impact</h1>
- <p>If the fliccd binary is installed as suid root, it
- enables root privilege escalation for local users, or, if
- the daemon is actually running (which it does not by
- default) and is running as root, remote root privilege
- escalation.</p>
+ <p>A KDE Security Advisory explains:</p> <blockquote
+ cite="http://www.kde.org/info/security/advisory-20050215-1.txt">
+ <h1>Overview</h1> <p>KStars includes support for the
+ Instrument Neutral
+ Distributed Interface (INDI). The build system of this
+ extra 3rd party software contained an installation hook
+ to install fliccd (part of INDI) as SUID root
+ application.</p>
+ <p>Erik Sjölund discovered that the code contains several
+ vulnerabilities that allow stack based buffer overflows.</p>
+ <h1>Impact</h1> <p>If the fliccd binary is installed as
+ suid root, it
+ enables root privilege escalation for local users, or,
+ if the daemon is actually running (which it does not
+ by default) and is running as root, remote root privilege
+ escalation.</p>
</blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2005-0011</cvename>
<url>http://www.kde.org/info/security/advisory-20050215-1.txt</url>
- </references>
- <dates>
- <discovery>2005-01-05</discovery>
- <entry>2005-06-17</entry>
+ </references> <dates>
+ <discovery>2005-01-05</discovery> <entry>2005-06-17</entry>
</dates>
</vuln>
@@ -4823,57 +4062,41 @@ Note: Please add new entries to the beginning of this file.
<topic>fd_set -- bitmap index overflow in multiple applications</topic>
<affects>
<package>
- <name>gatekeeper</name>
- <range><lt>2.2.1</lt></range>
- </package>
- <package>
- <name>citadel</name>
- <range><lt>6.29</lt></range>
- </package>
- <package>
- <name>3proxy</name>
- <range><lt>0.5.b</lt></range>
- </package>
- <package>
- <name>jabber</name>
- <name>bnc</name>
- <range><ge>0</ge></range>
- </package>
- <package>
- <name>rinetd</name>
- <range><lt>0.62_1</lt></range>
- </package>
- <package>
- <name>dante</name>
- <range><lt>1.1.15</lt></range>
- </package>
- <package>
- <name>bld</name>
- <range><lt>0.3.3</lt></range>
- </package>
- </affects>
- <description>
- <body xmlns="http://www.w3.org/1999/xhtml">
- <p>3APA3A reports:</p>
- <blockquote cite="http://www.security.nnov.ru/advisories/sockets.asp">
+ <name>gatekeeper</name> <range><lt>2.2.1</lt></range>
+ </package> <package>
+ <name>citadel</name> <range><lt>6.29</lt></range>
+ </package> <package>
+ <name>3proxy</name> <range><lt>0.5.b</lt></range>
+ </package> <package>
+ <name>jabber</name> <name>bnc</name> <range><ge>0</ge></range>
+ </package> <package>
+ <name>rinetd</name> <range><lt>0.62_1</lt></range>
+ </package> <package>
+ <name>dante</name> <range><lt>1.1.15</lt></range>
+ </package> <package>
+ <name>bld</name> <range><lt>0.3.3</lt></range>
+ </package>
+ </affects> <description>
+ <body xmlns="http://www.w3.org/1999/xhtml">
+ <p>3APA3A reports:</p> <blockquote
+ cite="http://www.security.nnov.ru/advisories/sockets.asp">
<p>If programmer fails to check socket number before using
select() or fd_set macros, it's possible to overwrite
memory behind fd_set structure. Very few select() based
- application actually check FD_SETSIZE value. <em>[...]</em></p>
+ application actually check FD_SETSIZE value.
+ <em>[...]</em></p>
<p>Depending on vulnerable application it's possible to
overwrite portions of memory. Impact is close to
off-by-one overflows, code execution doesn't seems
exploitable.</p>
</blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<url>http://www.security.nnov.ru/advisories/sockets.asp</url>
- <mlist msgid="1473827718.20050124233008@security.nnov.ru">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110660879328901</mlist>
- </references>
- <dates>
- <discovery>2004-12-12</discovery>
- <entry>2005-06-17</entry>
+ <mlist
+ msgid="1473827718.20050124233008@security.nnov.ru">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110660879328901</mlist>
+ </references> <dates>
+ <discovery>2004-12-12</discovery> <entry>2005-06-17</entry>
<modified>2005-10-04</modified>
</dates>
</vuln>
@@ -4882,32 +4105,30 @@ Note: Please add new entries to the beginning of this file.
<topic>leafnode -- denial of service vulnerability</topic>
<affects>
<package>
- <name>leafnode</name>
- <range><lt>1.11.3</lt></range>
+ <name>leafnode</name> <range><lt>1.11.3</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>Matthias Andree reports:</p>
- <blockquote cite="http://leafnode.sourceforge.net/leafnode-SA-2005-02.txt">
- <p>A vulnerability was found in the fetchnews program (the NNTP
- client) that may under some circumstances cause a wait for input
- that never arrives, fetchnews "hangs". [...]</p>
- <p>As only one fetchnews program can run at a time, subsequently
- started fetchnews and texpire programs will terminate. [...]</p>
+ <p>Matthias Andree reports:</p> <blockquote
+ cite="http://leafnode.sourceforge.net/leafnode-SA-2005-02.txt">
+ <p>A vulnerability was found in the fetchnews program
+ (the NNTP
+ client) that may under some circumstances cause a wait
+ for input that never arrives, fetchnews "hangs". [...]</p>
+ <p>As only one fetchnews program can run at a time,
+ subsequently
+ started fetchnews and texpire programs will terminate.
+ [...]</p>
<p>Upgrade your leafnode package to version 1.11.3.</p>
</blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2005-1911</cvename>
<url>http://leafnode.sourceforge.net/leafnode-SA-2005-02.txt</url>
- <freebsdpr>ports/82056</freebsdpr>
- <mlist msgid="20050608215155.GB27234@merlin.emma.line.org">http://marc.theaimsgroup.com/?l=vulnwatch&amp;m=111827180929063</mlist>
- </references>
- <dates>
- <discovery>2005-06-08</discovery>
- <entry>2005-06-09</entry>
+ <freebsdpr>ports/82056</freebsdpr> <mlist
+ msgid="20050608215155.GB27234@merlin.emma.line.org">http://marc.theaimsgroup.com/?l=vulnwatch&amp;m=111827180929063</mlist>
+ </references> <dates>
+ <discovery>2005-06-08</discovery> <entry>2005-06-09</entry>
</dates>
</vuln>
@@ -4915,56 +4136,46 @@ Note: Please add new entries to the beginning of this file.
<topic>gforge -- directory traversal vulnerability</topic>
<affects>
<package>
- <name>gforge</name>
- <range><lt>4.0</lt></range>
+ <name>gforge</name> <range><lt>4.0</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>An STG Security Advisory reports:</p>
- <blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110627132209963">
+ <blockquote
+ cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110627132209963">
<p>GForge CVS module made by Dragos Moinescu and another
module made by Ronald Petty have a directory traversal
vulnerability. [...] malicious attackers can read
arbitrary directory lists.</p>
</blockquote>
</body>
- </description>
- <references>
- <cvename>CVE-2005-0299</cvename>
- <bid>12318</bid>
- <mlist msgid="20050120051735.2832.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110627132209963</mlist>
- </references>
- <dates>
- <discovery>2005-01-20</discovery>
- <entry>2005-06-03</entry>
+ </description> <references>
+ <cvename>CVE-2005-0299</cvename> <bid>12318</bid> <mlist
+ msgid="20050120051735.2832.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110627132209963</mlist>
+ </references> <dates>
+ <discovery>2005-01-20</discovery> <entry>2005-06-03</entry>
</dates>
</vuln>
<vuln vid="d1bbc235-c0c9-45cd-8d2d-c1b8fd22e616">
- <topic>imap-uw -- authentication bypass when CRAM-MD5 is enabled</topic>
- <affects>
+ <topic>imap-uw -- authentication bypass when CRAM-MD5 is
+ enabled</topic> <affects>
<package>
- <name>imap-uw</name>
- <range><lt>2004b,1</lt></range>
+ <name>imap-uw</name> <range><lt>2004b,1</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>The CRAM-MD5 authentication support of the University of
- Washington IMAP and POP3 servers contains a vulnerability that
- may allow an attacker to bypass authentication and impersonate
- arbitrary users. Only installations with CRAM-MD5 support
- configured are affected.</p>
+ <p>The CRAM-MD5 authentication support of the University
+ of
+ Washington IMAP and POP3 servers contains a vulnerability
+ that may allow an attacker to bypass authentication and
+ impersonate arbitrary users. Only installations with
+ CRAM-MD5 support configured are affected.</p>
</body>
- </description>
- <references>
- <cvename>CVE-2005-0198</cvename>
- <certvu>702777</certvu>
- </references>
- <dates>
- <discovery>2005-01-04</discovery>
- <entry>2005-06-03</entry>
+ </description> <references>
+ <cvename>CVE-2005-0198</cvename> <certvu>702777</certvu>
+ </references> <dates>
+ <discovery>2005-01-04</discovery> <entry>2005-06-03</entry>
</dates>
</vuln>
@@ -4972,55 +4183,45 @@ Note: Please add new entries to the beginning of this file.
<topic>squid -- denial-of-service vulnerabilities</topic>
<affects>
<package>
- <name>squid</name>
- <range><lt>2.5.9</lt></range>
+ <name>squid</name> <range><lt>2.5.9</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Squid team reported several denial-of-service
- vulnerabilities related to the handling of DNS responses and
- NT Lan Manager messages. These may allow an attacker to crash
- the Squid cache.</p>
+ vulnerabilities related to the handling of DNS responses
+ and NT Lan Manager messages. These may allow an attacker
+ to crash the Squid cache.</p>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2005-0446</cvename>
<url>http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE8-dns_assert</url>
- <cvename>CVE-2005-0096</cvename>
- <cvename>CVE-2005-0097</cvename>
+ <cvename>CVE-2005-0096</cvename> <cvename>CVE-2005-0097</cvename>
<url>http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-fakeauth_auth</url>
- </references>
- <dates>
- <discovery>2005-01-16</discovery>
- <entry>2005-06-03</entry>
+ </references> <dates>
+ <discovery>2005-01-16</discovery> <entry>2005-06-03</entry>
</dates>
</vuln>
<vuln vid="3b260179-e464-460d-bf9f-d5cda6204020">
- <topic>racoon -- remote denial-of-service</topic>
- <affects>
+ <topic>racoon -- remote denial-of-service</topic> <affects>
<package>
- <name>racoon</name>
- <range><lt>20050510a</lt></range>
+ <name>racoon</name> <range><lt>20050510a</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>Sebastian Krahmer discovered that the racoon ISAKMP daemon
- could be crashed with a maliciously crafted UDP packet. No
- authentication is required in order to perform the attack.</p>
+ <p>Sebastian Krahmer discovered that the racoon ISAKMP
+ daemon
+ could be crashed with a maliciously crafted UDP packet.
+ No authentication is required in order to perform the
+ attack.</p>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2005-0398</cvename>
<mlist>http://sourceforge.net/mailarchive/forum.php?thread_id=6787713&amp;forum_id=32000</mlist>
<url>http://xforce.iss.net/xforce/xfdb/19707</url>
<url>https://bugzilla.redhat.com/bugzilla/attachment.cgi?id=109966&amp;action=view</url>
- </references>
- <dates>
- <discovery>2005-03-12</discovery>
- <entry>2005-06-03</entry>
+ </references> <dates>
+ <discovery>2005-03-12</discovery> <entry>2005-06-03</entry>
</dates>
</vuln>
@@ -5028,25 +4229,22 @@ Note: Please add new entries to the beginning of this file.
<topic>xli -- integer overflows in image size calculations</topic>
<affects>
<package>
- <name>xli</name>
- <range><le>1.17.0_1</le></range>
+ <name>xli</name> <range><le>1.17.0_1</le></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>Tavis Ormandy discovered several integer overflows in xli's
- image size handling. A maliciously crafted image may be able
- to cause a heap buffer overflow and execute arbitrary code.</p>
+ <p>Tavis Ormandy discovered several integer overflows in
+ xli's
+ image size handling. A maliciously crafted image may be
+ able to cause a heap buffer overflow and execute arbitrary
+ code.</p>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2005-0639</cvename>
<url>http://bugs.gentoo.org/show_bug.cgi?id=79762</url>
<url>http://pantransit.reptiles.org/prog/xli/CHANGES</url>
- </references>
- <dates>
- <discovery>2005-02-08</discovery>
- <entry>2005-06-03</entry>
+ </references> <dates>
+ <discovery>2005-02-08</discovery> <entry>2005-06-03</entry>
</dates>
</vuln>
@@ -5055,33 +4253,27 @@ Note: Please add new entries to the beginning of this file.
compressed files</topic>
<affects>
<package>
- <name>xli</name>
- <range><le>1.17.0_1</le></range>
+ <name>xli</name> <range><le>1.17.0_1</le></range>
+ </package> <package>
+ <name>xloadimage</name> <range><le>4.1.10</le></range>
</package>
- <package>
- <name>xloadimage</name>
- <range><le>4.1.10</le></range>
- </package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>Tavis Ormandy discovered that xli and xloadimage attempt to
+ <p>Tavis Ormandy discovered that xli and xloadimage attempt
+ to
decompress images by piping them through <code>gunzip</code>
or similar decompression tools. Unfortunately, the
unsanitized file name is included as part of the command.
This is dangerous, as in some situations, such as mailcap
- processing, an attacker may control the input file name. As a
- result, an attacker may be able to cause arbitrary command
- execution.</p>
+ processing, an attacker may control the input file name.
+ As a result, an attacker may be able to cause arbitrary
+ command execution.</p>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2005-0638</cvename>
<url>http://bugs.gentoo.org/show_bug.cgi?id=79762</url>
- </references>
- <dates>
- <discovery>2005-02-18</discovery>
- <entry>2005-06-03</entry>
+ </references> <dates>
+ <discovery>2005-02-18</discovery> <entry>2005-06-03</entry>
</dates>
</vuln>
@@ -5089,33 +4281,26 @@ Note: Please add new entries to the beginning of this file.
<topic>xloadimage -- buffer overflow in FACES image handling</topic>
<affects>
<package>
- <name>xli</name>
- <range><le>1.17.0_1</le></range>
- </package>
- <package>
- <name>xloadimage</name>
- <range><lt>4.1.9</lt></range>
+ <name>xli</name> <range><le>1.17.0_1</le></range>
+ </package> <package>
+ <name>xloadimage</name> <range><lt>4.1.9</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>In 2001, zen-parse discovered a buffer overflow in
- xloadimage's FACES image loader. A maliciously crafted image
- could cause xloadimage to execute arbitrary code. A published
- exploit exists for this vulnerability.</p>
+ xloadimage's FACES image loader. A maliciously crafted
+ image could cause xloadimage to execute arbitrary code.
+ A published exploit exists for this vulnerability.</p>
<p>In 2005, Rob Holland discovered that the same vulnerability
was present in xli.</p>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2001-0775</cvename>
<mlist>http://marc.theaimsgroup.com/?l=bugtraq&amp;m=99477230306845</mlist>
<url>https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=46186</url>
<url>http://bugs.gentoo.org/show_bug.cgi?id=79762</url>
- </references>
- <dates>
- <discovery>2000-02-19</discovery>
- <entry>2005-06-03</entry>
+ </references> <dates>
+ <discovery>2000-02-19</discovery> <entry>2005-06-03</entry>
</dates>
</vuln>
@@ -5124,38 +4309,30 @@ Note: Please add new entries to the beginning of this file.
issues</topic>
<affects>
<package>
- <name>yamt</name>
- <range><lt>0.5_2</lt></range>
+ <name>yamt</name> <range><lt>0.5_2</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Stanislav Brabec discovered errors in yamt's path name
- handling that lead to buffer overflows and directory traversal
- issues. When processing a file with a maliciously crafted ID3
- tag, yamt might overwrite arbitrary files or possibly execute
- arbitrary code.</p>
- <p>The SuSE package ChangeLog contains:</p>
- <blockquote>
+ handling that lead to buffer overflows and directory
+ traversal issues. When processing a file with a maliciously
+ crafted ID3 tag, yamt might overwrite arbitrary files or
+ possibly execute arbitrary code.</p>
+ <p>The SuSE package ChangeLog contains:</p> <blockquote>
<ul>
- <li>Several security fixes (#49337):</li>
- <li>directory traversal in rename</li>
- <li>directory traversal in sort</li>
- <li>buffer overflow in sort</li>
- <li>buffer overflow in rename</li>
+ <li>Several security fixes (#49337):</li> <li>directory
+ traversal in rename</li> <li>directory traversal in
+ sort</li> <li>buffer overflow in sort</li> <li>buffer
+ overflow in rename</li>
</ul>
</blockquote>
</body>
- </description>
- <references>
- <cvename>CVE-2005-1846</cvename>
- <cvename>CVE-2005-1847</cvename>
+ </description> <references>
+ <cvename>CVE-2005-1846</cvename> <cvename>CVE-2005-1847</cvename>
<url>http://rpmfind.net/linux/RPM/suse/updates/8.2/i386/rpm/i586/yamt-0.5-1277.i586.html</url>
<url>ftp://ftp.suse.com/pub/suse/i386/update/8.2/rpm/src/yamt-0.5-1277.src.rpm</url>
- </references>
- <dates>
- <discovery>2005-01-20</discovery>
- <entry>2005-06-03</entry>
+ </references> <dates>
+ <discovery>2005-01-20</discovery> <entry>2005-06-03</entry>
</dates>
</vuln>
@@ -5163,57 +4340,50 @@ Note: Please add new entries to the beginning of this file.
<topic>xview -- multiple buffer overflows in xv_parse_one</topic>
<affects>
<package>
- <name>xview</name>
- <range><lt>3.2.1_3</lt></range>
+ <name>xview</name> <range><lt>3.2.1_3</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>A Debian Security Advisory reports:</p>
- <blockquote cite="http://www.debian.org/security/2005/dsa-672">
- <p>Erik Sjölund discovered that programs linked against xview
- are vulnerable to a number of buffer overflows in the XView
- library. When the overflow is triggered in a program which
- is installed setuid root a malicious user could perhaps
- execute arbitrary code as privileged user.</p>
+ <p>A Debian Security Advisory reports:</p> <blockquote
+ cite="http://www.debian.org/security/2005/dsa-672">
+ <p>Erik Sjölund discovered that programs linked against
+ xview
+ are vulnerable to a number of buffer overflows in the
+ XView library. When the overflow is triggered in a
+ program which is installed setuid root a malicious user
+ could perhaps execute arbitrary code as privileged
+ user.</p>
</blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2005-0076</cvename>
<url>http://www.debian.org/security/2005/dsa-672</url>
<url>http://xforce.iss.net/xforce/xfdb/19271</url>
- </references>
- <dates>
- <discovery>2005-02-09</discovery>
- <entry>2005-06-01</entry>
+ </references> <dates>
+ <discovery>2005-02-09</discovery> <entry>2005-06-01</entry>
</dates>
</vuln>
<vuln vid="f7e8d2ca-410e-40b2-8748-3abd021e44a9">
- <topic>xtrlock -- X display locking bypass</topic>
- <affects>
+ <topic>xtrlock -- X display locking bypass</topic> <affects>
<package>
- <name>xtrlock</name>
- <range><lt>2.0.10</lt></range>
+ <name>xtrlock</name> <range><lt>2.0.10</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>The X display locking program <code>xtrlock</code> contains
- an integer overflow bug. It is possible for an attacker with
- physical access to the system to bypass the display lock.</p>
+ <p>The X display locking program <code>xtrlock</code>
+ contains
+ an integer overflow bug. It is possible for an attacker
+ with physical access to the system to bypass the display
+ lock.</p>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2005-0079</cvename>
<url>http://www.debian.org/security/2005/dsa-649</url>
<url>http://xforce.iss.net/xforce/xfdb/18991</url>
<url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=278191</url>
- </references>
- <dates>
- <discovery>2004-10-25</discovery>
- <entry>2005-06-01</entry>
+ </references> <dates>
+ <discovery>2004-10-25</discovery> <entry>2005-06-01</entry>
</dates>
</vuln>
@@ -5221,122 +4391,104 @@ Note: Please add new entries to the beginning of this file.
<topic>linux_base -- vulnerabilities in Red Hat 7.1 libraries</topic>
<affects>
<package>
- <name>linux_base</name>
- <range><lt>7.3</lt></range>
+ <name>linux_base</name> <range><lt>7.3</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Trevor Johnson reported that the Red Hat Linux RPMs used
- by linux_base contained multiple older vulnerabilities, such
- as a DNS resolver issue and critical bugs in X font handling
- and XPM image handling.</p>
+ by linux_base contained multiple older vulnerabilities,
+ such as a DNS resolver issue and critical bugs in X font
+ handling and XPM image handling.</p>
</body>
- </description>
- <references>
+ </description> <references>
<url>http://fedoralegacy.org/updates/RH7.3/2004-10-23-FLSA_2004_1947__Updated_glibc_packages_fix_flaws.html</url>
<url>http://rhn.redhat.com/errata/RHSA-2004-059.html</url>
<url>http://rhn.redhat.com/errata/RHSA-2004-478.html</url>
<url>http://rhn.redhat.com/errata/RHSA-2004-612.html</url>
- <cvename>CVE-2002-0029</cvename>
- <cvename>CVE-2004-0083</cvename>
- <cvename>CVE-2004-0084</cvename>
- <cvename>CVE-2004-0106</cvename>
- <cvename>CVE-2004-0687</cvename>
- <cvename>CVE-2004-0688</cvename>
- <cvename>CVE-2004-0692</cvename>
- <cvename>CVE-2004-0914</cvename>
- </references>
- <dates>
- <discovery>2004-09-27</discovery>
- <entry>2005-06-01</entry>
+ <cvename>CVE-2002-0029</cvename> <cvename>CVE-2004-0083</cvename>
+ <cvename>CVE-2004-0084</cvename> <cvename>CVE-2004-0106</cvename>
+ <cvename>CVE-2004-0687</cvename> <cvename>CVE-2004-0688</cvename>
+ <cvename>CVE-2004-0692</cvename> <cvename>CVE-2004-0914</cvename>
+ </references> <dates>
+ <discovery>2004-09-27</discovery> <entry>2005-06-01</entry>
</dates>
</vuln>
<vuln vid="79630c0c-8dcc-45d0-9908-4087fe1d618c">
- <topic>squirrelmail -- XSS and remote code injection vulnerabilities</topic>
- <affects>
+ <topic>squirrelmail -- XSS and remote code injection
+ vulnerabilities</topic> <affects>
<package>
- <name>squirrelmail</name>
- <name>ja-squirrelmail</name>
+ <name>squirrelmail</name> <name>ja-squirrelmail</name>
<range><lt>1.4.4</lt></range>
</package>
- </affects>
- <description>
- <body xmlns="http://www.w3.org/1999/xhtml">
- <p>A SquirrelMail Security Advisory reports:</p>
- <blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110702772714662">
- <p>SquirrelMail 1.4.4 has been released to resolve a number of
- security issues disclosed below. It is strongly recommended
- that all running SquirrelMail prior to 1.4.4 upgrade to the
- latest release.</p>
- <h1>Remote File Inclusion</h1>
- <p>Manoel Zaninetti reported an issue in src/webmail.php which
+ </affects> <description>
+ <body xmlns="http://www.w3.org/1999/xhtml">
+ <p>A SquirrelMail Security Advisory reports:</p> <blockquote
+ cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110702772714662">
+ <p>SquirrelMail 1.4.4 has been released to resolve a
+ number of
+ security issues disclosed below. It is strongly
+ recommended that all running SquirrelMail prior to 1.4.4
+ upgrade to the latest release.</p>
+ <h1>Remote File Inclusion</h1> <p>Manoel Zaninetti reported
+ an issue in src/webmail.php which
would allow a crafted URL to include a remote web page.
- This was assigned CAN-2005-0103 by the Common
- Vulnerabilities and Exposures.</p>
- <h1>Cross Site Scripting Issues</h1>
- <p>A possible cross site scripting issue exists in
+ This was assigned CAN-2005-0103 by the Common Vulnerabilities
+ and Exposures.</p>
+ <h1>Cross Site Scripting Issues</h1> <p>A possible cross
+ site scripting issue exists in
src/webmail.php that is only accessible when the PHP
- installation is running with register_globals set to On.
- This issue was uncovered internally by the SquirrelMail
- Development team. This isssue was assigned CAN-2005-0104 by
- the Common Vulnerabilities and Exposures.</p>
- <p>A second issue which was resolved in the 1.4.4-rc1 release
+ installation is running with register_globals set to
+ On. This issue was uncovered internally by the
+ SquirrelMail Development team. This isssue was assigned
+ CAN-2005-0104 by the Common Vulnerabilities and
+ Exposures.</p>
+ <p>A second issue which was resolved in the 1.4.4-rc1
+ release
was uncovered and assigned CAN-2004-1036 by the Common
- Vulnerabilities and Exposures. This issue could allow a
- remote user to send a specially crafted header and cause
- execution of script (such as javascript) in the client
- browser.</p>
- <h1>Local File Inclusion</h1>
- <p>A possible local file inclusion issue was uncovered by one
+ Vulnerabilities and Exposures. This issue could allow
+ a remote user to send a specially crafted header and
+ cause execution of script (such as javascript) in the
+ client browser.</p>
+ <h1>Local File Inclusion</h1> <p>A possible local file
+ inclusion issue was uncovered by one
of our developers involving custom preference handlers.
- This issue is only active if the PHP installation is running
- with register_globals set to On.</p>
+ This issue is only active if the PHP installation is
+ running with register_globals set to On.</p>
</blockquote>
</body>
- </description>
- <references>
- <cvename>CVE-2004-1036</cvename>
- <cvename>CVE-2005-0075</cvename>
- <cvename>CVE-2005-0103</cvename>
- <cvename>CVE-2005-0104</cvename>
- <mlist msgid="47249.24.0.109.81.1106975343.squirrel@sm-14.netdork.net">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110702772714662</mlist>
+ </description> <references>
+ <cvename>CVE-2004-1036</cvename> <cvename>CVE-2005-0075</cvename>
+ <cvename>CVE-2005-0103</cvename> <cvename>CVE-2005-0104</cvename>
+ <mlist
+ msgid="47249.24.0.109.81.1106975343.squirrel@sm-14.netdork.net">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110702772714662</mlist>
<url>http://www.squirrelmail.org/security/issue/2005-01-14</url>
<url>http://www.squirrelmail.org/security/issue/2005-01-19</url>
<url>http://www.squirrelmail.org/security/issue/2005-01-20</url>
- </references>
- <dates>
- <discovery>2005-01-29</discovery>
- <entry>2005-06-01</entry>
+ </references> <dates>
+ <discovery>2005-01-29</discovery> <entry>2005-06-01</entry>
</dates>
</vuln>
<vuln vid="0d9ba03b-0dbb-42b4-ae0f-60e27af78e22">
- <topic>sympa -- buffer overflow in "queue"</topic>
- <affects>
+ <topic>sympa -- buffer overflow in "queue"</topic> <affects>
<package>
- <name>sympa</name>
- <range><lt>4.1.2_1</lt></range>
+ <name>sympa</name> <range><lt>4.1.2_1</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Erik Sjölund discovered a vulnerabilitiy in Sympa. The
- <code>queue</code> application processes messages received via
- aliases. It contains a buffer overflow in the usage of
- <code>sprintf</code>. In some configurations, it may allow an
- attacker to execute arbitrary code as the <code>sympa</code>
- user.</p>
+ <code>queue</code> application processes messages received
+ via aliases. It contains a buffer overflow in the usage
+ of <code>sprintf</code>. In some configurations, it may
+ allow an attacker to execute arbitrary code as the
+ <code>sympa</code> user.</p>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2005-0073</cvename>
<url>http://www.debian.org/security/2005/dsa-677</url>
- </references>
- <dates>
- <discovery>2005-02-11</discovery>
- <entry>2005-06-01</entry>
+ </references> <dates>
+ <discovery>2005-02-11</discovery> <entry>2005-06-01</entry>
</dates>
</vuln>
@@ -5344,69 +4496,59 @@ Note: Please add new entries to the beginning of this file.
<topic>mailman -- generated passwords are poor quality</topic>
<affects>
<package>
- <name>mailman</name>
- <name>ja-mailman</name>
+ <name>mailman</name> <name>ja-mailman</name>
<range><lt>2.1.6</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>Florian Weimer wrote:</p>
- <blockquote cite="http://mail.python.org/pipermail/mailman-developers/attachments/20041215/be238297/attachment.mht">
- <p>Mailman 2.1.5 uses weak auto-generated passwords for new
+ <p>Florian Weimer wrote:</p> <blockquote
+ cite="http://mail.python.org/pipermail/mailman-developers/attachments/20041215/be238297/attachment.mht">
+ <p>Mailman 2.1.5 uses weak auto-generated passwords for
+ new
subscribers. These passwords are assigned when members
- subscribe without specifying their own password (either by
- email or the web frontend). Knowledge of this password
- allows an attacker to gain access to the list archive even
- though she's not a member and the archive is restricted to
- members only. [...]</p>
+ subscribe without specifying their own password (either
+ by email or the web frontend). Knowledge of this
+ password allows an attacker to gain access to the list
+ archive even though she's not a member and the archive
+ is restricted to members only. [...]</p>
<p>This means that only about 5 million different passwords
- are ever generated, a number that is in the range of brute
- force attacks -- you only have to guess one subscriber
- address (which is usually not that hard).</p>
+ are ever generated, a number that is in the range of
+ brute force attacks -- you only have to guess one
+ subscriber address (which is usually not that hard).</p>
</blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2004-1143</cvename>
<mlist>http://mail.python.org/pipermail/mailman-developers/2004-December/017553.html</mlist>
- <mlist msgid="87llc0u6l8.fsf@deneb.enyo.de">http://mail.python.org/pipermail/mailman-developers/attachments/20041215/be238297/attachment.mht</mlist>
- </references>
- <dates>
- <discovery>2004-12-15</discovery>
- <entry>2005-06-01</entry>
+ <mlist
+ msgid="87llc0u6l8.fsf@deneb.enyo.de">http://mail.python.org/pipermail/mailman-developers/attachments/20041215/be238297/attachment.mht</mlist>
+ </references> <dates>
+ <discovery>2004-12-15</discovery> <entry>2005-06-01</entry>
</dates>
</vuln>
<vuln vid="ad9d2518-3471-4737-b60b-9a1f51023b28">
- <topic>mailman -- password disclosure</topic>
- <affects>
+ <topic>mailman -- password disclosure</topic> <affects>
<package>
- <name>mailman</name>
- <name>ja-mailman</name>
+ <name>mailman</name> <name>ja-mailman</name>
<range><lt>2.1.5</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>Barry Warsaw reports:</p>
- <blockquote
+ <p>Barry Warsaw reports:</p> <blockquote
cite="http://mail.python.org/pipermail/mailman-announce/2004-May/000072.html">
<p>Today I am releasing Mailman 2.1.5, a bug fix release
- [...] This version also contains a fix for an exploit that
- could allow 3rd parties to retrieve member passwords. It is
- thus highly recommended that all existing sites upgrade to
- the latest version.</p>
+ [...] This version also contains a fix for an exploit
+ that could allow 3rd parties to retrieve member passwords.
+ It is thus highly recommended that all existing sites
+ upgrade to the latest version.</p>
</blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2004-0412</cvename>
<mlist>http://mail.python.org/pipermail/mailman-announce/2004-May/000072.html</mlist>
- </references>
- <dates>
- <discovery>2004-05-15</discovery>
- <entry>2005-06-01</entry>
+ </references> <dates>
+ <discovery>2004-05-15</discovery> <entry>2005-06-01</entry>
</dates>
</vuln>
@@ -5417,151 +4559,119 @@ Note: Please add new entries to the beginning of this file.
<name>jakarta-tomcat</name>
<range><ge>5.*</ge><lt>5.5.7</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Oliver Karow discovered cross-site scripting issues in
- the Apache Jakarta Tomcat manager. The developers refer to
- the issues as <q>minor</q>.</p>
+ the Apache Jakarta Tomcat manager. The developers refer
+ to the issues as <q>minor</q>.</p>
</body>
- </description>
- <references>
+ </description> <references>
<url>http://www.oliverkarow.de/research/jakarta556_xss.txt</url>
<mlist>http://www.mail-archive.com/tomcat-dev@jakarta.apache.org/msg66978.html</mlist>
- </references>
- <dates>
- <discovery>2005-01-03</discovery>
- <entry>2005-06-01</entry>
+ </references> <dates>
+ <discovery>2005-01-03</discovery> <entry>2005-06-01</entry>
</dates>
</vuln>
<vuln vid="84479a62-ca5f-11d9-b772-000c29b00e99">
- <topic>fswiki -- XSS problem in file upload form</topic>
- <affects>
+ <topic>fswiki -- XSS problem in file upload form</topic> <affects>
<package>
- <name>fswiki</name>
- <range><le>3.5.6</le></range>
+ <name>fswiki</name> <range><le>3.5.6</le></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>A Secunia security advisory reports:</p>
- <blockquote cite="http://secunia.com/advisories/15538">
- <p>A vulnerability has been reported in FreeStyle Wiki and
- FSWikiLite, which can be exploited by malicious people to
- conduct script insertion attacks.</p>
+ <p>A Secunia security advisory reports:</p> <blockquote
+ cite="http://secunia.com/advisories/15538">
+ <p>A vulnerability has been reported in FreeStyle Wiki
+ and
+ FSWikiLite, which can be exploited by malicious people
+ to conduct script insertion attacks.</p>
<p>Input passed in uploaded attachments is not properly
- sanitised before being used. This can be exploited to inject
- arbitrary HTML and script code, which will be executed in a
- user's browser session in context of an affected site when
- the malicious attachment is viewed.</p>
+ sanitised before being used. This can be exploited to
+ inject arbitrary HTML and script code, which will be
+ executed in a user's browser session in context of an
+ affected site when the malicious attachment is viewed.</p>
</blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2005-1799</cvename>
<url>http://secunia.com/advisories/15538</url>
<freebsdpr>ports/81520</freebsdpr>
<url>http://fswiki.poi.jp/wiki.cgi?page=%CD%FA%CE%F2%2F2005%2D5%2D19</url>
<url>http://jvn.jp/jp/JVN%23465742E4/index.html</url>
- </references>
- <dates>
- <discovery>2005-05-19</discovery>
- <entry>2005-05-29</entry>
+ </references> <dates>
+ <discovery>2005-05-19</discovery> <entry>2005-05-29</entry>
<modified>2005-06-01</modified>
</dates>
- </vuln>
- <vuln vid="2fbe16c2-cab6-11d9-9aed-000e0c2e438a">
- <topic>freeradius -- sql injection and denial of service vulnerability</topic>
- <affects>
- <package>
- <name>freeradius</name>
- <range><le>1.0.2_1</le></range>
- </package>
+ </vuln> <vuln vid="2fbe16c2-cab6-11d9-9aed-000e0c2e438a">
+ <topic>freeradius -- sql injection and denial of service
+ vulnerability</topic> <affects>
<package>
- <name>freeradius-devel</name>
- <range><gt>0</gt></range>
+ <name>freeradius</name> <range><le>1.0.2_1</le></range>
+ </package> <package>
+ <name>freeradius-devel</name> <range><gt>0</gt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>A Gentoo Advisory reports:</p>
- <blockquote cite="http://www.gentoo.org/security/en/glsa/glsa-200505-13.xml">
+ <p>A Gentoo Advisory reports:</p> <blockquote
+ cite="http://www.gentoo.org/security/en/glsa/glsa-200505-13.xml">
<p>The FreeRADIUS server is vulnerable to an SQL injection
attack and a buffer overflow, possibly resulting in
disclosure and modification of data and Denial of
Service.</p>
</blockquote>
</body>
- </description>
- <references>
- <bid>13540</bid>
- <bid>13541</bid>
+ </description> <references>
+ <bid>13540</bid> <bid>13541</bid>
<url>http://www.gentoo.org/security/en/glsa/glsa-200505-13.xml</url>
- </references>
- <dates>
- <discovery>2005-05-17</discovery>
- <entry>2005-05-22</entry>
+ </references> <dates>
+ <discovery>2005-05-17</discovery> <entry>2005-05-22</entry>
</dates>
</vuln>
<vuln vid="641e8609-cab5-11d9-9aed-000e0c2e438a">
- <topic>ppxp -- local root exploit</topic>
- <affects>
+ <topic>ppxp -- local root exploit</topic> <affects>
<package>
- <name>ppxp</name>
- <range><gt>0</gt></range>
+ <name>ppxp</name> <range><gt>0</gt></range>
+ </package> <package>
+ <name>ja-ppxp</name> <range><gt>0</gt></range>
</package>
- <package>
- <name>ja-ppxp</name>
- <range><gt>0</gt></range>
- </package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>A Debian Advisory reports:</p>
- <blockquote cite="http://www.debian.org/security/2005/dsa-725">
- <p>Jens Steube discovered that ppxp, yet another PPP program,
+ <p>A Debian Advisory reports:</p> <blockquote
+ cite="http://www.debian.org/security/2005/dsa-725">
+ <p>Jens Steube discovered that ppxp, yet another PPP
+ program,
does not release root privileges when opening potentially
- user supplied log files. This can be tricked into opening
- a root shell.</p>
+ user supplied log files. This can be tricked into
+ opening a root shell.</p>
</blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2005-0392</cvename>
<url>http://www.debian.org/security/2005/dsa-725</url>
- </references>
- <dates>
- <discovery>2005-05-19</discovery>
- <entry>2005-05-22</entry>
+ </references> <dates>
+ <discovery>2005-05-19</discovery> <entry>2005-05-22</entry>
</dates>
</vuln>
<vuln vid="1033750f-cab4-11d9-9aed-000e0c2e438a">
- <topic>oops -- format string vulnerability</topic>
- <affects>
+ <topic>oops -- format string vulnerability</topic> <affects>
<package>
- <name>oops</name>
- <range><le>1.5.24</le></range>
+ <name>oops</name> <range><le>1.5.24</le></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A RST/GHC Advisory reports that there is an format string
- vulnerability in oops. The vulnerability can be found in
- the MySQL/PgSQL authentication module. Succesful
+ vulnerability in oops. The vulnerability can be found
+ in the MySQL/PgSQL authentication module. Succesful
exploitation may allow execution of arbitrary code.</p>
</body>
- </description>
- <references>
- <bid>13172</bid>
- <cvename>CVE-2005-1121</cvename>
+ </description> <references>
+ <bid>13172</bid> <cvename>CVE-2005-1121</cvename>
<url>http://rst.void.ru/papers/advisory24.txt</url>
- </references>
- <dates>
- <discovery>2005-04-14</discovery>
- <entry>2005-05-22</entry>
+ </references> <dates>
+ <discovery>2005-04-14</discovery> <entry>2005-05-22</entry>
</dates>
</vuln>
@@ -5569,96 +4679,76 @@ Note: Please add new entries to the beginning of this file.
<topic>cdrdao -- unspecified privilege escalation vulnerability</topic>
<affects>
<package>
- <name>cdrdao</name>
- <range><lt>1.2.0</lt></range>
+ <name>cdrdao</name> <range><lt>1.2.0</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The developers of cdrdao report that there is a potential
root exploit in the software. In order to be able to
succesfully exploit this vulnerability cdrdao must be
installed setuid root. When succesfully exploited a local
- user might get escalated privileges. By default this port is
- not installed setuid root.</p>
+ user might get escalated privileges. By default this
+ port is not installed setuid root.</p>
</body>
- </description>
- <references>
+ </description> <references>
<url>http://secunia.com/advisories/15354/</url>
<url>http://sourceforge.net/forum/forum.php?forum_id=466399</url>
- </references>
- <dates>
- <discovery>2005-05-13</discovery>
- <entry>2005-05-19</entry>
+ </references> <dates>
+ <discovery>2005-05-13</discovery> <entry>2005-05-19</entry>
</dates>
</vuln>
<vuln vid="ad5e70bb-c429-11d9-ac59-02061b08fc24">
- <topic>gaim -- MSN remote DoS vulnerability</topic>
- <affects>
+ <topic>gaim -- MSN remote DoS vulnerability</topic> <affects>
<package>
- <name>gaim</name>
- <name>ja-gaim</name>
- <name>ko-gaim</name>
- <name>ru-gaim</name>
- <range><lt>1.3.0</lt></range>
+ <name>gaim</name> <name>ja-gaim</name> <name>ko-gaim</name>
+ <name>ru-gaim</name> <range><lt>1.3.0</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>The GAIM team reports:</p>
- <blockquote cite="http://gaim.sourceforge.net/security/index.php?id=17">
- <p>Potential remote denial of service bug resulting from not
+ <p>The GAIM team reports:</p> <blockquote
+ cite="http://gaim.sourceforge.net/security/index.php?id=17">
+ <p>Potential remote denial of service bug resulting from
+ not
checking a pointer for non-NULL before passing it to
strncmp, which results in a crash. This can be triggered
by a remote client sending an SLP message with an empty
body.</p>
</blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2005-1262</cvename>
<url>http://gaim.sourceforge.net/security/index.php?id=17</url>
- </references>
- <dates>
- <discovery>2005-05-10</discovery>
- <entry>2005-05-14</entry>
+ </references> <dates>
+ <discovery>2005-05-10</discovery> <entry>2005-05-14</entry>
</dates>
</vuln>
<vuln vid="889061af-c427-11d9-ac59-02061b08fc24">
- <topic>gaim -- remote crash on some protocols</topic>
- <affects>
+ <topic>gaim -- remote crash on some protocols</topic> <affects>
<package>
- <name>gaim</name>
- <name>ja-gaim</name>
- <name>ko-gaim</name>
- <name>ru-gaim</name>
- <range><lt>1.3.0</lt></range>
+ <name>gaim</name> <name>ja-gaim</name> <name>ko-gaim</name>
+ <name>ru-gaim</name> <range><lt>1.3.0</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The GAIM team reports that GAIM is vulnerable to a
denial-of-service vulnerability which can cause GAIM to
crash:</p>
- <blockquote cite="http://gaim.sourceforge.net/security/index.php?id=16">
+ <blockquote
+ cite="http://gaim.sourceforge.net/security/index.php?id=16">
<p>It is possible for a remote user to overflow a static
buffer by sending an IM containing a very large URL
(greater than 8192 bytes) to the Gaim user. This is not
possible on all protocols, due to message length
- restrictions. Jabber are SILC are known to be
- vulnerable.</p>
+ restrictions. Jabber are SILC are known to be vulnerable.</p>
</blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2005-1261</cvename>
<url>http://gaim.sourceforge.net/security/index.php?id=16</url>
- </references>
- <dates>
- <discovery>2005-05-10</discovery>
- <entry>2005-05-14</entry>
+ </references> <dates>
+ <discovery>2005-05-10</discovery> <entry>2005-05-14</entry>
</dates>
</vuln>
@@ -5666,86 +4756,83 @@ Note: Please add new entries to the beginning of this file.
<topic>kernel -- information disclosure when using HTT</topic>
<affects>
<system>
- <name>FreeBSD</name>
- <range><ge>5.4</ge><lt>5.4_1</lt></range>
+ <name>FreeBSD</name> <range><ge>5.4</ge><lt>5.4_1</lt></range>
<range><ge>5.0</ge><lt>5.3_15</lt></range>
<range><ge>4.11</ge><lt>4.11_9</lt></range>
<range><lt>4.10_14</lt></range>
</system>
- </affects>
- <description>
- <body xmlns="http://www.w3.org/1999/xhtml">
- <h1>Problem description and impact</h1>
- <p>When running on processors supporting Hyper-Threading Technology, it is
- possible for a malicious thread to monitor the execution of another
- thread.</p>
- <p>Information may be disclosed to local users, allowing in many
- cases for privilege escalation. For example, on a multi-user
- system, it may be possible to steal cryptographic keys used in
- applications such as OpenSSH or SSL-enabled web servers.</p>
- <p><strong>NOTE:</strong> Similar problems may exist in other
+ </affects> <description>
+ <body xmlns="http://www.w3.org/1999/xhtml">
+ <h1>Problem description and impact</h1> <p>When running on
+ processors supporting Hyper-Threading Technology, it is
+ possible for a malicious thread to monitor the execution
+ of another thread.</p>
+ <p>Information may be disclosed to local users, allowing
+ in many
+ cases for privilege escalation. For example, on a
+ multi-user system, it may be possible to steal cryptographic
+ keys used in applications such as OpenSSH or SSL-enabled
+ web servers.</p>
+ <p><strong>NOTE:</strong> Similar problems may exist in
+ other
simultaneous multithreading implementations, or even some
systems in the absence of simultaneous multithreading.
- However, current research has only demonstrated this flaw in
- Hyper-Threading Technology, where shared memory caches are
- used.</p>
- <h1>Workaround</h1>
- <p>Systems not using processors with Hyper-Threading Technology
- support are not affected by this issue. On systems which are
- affected, the security flaw can be eliminated by setting the
- "machdep.hlt_logical_cpus" tunable:</p>
+ However, current research has only demonstrated this flaw
+ in Hyper-Threading Technology, where shared memory caches
+ are used.</p>
+ <h1>Workaround</h1> <p>Systems not using processors with
+ Hyper-Threading Technology
+ support are not affected by this issue. On systems which
+ are affected, the security flaw can be eliminated by
+ setting the "machdep.hlt_logical_cpus" tunable:</p>
<pre># echo "machdep.hlt_logical_cpus=1" >> /boot/loader.conf</pre>
- <p>The system must be rebooted in order for tunables to take effect.</p>
- <p>Use of this workaround is not recommended on "dual-core" systems, as
+ <p>The system must be rebooted in order for tunables to
+ take effect.</p> <p>Use of this workaround is not recommended
+ on "dual-core" systems, as
this workaround will also disable one of the processor
cores.</p>
</body>
- </description>
- <references>
- <cvename>CVE-2005-0109</cvename>
- <freebsdsa>SA-05:09.htt</freebsdsa>
+ </description> <references>
+ <cvename>CVE-2005-0109</cvename> <freebsdsa>SA-05:09.htt</freebsdsa>
<url>http://www.daemonology.net/hyperthreading-considered-harmful/</url>
- </references>
- <dates>
- <discovery>2005-05-13</discovery>
- <entry>2005-05-13</entry>
+ </references> <dates>
+ <discovery>2005-05-13</discovery> <entry>2005-05-13</entry>
</dates>
</vuln>
<vuln vid="66dbb2ee-99b8-45b2-bb3e-640caea67a60">
- <topic>leafnode -- fetchnews denial-of-service triggered by transmission abort/timeout</topic>
- <affects>
+ <topic>leafnode -- fetchnews denial-of-service triggered by
+ transmission abort/timeout</topic> <affects>
<package>
- <name>leafnode</name>
- <range><ge>1.9.48</ge><lt>1.11.2</lt></range>
+ <name>leafnode</name> <range><ge>1.9.48</ge><lt>1.11.2</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>When an upstream server aborts the transmission or stops sending
- data after the fetchnews program has requested an article header
- or body, fetchnews may crash, without querying further servers
- that are configured. This can prevent articles from being fetched.
+ <p>When an upstream server aborts the transmission or stops
+ sending
+ data after the fetchnews program has requested an article
+ header or body, fetchnews may crash, without querying
+ further servers that are configured. This can prevent
+ articles from being fetched.
</p>
</body>
- </description>
- <references>
+ </description> <references>
<url>http://leafnode.sourceforge.net/leafnode-SA-2005-01.txt</url>
- <cvename>CVE-2005-1453</cvename>
- <freebsdpr>ports/80663</freebsdpr>
- <bid>13489</bid>
- <bid>13492</bid>
- <mlist msgid="20050504152311.GA25593@merlin.emma.line.org">http://sourceforge.net/mailarchive/forum.php?thread_id=7186974&amp;forum_id=10210</mlist>
- <mlist msgid="20050504152311.GA25593@merlin.emma.line.org">http://article.gmane.org/gmane.network.leafnode.announce/52</mlist>
- <mlist msgid="20050504152311.GA25593@merlin.emma.line.org">http://www.dt.e-technik.uni-dortmund.de/pipermail/leafnode-list/2005q2/000900.html</mlist>
- <mlist msgid="20050504152311.GA25593@merlin.emma.line.org">http://www.fredi.de/maillist/msg00111.html</mlist>
- <mlist msgid="20050504152311.GA25593@merlin.emma.line.org">http://archives.neohapsis.com/archives/vulnwatch/2005-q2/0037.html</mlist>
+ <cvename>CVE-2005-1453</cvename> <freebsdpr>ports/80663</freebsdpr>
+ <bid>13489</bid> <bid>13492</bid> <mlist
+ msgid="20050504152311.GA25593@merlin.emma.line.org">http://sourceforge.net/mailarchive/forum.php?thread_id=7186974&amp;forum_id=10210</mlist>
+ <mlist
+ msgid="20050504152311.GA25593@merlin.emma.line.org">http://article.gmane.org/gmane.network.leafnode.announce/52</mlist>
+ <mlist
+ msgid="20050504152311.GA25593@merlin.emma.line.org">http://www.dt.e-technik.uni-dortmund.de/pipermail/leafnode-list/2005q2/000900.html</mlist>
+ <mlist
+ msgid="20050504152311.GA25593@merlin.emma.line.org">http://www.fredi.de/maillist/msg00111.html</mlist>
+ <mlist
+ msgid="20050504152311.GA25593@merlin.emma.line.org">http://archives.neohapsis.com/archives/vulnwatch/2005-q2/0037.html</mlist>
<url>http://www.frsirt.com/english/advisories/2005/0468</url>
<url>http://secunia.com/advisories/15252</url>
- </references>
- <dates>
- <discovery>2005-05-04</discovery>
- <entry>2005-05-13</entry>
+ </references> <dates>
+ <discovery>2005-05-04</discovery> <entry>2005-05-13</entry>
</dates>
</vuln>
@@ -5754,29 +4841,18 @@ Note: Please add new entries to the beginning of this file.
overrides</topic>
<affects>
<package>
- <name>firefox</name>
- <range><lt>1.0.4,1</lt></range>
- </package>
- <package>
- <name>linux-firefox</name>
- <range><lt>1.0.4</lt></range>
- </package>
- <package>
- <name>mozilla</name>
- <range><lt>1.7.8,2</lt></range>
+ <name>firefox</name> <range><lt>1.0.4,1</lt></range>
+ </package> <package>
+ <name>linux-firefox</name> <range><lt>1.0.4</lt></range>
+ </package> <package>
+ <name>mozilla</name> <range><lt>1.7.8,2</lt></range>
<range><ge>1.8.*,2</ge></range>
- </package>
- <package>
- <name>linux-mozilla</name>
- <name>linux-mozilla-devel</name>
- <range><lt>1.7.8</lt></range>
- <range><ge>1.8.*</ge></range>
- </package>
- <package>
- <name>netscape7</name>
- <range><ge>0</ge></range>
- </package>
- <package>
+ </package> <package>
+ <name>linux-mozilla</name> <name>linux-mozilla-devel</name>
+ <range><lt>1.7.8</lt></range> <range><ge>1.8.*</ge></range>
+ </package> <package>
+ <name>netscape7</name> <range><ge>0</ge></range>
+ </package> <package>
<!-- These ports are obsolete. -->
<name>de-linux-mozillafirebird</name>
<name>el-linux-mozillafirebird</name>
@@ -5785,59 +4861,48 @@ Note: Please add new entries to the beginning of this file.
<name>linux-mozillafirebird</name>
<name>ru-linux-mozillafirebird</name>
<name>zhCN-linux-mozillafirebird</name>
- <name>zhTW-linux-mozillafirebird</name>
- <range><ge>0</ge></range>
- </package>
- <package>
+ <name>zhTW-linux-mozillafirebird</name> <range><ge>0</ge></range>
+ </package> <package>
<!-- These package names are obsolete. -->
- <name>de-linux-netscape</name>
- <name>de-netscape7</name>
- <name>fr-linux-netscape</name>
- <name>fr-netscape7</name>
- <name>ja-linux-netscape</name>
- <name>ja-netscape7</name>
- <name>linux-netscape</name>
- <name>linux-phoenix</name>
- <name>mozilla+ipv6</name>
- <name>mozilla-embedded</name>
- <name>mozilla-firebird</name>
- <name>mozilla-gtk1</name>
- <name>mozilla-gtk2</name>
- <name>mozilla-gtk</name>
- <name>mozilla-thunderbird</name>
- <name>phoenix</name>
- <name>pt_BR-netscape7</name>
- <range><ge>0</ge></range>
- </package>
- </affects>
- <description>
+ <name>de-linux-netscape</name> <name>de-netscape7</name>
+ <name>fr-linux-netscape</name> <name>fr-netscape7</name>
+ <name>ja-linux-netscape</name> <name>ja-netscape7</name>
+ <name>linux-netscape</name> <name>linux-phoenix</name>
+ <name>mozilla+ipv6</name> <name>mozilla-embedded</name>
+ <name>mozilla-firebird</name> <name>mozilla-gtk1</name>
+ <name>mozilla-gtk2</name> <name>mozilla-gtk</name>
+ <name>mozilla-thunderbird</name> <name>phoenix</name>
+ <name>pt_BR-netscape7</name> <range><ge>0</ge></range>
+ </package>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Mozilla Foundation Security Advisory reports:</p>
- <blockquote cite="http://www.mozilla.org/security/announce/mfsa2005-44.html">
- <p>Additional checks were added to make sure Javascript eval
+ <blockquote
+ cite="http://www.mozilla.org/security/announce/mfsa2005-44.html">
+ <p>Additional checks were added to make sure Javascript
+ eval
and Script objects are run with the privileges of the
context that created them, not the potentially elevated
privilege of the context calling them in order to protect
against an additional variant of <a
href="http://www.mozilla.org/security/announce/mfsa2005-41.html">MFSA
2005-41</a>.</p>
- </blockquote>
- <p>The Mozilla Foundation Security Advisory MFSA 2005-41
+ </blockquote> <p>The Mozilla Foundation Security Advisory
+ MFSA 2005-41
reports:</p>
- <blockquote cite="http://www.mozilla.org/security/announce/mfsa2005-41.html">
- <p>moz_bug_r_a4 reported several exploits giving an attacker
+ <blockquote
+ cite="http://www.mozilla.org/security/announce/mfsa2005-41.html">
+ <p>moz_bug_r_a4 reported several exploits giving an
+ attacker
the ability to install malicious code or steal data,
- requiring only that the user do commonplace actions like
- click on a link or open the context menu.</p>
+ requiring only that the user do commonplace actions
+ like click on a link or open the context menu.</p>
</blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<url>http://www.mozilla.org/security/announce/mfsa2005-44.html</url>
- </references>
- <dates>
- <discovery>2005-05-11</discovery>
- <entry>2005-05-12</entry>
+ </references> <dates>
+ <discovery>2005-05-11</discovery> <entry>2005-05-12</entry>
</dates>
</vuln>
@@ -5846,29 +4911,18 @@ Note: Please add new entries to the beginning of this file.
checks</topic>
<affects>
<package>
- <name>firefox</name>
- <range><lt>1.0.4,1</lt></range>
- </package>
- <package>
- <name>linux-firefox</name>
- <range><lt>1.0.4</lt></range>
- </package>
- <package>
- <name>mozilla</name>
- <range><lt>1.7.8,2</lt></range>
+ <name>firefox</name> <range><lt>1.0.4,1</lt></range>
+ </package> <package>
+ <name>linux-firefox</name> <range><lt>1.0.4</lt></range>
+ </package> <package>
+ <name>mozilla</name> <range><lt>1.7.8,2</lt></range>
<range><ge>1.8.*,2</ge></range>
- </package>
- <package>
- <name>linux-mozilla</name>
- <name>linux-mozilla-devel</name>
- <range><lt>1.7.8</lt></range>
- <range><ge>1.8.*</ge></range>
- </package>
- <package>
- <name>netscape7</name>
- <range><ge>0</ge></range>
- </package>
- <package>
+ </package> <package>
+ <name>linux-mozilla</name> <name>linux-mozilla-devel</name>
+ <range><lt>1.7.8</lt></range> <range><ge>1.8.*</ge></range>
+ </package> <package>
+ <name>netscape7</name> <range><ge>0</ge></range>
+ </package> <package>
<!-- These ports are obsolete. -->
<name>de-linux-mozillafirebird</name>
<name>el-linux-mozillafirebird</name>
@@ -5877,43 +4931,31 @@ Note: Please add new entries to the beginning of this file.
<name>linux-mozillafirebird</name>
<name>ru-linux-mozillafirebird</name>
<name>zhCN-linux-mozillafirebird</name>
- <name>zhTW-linux-mozillafirebird</name>
- <range><ge>0</ge></range>
- </package>
- <package>
+ <name>zhTW-linux-mozillafirebird</name> <range><ge>0</ge></range>
+ </package> <package>
<!-- These package names are obsolete. -->
- <name>de-linux-netscape</name>
- <name>de-netscape7</name>
- <name>fr-linux-netscape</name>
- <name>fr-netscape7</name>
- <name>ja-linux-netscape</name>
- <name>ja-netscape7</name>
- <name>linux-netscape</name>
- <name>linux-phoenix</name>
- <name>mozilla+ipv6</name>
- <name>mozilla-embedded</name>
- <name>mozilla-firebird</name>
- <name>mozilla-gtk1</name>
- <name>mozilla-gtk2</name>
- <name>mozilla-gtk</name>
- <name>mozilla-thunderbird</name>
- <name>phoenix</name>
- <name>pt_BR-netscape7</name>
- <range><ge>0</ge></range>
- </package>
- </affects>
- <description>
+ <name>de-linux-netscape</name> <name>de-netscape7</name>
+ <name>fr-linux-netscape</name> <name>fr-netscape7</name>
+ <name>ja-linux-netscape</name> <name>ja-netscape7</name>
+ <name>linux-netscape</name> <name>linux-phoenix</name>
+ <name>mozilla+ipv6</name> <name>mozilla-embedded</name>
+ <name>mozilla-firebird</name> <name>mozilla-gtk1</name>
+ <name>mozilla-gtk2</name> <name>mozilla-gtk</name>
+ <name>mozilla-thunderbird</name> <name>phoenix</name>
+ <name>pt_BR-netscape7</name> <range><ge>0</ge></range>
+ </package>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Mozilla Foundation Security Advisory reports:</p>
- <blockquote cite="http://www.mozilla.org/security/announce/mfsa2005-43.html">
+ <blockquote
+ cite="http://www.mozilla.org/security/announce/mfsa2005-43.html">
<p>Some security checks intended to prevent script injection
were incorrect and could be bypassed by wrapping a
- javascript: url in the view-source:
- pseudo-protocol. Michael Krax demonstrated that a variant
- of his <a
+ javascript: url in the view-source: pseudo-protocol.
+ Michael Krax demonstrated that a variant of his <a
href="http://www.mozilla.org/security/announce/mfsa2005-37.html">favicon</a>
- exploit could still execute arbitrary code, and the same
- technique could also be used to perform cross-site
+ exploit could still execute arbitrary code, and the
+ same technique could also be used to perform cross-site
scripting.</p>
<p>Georgi Guninski demonstrated the same flaw wrapping
javascript: urls with the jar: pseudo-protocol.</p>
@@ -5922,13 +4964,10 @@ Note: Please add new entries to the beginning of this file.
<p><strong>Workaround:</strong> Disable Javascript</p>
</blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<url>http://www.mozilla.org/security/announce/mfsa2005-43.html</url>
- </references>
- <dates>
- <discovery>2005-05-11</discovery>
- <entry>2005-05-12</entry>
+ </references> <dates>
+ <discovery>2005-05-11</discovery> <entry>2005-05-12</entry>
</dates>
</vuln>
@@ -5937,29 +4976,18 @@ Note: Please add new entries to the beginning of this file.
vulnerability</topic>
<affects>
<package>
- <name>firefox</name>
- <range><lt>1.0.4,1</lt></range>
- </package>
- <package>
- <name>linux-firefox</name>
- <range><lt>1.0.4</lt></range>
- </package>
- <package>
- <name>mozilla</name>
- <range><lt>1.7.8,2</lt></range>
+ <name>firefox</name> <range><lt>1.0.4,1</lt></range>
+ </package> <package>
+ <name>linux-firefox</name> <range><lt>1.0.4</lt></range>
+ </package> <package>
+ <name>mozilla</name> <range><lt>1.7.8,2</lt></range>
<range><ge>1.8.*,2</ge></range>
- </package>
- <package>
- <name>linux-mozilla</name>
- <name>linux-mozilla-devel</name>
- <range><lt>1.7.8</lt></range>
- <range><ge>1.8.*</ge></range>
- </package>
- <package>
- <name>netscape7</name>
- <range><ge>0</ge></range>
- </package>
- <package>
+ </package> <package>
+ <name>linux-mozilla</name> <name>linux-mozilla-devel</name>
+ <range><lt>1.7.8</lt></range> <range><ge>1.8.*</ge></range>
+ </package> <package>
+ <name>netscape7</name> <range><ge>0</ge></range>
+ </package> <package>
<!-- These ports are obsolete. -->
<name>de-linux-mozillafirebird</name>
<name>el-linux-mozillafirebird</name>
@@ -5968,41 +4996,31 @@ Note: Please add new entries to the beginning of this file.
<name>linux-mozillafirebird</name>
<name>ru-linux-mozillafirebird</name>
<name>zhCN-linux-mozillafirebird</name>
- <name>zhTW-linux-mozillafirebird</name>
- <range><ge>0</ge></range>
- </package>
- <package>
+ <name>zhTW-linux-mozillafirebird</name> <range><ge>0</ge></range>
+ </package> <package>
<!-- These package names are obsolete. -->
- <name>de-linux-netscape</name>
- <name>de-netscape7</name>
- <name>fr-linux-netscape</name>
- <name>fr-netscape7</name>
- <name>ja-linux-netscape</name>
- <name>ja-netscape7</name>
- <name>linux-netscape</name>
- <name>linux-phoenix</name>
- <name>mozilla+ipv6</name>
- <name>mozilla-embedded</name>
- <name>mozilla-firebird</name>
- <name>mozilla-gtk1</name>
- <name>mozilla-gtk2</name>
- <name>mozilla-gtk</name>
- <name>mozilla-thunderbird</name>
- <name>phoenix</name>
- <name>pt_BR-netscape7</name>
- <range><ge>0</ge></range>
- </package>
- </affects>
- <description>
+ <name>de-linux-netscape</name> <name>de-netscape7</name>
+ <name>fr-linux-netscape</name> <name>fr-netscape7</name>
+ <name>ja-linux-netscape</name> <name>ja-netscape7</name>
+ <name>linux-netscape</name> <name>linux-phoenix</name>
+ <name>mozilla+ipv6</name> <name>mozilla-embedded</name>
+ <name>mozilla-firebird</name> <name>mozilla-gtk1</name>
+ <name>mozilla-gtk2</name> <name>mozilla-gtk</name>
+ <name>mozilla-thunderbird</name> <name>phoenix</name>
+ <name>pt_BR-netscape7</name> <range><ge>0</ge></range>
+ </package>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Mozilla Foundation Security Advisory reports:</p>
- <blockquote cite="http://www.mozilla.org/security/announce/mfsa2005-42.html">
+ <blockquote
+ cite="http://www.mozilla.org/security/announce/mfsa2005-42.html">
<p>Two vulnerabilities have been discovered in Firefox,
which can be exploited by malicious people to conduct
cross-site scripting attacks and compromise a user's
system.</p>
<ol>
- <li>The problem is that "IFRAME" JavaScript URLs are not
+ <li>The problem is that "IFRAME" JavaScript URLs are
+ not
properly protected from being executed in context of
another URL in the history list. This can be exploited
to execute arbitrary HTML and script code in a user's
@@ -6010,53 +5028,44 @@ Note: Please add new entries to the beginning of this file.
<li>Input passed to the "IconURL" parameter in
"InstallTrigger.install()" is not properly verified
before being used. This can be exploited to execute
- arbitrary JavaScript code with escalated privileges via
- a specially crafted JavaScript URL.</li>
- </ol>
- <p>Successful exploitation requires that the site is allowed
- to install software (default sites are
- "update.mozilla.org" and "addons.mozilla.org").</p>
+ arbitrary JavaScript code with escalated privileges
+ via a specially crafted JavaScript URL.</li>
+ </ol> <p>Successful exploitation requires that the site
+ is allowed
+ to install software (default sites are "update.mozilla.org"
+ and "addons.mozilla.org").</p>
<p>A combination of vulnerability 1 and 2 can be exploited
to execute arbitrary code.</p>
</blockquote>
</body>
- </description>
- <references>
- <cvename>CVE-2005-1476</cvename>
- <cvename>CVE-2005-1477</cvename>
+ </description> <references>
+ <cvename>CVE-2005-1476</cvename> <cvename>CVE-2005-1477</cvename>
<url>http://www.mozilla.org/security/announce/mfsa2005-42.html</url>
- </references>
- <dates>
- <discovery>2005-05-08</discovery>
- <entry>2005-05-11</entry>
+ </references> <dates>
+ <discovery>2005-05-08</discovery> <entry>2005-05-11</entry>
</dates>
</vuln>
<vuln vid="01bb84e2-bd88-11d9-a281-02e018374e71">
- <topic>groff -- pic2graph and eqn2graph are vulnerable to symlink attack through temporary files</topic>
- <affects>
+ <topic>groff -- pic2graph and eqn2graph are vulnerable to symlink
+ attack through temporary files</topic> <affects>
<package>
<name>ja-groff</name>
<range><ge>1.18.1</ge><lt>1.18.1_8</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The eqn2graph and pic2graph scripts in groff 1.18.1
- allow local users to overwrite arbitrary files via
- a symlink attack on temporary files.</p>
+ allow local users to overwrite arbitrary files via a
+ symlink attack on temporary files.</p>
</body>
- </description>
- <references>
- <freebsdpr>ports/80671</freebsdpr>
- <bid>12058</bid>
+ </description> <references>
+ <freebsdpr>ports/80671</freebsdpr> <bid>12058</bid>
<cvename>CVE-2004-1296</cvename>
<url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=286371</url>
<url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=286372</url>
- </references>
- <dates>
- <discovery>2004-12-20</discovery>
- <entry>2005-05-09</entry>
+ </references> <dates>
+ <discovery>2004-12-20</discovery> <entry>2005-05-09</entry>
</dates>
</vuln>
@@ -6064,26 +5073,21 @@ Note: Please add new entries to the beginning of this file.
<topic>groff -- groffer uses temporary files unsafely</topic>
<affects>
<package>
- <name>ja-groff</name>
- <range><ge>1.18</ge><lt>1.18.1_8</lt></range>
+ <name>ja-groff</name> <range><ge>1.18</ge><lt>1.18.1_8</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>The groffer script in the groff package 1.18 and later versions
- allows local users to overwrite files via a symlink attack
+ <p>The groffer script in the groff package 1.18 and later
+ versions
+ allows local users to overwrite files via a symlink attack
on temporary files.</p>
</body>
- </description>
- <references>
- <freebsdpr>ports/80671</freebsdpr>
- <bid>11287</bid>
+ </description> <references>
+ <freebsdpr>ports/80671</freebsdpr> <bid>11287</bid>
<cvename>CVE-2004-0969</cvename>
<url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=278265</url>
- </references>
- <dates>
- <discovery>2004-09-30</discovery>
- <entry>2005-05-09</entry>
+ </references> <dates>
+ <discovery>2004-09-30</discovery> <entry>2005-05-09</entry>
</dates>
</vuln>
@@ -6091,60 +5095,48 @@ Note: Please add new entries to the beginning of this file.
<topic>sharutils -- unshar insecure temporary file creation</topic>
<affects>
<package>
- <name>sharutils</name>
- <range><lt>4.3.80</lt></range>
+ <name>sharutils</name> <range><lt>4.3.80</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>An Ubuntu Advisory reports:</p>
- <blockquote cite="http://www.ubuntulinux.org/support/documentation/usn/usn-104-1">
- <p>Joey Hess discovered that "unshar" created temporary files
+ <p>An Ubuntu Advisory reports:</p> <blockquote
+ cite="http://www.ubuntulinux.org/support/documentation/usn/usn-104-1">
+ <p>Joey Hess discovered that "unshar" created temporary
+ files
in an insecure manner. This could allow a symbolic link
attack to create or overwrite arbitrary files with the
privileges of the user invoking the program.</p>
</blockquote>
</body>
- </description>
- <references>
- <bid>12981</bid>
- <cvename>CVE-2005-0990</cvename>
+ </description> <references>
+ <bid>12981</bid> <cvename>CVE-2005-0990</cvename>
<url>http://www.ubuntulinux.org/support/documentation/usn/usn-104-1</url>
- </references>
- <dates>
- <discovery>2005-04-04</discovery>
- <entry>2005-05-01</entry>
+ </references> <dates>
+ <discovery>2005-04-04</discovery> <entry>2005-05-01</entry>
</dates>
</vuln>
<vuln vid="8c5ad0cf-ba37-11d9-837d-000e0c2e438a">
- <topic>rsnapshot -- local privilege escalation</topic>
- <affects>
+ <topic>rsnapshot -- local privilege escalation</topic> <affects>
<package>
- <name>rsnapshot</name>
- <range><lt>1.1.7</lt></range>
+ <name>rsnapshot</name> <range><lt>1.1.7</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>An rsnapshot Advisory reports:</p>
- <blockquote cite="http://www.rsnapshot.org/security/2005/001.html">
+ <p>An rsnapshot Advisory reports:</p> <blockquote
+ cite="http://www.rsnapshot.org/security/2005/001.html">
<p>The copy_symlink() subroutine in rsnapshot incorrectly
- changes file ownership on the files pointed to by symlinks,
- not on the symlinks themselves. This would allow, under
- certain circumstances, an arbitrary user to take ownership
- of a file on the main filesystem.</p>
+ changes file ownership on the files pointed to by
+ symlinks, not on the symlinks themselves. This would
+ allow, under certain circumstances, an arbitrary user
+ to take ownership of a file on the main filesystem.</p>
</blockquote>
</body>
- </description>
- <references>
- <bid>13095</bid>
- <cvename>CVE-2005-1064</cvename>
+ </description> <references>
+ <bid>13095</bid> <cvename>CVE-2005-1064</cvename>
<url>http://www.rsnapshot.org/security/2005/001.html</url>
- </references>
- <dates>
- <discovery>2005-04-10</discovery>
- <entry>2005-05-01</entry>
+ </references> <dates>
+ <discovery>2005-04-10</discovery> <entry>2005-05-01</entry>
</dates>
</vuln>
@@ -6152,64 +5144,55 @@ Note: Please add new entries to the beginning of this file.
<topic>coppermine -- IP spoofing and XSS vulnerability</topic>
<affects>
<package>
- <name>coppermine</name>
- <range><lt>1.3.2</lt></range>
+ <name>coppermine</name> <range><lt>1.3.2</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>GHC team reports about coppermine</p>
- <blockquote cite="http://www.securityfocus.com/archive/1/396080">
+ <p>GHC team reports about coppermine</p> <blockquote
+ cite="http://www.securityfocus.com/archive/1/396080">
<p>The lack of sanitizing of user defined variables may
result in undesirable consequences such as IP spoofing
or XSS attack.</p>
<p>Generally users of Coppermine Gallery can post comments.
- Remote address &amp; x-forwarded-for variables are logged
- for admin's eyes. X-Forwarded-for variable does not pass
- throu any filtration before logging into database. User
- can define/redefine this variable.</p>
+ Remote address &amp; x-forwarded-for variables are
+ logged for admin's eyes. X-Forwarded-for variable does
+ not pass throu any filtration before logging into
+ database. User can define/redefine this variable.</p>
</blockquote>
</body>
- </description>
- <references>
- <mlist msgid="20050418122434.10438.qmail@www.securityfocus.com">http://www.securityfocus.com/archive/1/396080</mlist>
- <bid>13218</bid>
- <cvename>CVE-2005-1172</cvename>
+ </description> <references>
+ <mlist
+ msgid="20050418122434.10438.qmail@www.securityfocus.com">http://www.securityfocus.com/archive/1/396080</mlist>
+ <bid>13218</bid> <cvename>CVE-2005-1172</cvename>
<url>http://coppermine.sourceforge.net/board/index.php?topic=17134.0</url>
- </references>
- <dates>
- <discovery>2005-04-18</discovery>
- <entry>2005-05-01</entry>
+ </references> <dates>
+ <discovery>2005-04-18</discovery> <entry>2005-05-01</entry>
</dates>
</vuln>
<vuln vid="cd286cc5-b762-11d9-bfb7-000c6ec775d9">
- <topic>ImageMagick -- ReadPNMImage() heap overflow vulnerability</topic>
- <affects>
+ <topic>ImageMagick -- ReadPNMImage() heap overflow
+ vulnerability</topic> <affects>
<package>
- <name>ImageMagick</name>
- <range><lt>6.2.2</lt></range>
+ <name>ImageMagick</name> <range><lt>6.2.2</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>Damian Put reports about ImageMagick:</p>
- <blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=111445767107869">
+ <p>Damian Put reports about ImageMagick:</p> <blockquote
+ cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=111445767107869">
<p>Remote exploitation of a heap overflow vulnerability
could allow execution of arbitrary code or course denial
of service.</p>
- <p>A heap overflow exists in ReadPNMImage() function, that
+ <p>A heap overflow exists in ReadPNMImage() function,
+ that
is used to decode a PNM image files.</p>
</blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<bid>13351</bid>
<url>http://marc.theaimsgroup.com/?l=bugtraq&amp;m=111445767107869</url>
- </references>
- <dates>
- <discovery>2005-04-25</discovery>
- <entry>2005-04-27</entry>
+ </references> <dates>
+ <discovery>2005-04-25</discovery> <entry>2005-04-27</entry>
</dates>
</vuln>
@@ -6218,59 +5201,49 @@ Note: Please add new entries to the beginning of this file.
vulnerabilities</topic>
<affects>
<package>
- <name>mplayer</name>
- <name>mplayer-gtk</name>
- <name>mplayer-gtk2</name>
- <name>mplayer-esound</name>
- <name>mplayer-gtk-esound</name>
- <name>mplayer-gtk2-esound</name>
+ <name>mplayer</name> <name>mplayer-gtk</name>
+ <name>mplayer-gtk2</name> <name>mplayer-esound</name>
+ <name>mplayer-gtk-esound</name> <name>mplayer-gtk2-esound</name>
<range><lt>0.99.7</lt></range>
+ </package> <package>
+ <name>libxine</name> <range><ge>0.9.9</ge><lt>1.0.1</lt></range>
</package>
- <package>
- <name>libxine</name>
- <range><ge>0.9.9</ge><lt>1.0.1</lt></range>
- </package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>A xine security announcement reports:</p>
- <blockquote cite="http://xinehq.de/index.php/security/XSA-2004-8">
+ <p>A xine security announcement reports:</p> <blockquote
+ cite="http://xinehq.de/index.php/security/XSA-2004-8">
<p>By a user receiving data from a malicious network
streaming server, an attacker can overrun a heap buffer,
which can, on some systems, lead to or help in executing
- attacker-chosen malicious code with the permissions of the
- user running a xine-lib based media application.</p>
+ attacker-chosen malicious code with the permissions of
+ the user running a xine-lib based media application.</p>
<p>Both the MMS and Real RTSP streaming client code made
- some too-strong assumptions on the transferred
- data. Several critical bounds checks were missing,
- resulting in the possibility of heap overflows, should the
- remote server not adhere to these assumptions. In the MMS
- case, a remote server could present content with too many
+ some too-strong assumptions on the transferred data.
+ Several critical bounds checks were missing, resulting
+ in the possibility of heap overflows, should the remote
+ server not adhere to these assumptions. In the MMS case,
+ a remote server could present content with too many
individual streams; in the RTSP case, a remote server's
reply could have too many lines.</p>
- <p>An attacker can set up a server delivering malicious data
+ <p>An attacker can set up a server delivering malicious
+ data
to the users. This can be used to overflow a heap buffer,
- which can, with certain implementations of heap
- management, lead to attacker chosen data written to the
- stack. This can cause attacker-chosen code being executed
- with the permissions of the user running the
- application. By tricking users to retrieve a stream, which
- can be as easy as providing a link on a website, this
- vulnerability can be exploited remotely.</p>
+ which can, with certain implementations of heap management,
+ lead to attacker chosen data written to the stack. This
+ can cause attacker-chosen code being executed with the
+ permissions of the user running the application. By
+ tricking users to retrieve a stream, which can be as
+ easy as providing a link on a website, this vulnerability
+ can be exploited remotely.</p>
</blockquote>
</body>
- </description>
- <references>
- <bid>13270</bid>
- <bid>13271</bid>
- <cvename>CVE-2005-1195</cvename>
+ </description> <references>
+ <bid>13270</bid> <bid>13271</bid> <cvename>CVE-2005-1195</cvename>
<url>http://www.mplayerhq.hu/homepage/design7/news.html#vuln10</url>
<url>http://www.mplayerhq.hu/homepage/design7/news.html#vuln11</url>
<url>http://xinehq.de/index.php/security/XSA-2004-8</url>
- </references>
- <dates>
- <discovery>2005-04-16</discovery>
- <entry>2005-04-25</entry>
+ </references> <dates>
+ <discovery>2005-04-16</discovery> <entry>2005-04-25</entry>
</dates>
</vuln>
@@ -6278,33 +5251,28 @@ Note: Please add new entries to the beginning of this file.
<topic>gaim -- AIM/ICQ remote denial of service vulnerability</topic>
<affects>
<package>
- <name>gaim</name>
- <name>ja-gaim</name>
- <name>ko-gaim</name>
- <name>ru-gaim</name>
- <range><lt>1.1.3</lt></range>
+ <name>gaim</name> <name>ja-gaim</name> <name>ko-gaim</name>
+ <name>ru-gaim</name> <range><lt>1.1.3</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The GAIM team reports that GAIM is vulnerable to a
denial-of-service vulnerability which can cause GAIM to
freeze:</p>
- <blockquote cite="http://gaim.sourceforge.net/security/index.php?id=10">
- <p>Certain malformed SNAC packets sent by other AIM or ICQ
+ <blockquote
+ cite="http://gaim.sourceforge.net/security/index.php?id=10">
+ <p>Certain malformed SNAC packets sent by other AIM or
+ ICQ
users can trigger an infinite loop in Gaim when parsing
- the SNAC. The remote user would need a custom client, able
- to generate malformed SNACs.</p>
+ the SNAC. The remote user would need a custom client,
+ able to generate malformed SNACs.</p>
</blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2005-0472</cvename>
<url>http://gaim.sourceforge.net/security/index.php?id=10</url>
- </references>
- <dates>
- <discovery>2005-02-17</discovery>
- <entry>2005-04-25</entry>
+ </references> <dates>
+ <discovery>2005-02-17</discovery> <entry>2005-04-25</entry>
</dates>
</vuln>
@@ -6312,31 +5280,24 @@ Note: Please add new entries to the beginning of this file.
<topic>gaim -- remote DoS on receiving malformed HTML</topic>
<affects>
<package>
- <name>gaim</name>
- <name>ja-gaim</name>
- <name>ko-gaim</name>
- <name>ru-gaim</name>
- <range><lt>1.1.4</lt></range>
+ <name>gaim</name> <name>ja-gaim</name> <name>ko-gaim</name>
+ <name>ru-gaim</name> <range><lt>1.1.4</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>The GAIM team reports:</p>
- <blockquote cite="http://gaim.sourceforge.net/security/index.php?id=12">
- <p>Receiving malformed HTML can result in an invalid memory
+ <p>The GAIM team reports:</p> <blockquote
+ cite="http://gaim.sourceforge.net/security/index.php?id=12">
+ <p>Receiving malformed HTML can result in an invalid
+ memory
access causing Gaim to crash.</p>
</blockquote>
</body>
- </description>
- <references>
- <cvename>CVE-2005-0208</cvename>
- <cvename>CVE-2005-0473</cvename>
+ </description> <references>
+ <cvename>CVE-2005-0208</cvename> <cvename>CVE-2005-0473</cvename>
<url>http://gaim.sourceforge.net/security/index.php?id=11</url>
<url>http://gaim.sourceforge.net/security/index.php?id=12</url>
- </references>
- <dates>
- <discovery>2005-02-17</discovery>
- <entry>2005-04-25</entry>
+ </references> <dates>
+ <discovery>2005-02-17</discovery> <entry>2005-04-25</entry>
</dates>
</vuln>
@@ -6345,31 +5306,26 @@ Note: Please add new entries to the beginning of this file.
vulnerability</topic>
<affects>
<package>
- <name>kdewebdev</name>
- <range><lt>3.4.0_1,2</lt></range>
+ <name>kdewebdev</name> <range><lt>3.4.0_1,2</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>A KDE Security Advisory reports:</p>
- <blockquote cite="http://www.kde.org/info/security/advisory-20050420-1.txt">
+ <p>A KDE Security Advisory reports:</p> <blockquote
+ cite="http://www.kde.org/info/security/advisory-20050420-1.txt">
<p>Kommander executes without user confirmation data files
from possibly untrusted locations. As they contain
scripts, the user might accidentally run arbitrary
code.</p>
- <p><strong>Impact:</strong> Remotly supplied kommander files
- from untrusted sources are executed without
- confirmation.</p>
+ <p><strong>Impact:</strong> Remotly supplied kommander
+ files
+ from untrusted sources are executed without confirmation.</p>
</blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2005-0754</cvename>
<url>http://www.kde.org/info/security/advisory-20050420-1.txt</url>
- </references>
- <dates>
- <discovery>2005-04-20</discovery>
- <entry>2005-04-23</entry>
+ </references> <dates>
+ <discovery>2005-04-20</discovery> <entry>2005-04-23</entry>
</dates>
</vuln>
@@ -6378,74 +5334,61 @@ Note: Please add new entries to the beginning of this file.
modification vulnerability</topic>
<affects>
<package>
- <name>junkbuster</name>
- <range><lt>2.0.2_3</lt></range>
+ <name>junkbuster</name> <range><lt>2.0.2_3</lt></range>
+ </package> <package>
+ <name>junkbuster-zlib</name> <range><gt>0</gt></range>
</package>
- <package>
- <name>junkbuster-zlib</name>
- <range><gt>0</gt></range>
- </package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>A Debian advisory reports:</p>
- <blockquote cite="http://www.debian.org/security/2005/dsa-713">
- <p>James Ranson discovered that an attacker can modify the
- referrer setting with a carefully crafted URL by accidently
- overwriting a global variable.</p>
+ <p>A Debian advisory reports:</p> <blockquote
+ cite="http://www.debian.org/security/2005/dsa-713">
+ <p>James Ranson discovered that an attacker can modify
+ the
+ referrer setting with a carefully crafted URL by
+ accidently overwriting a global variable.</p>
<p>Tavis Ormandy from the Gentoo Security Team discovered
several heap corruptions due to inconsistent use of an
internal function that can crash the daemon or possibly
lead to the execution of arbitrary code.</p>
</blockquote>
</body>
- </description>
- <references>
- <bid>13146</bid>
- <bid>13147</bid>
- <cvename>CVE-2005-1108</cvename>
+ </description> <references>
+ <bid>13146</bid> <bid>13147</bid> <cvename>CVE-2005-1108</cvename>
<cvename>CVE-2005-1109</cvename>
<url>http://www.debian.org/security/2005/dsa-713</url>
<url>http://www.gentoo.org/security/en/glsa/glsa-200504-11.xml</url>
- </references>
- <dates>
- <discovery>2005-04-13</discovery>
- <entry>2005-04-22</entry>
+ </references> <dates>
+ <discovery>2005-04-13</discovery> <entry>2005-04-22</entry>
</dates>
</vuln>
<vuln vid="06404241-b306-11d9-a788-0001020eed82">
- <topic>kdelibs -- kimgio input validation errors</topic>
- <affects>
+ <topic>kdelibs -- kimgio input validation errors</topic> <affects>
<package>
- <name>kdelibs</name>
- <range><ge>3.2</ge><lt>3.4.0_2</lt></range>
+ <name>kdelibs</name> <range><ge>3.2</ge><lt>3.4.0_2</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>A KDE Security Advisory reports:</p>
- <blockquote cite="http://www.kde.org/info/security/advisory-20050421-1.txt">
- <p>kimgio contains a PCX image file format reader that does
- not properly perform input validation. A source code audit
- performed by the KDE security team discovered several
- vulnerabilities in the PCX and other image file format
- readers, some of them exploitable to execute arbitrary
- code.</p>
+ <p>A KDE Security Advisory reports:</p> <blockquote
+ cite="http://www.kde.org/info/security/advisory-20050421-1.txt">
+ <p>kimgio contains a PCX image file format reader that
+ does
+ not properly perform input validation. A source code
+ audit performed by the KDE security team discovered
+ several vulnerabilities in the PCX and other image file
+ format readers, some of them exploitable to execute
+ arbitrary code.</p>
<p><strong>Impact:</strong> Remotely supplied, specially
crafted image files can be used to execute arbitrary
code.</p>
</blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2005-1046</cvename>
<url>http://bugs.kde.org/102328</url>
<url>http://www.kde.org/info/security/advisory-20050421-1.txt</url>
- </references>
- <dates>
- <discovery>2005-04-21</discovery>
- <entry>2005-04-22</entry>
+ </references> <dates>
+ <discovery>2005-04-21</discovery> <entry>2005-04-22</entry>
</dates>
</vuln>
@@ -6453,51 +5396,44 @@ Note: Please add new entries to the beginning of this file.
<topic>gld -- format string and buffer overflow vulnerabilities</topic>
<affects>
<package>
- <name>gld</name>
- <range><lt>1.5</lt></range>
+ <name>gld</name> <range><lt>1.5</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>Gld has been found vulnerable to multiple buffer overflows as
+ <p>Gld has been found vulnerable to multiple buffer overflows
+ as
well as multiple format string vulnerabilities.</p>
- <blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=111339935903880">
+ <blockquote
+ cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=111339935903880">
<p>An attacker could exploit this vulnerability to execute
- arbitrary code with the permissions of the user running Gld,
- the default user being root.</p>
- </blockquote>
- <p>The FreeBSD port defaults to running gld as the root user.
+ arbitrary code with the permissions of the user running
+ Gld, the default user being root.</p>
+ </blockquote> <p>The FreeBSD port defaults to running gld
+ as the root user.
The risk of exploitation can be minimized by making gld
- listen on the loopback address only, or configure it to only
- accept connections from trusted smtp servers.</p>
+ listen on the loopback address only, or configure it to
+ only accept connections from trusted smtp servers.</p>
</body>
- </description>
- <references>
- <bid>13129</bid>
- <bid>13133</bid>
- <cvename>CVE-2005-1099</cvename>
- <cvename>CVE-2005-1100</cvename>
- <mlist msgid="20050412004111.562AC7A890E@ws4-4.us4.outblaze.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=111339935903880</mlist>
- <mlist msgid="20050413174736.20947.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=111342432325670</mlist>
- </references>
- <dates>
- <discovery>2005-04-12</discovery>
- <entry>2005-04-19</entry>
+ </description> <references>
+ <bid>13129</bid> <bid>13133</bid> <cvename>CVE-2005-1099</cvename>
+ <cvename>CVE-2005-1100</cvename> <mlist
+ msgid="20050412004111.562AC7A890E@ws4-4.us4.outblaze.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=111339935903880</mlist>
+ <mlist
+ msgid="20050413174736.20947.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=111342432325670</mlist>
+ </references> <dates>
+ <discovery>2005-04-12</discovery> <entry>2005-04-19</entry>
</dates>
</vuln>
<vuln vid="0163b498-af54-11d9-acd0-000854d03344">
- <topic>axel -- remote buffer overflow</topic>
- <affects>
+ <topic>axel -- remote buffer overflow</topic> <affects>
<package>
- <name>axel</name>
- <range><lt>1.0a_4</lt></range>
+ <name>axel</name> <range><lt>1.0a_4</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>A Debian Security Advisory reports:</p>
- <blockquote cite="http://www.debian.org/security/2005/dsa-706">
+ <p>A Debian Security Advisory reports:</p> <blockquote
+ cite="http://www.debian.org/security/2005/dsa-706">
<p>Ulf Härnhammar from the Debian Security Audit Project
discovered a buffer overflow in axel, a light download
accelerator. When reading remote input the program did
@@ -6505,15 +5441,11 @@ Note: Please add new entries to the beginning of this file.
and maybe trigger the execution of arbitrary code.</p>
</blockquote>
</body>
- </description>
- <references>
- <bid>13059</bid>
- <cvename>CVE-2005-0390</cvename>
+ </description> <references>
+ <bid>13059</bid> <cvename>CVE-2005-0390</cvename>
<url>http://www.debian.org/security/2005/dsa-706</url>
- </references>
- <dates>
- <discovery>2005-04-16</discovery>
- <entry>2005-04-17</entry>
+ </references> <dates>
+ <discovery>2005-04-16</discovery> <entry>2005-04-17</entry>
</dates>
</vuln>
@@ -6521,43 +5453,38 @@ Note: Please add new entries to the beginning of this file.
<topic>firefox -- PLUGINSPAGE privileged javascript execution</topic>
<affects>
<package>
- <name>firefox</name>
- <range><lt>1.0.3,1</lt></range>
- </package>
- <package>
- <name>linux-firefox</name>
- <range><lt>1.0.3</lt></range>
+ <name>firefox</name> <range><lt>1.0.3,1</lt></range>
+ </package> <package>
+ <name>linux-firefox</name> <range><lt>1.0.3</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Mozilla Foundation Security Advisory reports:</p>
- <blockquote cite="http://www.mozilla.org/security/announce/mfsa2005-34.html">
+ <blockquote
+ cite="http://www.mozilla.org/security/announce/mfsa2005-34.html">
<p>When a webpage requires a plugin that is not installed
the user can click to launch the Plugin Finder Service
- (PFS) to find an appropriate plugin. If the service does
- not have an appropriate plugin the EMBED tag is checked
- for a PLUGINSPAGE attribute, and if one is found the PFS
- dialog will contain a "manual install" button that will
- load the PLUGINSPAGE url.</p>
+ (PFS) to find an appropriate plugin. If the service
+ does not have an appropriate plugin the EMBED tag is
+ checked for a PLUGINSPAGE attribute, and if one is found
+ the PFS dialog will contain a "manual install" button
+ that will load the PLUGINSPAGE url.</p>
<p>Omar Khan reported that if the PLUGINSPAGE attribute
- contains a javascript: url then pressing the button could
- launch arbitrary code capable of stealing local data or
- installing malicious code.</p>
- <p>Doron Rosenberg reported a variant that injects script by
+ contains a javascript: url then pressing the button
+ could launch arbitrary code capable of stealing local
+ data or installing malicious code.</p>
+ <p>Doron Rosenberg reported a variant that injects script
+ by
appending it to a malformed URL of any protocol.</p>
</blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2005-0752</cvename>
<url>http://www.mozilla.org/security/announce/mfsa2005-34.html</url>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=288556</url>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=289171</url>
- </references>
- <dates>
- <discovery>2005-03-31</discovery>
- <entry>2005-04-16</entry>
+ </references> <dates>
+ <discovery>2005-03-31</discovery> <entry>2005-04-16</entry>
</dates>
</vuln>
@@ -6565,87 +5492,64 @@ Note: Please add new entries to the beginning of this file.
<topic>jdk -- jar directory traversal vulnerability</topic>
<affects>
<package>
- <name>jdk</name>
- <range><le>1.2.2p11_3</le></range>
+ <name>jdk</name> <range><le>1.2.2p11_3</le></range>
<range><ge>1.3.*</ge><le>1.3.1p9_4</le></range>
<range><ge>1.4.*</ge><le>1.4.2p7</le></range>
<range><ge>1.5.*</ge><le>1.5.0p1_1</le></range>
- </package>
- <package>
- <name>linux-ibm-jdk</name>
- <range><le>1.4.2_1</le></range>
- </package>
- <package>
- <name>linux-sun-jdk</name>
- <range><le>1.4.2.08_1</le></range>
+ </package> <package>
+ <name>linux-ibm-jdk</name> <range><le>1.4.2_1</le></range>
+ </package> <package>
+ <name>linux-sun-jdk</name> <range><le>1.4.2.08_1</le></range>
<range><ge>1.5.*</ge><le>1.5.2.02,2</le></range>
+ </package> <package>
+ <name>linux-blackdown-jdk</name> <range><le>1.4.2_2</le></range>
+ </package> <package>
+ <name>diablo-jdk</name> <range><le>1.3.1.0_1</le></range>
+ </package> <package>
+ <name>linux-jdk</name> <range><ge>0</ge></range>
</package>
- <package>
- <name>linux-blackdown-jdk</name>
- <range><le>1.4.2_2</le></range>
- </package>
- <package>
- <name>diablo-jdk</name>
- <range><le>1.3.1.0_1</le></range>
- </package>
- <package>
- <name>linux-jdk</name>
- <range><ge>0</ge></range>
- </package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Pluf has discovered a vulnerability in Sun Java JDK/SDK,
- which potentially can be exploited by malicious people to
- compromise a user's system.</p>
- <blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=111331593310508">
- <p>The jar tool does not check properly if the files to be
+ which potentially can be exploited by malicious people
+ to compromise a user's system.</p>
+ <blockquote
+ cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=111331593310508">
+ <p>The jar tool does not check properly if the files to
+ be
extracted have the string "../" on its names, so it's
- possible for an attacker to create a malicious jar file in
- order to overwrite arbitrary files within the filesystem.</p>
+ possible for an attacker to create a malicious jar file
+ in order to overwrite arbitrary files within the
+ filesystem.</p>
</blockquote>
</body>
- </description>
- <references>
- <cvename>CVE-2005-1080</cvename>
- <mlist msgid="200504120226.10559.pluf@7a69ezine.org">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=111331593310508</mlist>
+ </description> <references>
+ <cvename>CVE-2005-1080</cvename> <mlist
+ msgid="200504120226.10559.pluf@7a69ezine.org">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=111331593310508</mlist>
<url>http://www.securiteam.com/securitynews/5IP0C0AFGW.html</url>
<url>http://secunia.com/advisories/14902/</url>
- </references>
- <dates>
- <discovery>2005-04-11</discovery>
- <entry>2005-04-16</entry>
+ </references> <dates>
+ <discovery>2005-04-11</discovery> <entry>2005-04-16</entry>
<modified>2005-05-02</modified>
</dates>
</vuln>
<vuln vid="f650d5b8-ae62-11d9-a788-0001020eed82">
- <topic>mozilla -- privilege escalation via DOM property overrides</topic>
- <affects>
- <package>
- <name>firefox</name>
- <range><lt>1.0.3,1</lt></range>
- </package>
- <package>
- <name>linux-firefox</name>
- <range><lt>1.0.3</lt></range>
- </package>
- <package>
- <name>mozilla</name>
- <range><lt>1.7.7,2</lt></range>
+ <topic>mozilla -- privilege escalation via DOM property
+ overrides</topic> <affects>
+ <package>
+ <name>firefox</name> <range><lt>1.0.3,1</lt></range>
+ </package> <package>
+ <name>linux-firefox</name> <range><lt>1.0.3</lt></range>
+ </package> <package>
+ <name>mozilla</name> <range><lt>1.7.7,2</lt></range>
<range><ge>1.8.*,2</ge></range>
- </package>
- <package>
- <name>linux-mozilla</name>
- <name>linux-mozilla-devel</name>
- <range><lt>1.7.7</lt></range>
- <range><ge>1.8.*</ge></range>
- </package>
- <package>
- <name>netscape7</name>
- <range><ge>0</ge></range>
- </package>
- <package>
+ </package> <package>
+ <name>linux-mozilla</name> <name>linux-mozilla-devel</name>
+ <range><lt>1.7.7</lt></range> <range><ge>1.8.*</ge></range>
+ </package> <package>
+ <name>netscape7</name> <range><ge>0</ge></range>
+ </package> <package>
<!-- These ports are obsolete. -->
<name>de-linux-mozillafirebird</name>
<name>el-linux-mozillafirebird</name>
@@ -6654,68 +5558,56 @@ Note: Please add new entries to the beginning of this file.
<name>linux-mozillafirebird</name>
<name>ru-linux-mozillafirebird</name>
<name>zhCN-linux-mozillafirebird</name>
- <name>zhTW-linux-mozillafirebird</name>
- <range><ge>0</ge></range>
- </package>
- <package>
+ <name>zhTW-linux-mozillafirebird</name> <range><ge>0</ge></range>
+ </package> <package>
<!-- These package names are obsolete. -->
- <name>de-linux-netscape</name>
- <name>de-netscape7</name>
- <name>fr-linux-netscape</name>
- <name>fr-netscape7</name>
- <name>ja-linux-netscape</name>
- <name>ja-netscape7</name>
- <name>linux-netscape</name>
- <name>linux-phoenix</name>
- <name>mozilla+ipv6</name>
- <name>mozilla-embedded</name>
- <name>mozilla-firebird</name>
- <name>mozilla-gtk1</name>
- <name>mozilla-gtk2</name>
- <name>mozilla-gtk</name>
- <name>mozilla-thunderbird</name>
- <name>phoenix</name>
- <name>pt_BR-netscape7</name>
- <range><ge>0</ge></range>
- </package>
- </affects>
- <description>
+ <name>de-linux-netscape</name> <name>de-netscape7</name>
+ <name>fr-linux-netscape</name> <name>fr-netscape7</name>
+ <name>ja-linux-netscape</name> <name>ja-netscape7</name>
+ <name>linux-netscape</name> <name>linux-phoenix</name>
+ <name>mozilla+ipv6</name> <name>mozilla-embedded</name>
+ <name>mozilla-firebird</name> <name>mozilla-gtk1</name>
+ <name>mozilla-gtk2</name> <name>mozilla-gtk</name>
+ <name>mozilla-thunderbird</name> <name>phoenix</name>
+ <name>pt_BR-netscape7</name> <range><ge>0</ge></range>
+ </package>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Mozilla Foundation Security Advisory reports:</p>
- <blockquote cite="http://www.mozilla.org/security/announce/mfsa2005-41.html">
- <p>moz_bug_r_a4 reported several exploits giving an attacker
+ <blockquote
+ cite="http://www.mozilla.org/security/announce/mfsa2005-41.html">
+ <p>moz_bug_r_a4 reported several exploits giving an
+ attacker
the ability to install malicious code or steal data,
- requiring only that the user do commonplace actions like
- click on a link or open the context menu. The common cause
- in each case was privileged UI code ("chrome") being
- overly trusting of DOM nodes from the content
- window. Scripts in the web page can override properties
- and methods of DOM nodes and shadow the native values,
- unless steps are taken to get the true underlying values.</p>
+ requiring only that the user do commonplace actions
+ like click on a link or open the context menu. The
+ common cause in each case was privileged UI code
+ ("chrome") being overly trusting of DOM nodes from the
+ content window. Scripts in the web page can override
+ properties and methods of DOM nodes and shadow the
+ native values, unless steps are taken to get the true
+ underlying values.</p>
<p>We found that most extensions also interacted with
- content DOM in a natural, but unsafe, manner. Changes were
- made so that chrome code using this natural DOM coding
- style will now automatically use the native DOM value if
- it exists without having to use cumbersome wrapper
- objects.</p>
+ content DOM in a natural, but unsafe, manner. Changes
+ were made so that chrome code using this natural DOM
+ coding style will now automatically use the native DOM
+ value if it exists without having to use cumbersome
+ wrapper objects.</p>
<p>Most of the specific exploits involved tricking the
- privileged code into calling eval() on an
- attacker-supplied script string, or the equivalent using
- the Script() object. Checks were added in the security
- manager to make sure eval and Script objects are run with
- the privileges of the context that created them, not the
+ privileged code into calling eval() on an attacker-supplied
+ script string, or the equivalent using the Script()
+ object. Checks were added in the security manager to
+ make sure eval and Script objects are run with the
+ privileges of the context that created them, not the
potentially elevated privileges of the context calling
them.</p>
<p><strong>Workaround</strong>: Disable Javascript</p>
</blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<url>http://www.mozilla.org/security/announce/mfsa2005-41.html</url>
- </references>
- <dates>
- <discovery>2005-04-15</discovery>
- <entry>2005-04-16</entry>
+ </references> <dates>
+ <discovery>2005-04-15</discovery> <entry>2005-04-16</entry>
</dates>
</vuln>
@@ -6723,29 +5615,18 @@ Note: Please add new entries to the beginning of this file.
<topic>mozilla -- code execution through javascript: favicons</topic>
<affects>
<package>
- <name>firefox</name>
- <range><lt>1.0.3,1</lt></range>
- </package>
- <package>
- <name>linux-firefox</name>
- <range><lt>1.0.3</lt></range>
- </package>
- <package>
- <name>mozilla</name>
- <range><lt>1.7.7,2</lt></range>
+ <name>firefox</name> <range><lt>1.0.3,1</lt></range>
+ </package> <package>
+ <name>linux-firefox</name> <range><lt>1.0.3</lt></range>
+ </package> <package>
+ <name>mozilla</name> <range><lt>1.7.7,2</lt></range>
<range><ge>1.8.*,2</ge></range>
- </package>
- <package>
- <name>linux-mozilla</name>
- <name>linux-mozilla-devel</name>
- <range><lt>1.7.7</lt></range>
- <range><ge>1.8.*</ge></range>
- </package>
- <package>
- <name>netscape7</name>
- <range><ge>0</ge></range>
- </package>
- <package>
+ </package> <package>
+ <name>linux-mozilla</name> <name>linux-mozilla-devel</name>
+ <range><lt>1.7.7</lt></range> <range><ge>1.8.*</ge></range>
+ </package> <package>
+ <name>netscape7</name> <range><ge>0</ge></range>
+ </package> <package>
<!-- These ports are obsolete. -->
<name>de-linux-mozillafirebird</name>
<name>el-linux-mozillafirebird</name>
@@ -6754,50 +5635,36 @@ Note: Please add new entries to the beginning of this file.
<name>linux-mozillafirebird</name>
<name>ru-linux-mozillafirebird</name>
<name>zhCN-linux-mozillafirebird</name>
- <name>zhTW-linux-mozillafirebird</name>
- <range><ge>0</ge></range>
- </package>
- <package>
+ <name>zhTW-linux-mozillafirebird</name> <range><ge>0</ge></range>
+ </package> <package>
<!-- These package names are obsolete. -->
- <name>de-linux-netscape</name>
- <name>de-netscape7</name>
- <name>fr-linux-netscape</name>
- <name>fr-netscape7</name>
- <name>ja-linux-netscape</name>
- <name>ja-netscape7</name>
- <name>linux-netscape</name>
- <name>linux-phoenix</name>
- <name>mozilla+ipv6</name>
- <name>mozilla-embedded</name>
- <name>mozilla-firebird</name>
- <name>mozilla-gtk1</name>
- <name>mozilla-gtk2</name>
- <name>mozilla-gtk</name>
- <name>mozilla-thunderbird</name>
- <name>phoenix</name>
- <name>pt_BR-netscape7</name>
- <range><ge>0</ge></range>
- </package>
- </affects>
- <description>
+ <name>de-linux-netscape</name> <name>de-netscape7</name>
+ <name>fr-linux-netscape</name> <name>fr-netscape7</name>
+ <name>ja-linux-netscape</name> <name>ja-netscape7</name>
+ <name>linux-netscape</name> <name>linux-phoenix</name>
+ <name>mozilla+ipv6</name> <name>mozilla-embedded</name>
+ <name>mozilla-firebird</name> <name>mozilla-gtk1</name>
+ <name>mozilla-gtk2</name> <name>mozilla-gtk</name>
+ <name>mozilla-thunderbird</name> <name>phoenix</name>
+ <name>pt_BR-netscape7</name> <range><ge>0</ge></range>
+ </package>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Mozilla Foundation Security Advisory reports:</p>
- <blockquote cite="http://www.mozilla.org/security/announce/mfsa2005-37.html">
+ <blockquote
+ cite="http://www.mozilla.org/security/announce/mfsa2005-37.html">
<p>Firefox and the Mozilla Suite support custom "favicons"
- through the &lt;LINK rel="icon"&gt; tag. If a link tag is added
- to the page programmatically and a javascript: url is
- used, then script will run with elevated privileges and
- could run or install malicious software.</p>
+ through the &lt;LINK rel="icon"&gt; tag. If a link tag
+ is added to the page programmatically and a javascript:
+ url is used, then script will run with elevated privileges
+ and could run or install malicious software.</p>
<p><strong>Workaround</strong>: Disable Javascript</p>
</blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<url>http://www.mozilla.org/security/announce/mfsa2005-37.html</url>
- </references>
- <dates>
- <discovery>2005-04-12</discovery>
- <entry>2005-04-16</entry>
+ </references> <dates>
+ <discovery>2005-04-12</discovery> <entry>2005-04-16</entry>
</dates>
</vuln>
@@ -6806,29 +5673,18 @@ Note: Please add new entries to the beginning of this file.
contents</topic>
<affects>
<package>
- <name>firefox</name>
- <range><lt>1.0.3,1</lt></range>
- </package>
- <package>
- <name>linux-firefox</name>
- <range><lt>1.0.3</lt></range>
- </package>
- <package>
- <name>mozilla</name>
- <range><lt>1.7.7,2</lt></range>
+ <name>firefox</name> <range><lt>1.0.3,1</lt></range>
+ </package> <package>
+ <name>linux-firefox</name> <range><lt>1.0.3</lt></range>
+ </package> <package>
+ <name>mozilla</name> <range><lt>1.7.7,2</lt></range>
<range><ge>1.8.*,2</ge></range>
- </package>
- <package>
- <name>linux-mozilla</name>
- <name>linux-mozilla-devel</name>
- <range><lt>1.7.7</lt></range>
- <range><ge>1.8.*</ge></range>
- </package>
- <package>
- <name>netscape7</name>
- <range><ge>0</ge></range>
- </package>
- <package>
+ </package> <package>
+ <name>linux-mozilla</name> <name>linux-mozilla-devel</name>
+ <range><lt>1.7.7</lt></range> <range><ge>1.8.*</ge></range>
+ </package> <package>
+ <name>netscape7</name> <range><ge>0</ge></range>
+ </package> <package>
<!-- These ports are obsolete. -->
<name>de-linux-mozillafirebird</name>
<name>el-linux-mozillafirebird</name>
@@ -6837,35 +5693,24 @@ Note: Please add new entries to the beginning of this file.
<name>linux-mozillafirebird</name>
<name>ru-linux-mozillafirebird</name>
<name>zhCN-linux-mozillafirebird</name>
- <name>zhTW-linux-mozillafirebird</name>
- <range><ge>0</ge></range>
- </package>
- <package>
+ <name>zhTW-linux-mozillafirebird</name> <range><ge>0</ge></range>
+ </package> <package>
<!-- These package names are obsolete. -->
- <name>de-linux-netscape</name>
- <name>de-netscape7</name>
- <name>fr-linux-netscape</name>
- <name>fr-netscape7</name>
- <name>ja-linux-netscape</name>
- <name>ja-netscape7</name>
- <name>linux-netscape</name>
- <name>linux-phoenix</name>
- <name>mozilla+ipv6</name>
- <name>mozilla-embedded</name>
- <name>mozilla-firebird</name>
- <name>mozilla-gtk1</name>
- <name>mozilla-gtk2</name>
- <name>mozilla-gtk</name>
- <name>mozilla-thunderbird</name>
- <name>phoenix</name>
- <name>pt_BR-netscape7</name>
- <range><ge>0</ge></range>
- </package>
- </affects>
- <description>
+ <name>de-linux-netscape</name> <name>de-netscape7</name>
+ <name>fr-linux-netscape</name> <name>fr-netscape7</name>
+ <name>ja-linux-netscape</name> <name>ja-netscape7</name>
+ <name>linux-netscape</name> <name>linux-phoenix</name>
+ <name>mozilla+ipv6</name> <name>mozilla-embedded</name>
+ <name>mozilla-firebird</name> <name>mozilla-gtk1</name>
+ <name>mozilla-gtk2</name> <name>mozilla-gtk</name>
+ <name>mozilla-thunderbird</name> <name>phoenix</name>
+ <name>pt_BR-netscape7</name> <range><ge>0</ge></range>
+ </package>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Mozilla Foundation Security Advisory reports:</p>
- <blockquote cite="http://www.mozilla.org/security/announce/mfsa2005-33.html">
+ <blockquote
+ cite="http://www.mozilla.org/security/announce/mfsa2005-33.html">
<p>A bug in javascript's regular expression string
replacement when using an anonymous function as the
replacement argument allows a malicious script to capture
@@ -6875,15 +5720,12 @@ Note: Please add new entries to the beginning of this file.
<p><strong>Workaround</strong>: Disable Javascript</p>
</blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2005-0989</cvename>
<url>http://www.mozilla.org/security/announce/mfsa2005-33.html</url>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=288688</url>
- </references>
- <dates>
- <discovery>2005-04-01</discovery>
- <entry>2005-04-16</entry>
+ </references> <dates>
+ <discovery>2005-04-01</discovery> <entry>2005-04-16</entry>
</dates>
</vuln>
@@ -6891,34 +5733,28 @@ Note: Please add new entries to the beginning of this file.
<topic>firefox -- arbitrary code execution in sidebar panel</topic>
<affects>
<package>
- <name>firefox</name>
- <range><lt>1.0.3,1</lt></range>
- </package>
- <package>
- <name>linux-firefox</name>
- <range><lt>1.0.3</lt></range>
+ <name>firefox</name> <range><lt>1.0.3,1</lt></range>
+ </package> <package>
+ <name>linux-firefox</name> <range><lt>1.0.3</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Mozilla Foundation Security Advisory reports:</p>
- <blockquote cite="http://www.mozilla.org/security/announce/mfsa2005-39.html">
+ <blockquote
+ cite="http://www.mozilla.org/security/announce/mfsa2005-39.html">
<p>Sites can use the _search target to open links in the
Firefox sidebar. Two missing security checks allow
- malicious scripts to first open a privileged page (such as
- about:config) and then inject script using a javascript:
- url. This could be used to install malicious code or steal
- data without user interaction.</p>
+ malicious scripts to first open a privileged page (such
+ as about:config) and then inject script using a javascript:
+ url. This could be used to install malicious code or
+ steal data without user interaction.</p>
<p><strong>Workaround</strong>: Disable Javascript</p>
</blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<url>http://www.mozilla.org/security/announce/mfsa2005-39.html</url>
- </references>
- <dates>
- <discovery>2005-04-12</discovery>
- <entry>2005-04-16</entry>
+ </references> <dates>
+ <discovery>2005-04-12</discovery> <entry>2005-04-16</entry>
</dates>
</vuln>
@@ -6926,73 +5762,48 @@ Note: Please add new entries to the beginning of this file.
<topic>openoffice -- DOC document heap overflow vulnerability</topic>
<affects>
<package>
- <name>openoffice</name>
- <name>ar-openoffice</name>
- <name>ca-openoffice</name>
- <name>cs-openoffice</name>
- <name>de-openoffice</name>
- <name>dk-openoffice</name>
- <name>el-openoffice</name>
- <name>es-openoffice</name>
- <name>et-openoffice</name>
- <name>fi-openoffice</name>
- <name>fr-openoffice</name>
- <name>gr-openoffice</name>
- <name>hu-openoffice</name>
- <name>it-openoffice</name>
- <name>ja-openoffice</name>
- <name>ko-openoffice</name>
- <name>nl-openoffice</name>
- <name>pl-openoffice</name>
- <name>pt-openoffice</name>
- <name>pt_BR-openoffice</name>
- <name>ru-openoffice</name>
- <name>se-openoffice</name>
- <name>sk-openoffice</name>
- <name>sl-openoffice-SI</name>
- <name>tr-openoffice</name>
- <name>zh-openoffice-CN</name>
- <name>zh-openoffice-TW</name>
- <!-- Deprecated names -->
- <name>jp-openoffice</name>
- <name>kr-openoffice</name>
- <name>sl-openoffice-SL</name>
- <name>zh-openoffice</name>
- <name>zh_TW-openoffice</name>
- <range><lt>1.1.4_2</lt></range>
+ <name>openoffice</name> <name>ar-openoffice</name>
+ <name>ca-openoffice</name> <name>cs-openoffice</name>
+ <name>de-openoffice</name> <name>dk-openoffice</name>
+ <name>el-openoffice</name> <name>es-openoffice</name>
+ <name>et-openoffice</name> <name>fi-openoffice</name>
+ <name>fr-openoffice</name> <name>gr-openoffice</name>
+ <name>hu-openoffice</name> <name>it-openoffice</name>
+ <name>ja-openoffice</name> <name>ko-openoffice</name>
+ <name>nl-openoffice</name> <name>pl-openoffice</name>
+ <name>pt-openoffice</name> <name>pt_BR-openoffice</name>
+ <name>ru-openoffice</name> <name>se-openoffice</name>
+ <name>sk-openoffice</name> <name>sl-openoffice-SI</name>
+ <name>tr-openoffice</name> <name>zh-openoffice-CN</name>
+ <name>zh-openoffice-TW</name> <!-- Deprecated names -->
+ <name>jp-openoffice</name> <name>kr-openoffice</name>
+ <name>sl-openoffice-SL</name> <name>zh-openoffice</name>
+ <name>zh_TW-openoffice</name> <range><lt>1.1.4_2</lt></range>
<range><gt>2.*</gt><le>2.0.20050406</le></range>
- </package>
- <package>
- <name>openoffice</name>
- <name>ja-openoffice</name>
+ </package> <package>
+ <name>openoffice</name> <name>ja-openoffice</name>
<range><ge>6.0.a609</ge><le>6.0.a638</le></range>
<range><ge>641c</ge><le>645</le></range>
- <range><eq>1.1RC4</eq></range>
- <range><eq>1.1rc5</eq></range>
+ <range><eq>1.1RC4</eq></range> <range><eq>1.1rc5</eq></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>AD-LAB reports that a heap-based buffer overflow
vulnerability exists in OpenOffice's handling of DOC
- documents. When reading a DOC document 16 bit from a 32 bit
- integer is used for memory allocation, but the full 32 bit
- is used for further processing of the document. This can
- allow an attacker to crash OpenOffice, or potentially
- execute arbitrary code as the user running OpenOffice, by
- tricking an user into opening a specially crafted DOC
- document.</p>
- </body>
- </description>
- <references>
- <bid>13092</bid>
- <cvename>CVE-2005-0941</cvename>
- <mlist msgid="20050412000438.17342.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=111325305109137</mlist>
+ documents. When reading a DOC document 16 bit from a 32
+ bit integer is used for memory allocation, but the full
+ 32 bit is used for further processing of the document.
+ This can allow an attacker to crash OpenOffice, or
+ potentially execute arbitrary code as the user running
+ OpenOffice, by tricking an user into opening a specially
+ crafted DOC document.</p>
+ </body>
+ </description> <references>
+ <bid>13092</bid> <cvename>CVE-2005-0941</cvename> <mlist
+ msgid="20050412000438.17342.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=111325305109137</mlist>
<url>http://www.openoffice.org/issues/show_bug.cgi?id=46388</url>
- </references>
- <dates>
- <discovery>2005-04-11</discovery>
- <entry>2005-04-13</entry>
+ </references> <dates>
+ <discovery>2005-04-11</discovery> <entry>2005-04-13</entry>
<modified>2005-04-20</modified>
</dates>
</vuln>
@@ -7002,18 +5813,16 @@ Note: Please add new entries to the beginning of this file.
vulnerability</topic>
<affects>
<package>
- <name>portupgrade</name>
- <range><lt>20041226_2</lt></range>
+ <name>portupgrade</name> <range><lt>20041226_2</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Simon L. Nielsen discovered that portupgrade handles
- temporary files in an insecure manner. This could allow an
- unprivileged local attacker to execute arbitrary commands or
- overwrite arbitrary files with the permissions of the user
- running portupgrade, typically root, by way of a symlink
- attack.</p>
+ temporary files in an insecure manner. This could allow
+ an unprivileged local attacker to execute arbitrary
+ commands or overwrite arbitrary files with the permissions
+ of the user running portupgrade, typically root, by way
+ of a symlink attack.</p>
<p>The following issues exist where the temporary files are
created, by default in the world writeable directory
/var/tmp, with the permissions of the user running
@@ -7029,91 +5838,73 @@ Note: Please add new entries to the beginning of this file.
the old package to a predictable temporary file, allowing
an attacker to overwrite arbitrary files via a symlink
attack.</li>
- <li>portupgrade will <q>touch</q> a temporary temporary file
+ <li>portupgrade will <q>touch</q> a temporary temporary
+ file
with a constant filename (pkgdb.fixme) allowing an
- attacker to create arbitrary zero-byte files via a symlink
- attack.</li>
- </ul>
- <p>A workaround for these issues is to set the
+ attacker to create arbitrary zero-byte files via a
+ symlink attack.</li>
+ </ul> <p>A workaround for these issues is to set the
<code>PKG_TMPDIR</code> environment variable to a directory
only write-able by the user running portupgrade.</p>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2005-0610</cvename>
- </references>
- <dates>
- <discovery>2005-04-12</discovery>
- <entry>2005-04-12</entry>
+ </references> <dates>
+ <discovery>2005-04-12</discovery> <entry>2005-04-12</entry>
</dates>
</vuln>
<vuln vid="ecf68408-a9f5-11d9-a788-0001020eed82">
- <topic>gaim -- jabber remote crash</topic>
- <affects>
+ <topic>gaim -- jabber remote crash</topic> <affects>
<package>
- <name>gaim</name>
- <name>ja-gaim</name>
- <name>ko-gaim</name>
- <name>ru-gaim</name>
- <range><lt>1.2.1</lt></range>
+ <name>gaim</name> <name>ja-gaim</name> <name>ko-gaim</name>
+ <name>ru-gaim</name> <range><lt>1.2.1</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>The GAIM team reports:</p>
- <blockquote cite="http://gaim.sourceforge.net/security/?id=15">
- <p>A remote jabber user can cause Gaim to crash by sending a
+ <p>The GAIM team reports:</p> <blockquote
+ cite="http://gaim.sourceforge.net/security/?id=15">
+ <p>A remote jabber user can cause Gaim to crash by sending
+ a
specific file transfer request.</p>
</blockquote>
</body>
- </description>
- <references>
- <bid>13004</bid>
- <cvename>CVE-2005-0967</cvename>
+ </description> <references>
+ <bid>13004</bid> <cvename>CVE-2005-0967</cvename>
<url>http://gaim.sourceforge.net/security/?id=15</url>
- </references>
- <dates>
- <discovery>2005-04-04</discovery>
- <entry>2005-04-10</entry>
+ </references> <dates>
+ <discovery>2005-04-04</discovery> <entry>2005-04-10</entry>
</dates>
</vuln>
<vuln vid="ec09baa3-a9f5-11d9-a788-0001020eed82">
- <topic>gaim -- remote DoS on receiving certain messages over IRC</topic>
- <affects>
+ <topic>gaim -- remote DoS on receiving certain messages over
+ IRC</topic> <affects>
<package>
- <name>gaim</name>
- <name>ja-gaim</name>
- <name>ko-gaim</name>
- <name>ru-gaim</name>
- <range><lt>1.2.1</lt></range>
+ <name>gaim</name> <name>ja-gaim</name> <name>ko-gaim</name>
+ <name>ru-gaim</name> <range><lt>1.2.1</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>The GAIM team reports:</p>
- <blockquote cite="http://gaim.sourceforge.net/security/?id=14">
+ <p>The GAIM team reports:</p> <blockquote
+ cite="http://gaim.sourceforge.net/security/?id=14">
<p>The IRC protocol plugin in Gaim 1.2.0, and possibly
earlier versions, allows (1) remote attackers to inject
arbitrary Gaim markup via irc_msg_kick, irc_msg_mode,
- irc_msg_part, irc_msg_quit, (2) remote attackers to inject
- arbitrary Pango markup and pop up empty dialog boxes via
- irc_msg_invite, or (3) malicious IRC servers to cause a
- denial of service (application crash) by injecting certain
- Pango markup into irc_msg_badmode, irc_msg_banned,
- irc_msg_unknown, irc_msg_nochan functions.</p>
+ irc_msg_part, irc_msg_quit, (2) remote attackers to
+ inject arbitrary Pango markup and pop up empty dialog
+ boxes via irc_msg_invite, or (3) malicious IRC servers
+ to cause a denial of service (application crash) by
+ injecting certain Pango markup into irc_msg_badmode,
+ irc_msg_banned, irc_msg_unknown, irc_msg_nochan
+ functions.</p>
</blockquote>
</body>
- </description>
- <references>
- <bid>13003</bid>
- <cvename>CVE-2005-0966</cvename>
+ </description> <references>
+ <bid>13003</bid> <cvename>CVE-2005-0966</cvename>
<url>http://gaim.sourceforge.net/security/?id=14</url>
- </references>
- <dates>
- <discovery>2005-04-02</discovery>
- <entry>2005-04-10</entry>
+ </references> <dates>
+ <discovery>2005-04-02</discovery> <entry>2005-04-10</entry>
</dates>
</vuln>
@@ -7121,75 +5912,56 @@ Note: Please add new entries to the beginning of this file.
<topic>gaim -- remote DoS on receiving malformed HTML</topic>
<affects>
<package>
- <name>gaim</name>
- <name>ja-gaim</name>
- <name>ko-gaim</name>
- <name>ru-gaim</name>
- <range><lt>1.2.1</lt></range>
+ <name>gaim</name> <name>ja-gaim</name> <name>ko-gaim</name>
+ <name>ru-gaim</name> <range><lt>1.2.1</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>The GAIM team reports:</p>
- <blockquote cite="http://gaim.sourceforge.net/security/?id=13">
+ <p>The GAIM team reports:</p> <blockquote
+ cite="http://gaim.sourceforge.net/security/?id=13">
<p>The gaim_markup_strip_html function in Gaim 1.2.0, and
possibly earlier versions, allows remote attackers to
- cause a denial of service (application crash) via a string
- that contains malformed HTML, which causes an
+ cause a denial of service (application crash) via a
+ string that contains malformed HTML, which causes an
out-of-bounds read.</p>
</blockquote>
</body>
- </description>
- <references>
- <bid>12999</bid>
- <cvename>CVE-2005-0965</cvename>
+ </description> <references>
+ <bid>12999</bid> <cvename>CVE-2005-0965</cvename>
<url>http://gaim.sourceforge.net/security/?id=13</url>
- </references>
- <dates>
- <discovery>2005-04-02</discovery>
- <entry>2005-04-10</entry>
+ </references> <dates>
+ <discovery>2005-04-02</discovery> <entry>2005-04-10</entry>
</dates>
</vuln>
<vuln vid="07f3fe15-a9de-11d9-a788-0001020eed82">
- <topic>php -- readfile() DoS vulnerability</topic>
- <affects>
+ <topic>php -- readfile() DoS vulnerability</topic> <affects>
<package>
- <name>mod_php4-twig</name>
- <name>php4-cgi</name>
- <name>php4-cli</name>
- <name>php4-dtc</name>
- <name>php4-horde</name>
- <name>php4-nms</name>
- <name>php4</name>
+ <name>mod_php4-twig</name> <name>php4-cgi</name>
+ <name>php4-cli</name> <name>php4-dtc</name> <name>php4-horde</name>
+ <name>php4-nms</name> <name>php4</name>
<range><lt>4.3.5_7</lt></range>
- </package>
- <package>
- <name>mod_php</name>
- <name>mod_php4</name>
+ </package> <package>
+ <name>mod_php</name> <name>mod_php4</name>
<range><lt>4.3.5_7,1</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>A SUSE Security advisory reports:</p>
- <blockquote cite="http://www.novell.com/linux/security/advisories/2005_06_sr.html">
- <p>A bug in the readfile() function of php4 could be used to
+ <p>A SUSE Security advisory reports:</p> <blockquote
+ cite="http://www.novell.com/linux/security/advisories/2005_06_sr.html">
+ <p>A bug in the readfile() function of php4 could be used
+ to
to crash the httpd running the php4 code when accessing
files with a multiple of the architectures page size
leading to a denial of service.</p>
</blockquote>
</body>
- </description>
- <references>
- <bid>12665</bid>
- <cvename>CVE-2005-0596</cvename>
+ </description> <references>
+ <bid>12665</bid> <cvename>CVE-2005-0596</cvename>
<url>http://bugs.php.net/bug.php?id=27037</url>
<url>http://www.novell.com/linux/security/advisories/2005_06_sr.html</url>
- </references>
- <dates>
- <discovery>2004-01-25</discovery>
- <entry>2005-04-10</entry>
+ </references> <dates>
+ <discovery>2004-01-25</discovery> <entry>2005-04-10</entry>
</dates>
</vuln>
@@ -7197,65 +5969,58 @@ Note: Please add new entries to the beginning of this file.
<topic>squid -- DoS on failed PUT/POST requests vulnerability</topic>
<affects>
<package>
- <name>squid</name>
- <range><le>2.5.7_12</le></range>
+ <name>squid</name> <range><le>2.5.7_12</le></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>The squid patches page notes:</p>
- <blockquote cite="http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-post">
+ <p>The squid patches page notes:</p> <blockquote
+ cite="http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-post">
<p>An inconsistent state is entered on a failed PUT/POST
request making a high risk for segmentation faults or
other strange errors</p>
</blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2005-0718</cvename>
<url>http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-post</url>
<url>http://www.squid-cache.org/bugs/show_bug.cgi?id=1224</url>
- </references>
- <dates>
- <discovery>2005-02-03</discovery>
- <entry>2005-04-10</entry>
+ </references> <dates>
+ <discovery>2005-02-03</discovery> <entry>2005-04-10</entry>
</dates>
</vuln>
<vuln vid="396ee517-a607-11d9-ac72-000bdb1444a4">
- <topic>horde -- Horde Page Title Cross-Site Scripting Vulnerability</topic>
- <affects>
+ <topic>horde -- Horde Page Title Cross-Site Scripting
+ Vulnerability</topic> <affects>
<package>
- <name>horde</name>
- <name>horde-php5</name>
+ <name>horde</name> <name>horde-php5</name>
<range><gt>3.*</gt><lt>3.0.4</lt></range>
</package>
- </affects>
- <description>
- <body xmlns="http://www.w3.org/1999/xhtml">
- <p>Secunia Advisory: SA14730</p>
- <blockquote cite="http://secunia.com/advisories/14730">
- <p>A vulnerability has been reported in Horde, which can be
- exploited by malicious people to conduct cross-site scripting
- attacks.</p>
- <p>Input passed when setting the parent frame's page title via
- JavaScript is not properly sanitised before being returned to
- the user. This can be exploited to execute arbitrary HTML and
- script code in a user's browser session in context of an affected
- site.</p>
- <p>The vulnerability has been reported in version 3.0.4-RC2. Prior
+ </affects> <description>
+ <body xmlns="http://www.w3.org/1999/xhtml">
+ <p>Secunia Advisory: SA14730</p> <blockquote
+ cite="http://secunia.com/advisories/14730">
+ <p>A vulnerability has been reported in Horde, which can
+ be
+ exploited by malicious people to conduct cross-site
+ scripting attacks.</p>
+ <p>Input passed when setting the parent frame's page title
+ via
+ JavaScript is not properly sanitised before being
+ returned to the user. This can be exploited to execute
+ arbitrary HTML and script code in a user's browser
+ session in context of an affected site.</p>
+ <p>The vulnerability has been reported in version 3.0.4-RC2.
+ Prior
versions may also be affected.</p>
</blockquote>
</body>
- </description>
- <references>
- <cvename>CVE-2005-0961</cvename>
- <mlist msgid="20050329111028.6A112117243@neo.wg.de">http://lists.horde.org/archives/announce/2005/000176.html</mlist>
+ </description> <references>
+ <cvename>CVE-2005-0961</cvename> <mlist
+ msgid="20050329111028.6A112117243@neo.wg.de">http://lists.horde.org/archives/announce/2005/000176.html</mlist>
<url>http://cvs.horde.org/diff.php/horde/docs/CHANGES?r1=1.515.2.49&amp;r2=1.515.2.93&amp;ty=h</url>
- </references>
- <dates>
- <discovery>2005-03-29</discovery>
- <entry>2005-04-05</entry>
+ </references> <dates>
+ <discovery>2005-03-29</discovery> <entry>2005-04-05</entry>
</dates>
</vuln>
@@ -7263,100 +6028,82 @@ Note: Please add new entries to the beginning of this file.
<topic>wu-ftpd -- remote globbing DoS vulnerability</topic>
<affects>
<package>
- <name>wu-ftpd</name>
- <range><lt>2.6.2_6</lt></range>
- </package>
- <package>
- <name>wu-ftpd+ipv6</name>
- <range><lt>2.6.2_7</lt></range>
+ <name>wu-ftpd</name> <range><lt>2.6.2_6</lt></range>
+ </package> <package>
+ <name>wu-ftpd+ipv6</name> <range><lt>2.6.2_7</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>An iDEFENSE Security Advisory reports:</p>
- <blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110935886414939">
+ <p>An iDEFENSE Security Advisory reports:</p> <blockquote
+ cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110935886414939">
<p>Remote exploitation of an input validation vulnerability
- in version 2.6.2 of WU-FPTD could allow for a denial of
- service of the system by resource exhaustion.</p>
+ in version 2.6.2 of WU-FPTD could allow for a denial
+ of service of the system by resource exhaustion.</p>
<p>The vulnerability specifically exists in the
- <code>wu_fnmatch()</code> function in wu_fnmatch.c. When a
- pattern containing a '*' character is supplied as input,
- the function calls itself recursively on a smaller
- substring. By supplying a string which contains a large
- number of '*' characters, the system will take a long time
- to return the results, during which time it will be using
- a large amount of CPU time.</p>
+ <code>wu_fnmatch()</code> function in wu_fnmatch.c.
+ When a pattern containing a '*' character is supplied
+ as input, the function calls itself recursively on a
+ smaller substring. By supplying a string which contains
+ a large number of '*' characters, the system will take
+ a long time to return the results, during which time
+ it will be using a large amount of CPU time.</p>
</blockquote>
</body>
- </description>
- <references>
- <cvename>CVE-2005-0256</cvename>
- <mlist msgid="FB24803D1DF2A34FA59FC157B77C970503E249AF@idserv04.idef.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110935886414939</mlist>
- </references>
- <dates>
- <discovery>2005-02-05</discovery>
- <entry>2005-04-04</entry>
+ </description> <references>
+ <cvename>CVE-2005-0256</cvename> <mlist
+ msgid="FB24803D1DF2A34FA59FC157B77C970503E249AF@idserv04.idef.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110935886414939</mlist>
+ </references> <dates>
+ <discovery>2005-02-05</discovery> <entry>2005-04-04</entry>
</dates>
</vuln>
<vuln vid="5ebfe901-a3cb-11d9-b248-000854d03344">
- <topic>hashcash -- format string vulnerability</topic>
- <affects>
+ <topic>hashcash -- format string vulnerability</topic> <affects>
<package>
- <name>hashcash</name>
- <range><lt>1.17</lt></range>
+ <name>hashcash</name> <range><lt>1.17</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>A Gentoo Linux Security Advisory reports:</p>
- <blockquote cite="http://www.gentoo.org/security/en/glsa/glsa-200503-12.xml">
+ <p>A Gentoo Linux Security Advisory reports:</p> <blockquote
+ cite="http://www.gentoo.org/security/en/glsa/glsa-200503-12.xml">
<p>Tavis Ormandy of the Gentoo Linux Security Audit Team
- identified a flaw in the Hashcash utility that an attacker
- could expose by specifying a malformed reply address.</p>
- <p>Successful exploitation would permit an attacker to disrupt
- Hashcash users, and potentially execute arbitrary code.</p>
+ identified a flaw in the Hashcash utility that an
+ attacker could expose by specifying a malformed reply
+ address.</p>
+ <p>Successful exploitation would permit an attacker to
+ disrupt
+ Hashcash users, and potentially execute arbitrary
+ code.</p>
</blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2005-0687</cvename>
<url>http://www.gentoo.org/security/en/glsa/glsa-200503-12.xml</url>
- </references>
- <dates>
- <discovery>2005-03-06</discovery>
- <entry>2005-04-02</entry>
+ </references> <dates>
+ <discovery>2005-03-06</discovery> <entry>2005-04-02</entry>
<modified>2005-04-03</modified>
</dates>
</vuln>
<vuln vid="70b62f5e-9e2e-11d9-a256-0001020eed82">
- <topic>clamav -- zip handling DoS vulnerability</topic>
- <affects>
- <package>
- <name>clamav</name>
- <range><lt>0.81</lt></range>
- </package>
+ <topic>clamav -- zip handling DoS vulnerability</topic> <affects>
<package>
- <name>clamav-devel</name>
- <range><lt>20050408</lt></range>
+ <name>clamav</name> <range><lt>0.81</lt></range>
+ </package> <package>
+ <name>clamav-devel</name> <range><lt>20050408</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>The clamav daemon is vulnerable to a DoS vulnerability due
+ <p>The clamav daemon is vulnerable to a DoS vulnerability
+ due
to insufficient handling of malformed zip files which can
crash the clamav daemon.</p>
</body>
- </description>
- <references>
- <bid>12408</bid>
- <cvename>CVE-2005-0133</cvename>
+ </description> <references>
+ <bid>12408</bid> <cvename>CVE-2005-0133</cvename>
<url>http://sourceforge.net/project/shownotes.php?release_id=300116</url>
- </references>
- <dates>
- <discovery>2005-01-27</discovery>
- <entry>2005-03-26</entry>
+ </references> <dates>
+ <discovery>2005-01-27</discovery> <entry>2005-03-26</entry>
<modified>2005-04-09</modified>
</dates>
</vuln>
@@ -7366,74 +6113,66 @@ Note: Please add new entries to the beginning of this file.
file handling</topic>
<affects>
<package>
- <name>wine</name>
- <range><lt>20050310</lt></range>
+ <name>wine</name> <range><lt>20050310</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>Due to insecure temporary file creation in the Wine Windows
+ <p>Due to insecure temporary file creation in the Wine
+ Windows
emulator, it is possible for any user to read potentially
sensitive information from temporary registry files.</p>
- <blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=111082537009842">
- <p>When a Win32 application is launched by wine, wine makes
+ <blockquote
+ cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=111082537009842">
+ <p>When a Win32 application is launched by wine, wine
+ makes
a dump of the Windows registry in /tmp with name
regxxxxyyyy.tmp , where xxxxxx is the pid in hexadecimal
value of the current wine process and yyyy is an integer
value usually equal to zero.</p>
<p>regxxxxyyyy.tmp is created with 0644 (-rw-r--r--)
- permissions. This could represent a security problem in a
- multi-user environment. Indeed, any local user could
- access to windows regstry's dump and get sensitive
+ permissions. This could represent a security problem
+ in a multi-user environment. Indeed, any local user
+ could access to windows regstry's dump and get sensitive
information, like passwords and other private data.</p>
</blockquote>
</body>
- </description>
- <references>
- <cvename>CVE-2005-0787</cvename>
- <mlist msgid="20050314135701.30231.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=111082537009842</mlist>
+ </description> <references>
+ <cvename>CVE-2005-0787</cvename> <mlist
+ msgid="20050314135701.30231.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=111082537009842</mlist>
<url>http://bugs.winehq.org/show_bug.cgi?id=2715</url>
<url>http://www.securitytracker.com/alerts/2005/Mar/1013428.html</url>
<url>http://www.zone-h.org/advisories/read/id=7300</url>
<url>http://www.securityfocus.com/bid/12791</url>
<url>http://xforce.iss.net/xforce/xfdb/19697</url>
- </references>
- <dates>
- <discovery>2005-03-13</discovery>
- <entry>2005-03-24</entry>
+ </references> <dates>
+ <discovery>2005-03-13</discovery> <entry>2005-03-24</entry>
</dates>
</vuln>
<vuln vid="741f8841-9c6b-11d9-9dbe-000a95bc6fae">
- <topic>firefox -- arbitrary code execution from sidebar panel</topic>
- <affects>
- <package>
- <name>firefox</name>
- <range><lt>1.0.2,1</lt></range>
- </package>
+ <topic>firefox -- arbitrary code execution from sidebar
+ panel</topic> <affects>
<package>
- <name>linux-firefox</name>
- <range><lt>1.0.2</lt></range>
+ <name>firefox</name> <range><lt>1.0.2,1</lt></range>
+ </package> <package>
+ <name>linux-firefox</name> <range><lt>1.0.2</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Mozilla Foundation Security Advisory states:</p>
- <blockquote cite="http://www.mozilla.org/security/announce/mfsa2005-31.html">
+ <blockquote
+ cite="http://www.mozilla.org/security/announce/mfsa2005-31.html">
<p>If a user bookmarked a malicious page as a Firefox
sidebar panel that page could execute arbitrary programs
- by opening a privileged page and injecting javascript into
- it.</p>
+ by opening a privileged page and injecting javascript
+ into it.</p>
</blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2005-0402</cvename>
<url>http://www.mozilla.org/security/announce/mfsa2005-31.html</url>
- </references>
- <dates>
- <discovery>2005-03-03</discovery>
- <entry>2005-03-24</entry>
+ </references> <dates>
+ <discovery>2005-03-03</discovery> <entry>2005-03-24</entry>
</dates>
</vuln>
@@ -7441,83 +6180,59 @@ Note: Please add new entries to the beginning of this file.
<topic>mozilla -- heap buffer overflow in GIF image processing</topic>
<affects>
<package>
- <name>firefox</name>
- <range><lt>1.0.2,1</lt></range>
- </package>
- <package>
- <name>thunderbird</name>
- <name>linux-firefox</name>
- <range><lt>1.0.2</lt></range>
- </package>
- <package>
- <name>mozilla</name>
- <range><lt>1.7.6,2</lt></range>
+ <name>firefox</name> <range><lt>1.0.2,1</lt></range>
+ </package> <package>
+ <name>thunderbird</name> <name>linux-firefox</name>
+ <range><lt>1.0.2</lt></range>
+ </package> <package>
+ <name>mozilla</name> <range><lt>1.7.6,2</lt></range>
<range><ge>1.8.*,2</ge></range>
- </package>
- <package>
- <name>linux-mozilla</name>
- <name>linux-mozilla-devel</name>
- <range><lt>1.7.6</lt></range>
- <range><ge>1.8.*</ge></range>
- </package>
- <package>
- <name>netscape7</name>
- <range><ge>0</ge></range>
- </package>
- <package>
+ </package> <package>
+ <name>linux-mozilla</name> <name>linux-mozilla-devel</name>
+ <range><lt>1.7.6</lt></range> <range><ge>1.8.*</ge></range>
+ </package> <package>
+ <name>netscape7</name> <range><ge>0</ge></range>
+ </package> <package>
<!-- These ports are obsolete. -->
- <name>de-linux-mozillafirebird</name>
+ <name>de-linux-mozillafirebird</name>
<name>el-linux-mozillafirebird</name>
- <name>ja-linux-mozillafirebird-gtk1</name>
- <name>ja-mozillafirebird-gtk2</name>
- <name>linux-mozillafirebird</name>
- <name>ru-linux-mozillafirebird</name>
- <name>zhCN-linux-mozillafirebird</name>
- <name>zhTW-linux-mozillafirebird</name>
- <range><ge>0</ge></range>
- </package>
- <package>
+ <name>ja-linux-mozillafirebird-gtk1</name>
+ <name>ja-mozillafirebird-gtk2</name>
+ <name>linux-mozillafirebird</name>
+ <name>ru-linux-mozillafirebird</name>
+ <name>zhCN-linux-mozillafirebird</name>
+ <name>zhTW-linux-mozillafirebird</name> <range><ge>0</ge></range>
+ </package> <package>
<!-- These package names are obsolete. -->
- <name>de-linux-netscape</name>
- <name>de-netscape7</name>
- <name>fr-linux-netscape</name>
- <name>fr-netscape7</name>
- <name>ja-linux-netscape</name>
- <name>ja-netscape7</name>
- <name>linux-netscape</name>
- <name>linux-phoenix</name>
- <name>mozilla+ipv6</name>
- <name>mozilla-embedded</name>
- <name>mozilla-firebird</name>
- <name>mozilla-gtk1</name>
- <name>mozilla-gtk2</name>
- <name>mozilla-gtk</name>
- <name>mozilla-thunderbird</name>
- <name>phoenix</name>
- <name>pt_BR-netscape7</name>
- <range><ge>0</ge></range>
- </package>
- </affects>
- <description>
+ <name>de-linux-netscape</name> <name>de-netscape7</name>
+ <name>fr-linux-netscape</name> <name>fr-netscape7</name>
+ <name>ja-linux-netscape</name> <name>ja-netscape7</name>
+ <name>linux-netscape</name> <name>linux-phoenix</name>
+ <name>mozilla+ipv6</name> <name>mozilla-embedded</name>
+ <name>mozilla-firebird</name> <name>mozilla-gtk1</name>
+ <name>mozilla-gtk2</name> <name>mozilla-gtk</name>
+ <name>mozilla-thunderbird</name> <name>phoenix</name>
+ <name>pt_BR-netscape7</name> <range><ge>0</ge></range>
+ </package>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Mozilla Foundation Security Advisory states:</p>
- <blockquote cite="http://www.mozilla.org/security/announce/mfsa2005-31.html">
- <p>An <em>(sic)</em> GIF processing error when parsing the
+ <blockquote
+ cite="http://www.mozilla.org/security/announce/mfsa2005-31.html">
+ <p>An <em>(sic)</em> GIF processing error when parsing
+ the
obsolete Netscape extension 2 can lead to an exploitable
- heap overrun, allowing an attacker to run arbitrary code on
- the user's machine.</p>
+ heap overrun, allowing an attacker to run arbitrary
+ code on the user's machine.</p>
</blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2005-0399</cvename>
<url>http://www.mozilla.org/security/announce/mfsa2005-30.html</url>
<url>http://xforce.iss.net/xforce/alerts/id/191</url>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=285595</url>
- </references>
- <dates>
- <discovery>2005-03-10</discovery>
- <entry>2005-03-24</entry>
+ </references> <dates>
+ <discovery>2005-03-10</discovery> <entry>2005-03-24</entry>
</dates>
</vuln>
@@ -7525,30 +6240,25 @@ Note: Please add new entries to the beginning of this file.
<topic>sylpheed -- buffer overflow in header processing</topic>
<affects>
<package>
- <name>sylpheed</name>
- <name>sylpheed-claws</name>
+ <name>sylpheed</name> <name>sylpheed-claws</name>
<name>sylpheed-gtk2</name>
<range><ge>0.8.*</ge><lt>1.0.3</lt></range>
<range><ge>1.9.*</ge><lt>1.9.5</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>The Sylpheed web site states:</p>
- <blockquote cite="http://sylpheed.good-day.net/index.cgi.en#changes">
+ <p>The Sylpheed web site states:</p> <blockquote
+ cite="http://sylpheed.good-day.net/index.cgi.en#changes">
<p>A buffer overflow which occurred when replying to a
message with certain headers which contain non-ascii
characters was fixed.</p>
</blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2005-0667</cvename>
<url>http://sylpheed.good-day.net/index.cgi.en#changes</url>
- </references>
- <dates>
- <discovery>2005-03-07</discovery>
- <entry>2005-03-23</entry>
+ </references> <dates>
+ <discovery>2005-03-07</discovery> <entry>2005-03-23</entry>
</dates>
</vuln>
@@ -7556,30 +6266,27 @@ Note: Please add new entries to the beginning of this file.
<topic>xv -- filename handling format string vulnerability</topic>
<affects>
<package>
- <name>xv</name>
- <name>ja-xv</name>
- <range><lt>3.10a_5</lt></range>
+ <name>xv</name> <name>ja-xv</name> <range><lt>3.10a_5</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>A Gentoo Linux Security Advisory reports:</p>
- <blockquote cite="http://www.gentoo.org/security/en/glsa/glsa-200503-09.xml">
+ <p>A Gentoo Linux Security Advisory reports:</p> <blockquote
+ cite="http://www.gentoo.org/security/en/glsa/glsa-200503-09.xml">
<p>Tavis Ormandy of the Gentoo Linux Security Audit Team
- identified a flaw in the handling of image filenames by xv.</p>
- <p>Successful exploitation would require a victim to process
+ identified a flaw in the handling of image filenames
+ by xv.</p>
+ <p>Successful exploitation would require a victim to
+ process
a specially crafted image with a malformed filename,
- potentially resulting in the execution of arbitrary code.</p>
+ potentially resulting in the execution of arbitrary
+ code.</p>
</blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2005-0665</cvename>
<url>http://www.gentoo.org/security/en/glsa/glsa-200503-09.xml</url>
- </references>
- <dates>
- <discovery>2005-03-01</discovery>
- <entry>2005-03-21</entry>
+ </references> <dates>
+ <discovery>2005-03-01</discovery> <entry>2005-03-21</entry>
</dates>
</vuln>
@@ -7587,20 +6294,17 @@ Note: Please add new entries to the beginning of this file.
<topic>kdelibs -- local DCOP denial of service vulnerability</topic>
<affects>
<package>
- <name>ja-kdelibs</name>
- <name>kdelibs-nocups</name>
- <name>kdelibs</name>
- <range><lt>3.4.0</lt></range>
+ <name>ja-kdelibs</name> <name>kdelibs-nocups</name>
+ <name>kdelibs</name> <range><lt>3.4.0</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>A KDE Security Advisory reports:</p>
- <blockquote cite="http://www.kde.org/info/security/advisory-20050316-1.txt">
+ <p>A KDE Security Advisory reports:</p> <blockquote
+ cite="http://www.kde.org/info/security/advisory-20050316-1.txt">
<p>Sebastian Krahmer of the SUSE LINUX Security Team
- reported a local denial of service vulnerability in KDE's
- Desktop Communication Protocol (DCOP) daemon better known
- as dcopserver.</p>
+ reported a local denial of service vulnerability in
+ KDE's Desktop Communication Protocol (DCOP) daemon
+ better known as dcopserver.</p>
<p>A local user can lock up the dcopserver of arbitrary
other users on the same machine. This can cause a
significant reduction in desktop functionality for the
@@ -7609,14 +6313,11 @@ Note: Please add new entries to the beginning of this file.
start new applications.</p>
</blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2005-0396</cvename>
<url>http://www.kde.org/info/security/advisory-20050316-1.txt</url>
- </references>
- <dates>
- <discovery>2005-03-16</discovery>
- <entry>2005-03-21</entry>
+ </references> <dates>
+ <discovery>2005-03-16</discovery> <entry>2005-03-21</entry>
</dates>
</vuln>
@@ -7624,29 +6325,24 @@ Note: Please add new entries to the beginning of this file.
<topic>phpmyadmin -- increased privilege vulnerability</topic>
<affects>
<package>
- <name>phpmyadmin</name>
- <name>phpMyAdmin</name>
+ <name>phpmyadmin</name> <name>phpMyAdmin</name>
<range><lt>2.6.1.3</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>The phpMyAdmin team reports:</p>
- <blockquote cite="http://sourceforge.net/forum/forum.php?forum_id=450948">
+ <p>The phpMyAdmin team reports:</p> <blockquote
+ cite="http://sourceforge.net/forum/forum.php?forum_id=450948">
<p>Escaping of the "_" character was not properly done,
giving a wildcard privilege when editing db-specific
privileges with phpMyAdmin.</p>
</blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2005-0653</cvename>
<url>http://sourceforge.net/forum/forum.php?forum_id=450948</url>
<url>http://sourceforge.net/tracker/index.php?func=detail&amp;aid=1113788&amp;group_id=23067&amp;atid=377408</url>
- </references>
- <dates>
- <discovery>2005-02-01</discovery>
- <entry>2005-03-15</entry>
+ </references> <dates>
+ <discovery>2005-02-01</discovery> <entry>2005-03-15</entry>
</dates>
</vuln>
@@ -7654,17 +6350,14 @@ Note: Please add new entries to the beginning of this file.
<topic>ethereal -- multiple protocol dissectors vulnerabilities</topic>
<affects>
<package>
- <name>ethereal</name>
- <name>ethereal-lite</name>
- <name>tethereal</name>
- <name>tethereal-lite</name>
+ <name>ethereal</name> <name>ethereal-lite</name>
+ <name>tethereal</name> <name>tethereal-lite</name>
<range><ge>0.9.1</ge><lt>0.10.10</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>An Ethreal Security Advisories reports:</p>
- <blockquote cite="http://www.ethereal.com/appnotes/enpa-sa-00018.html">
+ <p>An Ethreal Security Advisories reports:</p> <blockquote
+ cite="http://www.ethereal.com/appnotes/enpa-sa-00018.html">
<p>Issues have been discovered in the following protocol
dissectors:</p>
<ul>
@@ -7672,28 +6365,26 @@ Note: Please add new entries to the beginning of this file.
Etheric dissector. CVE: CAN-2005-0704</li>
<li>The GPRS-LLC dissector could crash if the "ignore
cipher bit" option was enabled. CVE: CAN-2005-0705</li>
- <li>Diego Giago discovered a buffer overflow in the 3GPP2
+ <li>Diego Giago discovered a buffer overflow in the
+ 3GPP2
A11 dissector. This flaw was later reported by Leon
Juranic. CVE: CAN-2005-0699</li>
- <li>Leon Juranic discovered a buffer overflow in the IAPP dissector.
+ <li>Leon Juranic discovered a buffer overflow in the
+ IAPP dissector.
CVE: CAN-2005-0739</li>
- <li>A bug in the JXTA dissector could make Ethereal crash.</li>
- <li>A bug in the sFlow dissector could make Ethereal crash.</li>
+ <li>A bug in the JXTA dissector could make Ethereal
+ crash.</li> <li>A bug in the sFlow dissector could make
+ Ethereal crash.</li>
</ul>
</blockquote>
</body>
- </description>
- <references>
- <bid>12759</bid>
- <cvename>CVE-2005-0699</cvename>
- <cvename>CVE-2005-0704</cvename>
- <cvename>CVE-2005-0705</cvename>
+ </description> <references>
+ <bid>12759</bid> <cvename>CVE-2005-0699</cvename>
+ <cvename>CVE-2005-0704</cvename> <cvename>CVE-2005-0705</cvename>
<cvename>CVE-2005-0739</cvename>
<url>http://www.ethereal.com/appnotes/enpa-sa-00018.html</url>
- </references>
- <dates>
- <discovery>2005-03-09</discovery>
- <entry>2005-03-14</entry>
+ </references> <dates>
+ <discovery>2005-03-09</discovery> <entry>2005-03-14</entry>
<modified>2005-06-24</modified>
</dates>
</vuln>
@@ -7703,27 +6394,21 @@ Note: Please add new entries to the beginning of this file.
vulnerability</topic>
<affects>
<package>
- <name>grip</name>
- <range><lt>3.2.0_7</lt></range>
+ <name>grip</name> <range><lt>3.2.0_7</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Joseph VanAndel reports that grip is vulnerability to a
- buffer overflow vulnerability when receiving more than 16
- CDDB responses. This could lead to a crash in grip and
- potentially execution arbitrary code.</p>
+ buffer overflow vulnerability when receiving more than
+ 16 CDDB responses. This could lead to a crash in grip
+ and potentially execution arbitrary code.</p>
<p>A workaround is to disable CDDB lookups.</p>
</body>
- </description>
- <references>
- <bid>12770</bid>
- <cvename>CVE-2005-0706</cvename>
+ </description> <references>
+ <bid>12770</bid> <cvename>CVE-2005-0706</cvename>
<url>http://sourceforge.net/tracker/index.php?func=detail&amp;aid=834724&amp;group_id=3714&amp;atid=103714</url>
- </references>
- <dates>
- <discovery>2003-11-02</discovery>
- <entry>2005-03-14</entry>
+ </references> <dates>
+ <discovery>2003-11-02</discovery> <entry>2005-03-14</entry>
<modified>2005-03-18</modified>
</dates>
</vuln>
@@ -7736,41 +6421,43 @@ Note: Please add new entries to the beginning of this file.
<range><ge>4.0.0</ge><lt>4.0.24</lt></range>
<range><ge>4.1.0</ge><lt>4.1.10a</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>SecurityFocus reports:</p>
- <blockquote cite="http://www.securityfocus.com/bid/12781/discussion/">
- <p>MySQL is reported prone to an insecure temporary file creation
+ <p>SecurityFocus reports:</p> <blockquote
+ cite="http://www.securityfocus.com/bid/12781/discussion/">
+ <p>MySQL is reported prone to an insecure temporary file
+ creation
vulnerability.</p>
- <p>Reports indicate that an attacker that has 'CREATE TEMPORARY TABLE'
- privileges on an affected installation may leverage this
- vulnerability to corrupt files with the privileges of the MySQL
+ <p>Reports indicate that an attacker that has 'CREATE
+ TEMPORARY TABLE'
+ privileges on an affected installation may leverage
+ this vulnerability to corrupt files with the privileges
+ of the MySQL process.</p>
+ <p>MySQL is reported prone to an input validation
+ vulnerability that
+ can be exploited by remote users that have INSERT and
+ DELETE privileges on the 'mysql' administrative
+ database.</p>
+ <p>Reports indicate that this issue may be leveraged to
+ load an
+ execute a malicious library in the context of the MySQL
process.</p>
- <p>MySQL is reported prone to an input validation vulnerability that
- can be exploited by remote users that have INSERT and DELETE
- privileges on the 'mysql' administrative database.</p>
- <p>Reports indicate that this issue may be leveraged to load an
- execute a malicious library in the context of the MySQL process.</p>
- <p>Finally, MySQL is reported prone to a remote arbitrary code
- execution vulnerability. It is reported that the vulnerability may
- be triggered by employing the 'CREATE FUNCTION' statement to
- manipulate functions in order to control sensitive data
- structures.</p>
- <p>This issue may be exploited to execute arbitrary code in the
+ <p>Finally, MySQL is reported prone to a remote arbitrary
+ code
+ execution vulnerability. It is reported that the
+ vulnerability may be triggered by employing the 'CREATE
+ FUNCTION' statement to manipulate functions in order
+ to control sensitive data structures.</p>
+ <p>This issue may be exploited to execute arbitrary code
+ in the
context of the database process.</p>
</blockquote>
</body>
- </description>
- <references>
- <bid>12781</bid>
- <cvename>CVE-2005-0709</cvename>
- <cvename>CVE-2005-0710</cvename>
- <cvename>CVE-2005-0711</cvename>
- </references>
- <dates>
- <discovery>2005-03-11</discovery>
- <entry>2005-03-14</entry>
+ </description> <references>
+ <bid>12781</bid> <cvename>CVE-2005-0709</cvename>
+ <cvename>CVE-2005-0710</cvename> <cvename>CVE-2005-0711</cvename>
+ </references> <dates>
+ <discovery>2005-03-11</discovery> <entry>2005-03-14</entry>
</dates>
</vuln>
@@ -7778,26 +6465,22 @@ Note: Please add new entries to the beginning of this file.
<topic>rxvt-unicode -- buffer overflow vulnerability</topic>
<affects>
<package>
- <name>rxvt-unicode</name>
- <range><lt>5.3</lt></range>
+ <name>rxvt-unicode</name> <range><lt>5.3</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>A rxvt-unicode changelog reports:</p>
- <blockquote cite="http://dist.schmorp.de/rxvt-unicode/Changes">
+ <p>A rxvt-unicode changelog reports:</p> <blockquote
+ cite="http://dist.schmorp.de/rxvt-unicode/Changes">
<p>Fix a bug that allowed to overflow a buffer via a long
escape sequence, which is probably exploitable (fix by
- Rob Holland / Yoann Vandoorselaere / Gentoo Audit Team).</p>
+ Rob Holland / Yoann Vandoorselaere / Gentoo Audit
+ Team).</p>
</blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<url>http://dist.schmorp.de/rxvt-unicode/Changes</url>
- </references>
- <dates>
- <discovery>2005-03-13</discovery>
- <entry>2005-03-13</entry>
+ </references> <dates>
+ <discovery>2005-03-13</discovery> <entry>2005-03-13</entry>
</dates>
</vuln>
@@ -7805,62 +6488,57 @@ Note: Please add new entries to the beginning of this file.
<topic>phpmyadmin -- information disclosure vulnerability</topic>
<affects>
<package>
- <name>phpmyadmin</name>
- <name>phpMyAdmin</name>
+ <name>phpmyadmin</name> <name>phpMyAdmin</name>
<range><lt>2.6.1.2</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>A phpMyAdmin security announcement reports:</p>
- <blockquote cite="http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-2">
- <p>By calling some scripts that are part of phpMyAdmin in an
+ <p>A phpMyAdmin security announcement reports:</p> <blockquote
+ cite="http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-2">
+ <p>By calling some scripts that are part of phpMyAdmin
+ in an
unexpected way (especially scripts in the libraries
subdirectory), it is possible to trigger phpMyAdmin to
- display a PHP error message which contains the full path
- of the directory where phpMyAdmin is installed.</p>
+ display a PHP error message which contains the full
+ path of the directory where phpMyAdmin is installed.</p>
<p><strong>Mitigation factor:</strong> This path disclosure
- is possible on servers where the recommended setting of
- the PHP configuration directive
- <code>display_errors</code> is set to on, which is against
- the recommendations given in the PHP manual.</p>
+ is possible on servers where the recommended setting
+ of the PHP configuration directive <code>display_errors</code>
+ is set to on, which is against the recommendations given
+ in the PHP manual.</p>
</blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2005-0544</cvename>
<url>http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-2</url>
- </references>
- <dates>
- <discovery>2005-02-22</discovery>
- <entry>2005-03-08</entry>
+ </references> <dates>
+ <discovery>2005-02-22</discovery> <entry>2005-03-08</entry>
</dates>
</vuln>
<vuln vid="882ef43b-901f-11d9-a22c-0001020eed82">
- <topic>phpmyadmin -- arbitrary file include and XSS vulnerabilities</topic>
- <affects>
+ <topic>phpmyadmin -- arbitrary file include and XSS
+ vulnerabilities</topic> <affects>
<package>
- <name>phpmyadmin</name>
- <name>phpMyAdmin</name>
+ <name>phpmyadmin</name> <name>phpMyAdmin</name>
<range><gt>1.3.1</gt><lt>2.6.1.2</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>A phpMyAdmin security announcement reports:</p>
- <blockquote cite="http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-1">
+ <p>A phpMyAdmin security announcement reports:</p> <blockquote
+ cite="http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-1">
<p>We received two bug reports by Maksymilian Arciemowicz
- about those vulnerabilities and we wish to thank him for
- his work. The vulnerabilities apply to those points:</p>
+ about those vulnerabilities and we wish to thank him
+ for his work. The vulnerabilities apply to those
+ points:</p>
<ol>
<li>css/phpmyadmin.css.php was vulnerable against
<code>$cfg</code> and <code>GLOBALS</code> variable
injections. This way, a possible attacker could
manipulate any configuration parameter. Using
phpMyAdmin's theming mechanism, he was able to include
- arbitrary files. This is especially dangerous if php is
- not running in safe mode.</li>
+ arbitrary files. This is especially dangerous if php
+ is not running in safe mode.</li>
<li>A possible attacker could manipulate phpMyAdmin's
localized strings via the URL and inject harmful
JavaScript code this way, which could be used for XSS
@@ -7868,110 +6546,89 @@ Note: Please add new entries to the beginning of this file.
</ol>
</blockquote>
</body>
- </description>
- <references>
- <bid>12644</bid>
- <bid>12645</bid>
- <cvename>CVE-2005-0543</cvename>
- <cvename>CVE-2005-0567</cvename>
- <mlist msgid="20050224190307.20197.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110929725801154</mlist>
+ </description> <references>
+ <bid>12644</bid> <bid>12645</bid> <cvename>CVE-2005-0543</cvename>
+ <cvename>CVE-2005-0567</cvename> <mlist
+ msgid="20050224190307.20197.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110929725801154</mlist>
<url>http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-1</url>
- </references>
- <dates>
- <discovery>2005-02-21</discovery>
- <entry>2005-03-08</entry>
+ </references> <dates>
+ <discovery>2005-02-21</discovery> <entry>2005-03-08</entry>
</dates>
</vuln>
<vuln vid="624fe633-9006-11d9-a22c-0001020eed82">
- <topic>libexif -- buffer overflow vulnerability</topic>
- <affects>
+ <topic>libexif -- buffer overflow vulnerability</topic> <affects>
<package>
- <name>libexif</name>
- <range><lt>0.6.10_1</lt></range>
+ <name>libexif</name> <range><lt>0.6.10_1</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>Sylvain Defresne reports that libexif is vulnerable to a
+ <p>Sylvain Defresne reports that libexif is vulnerable to
+ a
buffer overflow vulnerability due to insufficient input
checking. This could lead crash of applications using
libexif.</p>
</body>
- </description>
- <references>
- <bid>12744</bid>
- <cvename>CVE-2005-0664</cvename>
+ </description> <references>
+ <bid>12744</bid> <cvename>CVE-2005-0664</cvename>
<url>https://bugzilla.ubuntulinux.org/show_bug.cgi?id=7152</url>
- </references>
- <dates>
- <discovery>2005-03-03</discovery>
- <entry>2005-03-08</entry>
+ </references> <dates>
+ <discovery>2005-03-03</discovery> <entry>2005-03-08</entry>
</dates>
</vuln>
<vuln vid="4a0b334d-8d8d-11d9-afa0-003048705d5a">
- <topic>phpbb - Insuffient check against HTML code in usercp_register.php</topic>
- <affects>
+ <topic>phpbb - Insuffient check against HTML code in
+ usercp_register.php</topic> <affects>
<package>
- <name>phpbb</name>
- <range><le>2.0.13</le></range>
+ <name>phpbb</name> <range><le>2.0.13</le></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>Neo Security Team reports:</p>
- <blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110987231502274">
+ <p>Neo Security Team reports:</p> <blockquote
+ cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110987231502274">
<p>If we specify a variable in the html code (any type:
hidden, text, radio, check, etc) with the name allowhtml,
allowbbcode or allowsmilies, is going to be on the html,
bbcode and smilies in our signature.</p>
- </blockquote>
- <p>This is a low risk vulnerability that allows users to bypass
+ </blockquote> <p>This is a low risk vulnerability that
+ allows users to bypass
forum-wide configuration.</p>
</body>
- </description>
- <references>
- <mlist msgid="20050303055339.3109.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110987231502274</mlist>
- <mlist msgid="38599.166.68.134.174.1109875231.squirrel@166.68.134.174">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110988400407204</mlist>
- </references>
- <dates>
- <discovery>2005-02-28</discovery>
- <entry>2005-03-05</entry>
+ </description> <references>
+ <mlist
+ msgid="20050303055339.3109.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110987231502274</mlist>
+ <mlist
+ msgid="38599.166.68.134.174.1109875231.squirrel@166.68.134.174">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110988400407204</mlist>
+ </references> <dates>
+ <discovery>2005-02-28</discovery> <entry>2005-03-05</entry>
<modified>2005-03-07</modified>
</dates>
</vuln>
<vuln vid="f3eec2b5-8cd8-11d9-8066-000a95bc6fae">
- <topic>postnuke -- SQL injection vulnerabilities</topic>
- <affects>
+ <topic>postnuke -- SQL injection vulnerabilities</topic> <affects>
<package>
- <name>postnuke</name>
- <range><lt>0.760</lt></range>
+ <name>postnuke</name> <range><lt>0.760</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>Two separate SQL injection vulnerabilites have been
- identified in the PostNuke PHP content management
- system. An attacker can use this vulnerability to
- potentially insert executable PHP code into the content
- management system (to view all files within the PHP scope,
- for instance). Various other SQL injection vulnerabilities
- exist, which give attackers the ability to run SQL queries
- on any tables within the database.</p>
+ <p>Two separate SQL injection vulnerabilites have been
+ identified in the PostNuke PHP content management system.
+ An attacker can use this vulnerability to potentially
+ insert executable PHP code into the content management
+ system (to view all files within the PHP scope, for
+ instance). Various other SQL injection vulnerabilities
+ exist, which give attackers the ability to run SQL queries
+ on any tables within the database.</p>
</body>
- </description>
- <references>
- <cvename>CVE-2005-0617</cvename>
- <cvename>CVE-2005-0615</cvename>
+ </description> <references>
+ <cvename>CVE-2005-0617</cvename> <cvename>CVE-2005-0615</cvename>
<mlist>http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110962710805864</mlist>
<mlist>http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110962819232255</mlist>
<url>http://news.postnuke.com/Article2669.html</url>
- </references>
- <dates>
- <discovery>2005-02-28</discovery>
- <entry>2005-03-04</entry>
+ </references> <dates>
+ <discovery>2005-02-28</discovery> <entry>2005-03-04</entry>
</dates>
</vuln>
@@ -7979,30 +6636,25 @@ Note: Please add new entries to the beginning of this file.
<topic>postnuke -- cross-site scripting (XSS) vulnerabilities</topic>
<affects>
<package>
- <name>postnuke</name>
- <range><lt>0.760</lt></range>
+ <name>postnuke</name> <range><lt>0.760</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>A cross-site scripting vulnerability is present in the
- PostNuke PHP content management system. By passing data
- injected through exploitable errors in input validation, an
- attacker can insert code which will run on the machine of
- anybody viewing the page. It is feasible that this attack
- could be used to retrieve session information from cookies,
- thereby allowing the attacker to gain administrative access
- to the CMS.</p>
+ <p>A cross-site scripting vulnerability is present in the
+ PostNuke PHP content management system. By passing data
+ injected through exploitable errors in input validation,
+ an attacker can insert code which will run on the machine
+ of anybody viewing the page. It is feasible that this
+ attack could be used to retrieve session information
+ from cookies, thereby allowing the attacker to gain
+ administrative access to the CMS.</p>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2005-0616</cvename>
<mlist>http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110962768300373</mlist>
<url>http://news.postnuke.com/Article2669.html</url>
- </references>
- <dates>
- <discovery>2005-02-28</discovery>
- <entry>2005-03-04</entry>
+ </references> <dates>
+ <discovery>2005-02-28</discovery> <entry>2005-03-04</entry>
</dates>
</vuln>
@@ -8010,28 +6662,28 @@ Note: Please add new entries to the beginning of this file.
<topic>realplayer -- remote heap overflow</topic>
<affects>
<package>
- <name>linux-realplayer</name>
- <range><le>10.0.2</le></range>
+ <name>linux-realplayer</name> <range><le>10.0.2</le></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>Two exploits have been identified in the Linux RealPlayer client.
- RealNetworks states:</p>
- <blockquote cite="http://service.real.com/help/faq/security/050224_player/EN/">
+ <p>Two exploits have been identified in the Linux RealPlayer
+ client.
+ RealNetworks states:</p>
+ <blockquote
+ cite="http://service.real.com/help/faq/security/050224_player/EN/">
<p>RealNetworks, Inc. has addressed recently discovered
- security vulnerabilities that offered the potential for
- an attacker to run arbitrary or malicious code on a
- customer's machine. RealNetworks has received no reports
- of machines compromised as a result of the now-remedied
- vulnerabilities. RealNetworks takes all security
- vulnerabilities very seriously.</p>
- <p>The specific exploits were:</p>
- <ul>
- <li><strong>Exploit 1:</strong> To fashion a malicious WAV
- file to cause a buffer overflow which could have allowed
- an attacker to execute arbitrary code on a customer's
- machine.</li>
+ security vulnerabilities that offered the potential
+ for an attacker to run arbitrary or malicious code on
+ a customer's machine. RealNetworks has received no
+ reports of machines compromised as a result of the
+ now-remedied vulnerabilities. RealNetworks takes all
+ security vulnerabilities very seriously.</p>
+ <p>The specific exploits were:</p> <ul>
+ <li><strong>Exploit 1:</strong> To fashion a malicious
+ WAV
+ file to cause a buffer overflow which could have
+ allowed an attacker to execute arbitrary code on a
+ customer's machine.</li>
<li><strong>Exploit 2:</strong> To fashion a malicious
SMIL file to cause a buffer overflow which could have
allowed an attacker to execute arbitrary code on a
@@ -8039,15 +6691,12 @@ Note: Please add new entries to the beginning of this file.
</ul>
</blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2005-0611</cvename>
<mlist>http://marc.theaimsgroup.com/?l=vulnwatch&amp;m=110977858619314</mlist>
<url>http://service.real.com/help/faq/security/050224_player/EN/</url>
- </references>
- <dates>
- <discovery>2005-03-01</discovery>
- <entry>2005-03-04</entry>
+ </references> <dates>
+ <discovery>2005-03-01</discovery> <entry>2005-03-04</entry>
</dates>
</vuln>
@@ -8055,64 +6704,53 @@ Note: Please add new entries to the beginning of this file.
<topic>ImageMagick -- format string vulnerability</topic>
<affects>
<package>
- <name>ImageMagick</name>
- <range><lt>6.2.0.3</lt></range>
+ <name>ImageMagick</name> <range><lt>6.2.0.3</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>Tavis Ormandy reports:</p>
- <blockquote>
+ <p>Tavis Ormandy reports:</p> <blockquote>
<p>magemagick-6.2.0-3 fixes an potential issue handling
malformed filenames, the flaw may affect webapps or
scripts that use the imagemagick utilities for image
processing, or applications linked with libMagick.</p>
- </blockquote>
- <p>This vulnerability could crash ImageMagick or potentially
+ </blockquote> <p>This vulnerability could crash ImageMagick
+ or potentially
lead to the execution of arbitrary code with the permissions
of the user running ImageMagick.</p>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2005-0397</cvename>
<url>http://www.ubuntulinux.org/support/documentation/usn/usn-90-1</url>
- </references>
- <dates>
- <discovery>2005-03-02</discovery>
- <entry>2005-03-03</entry>
+ </references> <dates>
+ <discovery>2005-03-02</discovery> <entry>2005-03-03</entry>
</dates>
</vuln>
<vuln vid="fb03b1c6-8a8a-11d9-81f7-02023f003c9f">
- <topic>uim -- privilege escalation vulnerability</topic>
- <affects>
+ <topic>uim -- privilege escalation vulnerability</topic> <affects>
<package>
- <name>ja-uim</name>
- <range><lt>0.4.6</lt></range>
+ <name>ja-uim</name> <range><lt>0.4.6</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>The uim developers reports:</p>
- <blockquote cite="http://lists.freedesktop.org/pipermail/uim/2005-February/000996.html">
- <p>Takumi ASAKI discovered that uim always trusts environment variables.
- But this is not correct behavior, sometimes environment variables
- shouldn't be trusted. This bug causes privilege escalation when libuim
- is linked against setuid/setgid application. Since GTK+ prohibits
- setuid/setgid applications, the bug appears only in 'immodule for Qt'
- enabled Qt. (Normal Qt is also safe.)</p>
+ <p>The uim developers reports:</p> <blockquote
+ cite="http://lists.freedesktop.org/pipermail/uim/2005-February/000996.html">
+ <p>Takumi ASAKI discovered that uim always trusts environment
+ variables.
+ But this is not correct behavior, sometimes environment
+ variables shouldn't be trusted. This bug causes privilege
+ escalation when libuim is linked against setuid/setgid
+ application. Since GTK+ prohibits setuid/setgid
+ applications, the bug appears only in 'immodule for
+ Qt' enabled Qt. (Normal Qt is also safe.)</p>
</blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2005-0503</cvename>
<mlist>http://lists.freedesktop.org/pipermail/uim/2005-February/000996.html</mlist>
- <bid>12604</bid>
- <url>http://secunia.com/advisories/13981</url>
- </references>
- <dates>
- <discovery>2005-02-21</discovery>
- <entry>2005-03-01</entry>
+ <bid>12604</bid> <url>http://secunia.com/advisories/13981</url>
+ </references> <dates>
+ <discovery>2005-02-21</discovery> <entry>2005-03-01</entry>
</dates>
</vuln>
@@ -8120,32 +6758,28 @@ Note: Please add new entries to the beginning of this file.
<topic>lighttpd -- script source disclosure vulnerability</topic>
<affects>
<package>
- <name>lighttpd</name>
- <range><lt>1.3.8</lt></range>
+ <name>lighttpd</name> <range><lt>1.3.8</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>The lighttpd website reports:</p>
- <blockquote cite="http://article.gmane.org/gmane.comp.web.lighttpd/1171">
- <p>In lighttpd 1.3.7 and below it is possible to fetch the source
- files which should be handled by CGI or FastCGI applications.</p>
- </blockquote>
- <p>The vulnerability is in the handling of urlencoded trailing
- NUL bytes. Installations that do not use CGI or FastCGI are
- not affected.</p>
+ <p>The lighttpd website reports:</p> <blockquote
+ cite="http://article.gmane.org/gmane.comp.web.lighttpd/1171">
+ <p>In lighttpd 1.3.7 and below it is possible to fetch
+ the source
+ files which should be handled by CGI or FastCGI
+ applications.</p>
+ </blockquote> <p>The vulnerability is in the handling of
+ urlencoded trailing
+ NUL bytes. Installations that do not use CGI or FastCGI
+ are not affected.</p>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2005-0453</cvename>
<mlist>http://article.gmane.org/gmane.comp.web.lighttpd/1171</mlist>
<url>http://www.lighttpd.net/news/</url>
- <url>http://xforce.iss.net/xforce/xfdb/19350</url>
- <bid>12567</bid>
- </references>
- <dates>
- <discovery>2005-02-12</discovery>
- <entry>2005-03-01</entry>
+ <url>http://xforce.iss.net/xforce/xfdb/19350</url> <bid>12567</bid>
+ </references> <dates>
+ <discovery>2005-02-12</discovery> <entry>2005-03-01</entry>
</dates>
</vuln>
@@ -8153,31 +6787,27 @@ Note: Please add new entries to the beginning of this file.
<topic>phpbb -- privilege elevation and path disclosure</topic>
<affects>
<package>
- <name>phpbb</name>
- <range><lt>2.0.13</lt></range>
+ <name>phpbb</name> <range><lt>2.0.13</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>The phpbb developer group reports:</p>
- <blockquote cite="http://www.phpbb.com/phpBB/viewtopic.php?t=267563">
- <p>phpBB Group announces the release of phpBB 2.0.13, the
- "Beware of the furries" edition. This release addresses two
- recent security exploits, one of them critical. They were
- reported a few days after .12 was released and no one is
- more annoyed than us, having to release a new version ini
- such a short period of time. Fortunately both fixes are
- easy and in each case just one line needs to be edited.</p>
- </blockquote>
+ <p>The phpbb developer group reports:</p> <blockquote
+ cite="http://www.phpbb.com/phpBB/viewtopic.php?t=267563">
+ <p>phpBB Group announces the release of phpBB 2.0.13, the
+ "Beware of the furries" edition. This release addresses
+ two recent security exploits, one of them critical.
+ They were reported a few days after .12 was released
+ and no one is more annoyed than us, having to release
+ a new version ini such a short period of time. Fortunately
+ both fixes are easy and in each case just one line needs
+ to be edited.</p>
+ </blockquote>
</body>
- </description>
- <references>
- <url>http://www.phpbb.com/phpBB/viewtopic.php?t=267563</url>
+ </description> <references>
+ <url>http://www.phpbb.com/phpBB/viewtopic.php?t=267563</url>
<bid>12678</bid>
- </references>
- <dates>
- <discovery>2005-02-27</discovery>
- <entry>2005-02-28</entry>
+ </references> <dates>
+ <discovery>2005-02-27</discovery> <entry>2005-02-28</entry>
<modified>2005-03-05</modified>
</dates>
</vuln>
@@ -8186,49 +6816,43 @@ Note: Please add new entries to the beginning of this file.
<topic>curl -- authentication buffer overflow vulnerability</topic>
<affects>
<package>
- <name>curl</name>
- <range><lt>7.13.1</lt></range>
+ <name>curl</name> <range><lt>7.13.1</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>Two iDEFENSE Security Advisories reports:</p>
- <blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110902601221592">
+ <p>Two iDEFENSE Security Advisories reports:</p> <blockquote
+ cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110902601221592">
<p>An exploitable stack-based buffer overflow condition
- exists when using NT Lan Manager (NTLM)
- authentication. The problem specifically exists within
- <code>Curl_input_ntlm()</code> defined in
- lib/http_ntlm.c.</p>
+ exists when using NT Lan Manager (NTLM) authentication.
+ The problem specifically exists within
+ <code>Curl_input_ntlm()</code> defined in lib/http_ntlm.c.</p>
<p>Successful exploitation allows remote attackers to
- execute arbitrary code under the privileges of the target
- user. Exploitation requires that an attacker either coerce
- or force a target to connect to a malicious server using
- NTLM authentication.</p>
- </blockquote>
- <blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110902850731457">
+ execute arbitrary code under the privileges of the
+ target user. Exploitation requires that an attacker
+ either coerce or force a target to connect to a malicious
+ server using NTLM authentication.</p>
+ </blockquote> <blockquote
+ cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110902850731457">
<p>An exploitable stack-based buffer overflow condition
exists when using Kerberos authentication. The problem
specifically exists within the functions
<code>Curl_krb_kauth()</code> and <code>krb4_auth()</code>
defined in lib/krb4.c.</p>
<p>Successful exploitation allows remote attackers to
- execute arbitrary code under the privileges of the target
- user. Exploitation requires that an attacker either coerce
- or force a target to connect to a malicious server using
- Kerberos authentication.</p>
+ execute arbitrary code under the privileges of the
+ target user. Exploitation requires that an attacker
+ either coerce or force a target to connect to a malicious
+ server using Kerberos authentication.</p>
</blockquote>
</body>
- </description>
- <references>
- <bid>12615</bid>
- <bid>12616</bid>
- <cvename>CVE-2005-0490</cvename>
- <mlist msgid="FB24803D1DF2A34FA59FC157B77C970503E2462D@idserv04.idef.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110902850731457</mlist>
- <mlist msgid="FB24803D1DF2A34FA59FC157B77C970503E2462E@idserv04.idef.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110902601221592</mlist>
- </references>
- <dates>
- <discovery>2004-12-21</discovery>
- <entry>2005-02-27</entry>
+ </description> <references>
+ <bid>12615</bid> <bid>12616</bid> <cvename>CVE-2005-0490</cvename>
+ <mlist
+ msgid="FB24803D1DF2A34FA59FC157B77C970503E2462D@idserv04.idef.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110902850731457</mlist>
+ <mlist
+ msgid="FB24803D1DF2A34FA59FC157B77C970503E2462E@idserv04.idef.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110902601221592</mlist>
+ </references> <dates>
+ <discovery>2004-12-21</discovery> <entry>2005-02-27</entry>
</dates>
</vuln>
@@ -8236,15 +6860,13 @@ Note: Please add new entries to the beginning of this file.
<topic>cyrus-imapd -- multiple buffer overflow vulnerabilities</topic>
<affects>
<package>
- <name>cyrus-imapd</name>
- <range><lt>2.1.18</lt></range>
+ <name>cyrus-imapd</name> <range><lt>2.1.18</lt></range>
<range><gt>2.2.*</gt><lt>2.2.11</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>The Cyrus IMAP Server ChangeLog states:</p>
- <blockquote cite="http://asg.web.cmu.edu/cyrus/download/imapd/changes.html">
+ <p>The Cyrus IMAP Server ChangeLog states:</p> <blockquote
+ cite="http://asg.web.cmu.edu/cyrus/download/imapd/changes.html">
<ul>
<li>Fix possible single byte overflow in mailbox handling
code.</li>
@@ -8256,56 +6878,46 @@ Note: Please add new entries to the beginning of this file.
platforms where a filename may be larger than a mailbox
name).</li>
</ul>
- </blockquote>
- <p>The 2.1.X series are reportedly only affected by the second
+ </blockquote> <p>The 2.1.X series are reportedly only
+ affected by the second
issue.</p>
- <p>These issues may lead to execution of arbitrary code with
+ <p>These issues may lead to execution of arbitrary code
+ with
the permissions of the user running the Cyrus IMAP
Server.</p>
</body>
- </description>
- <references>
- <bid>12636</bid>
- <cvename>CVE-2005-0546</cvename>
+ </description> <references>
+ <bid>12636</bid> <cvename>CVE-2005-0546</cvename>
<url>http://asg.web.cmu.edu/cyrus/download/imapd/changes.html</url>
- </references>
- <dates>
- <discovery>2005-02-14</discovery>
- <entry>2005-02-27</entry>
+ </references> <dates>
+ <discovery>2005-02-14</discovery> <entry>2005-02-27</entry>
<modified>2005-04-05</modified>
</dates>
</vuln>
<vuln vid="2c5757f4-88bf-11d9-8720-0007e900f87b">
- <topic>sup -- format string vulnerability</topic>
- <affects>
+ <topic>sup -- format string vulnerability</topic> <affects>
<package>
- <name>sup</name>
- <range><lt>2.0.20050226</lt></range>
+ <name>sup</name> <range><lt>2.0.20050226</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>Debian Security Advisory reports:</p>
- <blockquote cite="http://www.securityfocus.com/advisories/6874">
+ <p>Debian Security Advisory reports:</p> <blockquote
+ cite="http://www.securityfocus.com/advisories/6874">
<p>jaguar@felinemenace.org discovered a format string
vulnerability in sup, a set of programs to synchronize
- collections of files across a number of machines,
- whereby a remote attacker could potentially cause
- arbitrary code to be executed with the privileges
- of the supfilesrv process (this process does not run
- automatically by default). </p>
+ collections of files across a number of machines, whereby
+ a remote attacker could potentially cause arbitrary
+ code to be executed with the privileges of the supfilesrv
+ process (this process does not run automatically by
+ default). </p>
</blockquote>
</body>
- </description>
- <references>
- <bid>10571</bid>
- <cvename>CVE-2004-0451</cvename>
+ </description> <references>
+ <bid>10571</bid> <cvename>CVE-2004-0451</cvename>
<url>http://www.securityfocus.com/advisories/6874</url>
- </references>
- <dates>
- <discovery>2004-06-19</discovery>
- <entry>2005-02-27</entry>
+ </references> <dates>
+ <discovery>2004-06-19</discovery> <entry>2005-02-27</entry>
</dates>
</vuln>
@@ -8313,75 +6925,53 @@ Note: Please add new entries to the beginning of this file.
<topic>mozilla -- insecure temporary directory vulnerability</topic>
<affects>
<package>
- <name>firefox</name>
- <range><lt>1.0.1,1</lt></range>
- </package>
- <package>
- <name>mozilla</name>
- <range><lt>1.7.6,2</lt></range>
- </package>
- <package>
- <name>linux-mozilla</name>
- <name>linux-mozilla-devel</name>
- <range><lt>1.7.6</lt></range>
- </package>
- <package>
- <name>netscape7</name>
- <range><ge>0</ge></range>
- </package>
- <package>
+ <name>firefox</name> <range><lt>1.0.1,1</lt></range>
+ </package> <package>
+ <name>mozilla</name> <range><lt>1.7.6,2</lt></range>
+ </package> <package>
+ <name>linux-mozilla</name> <name>linux-mozilla-devel</name>
+ <range><lt>1.7.6</lt></range>
+ </package> <package>
+ <name>netscape7</name> <range><ge>0</ge></range>
+ </package> <package>
<!-- These ports are obsolete. -->
- <name>de-linux-mozillafirebird</name>
+ <name>de-linux-mozillafirebird</name>
<name>el-linux-mozillafirebird</name>
- <name>ja-linux-mozillafirebird-gtk1</name>
- <name>ja-mozillafirebird-gtk2</name>
- <name>linux-mozillafirebird</name>
- <name>ru-linux-mozillafirebird</name>
- <name>zhCN-linux-mozillafirebird</name>
- <name>zhTW-linux-mozillafirebird</name>
- <range><ge>0</ge></range>
- </package>
- <package>
+ <name>ja-linux-mozillafirebird-gtk1</name>
+ <name>ja-mozillafirebird-gtk2</name>
+ <name>linux-mozillafirebird</name>
+ <name>ru-linux-mozillafirebird</name>
+ <name>zhCN-linux-mozillafirebird</name>
+ <name>zhTW-linux-mozillafirebird</name> <range><ge>0</ge></range>
+ </package> <package>
<!-- These package names are obsolete. -->
- <name>de-linux-netscape</name>
- <name>de-netscape7</name>
- <name>fr-linux-netscape</name>
- <name>fr-netscape7</name>
- <name>ja-linux-netscape</name>
- <name>ja-netscape7</name>
- <name>linux-netscape</name>
- <name>linux-phoenix</name>
- <name>mozilla+ipv6</name>
- <name>mozilla-embedded</name>
- <name>mozilla-firebird</name>
- <name>mozilla-gtk1</name>
- <name>mozilla-gtk2</name>
- <name>mozilla-gtk</name>
- <name>mozilla-thunderbird</name>
- <name>phoenix</name>
- <name>pt_BR-netscape7</name>
- <range><ge>0</ge></range>
- </package>
- </affects>
- <description>
+ <name>de-linux-netscape</name> <name>de-netscape7</name>
+ <name>fr-linux-netscape</name> <name>fr-netscape7</name>
+ <name>ja-linux-netscape</name> <name>ja-netscape7</name>
+ <name>linux-netscape</name> <name>linux-phoenix</name>
+ <name>mozilla+ipv6</name> <name>mozilla-embedded</name>
+ <name>mozilla-firebird</name> <name>mozilla-gtk1</name>
+ <name>mozilla-gtk2</name> <name>mozilla-gtk</name>
+ <name>mozilla-thunderbird</name> <name>phoenix</name>
+ <name>pt_BR-netscape7</name> <range><ge>0</ge></range>
+ </package>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Mozilla Foundation Security Advisory reports:</p>
- <blockquote cite="http://www.mozilla.org/security/announce/mfsa2005-28.html">
+ <blockquote
+ cite="http://www.mozilla.org/security/announce/mfsa2005-28.html">
<p>A predictable name is used for the plugin temporary
- directory. A malicious local user could symlink this to
- the victim's home directory and wait for the victim to run
- Firefox. When Firefox shuts down the victim's directory
- would be erased.</p>
+ directory. A malicious local user could symlink this
+ to the victim's home directory and wait for the victim
+ to run Firefox. When Firefox shuts down the victim's
+ directory would be erased.</p>
</blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<url>http://www.mozilla.org/security/announce/mfsa2005-28.html</url>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=281284</url>
- </references>
- <dates>
- <discovery>2005-02-06</discovery>
- <entry>2005-02-26</entry>
+ </references> <dates>
+ <discovery>2005-02-06</discovery> <entry>2005-02-26</entry>
</dates>
</vuln>
@@ -8389,86 +6979,64 @@ Note: Please add new entries to the beginning of this file.
<topic>mozilla -- arbitrary code execution vulnerability</topic>
<affects>
<package>
- <name>firefox</name>
- <range><lt>1.0.1,1</lt></range>
- </package>
- <package>
- <name>mozilla</name>
- <range><lt>1.7.6,2</lt></range>
- </package>
- <package>
- <name>linux-mozilla</name>
- <name>linux-mozilla-devel</name>
- <range><lt>1.7.6</lt></range>
- </package>
- <package>
- <name>netscape7</name>
- <range><ge>0</ge></range>
- </package>
- <package>
+ <name>firefox</name> <range><lt>1.0.1,1</lt></range>
+ </package> <package>
+ <name>mozilla</name> <range><lt>1.7.6,2</lt></range>
+ </package> <package>
+ <name>linux-mozilla</name> <name>linux-mozilla-devel</name>
+ <range><lt>1.7.6</lt></range>
+ </package> <package>
+ <name>netscape7</name> <range><ge>0</ge></range>
+ </package> <package>
<!-- These ports are obsolete. -->
- <name>de-linux-mozillafirebird</name>
+ <name>de-linux-mozillafirebird</name>
<name>el-linux-mozillafirebird</name>
- <name>ja-linux-mozillafirebird-gtk1</name>
- <name>ja-mozillafirebird-gtk2</name>
- <name>linux-mozillafirebird</name>
- <name>ru-linux-mozillafirebird</name>
- <name>zhCN-linux-mozillafirebird</name>
- <name>zhTW-linux-mozillafirebird</name>
- <range><ge>0</ge></range>
- </package>
- <package>
+ <name>ja-linux-mozillafirebird-gtk1</name>
+ <name>ja-mozillafirebird-gtk2</name>
+ <name>linux-mozillafirebird</name>
+ <name>ru-linux-mozillafirebird</name>
+ <name>zhCN-linux-mozillafirebird</name>
+ <name>zhTW-linux-mozillafirebird</name> <range><ge>0</ge></range>
+ </package> <package>
<!-- These package names are obsolete. -->
- <name>de-linux-netscape</name>
- <name>de-netscape7</name>
- <name>fr-linux-netscape</name>
- <name>fr-netscape7</name>
- <name>ja-linux-netscape</name>
- <name>ja-netscape7</name>
- <name>linux-netscape</name>
- <name>linux-phoenix</name>
- <name>mozilla+ipv6</name>
- <name>mozilla-embedded</name>
- <name>mozilla-firebird</name>
- <name>mozilla-gtk1</name>
- <name>mozilla-gtk2</name>
- <name>mozilla-gtk</name>
- <name>mozilla-thunderbird</name>
- <name>phoenix</name>
- <name>pt_BR-netscape7</name>
- <range><ge>0</ge></range>
- </package>
- </affects>
- <description>
+ <name>de-linux-netscape</name> <name>de-netscape7</name>
+ <name>fr-linux-netscape</name> <name>fr-netscape7</name>
+ <name>ja-linux-netscape</name> <name>ja-netscape7</name>
+ <name>linux-netscape</name> <name>linux-phoenix</name>
+ <name>mozilla+ipv6</name> <name>mozilla-embedded</name>
+ <name>mozilla-firebird</name> <name>mozilla-gtk1</name>
+ <name>mozilla-gtk2</name> <name>mozilla-gtk</name>
+ <name>mozilla-thunderbird</name> <name>phoenix</name>
+ <name>pt_BR-netscape7</name> <range><ge>0</ge></range>
+ </package>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Mozilla Foundation Security Advisory reports:</p>
- <blockquote cite="http://www.mozilla.org/security/announce/mfsa2005-27.html">
+ <blockquote
+ cite="http://www.mozilla.org/security/announce/mfsa2005-27.html">
<p>Plugins (such as flash) can be used to load privileged
- content into a frame. Once loaded various spoofs can be
- applied to get the user to interact with the privileged
- content. Michael Krax's "Fireflashing" example
- demonstrates that an attacker can open about:config in a
- frame, hide it with an opacity setting, and if the
- attacker can get the victim to click at a particular spot
- (design some kind of simple game) you could toggle boolean
- preferences, some of which would make further attacks
- easier.</p>
- <p>The "firescrolling" example demonstrates arbitrary code
+ content into a frame. Once loaded various spoofs can
+ be applied to get the user to interact with the privileged
+ content. Michael Krax's "Fireflashing" example demonstrates
+ that an attacker can open about:config in a frame, hide
+ it with an opacity setting, and if the attacker can get
+ the victim to click at a particular spot (design some
+ kind of simple game) you could toggle boolean preferences,
+ some of which would make further attacks easier.</p>
+ <p>The "firescrolling" example demonstrates arbitrary
+ code
execution (in this case downloading a file) by convincing
the user to scroll twice.</p>
- </blockquote>
- <p><strong>Workaround:</strong> Disable JavaScript.</p>
+ </blockquote> <p><strong>Workaround:</strong> Disable
+ JavaScript.</p>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2005-0527</cvename>
<url>http://www.mikx.de/fireflashing/</url>
<url>http://www.mikx.de/firescrolling/</url>
<url>http://www.mozilla.org/security/announce/mfsa2005-27.html</url>
- </references>
- <dates>
- <discovery>2005-02-24</discovery>
- <entry>2005-02-26</entry>
+ </references> <dates>
+ <discovery>2005-02-24</discovery> <entry>2005-02-26</entry>
</dates>
</vuln>
@@ -8476,23 +7044,18 @@ Note: Please add new entries to the beginning of this file.
<topic>mkbold-mkitalic -- format string vulnerability</topic>
<affects>
<package>
- <name>mkbold-mkitalic</name>
- <range><lt>0.07</lt></range>
+ <name>mkbold-mkitalic</name> <range><lt>0.07</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The version 0.06_1 and prior
have a format string vulnerability which can be triggered
by using a carefully-crafted BDF font file.</p>
</body>
- </description>
- <references>
+ </description> <references>
<url>http://home.jp.FreeBSD.org/cgi-bin/showmail/ports-jp/15568</url>
- </references>
- <dates>
- <discovery>2005-02-23</discovery>
- <entry>2005-02-24</entry>
+ </references> <dates>
+ <discovery>2005-02-23</discovery> <entry>2005-02-24</entry>
</dates>
</vuln>
@@ -8500,91 +7063,87 @@ Note: Please add new entries to the beginning of this file.
<topic>phpbb -- multiple information disclosure vulnerabilities</topic>
<affects>
<package>
- <name>phpbb</name>
- <range><lt>2.0.12</lt></range>
+ <name>phpbb</name> <range><lt>2.0.12</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>psoTFX reports:</p>
- <blockquote cite="http://www.phpbb.com/phpBB/viewtopic.php?f=14&amp;t=265423">
- <p>phpBB Group are pleased to announce the release of phpBB
+ <p>psoTFX reports:</p> <blockquote
+ cite="http://www.phpbb.com/phpBB/viewtopic.php?f=14&amp;t=265423">
+ <p>phpBB Group are pleased to announce the release of
+ phpBB
2.0.12 the "Horray for Furrywood" release. This release
addresses a number of bugs and a couple of potential
exploits. [...] one of the potential exploits addressed
- in this release could be serious in certain situations and
- thus we urge all users, as always, to upgrade to this
- release as soon as possible. Mostly this release is
- concerned with eliminating disclosures of information
+ in this release could be serious in certain situations
+ and thus we urge all users, as always, to upgrade to
+ this release as soon as possible. Mostly this release
+ is concerned with eliminating disclosures of information
which while useful in debug situations may allow third
- parties to gain information which could be used to do harm
- via unknown or unfixed exploits in this or other
+ parties to gain information which could be used to do
+ harm via unknown or unfixed exploits in this or other
applications.</p>
- </blockquote>
- <p>The ChangeLog for phpBB 2.0.12 states:</p>
- <blockquote cite="http://www.phpbb.com/support/documents.php?mode=changelog">
+ </blockquote> <p>The ChangeLog for phpBB 2.0.12 states:</p>
+ <blockquote
+ cite="http://www.phpbb.com/support/documents.php?mode=changelog">
<ul>
<li>Prevented full path display on critical messages</li>
- <li>Fixed full path disclosure in username handling caused
+ <li>Fixed full path disclosure in username handling
+ caused
by a PHP 4.3.10 bug - <strong>AnthraX101</strong></li>
<li>Added exclude list to unsetting globals (if
register_globals is on) -
<strong>SpoofedExistence</strong></li>
- <li>Fixed arbitrary file disclosure vulnerability in avatar
+ <li>Fixed arbitrary file disclosure vulnerability in
+ avatar
handling functions - <strong>AnthraX101</strong></li>
<li>Fixed arbitrary file unlink vulnerability in avatar
handling functions - <strong>AnthraX101</strong></li>
- <li>Fixed path disclosure bug in search.php caused by a
+ <li>Fixed path disclosure bug in search.php caused by
+ a
PHP 4.3.10 bug (related to AnthraX101's discovery)</li>
- <li>Fixed path disclosure bug in viewtopic.php caused by
+ <li>Fixed path disclosure bug in viewtopic.php caused
+ by
a PHP 4.3.10 bug - <strong>matrix_killer</strong></li>
</ul>
</blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<url>http://www.phpbb.com/support/documents.php?mode=changelog</url>
<url>http://www.phpbb.com/phpBB/viewtopic.php?f=14&amp;t=265423</url>
<freebsdpr>ports/77943</freebsdpr>
- </references>
- <dates>
- <discovery>2005-02-22</discovery>
- <entry>2005-02-23</entry>
+ </references> <dates>
+ <discovery>2005-02-22</discovery> <entry>2005-02-23</entry>
<modified>2005-02-25</modified>
</dates>
</vuln>
<vuln vid="1d3a2737-7eb7-11d9-acf7-000854d03344">
- <topic>unace -- multiple vulnerabilities</topic>
- <affects>
+ <topic>unace -- multiple vulnerabilities</topic> <affects>
<package>
- <name>unace</name>
- <range><lt>unace-1.2b_2</lt></range>
+ <name>unace</name> <range><lt>unace-1.2b_2</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ulf Härnhammar reports multiple security vulnerabilities
in unace-1.2b:</p>
<ul>
- <li>There are buffer overflows when extracting, testing or
+ <li>There are buffer overflows when extracting, testing
+ or
listing specially prepared ACE archives.</li>
- <li>There are directory traversal bugs when extracting ACE
+ <li>There are directory traversal bugs when extracting
+ ACE
archives.</li>
- <li>There are also buffer overflows when dealing with long
+ <li>There are also buffer overflows when dealing with
+ long
(>17000 characters) command line arguments.</li>
</ul>
</body>
- </description>
- <references>
- <certvu>215006</certvu>
- <cvename>CVE-2005-0160</cvename>
- <cvename>CVE-2005-0161</cvename>
- <mlist msgid="1109113175.421bb95705d42@webmail.uu.se">http://marc.theaimsgroup.com/?l=full-disclosure&amp;m=110911451613135</mlist>
- </references>
- <dates>
- <discovery>2005-02-14</discovery>
- <entry>2005-02-22</entry>
+ </description> <references>
+ <certvu>215006</certvu> <cvename>CVE-2005-0160</cvename>
+ <cvename>CVE-2005-0161</cvename> <mlist
+ msgid="1109113175.421bb95705d42@webmail.uu.se">http://marc.theaimsgroup.com/?l=full-disclosure&amp;m=110911451613135</mlist>
+ </references> <dates>
+ <discovery>2005-02-14</discovery> <entry>2005-02-22</entry>
<modified>2005-10-01</modified>
</dates>
</vuln>
@@ -8593,36 +7152,31 @@ Note: Please add new entries to the beginning of this file.
<topic>putty -- pscp/psftp heap corruption vulnerabilities</topic>
<affects>
<package>
- <name>putty</name>
- <range><lt>0.57</lt></range>
+ <name>putty</name> <range><lt>0.57</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>Simon Tatham reports:</p>
- <blockquote cite="http://lists.tartarus.org/pipermail/putty-announce/2005/000012.html">
+ <p>Simon Tatham reports:</p> <blockquote
+ cite="http://lists.tartarus.org/pipermail/putty-announce/2005/000012.html">
<p>This version fixes a security hole in previous versions
- of PuTTY, which can allow a malicious SFTP server to
- attack your client. If you use either PSCP or PSFTP, you
- should upgrade. Users of the main PuTTY program are not
- affected. (However, note that the server must have passed
- host key verification before this attack can be launched,
- so a man-in-the-middle shouldn't be able to attack you if
- you're careful.)</p>
- </blockquote>
- </body>
- </description>
- <references>
- <bid>12601</bid>
- <cvename>CVE-2005-0467</cvename>
- <mlist msgid="E1D2taM-0005R1-00@ixion.tartarus.org">http://lists.tartarus.org/pipermail/putty-announce/2005/000012.html</mlist>
- <mlist msgid="FB24803D1DF2A34FA59FC157B77C970503E2462F@idserv04.idef.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110902510713763</mlist>
+ of PuTTY, which can allow a malicious SFTP server to
+ attack your client. If you use either PSCP or PSFTP,
+ you should upgrade. Users of the main PuTTY program are
+ not affected. (However, note that the server must have
+ passed host key verification before this attack can be
+ launched, so a man-in-the-middle shouldn't be able to
+ attack you if you're careful.)</p>
+ </blockquote>
+ </body>
+ </description> <references>
+ <bid>12601</bid> <cvename>CVE-2005-0467</cvename> <mlist
+ msgid="E1D2taM-0005R1-00@ixion.tartarus.org">http://lists.tartarus.org/pipermail/putty-announce/2005/000012.html</mlist>
+ <mlist
+ msgid="FB24803D1DF2A34FA59FC157B77C970503E2462F@idserv04.idef.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110902510713763</mlist>
<url>http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-sftp-readdir.html</url>
<url>http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-sftp-string.html</url>
- </references>
- <dates>
- <discovery>2005-02-20</discovery>
- <entry>2005-02-20</entry>
+ </references> <dates>
+ <discovery>2005-02-20</discovery> <entry>2005-02-20</entry>
<modified>2005-02-23</modified>
</dates>
</vuln>
@@ -8631,98 +7185,79 @@ Note: Please add new entries to the beginning of this file.
<topic>kdelibs -- insecure temporary file creation</topic>
<affects>
<package>
- <name>kdelibs</name>
- <name>ja-kdelibs</name>
+ <name>kdelibs</name> <name>ja-kdelibs</name>
<range><lt>3.3.2_5</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>Davide Madrisan reports:</p>
- <blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110814653804757">
+ <p>Davide Madrisan reports:</p> <blockquote
+ cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110814653804757">
<p>The `dcopidlng' script in the KDE library package
(kdelibs-3.3.2/dcop/dcopidlng/dcopidlng) creates temporary
files in a unsecure manner.</p>
- </blockquote>
- <p><strong>Note:</strong> dcopidlng is only used at build
- time, so only users installing KDE are vulnerable, not users
- already running KDE.</p>
+ </blockquote> <p><strong>Note:</strong> dcopidlng is only
+ used at build
+ time, so only users installing KDE are vulnerable, not
+ users already running KDE.</p>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2005-0365</cvename>
- <url>http://bugs.kde.org/show_bug.cgi?id=97608</url>
- <mlist msgid="200502110916.48921.davide.madrisan@qilinux.it">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110814653804757</mlist>
- </references>
- <dates>
- <discovery>2005-01-21</discovery>
- <entry>2005-02-18</entry>
+ <url>http://bugs.kde.org/show_bug.cgi?id=97608</url> <mlist
+ msgid="200502110916.48921.davide.madrisan@qilinux.it">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110814653804757</mlist>
+ </references> <dates>
+ <discovery>2005-01-21</discovery> <entry>2005-02-18</entry>
<modified>2005-02-20</modified>
</dates>
</vuln>
<vuln vid="74c86a29-81ef-11d9-a9e7-0001020eed82">
- <topic>bidwatcher -- format string vulnerability</topic>
- <affects>
+ <topic>bidwatcher -- format string vulnerability</topic> <affects>
<package>
- <name>bidwatcher</name>
- <range><lt>1.3.17</lt></range>
+ <name>bidwatcher</name> <range><lt>1.3.17</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>A Debian Security Advisory reports:</p>
- <blockquote cite="http://www.debian.org/security/2005/dsa-687">
+ <p>A Debian Security Advisory reports:</p> <blockquote
+ cite="http://www.debian.org/security/2005/dsa-687">
<p>Ulf Härnhammer from the Debian Security Audit Project
- discovered a format string vulnerability in bidwatcher, a
- tool for watching and bidding on eBay auctions. This
- problem can be triggered remotely by a web server of eBay,
- or someone pretending to be eBay, sending certain data
- back.</p>
+ discovered a format string vulnerability in bidwatcher,
+ a tool for watching and bidding on eBay auctions. This
+ problem can be triggered remotely by a web server of
+ eBay, or someone pretending to be eBay, sending certain
+ data back.</p>
</blockquote>
</body>
- </description>
- <references>
- <bid>12590</bid>
- <cvename>CVE-2005-0158</cvename>
+ </description> <references>
+ <bid>12590</bid> <cvename>CVE-2005-0158</cvename>
<url>http://www.debian.org/security/2005/dsa-687</url>
- </references>
- <dates>
- <discovery>2005-02-18</discovery>
- <entry>2005-02-18</entry>
+ </references> <dates>
+ <discovery>2005-02-18</discovery> <entry>2005-02-18</entry>
</dates>
</vuln>
<vuln vid="2d8cf857-81ea-11d9-a9e7-0001020eed82">
- <topic>gftp -- directory traversal vulnerability</topic>
- <affects>
+ <topic>gftp -- directory traversal vulnerability</topic> <affects>
<package>
- <name>gftp</name>
- <range><lt>2.0.18</lt></range>
+ <name>gftp</name> <range><lt>2.0.18</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>A Debian Security Advisory reports:</p>
- <blockquote cite="http://www.debian.org/security/2005/dsa-686">
+ <p>A Debian Security Advisory reports:</p> <blockquote
+ cite="http://www.debian.org/security/2005/dsa-686">
<p>Albert Puigsech Galicia discovered a directory traversal
vulnerability in a proprietary FTP client (CAN-2004-1376)
which is also present in gftp, a GTK+ FTP client. A
malicious server could provide a specially crafted
- filename that could cause arbitrary files to be
- overwritten or created by the client.</p>
+ filename that could cause arbitrary files to be overwritten
+ or created by the client.</p>
</blockquote>
</body>
- </description>
- <references>
- <bid>12539</bid>
- <cvename>CVE-2005-0372</cvename>
+ </description> <references>
+ <bid>12539</bid> <cvename>CVE-2005-0372</cvename>
<url>http://www.debian.org/security/2005/dsa-686</url>
<url>http://www.gftp.org/changelog.html</url>
- </references>
- <dates>
- <discovery>2005-02-04</discovery>
- <entry>2005-02-18</entry>
+ </references> <dates>
+ <discovery>2005-02-04</discovery> <entry>2005-02-18</entry>
</dates>
</vuln>
@@ -8730,37 +7265,30 @@ Note: Please add new entries to the beginning of this file.
<topic>opera -- "data:" URI handler spoofing vulnerability</topic>
<affects>
<package>
- <name>opera</name>
- <name>opera-devel</name>
- <name>linux-opera</name>
- <range><lt>7.54.20050131</lt></range>
+ <name>opera</name> <name>opera-devel</name>
+ <name>linux-opera</name> <range><lt>7.54.20050131</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>A Secunia Advisory reports:</p>
- <blockquote cite="http://secunia.com/advisories/13818/">
+ <p>A Secunia Advisory reports:</p> <blockquote
+ cite="http://secunia.com/advisories/13818/">
<p>Michael Holzt has discovered a vulnerability in Opera,
- which can be exploited by malicious people to trick users
- into executing malicious files.</p>
+ which can be exploited by malicious people to trick
+ users into executing malicious files.</p>
<p>The vulnerability is caused due to an error in the
- processing of "data:" URIs, causing wrong information to
- be shown in a download dialog. This can be exploited by
- e.g. a malicious website to trick users into executing a
- malicious file by supplying a specially crafted "data:"
+ processing of "data:" URIs, causing wrong information
+ to be shown in a download dialog. This can be exploited
+ by e.g. a malicious website to trick users into executing
+ a malicious file by supplying a specially crafted "data:"
URI.</p>
</blockquote>
</body>
- </description>
- <references>
- <cvename>CVE-2005-0456</cvename>
- <certvu>882926</certvu>
+ </description> <references>
+ <cvename>CVE-2005-0456</cvename> <certvu>882926</certvu>
<url>http://secunia.com/advisories/13818/</url>
<url>http://www.opera.com/freebsd/changelogs/754u2/</url>
- </references>
- <dates>
- <discovery>2005-01-12</discovery>
- <entry>2005-02-18</entry>
+ </references> <dates>
+ <discovery>2005-01-12</discovery> <entry>2005-02-18</entry>
</dates>
</vuln>
@@ -8768,32 +7296,26 @@ Note: Please add new entries to the beginning of this file.
<topic>opera -- kfmclient exec command execution vulnerability</topic>
<affects>
<package>
- <name>opera</name>
- <name>opera-devel</name>
- <name>linux-opera</name>
- <range><lt>7.54.20050131</lt></range>
+ <name>opera</name> <name>opera-devel</name>
+ <name>linux-opera</name> <range><lt>7.54.20050131</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>Giovanni Delvecchio reports:</p>
- <blockquote cite="http://www.zone-h.org/advisories/read/id=6503">
+ <p>Giovanni Delvecchio reports:</p> <blockquote
+ cite="http://www.zone-h.org/advisories/read/id=6503">
<p>Opera for linux uses "kfmclient exec" as "Default
- Application" to handle saved files. This could be used by
- malicious remote users to execute arbitrary shell commands
- on a target system.</p>
+ Application" to handle saved files. This could be used
+ by malicious remote users to execute arbitrary shell
+ commands on a target system.</p>
</blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2004-1491</cvename>
<url>http://secunia.com/advisories/13447/</url>
<url>http://www.opera.com/freebsd/changelogs/754u2/</url>
<url>http://www.zone-h.org/advisories/read/id=6503</url>
- </references>
- <dates>
- <discovery>2004-12-12</discovery>
- <entry>2005-02-18</entry>
+ </references> <dates>
+ <discovery>2004-12-12</discovery> <entry>2005-02-18</entry>
</dates>
</vuln>
@@ -8802,100 +7324,80 @@ Note: Please add new entries to the beginning of this file.
parser</topic>
<affects>
<package>
- <name>postgresql</name>
- <name>postgresql-server</name>
- <name>ja-postgresql</name>
- <range><lt>7.3.9_1</lt></range>
+ <name>postgresql</name> <name>postgresql-server</name>
+ <name>ja-postgresql</name> <range><lt>7.3.9_1</lt></range>
<range><gt>7.4.*</gt><lt>7.4.7_1</lt></range>
<range><gt>8.*</gt><lt>8.0.1_1</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PL/PgSQL parser in postgresql is vulnerable to several
buffer overflows. These could be exploited by a remote
- attacker to execute arbitrary code with the permissions of
- the postgresql server by running a specially crafted
+ attacker to execute arbitrary code with the permissions
+ of the postgresql server by running a specially crafted
query.</p>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2005-0247</cvename>
<url>http://archives.postgresql.org/pgsql-committers/2005-02/msg00049.php</url>
- </references>
- <dates>
- <discovery>2005-02-07</discovery>
- <entry>2005-02-17</entry>
+ </references> <dates>
+ <discovery>2005-02-07</discovery> <entry>2005-02-17</entry>
<modified>2005-02-19</modified>
</dates>
</vuln>
<vuln vid="fdad8a87-7f94-11d9-a9e7-0001020eed82">
- <topic>awstats -- arbitrary command execution</topic>
- <affects>
+ <topic>awstats -- arbitrary command execution</topic> <affects>
<package>
- <name>awstats</name>
- <range><lt>6.4</lt></range>
+ <name>awstats</name> <range><lt>6.4</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>Several input validation errors exist in AWStats that allow a
- remote unauthenticated attacker to execute arbitrary commands
- with the priviliges of the web server. These programming
- errors involve CGI parameters including
+ <p>Several input validation errors exist in AWStats that
+ allow a
+ remote unauthenticated attacker to execute arbitrary
+ commands with the priviliges of the web server. These
+ programming errors involve CGI parameters including
<code>loadplugin</code>, <code>logfile</code>,
<code>pluginmode</code>, <code>update</code>, and possibly
others.</p>
- <p>Additionally, the <code>debug</code> and other CGI parameters
- may be used to cause AWStats to disclose AWStats and system
- configuration information.</p>
- </body>
- </description>
- <references>
- <cvename>CVE-2005-0362</cvename>
- <cvename>CVE-2005-0363</cvename>
- <cvename>CVE-2005-0435</cvename>
- <cvename>CVE-2005-0436</cvename>
- <cvename>CVE-2005-0437</cvename>
- <cvename>CVE-2005-0438</cvename>
- <bid>12543</bid>
- <bid>12545</bid>
- <mlist msgid="20050214081040.3370.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110840530924124</mlist>
+ <p>Additionally, the <code>debug</code> and other CGI
+ parameters
+ may be used to cause AWStats to disclose AWStats and
+ system configuration information.</p>
+ </body>
+ </description> <references>
+ <cvename>CVE-2005-0362</cvename> <cvename>CVE-2005-0363</cvename>
+ <cvename>CVE-2005-0435</cvename> <cvename>CVE-2005-0436</cvename>
+ <cvename>CVE-2005-0437</cvename> <cvename>CVE-2005-0438</cvename>
+ <bid>12543</bid> <bid>12545</bid> <mlist
+ msgid="20050214081040.3370.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110840530924124</mlist>
<url>http://awstats.sourceforge.net/docs/awstats_changelog.txt</url>
<url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=294488</url>
<url>http://packetstormsecurity.nl/0501-exploits/AWStatsVulnAnalysis.pdf</url>
- </references>
- <dates>
- <discovery>2005-02-10</discovery>
- <entry>2005-02-16</entry>
+ </references> <dates>
+ <discovery>2005-02-10</discovery> <entry>2005-02-16</entry>
<modified>2005-02-23</modified>
</dates>
</vuln>
<vuln vid="5a5422fd-7e1a-11d9-a9e7-0001020eed82">
- <topic>powerdns -- DoS vulnerability</topic>
- <affects>
+ <topic>powerdns -- DoS vulnerability</topic> <affects>
<package>
- <name>powerdns</name>
- <range><lt>2.9.17</lt></range>
+ <name>powerdns</name> <range><lt>2.9.17</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PowerDNS is vulnerable to a temporary denial-of-service
- vulnerability that can be triggered using a random stream of
- bytes.</p>
+ vulnerability that can be triggered using a random stream
+ of bytes.</p>
</body>
- </description>
- <references>
+ </description> <references>
<bid>12446</bid>
<url>http://ds9a.nl/cgi-bin/cvstrac/pdns/tktview?tn=21</url>
<url>http://doc.powerdns.com/changelog.html#CHANGELOG-2-9-17</url>
- </references>
- <dates>
- <discovery>2004-09-18</discovery>
- <entry>2005-02-14</entry>
+ </references> <dates>
+ <discovery>2004-09-18</discovery> <entry>2005-02-14</entry>
</dates>
</vuln>
@@ -8903,109 +7405,79 @@ Note: Please add new entries to the beginning of this file.
<topic>emacs -- movemail format string vulnerability</topic>
<affects>
<package>
- <name>zh-emacs</name>
- <name>emacs</name>
+ <name>zh-emacs</name> <name>emacs</name>
<range><lt>20.7_4</lt></range>
<range><gt>21.*</gt><lt>21.3_4</lt></range>
- </package>
- <package>
- <name>xemacs</name>
- <name>xemacs-mule</name>
- <name>zh-xemacs</name>
- <name>zh-xemacs-mule</name>
- <range><lt>21.4.17</lt></range>
- </package>
- <package>
- <name>xemacs-devel</name>
- <range><lt>21.5.b19,1</lt></range>
- </package>
- <package>
- <name>xemacs-devel-21.5</name>
- <range><eq>b11</eq></range>
- </package>
- <package>
- <name>xemacs-devel-mule</name>
- <range><lt>21.5.b19</lt></range>
- </package>
- <package>
- <name>mule-common</name>
- <name>hanemacs</name>
+ </package> <package>
+ <name>xemacs</name> <name>xemacs-mule</name> <name>zh-xemacs</name>
+ <name>zh-xemacs-mule</name> <range><lt>21.4.17</lt></range>
+ </package> <package>
+ <name>xemacs-devel</name> <range><lt>21.5.b19,1</lt></range>
+ </package> <package>
+ <name>xemacs-devel-21.5</name> <range><eq>b11</eq></range>
+ </package> <package>
+ <name>xemacs-devel-mule</name> <range><lt>21.5.b19</lt></range>
+ </package> <package>
+ <name>mule-common</name> <name>hanemacs</name>
<range><gt>0</gt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Max Vozeler discovered several format string
- vulnerabilities in the movemail utility of Emacs. They can
- be exploited when connecting to a malicious POP server and
- can allow an attacker can execute arbitrary code under the
- privileges of the user running Emacs.</p>
+ vulnerabilities in the movemail utility of Emacs. They
+ can be exploited when connecting to a malicious POP server
+ and can allow an attacker can execute arbitrary code under
+ the privileges of the user running Emacs.</p>
</body>
- </description>
- <references>
- <cvename>CVE-2005-0100</cvename>
- <bid>12462</bid>
- </references>
- <dates>
- <discovery>2005-01-31</discovery>
- <entry>2005-02-14</entry>
+ </description> <references>
+ <cvename>CVE-2005-0100</cvename> <bid>12462</bid>
+ </references> <dates>
+ <discovery>2005-01-31</discovery> <entry>2005-02-14</entry>
</dates>
</vuln>
<vuln vid="bc4a7efa-7d9a-11d9-a9e7-0001020eed82">
- <topic>ngircd -- format string vulnerability</topic>
- <affects>
+ <topic>ngircd -- format string vulnerability</topic> <affects>
<package>
- <name>ngircd</name>
- <range><lt>0.8.3</lt></range>
+ <name>ngircd</name> <range><lt>0.8.3</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>A No System Group security advisory reports that ngircd is
+ <p>A No System Group security advisory reports that ngircd
+ is
vulnerable to a format string vulnerability in the
<code>Log_Resolver()</code> function of log.c, if IDENT
- support is enabled. This could allow a remote attacker to
- execute arbitrary code with the permissions of the ngircd
- daemon, which is <q>root</q> by default.</p>
- <p><strong>Note:</strong> By default the FreeBSD ngircd port
+ support is enabled. This could allow a remote attacker
+ to execute arbitrary code with the permissions of the
+ ngircd daemon, which is <q>root</q> by default.</p>
+ <p><strong>Note:</strong> By default the FreeBSD ngircd
+ port
does not enable IDENT support.</p>
</body>
- </description>
- <references>
- <cvename>CVE-2005-0226</cvename>
- <bid>12434</bid>
- <mlist msgid="20050203020909.21785.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110746413108183</mlist>
- </references>
- <dates>
- <discovery>2005-02-03</discovery>
- <entry>2005-02-13</entry>
+ </description> <references>
+ <cvename>CVE-2005-0226</cvename> <bid>12434</bid> <mlist
+ msgid="20050203020909.21785.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110746413108183</mlist>
+ </references> <dates>
+ <discovery>2005-02-03</discovery> <entry>2005-02-13</entry>
</dates>
</vuln>
<vuln vid="7f6dd1bd-7d99-11d9-a9e7-0001020eed82">
- <topic>ngircd -- buffer overflow vulnerability</topic>
- <affects>
+ <topic>ngircd -- buffer overflow vulnerability</topic> <affects>
<package>
- <name>ngircd</name>
- <range><lt>0.8.2</lt></range>
+ <name>ngircd</name> <range><lt>0.8.2</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Florian Westphal discovered a buffer overflow in ngircd
which can be used remotely crash the server and possibly
execute arbitrary code.</p>
</body>
- </description>
- <references>
- <cvename>CVE-2005-0199</cvename>
- <bid>12397</bid>
+ </description> <references>
+ <cvename>CVE-2005-0199</cvename> <bid>12397</bid>
<mlist>http://arthur.ath.cx/pipermail/ngircd-ml/2005-January/000228.html</mlist>
- </references>
- <dates>
- <discovery>2005-01-26</discovery>
- <entry>2005-02-13</entry>
+ </references> <dates>
+ <discovery>2005-01-26</discovery> <entry>2005-02-13</entry>
</dates>
</vuln>
@@ -9013,31 +7485,25 @@ Note: Please add new entries to the beginning of this file.
<topic>mod_python -- information leakage vulnerability</topic>
<affects>
<package>
- <name>mod_python</name>
- <range><lt>2.7.11</lt></range>
+ <name>mod_python</name> <range><lt>2.7.11</lt></range>
<range><gt>3.*</gt><lt>3.1.4</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>Mark J Cox reports:</p>
- <blockquote>
+ <p>Mark J Cox reports:</p> <blockquote>
<p>Graham Dumpleton discovered a flaw which can affect
anyone using the publisher handle of the Apache Software
Foundation mod_python. The publisher handle lets you
- publish objects inside modules to make them callable via
- URL. The flaw allows a carefully crafted URL to obtain
- extra information that should not be visible (information
- leak).</p>
+ publish objects inside modules to make them callable
+ via URL. The flaw allows a carefully crafted URL to
+ obtain extra information that should not be visible
+ (information leak).</p>
</blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2005-0088</cvename>
- </references>
- <dates>
- <discovery>2005-01-30</discovery>
- <entry>2005-02-13</entry>
+ </references> <dates>
+ <discovery>2005-01-30</discovery> <entry>2005-02-13</entry>
</dates>
</vuln>
@@ -9045,42 +7511,34 @@ Note: Please add new entries to the beginning of this file.
<topic>mailman -- directory traversal vulnerability</topic>
<affects>
<package>
- <name>mailman</name>
- <name>ja-mailman</name>
+ <name>mailman</name> <name>ja-mailman</name>
<range><lt>2.1.5_2</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>A directory traversal vulnerability in mailman allow remote
+ <p>A directory traversal vulnerability in mailman allow
+ remote
attackers to read arbitrary files due to inadequate input
sanitizing. This could, among other things, lead remote
attackers to gaining access to the mailman configuration
database (which contains subscriber email addresses and
passwords) or to the mail archives for private lists.</p>
</body>
- </description>
- <references>
- <cvename>CVE-2005-0202</cvename>
- <mlist msgid="20050209181502.GA26136@grok.org.uk">http://marc.theaimsgroup.com/?l=full-disclosure&amp;m=110797575304304</mlist>
- </references>
- <dates>
- <discovery>2005-01-02</discovery>
- <entry>2005-02-12</entry>
+ </description> <references>
+ <cvename>CVE-2005-0202</cvename> <mlist
+ msgid="20050209181502.GA26136@grok.org.uk">http://marc.theaimsgroup.com/?l=full-disclosure&amp;m=110797575304304</mlist>
+ </references> <dates>
+ <discovery>2005-01-02</discovery> <entry>2005-02-12</entry>
</dates>
</vuln>
<vuln vid="72da8af6-7c75-11d9-8cc5-000854d03344">
- <topic>enscript -- multiple vulnerabilities</topic>
- <affects>
+ <topic>enscript -- multiple vulnerabilities</topic> <affects>
<package>
- <name>enscript-a4</name>
- <name>enscript-letter</name>
- <name>enscript-letterdj</name>
- <range><lt>1.6.4_1</lt></range>
+ <name>enscript-a4</name> <name>enscript-letter</name>
+ <name>enscript-letterdj</name> <range><lt>1.6.4_1</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Erik Sjölund discovered several issues in enscript:
it suffers from several buffer overflows, quotes and shell
@@ -9088,16 +7546,12 @@ Note: Please add new entries to the beginning of this file.
and it supported taking input from an arbitrary command
pipe, with unwanted side effects.</p>
</body>
- </description>
- <references>
- <cvename>CVE-2004-1184</cvename>
- <cvename>CVE-2004-1185</cvename>
+ </description> <references>
+ <cvename>CVE-2004-1184</cvename> <cvename>CVE-2004-1185</cvename>
<cvename>CVE-2004-1186</cvename>
<url>http://www.gentoo.org/security/en/glsa/glsa-200502-03.xml</url>
- </references>
- <dates>
- <discovery>2005-02-02</discovery>
- <entry>2005-02-11</entry>
+ </references> <dates>
+ <discovery>2005-02-02</discovery> <entry>2005-02-11</entry>
</dates>
</vuln>
@@ -9105,37 +7559,29 @@ Note: Please add new entries to the beginning of this file.
<topic>postgresql -- privilege escalation vulnerability</topic>
<affects>
<package>
- <name>postgresql</name>
- <name>postgresql-server</name>
- <name>ja-postgresql</name>
- <range><lt>7.3.9</lt></range>
+ <name>postgresql</name> <name>postgresql-server</name>
+ <name>ja-postgresql</name> <range><lt>7.3.9</lt></range>
<range><gt>7.4.*</gt><lt>7.4.7</lt></range>
<range><gt>8.*</gt><lt>8.0.1</lt></range>
+ </package> <package>
+ <name>postgresql-devel</name> <range><le>8.0.1,1</le></range>
</package>
- <package>
- <name>postgresql-devel</name>
- <range><le>8.0.1,1</le></range>
- </package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>John Heasman and others disovered that non-privileged users
+ <p>John Heasman and others disovered that non-privileged
+ users
could use the <q>LOAD</q> extension to load arbitrary
libraries into the postgres server process space. This
could be used by non-privileged local users to execute
arbitrary code with the privileges of the postgresql
server.</p>
</body>
- </description>
- <references>
- <bid>12411</bid>
- <cvename>CVE-2005-0227</cvename>
+ </description> <references>
+ <bid>12411</bid> <cvename>CVE-2005-0227</cvename>
<mlist>http://archives.postgresql.org/pgsql-announce/2005-02/msg00000.php</mlist>
<mlist>http://archives.postgresql.org/pgsql-bugs/2005-01/msg00269.php</mlist>
- </references>
- <dates>
- <discovery>2005-01-21</discovery>
- <entry>2005-02-08</entry>
+ </references> <dates>
+ <discovery>2005-01-21</discovery> <entry>2005-02-08</entry>
</dates>
</vuln>
@@ -9143,138 +7589,122 @@ Note: Please add new entries to the beginning of this file.
<topic>ethereal -- multiple protocol dissectors vulnerabilities</topic>
<affects>
<package>
- <name>ethereal</name>
- <name>ethereal-lite</name>
- <name>tethereal</name>
- <name>tethereal-lite</name>
+ <name>ethereal</name> <name>ethereal-lite</name>
+ <name>tethereal</name> <name>tethereal-lite</name>
<range><ge>0.8.10</ge><lt>0.10.9</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>An Ethreal Security Advisories reports:</p>
- <blockquote cite="http://www.ethereal.com/appnotes/enpa-sa-00017.html">
- <p>Issues have been discovered in the following protocol dissectors:</p>
- <ul>
+ <p>An Ethreal Security Advisories reports:</p> <blockquote
+ cite="http://www.ethereal.com/appnotes/enpa-sa-00017.html">
+ <p>Issues have been discovered in the following protocol
+ dissectors:</p> <ul>
<li>The COPS dissector could go into an infinite
loop. CVE: CAN-2005-0006</li>
<li>The DLSw dissector could cause an assertion. CVE:
CAN-2005-0007</li>
- <li>The DNP dissector could cause memory corruption. CVE:
+ <li>The DNP dissector could cause memory corruption.
+ CVE:
CAN-2005-0008</li>
- <li>The Gnutella dissector could cuase an assertion. CVE:
+ <li>The Gnutella dissector could cuase an assertion.
+ CVE:
CAN-2005-0009</li>
<li>The MMSE dissector could free statically-allocated
memory. CVE: CAN-2005-0010</li>
<li>The X11 dissector is vulnerable to a string buffer
overflow. CVE: CAN-2005-0084</li>
- </ul>
- <p>Impact: It may be possible to make Ethereal crash or run
+ </ul> <p>Impact: It may be possible to make Ethereal crash
+ or run
arbitrary code by injecting a purposefully malformed
- packet onto the wire or by convincing someone to read a
- malformed packet trace file.</p>
+ packet onto the wire or by convincing someone to read
+ a malformed packet trace file.</p>
</blockquote>
</body>
- </description>
- <references>
- <cvename>CVE-2005-0006</cvename>
- <cvename>CVE-2005-0007</cvename>
- <cvename>CVE-2005-0008</cvename>
- <cvename>CVE-2005-0009</cvename>
- <cvename>CVE-2005-0010</cvename>
- <cvename>CVE-2005-0084</cvename>
+ </description> <references>
+ <cvename>CVE-2005-0006</cvename> <cvename>CVE-2005-0007</cvename>
+ <cvename>CVE-2005-0008</cvename> <cvename>CVE-2005-0009</cvename>
+ <cvename>CVE-2005-0010</cvename> <cvename>CVE-2005-0084</cvename>
<bid>12326</bid>
<url>http://www.ethereal.com/appnotes/enpa-sa-00017.html</url>
- </references>
- <dates>
- <discovery>2005-01-18</discovery>
- <entry>2005-02-08</entry>
+ </references> <dates>
+ <discovery>2005-01-18</discovery> <entry>2005-02-08</entry>
</dates>
</vuln>
<vuln vid="bfda39de-7467-11d9-9e1e-c296ac722cb3">
- <topic>squid -- correct handling of oversized HTTP reply headers</topic>
- <affects>
- <package>
- <name>squid</name>
- <range><lt>2.5.7_12</lt></range>
- </package>
- </affects>
- <description>
- <body xmlns="http://www.w3.org/1999/xhtml">
- <p>The squid patches page notes:</p>
- <blockquote cite="http://www.squid-cache.org/Versions/v2/2.5/bugs/squid-2.5.STABLE7-oversize_reply_headers.patch">
- <p>This patch addresses a HTTP protocol mismatch related to oversized
- reply headers. In addition it enhances the cache.log reporting on
- reply header parsing failures to make it easier to track down which
- sites are malfunctioning.</p>
- </blockquote>
- <p>It is believed that this bug may lead to cache pollution or
+ <topic>squid -- correct handling of oversized HTTP reply
+ headers</topic> <affects>
+ <package>
+ <name>squid</name> <range><lt>2.5.7_12</lt></range>
+ </package>
+ </affects> <description>
+ <body xmlns="http://www.w3.org/1999/xhtml">
+ <p>The squid patches page notes:</p> <blockquote
+ cite="http://www.squid-cache.org/Versions/v2/2.5/bugs/squid-2.5.STABLE7-oversize_reply_headers.patch">
+ <p>This patch addresses a HTTP protocol mismatch related
+ to oversized
+ reply headers. In addition it enhances the cache.log
+ reporting on reply header parsing failures to make it
+ easier to track down which sites are malfunctioning.</p>
+ </blockquote> <p>It is believed that this bug may lead to
+ cache pollution or
allow access controls to be bypassed.</p>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2005-0241</cvename>
<url>http://www.squid-cache.org/bugs/show_bug.cgi?id=1216</url>
<url>http://www.squid-cache.org/Versions/v2/2.5/bugs/squid-2.5.STABLE7-oversize_reply_headers.patch</url>
- <freebsdpr>ports/76967</freebsdpr>
- <certvu>823350</certvu>
- </references>
- <dates>
- <discovery>2005-01-31</discovery>
- <entry>2005-02-08</entry>
+ <freebsdpr>ports/76967</freebsdpr> <certvu>823350</certvu>
+ </references> <dates>
+ <discovery>2005-01-31</discovery> <entry>2005-02-08</entry>
</dates>
</vuln>
<vuln vid="6afa87d3-764b-11d9-b0e7-0000e249a0a2">
- <topic>python -- SimpleXMLRPCServer.py allows unrestricted traversal</topic>
- <affects>
+ <topic>python -- SimpleXMLRPCServer.py allows unrestricted
+ traversal</topic> <affects>
<package>
- <name>python</name>
- <name>python23</name>
- <name>python22</name>
- <name>python-devel</name>
+ <name>python</name> <name>python23</name> <name>python22</name>
+ <name>python-devel</name>
<range><ge>2.2</ge><lt>2.2.3_7</lt></range>
<range><ge>2.3</ge><lt>2.3.4_4</lt></range>
<range><ge>2.4</ge><lt>2.4_1</lt></range>
<range><ge>2.5.a0.20050129</ge><lt>2.5.a0.20050129_1</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>According to Python Security Advisory PSF-2005-001,</p>
+ <p>According to Python Security Advisory PSF-2005-001,</p>
<blockquote cite="http://www.python.org/security/PSF-2005-001/">
<p>The Python development team has discovered a flaw in
the <code>SimpleXMLRPCServer</code> library module which
can give remote attackers access to internals of the
- registered object or its module or possibly other modules.
- The flaw only affects Python XML-RPC servers that use the
- <code>register_instance()</code> method to register an object
- without a <code>_dispatch()</code> method. Servers using
- only <code>register_function()</code> are not affected.</p>
+ registered object or its module or possibly other
+ modules. The flaw only affects Python XML-RPC servers
+ that use the <code>register_instance()</code> method
+ to register an object without a <code>_dispatch()</code>
+ method. Servers using only <code>register_function()</code>
+ are not affected.</p>
<p>On vulnerable XML-RPC servers, a remote attacker may
be able to view or modify globals of the module(s)
containing the registered instance's class(es), potentially
- leading to data loss or arbitrary code execution. If the
- registered object is a module, the danger is particularly
- serious. For example, if the registered module imports
- the <code>os</code> module, an attacker could invoke the
- <code>os.system()</code> function.</p>
- </blockquote>
- <p><strong>Note:</strong> This vulnerability affects your
+ leading to data loss or arbitrary code execution. If
+ the registered object is a module, the danger is
+ particularly serious. For example, if the registered
+ module imports the <code>os</code> module, an attacker
+ could invoke the <code>os.system()</code> function.</p>
+ </blockquote> <p><strong>Note:</strong> This vulnerability
+ affects your
system only if you're running
<code>SimpleXMLRPCServer</code>-based server. This isn't
harmful at all if you don't run any internet server written
- in Python or your server doesn't serve in XML-RPC protocol.</p>
+ in Python or your server doesn't serve in XML-RPC
+ protocol.</p>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2005-0089</cvename>
<url>http://www.python.org/security/PSF-2005-001/</url>
- </references>
- <dates>
- <discovery>2005-02-03</discovery>
- <entry>2005-02-03</entry>
+ </references> <dates>
+ <discovery>2005-02-03</discovery> <entry>2005-02-03</entry>
</dates>
</vuln>
@@ -9282,36 +7712,32 @@ Note: Please add new entries to the beginning of this file.
<topic>perl -- vulnerabilities in PERLIO_DEBUG handling</topic>
<affects>
<package>
- <name>perl</name>
- <range><ge>5.8</ge><lt>5.8.6_2</lt></range>
+ <name>perl</name> <range><ge>5.8</ge><lt>5.8.6_2</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>Kevin Finisterre discovered bugs in perl's I/O debug support:</p>
- <ul>
- <li>The environmental variable PERLIO_DEBUG is honored even
- by the set-user-ID perl command (usually
- named <code>sperl</code> or <code>suidperl</code>). As a
+ <p>Kevin Finisterre discovered bugs in perl's I/O debug
+ support:</p> <ul>
+ <li>The environmental variable PERLIO_DEBUG is honored
+ even
+ by the set-user-ID perl command (usually named
+ <code>sperl</code> or <code>suidperl</code>). As a
result, a local attacker may be able to gain elevated
privileges. <em>(CVE-2005-0155)</em></li>
- <li>A buffer overflow may occur in threaded versions of perl
+ <li>A buffer overflow may occur in threaded versions of
+ perl
when the full pathname of the script being executed is
very long. <em>(CVE-2005-0156)</em>.</li>
- </ul>
- <p><strong>Note:</strong> By default, no set-user-ID perl
+ </ul> <p><strong>Note:</strong> By default, no set-user-ID
+ perl
binary is installed. An administrator must enable it
manually at build time with the <code>ENABLE_SUIDPERL</code>
port flag.</p>
</body>
- </description>
- <references>
- <cvename>CVE-2005-0155</cvename>
- <cvename>CVE-2005-0156</cvename>
- </references>
- <dates>
- <discovery>2005-02-02</discovery>
- <entry>2005-02-02</entry>
+ </description> <references>
+ <cvename>CVE-2005-0155</cvename> <cvename>CVE-2005-0156</cvename>
+ </references> <dates>
+ <discovery>2005-02-02</discovery> <entry>2005-02-02</entry>
</dates>
</vuln>
@@ -9319,29 +7745,25 @@ Note: Please add new entries to the beginning of this file.
<topic>newsgrab -- insecure file and directory creation</topic>
<affects>
<package>
- <name>newsgrab</name>
- <range><le>0.4.0</le></range>
+ <name>newsgrab</name> <range><le>0.4.0</le></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The newsgrab script uses insecure permissions during the
creation of the local output directory and downloaded files.</p>
- <p>After a file is created, permissions on it are set using the mode
- value of the newsgroup posting. This can potentially be a problem
- when the mode is not restrictive enough. In addition, the output
- directory is created with world writable permissions allowing other
- users to drop symlinks or other files at that location.</p>
+ <p>After a file is created, permissions on it are set using
+ the mode value of the newsgroup posting. This can potentially
+ be a problem when the mode is not restrictive enough. In
+ addition, the output directory is created with world writable
+ permissions allowing other users to drop symlinks or other
+ files at that location.</p>
</body>
- </description>
- <references>
+ </description> <references>
<url>http://people.freebsd.org/~niels/issues/newsgrab-20050114.txt</url>
<url>http://sourceforge.net/project/shownotes.php?release_id=300562</url>
<cvename>CVE-2005-0154</cvename>
- </references>
- <dates>
- <discovery>2005-01-18</discovery>
- <entry>2005-02-01</entry>
+ </references> <dates>
+ <discovery>2005-01-18</discovery> <entry>2005-02-01</entry>
</dates>
</vuln>
@@ -9349,85 +7771,69 @@ Note: Please add new entries to the beginning of this file.
<topic>newsgrab -- directory traversal vulnerability</topic>
<affects>
<package>
- <name>newsgrab</name>
- <range><le>0.4.0</le></range>
+ <name>newsgrab</name> <range><le>0.4.0</le></range>
</package>
- </affects>
- <description>
- <body xmlns="http://www.w3.org/1999/xhtml">
+ </affects> <description> <body xmlns="http://www.w3.org/1999/xhtml">
<p>The newsgrab script creates files by using the names provided
in the newsgroup messages in a perl open() call. This is done
- without performing any security checks to prevent a
- directory traversal. A specially crafted newsgroup message
- could cause newsgrab to drop an attachment anywhere on the
- file system using the permissions of the user running the
- script.</p>
+ without performing any security checks to prevent a directory
+ traversal. A specially crafted newsgroup message could cause
+ newsgrab to drop an attachment anywhere on the file system
+ using the permissions of the user running the script.</p>
</body>
- </description>
- <references>
+ </description> <references>
<url>http://people.freebsd.org/~niels/issues/newsgrab-20050114.txt</url>
<url>http://sourceforge.net/project/shownotes.php?release_id=300562</url>
<cvename>CVE-2005-0153</cvename>
- </references>
- <dates>
- <discovery>2005-01-18</discovery>
- <entry>2005-02-01</entry>
+ </references> <dates>
+ <discovery>2005-01-18</discovery> <entry>2005-02-01</entry>
</dates>
- </vuln>
- <vuln vid="7f13607b-6948-11d9-8937-00065be4b5b6">
+ </vuln> <vuln vid="7f13607b-6948-11d9-8937-00065be4b5b6">
<topic>newspost -- server response buffer overflow vulnerability</topic>
<affects>
<package>
- <name>newspost</name>
- <range><le>2.1.1</le></range>
+ <name>newspost</name> <range><le>2.1.1</le></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>The newspost program uses a function named socket_getline to
- read server responses from the network socket. Unfortunately this
- function does not check the length of the buffer in which the read
- data is stored and only stops reading when a newline character is found.</p>
- <p>A malicious NNTP server could use this bug to cause a buffer
- overflow by sending an overly long response. Such an overflow allows
- arbitrary code to be executed, with the privileges of the newspost
- process, on the affected systems.</p>
+ <p>The newspost program uses a function named socket_getline
+ to read server responses from the network socket. Unfortunately
+ this function does not check the length of the buffer in which
+ the read data is stored and only stops reading when a newline
+ character is found.</p> <p>A malicious NNTP server could use
+ this bug to cause a buffer overflow by sending an overly long
+ response. Such an overflow allows arbitrary code to be executed,
+ with the privileges of the newspost process, on the affected
+ systems.</p>
</body>
- </description>
- <references>
+ </description> <references>
<url>http://people.freebsd.org/~niels/issues/newspost-20050114.txt</url>
<cvename>CVE-2005-0101</cvename>
- </references>
- <dates>
- <discovery>2005-01-14</discovery>
- <entry>2005-02-01</entry>
+ </references> <dates>
+ <discovery>2005-01-14</discovery> <entry>2005-02-01</entry>
</dates>
</vuln>
<vuln vid="76e0b133-6bfd-11d9-a5df-00065be4b5b6">
- <topic>newsfetch -- server response buffer overflow vulnerability</topic>
- <affects>
+ <topic>newsfetch -- server response buffer overflow
+ vulnerability</topic> <affects>
<package>
- <name>newsfetch</name>
- <range><le>1.21_1</le></range>
+ <name>newsfetch</name> <range><le>1.21_1</le></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>The newsfetch program uses the sscanf function to read information
+ <p>The newsfetch program uses the sscanf function to read
+ information
from server responses into static memory buffers. Unfortunately
- this is done without any proper bounds checking. As a result long
- server responses may cause an overflow when a newsgroup listing is
- requested from an NNTP server.</p>
+ this is done without any proper bounds checking. As a result
+ long server responses may cause an overflow when a newsgroup
+ listing is requested from an NNTP server.</p>
</body>
- </description>
- <references>
+ </description> <references>
<url>http://people.freebsd.org/~niels/issues/newsfetch-20050119.txt</url>
<cvename>CVE-2005-0132</cvename>
- </references>
- <dates>
- <discovery>2005-01-18</discovery>
- <entry>2005-02-01</entry>
+ </references> <dates>
+ <discovery>2005-01-18</discovery> <entry>2005-02-01</entry>
</dates>
</vuln>
@@ -9435,40 +7841,38 @@ Note: Please add new entries to the beginning of this file.
<topic>squid -- buffer overflow in WCCP recvfrom() call</topic>
<affects>
<package>
- <name>squid</name>
- <range><lt>2.5.7_10</lt></range>
- </package>
- </affects>
- <description>
- <body xmlns="http://www.w3.org/1999/xhtml">
- <p>According to the Squid Proxy Cache Security Update Advisory SQUID-2005:3,</p>
- <blockquote cite="http://www.squid-cache.org/Advisories/SQUID-2005_3.txt">
- <p>The WCCP recvfrom() call accepts more data than will fit in
- the allocated buffer. An attacker may send a larger-than-normal
- WCCP message to Squid and overflow this buffer.</p>
- <p>Severity:</p>
- <p>The bug is important because it allows remote attackers to crash
- Squid, causing a disription in service. However, the bug is
- exploitable only if you have configured Squid to send WCCP messages
- to, and expect WCCP replies from, a router.</p>
+ <name>squid</name> <range><lt>2.5.7_10</lt></range>
+ </package>
+ </affects> <description>
+ <body xmlns="http://www.w3.org/1999/xhtml">
+ <p>According to the Squid Proxy Cache Security Update
+ Advisory SQUID-2005:3,</p> <blockquote
+ cite="http://www.squid-cache.org/Advisories/SQUID-2005_3.txt">
+ <p>The WCCP recvfrom() call accepts more data than will
+ fit in
+ the allocated buffer. An attacker may send a
+ larger-than-normal WCCP message to Squid and overflow
+ this buffer.</p>
+ <p>Severity:</p> <p>The bug is important because it allows
+ remote attackers to crash
+ Squid, causing a disription in service. However, the
+ bug is exploitable only if you have configured Squid
+ to send WCCP messages to, and expect WCCP replies from,
+ a router.</p>
<p>Sites that do not use WCCP are not vulnerable.</p>
- </blockquote>
- <p>Note that while the default configuration of the FreeBSD squid port
+ </blockquote> <p>Note that while the default configuration
+ of the FreeBSD squid port
enables WCCP support in general, the default configuration
- supplied does not actually configure squid to send and receive WCCP
- messages.</p>
+ supplied does not actually configure squid to send and
+ receive WCCP messages.</p>
</body>
- </description>
- <references>
- <cvename>CVE-2005-0211</cvename>
- <certvu>886006</certvu>
+ </description> <references>
+ <cvename>CVE-2005-0211</cvename> <certvu>886006</certvu>
<url>http://www.squid-cache.org/Advisories/SQUID-2005_3.txt</url>
<url>http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-wccp_buffer_overflow</url>
<url>http://www.squid-cache.org/bugs/show_bug.cgi?id=1217</url>
- </references>
- <dates>
- <discovery>2005-01-28</discovery>
- <entry>2005-01-28</entry>
+ </references> <dates>
+ <discovery>2005-01-28</discovery> <entry>2005-01-28</entry>
<modified>2005-02-13</modified>
</dates>
</vuln>
@@ -9477,91 +7881,69 @@ Note: Please add new entries to the beginning of this file.
<topic>xpdf -- makeFileKey2() buffer overflow vulnerability</topic>
<affects>
<package>
- <name>xpdf</name>
- <range><lt>3.00_6</lt></range>
- </package>
- <package>
- <name>kdegraphics</name>
- <range><lt>3.3.2_2</lt></range>
- </package>
- <package>
- <name>gpdf</name>
- <range><lt>2.8.3</lt></range>
- </package>
- <package>
- <name>teTeX-base</name>
- <range><lt>2.0.2_9</lt></range>
- </package>
- <package>
- <name>cups-base</name>
- <range><lt>1.1.23.0_3</lt></range>
- </package>
- <package>
- <name>koffice</name>
- <range><lt>1.3.5_2,1</lt></range>
- </package>
- <package>
- <name>pdftohtml</name>
- <range><lt>0.36_2</lt></range>
- </package>
- </affects>
- <description>
- <body xmlns="http://www.w3.org/1999/xhtml">
- <p>An iDEFENSE Security Advisory reports:</p>
- <blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110608898221554">
- <p>Remote exploitation of a buffer overflow vulnerability in
+ <name>xpdf</name> <range><lt>3.00_6</lt></range>
+ </package> <package>
+ <name>kdegraphics</name> <range><lt>3.3.2_2</lt></range>
+ </package> <package>
+ <name>gpdf</name> <range><lt>2.8.3</lt></range>
+ </package> <package>
+ <name>teTeX-base</name> <range><lt>2.0.2_9</lt></range>
+ </package> <package>
+ <name>cups-base</name> <range><lt>1.1.23.0_3</lt></range>
+ </package> <package>
+ <name>koffice</name> <range><lt>1.3.5_2,1</lt></range>
+ </package> <package>
+ <name>pdftohtml</name> <range><lt>0.36_2</lt></range>
+ </package>
+ </affects> <description>
+ <body xmlns="http://www.w3.org/1999/xhtml">
+ <p>An iDEFENSE Security Advisory reports:</p> <blockquote
+ cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110608898221554">
+ <p>Remote exploitation of a buffer overflow vulnerability
+ in
the xpdf PDF viewer included in multiple Unix and Linux
- distributions could allow for arbitrary code execution as
- the user viewing a PDF file.</p>
+ distributions could allow for arbitrary code execution
+ as the user viewing a PDF file.</p>
<p>The vulnerability specifically exists due to insufficient
bounds checking while processing a PDF file that provides
malicious values in the /Encrypt /Length tag. The
offending code can be found in the
- <code>Decrypt::makeFileKey2</code> function in the source
- file xpdf/Decrypt.cc.</p>
+ <code>Decrypt::makeFileKey2</code> function in the
+ source file xpdf/Decrypt.cc.</p>
</blockquote>
</body>
- </description>
- <references>
- <cvename>CVE-2005-0064</cvename>
- <mlist msgid="FB24803D1DF2A34FA59FC157B77C970503C8B298@idserv04.idef.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110608898221554</mlist>
+ </description> <references>
+ <cvename>CVE-2005-0064</cvename> <mlist
+ msgid="FB24803D1DF2A34FA59FC157B77C970503C8B298@idserv04.idef.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110608898221554</mlist>
<url>http://www.koffice.org/security/advisory-20050120-1.txt</url>
- </references>
- <dates>
- <discovery>2005-01-06</discovery>
- <entry>2005-01-26</entry>
+ </references> <dates>
+ <discovery>2005-01-06</discovery> <entry>2005-01-26</entry>
<modified>2005-02-03</modified>
</dates>
</vuln>
<vuln vid="d371b627-6ed5-11d9-bd18-000a95bc6fae">
- <topic>zhcon -- unauthorized file access</topic>
- <affects>
+ <topic>zhcon -- unauthorized file access</topic> <affects>
<package>
- <name>zhcon</name>
- <name>zh-zhcon</name>
+ <name>zhcon</name> <name>zh-zhcon</name>
<range><lt>0.2.3_3</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>Martin <q>Joey</q> Schulze reports:</p>
- <blockquote>
+ <p>Martin <q>Joey</q> Schulze reports:</p> <blockquote>
<p>Erik Sjöund discovered that zhcon, a fast console CJK
system using the Linux framebuffer, accesses a
user-controlled configuration file with elevated
- privileges. Thus, it is possible to read arbitrary files.</p>
- </blockquote>
- <p>When installed from the FreeBSD Ports Collection, zhcon is
+ privileges. Thus, it is possible to read arbitrary
+ files.</p>
+ </blockquote> <p>When installed from the FreeBSD Ports
+ Collection, zhcon is
installed set-user-ID root.</p>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2005-0072</cvename>
- </references>
- <dates>
- <discovery>2005-01-25</discovery>
- <entry>2005-01-25</entry>
+ </references> <dates>
+ <discovery>2005-01-25</discovery> <entry>2005-01-25</entry>
</dates>
</vuln>
@@ -9569,31 +7951,25 @@ Note: Please add new entries to the beginning of this file.
<topic>evolution -- arbitrary code execution vulnerability</topic>
<affects>
<package>
- <name>evolution</name>
- <range><lt>2.0.3_1</lt></range>
+ <name>evolution</name> <range><lt>2.0.3_1</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>Martin <q>Joey</q> Schulze reports:</p>
- <blockquote>
- <p>Max Vozeler discovered an integer overflow in the helper
- application camel-lock-helper which runs setuid root or
- setgid mail inside of Evolution, a free groupware suite.
- A local attacker can cause the setuid root helper to
- execute arbitrary code with elevated privileges via a
- malicious POP server.</p>
+ <p>Martin <q>Joey</q> Schulze reports:</p> <blockquote>
+ <p>Max Vozeler discovered an integer overflow in the
+ helper
+ application camel-lock-helper which runs setuid root
+ or setgid mail inside of Evolution, a free groupware
+ suite. A local attacker can cause the setuid root
+ helper to execute arbitrary code with elevated privileges
+ via a malicious POP server.</p>
</blockquote>
</body>
- </description>
- <references>
- <bid>12354</bid>
- <cvename>CVE-2005-0102</cvename>
+ </description> <references>
+ <bid>12354</bid> <cvename>CVE-2005-0102</cvename>
<url>http://cvs.gnome.org/viewcvs/evolution/camel/camel-lock-helper.c?rev=1.7&amp;view=log#rev1.5.74.1</url>
- </references>
- <dates>
- <discovery>2005-01-20</discovery>
- <entry>2005-01-25</entry>
+ </references> <dates>
+ <discovery>2005-01-20</discovery> <entry>2005-01-25</entry>
<modified>2005-02-02</modified>
</dates>
</vuln>
@@ -9602,36 +7978,33 @@ Note: Please add new entries to the beginning of this file.
<topic>mod_dosevasive -- insecure temporary file creation</topic>
<affects>
<package>
- <name>mod_dosevasive20</name>
- <range><lt>1.10</lt></range>
+ <name>mod_dosevasive20</name> <range><lt>1.10</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>An LSS Security Advisory reports:</p>
- <blockquote cite="http://security.lss.hr/en/index.php?page=details&amp;ID=LSS-2005-01-01">
+ <p>An LSS Security Advisory reports:</p> <blockquote
+ cite="http://security.lss.hr/en/index.php?page=details&amp;ID=LSS-2005-01-01">
<p>When a denial of service attack is detected,
mod_dosevasive will, among other things, create a
- temporary file which it will use to trace actions from the
- offensive IP address. This file is insecurely created in
- /tmp and it's name is easily predictable.</p>
- <p>It is then easy for an attacker to create arbitrary files
- in any directory that the user under which apache runs has
- privileges to write.</p>
- <p><em>[...]</em> once the target file is opened, there is a
- race attack (although difficult to exploit) which can lead
- to mod_dosevasive overwriting any file that the user under
- which apache runs has privileges to write.</p>
- </blockquote>
- </body>
- </description>
- <references>
+ temporary file which it will use to trace actions from
+ the offensive IP address. This file is insecurely created
+ in /tmp and it's name is easily predictable.</p>
+ <p>It is then easy for an attacker to create arbitrary
+ files
+ in any directory that the user under which apache runs
+ has privileges to write.</p>
+ <p><em>[...]</em> once the target file is opened, there
+ is a
+ race attack (although difficult to exploit) which can
+ lead to mod_dosevasive overwriting any file that the
+ user under which apache runs has privileges to write.</p>
+ </blockquote>
+ </body>
+ </description> <references>
<freebsdpr>ports/77513</freebsdpr>
<url>http://security.lss.hr/en/index.php?page=details&amp;ID=LSS-2005-01-01</url>
- </references>
- <dates>
- <discovery>2005-01-04</discovery>
- <entry>2005-01-24</entry>
+ </references> <dates>
+ <discovery>2005-01-04</discovery> <entry>2005-01-24</entry>
<modified>2005-02-22</modified>
</dates>
</vuln>
@@ -9641,42 +8014,39 @@ Note: Please add new entries to the beginning of this file.
responses</topic>
<affects>
<package>
- <name>squid</name>
- <range><lt>2.5.7_9</lt></range>
+ <name>squid</name> <range><lt>2.5.7_9</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>The squid patches page notes:</p>
- <blockquote cite="http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-header_parsing">
- <p>This patch makes Squid considerably stricter while
- parsing the HTTP protocol.</p>
- <ol>
- <li>A Content-length header should only appear once in a
- valid request or response. Multiple Content-length
- headers, in conjunction with specially crafted requests,
- may allow Squid's cache to be poisioned with bad content
- in certain situations.</li>
- <li>CR characters is only allowed as part of the CR NL
- line terminator, not alone. This to ensure that all
- involved agrees on the structure of HTTP headers.</li>
- <li>Rejects requests/responses that have whitespace in an
- HTTP header name.</li>
- </ol>
- </blockquote>
- <p>To enable these strict parsing rules, update to at least
- squid-2.5.7_9 and specify <code>relaxed_header_parser
- off</code> in squid.conf.</p>
+ <p>The squid patches page notes:</p> <blockquote
+ cite="http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-header_parsing">
+ <p>This patch makes Squid considerably stricter while
+ parsing the HTTP protocol.</p>
+ <ol>
+ <li>A Content-length header should only appear once in
+ a
+ valid request or response. Multiple Content-length
+ headers, in conjunction with specially crafted requests,
+ may allow Squid's cache to be poisioned with bad
+ content in certain situations.</li>
+ <li>CR characters is only allowed as part of the CR NL
+ line terminator, not alone. This to ensure that all
+ involved agrees on the structure of HTTP headers.</li>
+ <li>Rejects requests/responses that have whitespace in
+ an
+ HTTP header name.</li>
+ </ol>
+ </blockquote> <p>To enable these strict parsing rules,
+ update to at least
+ squid-2.5.7_9 and specify <code>relaxed_header_parser
+ off</code> in squid.conf.</p>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2005-0174</cvename>
<url>http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-header_parsing</url>
<certvu>768702</certvu>
- </references>
- <dates>
- <discovery>2005-01-24</discovery>
- <entry>2005-01-24</entry>
+ </references> <dates>
+ <discovery>2005-01-24</discovery> <entry>2005-01-24</entry>
<modified>2005-02-07</modified>
</dates>
</vuln>
@@ -9685,34 +8055,30 @@ Note: Please add new entries to the beginning of this file.
<topic>bugzilla -- cross-site scripting vulnerability</topic>
<affects>
<package>
- <name>bugzilla</name>
- <name>ja-bugzilla</name>
+ <name>bugzilla</name> <name>ja-bugzilla</name>
<range><lt>2.16.8</lt></range>
<range><ge>2.17.*</ge><lt>2.18</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>A Bugzilla advisory states:</p>
- <blockquote cite="http://www.bugzilla.org/security/2.16.7-nr/">
- <p>This advisory covers a single cross-site scripting issue
+ <p>A Bugzilla advisory states:</p> <blockquote
+ cite="http://www.bugzilla.org/security/2.16.7-nr/">
+ <p>This advisory covers a single cross-site scripting
+ issue
that has recently been discovered and fixed in the
Bugzilla code: If a malicious user links to a Bugzilla
- site using a specially crafted URL, a script in the error
- page generated by Bugzilla will display the URL unaltered
- in the page, allowing scripts embedded in the URL to
- execute.</p>
+ site using a specially crafted URL, a script in the
+ error page generated by Bugzilla will display the URL
+ unaltered in the page, allowing scripts embedded in the
+ URL to execute.</p>
</blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2004-1061</cvename>
<url>http://www.bugzilla.org/security/2.16.7-nr/</url>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=272620</url>
- </references>
- <dates>
- <discovery>2004-12-01</discovery>
- <entry>2005-01-24</entry>
+ </references> <dates>
+ <discovery>2004-12-01</discovery> <entry>2005-01-24</entry>
</dates>
</vuln>
@@ -9720,106 +8086,77 @@ Note: Please add new entries to the beginning of this file.
<topic>web browsers -- window injection vulnerabilities</topic>
<affects>
<package>
- <name>firefox</name>
- <range><lt>1.0.1,1</lt></range>
- </package>
- <package>
- <name>mozilla</name>
- <range><lt>1.7.6,2</lt></range>
- </package>
- <package>
- <name>linux-mozilla</name>
- <name>linux-mozilla-devel</name>
- <range><lt>1.7.6</lt></range>
- </package>
- <package>
- <name>de-linux-mozillafirebird</name>
+ <name>firefox</name> <range><lt>1.0.1,1</lt></range>
+ </package> <package>
+ <name>mozilla</name> <range><lt>1.7.6,2</lt></range>
+ </package> <package>
+ <name>linux-mozilla</name> <name>linux-mozilla-devel</name>
+ <range><lt>1.7.6</lt></range>
+ </package> <package>
+ <name>de-linux-mozillafirebird</name>
<name>el-linux-mozillafirebird</name>
- <name>ja-linux-mozillafirebird-gtk1</name>
- <name>ja-mozillafirebird-gtk2</name>
- <name>linux-mozillafirebird</name>
- <name>ru-linux-mozillafirebird</name>
- <name>zhCN-linux-mozillafirebird</name>
- <name>zhTW-linux-mozillafirebird</name>
- <name>de-netscape7</name>
- <name>fr-netscape7</name>
- <name>ja-netscape7</name>
- <name>netscape7</name>
- <name>pt_BR-netscape7</name>
- <name>mozilla-gtk1</name>
- <range><ge>0</ge></range>
- </package>
- <package>
+ <name>ja-linux-mozillafirebird-gtk1</name>
+ <name>ja-mozillafirebird-gtk2</name>
+ <name>linux-mozillafirebird</name>
+ <name>ru-linux-mozillafirebird</name>
+ <name>zhCN-linux-mozillafirebird</name>
+ <name>zhTW-linux-mozillafirebird</name> <name>de-netscape7</name>
+ <name>fr-netscape7</name> <name>ja-netscape7</name>
+ <name>netscape7</name> <name>pt_BR-netscape7</name>
+ <name>mozilla-gtk1</name> <range><ge>0</ge></range>
+ </package> <package>
<!-- These package names are obsolete. -->
- <name>de-linux-netscape</name>
- <name>fr-linux-netscape</name>
- <name>ja-linux-netscape</name>
- <name>linux-netscape</name>
- <name>linux-phoenix</name>
- <name>mozilla+ipv6</name>
- <name>mozilla-embedded</name>
- <name>mozilla-firebird</name>
- <name>mozilla-gtk2</name>
- <name>mozilla-gtk</name>
- <name>mozilla-thunderbird</name>
- <name>phoenix</name>
+ <name>de-linux-netscape</name> <name>fr-linux-netscape</name>
+ <name>ja-linux-netscape</name> <name>linux-netscape</name>
+ <name>linux-phoenix</name> <name>mozilla+ipv6</name>
+ <name>mozilla-embedded</name> <name>mozilla-firebird</name>
+ <name>mozilla-gtk2</name> <name>mozilla-gtk</name>
+ <name>mozilla-thunderbird</name> <name>phoenix</name>
<range><ge>0</ge></range>
- </package>
- <package>
- <name>kdebase</name>
- <name>kdelibs</name>
+ </package> <package>
+ <name>kdebase</name> <name>kdelibs</name>
<range><lt>3.3.2</lt></range>
- </package>
- <package>
- <name>opera</name>
- <name>opera-devel</name>
- <name>linux-opera</name>
- <range><lt>7.54.20050131</lt></range>
- </package>
- </affects>
- <description>
- <body xmlns="http://www.w3.org/1999/xhtml">
- <p>A Secunia Research advisory reports:</p>
- <blockquote cite="http://secunia.com/secunia_research/2004-13/advisory/">
- <p>Secunia Research has reported a vulnerability in multiple
- browsers, which can be exploited by malicious people to
- spoof the content of websites.</p>
+ </package> <package>
+ <name>opera</name> <name>opera-devel</name>
+ <name>linux-opera</name> <range><lt>7.54.20050131</lt></range>
+ </package>
+ </affects> <description>
+ <body xmlns="http://www.w3.org/1999/xhtml">
+ <p>A Secunia Research advisory reports:</p> <blockquote
+ cite="http://secunia.com/secunia_research/2004-13/advisory/">
+ <p>Secunia Research has reported a vulnerability in
+ multiple
+ browsers, which can be exploited by malicious people
+ to spoof the content of websites.</p>
<p>The problem is that a website can inject content into
- another site's window if the target name of the window is
- known. This can e.g. be exploited by a malicious website
- to spoof the content of a pop-up window opened on a
- trusted website.</p>
+ another site's window if the target name of the window
+ is known. This can e.g. be exploited by a malicious
+ website to spoof the content of a pop-up window opened
+ on a trusted website.</p>
<p>Secunia has constructed a test, which can be used to
- check if your browser is affected by this issue:
- <a href="http://secunia.com/multiple_browsers_window_injection_vulnerability_test/">http://secunia.com/multiple_browsers_window_injection_vulnerability_test/</a></p>
- </blockquote>
- <p>A <a href="http://mozillanews.org/?article_date=2004-12-08+06-48-46">workaround
+ check if your browser is affected by this issue: <a
+ href="http://secunia.com/multiple_browsers_window_injection_vulnerability_test/">http://secunia.com/multiple_browsers_window_injection_vulnerability_test/</a></p>
+ </blockquote> <p>A <a
+ href="http://mozillanews.org/?article_date=2004-12-08+06-48-46">workaround
for Mozilla-based browsers</a> is available.</p>
</body>
- </description>
- <references>
+ </description> <references>
<url>http://secunia.com/secunia_research/2004-13/advisory/</url>
<url>http://secunia.com/multiple_browsers_window_injection_vulnerability_test/</url>
- <!-- mozilla -->
- <cvename>CVE-2004-1156</cvename>
+ <!-- mozilla --> <cvename>CVE-2004-1156</cvename>
<url>http://secunia.com/advisories/13129/</url>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=273699</url>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=103638</url>
<url>http://mozillanews.org/?article_date=2004-12-08+06-48-46</url>
- <!-- opera -->
- <cvename>CVE-2004-1157</cvename>
- <url>http://secunia.com/advisories/13253/</url>
- <!-- konqueror -->
- <cvename>CVE-2004-1158</cvename>
+ <!-- opera --> <cvename>CVE-2004-1157</cvename>
+ <url>http://secunia.com/advisories/13253/</url> <!-- konqueror
+ --> <cvename>CVE-2004-1158</cvename>
<url>http://secunia.com/advisories/13254/</url>
<url>http://www.kde.org/info/security/advisory-20041213-1.txt</url>
- <!-- netscape -->
- <cvename>CVE-2004-1160</cvename>
+ <!-- netscape --> <cvename>CVE-2004-1160</cvename>
<url>http://secunia.com/advisories/13402/</url>
- </references>
- <dates>
- <discovery>2004-12-08</discovery>
- <entry>2005-01-24</entry>
+ </references> <dates>
+ <discovery>2004-12-08</discovery> <entry>2005-01-24</entry>
<modified>2005-02-26</modified>
</dates>
</vuln>
@@ -9828,136 +8165,114 @@ Note: Please add new entries to the beginning of this file.
<topic>yamt -- arbitrary command execution vulnerability</topic>
<affects>
<package>
- <name>yamt</name>
- <range><lt>0.5_2</lt></range>
+ <name>yamt</name> <range><lt>0.5_2</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Manigandan Radhakrishnan discovered a security
vulnerability in YAMT which can lead to execution of
arbitrary commands with the privileges of the user running
- YAMT when sorting based on MP3 tags. The problem exist in
- the <code>id3tag_sort()</code> routine which does not
+ YAMT when sorting based on MP3 tags. The problem exist
+ in the <code>id3tag_sort()</code> routine which does not
properly sanitize the artist tag from the MP3 file before
using it as an argument to the mv command.</p>
</body>
- </description>
- <references>
- <bid>11999</bid>
- <cvename>CVE-2004-1302</cvename>
+ </description> <references>
+ <bid>11999</bid> <cvename>CVE-2004-1302</cvename>
<url>http://tigger.uic.edu/~jlongs2/holes/yamt.txt</url>
- </references>
- <dates>
- <discovery>2004-12-15</discovery>
- <entry>2005-01-23</entry>
+ </references> <dates>
+ <discovery>2004-12-15</discovery> <entry>2005-01-23</entry>
<modified>2005-01-25</modified>
</dates>
</vuln>
<vuln vid="4e4bd2c2-6bd5-11d9-9e1e-c296ac722cb3">
- <topic>squid -- HTTP response splitting cache pollution attack</topic>
- <affects>
- <package>
- <name>squid</name>
- <range><lt>2.5.7_8</lt></range>
- </package>
- </affects>
- <description>
- <body xmlns="http://www.w3.org/1999/xhtml">
- <p>According to a whitepaper published by Sanctum, Inc., it
- is possible to mount cache poisoning attacks against, among others,
- squid proxies by inserting false replies into the HTTP stream.</p>
- <p>The squid patches page notes:</p>
- <blockquote cite="http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-response_splitting">
- <p>This patch additionally strengthens Squid from the HTTP response
+ <topic>squid -- HTTP response splitting cache pollution
+ attack</topic> <affects>
+ <package>
+ <name>squid</name> <range><lt>2.5.7_8</lt></range>
+ </package>
+ </affects> <description>
+ <body xmlns="http://www.w3.org/1999/xhtml">
+ <p>According to a whitepaper published by Sanctum, Inc.,
+ it
+ is possible to mount cache poisoning attacks against,
+ among others, squid proxies by inserting false replies
+ into the HTTP stream.</p>
+ <p>The squid patches page notes:</p> <blockquote
+ cite="http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-response_splitting">
+ <p>This patch additionally strengthens Squid from the
+ HTTP response
attack described by Sanctum.</p>
</blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2005-0175</cvename>
<url>http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-response_splitting</url>
<url>http://www.squid-cache.org/bugs/show_bug.cgi?id=1200</url>
<url>https://www.watchfire.com/securearea/whitepapers.aspx?id=8</url>
<certvu>625878</certvu>
- </references>
- <dates>
- <discovery>2004-03-01</discovery>
- <entry>2005-01-22</entry>
+ </references> <dates>
+ <discovery>2004-03-01</discovery> <entry>2005-01-22</entry>
<modified>2005-02-07</modified>
</dates>
</vuln>
<vuln vid="338d1723-5f03-11d9-92a7-000bdb1444a4">
- <topic>horde -- XSS vulnerabilities</topic>
- <affects>
+ <topic>horde -- XSS vulnerabilities</topic> <affects>
<package>
- <name>horde</name>
- <name>horde-php5</name>
+ <name>horde</name> <name>horde-php5</name>
<range><gt>3.*</gt><lt>3.0.1</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>A Hyperdose Security Advisory reports:</p>
- <blockquote cite="http://lists.horde.org/archives/announce/2005/000159.html">
+ <p>A Hyperdose Security Advisory reports:</p> <blockquote
+ cite="http://lists.horde.org/archives/announce/2005/000159.html">
<p>Horde contains two XSS attacks that can be exploited
through GET requests. Once exploited, these requests
could be used to execute any javascript commands in the
context of that user, potentially including but not
- limited to reading and deleting email, and stealing auth
- tokens.</p>
+ limited to reading and deleting email, and stealing
+ auth tokens.</p>
</blockquote>
</body>
- </description>
- <references>
- <bid>12255</bid>
- <mlist msgid="1105593825.8638@mx249a.mysite4now.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110564059322774</mlist>
+ </description> <references>
+ <bid>12255</bid> <mlist
+ msgid="1105593825.8638@mx249a.mysite4now.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110564059322774</mlist>
<mlist>http://lists.horde.org/archives/announce/2005/000159.html</mlist>
- </references>
- <dates>
- <discovery>2005-01-04</discovery>
- <entry>2005-01-22</entry>
+ </references> <dates>
+ <discovery>2005-01-04</discovery> <entry>2005-01-22</entry>
</dates>
</vuln>
<vuln vid="2b2b333b-6bd3-11d9-95f8-000a95bc6fae">
- <topic>mc -- multiple vulnerabilities</topic>
- <affects>
+ <topic>mc -- multiple vulnerabilities</topic> <affects>
<package>
- <name>mc</name>
- <range><lt>4.6.0</lt></range>
+ <name>mc</name> <range><lt>4.6.0</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Andrew V. Samoilov reported several vulnerabilities that
were corrected in MidnightCommand 4.6.0:</p>
<ul>
- <li>Format string issues (CVE-2004-1004)</li>
- <li>Buffer overflows (CVE-2004-1005)</li>
- <li>Denial-of-service, infinite loop (CVE-2004-1009)</li>
- <li>Denial-of-service, corrupted section header
+ <li>Format string issues (CVE-2004-1004)</li> <li>Buffer
+ overflows (CVE-2004-1005)</li> <li>Denial-of-service,
+ infinite loop (CVE-2004-1009)</li> <li>Denial-of-service,
+ corrupted section header
(CVE-2004-1090)</li>
- <li>Denial-of-service, null pointer dereference (CVE-2004-1091)</li>
- <li>Freeing unallocated memory (CVE-2004-1092)</li>
- <li>Using already freed memory (CVE-2004-1093)</li>
+ <li>Denial-of-service, null pointer dereference
+ (CVE-2004-1091)</li> <li>Freeing unallocated memory
+ (CVE-2004-1092)</li> <li>Using already freed memory
+ (CVE-2004-1093)</li>
</ul>
</body>
- </description>
- <references>
- <cvename>CVE-2004-1004</cvename>
- <cvename>CVE-2004-1005</cvename>
- <cvename>CVE-2004-1009</cvename>
- <cvename>CVE-2004-1090</cvename>
- <cvename>CVE-2004-1091</cvename>
- <cvename>CVE-2004-1092</cvename>
+ </description> <references>
+ <cvename>CVE-2004-1004</cvename> <cvename>CVE-2004-1005</cvename>
+ <cvename>CVE-2004-1009</cvename> <cvename>CVE-2004-1090</cvename>
+ <cvename>CVE-2004-1091</cvename> <cvename>CVE-2004-1092</cvename>
<cvename>CVE-2004-1093</cvename>
- </references>
- <dates>
- <discovery>2004-12-01</discovery>
- <entry>2005-01-21</entry>
+ </references> <dates>
+ <discovery>2004-12-01</discovery> <entry>2005-01-21</entry>
</dates>
</vuln>
@@ -9965,87 +8280,82 @@ Note: Please add new entries to the beginning of this file.
<topic>perl -- File::Path insecure file/directory permissions</topic>
<affects>
<package>
- <name>perl</name>
- <range><ge>0</ge><lt>5.6.2</lt></range>
+ <name>perl</name> <range><ge>0</ge><lt>5.6.2</lt></range>
<range><ge>5.8.0</ge><lt>5.8.6</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>Jeroen van Wolffelaar reports that the Perl module File::Path
- contains a race condition wherein traversed directories and files
- are temporarily made world-readable/writable.</p>
+ <p>Jeroen van Wolffelaar reports that the Perl module
+ File::Path
+ contains a race condition wherein traversed directories
+ and files are temporarily made world-readable/writable.</p>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2004-0452</cvename>
<url>http://www.debian.org/security/2004/dsa-620</url>
<url>http://xforce.iss.net/xforce/xfdb/18650</url>
- </references>
- <dates>
- <discovery>2004-12-30</discovery>
- <entry>2005-01-21</entry>
+ </references> <dates>
+ <discovery>2004-12-30</discovery> <entry>2005-01-21</entry>
<modified>2005-02-01</modified>
</dates>
</vuln>
<vuln vid="e8c6ade2-6bcc-11d9-8e6f-000a95bc6fae">
- <cancelled superseded="e3cf89f0-53da-11d9-92b7-ceadd4ac2edd" />
+ <cancelled superseded="e3cf89f0-53da-11d9-92b7-ceadd4ac2edd"
+ />
</vuln>
<vuln vid="1489df94-6bcb-11d9-a21e-000a95bc6fae">
<topic>opera -- multiple vulnerabilities in Java implementation</topic>
<affects>
<package>
- <name>opera</name>
- <name>opera-devel</name>
- <name>linux-opera</name>
- <range><lt>7.54.20041210</lt></range>
+ <name>opera</name> <name>opera-devel</name>
+ <name>linux-opera</name> <range><lt>7.54.20041210</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>Marc Schoenefeld reports:</p>
- <blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110088923127820">
+ <p>Marc Schoenefeld reports:</p> <blockquote
+ cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110088923127820">
<p>Opera 7.54 is vulnerable to leakage of the java sandbox,
- allowing malicious applets to gain unacceptable
- privileges. This allows them to be used for information
- gathering (spying) of local identity information and
- system configurations as well as causing annoying crash
- effects.</p>
- <p>Opera 754 <em>[sic]</em> which was released Aug 5,2004 is
- vulnerable to the XSLT processor covert channel attack,
- which was corrected with JRE 1.4.2_05 [released in July
- 04], but in disadvantage to the users the opera packaging
- guys chose to bundle the JRE 1.4.2_04 <em>[...]</em></p>
- <p>Internal pointer DoS exploitation: Opera.jar contains the
- opera replacement of the java plugin. It therefore handles
- communication between javascript and the Java VM via the
- liveconnect protocol. The public class EcmaScriptObject
- exposes a system memory pointer to the java address space,
- by constructing a special variant of this type an internal
- cache table can be polluted by false entries that infer
- proper function of the JSObject class and in the following
- proof-of-concept crash the browser.</p>
+ allowing malicious applets to gain unacceptable privileges.
+ This allows them to be used for information gathering
+ (spying) of local identity information and system
+ configurations as well as causing annoying crash
+ effects.</p>
+ <p>Opera 754 <em>[sic]</em> which was released Aug 5,2004
+ is
+ vulnerable to the XSLT processor covert channel attack,
+ which was corrected with JRE 1.4.2_05 [released in July
+ 04], but in disadvantage to the users the opera packaging
+ guys chose to bundle the JRE 1.4.2_04 <em>[...]</em></p>
+ <p>Internal pointer DoS exploitation: Opera.jar contains
+ the
+ opera replacement of the java plugin. It therefore
+ handles communication between javascript and the Java
+ VM via the liveconnect protocol. The public class
+ EcmaScriptObject exposes a system memory pointer to the
+ java address space, by constructing a special variant
+ of this type an internal cache table can be polluted
+ by false entries that infer proper function of the
+ JSObject class and in the following proof-of-concept
+ crash the browser.</p>
<p>Exposure of location of local java installation Sniffing
- the URL classpath allows to retrieve the URLs of the
- bootstrap class path and therefore the JDK installation
- directory.</p>
+ the URL classpath allows to retrieve the URLs of the
+ bootstrap class path and therefore the JDK installation
+ directory.</p>
<p>Exposure of local user name to an untrusted applet An
- attacker could use the sun.security.krb5.Credentials class
- to retrieve the name of the currently logged in user and
- parse his home directory from the information which is
- provided by the thrown
- java.security.AccessControlException.</p>
+ attacker could use the sun.security.krb5.Credentials
+ class to retrieve the name of the currently logged in
+ user and parse his home directory from the information
+ which is provided by the thrown
+ java.security.AccessControlException.</p>
</blockquote>
</body>
- </description>
- <references>
- <mlist msgid="Pine.A41.4.58.0411191800510.57436@zivunix.uni-muenster.de">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110088923127820</mlist>
- </references>
- <dates>
- <discovery>2004-11-19</discovery>
- <entry>2005-01-24</entry>
+ </description> <references>
+ <mlist
+ msgid="Pine.A41.4.58.0411191800510.57436@zivunix.uni-muenster.de">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110088923127820</mlist>
+ </references> <dates>
+ <discovery>2004-11-19</discovery> <entry>2005-01-24</entry>
</dates>
</vuln>
@@ -10053,132 +8363,107 @@ Note: Please add new entries to the beginning of this file.
<topic>sudo -- environmental variable CDPATH is not cleared</topic>
<affects>
<package>
- <name>sudo</name>
- <range><lt>1.6.8.4</lt></range>
+ <name>sudo</name> <range><lt>1.6.8.4</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>A sudo bug report says:</p>
- <blockquote cite="http://www.sudo.ws/bugs/show_bug.cgi?id=155">
- <p>sudo doesn't unset the CDPATH variable, which leads to
+ <p>A sudo bug report says:</p> <blockquote
+ cite="http://www.sudo.ws/bugs/show_bug.cgi?id=155">
+ <p>sudo doesn't unset the CDPATH variable, which leads
+ to
possible security problems.</p>
</blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<url>http://www.sudo.ws/bugs/show_bug.cgi?id=155</url>
<mlist>http://www.sudo.ws/pipermail/sudo-announce/2004-November/000044.html</mlist>
- </references>
- <dates>
- <discovery>2004-10-18</discovery>
- <entry>2005-01-21</entry>
+ </references> <dates>
+ <discovery>2004-10-18</discovery> <entry>2005-01-21</entry>
</dates>
</vuln>
<vuln vid="e480ccb2-6bc8-11d9-8dbe-000a95bc6fae">
- <topic>fcron -- multiple vulnerabilities</topic>
- <affects>
+ <topic>fcron -- multiple vulnerabilities</topic> <affects>
<package>
- <name>fcron</name>
- <range><lt>2.9.5.1</lt></range>
+ <name>fcron</name> <range><lt>2.9.5.1</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>An iDEFENSE Security Advisory states:</p>
- <blockquote cite="http://www.idefense.com/application/poi/display?id=157&amp;type=vulnerabilities&amp;flashstatus=false">
+ <p>An iDEFENSE Security Advisory states:</p> <blockquote
+ cite="http://www.idefense.com/application/poi/display?id=157&amp;type=vulnerabilities&amp;flashstatus=false">
<p>Multiple vulnerabilities have been found in Fcron.</p>
<ol>
- <li>File contents disclosure</li>
- <li>Configuration Bypass Vulnerability</li>
- <li>File Removal and Empty File Creation Vulnerability</li>
- <li>Information Disclosure Vulnerability</li>
+ <li>File contents disclosure</li> <li>Configuration
+ Bypass Vulnerability</li> <li>File Removal and Empty
+ File Creation Vulnerability</li> <li>Information
+ Disclosure Vulnerability</li>
</ol>
</blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<url>http://www.idefense.com/application/poi/display?id=157&amp;type=vulnerabilities&amp;flashstatus=false</url>
- <cvename>CVE-2004-1030</cvename>
- <cvename>CVE-2004-1031</cvename>
- <cvename>CVE-2004-1032</cvename>
- <cvename>CVE-2004-1033</cvename>
- </references>
- <dates>
- <discovery>2004-11-15</discovery>
- <entry>2005-01-21</entry>
+ <cvename>CVE-2004-1030</cvename> <cvename>CVE-2004-1031</cvename>
+ <cvename>CVE-2004-1032</cvename> <cvename>CVE-2004-1033</cvename>
+ </references> <dates>
+ <discovery>2004-11-15</discovery> <entry>2005-01-21</entry>
</dates>
</vuln>
<vuln vid="02274fd9-6bc5-11d9-8edb-000a95bc6fae">
- <topic>realplayer -- arbitrary file deletion and other vulnerabilities</topic>
- <affects>
+ <topic>realplayer -- arbitrary file deletion and other
+ vulnerabilities</topic> <affects>
<package>
- <name>linux-realplayer</name>
- <range><lt>10.0.2</lt></range>
+ <name>linux-realplayer</name> <range><lt>10.0.2</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>An NGSSoftware Insight Security Research Advisory reports:</p>
- <blockquote cite="http://www.ngssoftware.com/advisories/real-03full.txt">
+ <p>An NGSSoftware Insight Security Research Advisory
+ reports:</p> <blockquote
+ cite="http://www.ngssoftware.com/advisories/real-03full.txt">
<p>Two vulnerabilities have been discovered in RealPlayer
- which may potentially be leveraged to allow remote code
- execution, or may used in combination with the Real
- Metadata Package File Deletion vulnerability to reliably
- delete files from a users system.</p>
+ which may potentially be leveraged to allow remote code
+ execution, or may used in combination with the Real
+ Metadata Package File Deletion vulnerability to reliably
+ delete files from a users system.</p>
</blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<url>http://www.ngssoftware.com/advisories/real-02full.txt</url>
<url>http://www.ngssoftware.com/advisories/real-03full.txt</url>
<url>http://service.real.com/help/faq/security/040928_player/EN/</url>
- </references>
- <dates>
- <discovery>2004-10-06</discovery>
- <entry>2005-01-21</entry>
+ </references> <dates>
+ <discovery>2004-10-06</discovery> <entry>2005-01-21</entry>
</dates>
</vuln>
<vuln vid="2001103a-6bbd-11d9-851d-000a95bc6fae">
- <topic>imlib -- xpm heap buffer overflows and integer overflows</topic>
- <affects>
- <package>
- <name>imlib</name>
- <range><lt>1.9.15_2</lt></range>
- </package>
+ <topic>imlib -- xpm heap buffer overflows and integer
+ overflows</topic> <affects>
<package>
- <name>imlib2</name>
- <range><lt>1.1.2_1</lt></range>
+ <name>imlib</name> <range><lt>1.9.15_2</lt></range>
+ </package> <package>
+ <name>imlib2</name> <range><lt>1.1.2_1</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>Pavel Kankovsky reports:</p>
- <blockquote cite="https://bugzilla.fedora.us/show_bug.cgi?id=2051#c11">
+ <p>Pavel Kankovsky reports:</p> <blockquote
+ cite="https://bugzilla.fedora.us/show_bug.cgi?id=2051#c11">
<p>Imlib affected by a variant of CAN-2004-0782 too.</p>
<p>I've discovered more vulnerabilities in Imlib
- (1.9.13). In particular, it appears to be affected by a
- variant of Chris Evans' libXpm flaw #1 (CAN-2004-0782, see
- http://scary.beasts.org/security/CESA-2004-003.txt). Look
- at the attached image, it kills ee on my 7.3.</p>
- </blockquote>
- <p>The flaws also affect imlib2.</p>
- </body>
- </description>
- <references>
- <cvename>CVE-2004-1025</cvename>
- <cvename>CVE-2004-1026</cvename>
+ (1.9.13). In particular, it appears to be affected by
+ a variant of Chris Evans' libXpm flaw #1 (CAN-2004-0782,
+ see http://scary.beasts.org/security/CESA-2004-003.txt).
+ Look at the attached image, it kills ee on my 7.3.</p>
+ </blockquote> <p>The flaws also affect imlib2.</p>
+ </body>
+ </description> <references>
+ <cvename>CVE-2004-1025</cvename> <cvename>CVE-2004-1026</cvename>
<bid>11830</bid>
<url>https://bugzilla.fedora.us/show_bug.cgi?id=2051#c11</url>
<url>https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=138516</url>
<url>http://cvs.sourceforge.net/viewcvs.py/enlightenment/e17/libs/imlib2/src/modules/loaders/loader_xpm.c#rev1.3</url>
- </references>
- <dates>
- <discovery>2004-12-06</discovery>
- <entry>2005-01-21</entry>
+ </references> <dates>
+ <discovery>2004-12-06</discovery> <entry>2005-01-21</entry>
</dates>
</vuln>
@@ -10186,23 +8471,19 @@ Note: Please add new entries to the beginning of this file.
<topic>egroupware -- arbitrary file download in JiNN</topic>
<affects>
<package>
- <name>eGroupWare</name>
- <range><lt>1.0.0.006</lt></range>
+ <name>eGroupWare</name> <range><lt>1.0.0.006</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>eGroupWare contains a bug in the JiNN component that allows
- a remote attacker to download arbitrary files.</p>
+ <p>eGroupWare contains a bug in the JiNN component that
+ allows
+ a remote attacker to download arbitrary files.</p>
</body>
- </description>
- <references>
+ </description> <references>
<url>http://cvs.sourceforge.net/viewcvs.py/egroupware/jinn/CHANGELOG#rev1.24</url>
<mlist>http://sourceforge.net/mailarchive/forum.php?thread_id=5915445&amp;forum_id=35178</mlist>
- </references>
- <dates>
- <discovery>2004-10-15</discovery>
- <entry>2005-01-21</entry>
+ </references> <dates>
+ <discovery>2004-10-15</discovery> <entry>2005-01-21</entry>
</dates>
</vuln>
@@ -10210,33 +8491,27 @@ Note: Please add new entries to the beginning of this file.
<topic>quake2 -- multiple critical vulnerabilities</topic>
<affects>
<package>
- <name>quake2forge</name>
- <range><ge>0</ge></range>
+ <name>quake2forge</name> <range><ge>0</ge></range>
+ </package> <package>
+ <name>quake2lnx</name> <range><lt>0.16.2</lt></range>
</package>
- <package>
- <name>quake2lnx</name>
- <range><lt>0.16.2</lt></range>
- </package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>An advisory published by Richard Stanway describes numerous
+ <p>An advisory published by Richard Stanway describes
+ numerous
critical vulnerabilities in the Quake II engine:</p>
<blockquote cite="http://secur1ty.net/advisories/001">
<p>Due to unchecked input at various stages in the server,
- remote users are able to cause the server to crash, reveal
- sensitive information or potentially execute arbitrary
- code.</p>
+ remote users are able to cause the server to crash,
+ reveal sensitive information or potentially execute
+ arbitrary code.</p>
</blockquote>
</body>
- </description>
- <references>
- <url>http://secur1ty.net/advisories/001</url>
- <mlist msgid="NGEHLEPKOGIHAIJAMDPKOEHJCGAA.bugtraq@secur1ty.net">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=109892527321706</mlist>
- </references>
- <dates>
- <discovery>2004-10-27</discovery>
- <entry>2005-01-21</entry>
+ </description> <references>
+ <url>http://secur1ty.net/advisories/001</url> <mlist
+ msgid="NGEHLEPKOGIHAIJAMDPKOEHJCGAA.bugtraq@secur1ty.net">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=109892527321706</mlist>
+ </references> <dates>
+ <discovery>2004-10-27</discovery> <entry>2005-01-21</entry>
<modified>2005-03-15</modified>
</dates>
</vuln>
@@ -10245,26 +8520,22 @@ Note: Please add new entries to the beginning of this file.
<topic>konversation -- shell script command injection</topic>
<affects>
<package>
- <name>konversation</name>
- <range><lt>0.15</lt></range>
+ <name>konversation</name> <range><lt>0.15</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>Konversation comes with Perl scripts that do not properly escape
- shell characters on executing a script. This makes it possible
- to attack Konversation with shell script command injection.</p>
+ <p>Konversation comes with Perl scripts that do not properly
+ escape
+ shell characters on executing a script. This makes it
+ possible to attack Konversation with shell script command
+ injection.</p>
</body>
- </description>
- <references>
- <cvename>CVE-2005-0129</cvename>
- <cvename>CVE-2005-0130</cvename>
- <cvename>CVE-2005-0131</cvename>
- <mlist msgid="200501191739.56585.wouter@coekaerts.be">http://marc.theaimsgroup.com/?l=full-disclosure&amp;m=110616016509114</mlist>
- </references>
- <dates>
- <discovery>2005-01-19</discovery>
- <entry>2005-01-19</entry>
+ </description> <references>
+ <cvename>CVE-2005-0129</cvename> <cvename>CVE-2005-0130</cvename>
+ <cvename>CVE-2005-0131</cvename> <mlist
+ msgid="200501191739.56585.wouter@coekaerts.be">http://marc.theaimsgroup.com/?l=full-disclosure&amp;m=110616016509114</mlist>
+ </references> <dates>
+ <discovery>2005-01-19</discovery> <entry>2005-01-19</entry>
<modified>2005-01-21</modified>
</dates>
</vuln>
@@ -10273,38 +8544,32 @@ Note: Please add new entries to the beginning of this file.
<topic>squid -- no sanity check of usernames in squid_ldap_auth</topic>
<affects>
<package>
- <name>squid</name>
- <range><lt>2.5.7_7</lt></range>
+ <name>squid</name> <range><lt>2.5.7_7</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The LDAP authentication helper did not strip
- leading or trailing spaces from the login name.
- According to the squid patches page:</p>
- <blockquote cite="http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-ldap_spaces">
+ leading or trailing spaces from the login name. According
+ to the squid patches page:</p>
+ <blockquote
+ cite="http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-ldap_spaces">
<p>LDAP is very forgiving about spaces in search
- filters and this could be abused to log in
- using several variants of the login name,
- possibly bypassing explicit access controls
- or confusing accounting.</p>
+ filters and this could be abused to log in using several
+ variants of the login name, possibly bypassing explicit
+ access controls or confusing accounting.</p>
<p>Workaround: Block logins with spaces</p>
- <pre>
- acl login_with_spaces proxy_auth_regex [:space:]
+ <pre> acl login_with_spaces proxy_auth_regex [:space:]
http_access deny login_with_spaces
</pre>
</blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2005-0173</cvename>
<url>http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-ldap_spaces</url>
<url>http://www.squid-cache.org/bugs/show_bug.cgi?id=1187</url>
<certvu>924198</certvu>
- </references>
- <dates>
- <discovery>2005-01-10</discovery>
- <entry>2005-01-19</entry>
+ </references> <dates>
+ <discovery>2005-01-10</discovery> <entry>2005-01-19</entry>
<modified>2005-02-08</modified>
</dates>
</vuln>
@@ -10316,194 +8581,149 @@ Note: Please add new entries to the beginning of this file.
<name>cups-base</name>
<range><ge>1.1.21</ge><lt>1.1.23</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>Kenshi Muto discovered that the CUPS server would enter an
+ <p>Kenshi Muto discovered that the CUPS server would enter
+ an
infinite loop when processing a URL containing
<q><code>/..</code></q>.</p>
</body>
- </description>
- <references>
- <bid>12200</bid>
- <cvename>CVE-2005-2874</cvename>
+ </description> <references>
+ <bid>12200</bid> <cvename>CVE-2005-2874</cvename>
<url>http://www.cups.org/str.php?L1042</url>
- </references>
- <dates>
- <discovery>2004-12-30</discovery>
- <entry>2005-01-18</entry>
+ </references> <dates>
+ <discovery>2004-12-30</discovery> <entry>2005-01-18</entry>
<modified>2005-09-21</modified>
</dates>
</vuln>
<vuln vid="b58ff497-6977-11d9-ae49-000c41e2cdad">
- <topic>tiff -- divide-by-zero denial-of-service</topic>
- <affects>
+ <topic>tiff -- divide-by-zero denial-of-service</topic> <affects>
<package>
- <name>tiff</name>
- <name>linux-tiff</name>
+ <name>tiff</name> <name>linux-tiff</name>
<range><lt>3.6.0</lt></range>
- </package>
- <package>
- <name>pdflib</name>
- <name>pdflib-perl</name>
+ </package> <package>
+ <name>pdflib</name> <name>pdflib-perl</name>
<range><lt>6.0.1</lt></range>
- </package>
- <package>
- <name>gdal</name>
- <range><lt>1.2.1_2</lt></range>
- </package>
- <package>
- <name>fractorama</name>
- <name>iv</name>
- <name>ivtools</name>
- <name>ja-iv</name>
- <name>ja-libimg</name>
- <name>paraview</name>
+ </package> <package>
+ <name>gdal</name> <range><lt>1.2.1_2</lt></range>
+ </package> <package>
+ <name>fractorama</name> <name>iv</name> <name>ivtools</name>
+ <name>ja-iv</name> <name>ja-libimg</name> <name>paraview</name>
<range><gt>0</gt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>A US-CERT vulnerability note reports:</p>
- <blockquote cite="http://www.kb.cert.org/vuls/id/555304">
- <p>An Integer overflow in the LibTIFF library may allow a
- remote attacker to cause a divide-by-zero error that results
- in a denial-of-service condition.</p>
+ <p>A US-CERT vulnerability note reports:</p> <blockquote
+ cite="http://www.kb.cert.org/vuls/id/555304">
+ <p>An Integer overflow in the LibTIFF library may allow
+ a
+ remote attacker to cause a divide-by-zero error that
+ results in a denial-of-service condition.</p>
</blockquote>
</body>
- </description>
- <references>
- <cvename>CVE-2004-0804</cvename>
- <certvu>555304</certvu>
+ </description> <references>
+ <cvename>CVE-2004-0804</cvename> <certvu>555304</certvu>
<url>http://bugzilla.remotesensing.org/show_bug.cgi?id=111</url>
- </references>
- <dates>
- <discovery>2002-03-27</discovery>
- <entry>2005-01-18</entry>
+ </references> <dates>
+ <discovery>2002-03-27</discovery> <entry>2005-01-18</entry>
<modified>2005-08-01</modified>
</dates>
</vuln>
<vuln vid="249a8c42-6973-11d9-ae49-000c41e2cdad">
- <topic>zgv -- exploitable heap overflows</topic>
- <affects>
- <package>
- <name>zgv</name>
- <range><lt>5.8_1</lt></range>
- </package>
- <package>
- <name>xzgv</name>
- <range><lt>0.8_2</lt></range>
- </package>
- </affects>
- <description>
- <body xmlns="http://www.w3.org/1999/xhtml">
- <p>infamous41md reports:</p>
- <blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=109886210702781">
- <p>zgv uses malloc() frequently to allocate memory for storing
- image data. When calculating how much to allocate, user
- supplied data from image headers is multiplied and/or added
- without any checks for arithmetic overflows. We can
- overflow numerous calculations, and cause small buffers to
- be allocated. Then we can overflow the buffer, and
- eventually execute code. There are a total of
- 11 overflows that are exploitable to execute arbitrary
+ <topic>zgv -- exploitable heap overflows</topic> <affects>
+ <package>
+ <name>zgv</name> <range><lt>5.8_1</lt></range>
+ </package> <package>
+ <name>xzgv</name> <range><lt>0.8_2</lt></range>
+ </package>
+ </affects> <description>
+ <body xmlns="http://www.w3.org/1999/xhtml">
+ <p>infamous41md reports:</p> <blockquote
+ cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=109886210702781">
+ <p>zgv uses malloc() frequently to allocate memory for
+ storing
+ image data. When calculating how much to allocate,
+ user supplied data from image headers is multiplied
+ and/or added without any checks for arithmetic overflows.
+ We can overflow numerous calculations, and cause small
+ buffers to be allocated. Then we can overflow the
+ buffer, and eventually execute code. There are a total
+ of 11 overflows that are exploitable to execute arbitrary
code.</p>
- </blockquote>
- <p>These bugs exist in both zgv and xzgv.</p>
+ </blockquote> <p>These bugs exist in both zgv and xzgv.</p>
</body>
- </description>
- <references>
- <mlist msgid="20041025210717.2799d9c1.infamous41md@hotpop.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=109886210702781</mlist>
- <mlist msgid="20041027233907.A3678@netdirect.ca">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=109898111915661</mlist>
+ </description> <references>
+ <mlist
+ msgid="20041025210717.2799d9c1.infamous41md@hotpop.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=109886210702781</mlist>
+ <mlist
+ msgid="20041027233907.A3678@netdirect.ca">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=109898111915661</mlist>
<url>http://rus.members.beeb.net/xzgv.html</url>
<url>http://www.svgalib.org/rus/zgv/</url>
<cvename>CVE-2004-0994</cvename>
<url>http://www.idefense.com/application/poi/display?id=160&amp;type=vulnerabilities&amp;flashstatus=false</url>
- </references>
- <dates>
- <discovery>2004-10-26</discovery>
- <entry>2005-01-18</entry>
+ </references> <dates>
+ <discovery>2004-10-26</discovery> <entry>2005-01-18</entry>
<modified>2005-01-21</modified>
</dates>
</vuln>
<vuln vid="a77849a5-696f-11d9-ae49-000c41e2cdad">
- <topic>mozilla -- insecure permissions for some downloaded files</topic>
- <affects>
+ <topic>mozilla -- insecure permissions for some downloaded
+ files</topic> <affects>
<package>
- <name>thunderbird</name>
- <range><lt>0.9</lt></range>
- </package>
- <package>
- <name>de-linux-mozillafirebird</name>
- <name>el-linux-mozillafirebird</name>
- <name>firefox</name>
- <name>ja-linux-mozillafirebird-gtk1</name>
- <name>ja-mozillafirebird-gtk2</name>
- <name>linux-mozillafirebird</name>
- <name>ru-linux-mozillafirebird</name>
- <name>zhCN-linux-mozillafirebird</name>
- <name>zhTW-linux-mozillafirebird</name>
+ <name>thunderbird</name> <range><lt>0.9</lt></range>
+ </package> <package>
+ <name>de-linux-mozillafirebird</name>
+ <name>el-linux-mozillafirebird</name> <name>firefox</name>
+ <name>ja-linux-mozillafirebird-gtk1</name>
+ <name>ja-mozillafirebird-gtk2</name>
+ <name>linux-mozillafirebird</name>
+ <name>ru-linux-mozillafirebird</name>
+ <name>zhCN-linux-mozillafirebird</name>
+ <name>zhTW-linux-mozillafirebird</name>
<range><lt>1.0.r2,1</lt></range>
- </package>
- <package>
- <name>de-netscape7</name>
- <name>fr-netscape7</name>
- <name>ja-netscape7</name>
- <name>netscape7</name>
- <name>pt_BR-netscape7</name>
- <range><le>7.2</le></range>
- </package>
- <package>
- <name>mozilla-gtk1</name>
- <name>linux-mozilla</name>
- <name>linux-mozilla-devel</name>
- <range><lt>1.7.5</lt></range>
- </package>
- <package>
- <name>mozilla</name>
- <range><lt>1.7.5,2</lt></range>
- </package>
- <package>
+ </package> <package>
+ <name>de-netscape7</name> <name>fr-netscape7</name>
+ <name>ja-netscape7</name> <name>netscape7</name>
+ <name>pt_BR-netscape7</name> <range><le>7.2</le></range>
+ </package> <package>
+ <name>mozilla-gtk1</name> <name>linux-mozilla</name>
+ <name>linux-mozilla-devel</name> <range><lt>1.7.5</lt></range>
+ </package> <package>
+ <name>mozilla</name> <range><lt>1.7.5,2</lt></range>
+ </package> <package>
<!-- These package names are obsolete. -->
- <name>de-linux-netscape</name>
- <name>fr-linux-netscape</name>
- <name>ja-linux-netscape</name>
- <name>linux-netscape</name>
- <name>linux-phoenix</name>
- <name>mozilla+ipv6</name>
- <name>mozilla-embedded</name>
- <name>mozilla-firebird</name>
- <name>mozilla-gtk2</name>
- <name>mozilla-gtk</name>
- <name>mozilla-thunderbird</name>
- <name>phoenix</name>
+ <name>de-linux-netscape</name> <name>fr-linux-netscape</name>
+ <name>ja-linux-netscape</name> <name>linux-netscape</name>
+ <name>linux-phoenix</name> <name>mozilla+ipv6</name>
+ <name>mozilla-embedded</name> <name>mozilla-firebird</name>
+ <name>mozilla-gtk2</name> <name>mozilla-gtk</name>
+ <name>mozilla-thunderbird</name> <name>phoenix</name>
<range><ge>0</ge></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>In a Mozilla bug report, Daniel Kleinsinger writes:</p>
- <blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=251297">
+ <blockquote
+ cite="https://bugzilla.mozilla.org/show_bug.cgi?id=251297">
<p>I was comparing treatment of attachments opened directly
- from emails on different platforms. I discovered that Linux
- builds save attachments in /tmp with world readable rights.
- This doesn't seem like a good thing. Couldn't someone else
- logged onto the same machine read your attachments?</p>
- </blockquote>
- <p>This could expose the contents of downloaded files or email
+ from emails on different platforms. I discovered that
+ Linux builds save attachments in /tmp with world readable
+ rights. This doesn't seem like a good thing. Couldn't
+ someone else logged onto the same machine read your
+ attachments?</p>
+ </blockquote> <p>This could expose the contents of downloaded
+ files or email
attachments to other users on a multi-user system.</p>
</body>
- </description>
- <references>
+ </description> <references>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=251297</url>
- <mlist msgid="417C19F1.2040107@ptraced.net">http://marc.theaimsgroup.com/?l=full-disclosure&amp;m=109865078103911</mlist>
- </references>
- <dates>
- <discovery>2004-07-13</discovery>
- <entry>2005-01-18</entry>
+ <mlist
+ msgid="417C19F1.2040107@ptraced.net">http://marc.theaimsgroup.com/?l=full-disclosure&amp;m=109865078103911</mlist>
+ </references> <dates>
+ <discovery>2004-07-13</discovery> <entry>2005-01-18</entry>
</dates>
</vuln>
@@ -10511,39 +8731,34 @@ Note: Please add new entries to the beginning of this file.
<topic>awstats -- remote command execution vulnerability</topic>
<affects>
<package>
- <name>awstats</name>
- <range><lt>6.3</lt></range>
+ <name>awstats</name> <range><lt>6.3</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>An iDEFENSE Security Advisory reports:</p>
- <blockquote cite="http://marc.theaimsgroup.com/?l=full-disclosure&amp;m=110600949323439">
+ <p>An iDEFENSE Security Advisory reports:</p> <blockquote
+ cite="http://marc.theaimsgroup.com/?l=full-disclosure&amp;m=110600949323439">
<p>Remote exploitation of an input validation vulnerability
in AWStats allows attackers to execute arbitrary commands
under the privileges of the web server.</p>
- <p>The problem specifically exists when the application is
+ <p>The problem specifically exists when the application
+ is
running as a CGI script on a web server. The "configdir"
- parameter contains unfiltered user-supplied data that is
- utilized in a call to the Perl routine open()...</p>
+ parameter contains unfiltered user-supplied data that
+ is utilized in a call to the Perl routine open()...</p>
<p>Successful exploitation allows remote attackers to
- execute arbitrary commands under the privileges of the web
- server. This can lead to further compromise as it provides
- remote attackers with local access.</p>
+ execute arbitrary commands under the privileges of the
+ web server. This can lead to further compromise as it
+ provides remote attackers with local access.</p>
</blockquote>
</body>
- </description>
- <references>
- <bid>12270</bid>
- <cvename>CVE-2005-0116</cvename>
- <certvu>272296</certvu>
- <mlist msgid="FB24803D1DF2A34FA59FC157B77C970503C8B20C@idserv04.idef.com">http://marc.theaimsgroup.com/?l=full-disclosure&amp;m=110600949323439</mlist>
+ </description> <references>
+ <bid>12270</bid> <cvename>CVE-2005-0116</cvename>
+ <certvu>272296</certvu> <mlist
+ msgid="FB24803D1DF2A34FA59FC157B77C970503C8B20C@idserv04.idef.com">http://marc.theaimsgroup.com/?l=full-disclosure&amp;m=110600949323439</mlist>
<url>http://awstats.sourceforge.net/docs/awstats_changelog.txt</url>
<url>http://www.idefense.com/application/poi/display?id=185&amp;type=vulnerabilities&amp;flashstatus=false</url>
- </references>
- <dates>
- <discovery>2004-10-21</discovery>
- <entry>2005-01-18</entry>
+ </references> <dates>
+ <discovery>2004-10-21</discovery> <entry>2005-01-18</entry>
<modified>2005-02-23</modified>
</dates>
</vuln>
@@ -10552,35 +8767,32 @@ Note: Please add new entries to the beginning of this file.
<topic>ImageMagick -- PSD handler heap overflow vulnerability</topic>
<affects>
<package>
- <name>ImageMagick</name>
- <range><lt>6.1.8.8</lt></range>
+ <name>ImageMagick</name> <range><lt>6.1.8.8</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>An iDEFENSE Security Advisory reports:</p>
- <blockquote cite="http://www.idefense.com/application/poi/display?id=184&amp;type=vulnerabilities">
- <p>Remote exploitation of a buffer overflow vulnerability in
+ <p>An iDEFENSE Security Advisory reports:</p> <blockquote
+ cite="http://www.idefense.com/application/poi/display?id=184&amp;type=vulnerabilities">
+ <p>Remote exploitation of a buffer overflow vulnerability
+ in
The ImageMagick's Project's ImageMagick PSD image-decoding
module could allow an attacker to execute arbitrary
code.</p>
- <p>Exploitation may allow attackers to run arbitrary code on
+ <p>Exploitation may allow attackers to run arbitrary code
+ on
a victim's computer if the victim opens a specially
- formatted image. Such images could be delivered by e-mail
- or HTML, in some cases, and would likely not raise
- suspicion on the victim's part. Exploitation is also
- possible when a web-based application uses ImageMagick to
- process user-uploaded image files.</p>
+ formatted image. Such images could be delivered by
+ e-mail or HTML, in some cases, and would likely not
+ raise suspicion on the victim's part. Exploitation is
+ also possible when a web-based application uses ImageMagick
+ to process user-uploaded image files.</p>
</blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2005-0005</cvename>
<url>http://www.idefense.com/application/poi/display?id=184&amp;type=vulnerabilities</url>
- </references>
- <dates>
- <discovery>2004-12-21</discovery>
- <entry>2005-01-18</entry>
+ </references> <dates>
+ <discovery>2004-12-21</discovery> <entry>2005-01-18</entry>
</dates>
</vuln>
@@ -10588,56 +8800,51 @@ Note: Please add new entries to the beginning of this file.
<topic>cups-lpr -- lppasswd multiple vulnerabilities</topic>
<affects>
<package>
- <name>cups-lpr</name>
- <name>fr-cups-lpr</name>
+ <name>cups-lpr</name> <name>fr-cups-lpr</name>
<range><lt>1.1.23</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>D. J. Bernstein reports that Bartlomiej Sieka has
discovered several security vulnerabilities in lppasswd,
which is part of CUPS. In the following excerpt from
- Bernstein's email, CVE names have been added for each issue:</p>
+ Bernstein's email, CVE names have been added for each
+ issue:</p>
<blockquote cite="http://tigger.uic.edu/~jlongs2/holes/cups2.txt">
<p>First, lppasswd blithely ignores write errors in
fputs(line,outfile) at lines 311 and 315 of lppasswd.c,
- and in fprintf(...) at line 346. An attacker who fills up
- the disk at the right moment can arrange for
+ and in fprintf(...) at line 346. An attacker who fills
+ up the disk at the right moment can arrange for
/usr/local/etc/cups/passwd to be truncated.
<em>(CAN-2004-1268)</em></p>
- <p>Second, if lppasswd bumps into a file-size resource limit
+ <p>Second, if lppasswd bumps into a file-size resource
+ limit
while writing passwd.new, it leaves passwd.new in place,
disabling all subsequent invocations of lppasswd. Any
local user can thus disable lppasswd...
<em>(CAN-2004-1269)</em></p>
- <p>Third, line 306 of lppasswd.c prints an error message to
- stderr but does not exit. This is not a problem on systems
- that ensure that file descriptors 0, 1, and 2 are open for
- setuid programs, but it is a problem on other systems;
- lppasswd does not check that passwd.new is different from
- stderr, so it ends up writing a user-controlled error
- message to passwd if the user closes file descriptor
- 2. <em>(CAN-2004-1270)</em></p>
- </blockquote>
- <p><strong>Note:</strong> The third issue, CVE-2004-1270, does
+ <p>Third, line 306 of lppasswd.c prints an error message
+ to
+ stderr but does not exit. This is not a problem on
+ systems that ensure that file descriptors 0, 1, and 2
+ are open for setuid programs, but it is a problem on
+ other systems; lppasswd does not check that passwd.new
+ is different from stderr, so it ends up writing a
+ user-controlled error message to passwd if the user
+ closes file descriptor 2. <em>(CAN-2004-1270)</em></p>
+ </blockquote> <p><strong>Note:</strong> The third issue,
+ CVE-2004-1270, does
not affect FreeBSD 4.6-RELEASE or later systems, as these
systems ensure that the file descriptors 0, 1, and 2 are
always open for set-user-ID and set-group-ID programs.</p>
</body>
- </description>
- <references>
- <cvename>CVE-2004-1268</cvename>
- <cvename>CVE-2004-1269</cvename>
- <cvename>CVE-2004-1270</cvename>
- <bid>12007</bid>
- <bid>12004</bid>
+ </description> <references>
+ <cvename>CVE-2004-1268</cvename> <cvename>CVE-2004-1269</cvename>
+ <cvename>CVE-2004-1270</cvename> <bid>12007</bid> <bid>12004</bid>
<url>http://www.cups.org/str.php?L1023</url>
<url>http://tigger.uic.edu/~jlongs2/holes/cups2.txt</url>
- </references>
- <dates>
- <discovery>2004-12-11</discovery>
- <entry>2005-01-17</entry>
+ </references> <dates>
+ <discovery>2004-12-11</discovery> <entry>2005-01-17</entry>
</dates>
</vuln>
@@ -10645,180 +8852,142 @@ Note: Please add new entries to the beginning of this file.
<topic>cups-base -- HPGL buffer overflow vulnerability</topic>
<affects>
<package>
- <name>cups-base</name>
- <name>fr-cups-base</name>
+ <name>cups-base</name> <name>fr-cups-base</name>
<range><lt>1.1.22.0_2</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ariel Berkman has discovered a buffer overflow
- vulnerability in CUPS's HPGL input driver. This
- vulnerability could be exploited to execute arbitrary code
- with the permission of the CUPS server by printing a
- specially crated HPGL file.</p>
+ vulnerability in CUPS's HPGL input driver. This vulnerability
+ could be exploited to execute arbitrary code with the
+ permission of the CUPS server by printing a specially
+ crated HPGL file.</p>
</body>
- </description>
- <references>
- <bid>11968</bid>
- <cvename>CVE-2004-1267</cvename>
+ </description> <references>
+ <bid>11968</bid> <cvename>CVE-2004-1267</cvename>
<url>http://tigger.uic.edu/~jlongs2/holes/cups.txt</url>
<url>http://www.cups.org/str.php?L1024</url>
- </references>
- <dates>
- <discovery>2004-12-15</discovery>
- <entry>2005-01-17</entry>
+ </references> <dates>
+ <discovery>2004-12-15</discovery> <entry>2005-01-17</entry>
</dates>
</vuln>
<vuln vid="ce109fd4-67f3-11d9-a9e7-0001020eed82">
- <topic>mysql-scripts -- mysqlaccess insecure temporary file creation</topic>
- <affects>
+ <topic>mysql-scripts -- mysqlaccess insecure temporary file
+ creation</topic> <affects>
<package>
- <name>mysql-scripts</name>
- <range><lt>3.23.58_2</lt></range>
+ <name>mysql-scripts</name> <range><lt>3.23.58_2</lt></range>
<range><gt>4.*</gt><lt>4.0.23a_1</lt></range>
<range><gt>4.1.*</gt><lt>4.1.9_1</lt></range>
<range><gt>5.*</gt><lt>5.0.2_1</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>The Debian Security Team reports:</p>
- <blockquote>
- <p>Javier Fernández-Sanguino Peña from the Debian Security
- Audit Project discovered a temporary file vulnerability in
- the mysqlaccess script of MySQL that could allow an
+ <p>The Debian Security Team reports:</p> <blockquote>
+ <p>Javier Fernández-Sanguino Peña from the Debian
+ Security
+ Audit Project discovered a temporary file vulnerability
+ in the mysqlaccess script of MySQL that could allow an
unprivileged user to let root overwrite arbitrary files
via a symlink attack and could also could unveil the
contents of a temporary file which might contain sensitive
information.</p>
</blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2005-0004</cvename>
<url>http://lists.mysql.com/internals/20600</url>
- </references>
- <dates>
- <discovery>2005-01-12</discovery>
- <entry>2005-01-16</entry>
+ </references> <dates>
+ <discovery>2005-01-12</discovery> <entry>2005-01-16</entry>
<modified>2005-01-17</modified>
</dates>
</vuln>
<vuln vid="f2d5e56e-67eb-11d9-a9e7-0001020eed82">
- <topic>unrtf -- buffer overflow vulnerability</topic>
- <affects>
+ <topic>unrtf -- buffer overflow vulnerability</topic> <affects>
<package>
- <name>unrtf</name>
- <range><lt>0.19.3_1</lt></range>
+ <name>unrtf</name> <range><lt>0.19.3_1</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Yosef Klein and Limin Wang have found a buffer overflow
- vulnerability in unrtf that can allow an attacker to execute
- arbitrary code with the permissions of the user running
- unrtf, by running unrtf on a specially crafted rtf
- document.</p>
+ vulnerability in unrtf that can allow an attacker to
+ execute arbitrary code with the permissions of the user
+ running unrtf, by running unrtf on a specially crafted
+ rtf document.</p>
</body>
- </description>
- <references>
- <bid>12030</bid>
- <cvename>CVE-2004-1297</cvename>
+ </description> <references>
+ <bid>12030</bid> <cvename>CVE-2004-1297</cvename>
<url>http://tigger.uic.edu/~jlongs2/holes/unrtf.txt</url>
- </references>
- <dates>
- <discovery>2004-12-15</discovery>
- <entry>2005-01-16</entry>
+ </references> <dates>
+ <discovery>2004-12-15</discovery> <entry>2005-01-16</entry>
<modified>2005-02-11</modified>
</dates>
</vuln>
<vuln vid="3fbf9db2-658b-11d9-abad-000a95bc6fae">
- <topic>mozilla -- heap overflow in NNTP handler</topic>
- <affects>
- <package>
- <name>de-netscape7</name>
- <name>fr-netscape7</name>
- <name>ja-netscape7</name>
- <name>netscape7</name>
- <name>pt_BR-netscape7</name>
- <range><gt>0</gt></range>
- </package>
- <package>
- <name>mozilla-gtk1</name>
- <name>linux-mozilla</name>
- <name>linux-mozilla-devel</name>
- <range><lt>1.7.5</lt></range>
- </package>
- <package>
- <name>mozilla</name>
- <range><lt>1.7.5,2</lt></range>
- </package>
- <package>
+ <topic>mozilla -- heap overflow in NNTP handler</topic> <affects>
+ <package>
+ <name>de-netscape7</name> <name>fr-netscape7</name>
+ <name>ja-netscape7</name> <name>netscape7</name>
+ <name>pt_BR-netscape7</name> <range><gt>0</gt></range>
+ </package> <package>
+ <name>mozilla-gtk1</name> <name>linux-mozilla</name>
+ <name>linux-mozilla-devel</name> <range><lt>1.7.5</lt></range>
+ </package> <package>
+ <name>mozilla</name> <range><lt>1.7.5,2</lt></range>
+ </package> <package>
<!-- These package names are obsolete. -->
- <name>de-linux-netscape</name>
- <name>fr-linux-netscape</name>
- <name>ja-linux-netscape</name>
- <name>linux-netscape</name>
- <name>mozilla+ipv6</name>
- <name>mozilla-embedded</name>
- <name>mozilla-gtk2</name>
- <name>mozilla-gtk</name>
+ <name>de-linux-netscape</name> <name>fr-linux-netscape</name>
+ <name>ja-linux-netscape</name> <name>linux-netscape</name>
+ <name>mozilla+ipv6</name> <name>mozilla-embedded</name>
+ <name>mozilla-gtk2</name> <name>mozilla-gtk</name>
<range><ge>0</ge></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Maurycy Prodeus reports a critical vulnerability in
Mozilla-based browsers:</p>
- <blockquote cite="http://isec.pl/vulnerabilities/isec-0020-mozilla.txt">
- <p>Mozilla browser supports NNTP urls. Remote side is able to
- trigger news:// connection to any server. I found a flaw in
- NNTP handling code which may cause heap overflow and allow
- remote attacker to execute arbitrary code on client
- machine.</p>
+ <blockquote
+ cite="http://isec.pl/vulnerabilities/isec-0020-mozilla.txt">
+ <p>Mozilla browser supports NNTP urls. Remote side is
+ able to
+ trigger news:// connection to any server. I found a
+ flaw in NNTP handling code which may cause heap overflow
+ and allow remote attacker to execute arbitrary code on
+ client machine.</p>
</blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2004-1316</cvename>
<url>http://isec.pl/vulnerabilities/isec-0020-mozilla.txt</url>
- <mlist msgid="Pine.LNX.4.44.0412292228440.19239-200000@isec.pl">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110436284718949</mlist>
- </references>
- <dates>
- <discovery>2004-12-29</discovery>
- <entry>2005-01-13</entry>
+ <mlist
+ msgid="Pine.LNX.4.44.0412292228440.19239-200000@isec.pl">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110436284718949</mlist>
+ </references> <dates>
+ <discovery>2004-12-29</discovery> <entry>2005-01-13</entry>
</dates>
</vuln>
<vuln vid="3cc84400-6576-11d9-a9e7-0001020eed82">
- <topic>mpg123 -- buffer overflow vulnerability</topic>
- <affects>
+ <topic>mpg123 -- buffer overflow vulnerability</topic> <affects>
<package>
- <name>mpg123</name>
- <name>mpg123-nas</name>
- <name>mpg123-esound</name>
- <range><lt>0.59r_17</lt></range>
+ <name>mpg123</name> <name>mpg123-nas</name>
+ <name>mpg123-esound</name> <range><lt>0.59r_17</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>Yuri D'Elia has found a buffer overflow vulnerability in
+ <p>Yuri D'Elia has found a buffer overflow vulnerability
+ in
mpg123's parsing of frame headers in input streams. This
vulnerability can potentially lead to execution of arbitrary
- code with the permissions of the user running mpg123, if the
- user runs mpg123 on a specially crafted MP2 or MP3 file.</p>
+ code with the permissions of the user running mpg123, if
+ the user runs mpg123 on a specially crafted MP2 or MP3
+ file.</p>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2004-0991</cvename>
- </references>
- <dates>
- <discovery>2005-01-01</discovery>
- <entry>2005-01-13</entry>
+ </references> <dates>
+ <discovery>2005-01-01</discovery> <entry>2005-01-13</entry>
</dates>
</vuln>
@@ -10826,31 +8995,26 @@ Note: Please add new entries to the beginning of this file.
<topic>squid -- denial of service with forged WCCP messages</topic>
<affects>
<package>
- <name>squid</name>
- <range><lt>2.5.7_6</lt></range>
+ <name>squid</name> <range><lt>2.5.7_6</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>The squid patches page notes:</p>
- <blockquote cite="http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-wccp_denial_of_service">
+ <p>The squid patches page notes:</p> <blockquote
+ cite="http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-wccp_denial_of_service">
<p>WCCP_I_SEE_YOU messages contain a 'number of caches'
field which should be between 1 and 32. Values outside
- that range may crash Squid if WCCP is enabled, and if an
- attacker can spoof UDP packets with the WCCP router's IP
- address.</p>
+ that range may crash Squid if WCCP is enabled, and if
+ an attacker can spoof UDP packets with the WCCP router's
+ IP address.</p>
</blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2005-0095</cvename>
<url>http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-wccp_denial_of_service</url>
<url>http://www.squid-cache.org/bugs/show_bug.cgi?id=1190</url>
<url>http://www.squid-cache.org/Advisories/SQUID-2005_2.txt</url>
- </references>
- <dates>
- <discovery>2005-01-07</discovery>
- <entry>2005-01-12</entry>
+ </references> <dates>
+ <discovery>2005-01-07</discovery> <entry>2005-01-12</entry>
<modified>2005-01-22</modified>
</dates>
</vuln>
@@ -10859,33 +9023,30 @@ Note: Please add new entries to the beginning of this file.
<topic>squid -- buffer overflow vulnerability in gopherToHTML</topic>
<affects>
<package>
- <name>squid</name>
- <range><lt>2.5.7_6</lt></range>
+ <name>squid</name> <range><lt>2.5.7_6</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>The squid patches page notes:</p>
- <blockquote cite="http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-gopher_html_parsing">
- <p>A malicious gopher server may return a response with very
+ <p>The squid patches page notes:</p> <blockquote
+ cite="http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-gopher_html_parsing">
+ <p>A malicious gopher server may return a response with
+ very
long lines that cause a buffer overflow in Squid.</p>
- <p>Workaround: Since gopher is very obscure these days, do
+ <p>Workaround: Since gopher is very obscure these days,
+ do
not allow Squid to any gopher servers. Use an ACL rule
like:</p>
<pre>acl Gopher proto gopher
http_access deny Gopher</pre>
</blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2005-0094</cvename>
<url>http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-gopher_html_parsing</url>
<url>http://www.squid-cache.org/bugs/show_bug.cgi?id=1189</url>
<url>http://www.squid-cache.org/Advisories/SQUID-2005_1.txt</url>
- </references>
- <dates>
- <discovery>2005-01-11</discovery>
- <entry>2005-01-12</entry>
+ </references> <dates>
+ <discovery>2005-01-11</discovery> <entry>2005-01-12</entry>
<modified>2005-01-22</modified>
</dates>
</vuln>
@@ -10894,66 +9055,56 @@ http_access deny Gopher</pre>
<topic>libxine -- DVD subpicture decoder heap overflow</topic>
<affects>
<package>
- <name>libxine</name>
- <range><lt>1.0.r6</lt></range>
+ <name>libxine</name> <range><lt>1.0.r6</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>A xine security announcement states:</p>
- <blockquote cite="http://xinehq.de/index.php/security/XSA-2004-5">
+ <p>A xine security announcement states:</p> <blockquote
+ cite="http://xinehq.de/index.php/security/XSA-2004-5">
<p>A heap overflow has been found in the DVD subpicture
decoder of xine-lib. This can be used for a remote heap
- overflow exploit, which can, on some systems, lead to or
- help in executing malicious code with the permissions of the
- user running a xine-lib based media application.</p>
+ overflow exploit, which can, on some systems, lead to
+ or help in executing malicious code with the permissions
+ of the user running a xine-lib based media application.</p>
</blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2004-1379</cvename>
<url>http://xinehq.de/index.php/security/XSA-2004-5</url>
- </references>
- <dates>
- <discovery>2004-09-06</discovery>
- <entry>2005-01-12</entry>
+ </references> <dates>
+ <discovery>2004-09-06</discovery> <entry>2005-01-12</entry>
<modified>2005-01-19</modified>
</dates>
</vuln>
<vuln vid="b6939d5b-64a1-11d9-9106-000a95bc6fae">
- <topic>libxine -- multiple vulnerabilities in VideoCD handling</topic>
- <affects>
+ <topic>libxine -- multiple vulnerabilities in VideoCD
+ handling</topic> <affects>
<package>
- <name>libxine</name>
- <range><ge>1.0.r2</ge><lt>1.0.r6</lt></range>
+ <name>libxine</name> <range><ge>1.0.r2</ge><lt>1.0.r6</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>A xine security announcement states:</p>
- <blockquote cite="http://xinehq.de/index.php/security/XSA-2004-4">
- <p>Several string overflows on the stack have been fixed in
+ <p>A xine security announcement states:</p> <blockquote
+ cite="http://xinehq.de/index.php/security/XSA-2004-4">
+ <p>Several string overflows on the stack have been fixed
+ in
xine-lib, some of them can be used for remote buffer
- overflow exploits leading to the execution of arbitrary code
- with the permissions of the user running a xine-lib based
- media application.</p>
- <p>Stack-based string overflows have been found:</p>
- <ol>
- <li>in the code which handles VideoCD MRLs</li>
- <li>in VideoCD code reading the disc label</li>
- <li>in the code which parses text subtitles and prepares
+ overflow exploits leading to the execution of arbitrary
+ code with the permissions of the user running a xine-lib
+ based media application.</p>
+ <p>Stack-based string overflows have been found:</p> <ol>
+ <li>in the code which handles VideoCD MRLs</li> <li>in
+ VideoCD code reading the disc label</li> <li>in the
+ code which parses text subtitles and prepares
them for display</li>
</ol>
</blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<url>http://xinehq.de/index.php/security/XSA-2004-4</url>
- </references>
- <dates>
- <discovery>2004-09-07</discovery>
- <entry>2005-01-12</entry>
+ </references> <dates>
+ <discovery>2004-09-07</discovery> <entry>2005-01-12</entry>
</dates>
</vuln>
@@ -10961,45 +9112,37 @@ http_access deny Gopher</pre>
<topic>libxine -- multiple buffer overflows in RTSP</topic>
<affects>
<package>
- <name>mplayer</name>
- <name>mplayer-gtk</name>
- <name>mplayer-gtk2</name>
- <name>mplayer-esound</name>
- <name>mplayer-gtk-esound</name>
- <name>mplayer-gtk2-esound</name>
+ <name>mplayer</name> <name>mplayer-gtk</name>
+ <name>mplayer-gtk2</name> <name>mplayer-esound</name>
+ <name>mplayer-gtk-esound</name> <name>mplayer-gtk2-esound</name>
<range><lt>0.99.4</lt></range>
+ </package> <package>
+ <name>libxine</name> <range><lt>1.0.r4</lt></range>
</package>
- <package>
- <name>libxine</name>
- <range><lt>1.0.r4</lt></range>
- </package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>A xine security announcement states:</p>
- <blockquote cite="http://xinehq.de/index.php/security/XSA-2004-3">
- <p>Multiple vulnerabilities have been found and fixed in the
+ <p>A xine security announcement states:</p> <blockquote
+ cite="http://xinehq.de/index.php/security/XSA-2004-3">
+ <p>Multiple vulnerabilities have been found and fixed in
+ the
Real-Time Streaming Protocol (RTSP) client for RealNetworks
servers, including a series of potentially remotely
- exploitable buffer overflows. This is a joint advisory by
- the MPlayer and xine teams as the code in question is common
- to these projects.</p>
- <p>Severity: High (arbitrary remote code execution under the
- user ID running the player) when playing Real RTSP streams.
- At this time, there is no known exploit for these
- vulnerabilities.</p>
+ exploitable buffer overflows. This is a joint advisory
+ by the MPlayer and xine teams as the code in question
+ is common to these projects.</p>
+ <p>Severity: High (arbitrary remote code execution under
+ the
+ user ID running the player) when playing Real RTSP
+ streams. At this time, there is no known exploit for
+ these vulnerabilities.</p>
</blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2004-0433</cvename>
<url>http://xinehq.de/index.php/security/XSA-2004-3</url>
- <url>http://xforce.iss.net/xforce/xfdb/16019</url>
- <bid>10245</bid>
- </references>
- <dates>
- <discovery>2004-05-25</discovery>
- <entry>2005-01-12</entry>
+ <url>http://xforce.iss.net/xforce/xfdb/16019</url> <bid>10245</bid>
+ </references> <dates>
+ <discovery>2004-05-25</discovery> <entry>2005-01-12</entry>
</dates>
</vuln>
@@ -11007,87 +9150,68 @@ http_access deny Gopher</pre>
<topic>hylafax -- unauthorized login vulnerability</topic>
<affects>
<package>
- <name>hylafax</name>
- <range><lt>4.2.1</lt></range>
+ <name>hylafax</name> <range><lt>4.2.1</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A flaw in HylaFAX may allow an attacker to bypass normal
authentication by spoofing their DNS PTR records.</p>
</body>
- </description>
- <references>
- <cvename>CVE-2004-1182</cvename>
- <mlist msgid="20050111155949.GU9853@bilbo.x101.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110546971307585</mlist>
- </references>
- <dates>
- <discovery>2005-01-11</discovery>
- <entry>2005-01-11</entry>
+ </description> <references>
+ <cvename>CVE-2004-1182</cvename> <mlist
+ msgid="20050111155949.GU9853@bilbo.x101.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110546971307585</mlist>
+ </references> <dates>
+ <discovery>2005-01-11</discovery> <entry>2005-01-11</entry>
</dates>
</vuln>
<vuln vid="56971fa6-641c-11d9-a097-000854d03344">
- <topic>xshisen -- local buffer overflows</topic>
- <affects>
+ <topic>xshisen -- local buffer overflows</topic> <affects>
<package>
- <name>xshisen</name>
- <range><lt>1.36_1</lt></range>
+ <name>xshisen</name> <range><lt>1.36_1</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Steve Kemp has found buffer overflows in the handling
- of the command line flag -KCONV and the XSHISENLIB environment
- variable. Ulf Härnhammer has detected an unbounded copy from
- the GECOS field to a char array. All overflows can be exploited
- to gain group games privileges.</p>
+ of the command line flag -KCONV and the XSHISENLIB
+ environment variable. Ulf Härnhammer has detected an
+ unbounded copy from the GECOS field to a char array. All
+ overflows can be exploited to gain group games privileges.</p>
</body>
- </description>
- <references>
+ </description> <references>
<url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=213957</url>
<url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=289784</url>
- <cvename>CVE-2003-1053</cvename>
- <cvename>CVE-2005-0117</cvename>
- </references>
- <dates>
- <discovery>2005-01-11</discovery>
- <entry>2005-01-11</entry>
+ <cvename>CVE-2003-1053</cvename> <cvename>CVE-2005-0117</cvename>
+ </references> <dates>
+ <discovery>2005-01-11</discovery> <entry>2005-01-11</entry>
<modified>2005-01-19</modified>
</dates>
</vuln>
<vuln vid="0cf3480d-5fdf-11d9-b721-00065be4b5b6">
- <topic>helvis -- arbitrary file deletion problem</topic>
- <affects>
- <package>
- <name>ko-helvis</name>
- <range><le>1.8h2_1</le></range>
- </package>
+ <topic>helvis -- arbitrary file deletion problem</topic> <affects>
<package>
- <name>helvis</name>
- <range><le>1.8h2_1</le></range>
+ <name>ko-helvis</name> <range><le>1.8h2_1</le></range>
+ </package> <package>
+ <name>helvis</name> <range><le>1.8h2_1</le></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>The setuid root elvprsv utility, used to preserve
- recovery helvis files, can be abused by local users to delete
- with root privileges.</p>
- <p>The problem is that elvprsv deletes files when it thinks they
- have become corrupt. When elvprsv is pointed to a normal file then
- it will almost always think the file is corrupt and deletes it.
- This behavior may be exploited by local attackers to delete critical
- files.</p>
+ <p>The setuid root elvprsv utility, used to preserve
+ recovery helvis files, can be abused by local users to
+ delete
+ with root privileges.</p> <p>The problem is that elvprsv
+ deletes files when it thinks they have become corrupt. When
+ elvprsv is pointed to a normal file then it will almost
+ always think the file is corrupt and deletes it. This
+ behavior may be exploited by local attackers to delete
+ critical files.</p>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2005-0120</cvename>
<url>http://people.freebsd.org/~niels/ports/korean/helvis/issues.txt</url>
- </references>
- <dates>
- <discovery>2004-11-24</discovery>
- <entry>2005-01-10</entry>
+ </references> <dates>
+ <discovery>2004-11-24</discovery> <entry>2005-01-10</entry>
<modified>2005-01-19</modified>
</dates>
</vuln>
@@ -11096,58 +9220,45 @@ http_access deny Gopher</pre>
<topic>helvis -- information leak vulnerabilities</topic>
<affects>
<package>
- <name>ko-helvis</name>
- <range><le>1.8h2_1</le></range>
+ <name>ko-helvis</name> <range><le>1.8h2_1</le></range>
+ </package> <package>
+ <name>helvis</name> <range><le>1.8h2_1</le></range>
</package>
- <package>
- <name>helvis</name>
- <range><le>1.8h2_1</le></range>
- </package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>Once a recovery file has been preserved by the setuid root elvprsv
- utility it is placed in a worldreadable directory with worldreadable
- permissions. This possibly allows sensitive information to leak.</p>
- <p>In addition to this information leak, it is possible for users
- to recover files that belong to other users by using elvrec, another
- setuid root binary.</p>
+ <p>Once a recovery file has been preserved by the setuid
+ root elvprsv utility it is placed in a worldreadable directory
+ with worldreadable permissions. This possibly allows
+ sensitive information to leak.</p> <p>In addition to this
+ information leak, it is possible for users to recover files
+ that belong to other users by using elvrec, another setuid
+ root binary.</p>
</body>
- </description>
- <references>
- <cvename>CVE-2005-0118</cvename>
- <cvename>CVE-2005-0119</cvename>
+ </description> <references>
+ <cvename>CVE-2005-0118</cvename> <cvename>CVE-2005-0119</cvename>
<url>http://people.freebsd.org/~niels/ports/korean/helvis/issues.txt</url>
- </references>
- <dates>
- <discovery>2004-11-24</discovery>
- <entry>2005-01-10</entry>
+ </references> <dates>
+ <discovery>2004-11-24</discovery> <entry>2005-01-10</entry>
<modified>2005-01-19</modified>
</dates>
</vuln>
<vuln vid="28ab7ddf-61ab-11d9-a9e7-0001020eed82">
- <topic>dillo -- format string vulnerability</topic>
- <affects>
+ <topic>dillo -- format string vulnerability</topic> <affects>
<package>
- <name>dillo</name>
- <range><lt>0.8.3_1</lt></range>
+ <name>dillo</name> <range><lt>0.8.3_1</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>dillo contains a format string vulnerability which could
- lead to execution of arbitrary code simply by viewing a web
- page or opening a HTML file.</p>
+ lead to execution of arbitrary code simply by viewing a
+ web page or opening a HTML file.</p>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2005-0012</cvename>
<url>http://bugs.gentoo.org/show_bug.cgi?id=76665</url>
- </references>
- <dates>
- <discovery>2005-01-04</discovery>
- <entry>2005-01-08</entry>
+ </references> <dates>
+ <discovery>2005-01-04</discovery> <entry>2005-01-08</entry>
</dates>
</vuln>
@@ -11155,28 +9266,24 @@ http_access deny Gopher</pre>
<topic>tnftp -- mget does not check for directory escapes</topic>
<affects>
<package>
- <name>tnftp</name>
- <range><lt>20050103</lt></range>
+ <name>tnftp</name> <range><lt>20050103</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>When downloading a batch of files from an FTP server the
- mget command does not check for directory escapes. A
- specially crafted file on the FTP server could then
- potentially overwrite an existing file of the user.</p>
+ <p>When downloading a batch of files from an FTP server the
+ mget command does not check for directory escapes. A
+ specially crafted file on the FTP server could then
+ potentially overwrite an existing file of the user.</p>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2004-1294</cvename>
<url>http://tigger.uic.edu/~jlongs2/holes/tnftp.txt</url>
<url>http://cvsweb.netbsd.org/bsdweb.cgi/othersrc/usr.bin/tnftp/src/cmds.c?rev=1.1.1.3&amp;content-type=text/x-cvsweb-markup</url>
<url>http://it.slashdot.org/article.pl?sid=04/12/15/2113202</url>
- <mlist msgid="653D74053BA6F54A81ED83DCF969DF08CFA2AA@pivxes1.pivx.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110321888413132</mlist>
- </references>
- <dates>
- <discovery>2004-12-15</discovery>
- <entry>2005-01-07</entry>
+ <mlist
+ msgid="653D74053BA6F54A81ED83DCF969DF08CFA2AA@pivxes1.pivx.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110321888413132</mlist>
+ </references> <dates>
+ <discovery>2004-12-15</discovery> <entry>2005-01-07</entry>
<modified>2005-01-13</modified>
</dates>
</vuln>
@@ -11185,164 +9292,131 @@ http_access deny Gopher</pre>
<topic>tiff -- tiffdump integer overflow vulnerability</topic>
<affects>
<package>
- <name>tiff</name>
- <range><lt>3.7.1_2</lt></range>
+ <name>tiff</name> <range><lt>3.7.1_2</lt></range>
+ </package> <package>
+ <name>linux-tiff</name> <range><lt>3.6.1_1</lt></range>
</package>
- <package>
- <name>linux-tiff</name>
- <range><lt>3.6.1_1</lt></range>
- </package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>Dmitry V. Levin found a potential integer overflow in the
+ <p>Dmitry V. Levin found a potential integer overflow in
+ the
tiffdump utility which could lead to execution of arbitrary
code. This could be exploited by tricking an user into
executing tiffdump on a specially crafted tiff image.</p>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2004-1183</cvename>
- </references>
- <dates>
- <discovery>2005-01-06</discovery>
- <entry>2005-01-06</entry>
+ </references> <dates>
+ <discovery>2005-01-06</discovery> <entry>2005-01-06</entry>
<modified>2005-03-01</modified>
</dates>
</vuln>
<vuln vid="fc7e6a42-6012-11d9-a9e7-0001020eed82">
- <topic>tiff -- directory entry count integer overflow vulnerability</topic>
- <affects>
- <package>
- <name>tiff</name>
- <range><lt>3.7.1</lt></range>
- </package>
- <package>
- <name>linux-tiff</name>
- <range><lt>3.6.1_1</lt></range>
- </package>
- <package>
- <name>pdflib</name>
- <name>pdflib-perl</name>
+ <topic>tiff -- directory entry count integer overflow
+ vulnerability</topic> <affects>
+ <package>
+ <name>tiff</name> <range><lt>3.7.1</lt></range>
+ </package> <package>
+ <name>linux-tiff</name> <range><lt>3.6.1_1</lt></range>
+ </package> <package>
+ <name>pdflib</name> <name>pdflib-perl</name>
<range><lt>6.0.1_1</lt></range>
- </package>
- <package>
- <name>gdal</name>
- <range><lt>1.2.1_2</lt></range>
- </package>
- <package>
- <name>fractorama</name>
- <name>iv</name>
- <name>ivtools</name>
- <name>ja-iv</name>
- <name>ja-libimg</name>
- <name>paraview</name>
+ </package> <package>
+ <name>gdal</name> <range><lt>1.2.1_2</lt></range>
+ </package> <package>
+ <name>fractorama</name> <name>iv</name> <name>ivtools</name>
+ <name>ja-iv</name> <name>ja-libimg</name> <name>paraview</name>
<range><gt>0</gt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>In an iDEFENSE Security Advisory infamous41md reports:</p>
- <blockquote cite="http://www.idefense.com/application/poi/display?id=174&amp;type=vulnerabilities">
+ <blockquote
+ cite="http://www.idefense.com/application/poi/display?id=174&amp;type=vulnerabilities">
<p>Remote exploitation of a heap-based buffer overflow
vulnerability within the LibTIFF package could allow
attackers to execute arbitrary code.</p>
<p>The vulnerability specifically exists due to insufficient
- validation of user-supplied data when calculating the size
- of a directory entry. A TIFF file includes a number of
- directory entry header fields that describe the data in
- the file. Included in these entries is an entry count and
- offset value that are calculated to determine the size and
- location of the data for that entry.</p>
+ validation of user-supplied data when calculating the
+ size of a directory entry. A TIFF file includes a number
+ of directory entry header fields that describe the data
+ in the file. Included in these entries is an entry count
+ and offset value that are calculated to determine the
+ size and location of the data for that entry.</p>
</blockquote>
</body>
- </description>
- <references>
- <bid>12075</bid>
- <cvename>CVE-2004-1308</cvename>
+ </description> <references>
+ <bid>12075</bid> <cvename>CVE-2004-1308</cvename>
<url>http://www.idefense.com/application/poi/display?id=174&amp;type=vulnerabilities</url>
<certvu>125598</certvu>
- </references>
- <dates>
- <discovery>2004-12-17</discovery>
- <entry>2005-01-06</entry>
+ </references> <dates>
+ <discovery>2004-12-17</discovery> <entry>2005-01-06</entry>
<modified>2005-08-01</modified>
</dates>
</vuln>
<vuln vid="14e8f315-600e-11d9-a9e7-0001020eed82">
- <cancelled superseded="3897a2f8-1d57-11d9-bc4a-000c41e2cdad" />
+ <cancelled superseded="3897a2f8-1d57-11d9-bc4a-000c41e2cdad"
+ />
</vuln>
<vuln vid="bd9fc2bf-5ffe-11d9-a11a-000a95bc6fae">
<topic>vim -- vulnerabilities in modeline handling</topic>
<affects>
<package>
- <name>vim</name>
- <name>vim-lite</name>
- <name>vim+ruby</name>
+ <name>vim</name> <name>vim-lite</name> <name>vim+ruby</name>
<range><lt>6.3.45</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>Ciaran McCreesh discovered news ways in which a VIM modeline
+ <p>Ciaran McCreesh discovered news ways in which a VIM
+ modeline
can be used to trojan a text file. The patch by Bram
Moolenaar reads:</p>
<blockquote cite="ftp://ftp.vim.org/pub/vim/patches/6.3/6.3.045">
- <p>Problem: Unusual characters in an option value may cause
+ <p>Problem: Unusual characters in an option value may
+ cause
unexpected behavior, especially for a modeline. (Ciaran
McCreesh)</p>
<p>Solution: Don't allow setting termcap options or
'printdevice' or 'titleold' in a modeline. Don't list
- options for "termcap" and "all" in a modeline. Don't allow
- unusual characters in 'filetype', 'syntax', 'backupext',
- 'keymap', 'patchmode' and 'langmenu'.</p>
- </blockquote>
- <p><strong>Note:</strong> It is generally recommended that VIM
- users use <code>set nomodeline</code> in
- <code>~/.vimrc</code> to avoid the possibility of trojaned
- text files.</p>
- </body>
- </description>
- <references>
+ options for "termcap" and "all" in a modeline. Don't
+ allow unusual characters in 'filetype', 'syntax',
+ 'backupext', 'keymap', 'patchmode' and 'langmenu'.</p>
+ </blockquote> <p><strong>Note:</strong> It is generally
+ recommended that VIM
+ users use <code>set nomodeline</code> in <code>~/.vimrc</code>
+ to avoid the possibility of trojaned text files.</p>
+ </body>
+ </description> <references>
<cvename>CVE-2004-1138</cvename>
<url>ftp://ftp.vim.org/pub/vim/patches/6.3/6.3.045</url>
<mlist>http://groups.yahoo.com/group/vimdev/message/38084</mlist>
- </references>
- <dates>
- <discovery>2004-12-09</discovery>
- <entry>2005-01-06</entry>
+ </references> <dates>
+ <discovery>2004-12-09</discovery> <entry>2005-01-06</entry>
<modified>2005-01-13</modified>
</dates>
</vuln>
<vuln vid="58fc2752-5f74-11d9-a9e7-0001020eed82">
- <topic>pcal -- buffer overflow vulnerabilities</topic>
- <affects>
+ <topic>pcal -- buffer overflow vulnerabilities</topic> <affects>
<package>
- <name>pcal</name>
- <range><lt>4.8.0</lt></range>
+ <name>pcal</name> <range><lt>4.8.0</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Danny Lungstrom has found two buffer overflow
vulnerabilities in pcal which can lead to execution of
arbitrary code by making a user run pcal on a specially
crafted calendar file.</p>
</body>
- </description>
- <references>
- <cvename>CVE-2004-1289</cvename>
- <bid>12035</bid>
- <bid>12036</bid>
- <mlist msgid="20041215083219.56092.qmail@cr.yp.to">http://securesoftware.list.cr.yp.to/archive/0/46</mlist>
- </references>
- <dates>
- <discovery>2004-12-15</discovery>
- <entry>2005-01-06</entry>
+ </description> <references>
+ <cvename>CVE-2004-1289</cvename> <bid>12035</bid> <bid>12036</bid>
+ <mlist
+ msgid="20041215083219.56092.qmail@cr.yp.to">http://securesoftware.list.cr.yp.to/archive/0/46</mlist>
+ </references> <dates>
+ <discovery>2004-12-15</discovery> <entry>2005-01-06</entry>
</dates>
</vuln>
@@ -11350,52 +9424,40 @@ http_access deny Gopher</pre>
<topic>exim -- two buffer overflow vulnerabilities</topic>
<affects>
<package>
- <name>exim</name>
- <name>exim-ldap</name>
- <name>exim-ldap2</name>
- <name>exim-mysql</name>
- <name>exim-postgresql</name>
- <name>exim-sa-exim</name>
- <range><lt>4.43+28_1</lt></range>
+ <name>exim</name> <name>exim-ldap</name> <name>exim-ldap2</name>
+ <name>exim-mysql</name> <name>exim-postgresql</name>
+ <name>exim-sa-exim</name> <range><lt>4.43+28_1</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>1. The function host_aton() can overflow a buffer
- if it is presented with an illegal IPv6 address
- that has more than 8 components.</p>
+ if it is presented with an illegal IPv6 address that has
+ more than 8 components.</p>
<p>2. The second report described a buffer overflow
- in the function spa_base64_to_bits(), which is part
- of the code for SPA authentication.</p>
- </body>
- </description>
- <references>
- <mlist msgid="Pine.SOC.4.61.0501041452540.1114@draco.cus.cam.ac.uk">http://www.exim.org/mail-archives/exim-announce/2005/msg00000.html</mlist>
- <mlist msgid="1CE07882ECEE894CA2D5A89B8DEBC4011CFDE5@porgy.admin.idefense.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110573573800377</mlist>
- <cvename>CVE-2005-0021</cvename>
- <cvename>CVE-2005-0022</cvename>
- <bid>12185</bid>
- <bid>12188</bid>
- <bid>12268</bid>
- </references>
- <dates>
- <discovery>2005-01-05</discovery>
- <entry>2005-01-05</entry>
+ in the function spa_base64_to_bits(), which is part of
+ the code for SPA authentication.</p>
+ </body>
+ </description> <references>
+ <mlist
+ msgid="Pine.SOC.4.61.0501041452540.1114@draco.cus.cam.ac.uk">http://www.exim.org/mail-archives/exim-announce/2005/msg00000.html</mlist>
+ <mlist
+ msgid="1CE07882ECEE894CA2D5A89B8DEBC4011CFDE5@porgy.admin.idefense.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110573573800377</mlist>
+ <cvename>CVE-2005-0021</cvename> <cvename>CVE-2005-0022</cvename>
+ <bid>12185</bid> <bid>12188</bid> <bid>12268</bid>
+ </references> <dates>
+ <discovery>2005-01-05</discovery> <entry>2005-01-05</entry>
<modified>2005-01-18</modified>
</dates>
</vuln>
<vuln vid="877e918e-5362-11d9-96d4-00065be4b5b6">
- <topic>mpg123 -- playlist processing buffer overflow vulnerability</topic>
- <affects>
+ <topic>mpg123 -- playlist processing buffer overflow
+ vulnerability</topic> <affects>
<package>
- <name>mpg123</name>
- <name>mpg123-nas</name>
- <name>mpg123-esound</name>
- <range><le>0.59r_15</le></range>
+ <name>mpg123</name> <name>mpg123-nas</name>
+ <name>mpg123-esound</name> <range><le>0.59r_15</le></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A buffer overflow vulnerability exists in the playlist
processing of mpg123. A specially crafted playlist entry
@@ -11405,54 +9467,46 @@ http_access deny Gopher</pre>
vulnerability, was released by the bug finder and may be
used as a template by attackers.</p>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2004-1284</cvename>
<url>http://tigger.uic.edu/~jlongs2/holes/mpg123.txt</url>
<url>http://secunia.com/advisories/13511/</url>
- <url>http://xforce.iss.net/xforce/xfdb/18626</url>
- <bid>11958</bid>
- <mlist msgid="653D74053BA6F54A81ED83DCF969DF08CFA2AA@pivxes1.pivx.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110321888413132</mlist>
- </references>
- <dates>
- <discovery>2004-12-15</discovery>
- <entry>2005-01-03</entry>
+ <url>http://xforce.iss.net/xforce/xfdb/18626</url> <bid>11958</bid>
+ <mlist
+ msgid="653D74053BA6F54A81ED83DCF969DF08CFA2AA@pivxes1.pivx.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110321888413132</mlist>
+ </references> <dates>
+ <discovery>2004-12-15</discovery> <entry>2005-01-03</entry>
<modified>2005-01-13</modified>
</dates>
</vuln>
<vuln vid="bd579366-5290-11d9-ac20-00065be4b5b6">
- <topic>greed -- insecure GRX file processing</topic>
- <affects>
+ <topic>greed -- insecure GRX file processing</topic> <affects>
<package>
- <name>greed</name>
- <range><le>0.81p</le></range>
+ <name>greed</name> <range><le>0.81p</le></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>A buffer overflow vulnerability has been detected in the greed
- URL handling code. This bug can especially be a problem when greed is
- used to process GRX (GetRight) files that originate from untrusted
- sources.</p>
- <p>The bug finder, Manigandan Radhakrishnan, gave the following description:</p>
+ <p>A buffer overflow vulnerability has been detected in the
+ greed URL handling code. This bug can especially be a problem
+ when greed is used to process GRX (GetRight) files that
+ originate from untrusted sources.</p> <p>The bug finder,
+ Manigandan Radhakrishnan, gave the following description:</p>
<blockquote cite='http://tigger.uic.edu/~jlongs2/holes/greed.txt'>
- <p>Here are the bugs. First, in main.c, DownloadLoop() uses strcat()
- to copy an input filename to the end of a 128-byte COMMAND array.
- Second, DownloadLoop() passes the input filename to system() without
- checking for special characters such as semicolons.</p></blockquote>
- </body>
- </description>
- <references>
- <cvename>CVE-2004-1273</cvename>
- <cvename>CVE-2004-1274</cvename>
+ <p>Here are the bugs. First, in main.c, DownloadLoop()
+ uses strcat()
+ to copy an input filename to the end of a 128-byte
+ COMMAND array. Second, DownloadLoop() passes the input
+ filename to system() without checking for special
+ characters such as semicolons.</p></blockquote>
+ </body>
+ </description> <references>
+ <cvename>CVE-2004-1273</cvename> <cvename>CVE-2004-1274</cvename>
<url>http://tigger.uic.edu/~jlongs2/holes/greed.txt</url>
- <url>http://secunia.com/advisories/13534/</url>
- <mlist msgid="653D74053BA6F54A81ED83DCF969DF08CFA2AA@pivxes1.pivx.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110321888413132</mlist>
- </references>
- <dates>
- <discovery>2004-12-15</discovery>
- <entry>2005-01-03</entry>
+ <url>http://secunia.com/advisories/13534/</url> <mlist
+ msgid="653D74053BA6F54A81ED83DCF969DF08CFA2AA@pivxes1.pivx.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110321888413132</mlist>
+ </references> <dates>
+ <discovery>2004-12-15</discovery> <entry>2005-01-03</entry>
<modified>2005-01-13</modified>
</dates>
</vuln>
@@ -11461,52 +9515,47 @@ http_access deny Gopher</pre>
<topic>golddig -- local buffer overflow vulnerabilities</topic>
<affects>
<package>
- <name>golddig</name>
- <range><le>2.0</le></range>
+ <name>golddig</name> <range><le>2.0</le></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>Two buffer overflow vulnerabilities where detected. Both issues can
- be used by local users to gain group games privileges on affected systems.</p>
- <p>The first overflow exists in the map name handling and can be triggered
- when a very long name is given to the program during command-line execution</p>
- <p>The second overflow exists in the username processing while writing
- the players score to disk. Excessivly long usernames, set via the USER environment
- variable, are stored without any length checks in a memory buffer.</p>
+ <p>Two buffer overflow vulnerabilities where detected. Both
+ issues can be used by local users to gain group games
+ privileges on affected systems.</p> <p>The first overflow
+ exists in the map name handling and can be triggered when
+ a very long name is given to the program during command-line
+ execution</p>
+ <p>The second overflow exists in the username processing
+ while writing
+ the players score to disk. Excessivly long usernames, set
+ via the USER environment variable, are stored without any
+ length checks in a memory buffer.</p>
</body>
- </description>
- <references>
- <cvename>CVE-2005-0121</cvename>
- <mlist msgid="200412021055.iB2AtweU067125@repoman.freebsd.org">http://docs.FreeBSD.org/cgi/mid.cgi?200412021055.iB2AtweU067125</mlist>
- </references>
- <dates>
- <discovery>2004-11-11</discovery>
- <entry>2005-01-03</entry>
+ </description> <references>
+ <cvename>CVE-2005-0121</cvename> <mlist
+ msgid="200412021055.iB2AtweU067125@repoman.freebsd.org">http://docs.FreeBSD.org/cgi/mid.cgi?200412021055.iB2AtweU067125</mlist>
+ </references> <dates>
+ <discovery>2004-11-11</discovery> <entry>2005-01-03</entry>
<modified>2005-01-19</modified>
</dates>
</vuln>
<vuln vid="927743d4-5ca9-11d9-a9e7-0001020eed82">
- <topic>up-imapproxy -- multiple vulnerabilities</topic>
- <affects>
+ <topic>up-imapproxy -- multiple vulnerabilities</topic> <affects>
<package>
- <name>up-imapproxy</name>
- <range><lt>1.2.2</lt></range>
+ <name>up-imapproxy</name> <range><lt>1.2.2</lt></range>
+ </package> <package>
+ <name>pop3proxy</name> <range><le>1.1</le></range>
</package>
- <package>
- <name>pop3proxy</name>
- <range><le>1.1</le></range>
- </package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>Timo Sirainen reports:</p>
- <blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=109995749510773">
+ <p>Timo Sirainen reports:</p> <blockquote
+ cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=109995749510773">
<p>There are various bugs in up-imapproxy which can crash
- it. Since up-imapproxy runs in a single process with each
- connection handled in a separate thread, any crash kills
- all the connections and stops listening for new ones.</p>
+ it. Since up-imapproxy runs in a single process with
+ each connection handled in a separate thread, any crash
+ kills all the connections and stops listening for new
+ ones.</p>
<p>In 64bit systems it might be possible to make it leak
data (mails, passwords, ..) from other connections to
attacker's connection. However I don't think up-imapproxy
@@ -11514,110 +9563,90 @@ http_access deny Gopher</pre>
theoretical problem.</p>
</blockquote>
</body>
- </description>
- <references>
- <cvename>CVE-2004-1035</cvename>
- <bid>11630</bid>
- <mlist msgid="1099851138.3716.3.camel@hurina">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=109995749510773</mlist>
- </references>
- <dates>
- <discovery>2004-11-17</discovery>
- <entry>2005-01-02</entry>
+ </description> <references>
+ <cvename>CVE-2004-1035</cvename> <bid>11630</bid> <mlist
+ msgid="1099851138.3716.3.camel@hurina">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=109995749510773</mlist>
+ </references> <dates>
+ <discovery>2004-11-17</discovery> <entry>2005-01-02</entry>
<modified>2005-01-13</modified>
</dates>
</vuln>
<vuln vid="832e9d75-5bfc-11d9-a9e7-0001020eed82">
- <topic>kdelibs3 -- konqueror FTP command injection vulnerability</topic>
- <affects>
+ <topic>kdelibs3 -- konqueror FTP command injection
+ vulnerability</topic> <affects>
<package>
- <name>ja-kdelibs</name>
- <name>kdelibs</name>
+ <name>ja-kdelibs</name> <name>kdelibs</name>
<range><lt>3.3.2_2</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Albert Puigsech Galicia reports that Konqueror (more
specifically kio_ftp) and Microsoft Internet Explorer are
vulnerable to a FTP command injection vulnerability which
can be exploited by tricking an user into clicking a
specially crafted FTP URI.</p>
- <p>It is also reported by Ian Gulliver and Emanuele Balla that
+ <p>It is also reported by Ian Gulliver and Emanuele Balla
+ that
this vulnerability can be used to tricking a client into
sending out emails without user interaction.</p>
</body>
- </description>
- <references>
- <bid>11827</bid>
- <cvename>CVE-2004-1165</cvename>
- <mlist msgid="200412051011.54045.ripe@7a69ezine.org">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110245752232681</mlist>
- <mlist msgid="20041223235620.GA2846@penguinhosting.net">http://marc.theaimsgroup.com/?l=full-disclosure&amp;m=110387390226693</mlist>
- <mlist msgid="20041224142506.GB12939@penguinhosting.net">http://marc.theaimsgroup.com/?l=full-disclosure&amp;m=110390734925183</mlist>
+ </description> <references>
+ <bid>11827</bid> <cvename>CVE-2004-1165</cvename> <mlist
+ msgid="200412051011.54045.ripe@7a69ezine.org">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110245752232681</mlist>
+ <mlist
+ msgid="20041223235620.GA2846@penguinhosting.net">http://marc.theaimsgroup.com/?l=full-disclosure&amp;m=110387390226693</mlist>
+ <mlist
+ msgid="20041224142506.GB12939@penguinhosting.net">http://marc.theaimsgroup.com/?l=full-disclosure&amp;m=110390734925183</mlist>
<url>http://www.kde.org/info/security/advisory-20050101-1.txt</url>
- </references>
- <dates>
- <discovery>2004-12-01</discovery>
- <entry>2005-01-01</entry>
+ </references> <dates>
+ <discovery>2004-12-01</discovery> <entry>2005-01-01</entry>
<modified>2005-01-04</modified>
</dates>
</vuln>
<vuln vid="9168253c-5a6d-11d9-a9e7-0001020eed82">
- <topic>a2ps -- insecure temporary file creation</topic>
- <affects>
+ <topic>a2ps -- insecure temporary file creation</topic> <affects>
<package>
- <name>a2ps-a4</name>
- <name>a2ps-letter</name>
- <name>a2ps-letterdj</name>
- <range><lt>4.13b_3</lt></range>
+ <name>a2ps-a4</name> <name>a2ps-letter</name>
+ <name>a2ps-letterdj</name> <range><lt>4.13b_3</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Secunia Security Advisory reports that Javier
- Fernández-Sanguino Peña has found temporary file
- creation vulnerabilities in the fixps and psmandup scripts
- which are part of a2ps. These vulnerabilities could lead to
+ Fernández-Sanguino Peña has found temporary file creation
+ vulnerabilities in the fixps and psmandup scripts which
+ are part of a2ps. These vulnerabilities could lead to
an attacker overwriting arbitrary files with the credentials
of the user running the vulnerable scripts.</p>
</body>
- </description>
- <references>
- <cvename>CVE-2004-1377</cvename>
- <bid>12108</bid>
- <bid>12109</bid>
+ </description> <references>
+ <cvename>CVE-2004-1377</cvename> <bid>12108</bid> <bid>12109</bid>
<url>http://secunia.com/advisories/13641/</url>
- </references>
- <dates>
- <discovery>2004-12-27</discovery>
- <entry>2004-12-30</entry>
+ </references> <dates>
+ <discovery>2004-12-27</discovery> <entry>2004-12-30</entry>
<modified>2005-01-19</modified>
</dates>
</vuln>
<vuln vid="64c8cc2a-59b1-11d9-8a99-000c6e8f12ef">
- <topic>libxine -- buffer-overflow vulnerability in aiff support</topic>
- <affects>
+ <topic>libxine -- buffer-overflow vulnerability in aiff
+ support</topic> <affects>
<package>
- <name>libxine</name>
- <range><le>1.0.r5_3</le></range>
+ <name>libxine</name> <range><le>1.0.r5_3</le></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>Due to a buffer overflow in the open_aiff_file function in
+ <p>Due to a buffer overflow in the open_aiff_file function
+ in
demux_aiff.c, a remote attacker is able to execute arbitrary
code via a modified AIFF file.</p></body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2004-1300</cvename>
<url>http://tigger.uic.edu/~jlongs2/holes/xine-lib.txt</url>
<url>http://xinehq.de/index.php/security/XSA-2004-7</url>
- </references>
- <dates>
- <discovery>2004-12-15</discovery>
- <entry>2004-12-29</entry>
+ </references> <dates>
+ <discovery>2004-12-15</discovery> <entry>2004-12-29</entry>
<modified>2005-01-12</modified>
</dates>
</vuln>
@@ -11626,41 +9655,40 @@ http_access deny Gopher</pre>
<topic>jabberd -- denial-of-service vulnerability</topic>
<affects>
<package>
- <name>jabber</name>
- <range><lt>1.4.3.1</lt></range>
+ <name>jabber</name> <range><lt>1.4.3.1</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>José Antonio Calvo discovered a bug in the Jabber 1.x server.
+ <p>José Antonio Calvo discovered a bug in the Jabber 1.x
+ server.
According to Matthias Wimmer:</p>
- <blockquote cite="http://devel.amessage.info/jabberd14/README.html">
+ <blockquote
+ cite="http://devel.amessage.info/jabberd14/README.html">
<p>Without this patch, it is possible to remotly crash
- jabberd14, if there is access to one of the following types
- of network sockets:</p>
+ jabberd14, if there is access to one of the following
+ types of network sockets:</p>
<ul>
- <li>Socket accepting client connections</li>
- <li>Socket accepting connections from other servers</li>
- <li>Socket connecting to an other Jabber server</li>
- <li>Socket accepting connections from server components</li>
+ <li>Socket accepting client connections</li> <li>Socket
+ accepting connections from other servers</li> <li>Socket
+ connecting to an other Jabber server</li> <li>Socket
+ accepting connections from server components</li>
<li>Socket connecting to server components</li>
- </ul>
- <p>This is any socket on which the jabberd server parses
+ </ul> <p>This is any socket on which the jabberd server
+ parses
XML!</p>
- <p>The problem existed in the included expat XML parser code.
+ <p>The problem existed in the included expat XML parser
+ code.
This patch removes the included expat code from jabberd14
- and links jabberd against an installed version of expat.</p>
+ and links jabberd against an installed version of
+ expat.</p>
</blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2004-1378</cvename>
<url>http://devel.amessage.info/jabberd14/README.html</url>
<url>http://mail.jabber.org/pipermail/jabberd/2004-September/002004.html</url>
- </references>
- <dates>
- <discovery>2004-09-19</discovery>
- <entry>2004-12-26</entry>
+ </references> <dates>
+ <discovery>2004-09-19</discovery> <entry>2004-12-26</entry>
<modified>2005-01-19</modified>
</dates>
</vuln>
@@ -11669,59 +9697,55 @@ http_access deny Gopher</pre>
<topic>squid -- confusing results on empty acl declarations</topic>
<affects>
<package>
- <name>squid</name>
- <range><lt>2.5.7_5</lt></range>
+ <name>squid</name> <range><lt>2.5.7_5</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Applying an empty ACL list results in unexpected behavior:
anything will match an empty ACL list. For example,</p>
- <blockquote cite="http://www.squid-cache.org/bugs/show_bug.cgi?id=1166">
- <p>The meaning of the configuration gets very confusing when
+ <blockquote
+ cite="http://www.squid-cache.org/bugs/show_bug.cgi?id=1166">
+ <p>The meaning of the configuration gets very confusing
+ when
we encounter empty ACLs such as</p>
- <p><code>acl something src "/path/to/empty_file.txt"<br />
+ <p><code>acl something src "/path/to/empty_file.txt"<br
+ />
http_access allow something somewhere</code></p>
- <p>gets parsed (with warnings) as</p>
- <p><code>http_access allow somwhere</code></p>
- <p>And similarily if you are using proxy_auth acls without
+ <p>gets parsed (with warnings) as</p> <p><code>http_access
+ allow somwhere</code></p> <p>And similarily if you are
+ using proxy_auth acls without
having any auth schemes defined.</p>
</blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2005-0194</cvename>
<url>http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-empty_acls</url>
<url>http://www.squid-cache.org/bugs/show_bug.cgi?id=1166</url>
- </references>
- <dates>
- <discovery>2004-12-21</discovery>
- <entry>2004-12-23</entry>
+ </references> <dates>
+ <discovery>2004-12-21</discovery> <entry>2004-12-23</entry>
<modified>2005-02-08</modified>
</dates>
</vuln>
<vuln vid="efa1344b-5477-11d9-a9e7-0001020eed82">
- <topic>ethereal -- multiple vulnerabilities</topic>
- <affects>
+ <topic>ethereal -- multiple vulnerabilities</topic> <affects>
<package>
- <name>ethereal</name>
- <name>ethereal-lite</name>
- <name>tethereal</name>
- <name>tethereal-lite</name>
+ <name>ethereal</name> <name>ethereal-lite</name>
+ <name>tethereal</name> <name>tethereal-lite</name>
<range><lt>0.10.8</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>An Ethreal Security Advisories reports:</p>
- <blockquote cite="http://www.ethereal.com/appnotes/enpa-sa-00016.html">
+ <p>An Ethreal Security Advisories reports:</p> <blockquote
+ cite="http://www.ethereal.com/appnotes/enpa-sa-00016.html">
<p>Issues have been discovered in the following protocol
dissectors:</p>
<ul>
- <li>Matthew Bing discovered a bug in DICOM dissection that
+ <li>Matthew Bing discovered a bug in DICOM dissection
+ that
could make Ethereal crash.</li>
- <li>An invalid RTP timestamp could make Ethereal hang and
+ <li>An invalid RTP timestamp could make Ethereal hang
+ and
create a large temporary file, possibly filling
available disk space.</li>
<li>The HTTP dissector could access previously-freed
@@ -11729,117 +9753,89 @@ http_access deny Gopher</pre>
<li>Brian Caswell discovered that an improperly formatted
SMB packet could make Ethereal hang, maximizing CPU
utilization.</li>
- </ul>
- <p>Impact: It may be possible to make Ethereal crash or run
+ </ul> <p>Impact: It may be possible to make Ethereal crash
+ or run
arbitrary code by injecting a purposefully malformed
- packet onto the wire or by convincing someone to read a
- malformed packet trace file.</p>
+ packet onto the wire or by convincing someone to read
+ a malformed packet trace file.</p>
</blockquote>
</body>
- </description>
- <references>
- <cvename>CVE-2004-1139</cvename>
- <cvename>CVE-2004-1140</cvename>
- <cvename>CVE-2004-1141</cvename>
- <cvename>CVE-2004-1142</cvename>
+ </description> <references>
+ <cvename>CVE-2004-1139</cvename> <cvename>CVE-2004-1140</cvename>
+ <cvename>CVE-2004-1141</cvename> <cvename>CVE-2004-1142</cvename>
<url>http://www.ethereal.com/appnotes/enpa-sa-00016.html</url>
- </references>
- <dates>
- <discovery>2004-12-14</discovery>
- <entry>2004-12-23</entry>
+ </references> <dates>
+ <discovery>2004-12-14</discovery> <entry>2004-12-23</entry>
</dates>
</vuln>
<vuln vid="e3e266e9-5473-11d9-a9e7-0001020eed82">
- <topic>xpdf -- buffer overflow vulnerability</topic>
- <affects>
- <package>
- <name>xpdf</name>
- <range><lt>3.00_5</lt></range>
- </package>
- <package>
- <name>kdegraphics</name>
- <range><lt>3.3.2_1</lt></range>
- </package>
- <package>
- <name>gpdf</name>
- <range><le>2.8.1</le></range>
- </package>
- <package>
- <name>teTeX-base</name>
- <range><le>2.0.2_6</le></range>
- </package>
- <package>
- <name>cups-base</name>
- <range><le>1.1.22.0</le></range>
- </package>
- <package>
- <name>koffice</name>
- <range><le>1.3.5,1</le></range>
- </package>
- <package>
- <name>pdftohtml</name>
- <range><lt>0.36_1</lt></range>
- </package>
- </affects>
- <description>
- <body xmlns="http://www.w3.org/1999/xhtml">
- <p>An iDEFENSE Security Advisory reports:</p>
- <blockquote cite="http://www.idefense.com/application/poi/display?id=172&amp;type=vulnerabilities">
- <p>Remote exploitation of a buffer overflow vulnerability in
+ <topic>xpdf -- buffer overflow vulnerability</topic> <affects>
+ <package>
+ <name>xpdf</name> <range><lt>3.00_5</lt></range>
+ </package> <package>
+ <name>kdegraphics</name> <range><lt>3.3.2_1</lt></range>
+ </package> <package>
+ <name>gpdf</name> <range><le>2.8.1</le></range>
+ </package> <package>
+ <name>teTeX-base</name> <range><le>2.0.2_6</le></range>
+ </package> <package>
+ <name>cups-base</name> <range><le>1.1.22.0</le></range>
+ </package> <package>
+ <name>koffice</name> <range><le>1.3.5,1</le></range>
+ </package> <package>
+ <name>pdftohtml</name> <range><lt>0.36_1</lt></range>
+ </package>
+ </affects> <description>
+ <body xmlns="http://www.w3.org/1999/xhtml">
+ <p>An iDEFENSE Security Advisory reports:</p> <blockquote
+ cite="http://www.idefense.com/application/poi/display?id=172&amp;type=vulnerabilities">
+ <p>Remote exploitation of a buffer overflow vulnerability
+ in
the xpdf PDF viewer, as included in multiple Linux
distributions, could allow attackers to execute arbitrary
code as the user viewing a PDF file. The offending code
- can be found in the Gfx::doImage() function in the source
- file xpdf/Gfx.cc.</p>
+ can be found in the Gfx::doImage() function in the
+ source file xpdf/Gfx.cc.</p>
</blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2004-1125</cvename>
<url>http://www.idefense.com/application/poi/display?id=172&amp;type=vulnerabilities</url>
- </references>
- <dates>
- <discovery>2004-11-23</discovery>
- <entry>2004-12-23</entry>
+ </references> <dates>
+ <discovery>2004-11-23</discovery> <entry>2004-12-23</entry>
<modified>2005-01-13</modified>
</dates>
</vuln>
<vuln vid="28e93883-539f-11d9-a9e7-0001020eed82">
- <topic>acroread5 -- mailListIsPdf() buffer overflow vulnerability</topic>
- <affects>
+ <topic>acroread5 -- mailListIsPdf() buffer overflow
+ vulnerability</topic> <affects>
<package>
- <name>acroread</name>
- <name>acroread4</name>
- <name>acroread5</name>
+ <name>acroread</name> <name>acroread4</name> <name>acroread5</name>
<range><lt>5.10</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>An iDEFENSE Security Advisory reports:</p>
- <blockquote cite="http://www.idefense.com/application/poi/display?id=161&amp;type=vulnerabilities">
- <p>Remote exploitation of a buffer overflow in version 5.09
+ <p>An iDEFENSE Security Advisory reports:</p> <blockquote
+ cite="http://www.idefense.com/application/poi/display?id=161&amp;type=vulnerabilities">
+ <p>Remote exploitation of a buffer overflow in version
+ 5.09
of Adobe Acrobat Reader for Unix could allow for execution
of arbitrary code.</p>
<p>The vulnerability specifically exists in a the function
- mailListIsPdf(). This function checks if the input file
- is an email message containing a PDF. It unsafely copies
- user supplied data using strcat into a fixed sized
- buffer.</p>
+ mailListIsPdf(). This function checks if the input
+ file is an email message containing a PDF. It unsafely
+ copies user supplied data using strcat into a fixed
+ sized buffer.</p>
</blockquote>
</body>
- </description>
- <references>
- <cvename>CVE-2004-1152</cvename>
- <certvu>253024</certvu>
+ </description> <references>
+ <cvename>CVE-2004-1152</cvename> <certvu>253024</certvu>
<url>http://www.adobe.com/support/techdocs/331153.html</url>
<url>http://www.idefense.com/application/poi/display?id=161&amp;type=vulnerabilities</url>
- </references>
- <dates>
- <discovery>2004-10-14</discovery>
- <entry>2004-12-21</entry>
+ </references> <dates>
+ <discovery>2004-10-14</discovery> <entry>2004-12-21</entry>
<modified>2005-01-06</modified>
</dates>
</vuln>
@@ -11848,50 +9844,38 @@ http_access deny Gopher</pre>
<topic>ecartis -- unauthorised access to admin interface</topic>
<affects>
<package>
- <name>ecartis</name>
- <range><lt>1.0.0.s20031228_2,1</lt></range>
+ <name>ecartis</name> <range><lt>1.0.0.s20031228_2,1</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>A Debian security advisory reports:</p>
- <blockquote cite="http://www.debian.org/security/2004/dsa-572">
+ <p>A Debian security advisory reports:</p> <blockquote
+ cite="http://www.debian.org/security/2004/dsa-572">
<p>A problem has been discovered in ecartis, a mailing-list
- manager, which allows an attacker in the same domain as
- the list admin to gain administrator privileges and alter
- list settings.</p>
+ manager, which allows an attacker in the same domain
+ as the list admin to gain administrator privileges and
+ alter list settings.</p>
</blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2004-0913</cvename>
<url>http://www.debian.org/security/2004/dsa-572</url>
<url>http://secunia.com/advisories/12918/</url>
- </references>
- <dates>
- <discovery>2004-10-12</discovery>
- <entry>2004-12-21</entry>
+ </references> <dates>
+ <discovery>2004-10-12</discovery> <entry>2004-12-21</entry>
</dates>
</vuln>
<vuln vid="85d76f02-5380-11d9-a9e7-0001020eed82">
- <topic>mplayer -- multiple vulnerabilities</topic>
- <affects>
+ <topic>mplayer -- multiple vulnerabilities</topic> <affects>
<package>
- <name>mplayer</name>
- <name>mplayer-gtk</name>
- <name>mplayer-gtk2</name>
- <name>mplayer-esound</name>
- <name>mplayer-gtk-esound</name>
- <name>mplayer-gtk2-esound</name>
+ <name>mplayer</name> <name>mplayer-gtk</name>
+ <name>mplayer-gtk2</name> <name>mplayer-esound</name>
+ <name>mplayer-gtk-esound</name> <name>mplayer-gtk2-esound</name>
<range><lt>0.99.5_5</lt></range>
+ </package> <package>
+ <name>libxine</name> <range><le>1.0.r5_3</le></range>
</package>
- <package>
- <name>libxine</name>
- <range><le>1.0.r5_3</le></range>
- </package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>iDEFENSE and the MPlayer Team have found multiple
vulnerabilities in MPlayer:</p>
@@ -11901,164 +9885,135 @@ http_access deny Gopher</pre>
<li>Multiple buffer overflows in BMP demuxer</li>
<li>Potential heap overflow in pnm streaming code</li>
<li>Potential buffer overflow in mp3lib</li>
- </ul>
- <p>These vulnerabilities could allow a remote attacker to
+ </ul> <p>These vulnerabilities could allow a remote attacker
+ to
execute arbitrary code as the user running MPlayer. The
problem in the pnm streaming code also affects xine.</p>
</body>
- </description>
- <references>
- <cvename>CVE-2004-1187</cvename>
- <cvename>CVE-2004-1188</cvename>
+ </description> <references>
+ <cvename>CVE-2004-1187</cvename> <cvename>CVE-2004-1188</cvename>
<url>http://mplayerhq.hu/homepage/design7/news.html#mplayer10pre5try2</url>
- <mlist msgid="IDSERV04yz5b6KZmcK80000000c@exchange.idefense.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110322526210300</mlist>
+ <mlist
+ msgid="IDSERV04yz5b6KZmcK80000000c@exchange.idefense.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110322526210300</mlist>
<url>http://www.idefense.com/application/poi/display?id=166</url>
- <mlist msgid="IDSERV04FVjCRGryWtI0000000f@exchange.idefense.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110322829807443</mlist>
+ <mlist
+ msgid="IDSERV04FVjCRGryWtI0000000f@exchange.idefense.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110322829807443</mlist>
<url>http://www.idefense.com/application/poi/display?id=167</url>
- <mlist msgid="IDSERV046beUzmRf6Ci00000012@exchange.idefense.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110323022605345</mlist>
+ <mlist
+ msgid="IDSERV046beUzmRf6Ci00000012@exchange.idefense.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110323022605345</mlist>
<url>http://www.idefense.com/application/poi/display?id=168</url>
<url>http://xinehq.de/index.php/security/XSA-2004-6</url>
- </references>
- <dates>
- <discovery>2004-12-10</discovery>
- <entry>2004-12-21</entry>
+ </references> <dates>
+ <discovery>2004-12-10</discovery> <entry>2004-12-21</entry>
<modified>2005-01-12</modified>
</dates>
</vuln>
<vuln vid="0bb7677d-52f3-11d9-a9e7-0001020eed82">
- <topic>krb5 -- heap buffer overflow vulnerability in libkadm5srv</topic>
- <affects>
+ <topic>krb5 -- heap buffer overflow vulnerability in
+ libkadm5srv</topic> <affects>
<package>
- <name>krb5</name>
- <name>krb5-beta</name>
+ <name>krb5</name> <name>krb5-beta</name>
<range><lt>1.3.6</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>A MIT krb5 Security Advisory reports:</p>
- <blockquote cite="http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2004-004-pwhist.txt">
+ <p>A MIT krb5 Security Advisory reports:</p> <blockquote
+ cite="http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2004-004-pwhist.txt">
<p>The MIT Kerberos 5 administration library (libkadm5srv)
contains a heap buffer overflow in password history
handling code which could be exploited to execute
- arbitrary code on a Key Distribution Center (KDC)
- host. The overflow occurs during a password change of a
+ arbitrary code on a Key Distribution Center (KDC) host.
+ The overflow occurs during a password change of a
principal with a certain password history state. An
administrator must have performed a certain password
policy change in order to create the vulnerable state.</p>
<p>An authenticated user, not necessarily one with
- administrative privileges, could execute arbitrary code on
- the KDC host, compromising an entire Kerberos realm.</p>
+ administrative privileges, could execute arbitrary code
+ on the KDC host, compromising an entire Kerberos
+ realm.</p>
</blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2004-1189</cvename>
<url>http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2004-004-pwhist.txt</url>
- </references>
- <dates>
- <discovery>2004-12-06</discovery>
- <entry>2004-12-21</entry>
+ </references> <dates>
+ <discovery>2004-12-06</discovery> <entry>2004-12-21</entry>
</dates>
</vuln>
<vuln vid="3b3676be-52e1-11d9-a9e7-0001020eed82">
- <topic>samba -- integer overflow vulnerability</topic>
- <affects>
+ <topic>samba -- integer overflow vulnerability</topic> <affects>
<package>
- <name>samba</name>
- <range><lt>3.0.10,1</lt></range>
- </package>
- <package>
- <name>ja-samba</name>
- <range><lt>2.2.12.j1.0beta1_2</lt></range>
+ <name>samba</name> <range><lt>3.0.10,1</lt></range>
+ </package> <package>
+ <name>ja-samba</name> <range><lt>2.2.12.j1.0beta1_2</lt></range>
<range><gt>3.*</gt><lt>3.0.10,1</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>Greg MacManus, iDEFENSE Labs reports:</p>
- <blockquote cite="http://www.samba.org/samba/security/CAN-2004-1154.html">
+ <p>Greg MacManus, iDEFENSE Labs reports:</p> <blockquote
+ cite="http://www.samba.org/samba/security/CAN-2004-1154.html">
<p>Remote exploitation of an integer overflow vulnerability
in the smbd daemon included in Samba 2.0.x, Samba 2.2.x,
and Samba 3.0.x prior to and including 3.0.9 could allow
- an attacker to cause controllable heap corruption, leading
- to execution of arbitrary commands with root
+ an attacker to cause controllable heap corruption,
+ leading to execution of arbitrary commands with root
privileges.</p>
- <p>Successful remote exploitation allows an attacker to gain
+ <p>Successful remote exploitation allows an attacker to
+ gain
root privileges on a vulnerable system. In order to
exploit this vulnerability an attacker must possess
credentials that allow access to a share on the Samba
- server. Unsuccessful exploitation attempts will cause the
- process serving the request to crash with signal 11, and
- may leave evidence of an attack in logs.</p>
+ server. Unsuccessful exploitation attempts will cause
+ the process serving the request to crash with signal
+ 11, and may leave evidence of an attack in logs.</p>
</blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2004-1154</cvename>
<url>http://www.idefense.com/application/poi/display?id=165&amp;type=vulnerabilities</url>
<url>http://www.samba.org/samba/security/CAN-2004-1154.html</url>
- </references>
- <dates>
- <discovery>2004-12-02</discovery>
- <entry>2004-12-21</entry>
+ </references> <dates>
+ <discovery>2004-12-02</discovery> <entry>2004-12-21</entry>
<modified>2005-05-29</modified>
</dates>
</vuln>
<vuln vid="d47e9d19-5016-11d9-9b5f-0050569f0001">
- <topic>php -- multiple vulnerabilities</topic>
- <affects>
- <package>
- <name>mod_php4-twig</name>
- <name>php4-cgi</name>
- <name>php4-cli</name>
- <name>php4-dtc</name>
- <name>php4-horde</name>
- <name>php4-nms</name>
- <name>php4</name>
- <range><lt>4.3.10</lt></range>
- </package>
- <package>
- <name>mod_php</name>
- <name>mod_php4</name>
+ <topic>php -- multiple vulnerabilities</topic> <affects>
+ <package>
+ <name>mod_php4-twig</name> <name>php4-cgi</name>
+ <name>php4-cli</name> <name>php4-dtc</name> <name>php4-horde</name>
+ <name>php4-nms</name> <name>php4</name>
+ <range><lt>4.3.10</lt></range>
+ </package> <package>
+ <name>mod_php</name> <name>mod_php4</name>
<range><ge>4</ge><lt>4.3.10,1</lt></range>
+ </package> <package>
+ <name>php5</name> <name>php5-cgi</name> <name>php5-cli</name>
+ <range><lt>5.0.3</lt></range>
+ </package> <package>
+ <name>mod_php5</name> <range><lt>5.0.3,1</lt></range>
</package>
- <package>
- <name>php5</name>
- <name>php5-cgi</name>
- <name>php5-cli</name>
- <range><lt>5.0.3</lt></range>
- </package>
- <package>
- <name>mod_php5</name>
- <range><lt>5.0.3,1</lt></range>
- </package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>Secunia reports:</p>
- <blockquote cite="http://secunia.com/advisories/13481/">
- <p>Multiple vulnerabilities have been reported in PHP,
- which can be exploited to gain escalated privileges,
- bypass certain security restrictions, gain knowledge
- of sensitive information, or compromise a vulnerable
- system.</p>
+ <p>Secunia reports:</p> <blockquote
+ cite="http://secunia.com/advisories/13481/">
+ <p>Multiple vulnerabilities have been reported in PHP,
+ which can be exploited to gain escalated privileges,
+ bypass certain security restrictions, gain knowledge
+ of sensitive information, or compromise a vulnerable
+ system.</p>
</blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<url>http://secunia.com/advisories/13481/</url>
- <cvename>CVE-2004-1019</cvename>
- <cvename>CVE-2004-1065</cvename>
+ <cvename>CVE-2004-1019</cvename> <cvename>CVE-2004-1065</cvename>
<url>http://www.php.net/release_4_3_10.php</url>
<url>http://www.hardened-php.net/advisories/012004.txt</url>
- </references>
- <dates>
- <discovery>2004-12-16</discovery>
- <entry>2004-12-17</entry>
+ </references> <dates>
+ <discovery>2004-12-16</discovery> <entry>2004-12-17</entry>
<modified>2004-12-18</modified>
</dates>
</vuln>
@@ -12067,32 +10022,26 @@ http_access deny Gopher</pre>
<topic>mysql -- GRANT access restriction problem</topic>
<affects>
<package>
- <name>mysql-server</name>
- <range><le>3.23.58_3</le></range>
- <range><ge>4.*</ge><lt>4.0.21</lt></range>
+ <name>mysql-server</name> <range><le>3.23.58_3</le></range>
+ <range><ge>4.*</ge><lt>4.0.21</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>When a user is granted access to a database with a name containing an
- underscore and the underscore is not escaped then that user might
- also be able to access other, similarly named, databases on the
- affected system. </p>
- <p>The problem is that the underscore is seen as a wildcard by MySQL
- and therefore it is possible that an admin might accidently GRANT
- a user access to multiple databases.</p>
+ <p>When a user is granted access to a database with a name
+ containing an underscore and the underscore is not escaped
+ then that user might also be able to access other, similarly
+ named, databases on the affected system. </p>
+ <p>The problem is that the underscore is seen as a wildcard
+ by MySQL and therefore it is possible that an admin might
+ accidently GRANT a user access to multiple databases.</p>
</body>
- </description>
- <references>
- <cvename>CVE-2004-0957</cvename>
- <bid>11435</bid>
- <url>http://bugs.mysql.com/bug.php?id=3933</url>
- <url>http://rhn.redhat.com/errata/RHSA-2004-611.html</url>
- <url>http://www.openpkg.org/security/OpenPKG-SA-2004.045-mysql.html</url>
- </references>
- <dates>
- <discovery>2004-03-29</discovery>
- <entry>2004-12-16</entry>
+ </description> <references>
+ <cvename>CVE-2004-0957</cvename> <bid>11435</bid>
+ <url>http://bugs.mysql.com/bug.php?id=3933</url>
+ <url>http://rhn.redhat.com/errata/RHSA-2004-611.html</url>
+ <url>http://www.openpkg.org/security/OpenPKG-SA-2004.045-mysql.html</url>
+ </references> <dates>
+ <discovery>2004-03-29</discovery> <entry>2004-12-16</entry>
<modified>2005-03-15</modified>
</dates>
</vuln>
@@ -12101,35 +10050,29 @@ http_access deny Gopher</pre>
<topic>mysql -- ALTER MERGE denial of service vulnerability</topic>
<affects>
<package>
- <name>mysql-server</name>
- <range><le>3.23.58_3</le></range>
- <range><ge>4.*</ge><lt>4.0.21</lt></range>
- <range><ge>4.1.*</ge><lt>4.1.1</lt></range>
+ <name>mysql-server</name> <range><le>3.23.58_3</le></range>
+ <range><ge>4.*</ge><lt>4.0.21</lt></range>
+ <range><ge>4.1.*</ge><lt>4.1.1</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>Dean Ellis reported a denial of service vulnerability in the MySQL server:</p>
- <blockquote cite="http://bugs.mysql.com/bug.php?id=4017">
- <p>
- Multiple threads ALTERing the same (or different) MERGE tables to change the
- UNION eventually crash the server or hang the individual threads.
- </p>
- </blockquote>
- <p>Note that a script demonstrating the problem is included in the
- MySQL bug report. Attackers that have control of a MySQL account
- can easily use a modified version of that script during an attack. </p>
+ <p>Dean Ellis reported a denial of service vulnerability
+ in the MySQL server:</p>
+ <blockquote cite="http://bugs.mysql.com/bug.php?id=4017">
+ <p> Multiple threads ALTERing the same (or different)
+ MERGE tables to change the UNION eventually crash
+ the server or hang the individual threads. </p>
+ </blockquote> <p>Note that a script demonstrating the problem
+ is included in the MySQL bug report. Attackers that have
+ control of a MySQL account can easily use a modified version
+ of that script during an attack. </p>
</body>
- </description>
- <references>
- <cvename>CVE-2004-0837</cvename>
- <bid>11357</bid>
- <url>http://bugs.mysql.com/bug.php?id=2408</url>
- <url>http://rhn.redhat.com/errata/RHSA-2004-611.html</url>
- </references>
- <dates>
- <discovery>2004-01-15</discovery>
- <entry>2004-12-16</entry>
+ </description> <references>
+ <cvename>CVE-2004-0837</cvename> <bid>11357</bid>
+ <url>http://bugs.mysql.com/bug.php?id=2408</url>
+ <url>http://rhn.redhat.com/errata/RHSA-2004-611.html</url>
+ </references> <dates>
+ <discovery>2004-01-15</discovery> <entry>2004-12-16</entry>
<modified>2005-03-15</modified>
</dates>
</vuln>
@@ -12138,108 +10081,95 @@ http_access deny Gopher</pre>
<topic>mysql -- FTS request denial of service vulnerability</topic>
<affects>
<package>
- <name>mysql-server</name>
- <range><ge>4.*</ge><lt>4.0.21</lt></range>
+ <name>mysql-server</name>
+ <range><ge>4.*</ge><lt>4.0.21</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>A special crafted MySQL FTS request can cause the server to crash.
- Malicious MySQL users can abuse this bug in a denial of service
- attack against systems running an affected MySQL daemon. </p>
- <p>Note that because this bug is related to the parsing of requests,
- it may happen that this bug is triggered accidently by a user when he
- or she makes a typo. </p>
+ <p>A special crafted MySQL FTS request can cause the server
+ to crash. Malicious MySQL users can abuse this bug in a
+ denial of service attack against systems running an affected
+ MySQL daemon. </p> <p>Note that because this bug is related
+ to the parsing of requests, it may happen that this bug
+ is triggered accidently by a user when he or she makes a
+ typo. </p>
</body>
- </description>
- <references>
+ </description> <references>
<url>http://bugs.mysql.com/bug.php?id=3870</url>
- <cvename>CVE-2004-0956</cvename>
- <bid>11432</bid>
- </references>
- <dates>
- <discovery>2004-03-23</discovery>
- <entry>2004-12-16</entry>
+ <cvename>CVE-2004-0956</cvename> <bid>11432</bid>
+ </references> <dates>
+ <discovery>2004-03-23</discovery> <entry>2004-12-16</entry>
</dates>
</vuln>
<vuln vid="835256b8-46ed-11d9-8ce0-00065be4b5b6">
- <topic>mysql -- mysql_real_connect buffer overflow vulnerability</topic>
- <affects>
- <package>
- <name>mysql-server</name>
- <range><le>3.23.58_3</le></range>
- <range><ge>4.*</ge><lt>4.0.21</lt></range>
- </package>
+ <topic>mysql -- mysql_real_connect buffer overflow
+ vulnerability</topic> <affects>
<package>
- <name>mysql-client</name>
- <range><le>3.23.58_3</le></range>
- <range><ge>4.*</ge><lt>4.0.21</lt></range>
+ <name>mysql-server</name> <range><le>3.23.58_3</le></range>
+ <range><ge>4.*</ge><lt>4.0.21</lt></range>
+ </package> <package>
+ <name>mysql-client</name> <range><le>3.23.58_3</le></range>
+ <range><ge>4.*</ge><lt>4.0.21</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>The mysql_real_connect function doesn't properly handle DNS replies
- by copying the IP address into a buffer without any length checking.
- A specially crafted DNS reply may therefore be used to cause a
- buffer overflow on affected systems.</p>
- <p>Note that whether this issue can be exploitable depends on the system library responsible for
- the gethostbyname function. The bug finder, Lukasz Wojtow, explaines this with the following words:</p>
- <blockquote cite="http://bugs.mysql.com/bug.php?id=4017">
- <p>In glibc there is a limitation for an IP address to have only 4
- bytes (obviously), but generally speaking the length of the address
- comes with a response for dns query (i know it sounds funny but
- read rfc1035 if you don't believe). This bug can occur on libraries
- where gethostbyname function takes length from dns's response</p>
- </blockquote>
+ <p>The mysql_real_connect function doesn't properly handle
+ DNS replies by copying the IP address into a buffer without
+ any length checking. A specially crafted DNS reply may
+ therefore be used to cause a buffer overflow on affected
+ systems.</p> <p>Note that whether this issue can be
+ exploitable depends on the system library responsible for
+ the gethostbyname function. The bug finder, Lukasz Wojtow,
+ explaines this with the following words:</p> <blockquote
+ cite="http://bugs.mysql.com/bug.php?id=4017">
+ <p>In glibc there is a limitation for an IP address
+ to have only 4 bytes (obviously), but generally
+ speaking the length of the address comes with a
+ response for dns query (i know it sounds funny but
+ read rfc1035 if you don't believe). This bug can
+ occur on libraries where gethostbyname function
+ takes length from dns's response</p>
+ </blockquote>
</body>
- </description>
- <references>
- <cvename>CVE-2004-0836</cvename>
- <bid>10981</bid>
- <url>http://bugs.mysql.com/bug.php?id=4017</url>
- <url>http://lists.mysql.com/internals/14726</url>
- <url>http://rhn.redhat.com/errata/RHSA-2004-611.html</url>
- <url>http://www.osvdb.org/displayvuln.php?osvdb_id=10658</url>
- </references>
- <dates>
- <discovery>2004-06-04</discovery>
- <entry>2004-12-16</entry>
+ </description> <references>
+ <cvename>CVE-2004-0836</cvename> <bid>10981</bid>
+ <url>http://bugs.mysql.com/bug.php?id=4017</url>
+ <url>http://lists.mysql.com/internals/14726</url>
+ <url>http://rhn.redhat.com/errata/RHSA-2004-611.html</url>
+ <url>http://www.osvdb.org/displayvuln.php?osvdb_id=10658</url>
+ </references> <dates>
+ <discovery>2004-06-04</discovery> <entry>2004-12-16</entry>
<modified>2005-03-15</modified>
</dates>
</vuln>
<vuln vid="035d17b2-484a-11d9-813c-00065be4b5b6">
- <topic>mysql -- erroneous access restrictions applied to table renames</topic>
- <affects>
+ <topic>mysql -- erroneous access restrictions applied to table
+ renames</topic> <affects>
<package>
- <name>mysql-server</name>
- <range><le>3.23.58_3</le></range>
- <range><ge>4.*</ge><lt>4.0.21</lt></range>
+ <name>mysql-server</name> <range><le>3.23.58_3</le></range>
+ <range><ge>4.*</ge><lt>4.0.21</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>A Red Hat advisory reports:</p>
- <blockquote cite="http://rhn.redhat.com/errata/RHSA-2004-611.html">
- <p>Oleksandr Byelkin discovered that "ALTER TABLE ... RENAME"
- checked the CREATE/INSERT rights of the old table instead of the new one.</p>
- </blockquote>
- <p>Table access restrictions, on the affected MySQL servers,
- may accidently or intentially be bypassed due to this
- bug.</p>
+ <p>A Red Hat advisory reports:</p> <blockquote
+ cite="http://rhn.redhat.com/errata/RHSA-2004-611.html">
+ <p>Oleksandr Byelkin discovered that "ALTER TABLE
+ ... RENAME" checked the CREATE/INSERT rights of the
+ old table instead of the new one.</p>
+ </blockquote>
+ <p>Table access restrictions, on the affected MySQL
+ servers, may accidently or intentially be bypassed
+ due to this bug.</p>
</body>
- </description>
- <references>
- <cvename>CVE-2004-0835</cvename>
- <bid>11357</bid>
- <url>http://bugs.mysql.com/bug.php?id=3270</url>
- <url>http://rhn.redhat.com/errata/RHSA-2004-611.html</url>
- <url>http://xforce.iss.net/xforce/xfdb/17666</url>
- </references>
- <dates>
- <discovery>2004-03-23</discovery>
- <entry>2004-12-16</entry>
+ </description> <references>
+ <cvename>CVE-2004-0835</cvename> <bid>11357</bid>
+ <url>http://bugs.mysql.com/bug.php?id=3270</url>
+ <url>http://rhn.redhat.com/errata/RHSA-2004-611.html</url>
+ <url>http://xforce.iss.net/xforce/xfdb/17666</url>
+ </references> <dates>
+ <discovery>2004-03-23</discovery> <entry>2004-12-16</entry>
<modified>2005-03-15</modified>
</dates>
</vuln>
@@ -12251,29 +10181,25 @@ http_access deny Gopher</pre>
<name>phpMyAdmin</name>
<range><ge>2.6.0.2</ge><lt>2.6.1.r1</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>A phpMyAdmin security announcement reports:</p>
- <blockquote cite="http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2004-4">
+ <p>A phpMyAdmin security announcement reports:</p> <blockquote
+ cite="http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2004-4">
<p>Command execution: since phpMyAdmin 2.6.0-pl2, on a
system where external MIME-based transformations are
activated, an attacker can put into MySQL data an
offensive value that starts a shell command when
browsed.</p>
- </blockquote>
- <p>Enabling <q>PHP safe mode</q> on the server can be used as
+ </blockquote> <p>Enabling <q>PHP safe mode</q> on the server
+ can be used as
a workaround for this vulnerability.</p>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2004-1147</cvename>
<url>http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2004-4</url>
<url>http://www.exaprobe.com/labs/advisories/esa-2004-1213.html</url>
- </references>
- <dates>
- <discovery>2004-12-13</discovery>
- <entry>2004-12-15</entry>
+ </references> <dates>
+ <discovery>2004-12-13</discovery> <entry>2004-12-15</entry>
<modified>2004-12-19</modified>
</dates>
</vuln>
@@ -12282,81 +10208,69 @@ http_access deny Gopher</pre>
<topic>phpmyadmin -- file disclosure vulnerability</topic>
<affects>
<package>
- <name>phpMyAdmin</name>
- <range><lt>2.6.1.r1</lt></range>
+ <name>phpMyAdmin</name> <range><lt>2.6.1.r1</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>A phpMyAdmin security announcement reports:</p>
- <blockquote cite="http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2004-4">
- <p>File disclosure: on systems where the UploadDir mecanism
- is active, read_dump.php can be called with a crafted
- form; using the fact that the sql_localfile variable is
- not sanitized can lead to a file disclosure.</p>
- </blockquote>
- <p>Enabling <q>PHP safe mode</q> on the server can be used as
+ <p>A phpMyAdmin security announcement reports:</p> <blockquote
+ cite="http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2004-4">
+ <p>File disclosure: on systems where the UploadDir mecanism
+ is active, read_dump.php can be called with a crafted
+ form; using the fact that the sql_localfile variable
+ is not sanitized can lead to a file disclosure.</p>
+ </blockquote> <p>Enabling <q>PHP safe mode</q> on the server
+ can be used as
a workaround for this vulnerability.</p>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2004-1148</cvename>
<url>http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2004-4</url>
<url>http://www.exaprobe.com/labs/advisories/esa-2004-1213.html</url>
- </references>
- <dates>
- <discovery>2004-12-13</discovery>
- <entry>2004-12-15</entry>
+ </references> <dates>
+ <discovery>2004-12-13</discovery> <entry>2004-12-15</entry>
<modified>2004-12-19</modified>
</dates>
</vuln>
<vuln vid="06f142ff-4df3-11d9-a9e7-0001020eed82">
- <topic>wget -- multiple vulnerabilities</topic>
- <affects>
+ <topic>wget -- multiple vulnerabilities</topic> <affects>
<package>
- <name>wget</name>
- <name>wget-devel</name>
+ <name>wget</name> <name>wget-devel</name>
<range><lt>1.10.a1</lt></range>
- </package>
- <package>
- <name>wgetpro</name>
- <name>wget+ipv6</name>
+ </package> <package>
+ <name>wgetpro</name> <name>wget+ipv6</name>
<range><ge>0</ge></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jan Minar reports that there exists multiple
vulnerabilities in wget:</p>
- <blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110269474112384">
- <p>Wget erroneously thinks that the current directory is a
- fair game, and will happily write in any file in and below
- it. Malicious HTTP response or malicious HTML file can
- redirect wget to a file that is vital to the system, and
- wget will create/append/overwrite it.</p>
+ <blockquote
+ cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110269474112384">
+ <p>Wget erroneously thinks that the current directory is
+ a
+ fair game, and will happily write in any file in and
+ below it. Malicious HTTP response or malicious HTML
+ file can redirect wget to a file that is vital to the
+ system, and wget will create/append/overwrite it.</p>
<p>Wget apparently has at least two methods of
- ``sanitizing'' the potentially malicious data it receives
- from the HTTP stream, therefore a malicious redirects can
- pass the check. We haven't find a way to trick wget into
- writing above the parent directory, which doesn't mean
- it's not possible.</p>
+ ``sanitizing'' the potentially malicious data it receives
+ from the HTTP stream, therefore a malicious redirects
+ can pass the check. We haven't find a way to trick
+ wget into writing above the parent directory, which
+ doesn't mean it's not possible.</p>
<p>Malicious HTTP response can overwrite parts of the
- terminal so that the user will not notice anything wrong,
- or will believe the error was not fatal.</p>
+ terminal so that the user will not notice anything
+ wrong, or will believe the error was not fatal.</p>
</blockquote>
</body>
- </description>
- <references>
- <cvename>CVE-2004-1487</cvename>
- <cvename>CVE-2004-1488</cvename>
- <bid>11871</bid>
- <mlist msgid="20041209091438.GA15010@kontryhel.haltyr.dyndns.org">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110269474112384</mlist>
+ </description> <references>
+ <cvename>CVE-2004-1487</cvename> <cvename>CVE-2004-1488</cvename>
+ <bid>11871</bid> <mlist
+ msgid="20041209091438.GA15010@kontryhel.haltyr.dyndns.org">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110269474112384</mlist>
<url>http://bugs.debian.org/261755</url>
- </references>
- <dates>
- <discovery>2004-12-09</discovery>
- <entry>2004-12-14</entry>
+ </references> <dates>
+ <discovery>2004-12-09</discovery> <entry>2004-12-14</entry>
<modified>2005-04-15</modified>
</dates>
</vuln>
@@ -12365,61 +10279,52 @@ http_access deny Gopher</pre>
<topic>konqueror -- Password Disclosure for SMB Shares</topic>
<affects>
<package>
- <name>kdebase</name>
- <name>kdelibs</name>
+ <name>kdebase</name> <name>kdelibs</name>
<range><ge>3.2.0</ge><le>3.3.1</le></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>When browsing SMB shares with Konqueror, shares with
authentication show up with hidden password in the browser
- bar. It is possible to store the URL as a shortcut on the
- desktop where the password is then available in plain text.</p>
+ bar. It is possible to store the URL as a shortcut on
+ the desktop where the password is then available in plain
+ text.</p>
</body>
- </description>
- <references>
- <cvename>CVE-2004-1171</cvename>
- <certvu>305294</certvu>
+ </description> <references>
+ <cvename>CVE-2004-1171</cvename> <certvu>305294</certvu>
<url>http://www.kde.org/info/security/advisory-20041209-1.txt</url>
- <mlist msgid="ICEEJPLEDKODPNFKJEGAIEBJGFAA.df@sec-consult.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110178786809694</mlist>
- </references>
- <dates>
- <discovery>2004-10-06</discovery>
- <entry>2004-12-12</entry>
+ <mlist
+ msgid="ICEEJPLEDKODPNFKJEGAIEBJGFAA.df@sec-consult.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110178786809694</mlist>
+ </references> <dates>
+ <discovery>2004-10-06</discovery> <entry>2004-12-12</entry>
<modified>2005-01-13</modified>
</dates>
</vuln>
<vuln vid="af747389-42ba-11d9-bd37-00065be4b5b6">
- <topic>mod_access_referer -- null pointer dereference vulnerability</topic>
- <affects>
+ <topic>mod_access_referer -- null pointer dereference
+ vulnerability</topic> <affects>
<package>
- <name>mod_access_referer</name>
- <range><lt>1.0.2_1</lt></range>
+ <name>mod_access_referer</name> <range><lt>1.0.2_1</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A malformed <q>Referer</q> header field causes the Apache
ap_parse_uri_components function to discard it with the
result that a pointer is not initialized. The
mod_access_referer module does not take this into account
with the result that it may use such a pointer.</p>
- <p>The null pointer vulnerability may possibly be used in a
+ <p>The null pointer vulnerability may possibly be used in
+ a
remote denial of service attack against affected Apache
servers.</p>
</body>
- </description>
- <references>
- <cvename>CVE-2003-1054</cvename>
- <bid>7375</bid>
+ </description> <references>
+ <cvename>CVE-2003-1054</cvename> <bid>7375</bid>
<url>http://secunia.com/advisories/8612/</url>
<mlist>http://marc.theaimsgroup.com/?l=full-disclosure&amp;m=105053485515811</mlist>
- </references>
- <dates>
- <discovery>2003-04-16</discovery>
- <entry>2004-12-11</entry>
+ </references> <dates>
+ <discovery>2003-04-16</discovery> <entry>2004-12-11</entry>
<modified>2005-01-19</modified>
</dates>
</vuln>
@@ -12428,81 +10333,66 @@ http_access deny Gopher</pre>
<topic>squid -- possible information disclosure</topic>
<affects>
<package>
- <name>squid</name>
- <range><lt>2.5.7_4</lt></range>
+ <name>squid</name> <range><lt>2.5.7_4</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>The squid-2.5 patches pages notes:</p>
- <blockquote cite="http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-dothost">
- <p>In certain conditions Squid returns random data as error messages
- in response to malformed host name, possibly leaking random
- internal information which may come from other requests.</p>
+ <p>The squid-2.5 patches pages notes:</p> <blockquote
+ cite="http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-dothost">
+ <p>In certain conditions Squid returns random data as
+ error messages
+ in response to malformed host name, possibly leaking
+ random internal information which may come from other
+ requests.</p>
</blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<url>http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-dothost</url>
- </references>
- <dates>
- <discovery>2004-11-23</discovery>
- <entry>2004-12-09</entry>
+ </references> <dates>
+ <discovery>2004-11-23</discovery> <entry>2004-12-09</entry>
</dates>
</vuln>
<vuln vid="323784cf-48a6-11d9-a9e7-0001020eed82">
- <topic>viewcvs -- information leakage</topic>
- <affects>
+ <topic>viewcvs -- information leakage</topic> <affects>
<package>
- <name>viewcvs</name>
- <range><lt>0.9.2_2</lt></range>
+ <name>viewcvs</name> <range><lt>0.9.2_2</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The <code>hide_cvsroot</code> and <code>forbidden</code>
configuration options are not properly honored by viewcvs
when exporting to a tar file which can lead to information
leakage.</p>
</body>
- </description>
- <references>
- <cvename>CVE-2004-0915</cvename>
- <bid>11819</bid>
- </references>
- <dates>
- <discovery>2004-11-25</discovery>
- <entry>2004-12-08</entry>
+ </description> <references>
+ <cvename>CVE-2004-0915</cvename> <bid>11819</bid>
+ </references> <dates>
+ <discovery>2004-11-25</discovery> <entry>2004-12-08</entry>
<modified>2004-12-12</modified>
</dates>
</vuln>
<vuln vid="a7bfd423-484f-11d9-a9e7-0001020eed82">
- <topic>cscope -- symlink attack vulnerability</topic>
- <affects>
+ <topic>cscope -- symlink attack vulnerability</topic> <affects>
<package>
- <name>cscope</name>
- <range><lt>15.5_1</lt></range>
+ <name>cscope</name> <range><lt>15.5_1</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>cscope is vulnerable to a symlink attack which could lead
+ <p>cscope is vulnerable to a symlink attack which could
+ lead
to an attacker overwriting arbitrary files with the
permissions of the user running cscope.</p>
</body>
- </description>
- <references>
- <cvename>CVE-2004-0996</cvename>
- <bid>11697</bid>
- <mlist msgid="20041124025903.9337.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110133485519690</mlist>
- <mlist msgid="20041118012718.78b07d79.research@rexotec.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110072752707293</mlist>
+ </description> <references>
+ <cvename>CVE-2004-0996</cvename> <bid>11697</bid> <mlist
+ msgid="20041124025903.9337.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110133485519690</mlist>
+ <mlist
+ msgid="20041118012718.78b07d79.research@rexotec.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110072752707293</mlist>
<url>http://sourceforge.net/tracker/index.php?func=detail&amp;aid=1062807&amp;group_id=4664&amp;atid=104664</url>
- </references>
- <dates>
- <discovery>2003-04-03</discovery>
- <entry>2004-12-07</entry>
+ </references> <dates>
+ <discovery>2003-04-03</discovery> <entry>2004-12-07</entry>
</dates>
</vuln>
@@ -12511,34 +10401,30 @@ http_access deny Gopher</pre>
getnickuserhost</topic>
<affects>
<package>
- <name>bnc</name>
- <range><lt>2.9.1</lt></range>
+ <name>bnc</name> <range><lt>2.9.1</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>A LSS Security Advisory reports:</p>
- <blockquote cite="http://security.lss.hr/en/index.php?page=details&amp;ID=LSS-2004-11-03">
+ <p>A LSS Security Advisory reports:</p> <blockquote
+ cite="http://security.lss.hr/en/index.php?page=details&amp;ID=LSS-2004-11-03">
<p>There is a buffer overflow vulnerability in
getnickuserhost() function that is called when BNC is
processing response from IRC server.</p>
- <p>Vulnerability can be exploited if attacker tricks user to
+ <p>Vulnerability can be exploited if attacker tricks user
+ to
connect to his fake IRC server that will exploit this
vulnerability. If the attacker has access to BNC proxy
server, this vulnerability can be used to gain shell
access on machine where BNC proxy server is set.</p>
</blockquote>
</body>
- </description>
- <references>
- <cvename>CVE-2004-1052</cvename>
- <mlist msgid="20041110131046.GA21604@cecilija.zesoi.fer.hr">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110011817627839</mlist>
+ </description> <references>
+ <cvename>CVE-2004-1052</cvename> <mlist
+ msgid="20041110131046.GA21604@cecilija.zesoi.fer.hr">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110011817627839</mlist>
<url>http://security.lss.hr/en/index.php?page=details&amp;ID=LSS-2004-11-03</url>
<url>http://www.gotbnc.com/changes.html</url>
- </references>
- <dates>
- <discovery>2004-11-10</discovery>
- <entry>2004-12-04</entry>
+ </references> <dates>
+ <discovery>2004-11-10</discovery> <entry>2004-12-04</entry>
<modified>2005-02-22</modified>
</dates>
</vuln>
@@ -12547,47 +10433,40 @@ http_access deny Gopher</pre>
<topic>rssh &amp; scponly -- arbitrary command execution</topic>
<affects>
<package>
- <name>rssh</name>
- <range><le>2.2.2</le></range>
- </package>
- <package>
- <name>scponly</name>
- <range><lt>4.0</lt></range>
+ <name>rssh</name> <range><le>2.2.2</le></range>
+ </package> <package>
+ <name>scponly</name> <range><lt>4.0</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>Jason Wies identified both rssh &amp; scponly have a vulnerability
+ <p>Jason Wies identified both rssh &amp; scponly have a
+ vulnerability
that allows arbitrary command execution. He reports:</p>
- <blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110202047507273">
- <p>The problem is compounded when you recognize that the main use of rssh and
- scponly is to allow file transfers, which in turn allows a malicious user to
- transfer and execute entire custom scripts on the remote machine.</p>
- </blockquote>
- </body>
- </description>
- <references>
- <bid>11791</bid>
- <bid>11792</bid>
- <freebsdpr>ports/74633</freebsdpr>
- <mlist msgid="20041202135143.GA7105@xc.net">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110202047507273</mlist>
- </references>
- <dates>
- <discovery>2004-11-28</discovery>
- <entry>2004-12-02</entry>
+ <blockquote
+ cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110202047507273">
+ <p>The problem is compounded when you recognize that the
+ main use of rssh and
+ scponly is to allow file transfers, which in turn allows
+ a malicious user to transfer and execute entire custom
+ scripts on the remote machine.</p>
+ </blockquote>
+ </body>
+ </description> <references>
+ <bid>11791</bid> <bid>11792</bid> <freebsdpr>ports/74633</freebsdpr>
+ <mlist
+ msgid="20041202135143.GA7105@xc.net">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110202047507273</mlist>
+ </references> <dates>
+ <discovery>2004-11-28</discovery> <entry>2004-12-02</entry>
<modified>2004-12-12</modified>
</dates>
</vuln>
<vuln vid="2b4d5288-447e-11d9-9ebb-000854d03344">
- <topic>rockdodger -- buffer overflows</topic>
- <affects>
+ <topic>rockdodger -- buffer overflows</topic> <affects>
<package>
- <name>rockdodger</name>
- <range><lt>0.6_3</lt></range>
+ <name>rockdodger</name> <range><lt>0.6_3</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The environment variable HOME is copied without regard
to buffer size, which can be used to gain elevated privilege
@@ -12596,32 +10475,27 @@ http_access deny Gopher</pre>
<p>The port installs the binary without setgid, but with a
world-writable high score file.</p>
</body>
- </description>
- <references>
+ </description> <references>
<url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=278878</url>
- </references>
- <dates>
- <discovery>2004-10-29</discovery>
- <entry>2004-12-02</entry>
+ </references> <dates>
+ <discovery>2004-10-29</discovery> <entry>2004-12-02</entry>
</dates>
</vuln>
<vuln vid="40549bbf-43b5-11d9-a9e7-0001020eed82">
- <topic>zip -- long path buffer overflow</topic>
- <affects>
+ <topic>zip -- long path buffer overflow</topic> <affects>
<package>
- <name>zip</name>
- <range><lt>2.3_2</lt></range>
+ <name>zip</name> <range><lt>2.3_2</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>A HexView security advisory reports:</p>
- <blockquote cite="http://www.hexview.com/docs/20041103-1.txt">
- <p>When zip performs recursive folder compression, it does
- not check for the length of resulting path. If the path is
- too long, a buffer overflow occurs leading to stack
- corruption and segmentation fault. It is possible to
+ <p>A HexView security advisory reports:</p> <blockquote
+ cite="http://www.hexview.com/docs/20041103-1.txt">
+ <p>When zip performs recursive folder compression, it
+ does
+ not check for the length of resulting path. If the path
+ is too long, a buffer overflow occurs leading to stack
+ corruption and segmentation fault. It is possible to
exploit this vulnerability by embedding a shellcode in
directory or file name. While the issue is not of primary
concern for regular users, it can be critical for
@@ -12629,15 +10503,11 @@ http_access deny Gopher</pre>
automatically using Info-Zip application.</p>
</blockquote>
</body>
- </description>
- <references>
- <cvename>CVE-2004-1010</cvename>
- <bid>11603</bid>
+ </description> <references>
+ <cvename>CVE-2004-1010</cvename> <bid>11603</bid>
<url>http://www.hexview.com/docs/20041103-1.txt</url>
- </references>
- <dates>
- <discovery>2004-10-03</discovery>
- <entry>2004-12-01</entry>
+ </references> <dates>
+ <discovery>2004-10-03</discovery> <entry>2004-12-01</entry>
<modified>2004-12-12</modified>
</dates>
</vuln>
@@ -12646,22 +10516,18 @@ http_access deny Gopher</pre>
<topic>sudoscript -- signal delivery vulnerability</topic>
<affects>
<package>
- <name>sudoscript</name>
- <range><lt>2.1.2</lt></range>
+ <name>sudoscript</name> <range><lt>2.1.2</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>If non-root access is enabled in sudoscript, any member of
+ <p>If non-root access is enabled in sudoscript, any member
+ of
the ssers group can send a SIGHUP signal to any process.</p>
</body>
- </description>
- <references>
+ </description> <references>
<url>http://egbok.com/sudoscript/archives/2004/11/sudoscript_212.html</url>
- </references>
- <dates>
- <discovery>2004-11-14</discovery>
- <entry>2004-12-01</entry>
+ </references> <dates>
+ <discovery>2004-11-14</discovery> <entry>2004-12-01</entry>
</dates>
</vuln>
@@ -12669,26 +10535,21 @@ http_access deny Gopher</pre>
<topic>jabberd -- remote buffer overflow vulnerability</topic>
<affects>
<package>
- <name>jabberd</name>
- <range><ge>2.*</ge><le>2.0.4</le></range>
+ <name>jabberd</name> <range><ge>2.*</ge><le>2.0.4</le></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Caused by improper bounds-checking of username
- and password in the C2S module, it is possible
- for an attacker to cause a remote buffer overflow.
- The server directly handles the userinput with
- SQL backend functions - malicious input may lead
- to buffer overflow.</p>
+ and password in the C2S module, it is possible for an
+ attacker to cause a remote buffer overflow. The server
+ directly handles the userinput with SQL backend functions
+ - malicious input may lead to buffer overflow.</p>
</body>
- </description>
- <references>
- <mlist msgid="41A3FEE1.5030701@0x557.org">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110144303826709</mlist>
- </references>
- <dates>
- <discovery>2004-11-24</discovery>
- <entry>2004-11-30</entry>
+ </description> <references>
+ <mlist
+ msgid="41A3FEE1.5030701@0x557.org">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110144303826709</mlist>
+ </references> <dates>
+ <discovery>2004-11-24</discovery> <entry>2004-11-30</entry>
</dates>
</vuln>
@@ -12696,52 +10557,42 @@ http_access deny Gopher</pre>
<topic>Open DC Hub -- remote buffer overflow vulnerability</topic>
<affects>
<package>
- <name>opendchub</name>
- <range><lt>0.7.14_2</lt></range>
+ <name>opendchub</name> <range><lt>0.7.14_2</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>Donato Ferrante reported an exploitable buffer overflow in
+ <p>Donato Ferrante reported an exploitable buffer overflow
+ in
this software package. Any user that can login with 'admin'
privileges can abuse it, trough the $RedirectAll command,
to execute arbitrary code.</p>
</body>
- </description>
- <references>
- <mlist msgid="20041124155429.893852455E@chernobyl.investici.org">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110144606411674</mlist>
+ </description> <references>
+ <mlist
+ msgid="20041124155429.893852455E@chernobyl.investici.org">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110144606411674</mlist>
<url>http://www.gentoo.org/security/en/glsa/glsa-200411-37.xml</url>
- </references>
- <dates>
- <discovery>2004-11-24</discovery>
- <entry>2004-11-27</entry>
+ </references> <dates>
+ <discovery>2004-11-24</discovery> <entry>2004-11-27</entry>
<modified>2005-02-13</modified>
</dates>
</vuln>
<vuln vid="a163baff-3fe1-11d9-a9e7-0001020eed82">
- <topic>unarj -- long filename buffer overflow</topic>
- <affects>
+ <topic>unarj -- long filename buffer overflow</topic> <affects>
<package>
- <name>unarj</name>
- <range><lt>2.43_2</lt></range>
+ <name>unarj</name> <range><lt>2.43_2</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ludwig Nussel has discovered a buffer overflow
vulnerability in unarj's handling of long filenames which
- could potentially lead to execution of arbitrary code with
- the permissions of the user running unarj.</p>
+ could potentially lead to execution of arbitrary code
+ with the permissions of the user running unarj.</p>
</body>
- </description>
- <references>
- <cvename>CVE-2004-0947</cvename>
- <bid>11665</bid>
- </references>
- <dates>
- <discovery>2004-11-09</discovery>
- <entry>2004-11-26</entry>
+ </description> <references>
+ <cvename>CVE-2004-0947</cvename> <bid>11665</bid>
+ </references> <dates>
+ <discovery>2004-11-09</discovery> <entry>2004-11-26</entry>
</dates>
</vuln>
@@ -12749,26 +10600,20 @@ http_access deny Gopher</pre>
<topic>unarj -- directory traversal vulnerability</topic>
<affects>
<package>
- <name>unarj</name>
- <range><lt>2.43_2</lt></range>
+ <name>unarj</name> <range><lt>2.43_2</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>unarj has insufficient checks for filenames that contain
<q>..</q>. This can allow an attacker to overwrite
arbitrary files with the permissions of the user running
unarj.</p>
</body>
- </description>
- <references>
- <cvename>CVE-2004-1027</cvename>
- <bid>11436</bid>
- <mlist msgid="200410102243.i9AMhA9F083398@mailserver2.hushmail.com">http://marc.theaimsgroup.com/?l=full-disclosure&amp;m=109748984030292</mlist>
- </references>
- <dates>
- <discovery>2004-10-10</discovery>
- <entry>2004-11-26</entry>
+ </description> <references>
+ <cvename>CVE-2004-1027</cvename> <bid>11436</bid> <mlist
+ msgid="200410102243.i9AMhA9F083398@mailserver2.hushmail.com">http://marc.theaimsgroup.com/?l=full-disclosure&amp;m=109748984030292</mlist>
+ </references> <dates>
+ <discovery>2004-10-10</discovery> <entry>2004-11-26</entry>
</dates>
</vuln>
@@ -12776,218 +10621,186 @@ http_access deny Gopher</pre>
<topic>jdk/jre -- Security Vulnerability With Java Plugin</topic>
<affects>
<package>
- <name>jdk</name>
- <range><ge>1.4.0</ge><le>1.4.2p6_6</le></range>
+ <name>jdk</name> <range><ge>1.4.0</ge><le>1.4.2p6_6</le></range>
<range><ge>1.3.0</ge><le>1.3.1p9_5</le></range>
- </package>
- <package>
- <name>linux-jdk</name>
- <name>linux-sun-jdk</name>
+ </package> <package>
+ <name>linux-jdk</name> <name>linux-sun-jdk</name>
<range><ge>1.4.0</ge><le>1.4.2.05</le></range>
<range><ge>1.3.0</ge><le>1.3.1.13</le></range>
- </package>
- <package>
+ </package> <package>
<name>linux-blackdown-jdk</name>
<range><ge>1.3.0</ge><le>1.4.2</le></range>
- </package>
- <package>
+ </package> <package>
<name>linux-ibm-jdk</name>
<range><ge>1.3.0</ge><le>1.4.2</le></range>
- </package>
- <package>
- <name>diablo-jdk</name>
- <name>diablo-jre</name>
+ </package> <package>
+ <name>diablo-jdk</name> <name>diablo-jre</name>
<range><ge>1.3.1.0</ge><le>1.3.1.0_1</le></range>
</package>
- </affects>
- <description>
- <body xmlns="http://www.w3.org/1999/xhtml">
- <p>
- The Sun Java Plugin capability in Java 2 Runtime Environment
- (JRE) 1.4.2_01, 1.4.2_04, and possibly earlier versions, does
- not properly restrict access between Javascript and Java
- applets during data transfer, which allows remote attackers
- to load unsafe classes and execute arbitrary code.
- </p>
- </body>
- </description>
- <references>
+ </affects> <description>
+ <body xmlns="http://www.w3.org/1999/xhtml"> <p> The Sun Java
+ Plugin capability in Java 2 Runtime Environment (JRE) 1.4.2_01,
+ 1.4.2_04, and possibly earlier versions, does not properly
+ restrict access between Javascript and Java applets during
+ data transfer, which allows remote attackers to load unsafe
+ classes and execute arbitrary code. </p> </body>
+ </description> <references>
<url>http://sunsolve.sun.com/search/document.do?assetkey=1-26-57591-1&amp;searchclause=%22category:security%22%20%22availability,%20security%22</url>
<url>http://www.securityfocus.com/archive/1/382072</url>
- <cvename>CVE-2004-1029</cvename>
- <mlist msgid="20041123070248.GA25385@jouko.iki.fi">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110125046627909</mlist>
- </references>
- <dates>
- <discovery>2004-11-24</discovery>
- <entry>2004-11-25</entry>
+ <cvename>CVE-2004-1029</cvename> <mlist
+ msgid="20041123070248.GA25385@jouko.iki.fi">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110125046627909</mlist>
+ </references> <dates>
+ <discovery>2004-11-24</discovery> <entry>2004-11-25</entry>
<modified>2005-04-27</modified>
</dates>
</vuln>
<vuln vid="1a32e8ee-3edb-11d9-8699-00065be4b5b6">
- <topic>ProZilla -- server response buffer overflow vulnerabilities</topic>
- <affects>
+ <topic>ProZilla -- server response buffer overflow
+ vulnerabilities</topic> <affects>
<package>
- <name>prozilla</name>
- <range><le>1.3.6_3</le></range>
+ <name>prozilla</name> <range><le>1.3.6_3</le></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>Buffer overflow vulnerabilities have been reported to exist
- in this software package. The vulnerabilities can be triggered by
- a remote server and can be used to inject malicious code in the
- ProZilla process.</p>
+ <p>Buffer overflow vulnerabilities have been reported to
+ exist
+ in this software package. The vulnerabilities can be
+ triggered by a remote server and can be used to inject
+ malicious code in the ProZilla process.</p>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2004-1120</cvename>
<url>http://www.gentoo.org/security/en/glsa/glsa-200411-31.xml</url>
- <url>http://bugs.gentoo.org/show_bug.cgi?id=70090</url>
- <mlist msgid="41A411E0.2010907@gmx.net">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110136626320497</mlist>
- </references>
- <dates>
- <discovery>2004-11-23</discovery>
- <entry>2004-11-25</entry>
+ <url>http://bugs.gentoo.org/show_bug.cgi?id=70090</url> <mlist
+ msgid="41A411E0.2010907@gmx.net">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110136626320497</mlist>
+ </references> <dates>
+ <discovery>2004-11-23</discovery> <entry>2004-11-25</entry>
<modified>2005-10-01</modified>
</dates>
</vuln>
<vuln vid="31952117-3d17-11d9-8818-008088034841">
- <topic>Cyrus IMAPd -- APPEND command uses undefined programming construct</topic>
- <affects>
+ <topic>Cyrus IMAPd -- APPEND command uses undefined programming
+ construct</topic> <affects>
<package>
<name>cyrus-imapd</name>
<range><ge>2.2.7</ge><le>2.2.8</le></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>To support MULTIAPPENDS the cmd_append handler uses the
- global stage array. This array is one of the things that gets
- destructed when the fatal() function is triggered. When the
- Cyrus IMAP code adds new entries to this array this is done
- with the help of the postfix increment operator in combination
- with memory allocation functions. The increment is performed
- on a global variable counting the number of allocated
- stages. Because the memory allocation function can fail and
- therefore internally call fatal() this construct is undefined
- arcording to ANSI C. This means that it is not clearly defined
- if the numstage counter is already increased when fatal() is
- called or not. While older gcc versions increase the counter
- after the memory allocation function has returned, on newer
- gcc versions (3.x) the counter gets actually increased
- before. In such a case the stage destructing process will try
- to free an uninitialised and maybe attacker supplied
- pointer. Which again could lead to remote code
- execution. (Because it is hard for an attacker to let the
- memory allocation functions fail in the right moment no PoC
- code for this problem was designed)</p>
- </body>
- </description>
- <references>
+ global stage array. This array is one of the things that
+ gets destructed when the fatal() function is triggered.
+ When the Cyrus IMAP code adds new entries to this array
+ this is done with the help of the postfix increment
+ operator in combination with memory allocation functions.
+ The increment is performed on a global variable counting
+ the number of allocated stages. Because the memory
+ allocation function can fail and therefore internally
+ call fatal() this construct is undefined arcording to
+ ANSI C. This means that it is not clearly defined if the
+ numstage counter is already increased when fatal() is
+ called or not. While older gcc versions increase the
+ counter after the memory allocation function has returned,
+ on newer gcc versions (3.x) the counter gets actually
+ increased before. In such a case the stage destructing
+ process will try to free an uninitialised and maybe
+ attacker supplied pointer. Which again could lead to
+ remote code execution. (Because it is hard for an attacker
+ to let the memory allocation functions fail in the right
+ moment no PoC code for this problem was designed)</p>
+ </body>
+ </description> <references>
<url>http://security.e-matters.de/advisories/152004.html</url>
- </references>
- <dates>
- <discovery>2004-11-06</discovery>
- <entry>2004-11-22</entry>
+ </references> <dates>
+ <discovery>2004-11-06</discovery> <entry>2004-11-22</entry>
</dates>
</vuln>
<vuln vid="c0a269d5-3d16-11d9-8818-008088034841">
- <topic>Cyrus IMAPd -- FETCH command out of bounds memory corruption</topic>
- <affects>
+ <topic>Cyrus IMAPd -- FETCH command out of bounds memory
+ corruption</topic> <affects>
<package>
- <name>cyrus-imapd</name>
- <range><lt>2.1.17</lt></range>
+ <name>cyrus-imapd</name> <range><lt>2.1.17</lt></range>
<range><ge>2.2.*</ge><le>2.2.8</le></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>The argument parser of the fetch command suffers a bug very
+ <p>The argument parser of the fetch command suffers a bug
+ very
similiar to the partial command problem. Arguments like
"body[p", "binary[p" or "binary[p" will be wrongly detected
and the bufferposition can point outside of the allocated
- buffer for the rest of the parsing process. When the parser
- triggers the PARSE_PARTIAL macro after such a malformed
- argument was received this can lead to a similiar one byte
- memory corruption and allows remote code execution, when the
- heap layout was successfully controlled by the attacker.</p>
- </body>
- </description>
- <references>
+ buffer for the rest of the parsing process. When the
+ parser triggers the PARSE_PARTIAL macro after such a
+ malformed argument was received this can lead to a similiar
+ one byte memory corruption and allows remote code execution,
+ when the heap layout was successfully controlled by the
+ attacker.</p>
+ </body>
+ </description> <references>
<cvename>CVE-2004-1013</cvename>
<url>http://security.e-matters.de/advisories/152004.html</url>
- </references>
- <dates>
- <discovery>2004-11-06</discovery>
- <entry>2004-11-22</entry>
+ </references> <dates>
+ <discovery>2004-11-06</discovery> <entry>2004-11-22</entry>
<modified>2004-11-24</modified>
</dates>
</vuln>
<vuln vid="114d70f3-3d16-11d9-8818-008088034841">
- <topic>Cyrus IMAPd -- PARTIAL command out of bounds memory corruption</topic>
- <affects>
+ <topic>Cyrus IMAPd -- PARTIAL command out of bounds memory
+ corruption</topic> <affects>
<package>
- <name>cyrus-imapd</name>
- <range><lt>2.1.17</lt></range>
+ <name>cyrus-imapd</name> <range><lt>2.1.17</lt></range>
<range><ge>2.2.*</ge><le>2.2.6</le></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Due to a bug within the argument parser of the partial
- command an argument like "body[p" will be wrongly detected as
- "body.peek". Because of this the bufferposition gets increased
- by 10 instead of 5 and could therefore point outside the
- allocated memory buffer for the rest of the parsing
- process. In imapd versions prior to 2.2.7 the handling of
- "body" or "bodypeek" arguments was broken so that the
- terminating ']' got overwritten by a '\0'. Combined the two
- problems allow a potential attacker to overwrite a single byte
- of malloc() control structures, which leads to remote code
- execution if the attacker successfully controls the heap
- layout.</p>
- </body>
- </description>
- <references>
+ command an argument like "body[p" will be wrongly detected
+ as "body.peek". Because of this the bufferposition gets
+ increased by 10 instead of 5 and could therefore point
+ outside the allocated memory buffer for the rest of the
+ parsing process. In imapd versions prior to 2.2.7 the
+ handling of "body" or "bodypeek" arguments was broken so
+ that the terminating ']' got overwritten by a '\0'.
+ Combined the two problems allow a potential attacker to
+ overwrite a single byte of malloc() control structures,
+ which leads to remote code execution if the attacker
+ successfully controls the heap layout.</p>
+ </body>
+ </description> <references>
<cvename>CVE-2004-1012</cvename>
<url>http://security.e-matters.de/advisories/152004.html</url>
- </references>
- <dates>
- <discovery>2004-11-06</discovery>
- <entry>2004-11-22</entry>
+ </references> <dates>
+ <discovery>2004-11-06</discovery> <entry>2004-11-22</entry>
<modified>2004-11-24</modified>
</dates>
</vuln>
<vuln vid="816fdd8b-3d14-11d9-8818-008088034841">
- <topic>Cyrus IMAPd -- IMAPMAGICPLUS preauthentification overflow</topic>
- <affects>
+ <topic>Cyrus IMAPd -- IMAPMAGICPLUS preauthentification
+ overflow</topic> <affects>
<package>
<name>cyrus-imapd</name>
<range><ge>2.2.4</ge><le>2.2.8</le></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>When the option imapmagicplus is activated on a server the
+ <p>When the option imapmagicplus is activated on a server
+ the
PROXY and LOGIN commands suffer a standard stack overflow,
- because the username is not checked against a maximum length
- when it is copied into a temporary stack buffer. This bug is
- especially dangerous because it can be triggered before any
- kind of authentification took place.</p>
+ because the username is not checked against a maximum
+ length when it is copied into a temporary stack buffer.
+ This bug is especially dangerous because it can be triggered
+ before any kind of authentification took place.</p>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2004-1011</cvename>
<url>http://security.e-matters.de/advisories/152004.html</url>
- </references>
- <dates>
- <discovery>2004-11-06</discovery>
- <entry>2004-11-22</entry>
+ </references> <dates>
+ <discovery>2004-11-06</discovery> <entry>2004-11-22</entry>
</dates>
</vuln>
@@ -12995,33 +10808,26 @@ http_access deny Gopher</pre>
<topic>phpMyAdmin -- cross-site scripting vulnerabilities</topic>
<affects>
<package>
- <name>phpMyAdmin</name>
- <range><le>2.6.0.2</le></range>
+ <name>phpMyAdmin</name> <range><le>2.6.0.2</le></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Multiple cross-site scripting vulnerabilities, caused
- by improper input parameter sanitizing, were
- detected in phpMyAdmin, which may enable an attacker
- to do cross-site scripting attacks.</p>
+ by improper input parameter sanitizing, were detected in
+ phpMyAdmin, which may enable an attacker to do cross-site
+ scripting attacks.</p>
</body>
- </description>
- <references>
+ </description> <references>
<url>http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2004-3</url>
- </references>
- <dates>
- <discovery>2004-11-18</discovery>
- <entry>2004-11-20</entry>
+ </references> <dates>
+ <discovery>2004-11-18</discovery> <entry>2004-11-20</entry>
</dates>
</vuln>
<vuln vid="759b8dfe-3972-11d9-a9e7-0001020eed82">
- <topic>Overflow error in fetch</topic>
- <affects>
+ <topic>Overflow error in fetch</topic> <affects>
<system>
- <name>FreeBSD</name>
- <range><ge>5.3</ge><lt>5.3_1</lt></range>
+ <name>FreeBSD</name> <range><ge>5.3</ge><lt>5.3_1</lt></range>
<range><ge>5.2.1</ge><lt>5.2.1_12</lt></range>
<range><ge>5.1</ge><lt>5.1_18</lt></range>
<range><ge>5.0</ge><lt>5.0_22</lt></range>
@@ -13030,55 +10836,44 @@ http_access deny Gopher</pre>
<range><ge>4.8</ge><lt>4.8_26</lt></range>
<range><lt>4.7_28</lt></range>
</system>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>An integer overflow condition in <a
href="http://www.freebsd.org/cgi/man.cgi?query=fetch">fetch(1)</a>
in the processing of HTTP headers can result in a buffer
overflow.</p>
- <p>A malicious server or CGI script can respond to an HTTP or
+ <p>A malicious server or CGI script can respond to an HTTP
+ or
HTTPS request in such a manner as to cause arbitrary
portions of the client's memory to be overwritten, allowing
for arbitrary code execution.</p>
</body>
- </description>
- <references>
+ </description> <references>
<freebsdsa>SA-04:16.fetch</freebsdsa>
- <cvename>CVE-2004-1053</cvename>
- <bid>11702</bid>
- </references>
- <dates>
- <discovery>2004-11-14</discovery>
- <entry>2004-11-18</entry>
+ <cvename>CVE-2004-1053</cvename> <bid>11702</bid>
+ </references> <dates>
+ <discovery>2004-11-14</discovery> <entry>2004-11-18</entry>
</dates>
</vuln>
<vuln vid="f3d3f621-38d8-11d9-8fff-000c6e8f12ef">
- <topic>smbd -- buffer-overrun vulnerability</topic>
- <affects>
+ <topic>smbd -- buffer-overrun vulnerability</topic> <affects>
<package>
- <name>samba</name>
- <range><ge>3.*</ge><lt>3.0.8,1</lt></range>
+ <name>samba</name> <range><ge>3.*</ge><lt>3.0.8,1</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Caused by improper bounds checking of certain trans2
requests, there is a possible buffer overrun in smbd.
- The attacker needs to be able to create files with
- very specific Unicode filenames on the share to take
- advantage of this issue.</p>
- </body>
- </description>
- <references>
- <cvename>CVE-2004-0882</cvename>
- <bid>11678</bid>
- <mlist msgid="4198AE84.7020509@samba.org">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110055646329581</mlist>
- </references>
- <dates>
- <discovery>2004-11-15</discovery>
- <entry>2004-11-17</entry>
+ The attacker needs to be able to create files with very
+ specific Unicode filenames on the share to take advantage
+ of this issue.</p>
+ </body>
+ </description> <references>
+ <cvename>CVE-2004-0882</cvename> <bid>11678</bid> <mlist
+ msgid="4198AE84.7020509@samba.org">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110055646329581</mlist>
+ </references> <dates>
+ <discovery>2004-11-15</discovery> <entry>2004-11-17</entry>
<modified>2004-12-12</modified>
</dates>
</vuln>
@@ -13087,14 +10882,12 @@ http_access deny Gopher</pre>
<topic>twiki -- arbitrary shell command execution</topic>
<affects>
<package>
- <name>twiki</name>
- <range><lt>20040902</lt></range>
+ <name>twiki</name> <range><lt>20040902</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>Hans Ulrich Niedermann reports:</p>
- <blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110037207516456">
+ <p>Hans Ulrich Niedermann reports:</p> <blockquote
+ cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110037207516456">
<p>The TWiki search function uses a user supplied search
string to compose a command line executed by the Perl
backtick (``) operator.</p>
@@ -13105,15 +10898,12 @@ http_access deny Gopher</pre>
commands with the privileges of the TWiki process.</p>
</blockquote>
</body>
- </description>
- <references>
- <cvename>CVE-2004-1037</cvename>
- <mlist msgid="86zn1mhchx.fsf@n-dimensional.de">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110037207516456</mlist>
+ </description> <references>
+ <cvename>CVE-2004-1037</cvename> <mlist
+ msgid="86zn1mhchx.fsf@n-dimensional.de">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110037207516456</mlist>
<url>http://twiki.org/cgi-bin/view/Codev/SecurityAlertExecuteCommandsWithSearch</url>
- </references>
- <dates>
- <discovery>2004-11-12</discovery>
- <entry>2004-11-15</entry>
+ </references> <dates>
+ <discovery>2004-11-12</discovery> <entry>2004-11-15</entry>
<modified>2004-11-23</modified>
</dates>
</vuln>
@@ -13122,35 +10912,29 @@ http_access deny Gopher</pre>
<topic>proxytunnel -- format string vulnerability</topic>
<affects>
<package>
- <name>proxytunnel</name>
- <range><lt>1.2.3</lt></range>
+ <name>proxytunnel</name> <range><lt>1.2.3</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>A Gentoo Linux Security Advisory reports:</p>
- <blockquote cite="http://www.gentoo.org/security/en/glsa/glsa-200411-07.xml">
+ <p>A Gentoo Linux Security Advisory reports:</p> <blockquote
+ cite="http://www.gentoo.org/security/en/glsa/glsa-200411-07.xml">
<p>Florian Schilhabel of the Gentoo Linux Security Audit
- project found a format string vulnerability in
- Proxytunnel. When the program is started in daemon mode
- (-a [port]), it improperly logs invalid proxy answers to
- syslog.</p>
+ project found a format string vulnerability in Proxytunnel.
+ When the program is started in daemon mode (-a [port]),
+ it improperly logs invalid proxy answers to syslog.</p>
<p>A malicious remote server could send specially-crafted
- invalid answers to exploit the format string
- vulnerability, potentially allowing the execution of
- arbitrary code on the tunnelling host with the rights of
- the Proxytunnel process.</p>
+ invalid answers to exploit the format string vulnerability,
+ potentially allowing the execution of arbitrary code
+ on the tunnelling host with the rights of the Proxytunnel
+ process.</p>
</blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2004-0992</cvename>
<url>http://proxytunnel.sourceforge.net/news.html</url>
<url>http://www.gentoo.org/security/en/glsa/glsa-200411-07.xml</url>
- </references>
- <dates>
- <discovery>2004-11-01</discovery>
- <entry>2004-11-15</entry>
+ </references> <dates>
+ <discovery>2004-11-01</discovery> <entry>2004-11-15</entry>
</dates>
</vuln>
@@ -13158,118 +10942,97 @@ http_access deny Gopher</pre>
<topic>sudo -- privilege escalation with bash scripts</topic>
<affects>
<package>
- <name>sudo</name>
- <range><lt>1.6.8.2</lt></range>
+ <name>sudo</name> <range><lt>1.6.8.2</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>A Sudo Security Alerts reports:</p>
- <blockquote cite="http://www.courtesan.com/sudo/alerts/bash_functions.html">
+ <p>A Sudo Security Alerts reports:</p> <blockquote
+ cite="http://www.courtesan.com/sudo/alerts/bash_functions.html">
<p>A flaw in exists in sudo's environment sanitizing prior
- to sudo version 1.6.8p2 that could allow a malicious user
- with permission to run a shell script that utilized the
- bash shell to run arbitrary commands.</p>
+ to sudo version 1.6.8p2 that could allow a malicious
+ user with permission to run a shell script that utilized
+ the bash shell to run arbitrary commands.</p>
</blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<url>http://www.courtesan.com/sudo/alerts/bash_functions.html</url>
- </references>
- <dates>
- <discovery>2004-11-11</discovery>
- <entry>2004-11-13</entry>
+ </references> <dates>
+ <discovery>2004-11-11</discovery> <entry>2004-11-13</entry>
</dates>
</vuln>
<vuln vid="d656296b-33ff-11d9-a9e7-0001020eed82">
- <topic>ruby -- CGI DoS</topic>
- <affects>
+ <topic>ruby -- CGI DoS</topic> <affects>
<package>
- <name>ruby</name>
- <name>ruby_r</name>
+ <name>ruby</name> <name>ruby_r</name>
<range><gt>1.7.*</gt><lt>1.8.2.p2_2</lt></range>
<range><lt>1.6.8.2004.07.28_1</lt></range>
- </package>
- <package>
+ </package> <package>
<name>ruby-1.7.0</name>
<range><ge>a2001.05.12</ge><le>a2001.05.26</le></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>The Ruby CGI.rb module contains a bug which can cause the
- CGI module to go into an infinite loop, thereby causing a
- denial-of-service situation on the web server by using all
- available CPU time.</p>
+ <p>The Ruby CGI.rb module contains a bug which can cause
+ the
+ CGI module to go into an infinite loop, thereby causing
+ a denial-of-service situation on the web server by using
+ all available CPU time.</p>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2004-0983</cvename>
<url>http://www.debian.org/security/2004/dsa-586</url>
- </references>
- <dates>
- <discovery>2004-11-06</discovery>
- <entry>2004-11-13</entry>
+ </references> <dates>
+ <discovery>2004-11-06</discovery> <entry>2004-11-13</entry>
<modified>2004-11-25</modified>
</dates>
</vuln>
- <vuln vid="ba13dc13-340d-11d9-ac1b-000d614f7fad">
- <topic>samba -- potential remote DoS vulnerability</topic>
+ <vuln vid="ba13dc13-340d-11d9-ac1b-000d614f7fad"> <topic>samba
+ -- potential remote DoS vulnerability</topic>
<affects>
<package>
- <name>samba</name>
- <range><ge>3</ge><lt>3.0.8,1</lt></range>
+ <name>samba</name> <range><ge>3</ge><lt>3.0.8,1</lt></range>
</package>
- </affects>
- <description>
- <body xmlns="http://www.w3.org/1999/xhtml">
- <p>Karol Wiesek at iDEFENSE reports:</p>
- <blockquote cite="http://us4.samba.org/samba/security/CAN-2004-0930.html">
- <p>A remote attacker could cause an smbd process to consume
- abnormal amounts of system resources due to an input
- validation error when matching filenames containing
- wildcard characters.</p>
- </blockquote>
- <p>Although samba.org classifies this as a DoS vulnerability,
- several members of the security community believe it may be
- exploitable for arbitrary code execution.</p>
- </body>
- </description>
- <references>
- <freebsdpr>ports/73701</freebsdpr>
- <cvename>CVE-2004-0930</cvename>
+ </affects> <description>
+ <body xmlns="http://www.w3.org/1999/xhtml"> <p>Karol Wiesek
+ at iDEFENSE reports:</p>
+ <blockquote
+ cite="http://us4.samba.org/samba/security/CAN-2004-0930.html">
+ <p>A remote attacker could cause an smbd process to consume
+ abnormal amounts of system resources due to an input
+ validation error when matching filenames containing
+ wildcard characters.</p>
+ </blockquote> <p>Although samba.org classifies this as a
+ DoS vulnerability,
+ several members of the security community believe it may
+ be exploitable for arbitrary code execution.</p>
+ </body>
+ </description> <references>
+ <freebsdpr>ports/73701</freebsdpr> <cvename>CVE-2004-0930</cvename>
<url>http://us4.samba.org/samba/security/CAN-2004-0930.html</url>
- </references>
- <dates>
- <discovery>2004-09-30</discovery>
- <entry>2004-11-12</entry>
+ </references> <dates>
+ <discovery>2004-09-30</discovery> <entry>2004-11-12</entry>
</dates>
</vuln>
<vuln vid="fc99c736-3499-11d9-98a7-0090962cff2a">
- <topic>gnats -- format string vulnerability</topic>
- <affects>
+ <topic>gnats -- format string vulnerability</topic> <affects>
<package>
- <name>gnats</name>
- <range><ge>4.*</ge><le>4.0_2</le></range>
+ <name>gnats</name> <range><ge>4.*</ge><le>4.0_2</le></range>
<range><le>3.113.1_9</le></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>Gnats suffers from a format string bug, which may enable an
+ <p>Gnats suffers from a format string bug, which may enable
+ an
attacker to execute arbitary code.</p>
</body>
- </description>
- <references>
- <cvename>CVE-2004-0623</cvename>
- <mlist msgid="20040625164231.7437.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=108820000823191</mlist>
- </references>
- <dates>
- <discovery>2004-06-21</discovery>
- <entry>2004-11-12</entry>
+ </description> <references>
+ <cvename>CVE-2004-0623</cvename> <mlist
+ msgid="20040625164231.7437.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=108820000823191</mlist>
+ </references> <dates>
+ <discovery>2004-06-21</discovery> <entry>2004-11-12</entry>
</dates>
</vuln>
@@ -13277,71 +11040,65 @@ http_access deny Gopher</pre>
<topic>squirrelmail -- cross site scripting vulnerability</topic>
<affects>
<package>
- <name>ja-squirrelmail</name>
- <range><lt>1.4.3a_4,2</lt></range>
+ <name>ja-squirrelmail</name> <range><lt>1.4.3a_4,2</lt></range>
+ </package> <package>
+ <name>squirrelmail</name> <range><lt>1.4.3a_3</lt></range>
</package>
- <package>
- <name>squirrelmail</name>
- <range><lt>1.4.3a_3</lt></range>
- </package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>A SquirrelMail Security Notice reports:</p>
- <blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110012133608004">
- <p>There is a cross site scripting issue in the decoding of
+ <p>A SquirrelMail Security Notice reports:</p> <blockquote
+ cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110012133608004">
+ <p>There is a cross site scripting issue in the decoding
+ of
encoded text in certain headers. SquirrelMail correctly
- decodes the specially crafted header, but doesn't sanitize
- the decoded strings.</p>
+ decodes the specially crafted header, but doesn't
+ sanitize the decoded strings.</p>
</blockquote>
</body>
- </description>
- <references>
- <mlist msgid="544475695.20041110000451@netdork.net">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110012133608004</mlist>
- </references>
- <dates>
- <discovery>2004-11-03</discovery>
- <entry>2004-11-12</entry>
+ </description> <references>
+ <mlist
+ msgid="544475695.20041110000451@netdork.net">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110012133608004</mlist>
+ </references> <dates>
+ <discovery>2004-11-03</discovery> <entry>2004-11-12</entry>
</dates>
</vuln>
<vuln vid="1f8dea68-3436-11d9-952f-000c6e8f12ef">
- <cancelled superseded="9be819c6-4633-11d9-a9e7-0001020eed82" />
+ <cancelled superseded="9be819c6-4633-11d9-a9e7-0001020eed82"
+ />
</vuln>
<vuln vid="027380b7-3404-11d9-ac1b-000d614f7fad">
<topic>hafiye -- lack of terminal escape sequence filtering</topic>
<affects>
<package>
- <name>hafiye</name>
- <range><lt>1.0_1</lt></range>
+ <name>hafiye</name> <range><lt>1.0_1</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>A siyahsapka.org advisory reads:</p>
- <blockquote cite="http://deicide.siyahsapka.org/hafiye_esc.txt">
- <p>Hafiye-1.0 doesnt filter the payload when printing it to
- the terminal. A malicious attacker can send packets with
- escape sequence payloads to exploit this vulnerability.</p>
- <p>If Hafiye has been started with -n packet count option ,
- the vulnerability could allow remote code execution. For
- remote code execution the victim must press Enter after
- program exit.</p>
- </blockquote>
- <p>Note that it appears that this bug can only be exploited in
+ <p>A siyahsapka.org advisory reads:</p> <blockquote
+ cite="http://deicide.siyahsapka.org/hafiye_esc.txt">
+ <p>Hafiye-1.0 doesnt filter the payload when printing it
+ to
+ the terminal. A malicious attacker can send packets
+ with escape sequence payloads to exploit this
+ vulnerability.</p>
+ <p>If Hafiye has been started with -n packet count option
+ ,
+ the vulnerability could allow remote code execution.
+ For remote code execution the victim must press Enter
+ after program exit.</p>
+ </blockquote> <p>Note that it appears that this bug can
+ only be exploited in
conjunction with a terminal emulator that honors the
appropriate escape sequences.</p>
</body>
- </description>
- <references>
+ </description> <references>
<freebsdpr>ports/70978</freebsdpr>
<url>http://deicide.siyahsapka.org/hafiye_esc.txt</url>
<url>http://www.enderunix.org/hafiye/</url>
- </references>
- <dates>
- <discovery>2004-08-23</discovery>
- <entry>2004-11-11</entry>
+ </references> <dates>
+ <discovery>2004-08-23</discovery> <entry>2004-11-11</entry>
</dates>
</vuln>
@@ -13349,26 +11106,22 @@ http_access deny Gopher</pre>
<topic>ez-ipupdate -- format string vulnerability</topic>
<affects>
<package>
- <name>ez-ipupdate</name>
- <range><lt>3.0.11b8_2</lt></range>
+ <name>ez-ipupdate</name> <range><lt>3.0.11b8_2</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>Data supplied by a remote server is used as the format string
- instead of as parameters in a syslog() call. This may lead
- to crashes or potential running of arbitrary code. It is
- only a problem when running in daemon mode (very common) and
- when using some service types.</p>
+ <p>Data supplied by a remote server is used as the format
+ string
+ instead of as parameters in a syslog() call. This may
+ lead to crashes or potential running of arbitrary code.
+ It is only a problem when running in daemon mode (very
+ common) and when using some service types.</p>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2004-0980</cvename>
<mlist>http://lists.netsys.com/pipermail/full-disclosure/2004-November/028590.html</mlist>
- </references>
- <dates>
- <discovery>2004-11-11</discovery>
- <entry>2004-11-11</entry>
+ </references> <dates>
+ <discovery>2004-11-11</discovery> <entry>2004-11-11</entry>
</dates>
</vuln>
@@ -13376,147 +11129,116 @@ http_access deny Gopher</pre>
<topic>ImageMagick -- EXIF parser buffer overflow</topic>
<affects>
<package>
- <name>ImageMagick</name>
- <range><lt>6.1.3</lt></range>
+ <name>ImageMagick</name> <range><lt>6.1.3</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>There exists a buffer overflow vulnerability in
ImageMagick's EXIF parsing code which may lead to execution
of arbitrary code.</p>
</body>
- </description>
- <references>
- <bid>11548</bid>
- <cvename>CVE-2004-0981</cvename>
+ </description> <references>
+ <bid>11548</bid> <cvename>CVE-2004-0981</cvename>
<url>http://secunia.com/advisories/12995/</url>
<url>http://www.imagemagick.org/www/Changelog.html</url>
- </references>
- <dates>
- <discovery>2004-10-25</discovery>
- <entry>2004-11-11</entry>
+ </references> <dates>
+ <discovery>2004-10-25</discovery> <entry>2004-11-11</entry>
<modified>2004-12-12</modified>
</dates>
</vuln>
<vuln vid="282dfea0-3378-11d9-b404-000c6e8f12ef">
- <topic>apache2 multiple space header denial-of-service vulnerability</topic>
- <affects>
+ <topic>apache2 multiple space header denial-of-service
+ vulnerability</topic> <affects>
<package>
- <name>apache</name>
- <range><gt>2.*</gt><le>2.0.52_2</le></range>
+ <name>apache</name> <range><gt>2.*</gt><le>2.0.52_2</le></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>It is possible for remote attackers to cause a denial-of-service
- scenario on Apache 2.0.52 and earlier by sending an HTTP GET
- request with a MIME header containing multiple lines full of
- whitespaces.</p>
+ <p>It is possible for remote attackers to cause a
+ denial-of-service
+ scenario on Apache 2.0.52 and earlier by sending an HTTP
+ GET request with a MIME header containing multiple lines
+ full of whitespaces.</p>
</body>
- </description>
- <references>
- <cvename>CVE-2004-0942</cvename>
- <mlist msgid="a62f45480411010157571febcc.mail@gmail.com">http://marc.theaimsgroup.com/?l=full-disclosure&amp;m=109930632317208</mlist>
- </references>
- <dates>
- <discovery>2004-11-01</discovery>
- <entry>2004-11-10</entry>
+ </description> <references>
+ <cvename>CVE-2004-0942</cvename> <mlist
+ msgid="a62f45480411010157571febcc.mail@gmail.com">http://marc.theaimsgroup.com/?l=full-disclosure&amp;m=109930632317208</mlist>
+ </references> <dates>
+ <discovery>2004-11-01</discovery> <entry>2004-11-10</entry>
<modified>2004-11-11</modified>
</dates>
</vuln>
<vuln vid="f3017ce1-32a4-11d9-a9e7-0001020eed82">
- <topic>socat -- format string vulnerability</topic>
- <affects>
+ <topic>socat -- format string vulnerability</topic> <affects>
<package>
- <name>socat</name>
- <range><lt>1.4.0.3</lt></range>
+ <name>socat</name> <range><lt>1.4.0.3</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>Socat Security Advisory 1 states:</p>
- <blockquote cite="http://www.dest-unreach.org/socat/advisory/socat-adv-1.html">
+ <p>Socat Security Advisory 1 states:</p> <blockquote
+ cite="http://www.dest-unreach.org/socat/advisory/socat-adv-1.html">
<p>socat up to version 1.4.0.2 contains a syslog() based
format string vulnerability. This issue was originally
reported by CoKi on 19 Oct.2004 <a
href="http://www.nosystem.com.ar/advisories/advisory-07.txt">http://www.nosystem.com.ar/advisories/advisory-07.txt</a>.
- Further investigation showed that this vulnerability could
- under some circumstances lead to local or remote execution
- of arbitrary code with the privileges of the socat
- process.</p>
+ Further investigation showed that this vulnerability
+ could under some circumstances lead to local or remote
+ execution of arbitrary code with the privileges of the
+ socat process.</p>
</blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<url>http://www.dest-unreach.org/socat/advisory/socat-adv-1.html</url>
<url>http://www.nosystem.com.ar/advisories/advisory-07.txt</url>
- </references>
- <dates>
- <discovery>2004-10-18</discovery>
- <entry>2004-11-10</entry>
+ </references> <dates>
+ <discovery>2004-10-18</discovery> <entry>2004-11-10</entry>
</dates>
</vuln>
<vuln vid="9ff4c91e-328c-11d9-a9e7-0001020eed82">
- <topic>libxml -- remote buffer overflows</topic>
- <affects>
+ <topic>libxml -- remote buffer overflows</topic> <affects>
<package>
- <name>libxml</name>
- <range><lt>1.8.17_3</lt></range>
+ <name>libxml</name> <range><lt>1.8.17_3</lt></range>
+ </package> <package>
+ <name>libxml2</name> <range><lt>2.6.15</lt></range>
</package>
- <package>
- <name>libxml2</name>
- <range><lt>2.6.15</lt></range>
- </package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p><q>infamous41md</q> reports that libxml contains multiple
buffer overflows in the URL parsing and DNS name resolving
- functions. These vulnerabilities could lead to execution of
- arbitrary code.</p>
+ functions. These vulnerabilities could lead to execution
+ of arbitrary code.</p>
</body>
- </description>
- <references>
- <cvename>CVE-2004-0989</cvename>
- <bid>11526</bid>
- <mlist msgid="20041025205132.1f1620a8.infamous41md@hotpop.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=109880813013482</mlist>
+ </description> <references>
+ <cvename>CVE-2004-0989</cvename> <bid>11526</bid> <mlist
+ msgid="20041025205132.1f1620a8.infamous41md@hotpop.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=109880813013482</mlist>
<url>http://www.debian.org/security/2004/dsa-582</url>
- </references>
- <dates>
- <discovery>2004-10-26</discovery>
- <entry>2004-11-09</entry>
+ </references> <dates>
+ <discovery>2004-10-26</discovery> <entry>2004-11-09</entry>
<modified>2004-11-10</modified>
</dates>
</vuln>
<vuln vid="a5742055-300a-11d9-a9e7-0001020eed82">
- <topic>p5-Archive-Zip -- virus detection evasion</topic>
- <affects>
+ <topic>p5-Archive-Zip -- virus detection evasion</topic> <affects>
<package>
- <name>p5-Archive-Zip</name>
- <range><lt>1.14</lt></range>
+ <name>p5-Archive-Zip</name> <range><lt>1.14</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>An AMaViS Security Announcement reports that a
vulnerability exist in the Archive::Zip Perl module which
may lead to bypass of malicious code in anti-virus programs
by creating specially crafted ZIP files.</p>
</body>
- </description>
- <references>
+ </description> <references>
<url>http://www.idefense.com/application/poi/display?id=153&amp;type=vulnerabilities</url>
<url>http://www.amavis.org/security/asa-2004-6.txt</url>
<url>http://rt.cpan.org/NoAuth/Bug.html?id=8077</url>
- </references>
- <dates>
- <discovery>2004-10-18</discovery>
- <entry>2004-11-08</entry>
+ </references> <dates>
+ <discovery>2004-10-18</discovery> <entry>2004-11-08</entry>
</dates>
</vuln>
@@ -13524,53 +11246,36 @@ http_access deny Gopher</pre>
<topic>apache mod_include buffer overflow vulnerability</topic>
<affects>
<package>
- <name>apache</name>
- <range><lt>1.3.33</lt></range>
- </package>
- <package>
- <name>apache+mod_ssl</name>
- <range><lt>1.3.32+2.8.21_1</lt></range>
- </package>
- <package>
+ <name>apache</name> <range><lt>1.3.33</lt></range>
+ </package> <package>
+ <name>apache+mod_ssl</name> <range><lt>1.3.32+2.8.21_1</lt></range>
+ </package> <package>
<name>apache+mod_ssl+ipv6</name>
<range><lt>1.3.32+2.8.21_1</lt></range>
- </package>
- <package>
- <name>apache+mod_perl</name>
- <range><le>1.3.31</le></range>
- </package>
- <package>
- <name>apache+ipv6</name>
- <range><lt>1.3.33</lt></range>
- </package>
- <package>
- <name>apache+ssl</name>
- <range><le>1.3.29.1.55</le></range>
- </package>
- <package>
- <name>ru-apache</name>
- <range><lt>1.3.33+30.21</lt></range>
- </package>
- <package>
+ </package> <package>
+ <name>apache+mod_perl</name> <range><le>1.3.31</le></range>
+ </package> <package>
+ <name>apache+ipv6</name> <range><lt>1.3.33</lt></range>
+ </package> <package>
+ <name>apache+ssl</name> <range><le>1.3.29.1.55</le></range>
+ </package> <package>
+ <name>ru-apache</name> <range><lt>1.3.33+30.21</lt></range>
+ </package> <package>
<name>ru-apache+mod_ssl</name>
<range><lt>1.3.33+30.21+2.8.22</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>There is a buffer overflow in a function used by mod_include
that may enable a local user to gain privileges of a httpd
- child. Only users that are able to create SSI documents can
- take advantage of that vulnerability.</p>
+ child. Only users that are able to create SSI documents
+ can take advantage of that vulnerability.</p>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2004-0940</cvename>
<url>http://www.securitylab.ru/48807.html</url>
- </references>
- <dates>
- <discovery>2004-10-22</discovery>
- <entry>2004-11-06</entry>
+ </references> <dates>
+ <discovery>2004-10-22</discovery> <entry>2004-11-06</entry>
</dates>
</vuln>
@@ -13579,65 +11284,56 @@ http_access deny Gopher</pre>
creation</topic>
<affects>
<package>
- <name>postgresql-contrib</name>
- <range><lt>7.2.6</lt></range>
+ <name>postgresql-contrib</name> <range><lt>7.2.6</lt></range>
<range><gt>7.3.*</gt><lt>7.3.8</lt></range>
<range><gt>7.4.*</gt><lt>7.4.6</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>The make_oidjoins_check script in the PostgreSQL RDBMS has
- insecure handling of temporary files, which could lead to an
- attacker overwriting arbitrary files with the credentials of
- the user running the make_oidjoins_check script.</p>
+ <p>The make_oidjoins_check script in the PostgreSQL RDBMS
+ has
+ insecure handling of temporary files, which could lead
+ to an attacker overwriting arbitrary files with the
+ credentials of the user running the make_oidjoins_check
+ script.</p>
</body>
- </description>
- <references>
- <cvename>CVE-2004-0977</cvename>
- <bid>11295</bid>
+ </description> <references>
+ <cvename>CVE-2004-0977</cvename> <bid>11295</bid>
<url>http://www.postgresql.org/news/234.html</url>
<url>http://www.trustix.net/errata/2004/0050/</url>
- </references>
- <dates>
- <discovery>2004-09-10</discovery>
- <entry>2004-11-06</entry>
+ </references> <dates>
+ <discovery>2004-09-10</discovery> <entry>2004-11-06</entry>
</dates>
</vuln>
<vuln vid="62239968-2f2a-11d9-a9e7-0001020eed82">
- <topic>gd -- integer overflow</topic>
- <affects>
+ <topic>gd -- integer overflow</topic> <affects>
<package>
- <name>gd</name>
- <name>uk-gd</name>
- <name>ja-gd</name>
+ <name>gd</name> <name>uk-gd</name> <name>ja-gd</name>
<range><lt>2.0.29,1</lt></range>
<range><gt>1.*,2</gt><lt>2.*,2</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>infamous41md reports about the GD Graphics Library:</p>
- <blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=109882489302099">
- <p>There is an integer overflow when allocating memory in
- the routine that handles loading PNG image files. This
- later leads to heap data structures being overwritten. If
- an attacker tricked a user into loading a malicious PNG
- image, they could leverage this into executing arbitrary
- code in the context of the user opening image.</p>
- </blockquote>
- </body>
- </description>
- <references>
- <bid>11523</bid>
- <cvename>CVE-2004-0990</cvename>
- <mlist msgid="20041025204303.4341d907.infamous41md@hotpop.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=109882489302099</mlist>
+ <blockquote
+ cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=109882489302099">
+ <p>There is an integer overflow when allocating memory
+ in
+ the routine that handles loading PNG image files. This
+ later leads to heap data structures being overwritten.
+ If an attacker tricked a user into loading a malicious
+ PNG image, they could leverage this into executing
+ arbitrary code in the context of the user opening
+ image.</p>
+ </blockquote>
+ </body>
+ </description> <references>
+ <bid>11523</bid> <cvename>CVE-2004-0990</cvename> <mlist
+ msgid="20041025204303.4341d907.infamous41md@hotpop.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=109882489302099</mlist>
<url>http://www.boutell.com/gd/manual2.0.29.html#whatsnew2.0.29</url>
- </references>
- <dates>
- <discovery>2004-10-26</discovery>
- <entry>2004-11-05</entry>
+ </references> <dates>
+ <discovery>2004-10-26</discovery> <entry>2004-11-05</entry>
</dates>
</vuln>
@@ -13645,76 +11341,65 @@ http_access deny Gopher</pre>
<topic>putty -- buffer overflow vulnerability in ssh2 support</topic>
<affects>
<package>
- <name>putty</name>
- <range><lt>0.56</lt></range>
+ <name>putty</name> <range><lt>0.56</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>There is a bug in SSH2 support that allows a server to execute
- malicious code on a connecting PuTTY client.
- This attack can be performed before host key verification happens,
- so a different machine -- man in the middle attack -- could fake
- the machine you are connecting to.</p>
+ <p>There is a bug in SSH2 support that allows a server to
+ execute
+ malicious code on a connecting PuTTY client. This attack
+ can be performed before host key verification happens,
+ so a different machine -- man in the middle attack --
+ could fake the machine you are connecting to.</p>
</body>
</description>
<references>
- <mlist msgid="1CE07882ECEE894CA2D5A89B8DEBC4010A2DD2@porgy.admin.idefense.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=109890310929207</mlist>
+ <mlist
+ msgid="1CE07882ECEE894CA2D5A89B8DEBC4010A2DD2@porgy.admin.idefense.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=109890310929207</mlist>
<url>http://www.gentoo.org/security/en/glsa/glsa-200410-29.xml</url>
<url>http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-ssh2-debug.html</url>
- </references>
- <dates>
- <discovery>2004-10-26</discovery>
- <entry>2004-11-04</entry>
+ </references> <dates>
+ <discovery>2004-10-26</discovery> <entry>2004-11-04</entry>
<modified>2005-01-19</modified>
</dates>
</vuln>
<vuln vid="e0070221-2dd8-11d9-a9e7-0001020eed82">
- <topic>wzdftpd -- remote DoS</topic>
- <affects>
+ <topic>wzdftpd -- remote DoS</topic> <affects>
<package>
- <name>wzdftpd</name>
- <range><lt>0.4.3</lt></range>
+ <name>wzdftpd</name> <range><lt>0.4.3</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>wzdftpd contains a potential remote Denial-of-Service.</p>
</body>
- </description>
- <references>
+ </description> <references>
<url>http://sourceforge.net/project/shownotes.php?release_id=263573</url>
- </references>
- <dates>
- <discovery>2004-10-28</discovery>
- <entry>2004-11-03</entry>
+ </references> <dates>
+ <discovery>2004-10-28</discovery> <entry>2004-11-03</entry>
</dates>
</vuln>
<vuln vid="1f826757-26be-11d9-ad2d-0050fc56d258">
- <topic>rssh -- format string vulnerability</topic>
- <affects>
+ <topic>rssh -- format string vulnerability</topic> <affects>
<package>
- <name>rssh</name>
- <range><le>2.2.1</le></range>
+ <name>rssh</name> <range><le>2.2.1</le></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>There is a format string bug in rssh that enables an attacker
- to execute arbitrary code from an account configured to use
- rssh. On FreeBSD it is only possible to compromise the rssh
- running account, not root.</p>
+ <p>There is a format string bug in rssh that enables an
+ attacker
+ to execute arbitrary code from an account configured to
+ use rssh. On FreeBSD it is only possible to compromise
+ the rssh running account, not root.</p>
</body>
- </description>
- <references>
+ </description> <references>
<url>http://www.pizzashack.org/rssh/security.shtml</url>
- <mlist msgid="20041023084829.GA16819@sophic.org">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=109855982425122</mlist>
+ <mlist
+ msgid="20041023084829.GA16819@sophic.org">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=109855982425122</mlist>
</references>
<dates>
- <discovery>2004-10-23</discovery>
- <entry>2004-10-25</entry>
+ <discovery>2004-10-23</discovery> <entry>2004-10-25</entry>
</dates>
</vuln>
@@ -13723,107 +11408,87 @@ http_access deny Gopher</pre>
window</topic>
<affects>
<package>
- <name>horde</name>
- <name>horde-devel</name>
- <range><lt>2.2.7</lt></range>
+ <name>horde</name> <name>horde-devel</name>
+ <range><lt>2.2.7</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>A Horde Team announcement states that a potential cross-site
+ <p>A Horde Team announcement states that a potential
+ cross-site
scripting vulnerability in the help window has been
- corrected. The vulnerability appears to involve the handling
- of the <code>topic</code> and <code>module</code> parameters
- of the help window template.</p>
+ corrected. The vulnerability appears to involve the
+ handling of the <code>topic</code> and <code>module</code>
+ parameters of the help window template.</p>
</body>
- </description>
- <references>
- <mlist msgid="20041026115303.10FBEC046E@neo.wg.de">http://marc.theaimsgroup.com/?l=horde-announce&amp;m=109879164718625</mlist>
- </references>
- <dates>
- <discovery>2004-10-06</discovery>
- <entry>2004-10-27</entry>
+ </description> <references>
+ <mlist
+ msgid="20041026115303.10FBEC046E@neo.wg.de">http://marc.theaimsgroup.com/?l=horde-announce&amp;m=109879164718625</mlist>
+ </references> <dates>
+ <discovery>2004-10-06</discovery> <entry>2004-10-27</entry>
</dates>
</vuln>
<vuln vid="f4428842-a583-4a4c-89b7-297c3459a1c3">
- <topic>bogofilter -- RFC 2047 decoder denial-of-service vulnerability</topic>
- <affects>
+ <topic>bogofilter -- RFC 2047 decoder denial-of-service
+ vulnerability</topic> <affects>
<package>
- <name>bogofilter</name>
- <name>bogofilter-qdbm</name>
- <name>bogofilter-tdb</name>
- <name>ru-bogofilter</name>
+ <name>bogofilter</name> <name>bogofilter-qdbm</name>
+ <name>bogofilter-tdb</name> <name>ru-bogofilter</name>
<range><ge>0.17.4</ge><lt>0.92.8</lt></range>
</package>
- </affects>
- <description>
- <body xmlns="http://www.w3.org/1999/xhtml">
- <p>The bogofilter team has been provided with a test case of a
- malformatted (non-conformant) RFC-2047 encoded word that can cause
- bogofilter versions 0.92.7 and prior to try to write a NUL byte into
- a memory location that is either one byte past the end of a flex
- buffer or to a location that is the negative of the encoded word's
- start of payload data, causing a segmentation fault.</p>
- </body>
- </description>
- <references>
- <freebsdpr>73144</freebsdpr>
- <cvename>CVE-2004-1007</cvename>
- <mlist msgid="20041008143604.GA14934@scowler.net">http://article.gmane.org/gmane.mail.bogofilter.devel/3308</mlist>
- <mlist msgid="m3r7o892vj.fsf@merlin.emma.line.org">http://article.gmane.org/gmane.mail.bogofilter.devel/3317</mlist>
+ </affects> <description>
+ <body xmlns="http://www.w3.org/1999/xhtml">
+ <p>The bogofilter team has been provided with a test case
+ of a
+ malformatted (non-conformant) RFC-2047 encoded word that
+ can cause bogofilter versions 0.92.7 and prior to try
+ to write a NUL byte into a memory location that is either
+ one byte past the end of a flex buffer or to a location
+ that is the negative of the encoded word's start of
+ payload data, causing a segmentation fault.</p>
+ </body>
+ </description> <references>
+ <freebsdpr>73144</freebsdpr> <cvename>CVE-2004-1007</cvename>
+ <mlist
+ msgid="20041008143604.GA14934@scowler.net">http://article.gmane.org/gmane.mail.bogofilter.devel/3308</mlist>
+ <mlist
+ msgid="m3r7o892vj.fsf@merlin.emma.line.org">http://article.gmane.org/gmane.mail.bogofilter.devel/3317</mlist>
<url>http://bugs.debian.org/275373</url>
<url>http://bogofilter.sourceforge.net/security/bogofilter-SA-2004-01</url>
- </references>
- <dates>
- <discovery>2004-10-09</discovery>
- <entry>2004-10-26</entry>
+ </references> <dates>
+ <discovery>2004-10-09</discovery> <entry>2004-10-26</entry>
<modified>2004-11-03</modified>
</dates>
</vuln>
<vuln vid="ad2f3337-26bf-11d9-9289-000c41e2cdad">
- <topic>xpdf -- integer overflow vulnerabilities</topic>
- <affects>
+ <topic>xpdf -- integer overflow vulnerabilities</topic> <affects>
<package>
- <name>gpdf</name>
- <name>cups-base</name>
+ <name>gpdf</name> <name>cups-base</name>
<range><lt>1.1.22.0</lt></range>
+ </package> <package>
+ <name>xpdf</name> <range><lt>3.00_4</lt></range>
+ </package> <package>
+ <name>kdegraphics</name> <range><lt>3.3.0_1</lt></range>
+ </package> <package>
+ <name>koffice</name> <range><lt>1.3.2_1,1</lt></range>
+ </package> <package>
+ <name>teTeX-base</name> <range><lt>2.0.2_4</lt></range>
</package>
- <package>
- <name>xpdf</name>
- <range><lt>3.00_4</lt></range>
- </package>
- <package>
- <name>kdegraphics</name>
- <range><lt>3.3.0_1</lt></range>
- </package>
- <package>
- <name>koffice</name>
- <range><lt>1.3.2_1,1</lt></range>
- </package>
- <package>
- <name>teTeX-base</name>
- <range><lt>2.0.2_4</lt></range>
- </package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chris Evans discovered several integer arithmetic overflows
- in the xpdf 2 and xpdf 3 code bases. The flaws have impacts
- ranging from denial-of-service to arbitrary code execution.</p>
+ in the xpdf 2 and xpdf 3 code bases. The flaws have
+ impacts ranging from denial-of-service to arbitrary code
+ execution.</p>
</body>
- </description>
- <references>
- <cvename>CVE-2004-0888</cvename>
- <cvename>CVE-2004-0889</cvename>
+ </description> <references>
+ <cvename>CVE-2004-0888</cvename> <cvename>CVE-2004-0889</cvename>
<url>http://scary.beasts.org/security/CESA-2004-002.txt</url>
<url>http://scary.beasts.org/security/CESA-2004-007.txt</url>
<url>http://www.kde.org/info/security/advisory-20041021-1.txt</url>
- </references>
- <dates>
- <discovery>2004-10-21</discovery>
- <entry>2004-10-25</entry>
+ </references> <dates>
+ <discovery>2004-10-21</discovery> <entry>2004-10-25</entry>
</dates>
</vuln>
@@ -13831,101 +11496,80 @@ http_access deny Gopher</pre>
<topic>gaim -- MSN denial-of-service vulnerabilities</topic>
<affects>
<package>
- <name>gaim</name>
- <name>ja-gaim</name>
- <name>ko-gaim</name>
- <name>ru-gaim</name>
- <range><lt>1.0.2</lt></range>
- </package>
- <package>
- <name>gaim</name>
- <range><gt>20030000</gt></range>
+ <name>gaim</name> <name>ja-gaim</name> <name>ko-gaim</name>
+ <name>ru-gaim</name> <range><lt>1.0.2</lt></range>
+ </package> <package>
+ <name>gaim</name> <range><gt>20030000</gt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>The Gaim team discovered denial-of-service vulnerabilities in
+ <p>The Gaim team discovered denial-of-service vulnerabilities
+ in
the MSN protocol handler:</p>
<blockquote cite="http://gaim.sourceforge.net/security/?id=7">
- <p>After accepting a file transfer request, Gaim will attempt
- to allocate a buffer of a size equal to the entire filesize,
- this allocation attempt will cause Gaim to crash if the size
- exceeds the amount of available memory.</p>
- </blockquote>
- <blockquote cite="http://gaim.sourceforge.net/security/?id=8">
+ <p>After accepting a file transfer request, Gaim will
+ attempt
+ to allocate a buffer of a size equal to the entire
+ filesize, this allocation attempt will cause Gaim to
+ crash if the size exceeds the amount of available
+ memory.</p>
+ </blockquote> <blockquote
+ cite="http://gaim.sourceforge.net/security/?id=8">
<p>Gaim allocates a buffer for the payload of each message
received based on the size field in the header of the
- message. A malicious peer could specify an invalid size that
- exceeds the amount of available memory.</p>
+ message. A malicious peer could specify an invalid size
+ that exceeds the amount of available memory.</p>
</blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<url>http://gaim.sourceforge.net/security/?id=7</url>
<url>http://gaim.sourceforge.net/security/?id=8</url>
- </references>
- <dates>
- <discovery>2004-10-19</discovery>
- <entry>2004-10-25</entry>
+ </references> <dates>
+ <discovery>2004-10-19</discovery> <entry>2004-10-25</entry>
</dates>
</vuln>
<vuln vid="ad61657d-26b9-11d9-9289-000c41e2cdad">
- <topic>gaim -- Content-Length header denial-of-service vulnerability</topic>
- <affects>
- <package>
- <name>gaim</name>
- <name>ja-gaim</name>
- <name>ko-gaim</name>
- <name>ru-gaim</name>
- <range><lt>0.82</lt></range>
- </package>
+ <topic>gaim -- Content-Length header denial-of-service
+ vulnerability</topic> <affects>
<package>
- <name>gaim</name>
- <range><gt>20030000</gt></range>
+ <name>gaim</name> <name>ja-gaim</name> <name>ko-gaim</name>
+ <name>ru-gaim</name> <range><lt>0.82</lt></range>
+ </package> <package>
+ <name>gaim</name> <range><gt>20030000</gt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>Sean <q>infamous42md</q> reports:</p>
- <blockquote cite="http://gaim.sourceforge.net/security/?id=6">
+ <p>Sean <q>infamous42md</q> reports:</p> <blockquote
+ cite="http://gaim.sourceforge.net/security/?id=6">
<p>When a remote server provides a large "content-length"
- header value, Gaim will attempt to allocate a buffer to
- store the content, however this allocation attempt will
- cause Gaim to crash if the length exceeds the amount of
- possible memory. This happens when reading profile
- information on some protocols. It also happens when smiley
- themes are installed via drag and drop.</p>
+ header value, Gaim will attempt to allocate a buffer
+ to store the content, however this allocation attempt
+ will cause Gaim to crash if the length exceeds the
+ amount of possible memory. This happens when reading
+ profile information on some protocols. It also happens
+ when smiley themes are installed via drag and drop.</p>
</blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<url>http://gaim.sourceforge.net/security/?id=6</url>
- </references>
- <dates>
- <discovery>2004-08-26</discovery>
- <entry>2004-10-25</entry>
+ </references> <dates>
+ <discovery>2004-08-26</discovery> <entry>2004-10-25</entry>
</dates>
</vuln>
<vuln vid="4260eacb-26b8-11d9-9289-000c41e2cdad">
- <topic>gaim -- multiple buffer overflows</topic>
- <affects>
+ <topic>gaim -- multiple buffer overflows</topic> <affects>
<package>
- <name>gaim</name>
- <name>ja-gaim</name>
- <name>ko-gaim</name>
- <name>ru-gaim</name>
- <range><lt>0.82</lt></range>
+ <name>gaim</name> <name>ja-gaim</name> <name>ko-gaim</name>
+ <name>ru-gaim</name> <range><lt>0.82</lt></range>
+ </package> <package>
+ <name>gaim</name> <range><gt>20030000</gt></range>
</package>
- <package>
- <name>gaim</name>
- <range><gt>20030000</gt></range>
- </package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>Sean <q>infamous42md</q> reports several situations in gaim
+ <p>Sean <q>infamous42md</q> reports several situations in
+ gaim
that may result in exploitable buffer overflows:</p>
<ul>
<li>Rich Text Format (RTF) messages in Novell GroupWise
@@ -13934,16 +11578,13 @@ http_access deny Gopher</pre>
<li>URLs which are over 2048 bytes long once decoded</li>
</ul>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2004-0785</cvename>
<url>http://gaim.sourceforge.net/security/?id=3</url>
<url>http://gaim.sourceforge.net/security/?id=4</url>
<url>http://gaim.sourceforge.net/security/?id=5</url>
- </references>
- <dates>
- <discovery>2004-08-26</discovery>
- <entry>2004-10-25</entry>
+ </references> <dates>
+ <discovery>2004-08-26</discovery> <entry>2004-10-25</entry>
</dates>
</vuln>
@@ -13952,72 +11593,53 @@ http_access deny Gopher</pre>
server</topic>
<affects>
<package>
- <name>gaim</name>
- <name>ja-gaim</name>
- <name>ko-gaim</name>
- <name>ru-gaim</name>
- <range><lt>0.82</lt></range>
+ <name>gaim</name> <name>ja-gaim</name> <name>ko-gaim</name>
+ <name>ru-gaim</name> <range><lt>0.82</lt></range>
+ </package> <package>
+ <name>gaim</name> <range><gt>20030000</gt></range>
</package>
- <package>
- <name>gaim</name>
- <range><gt>20030000</gt></range>
- </package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>Sean <q>infamous42md</q> reports that a malicous GroupWise
- messaging server may be able to exploit a heap buffer
- overflow in gaim, leading to arbitrary code execution.</p>
+ <p>Sean <q>infamous42md</q> reports that a malicous GroupWise
+ messaging server may be able to exploit a heap buffer
+ overflow in gaim, leading to arbitrary code execution.</p>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2004-0754</cvename>
<url>http://gaim.sourceforge.net/security/?id=2</url>
- </references>
- <dates>
- <discovery>2004-08-26</discovery>
- <entry>2004-10-25</entry>
+ </references> <dates>
+ <discovery>2004-08-26</discovery> <entry>2004-10-25</entry>
</dates>
</vuln>
<vuln vid="635bf5f4-26b7-11d9-9289-000c41e2cdad">
- <topic>gaim -- malicious smiley themes</topic>
- <affects>
+ <topic>gaim -- malicious smiley themes</topic> <affects>
<package>
- <name>gaim</name>
- <name>ja-gaim</name>
- <name>ko-gaim</name>
- <name>ru-gaim</name>
- <range><lt>0.82</lt></range>
+ <name>gaim</name> <name>ja-gaim</name> <name>ko-gaim</name>
+ <name>ru-gaim</name> <range><lt>0.82</lt></range>
+ </package> <package>
+ <name>gaim</name> <range><gt>20030000</gt></range>
</package>
- <package>
- <name>gaim</name>
- <range><gt>20030000</gt></range>
- </package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Gaim Security Issues page documents a problem with
installing smiley themes from an untrusted source:</p>
<blockquote cite="http://gaim.sourceforge.net/security/?id=1">
<p>To install a new smiley theme, a user can drag a tarball
- from a graphical file manager, or a hypertext link to one
- from a web browser. When a tarball is dragged, Gaim executes
- a shell command to untar it. However, it does not escape the
- filename before sending it to the shell. Thus, a specially
- crafted filename could execute arbitrary commands if the
- user could be convinced to drag a file into the smiley theme
- selector.</p>
+ from a graphical file manager, or a hypertext link to
+ one from a web browser. When a tarball is dragged, Gaim
+ executes a shell command to untar it. However, it does
+ not escape the filename before sending it to the shell.
+ Thus, a specially crafted filename could execute arbitrary
+ commands if the user could be convinced to drag a file
+ into the smiley theme selector.</p>
</blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2004-0784</cvename>
<url>http://gaim.sourceforge.net/security/?id=1</url>
- </references>
- <dates>
- <discovery>2004-08-22</discovery>
- <entry>2004-10-25</entry>
+ </references> <dates>
+ <discovery>2004-08-22</discovery> <entry>2004-10-25</entry>
</dates>
</vuln>
@@ -14025,146 +11647,117 @@ http_access deny Gopher</pre>
<topic>gaim -- buffer overflow in MSN protocol support</topic>
<affects>
<package>
- <name>gaim</name>
- <name>ja-gaim</name>
- <name>ru-gaim</name>
+ <name>gaim</name> <name>ja-gaim</name> <name>ru-gaim</name>
<range><ge>0.79</ge><le>1.0.1</le></range>
+ </package> <package>
+ <name>gaim</name> <range><gt>20030000</gt></range>
</package>
- <package>
- <name>gaim</name>
- <range><gt>20030000</gt></range>
- </package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Due to a buffer overflow in the MSN protocol support for
- gaim 0.79 to 1.0.1, it is possible for remote clients to do a
- denial-of-service attack on the application.
- This is caused by an unbounded copy operation, which writes
+ gaim 0.79 to 1.0.1, it is possible for remote clients to
+ do a denial-of-service attack on the application. This
+ is caused by an unbounded copy operation, which writes
to the wrong buffer.</p>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2004-0891</cvename>
<url>http://gaim.sourceforge.net/security/?id=9</url>
- </references>
- <dates>
- <discovery>2004-10-19</discovery>
- <entry>2004-10-25</entry>
+ </references> <dates>
+ <discovery>2004-10-19</discovery> <entry>2004-10-25</entry>
</dates>
</vuln>
<vuln vid="4238151d-207a-11d9-bfe2-0090962cff2a">
- <topic>mod_ssl -- SSLCipherSuite bypass</topic>
- <affects>
+ <topic>mod_ssl -- SSLCipherSuite bypass</topic> <affects>
<package>
<name>ru-apache+mod_ssl</name>
<range><le>1.3.31+30.20+2.8.18</le></range>
- </package>
- <package>
- <name>apache+mod_ssl</name>
- <range><lt>1.3.31+2.8.20</lt></range>
- </package>
- <package>
+ </package> <package>
+ <name>apache+mod_ssl</name> <range><lt>1.3.31+2.8.20</lt></range>
+ </package> <package>
<name>apache+mod_ssl+ipv6</name>
<range><le>1.3.31+2.8.18_4</le></range>
+ </package> <package>
+ <name>apache2</name> <range><le>2.0.52_1</le></range>
</package>
- <package>
- <name>apache2</name>
- <range><le>2.0.52_1</le></range>
- </package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>It is possible for clients to use any cipher suite configured by
- the virtual host, whether or not a certain cipher suite is selected
- for a specific directory. This might result in clients using a
- weaker encryption than originally configured.</p>
+ <p>It is possible for clients to use any cipher suite
+ configured by
+ the virtual host, whether or not a certain cipher suite
+ is selected for a specific directory. This might result
+ in clients using a weaker encryption than originally
+ configured.</p>
</body>
- </description>
- <references>
- <cvename>CVE-2004-0885</cvename>
- <mlist msgid="20041008152510.GE8385@redhat.com">http://marc.theaimsgroup.com/?l=apache-modssl&amp;m=109724918128044</mlist>
+ </description> <references>
+ <cvename>CVE-2004-0885</cvename> <mlist
+ msgid="20041008152510.GE8385@redhat.com">http://marc.theaimsgroup.com/?l=apache-modssl&amp;m=109724918128044</mlist>
<url>http://issues.apache.org/bugzilla/show_bug.cgi?id=31505</url>
- </references>
- <dates>
- <discovery>2004-10-01</discovery>
- <entry>2004-10-23</entry>
+ </references> <dates>
+ <discovery>2004-10-01</discovery> <entry>2004-10-23</entry>
</dates>
</vuln>
<vuln vid="20d16518-2477-11d9-814e-0001020eed82">
- <topic>mpg123 -- buffer overflow in URL handling</topic>
- <affects>
+ <topic>mpg123 -- buffer overflow in URL handling</topic> <affects>
<package>
- <name>mpg123</name>
- <name>mpg123-nas</name>
- <name>mpg123-esound</name>
- <range><lt>0.59r_15</lt></range>
+ <name>mpg123</name> <name>mpg123-nas</name>
+ <name>mpg123-esound</name> <range><lt>0.59r_15</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Carlos Barros reports that mpg123 contains two buffer
- overflows. These vulnerabilities can potentially lead to
- execution of arbitrary code.</p>
- <p>The first buffer overflow can occur when mpg123 parses a
+ overflows. These vulnerabilities can potentially lead
+ to execution of arbitrary code.</p>
+ <p>The first buffer overflow can occur when mpg123 parses
+ a
URL with a user-name/password field that is more than 256
characters long. This problem can be triggered either
- locally or remotely via a specially crafted play list. The
- second potential buffer overflow may be triggered locally by
- a specially crafted symlink to the mpg123 binary. This
- problem is not as serious, since mpg123 is not installed
- setuid by default.</p>
- </body>
- </description>
- <references>
- <bid>11468</bid>
- <cvename>CVE-2004-0982</cvename>
- <mlist msgid="200410200119.42801.barros@barrossecurity.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=109834486312407</mlist>
- </references>
- <dates>
- <discovery>2004-10-02</discovery>
- <entry>2004-10-23</entry>
+ locally or remotely via a specially crafted play list.
+ The second potential buffer overflow may be triggered
+ locally by a specially crafted symlink to the mpg123
+ binary. This problem is not as serious, since mpg123 is
+ not installed setuid by default.</p>
+ </body>
+ </description> <references>
+ <bid>11468</bid> <cvename>CVE-2004-0982</cvename> <mlist
+ msgid="200410200119.42801.barros@barrossecurity.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=109834486312407</mlist>
+ </references> <dates>
+ <discovery>2004-10-02</discovery> <entry>2004-10-23</entry>
<modified>2004-12-30</modified>
</dates>
</vuln>
<vuln vid="7b81fc47-239f-11d9-814e-0001020eed82">
- <topic>apache2 -- SSL remote DoS</topic>
- <affects>
+ <topic>apache2 -- SSL remote DoS</topic> <affects>
<package>
- <name>apache</name>
- <range><gt>2.0</gt><lt>2.0.51</lt></range>
+ <name>apache</name> <range><gt>2.0</gt><lt>2.0.51</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>The Apache HTTP Server 2.0.51 release notes report that the
+ <p>The Apache HTTP Server 2.0.51 release notes report that
+ the
following issues have been fixed:</p>
- <blockquote cite="http://marc.theaimsgroup.com/?l=apache-httpd-announce&amp;m=109527608022322">
+ <blockquote
+ cite="http://marc.theaimsgroup.com/?l=apache-httpd-announce&amp;m=109527608022322">
<p>A segfault in mod_ssl which can be triggered by a
- malicious remote server, if proxying to SSL servers has
- been configured. [CAN-2004-0751]</p>
+ malicious remote server, if proxying to SSL servers has
+ been configured. [CAN-2004-0751]</p>
<p>A potential infinite loop in mod_ssl which could be
- triggered given particular timing of a connection
- abort. [CAN-2004-0748]</p>
+ triggered given particular timing of a connection abort.
+ [CAN-2004-0748]</p>
</blockquote>
</body>
- </description>
- <references>
- <bid>11094</bid>
- <bid>11154</bid>
- <cvename>CVE-2004-0748</cvename>
- <cvename>CVE-2004-0751</cvename>
- <mlist msgid="029f01c49b54$dec30f20$1500a8c0@Cougar">http://marc.theaimsgroup.com/?l=apache-httpd-announce&amp;m=109527608022322</mlist>
+ </description> <references>
+ <bid>11094</bid> <bid>11154</bid> <cvename>CVE-2004-0748</cvename>
+ <cvename>CVE-2004-0751</cvename> <mlist
+ msgid="029f01c49b54$dec30f20$1500a8c0@Cougar">http://marc.theaimsgroup.com/?l=apache-httpd-announce&amp;m=109527608022322</mlist>
<url>http://nagoya.apache.org/bugzilla/show_bug.cgi?id=29964</url>
<url>http://nagoya.apache.org/bugzilla/show_bug.cgi?id=30134</url>
- </references>
- <dates>
- <discovery>2004-07-07</discovery>
- <entry>2004-10-21</entry>
+ </references> <dates>
+ <discovery>2004-07-07</discovery> <entry>2004-10-21</entry>
</dates>
</vuln>
@@ -14173,55 +11766,44 @@ http_access deny Gopher</pre>
vulnerability</topic>
<affects>
<package>
- <name>phpMyAdmin</name>
- <name>phpmyadmin</name>
+ <name>phpMyAdmin</name> <name>phpmyadmin</name>
<range><lt>2.6.0.2</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>From the phpMyAdmin 2.6.0p2 release notes:</p>
- <blockquote cite="http://sourceforge.net/project/shownotes.php?release_id=274709">
+ <p>From the phpMyAdmin 2.6.0p2 release notes:</p> <blockquote
+ cite="http://sourceforge.net/project/shownotes.php?release_id=274709">
<p>If PHP is not running in safe mode, a problem in the
MIME-based transformation system (with an "external"
transformation) allows to execute any command with the
privileges of the web server's user.</p>
</blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<bid>11391</bid>
<url>http://sourceforge.net/project/shownotes.php?release_id=274709</url>
<url>http://sourceforge.net/tracker/index.php?func=detail&amp;aid=1044864&amp;group_id=23067&amp;atid=377408</url>
- </references>
- <dates>
- <discovery>2004-10-11</discovery>
- <entry>2004-10-20</entry>
+ </references> <dates>
+ <discovery>2004-10-11</discovery> <entry>2004-10-20</entry>
</dates>
</vuln>
<vuln vid="61480a9a-22b2-11d9-814e-0001020eed82">
- <topic>cabextract -- insecure directory handling</topic>
- <affects>
+ <topic>cabextract -- insecure directory handling</topic> <affects>
<package>
- <name>cabextract</name>
- <range><lt>1.1</lt></range>
+ <name>cabextract</name> <range><lt>1.1</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>cabextract has insufficient checks for file names that
- contain <q>../</q>. This can cause files to be extracted to
- the parent directory.</p>
+ contain <q>../</q>. This can cause files to be extracted
+ to the parent directory.</p>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2004-0916</cvename>
<url>http://www.kyz.uklinux.net/cabextract.php#changes</url>
- </references>
- <dates>
- <discovery>2004-10-18</discovery>
- <entry>2004-10-20</entry>
+ </references> <dates>
+ <discovery>2004-10-18</discovery> <entry>2004-10-20</entry>
<modified>2004-10-22</modified>
</dates>
</vuln>
@@ -14230,111 +11812,90 @@ http_access deny Gopher</pre>
<topic>a2ps -- insecure command line argument handling</topic>
<affects>
<package>
- <name>a2ps-a4</name>
- <range><lt>4.13b_2</lt></range>
+ <name>a2ps-a4</name> <range><lt>4.13b_2</lt></range>
+ </package> <package>
+ <name>a2ps-letter</name> <range><lt>4.13b_2</lt></range>
+ </package> <package>
+ <name>a2ps-letterdj</name> <range><lt>4.13b_2</lt></range>
</package>
- <package>
- <name>a2ps-letter</name>
- <range><lt>4.13b_2</lt></range>
- </package>
- <package>
- <name>a2ps-letterdj</name>
- <range><lt>4.13b_2</lt></range>
- </package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>Rudolf Polzer reports:</p>
- <blockquote cite="http://www.freebsd.org/cgi/query-pr.cgi?pr=ports/70618">
+ <p>Rudolf Polzer reports:</p> <blockquote
+ cite="http://www.freebsd.org/cgi/query-pr.cgi?pr=ports/70618">
<p>a2ps builds a command line for file() containing an
unescaped version of the file name, thus might call
- external programs described by the file name. Running a
- cronjob over a public writable directory a2ps-ing all
- files in it - or simply typing "a2ps *.txt" in /tmp - is
- therefore dangerous.</p>
- </blockquote>
- </body>
- </description>
- <references>
- <cvename>CVE-2004-1170</cvename>
- <freebsdpr>ports/70618</freebsdpr>
- <bid>11025</bid>
- <url>http://www.osvdb.org/9176</url>
- <mlist msgid="e5312d6a040824040119840c7c@mail.gmail.com">http://marc.theaimsgroup.com/?l=full-disclosure&amp;m=109334851517137</mlist>
- </references>
- <dates>
- <discovery>2004-08-18</discovery>
- <entry>2004-10-20</entry>
+ external programs described by the file name. Running
+ a cronjob over a public writable directory a2ps-ing all
+ files in it - or simply typing "a2ps *.txt" in /tmp -
+ is therefore dangerous.</p>
+ </blockquote>
+ </body>
+ </description> <references>
+ <cvename>CVE-2004-1170</cvename> <freebsdpr>ports/70618</freebsdpr>
+ <bid>11025</bid> <url>http://www.osvdb.org/9176</url> <mlist
+ msgid="e5312d6a040824040119840c7c@mail.gmail.com">http://marc.theaimsgroup.com/?l=full-disclosure&amp;m=109334851517137</mlist>
+ </references> <dates>
+ <discovery>2004-08-18</discovery> <entry>2004-10-20</entry>
<modified>2004-12-30</modified>
</dates>
</vuln>
<vuln vid="746ca1ac-21ec-11d9-9289-000c41e2cdad">
- <topic>ifmail -- unsafe set-user-ID application</topic>
- <affects>
+ <topic>ifmail -- unsafe set-user-ID application</topic> <affects>
<package>
- <name>ifmail</name>
- <range><le>ifmail-2.15_4</le></range>
+ <name>ifmail</name> <range><le>ifmail-2.15_4</le></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Niels Heinen reports that ifmail allows one to specify
- a configuration file. Since ifmail runs set-user-ID `news',
- this may allow a local attacker to write to arbitrary files
- or execute arbitrary commands as the `news' user.</p>
+ a configuration file. Since ifmail runs set-user-ID
+ `news', this may allow a local attacker to write to
+ arbitrary files or execute arbitrary commands as the
+ `news' user.</p>
</body>
- </description>
- <references>
+ </description> <references>
<url>http://cvsweb.freebsd.org/ports/news/ifmail</url>
- </references>
- <dates>
- <discovery>2004-08-23</discovery>
- <entry>2004-10-19</entry>
+ </references> <dates>
+ <discovery>2004-08-23</discovery> <entry>2004-10-19</entry>
</dates>
</vuln>
<vuln vid="e31d44a2-21e3-11d9-9289-000c41e2cdad">
- <topic>imwheel -- insecure handling of PID file</topic>
- <affects>
+ <topic>imwheel -- insecure handling of PID file</topic> <affects>
<package>
- <name>imwheel</name>
- <range><lt>1.0.0.p12</lt></range>
+ <name>imwheel</name> <range><lt>1.0.0.p12</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Computer Academic Underground advisory describes the
- consequences of imwheel's handling of the process ID file (PID
- file):</p>
+ consequences of imwheel's handling of the process ID file
+ (PID file):</p>
<blockquote
cite="http://www.caughq.org/advisories/CAU-2004-0002.txt">
- <p>imwheel exclusively uses a predictably named PID file for
- management of multiple imwheel processes. A race condition
- exists when the -k command-line option is used to kill
- existing imwheel processes. This race condition may be
- used by a local user to Denial of Service another user
- using imwheel, lead to resource exhaustion of the host
- system, or append data to arbitrary files.</p>
+ <p>imwheel exclusively uses a predictably named PID file
+ for
+ management of multiple imwheel processes. A race condition
+ exists when the -k command-line option is used to kill
+ existing imwheel processes. This race condition may be
+ used by a local user to Denial of Service another user
+ using imwheel, lead to resource exhaustion of the host
+ system, or append data to arbitrary files.</p>
</blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<url>http://www.caughq.org/advisories/CAU-2004-0002.txt</url>
<url>http://imwheel.sourceforge.net/files/DEVELOPMENT.txt</url>
- </references>
- <dates>
- <discovery>2004-08-20</discovery>
- <entry>2004-10-19</entry>
+ </references> <dates>
+ <discovery>2004-08-20</discovery> <entry>2004-10-19</entry>
</dates>
</vuln>
<vuln vid="064225c5-1f53-11d9-836a-0090962cff2a">
- <topic>squid -- NTLM authentication denial-of-service vulnerability</topic>
+ <topic>squid -- NTLM authentication denial-of-service
+ vulnerability</topic>
<affects>
<package>
- <name>squid</name>
- <range><lt>2.5.7</lt></range>
+ <name>squid</name> <range><lt>2.5.7</lt></range>
</package>
</affects>
<description>
@@ -14343,41 +11904,35 @@ http_access deny Gopher</pre>
situation, when NTLM authentication is enabled in squid.
NTLM authentication uses two functions which lack correct
offset checking.</p>
- </body>
- </description>
+ </body> </description>
<references>
<cvename>CVE-2004-0832</cvename>
<url>http://www.squid-cache.org/bugs/show_bug.cgi?id=1045</url>
</references>
<dates>
- <discovery>2004-08-18</discovery>
- <entry>2004-08-16</entry>
+ <discovery>2004-08-18</discovery> <entry>2004-08-16</entry>
</dates>
</vuln>
<vuln vid="ca543e06-207a-11d9-814e-0001020eed82">
- <topic>cacti -- SQL injection</topic>
- <affects>
+ <topic>cacti -- SQL injection</topic> <affects>
<package>
- <name>cacti</name>
- <range><lt>0.8.6</lt></range>
+ <name>cacti</name> <range><lt>0.8.6</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>Fernando Quintero reports that Cacti 0.8.5a suffers from a
+ <p>Fernando Quintero reports that Cacti 0.8.5a suffers from
+ a
SQL injection attack where an attacker can change the
- password for any Cacti user. This attack is not possible if
- the PHP option magic_quotes_gpc is set to On, which is the
- default for PHP in FreeBSD.</p>
+ password for any Cacti user. This attack is not possible
+ if the PHP option magic_quotes_gpc is set to On, which
+ is the default for PHP in FreeBSD.</p>
</body>
- </description>
- <references>
- <mlist msgid="1092686621.818.8.camel@mitnick.nadied.org">http://marc.theaimsgroup.com/?l=full-disclosure&amp;m=109269427427368</mlist>
- </references>
- <dates>
- <discovery>2004-08-16</discovery>
- <entry>2004-10-17</entry>
+ </description> <references>
+ <mlist
+ msgid="1092686621.818.8.camel@mitnick.nadied.org">http://marc.theaimsgroup.com/?l=full-disclosure&amp;m=109269427427368</mlist>
+ </references> <dates>
+ <discovery>2004-08-16</discovery> <entry>2004-10-17</entry>
</dates>
</vuln>
@@ -14386,70 +11941,59 @@ http_access deny Gopher</pre>
proxy support</topic>
<affects>
<package>
- <name>apache+mod_ssl</name>
- <range><lt>1.3.31+2.8.19</lt></range>
- </package>
- <package>
+ <name>apache+mod_ssl</name> <range><lt>1.3.31+2.8.19</lt></range>
+ </package> <package>
<name>apache+mod_ssl+ipv6</name>
<range><lt>1.3.31+2.8.19</lt></range>
- </package>
- <package>
+ </package> <package>
<name>ru-apache+mod_ssl</name>
<range><lt>1.3.31+30.20+2.8.19</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>A OpenPKG Security Advisory reports:</p>
- <blockquote cite="http://www.openpkg.org/security/OpenPKG-SA-2004.032-apache.html">
- <p>Triggered by a report to Packet Storm from Virulent, a
+ <p>A OpenPKG Security Advisory reports:</p> <blockquote
+ cite="http://www.openpkg.org/security/OpenPKG-SA-2004.032-apache.html">
+ <p>Triggered by a report to Packet Storm from Virulent,
+ a
format string vulnerability was found in mod_ssl, the
Apache SSL/TLS interface to OpenSSL, version (up to and
including) 2.8.18 for Apache 1.3. The mod_ssl in Apache
2.x is not affected. The vulnerability could be
exploitable if Apache is used as a proxy for HTTPS URLs
- and the attacker established a own specially prepared DNS
- and origin server environment.</p>
+ and the attacker established a own specially prepared
+ DNS and origin server environment.</p>
</blockquote>
</body>
- </description>
- <references>
- <bid>10736</bid>
- <certvu>303448</certvu>
+ </description> <references>
+ <bid>10736</bid> <certvu>303448</certvu>
<cvename>CVE-2004-0700</cvename>
<url>http://www.openpkg.org/security/OpenPKG-SA-2004.032-apache.html</url>
<url>http://packetstormsecurity.org/0407-advisories/modsslFormat.txt</url>
- <mlist msgid="20040716204207.GA45678@engelschall.com">http://marc.theaimsgroup.com/?l=apache-modssl&amp;m=109001100906749</mlist>
- </references>
- <dates>
- <discovery>2004-07-16</discovery>
- <entry>2004-10-17</entry>
+ <mlist
+ msgid="20040716204207.GA45678@engelschall.com">http://marc.theaimsgroup.com/?l=apache-modssl&amp;m=109001100906749</mlist>
+ </references> <dates>
+ <discovery>2004-07-16</discovery> <entry>2004-10-17</entry>
</dates>
</vuln>
<vuln vid="8e2e6ad8-1720-11d9-9fb9-00902788733b">
- <topic>tor -- remote DoS and loss of anonymity</topic>
- <affects>
+ <topic>tor -- remote DoS and loss of anonymity</topic> <affects>
<package>
- <name>tor</name>
- <range><lt>0.0.8.1</lt></range>
+ <name>tor</name> <range><lt>0.0.8.1</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>Tor has various remote crashes which could lead to a remote
+ <p>Tor has various remote crashes which could lead to a
+ remote
denial-of-service and be used to defeat clients anonymity.
- It is not expected that these vulnerabilities are
- exploitable for arbitrary code execution.</p>
+ It is not expected that these vulnerabilities are exploitable
+ for arbitrary code execution.</p>
</body>
- </description>
- <references>
+ </description> <references>
<mlist>http://archives.seul.org/or/announce/Aug-2004/msg00001.html</mlist>
<mlist>http://archives.seul.org/or/announce/Oct-2004/msg00000.html</mlist>
- </references>
- <dates>
- <discovery>2004-08-25</discovery>
- <entry>2004-10-15</entry>
+ </references> <dates>
+ <discovery>2004-08-25</discovery> <entry>2004-10-15</entry>
</dates>
</vuln>
@@ -14457,49 +12001,38 @@ http_access deny Gopher</pre>
<topic>icecast -- Cross-Site Scripting Vulnerability</topic>
<affects>
<package>
- <name>icecast</name>
- <range><lt>1.3.12_2</lt></range>
+ <name>icecast</name> <range><lt>1.3.12_2</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Caused by improper filtering of HTML code in the
- status display, it is possible for a remote user
- to execute scripting code in the target user's
- browser.</p>
+ status display, it is possible for a remote user to execute
+ scripting code in the target user's browser.</p>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2004-0781</cvename>
<url>http://www.securitytracker.com/alerts/2004/Aug/1011047.html</url>
- </references>
- <dates>
- <discovery>2004-08-24</discovery>
- <entry>2004-10-13</entry>
+ </references> <dates>
+ <discovery>2004-08-24</discovery> <entry>2004-10-13</entry>
</dates>
</vuln>
<vuln vid="741c3957-1d69-11d9-a804-0050fc56d258">
- <topic>icecast -- HTTP header overflow</topic>
- <affects>
+ <topic>icecast -- HTTP header overflow</topic> <affects>
<package>
- <name>icecast2</name>
- <range><lt>2.0.2,1</lt></range>
+ <name>icecast2</name> <range><lt>2.0.2,1</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>It is possible to execute remote code simply using
- HTTP request plus 31 headers followed by a shellcode that will be
- executed directly.</p>
+ <p>It is possible to execute remote code simply using HTTP
+ request plus 31 headers followed by a shellcode that will
+ be executed directly.</p>
</body>
- </description>
- <references>
- <mlist msgid="20040928184943.0a82b6f6.aluigi@autistici.org">http://marc.theaimsgroup.com/?l=full-disclosure&amp;m=109646043512722</mlist>
- </references>
- <dates>
- <discovery>2004-09-29</discovery>
- <entry>2004-10-13</entry>
+ </description> <references>
+ <mlist
+ msgid="20040928184943.0a82b6f6.aluigi@autistici.org">http://marc.theaimsgroup.com/?l=full-disclosure&amp;m=109646043512722</mlist>
+ </references> <dates>
+ <discovery>2004-09-29</discovery> <entry>2004-10-13</entry>
</dates>
</vuln>
@@ -14507,29 +12040,23 @@ http_access deny Gopher</pre>
<topic>freeradius -- denial-of-service vulnerability</topic>
<affects>
<package>
- <name>freeradius</name>
- <range><ge>0.8.0</ge><lt>1.0.1</lt></range>
+ <name>freeradius</name> <range><ge>0.8.0</ge><lt>1.0.1</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>A remote attacker may be able to crash the freeRADIUS Server
+ <p>A remote attacker may be able to crash the freeRADIUS
+ Server
due to three independant bugs in the function which does
improper checking values while processing RADIUS
attributes.</p>
</body>
- </description>
- <references>
- <cvename>CVE-2004-0938</cvename>
- <cvename>CVE-2004-0960</cvename>
+ </description> <references>
+ <cvename>CVE-2004-0938</cvename> <cvename>CVE-2004-0960</cvename>
<cvename>CVE-2004-0961</cvename>
<url>http://www.securitytracker.com/alerts/2004/Sep/1011364.html</url>
- <certvu>541574</certvu>
- <bid>11222</bid>
- </references>
- <dates>
- <discovery>2004-09-20</discovery>
- <entry>2004-10-13</entry>
+ <certvu>541574</certvu> <bid>11222</bid>
+ </references> <dates>
+ <discovery>2004-09-20</discovery> <entry>2004-10-13</entry>
<modified>2004-10-19</modified>
</dates>
</vuln>
@@ -14538,133 +12065,99 @@ http_access deny Gopher</pre>
<topic>xerces-c2 -- Attribute blowup denial-of-service</topic>
<affects>
<package>
- <name>xerces-c2</name>
- <range><lt>2.6.0</lt></range>
+ <name>xerces-c2</name> <range><lt>2.6.0</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>Amit Klein reports about Xerces-C++:</p>
- <blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=109674050017645">
- <p>An attacker can craft a malicious XML document, which
- uses XML attributes in a way that inflicts a denial of
- service condition on the target machine (XML parser). The
- result of this attack is that the XML parser consumes all
- the CPU.</p>
- </blockquote>
+ <p>Amit Klein reports about Xerces-C++:</p> <blockquote
+ cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=109674050017645">
+ <p>An attacker can craft a malicious XML document, which
+ uses XML attributes in a way that inflicts a denial of
+ service condition on the target machine (XML parser).
+ The result of this attack is that the XML parser consumes
+ all the CPU.</p>
+ </blockquote>
</body>
- </description>
- <references>
- <bid>11312</bid>
- <mlist msgid="415F00A8.13029.1FAADB7@localhost">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=109674050017645</mlist>
- </references>
- <dates>
- <discovery>2004-10-02</discovery>
- <entry>2004-10-13</entry>
+ </description> <references>
+ <bid>11312</bid> <mlist
+ msgid="415F00A8.13029.1FAADB7@localhost">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=109674050017645</mlist>
+ </references> <dates>
+ <discovery>2004-10-02</discovery> <entry>2004-10-13</entry>
<modified>2004-10-14</modified>
</dates>
</vuln>
<vuln vid="12b7b4cf-1d53-11d9-814e-0001020eed82">
- <topic>wordpress -- XSS in administration panel</topic>
- <affects>
+ <topic>wordpress -- XSS in administration panel</topic> <affects>
<package>
- <name>wordpress</name>
- <range><lt>1.2.1</lt></range>
+ <name>wordpress</name> <range><lt>1.2.1</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>Pages in the administration panel of Wordpress are
- vulnerable for XSS attacks.</p>
+ <p>Pages in the administration panel of Wordpress are
+ vulnerable for XSS attacks.</p>
</body>
- </description>
- <references>
+ </description> <references>
<url>http://wordpress.org/development/2004/10/wp-121/</url>
- <mlist msgid="20040927231608.19365.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=109641484723194</mlist>
- </references>
- <dates>
- <discovery>2004-09-27</discovery>
- <entry>2004-10-13</entry>
+ <mlist
+ msgid="20040927231608.19365.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=109641484723194</mlist>
+ </references> <dates>
+ <discovery>2004-09-27</discovery> <entry>2004-10-13</entry>
</dates>
</vuln>
<vuln vid="3897a2f8-1d57-11d9-bc4a-000c41e2cdad">
- <topic>tiff -- multiple integer overflows</topic>
- <affects>
- <package>
- <name>tiff</name>
- <range><le>3.6.1_2</le></range>
- </package>
- <package>
- <name>linux-tiff</name>
- <range><lt>3.6.1</lt></range>
- </package>
+ <topic>tiff -- multiple integer overflows</topic> <affects>
<package>
- <name>pdflib</name>
- <name>pdflib-perl</name>
+ <name>tiff</name> <range><le>3.6.1_2</le></range>
+ </package> <package>
+ <name>linux-tiff</name> <range><lt>3.6.1</lt></range>
+ </package> <package>
+ <name>pdflib</name> <name>pdflib-perl</name>
<range><lt>6.0.1</lt></range>
- </package>
- <package>
- <name>gdal</name>
- <range><lt>1.2.1_2</lt></range>
- </package>
- <package>
- <name>fractorama</name>
- <name>iv</name>
- <name>ivtools</name>
- <name>ja-iv</name>
- <name>ja-libimg</name>
- <name>paraview</name>
+ </package> <package>
+ <name>gdal</name> <range><lt>1.2.1_2</lt></range>
+ </package> <package>
+ <name>fractorama</name> <name>iv</name> <name>ivtools</name>
+ <name>ja-iv</name> <name>ja-libimg</name> <name>paraview</name>
<range><gt>0</gt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>Dmitry V. Levin discovered numerous integer overflow bugs in
- libtiff. Most of these bugs are related to memory management,
- and are believed to be exploitable for arbitrary code
- execution.</p>
+ <p>Dmitry V. Levin discovered numerous integer overflow
+ bugs in
+ libtiff. Most of these bugs are related to memory
+ management, and are believed to be exploitable for arbitrary
+ code execution.</p>
</body>
- </description>
- <references>
- <certvu>687568</certvu>
- <cvename>CVE-2004-0886</cvename>
+ </description> <references>
+ <certvu>687568</certvu> <cvename>CVE-2004-0886</cvename>
<url>http://www.idefense.com/application/poi/display?id=173&amp;type=vulnerabilities</url>
- </references>
- <dates>
- <discovery>2004-10-13</discovery>
- <entry>2004-10-13</entry>
+ </references> <dates>
+ <discovery>2004-10-13</discovery> <entry>2004-10-13</entry>
<modified>2005-08-01</modified>
</dates>
</vuln>
<vuln vid="30cea6be-1d0c-11d9-814e-0001020eed82">
- <topic>CUPS -- local information disclosure</topic>
- <affects>
+ <topic>CUPS -- local information disclosure</topic> <affects>
<package>
- <name>cups-base</name>
- <range><lt>1.1.22</lt></range>
+ <name>cups-base</name> <range><lt>1.1.22</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>Certain methods of authenticated remote printing in CUPS
- can disclose user names and passwords in the log files.</p>
- <p>A workaround for this problem is to set more strict
- access permissions on the CUPS logfiles.</p>
+ <p>Certain methods of authenticated remote printing in CUPS
+ can disclose user names and passwords in the log files.</p>
+ <p>A workaround for this problem is to set more strict
+ access permissions on the CUPS logfiles.</p>
</body>
- </description>
- <references>
+ </description> <references>
<url>http://docs.info.apple.com/article.html?artnum=61798</url>
<url>http://secunia.com/advisories/12690/</url>
<url>http://www.cups.org/str.php?L920</url>
- <cvename>CVE-2004-0923</cvename>
- <certvu>557062</certvu>
- </references>
- <dates>
- <discovery>2004-09-23</discovery>
- <entry>2004-10-13</entry>
+ <cvename>CVE-2004-0923</cvename> <certvu>557062</certvu>
+ </references> <dates>
+ <discovery>2004-09-23</discovery> <entry>2004-10-13</entry>
</dates>
</vuln>
@@ -14672,110 +12165,81 @@ http_access deny Gopher</pre>
<topic>zinf -- potential buffer overflow playlist support</topic>
<affects>
<package>
- <name>zinf</name>
- <range><lt>2.2.5</lt></range>
+ <name>zinf</name> <range><lt>2.2.5</lt></range>
+ </package> <package>
+ <name>freeamp</name> <range><gt>0</gt></range>
</package>
- <package>
- <name>freeamp</name>
- <range><gt>0</gt></range>
- </package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The audio player Zinf is vulnerable to a buffer-overflow
bug in the management of the playlist files.</p>
</body>
- </description>
- <references>
- <mlist msgid="20040924213102.7fb91138.aluigi@autistici.org">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=109608092609200</mlist>
+ </description> <references>
+ <mlist
+ msgid="20040924213102.7fb91138.aluigi@autistici.org">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=109608092609200</mlist>
</references>
<dates>
- <discovery>2004-09-24</discovery>
- <entry>2004-10-12</entry>
+ <discovery>2004-09-24</discovery> <entry>2004-10-12</entry>
</dates>
</vuln>
<vuln vid="f6680c03-0bd8-11d9-8a8a-000c41e2cdad">
- <topic>tiff -- RLE decoder heap overflows</topic>
- <affects>
+ <topic>tiff -- RLE decoder heap overflows</topic> <affects>
<package>
- <name>tiff</name>
- <range><le>3.6.1_1</le></range>
- </package>
- <package>
- <name>linux-tiff</name>
- <range><lt>3.6.1</lt></range>
- </package>
- <package>
- <name>pdflib</name>
- <name>pdflib-perl</name>
+ <name>tiff</name> <range><le>3.6.1_1</le></range>
+ </package> <package>
+ <name>linux-tiff</name> <range><lt>3.6.1</lt></range>
+ </package> <package>
+ <name>pdflib</name> <name>pdflib-perl</name>
<range><lt>6.0.1</lt></range>
- </package>
- <package>
- <name>gdal</name>
- <range><lt>1.2.1_2</lt></range>
- </package>
- <package>
- <name>fractorama</name>
- <name>iv</name>
- <name>ivtools</name>
- <name>ja-iv</name>
- <name>ja-libimg</name>
- <name>paraview</name>
+ </package> <package>
+ <name>gdal</name> <range><lt>1.2.1_2</lt></range>
+ </package> <package>
+ <name>fractorama</name> <name>iv</name> <name>ivtools</name>
+ <name>ja-iv</name> <name>ja-libimg</name> <name>paraview</name>
<range><gt>0</gt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>Chris Evans discovered several heap buffer overflows in
- libtiff's RLE decoder. These overflows could be triggered
- by a specially-crafted TIFF image file, resulting in an
- application crash and possibly arbitrary code execution.</p>
+ <p>Chris Evans discovered several heap buffer overflows in
+ libtiff's RLE decoder. These overflows could be triggered
+ by a specially-crafted TIFF image file, resulting in an
+ application crash and possibly arbitrary code execution.</p>
</body>
- </description>
- <references>
- <certvu>948752</certvu>
- <cvename>CVE-2004-0803</cvename>
+ </description> <references>
+ <certvu>948752</certvu> <cvename>CVE-2004-0803</cvename>
<url>http://scary.beasts.org/security/CESA-2004-006.txt</url>
- </references>
- <dates>
- <discovery>2004-10-13</discovery>
- <entry>2004-10-13</entry>
+ </references> <dates>
+ <discovery>2004-10-13</discovery> <entry>2004-10-13</entry>
<modified>2005-08-01</modified>
</dates>
</vuln>
<vuln vid="26c9e8c6-1c99-11d9-814e-0001020eed82">
- <topic>sharutils -- buffer overflows</topic>
- <affects>
+ <topic>sharutils -- buffer overflows</topic> <affects>
<package>
- <name>sharutils</name>
- <range><lt>4.2.1_2</lt></range>
+ <name>sharutils</name> <range><lt>4.2.1_2</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>From Gentoo advisory GLSA 200410-01:</p>
- <blockquote cite="http://www.gentoo.org/security/en/glsa/glsa-200410-01.xml">
+ <p>From Gentoo advisory GLSA 200410-01:</p> <blockquote
+ cite="http://www.gentoo.org/security/en/glsa/glsa-200410-01.xml">
<p>sharutils contains two buffer overflows. Ulf Harnhammar
discovered a buffer overflow in shar.c, where the length
of data returned by the wc command is not checked.
- Florian Schilhabel discovered another buffer overflow in
- unshar.c.</p>
+ Florian Schilhabel discovered another buffer overflow
+ in unshar.c.</p>
<p>An attacker could exploit these vulnerabilities to
execute arbitrary code as the user running one of the
sharutils programs.</p>
</blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<bid>11298</bid>
<url>http://www.gentoo.org/security/en/glsa/glsa-200410-01.xml</url>
<url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=265904</url>
- </references>
- <dates>
- <discovery>2004-08-15</discovery>
- <entry>2004-10-13</entry>
+ </references> <dates>
+ <discovery>2004-08-15</discovery> <entry>2004-10-13</entry>
</dates>
</vuln>
@@ -14783,26 +12247,21 @@ http_access deny Gopher</pre>
<topic>mail-notification -- denial-of-service vulnerability</topic>
<affects>
<package>
- <name>mail-notification</name>
- <range><lt>0.7.0</lt></range>
+ <name>mail-notification</name> <range><lt>0.7.0</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Caused by an untested return value, and a resulting
null pointer dereference, it is possible for an attacker
- to crash the application. However, the attacker must first
- hijack the connection between Mail Notification and the
- Gmail or IMAP server.</p>
+ to crash the application. However, the attacker must
+ first hijack the connection between Mail Notification and
+ the Gmail or IMAP server.</p>
</body>
- </description>
- <references>
+ </description> <references>
<url>http://www.nongnu.org/mailnotify/sa/mail-notification-SA-04:2.asc</url>
<url>http://www.nongnu.org/mailnotify/sa/mail-notification-SA-04:3.asc</url>
- </references>
- <dates>
- <discovery>2004-10-06</discovery>
- <entry>2004-10-12</entry>
+ </references> <dates>
+ <discovery>2004-10-06</discovery> <entry>2004-10-12</entry>
</dates>
</vuln>
@@ -14810,54 +12269,44 @@ http_access deny Gopher</pre>
<topic>squid -- SNMP module denial-of-service vulnerability</topic>
<affects>
<package>
- <name>squid</name>
- <range><lt>2.5.7</lt></range>
+ <name>squid</name> <range><lt>2.5.7</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>The Squid-2.5 patches page notes:</p>
- <blockquote cite="http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE6-SNMP_core_dump">
+ <p>The Squid-2.5 patches page notes:</p> <blockquote
+ cite="http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE6-SNMP_core_dump">
<p>If a certain malformed SNMP request is received squid
restarts with a Segmentation Fault error.</p>
- </blockquote>
- <p>This only affects squid installations where SNMP is
+ </blockquote> <p>This only affects squid installations where
+ SNMP is
explicitly enabled via "make config". As a workaround,
SNMP can be disabled by defining "snmp_port 0" in
squid.conf.</p>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2004-0918</cvename>
<url>http://www.idefense.com/application/poi/display?id=152&amp;type=vulnerabilities</url>
<url>http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE6-SNMP_core_dump</url>
- </references>
- <dates>
- <discovery>2004-09-29</discovery>
- <entry>2004-10-12</entry>
+ </references> <dates>
+ <discovery>2004-09-29</discovery> <entry>2004-10-12</entry>
</dates>
</vuln>
<vuln vid="0c592c4a-1bcc-11d9-a3ec-00061bd2d56f">
- <topic>cyrus-sasl -- potential buffer overflow in DIGEST-MD5 plugin</topic>
- <affects>
+ <topic>cyrus-sasl -- potential buffer overflow in DIGEST-MD5
+ plugin</topic> <affects>
<package>
- <name>cyrus-sasl</name>
- <range><ge>2.*</ge><lt>2.1.19</lt></range>
+ <name>cyrus-sasl</name> <range><ge>2.*</ge><lt>2.1.19</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>The Cyrus SASL DIGEST-MD5 plugin contains a potential
- buffer overflow when quoting is required in the output.</p>
+ <p>The Cyrus SASL DIGEST-MD5 plugin contains a potential
+ buffer overflow when quoting is required in the output.</p>
</body>
- </description>
- <references>
+ </description> <references>
<url>https://bugzilla.andrew.cmu.edu/cgi-bin/cvsweb.cgi/src/sasl/plugins/digestmd5.c#rev1.171</url>
- </references>
- <dates>
- <discovery>2004-07-06</discovery>
- <entry>2004-10-12</entry>
+ </references> <dates>
+ <discovery>2004-07-06</discovery> <entry>2004-10-12</entry>
</dates>
</vuln>
@@ -14866,79 +12315,62 @@ http_access deny Gopher</pre>
applications</topic>
<affects>
<package>
- <name>cyrus-sasl</name>
- <range><le>1.5.28_3</le></range>
+ <name>cyrus-sasl</name> <range><le>1.5.28_3</le></range>
<range><ge>2.*</ge><le>2.1.19</le></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>The Cyrus SASL library, libsasl, contains functions which
- may load dynamic libraries. These libraries may be loaded
- from the path specified by the environmental variable
- SASL_PATH, which in some situations may be fully controlled
- by a local attacker. Thus, if a set-user-ID application
- (such as chsh) utilizes libsasl, it may be possible for a
- local attacker to gain superuser privileges.</p>
+ <p>The Cyrus SASL library, libsasl, contains functions which
+ may load dynamic libraries. These libraries may be loaded
+ from the path specified by the environmental variable
+ SASL_PATH, which in some situations may be fully controlled
+ by a local attacker. Thus, if a set-user-ID application
+ (such as chsh) utilizes libsasl, it may be possible for
+ a local attacker to gain superuser privileges.</p>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2004-0884</cvename>
<url>https://bugzilla.andrew.cmu.edu/cgi-bin/cvsweb.cgi/src/sasl/lib/common.c#rev1.104</url>
- </references>
- <dates>
- <discovery>2004-09-22</discovery>
- <entry>2004-10-08</entry>
+ </references> <dates>
+ <discovery>2004-09-22</discovery> <entry>2004-10-08</entry>
</dates>
</vuln>
<vuln vid="efc4819b-0b2d-11d9-bfe1-000bdb1444a4">
- <topic>imp3 -- XSS hole in the HTML viewer</topic>
- <affects>
+ <topic>imp3 -- XSS hole in the HTML viewer</topic> <affects>
<package>
- <name>imp</name>
- <range><lt>3.2.6</lt></range>
+ <name>imp</name> <range><lt>3.2.6</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>The script vulnerabilities can only be exposed with
- certain browsers and allow XSS attacks when viewing
- HTML messages with the HTML MIME viewer</p>
+ <p>The script vulnerabilities can only be exposed with
+ certain browsers and allow XSS attacks when viewing HTML
+ messages with the HTML MIME viewer</p>
</body>
- </description>
- <references>
+ </description> <references>
<url>http://thread.gmane.org/gmane.comp.horde.imp/15488</url>
<url>http://cvs.horde.org/diff.php/imp/docs/CHANGES?r1=1.389.2.109&amp;r2=1.389.2.111&amp;ty=h</url>
- </references>
- <dates>
- <discovery>2004-08-20</discovery>
- <entry>2004-10-05</entry>
+ </references> <dates>
+ <discovery>2004-08-20</discovery> <entry>2004-10-05</entry>
</dates>
</vuln>
<vuln vid="938f357c-16dd-11d9-bc4a-000c41e2cdad">
- <topic>bmon -- unsafe set-user-ID application</topic>
- <affects>
+ <topic>bmon -- unsafe set-user-ID application</topic> <affects>
<package>
- <name>bmon</name>
- <range><lt>1.2.1_2</lt></range>
+ <name>bmon</name> <range><lt>1.2.1_2</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>Jon Nistor reported that the FreeBSD port of bmon was
- installed set-user-ID root, and executes commands using
- relative paths. This could allow local user to easily obtain
- root privileges.</p>
+ <p>Jon Nistor reported that the FreeBSD port of bmon was
+ installed set-user-ID root, and executes commands using
+ relative paths. This could allow local user to easily
+ obtain root privileges.</p>
</body>
- </description>
- <references>
+ </description> <references>
<freebsdpr>ports/67340</freebsdpr>
- </references>
- <dates>
- <discovery>2004-05-29</discovery>
- <entry>2004-10-05</entry>
+ </references> <dates>
+ <discovery>2004-05-29</discovery> <entry>2004-10-05</entry>
</dates>
</vuln>
@@ -14946,38 +12378,35 @@ http_access deny Gopher</pre>
<topic>gnutls -- certificate chain verification DoS</topic>
<affects>
<package>
- <name>gnutls</name>
- <range><lt>1.0.17</lt></range>
+ <name>gnutls</name> <range><lt>1.0.17</lt></range>
+ </package> <package>
+ <name>gnutls-devel</name>
+ <range><ge>1.1.*</ge><lt>1.1.12</lt></range>
</package>
- <package>
- <name>gnutls-devel</name>
- <range><ge>1.1.*</ge><lt>1.1.12</lt></range>
- </package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>Patric Hornik reports on a problem in the certificate chain
+ <p>Patric Hornik reports on a problem in the certificate
+ chain
verification procedures of GnuTLS that may result in a
denial-of-service vulnerability:</p>
<blockquote cite="http://www.hornik.sk/SA/SA-20040802.txt">
- <p>The certificate chain should be verified from last root
- certificate to the first certificate. Otherwise a lot
- of unauthorized CPU processing can be forced to check
- certificate signatures signed with arbitrary RSA/DSA keys
- chosen by attacker.</p>
- <p>In GnuTLS the signatures are checked from first to last
- certificate, there is no limit on size of keys and no
- limit on length of certificate chain.</p>
- </blockquote>
- </body>
- </description>
- <references>
+ <p>The certificate chain should be verified from last
+ root
+ certificate to the first certificate. Otherwise a lot
+ of unauthorized CPU processing can be forced to check
+ certificate signatures signed with arbitrary RSA/DSA
+ keys chosen by attacker.</p>
+ <p>In GnuTLS the signatures are checked from first to
+ last
+ certificate, there is no limit on size of keys and no
+ limit on length of certificate chain.</p>
+ </blockquote>
+ </body>
+ </description> <references>
<url>http://www.hornik.sk/SA/SA-20040802.txt</url>
<url>http://secunia.com/advisories/12156</url>
- </references>
- <dates>
- <discovery>2004-08-02</discovery>
- <entry>2004-10-05</entry>
+ </references> <dates>
+ <discovery>2004-08-02</discovery> <entry>2004-10-05</entry>
</dates>
</vuln>
@@ -14985,729 +12414,550 @@ http_access deny Gopher</pre>
<topic>php -- vulnerability in RFC 1867 file upload processing</topic>
<affects>
<package>
- <name>php4</name>
- <name>php4-cgi</name>
- <range><le>4.3.8_2</le></range>
+ <name>php4</name> <name>php4-cgi</name>
+ <range><le>4.3.8_2</le></range>
+ </package> <package>
+ <name>mod_php4</name> <range><le>4.3.8_2,1</le></range>
+ </package> <package>
+ <name>php5</name> <name>php5-cgi</name>
+ <range><le>5.0.1</le></range>
+ </package> <package>
+ <name>mod_php5</name> <range><le>5.0.1,1</le></range>
</package>
- <package>
- <name>mod_php4</name>
- <range><le>4.3.8_2,1</le></range>
- </package>
- <package>
- <name>php5</name>
- <name>php5-cgi</name>
- <range><le>5.0.1</le></range>
- </package>
- <package>
- <name>mod_php5</name>
- <range><le>5.0.1,1</le></range>
- </package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Stefano Di Paola discovered an issue with PHP that
could allow someone to upload a file to any directory
- writeable by the httpd process. Any sanitizing performed on
- the prepended directory path is ignored. This bug can only
- be triggered if the $_FILES element name contains an
- underscore.</p>
- </body>
- </description>
- <references>
- <mlist msgid="1095268057.2818.20.camel@localhost">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=109534848430404</mlist>
- <mlist msgid="1096478151.3220.6.camel@localhost">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=109648426331965</mlist>
- </references>
- <dates>
- <discovery>2004-09-15</discovery>
- <entry>2004-09-15</entry>
+ writeable by the httpd process. Any sanitizing performed
+ on the prepended directory path is ignored. This bug can
+ only be triggered if the $_FILES element name contains
+ an underscore.</p>
+ </body>
+ </description> <references>
+ <mlist
+ msgid="1095268057.2818.20.camel@localhost">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=109534848430404</mlist>
+ <mlist
+ msgid="1096478151.3220.6.camel@localhost">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=109648426331965</mlist>
+ </references> <dates>
+ <discovery>2004-09-15</discovery> <entry>2004-09-15</entry>
<modified>2004-10-12</modified>
</dates>
</vuln>
<vuln vid="ad74a1bd-16d2-11d9-bc4a-000c41e2cdad">
- <topic>php -- php_variables memory disclosure</topic>
- <affects>
- <package>
- <name>mod_php4-twig</name>
- <name>php4-cgi</name>
- <name>php4-cli</name>
- <name>php4-dtc</name>
- <name>php4-horde</name>
- <name>php4-nms</name>
- <name>php4</name>
- <range><le>4.3.8_2</le></range>
- </package>
- <package>
- <name>mod_php</name>
- <name>mod_php4</name>
+ <topic>php -- php_variables memory disclosure</topic> <affects>
+ <package>
+ <name>mod_php4-twig</name> <name>php4-cgi</name>
+ <name>php4-cli</name> <name>php4-dtc</name> <name>php4-horde</name>
+ <name>php4-nms</name> <name>php4</name>
+ <range><le>4.3.8_2</le></range>
+ </package> <package>
+ <name>mod_php</name> <name>mod_php4</name>
<range><ge>4</ge><le>4.3.8_2,1</le></range>
+ </package> <package>
+ <name>php5</name> <name>php5-cgi</name> <name>php5-cli</name>
+ <range><le>5.0.1</le></range>
+ </package> <package>
+ <name>mod_php5</name> <range><le>5.0.1,1</le></range>
</package>
- <package>
- <name>php5</name>
- <name>php5-cgi</name>
- <name>php5-cli</name>
- <range><le>5.0.1</le></range>
- </package>
- <package>
- <name>mod_php5</name>
- <range><le>5.0.1,1</le></range>
- </package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>Stefano Di Paola reports:</p>
- <blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=109527531130492">
- <p>Bad array parsing in php_variables.c could lead to show
- arbitrary memory content such as pieces of php code
- and other data. This affects all GET, POST or COOKIES
- variables.</p>
+ <p>Stefano Di Paola reports:</p> <blockquote
+ cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=109527531130492">
+ <p>Bad array parsing in php_variables.c could lead to
+ show
+ arbitrary memory content such as pieces of php code and
+ other data. This affects all GET, POST or COOKIES
+ variables.</p>
</blockquote>
</body>
- </description>
- <references>
- <mlist msgid="1095267581.2818.13.camel@localhost">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=109527531130492</mlist>
- </references>
- <dates>
- <discovery>2004-09-15</discovery>
- <entry>2004-10-05</entry>
+ </description> <references>
+ <mlist
+ msgid="1095267581.2818.13.camel@localhost">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=109527531130492</mlist>
+ </references> <dates>
+ <discovery>2004-09-15</discovery> <entry>2004-10-05</entry>
</dates>
</vuln>
<vuln vid="fffacc93-16cb-11d9-bc4a-000c41e2cdad">
- <topic>xv -- exploitable buffer overflows</topic>
- <affects>
+ <topic>xv -- exploitable buffer overflows</topic> <affects>
<package>
- <name>xv</name>
- <name>xv-m17n</name>
+ <name>xv</name> <name>xv-m17n</name>
<range><lt>3.10a_4</lt></range>
</package>
- </affects>
- <description>
- <body xmlns="http://www.w3.org/1999/xhtml">
- <p>In a Bugtraq posting, infamous41md(at)hotpop.com reported:</p>
- <blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=109302498125092">
- <p>there are at least 5 exploitable buffer and heap
- overflows in the image handling code. this allows someone
- to craft a malicious image, trick a user into viewing the
- file in xv, and upon viewing that image execute arbitrary
- code under privileges of the user viewing image. note
- the AT LEAST part of the above sentence. there is such a
- plethora of bad code that I just stopped reading after
- a while. there are at least 100 calls to sprintf() and
- strcpy() with no regards for bounds of buffers. 95% of
- these deal with program arguments or filenames, so they
- are of no interest to exploit. however I just got sick of
- reading this code after not too long. so im sure there are
- still other overflows in the image handling code for other
- image types.</p>
- </blockquote>
- <p>The posting also included an exploit.</p>
- </body>
- </description>
- <references>
- <mlist msgid="20040820032605.360e43e3.infamous41md@hotpop.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=109302498125092</mlist>
- </references>
- <dates>
- <discovery>2004-08-20</discovery>
- <entry>2004-10-05</entry>
+ </affects> <description>
+ <body xmlns="http://www.w3.org/1999/xhtml">
+ <p>In a Bugtraq posting, infamous41md(at)hotpop.com
+ reported:</p> <blockquote
+ cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=109302498125092">
+ <p>there are at least 5 exploitable buffer and heap
+ overflows in the image handling code. this allows someone
+ to craft a malicious image, trick a user into viewing
+ the file in xv, and upon viewing that image execute
+ arbitrary code under privileges of the user viewing
+ image. note the AT LEAST part of the above sentence.
+ there is such a plethora of bad code that I just stopped
+ reading after a while. there are at least 100 calls to
+ sprintf() and strcpy() with no regards for bounds of
+ buffers. 95% of these deal with program arguments or
+ filenames, so they are of no interest to exploit. however
+ I just got sick of reading this code after not too long.
+ so im sure there are still other overflows in the image
+ handling code for other image types.</p>
+ </blockquote> <p>The posting also included an exploit.</p>
+ </body>
+ </description> <references>
+ <mlist
+ msgid="20040820032605.360e43e3.infamous41md@hotpop.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=109302498125092</mlist>
+ </references> <dates>
+ <discovery>2004-08-20</discovery> <entry>2004-10-05</entry>
<modified>2004-10-12</modified>
</dates>
</vuln>
<vuln vid="8c33b299-163b-11d9-ac1b-000d614f7fad">
- <topic>getmail -- symlink vulnerability during maildir delivery</topic>
+ <topic>getmail -- symlink vulnerability during maildir
+ delivery</topic>
<affects>
- <package>
- <name>getmail</name>
- <range><lt>3.2.5</lt></range>
+ <package>
+ <name>getmail</name> <range><lt>3.2.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>David Watson reports a symlink vulnerability in getmail.
- If run as root (not the recommended mode of operation), a
- local user may be able to cause getmail to write files in
- arbitrary directories via a symlink attack on subdirectories
- of the maildir.</p>
+ <p>David Watson reports a symlink vulnerability in getmail.
+ If run as root (not the recommended mode of operation),
+ a local user may be able to cause getmail to write files
+ in arbitrary directories via a symlink attack on
+ subdirectories of the maildir.</p>
</body>
- </description>
- <references>
- <mlist msgid="200409191532.38997.baikie@ehwat.freeserve.co.uk">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=109571883130372</mlist>
- <cvename>CVE-2004-0881</cvename>
- <bid>11224</bid>
- </references>
- <dates>
- <discovery>2004-09-19</discovery>
- <entry>2004-10-04</entry>
+ </description> <references>
+ <mlist
+ msgid="200409191532.38997.baikie@ehwat.freeserve.co.uk">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=109571883130372</mlist>
+ <cvename>CVE-2004-0881</cvename> <bid>11224</bid>
+ </references> <dates>
+ <discovery>2004-09-19</discovery> <entry>2004-10-04</entry>
</dates>
</vuln>
<vuln vid="67710833-1626-11d9-bc4a-000c41e2cdad">
- <topic>Boundary checking errors in syscons</topic>
- <affects>
+ <topic>Boundary checking errors in syscons</topic> <affects>
<system>
- <name>FreeBSD</name>
- <range><ge>5.0</ge><lt>5.2.1_11</lt></range>
+ <name>FreeBSD</name> <range><ge>5.0</ge><lt>5.2.1_11</lt></range>
</system>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The syscons CONS_SCRSHOT <a
href="http://www.freebsd.org/cgi/man.cgi?query=ioctl">ioctl(2)</a>
- does insufficient validation of its input arguments. In
- particular, negative coordinates or large coordinates may
- cause unexpected behavior.</p>
- <p>It may be possible to cause the CONS_SCRSHOT ioctl to
- return portions of kernel memory. Such memory might
- contain sensitive information, such as portions of the
- file cache or terminal buffers. This information might be
- directly useful, or it might be leveraged to obtain elevated
- privileges in some way. For example, a terminal buffer
- might include a user-entered password.</p>
- <p>This bug may be exploitable by users who have access to the
- physical console or can otherwise open a /dev/ttyv* device
+ does insufficient validation of its input arguments. In
+ particular, negative coordinates or large coordinates may
+ cause unexpected behavior.</p>
+ <p>It may be possible to cause the CONS_SCRSHOT ioctl to
+ return portions of kernel memory. Such memory might
+ contain sensitive information, such as portions of the
+ file cache or terminal buffers. This information might
+ be directly useful, or it might be leveraged to obtain
+ elevated privileges in some way. For example, a terminal
+ buffer might include a user-entered password.</p>
+ <p>This bug may be exploitable by users who have access to
+ the
+ physical console or can otherwise open a /dev/ttyv* device
node.</p>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2004-0919</cvename>
<freebsdsa>SA-04:15.syscons</freebsdsa>
<url>http://www.freebsd.org/cgi/cvsweb.cgi/src/sys/dev/syscons/syscons.c#rev1.429</url>
- </references>
- <dates>
- <discovery>2004-09-30</discovery>
- <entry>2004-10-04</entry>
+ </references> <dates>
+ <discovery>2004-09-30</discovery> <entry>2004-10-04</entry>
</dates>
</vuln>
<vuln vid="2328ADEF-157C-11D9-8402-000D93664D5C">
- <topic>racoon -- improper certificate handling</topic>
- <affects>
+ <topic>racoon -- improper certificate handling</topic> <affects>
<package>
- <name>racoon</name>
- <range><lt>20040818a</lt></range>
+ <name>racoon</name> <range><lt>20040818a</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Thomas Walpuski noted when OpenSSL would detect an error
condition for a peer certificate, racoon mistakenly ignored
- the error. This could allow five invalid certificate states
- to properly be used for authentication.</p>
+ the error. This could allow five invalid certificate
+ states to properly be used for authentication.</p>
</body>
- </description>
- <references>
- <mlist msgid="20040614185623.GA10290@unproved.org">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=108726102304507</mlist>
+ </description> <references>
+ <mlist
+ msgid="20040614185623.GA10290@unproved.org">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=108726102304507</mlist>
<url>http://www.kame.net/racoon/racoon-ml/msg00517.html</url>
- </references>
- <dates>
- <discovery>2004-01-31</discovery>
- <entry>2004-10-03</entry>
+ </references> <dates>
+ <discovery>2004-01-31</discovery> <entry>2004-10-03</entry>
</dates>
</vuln>
<vuln vid="e8d4800f-1547-11d9-90a3-00010327614a">
- <topic>distcc -- incorrect parsing of IP access control rules</topic>
- <affects>
+ <topic>distcc -- incorrect parsing of IP access control
+ rules</topic> <affects>
<package>
- <name>distcc</name>
- <range><lt>2.16</lt></range>
+ <name>distcc</name> <range><lt>2.16</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <blockquote cite="http://distcc.samba.org/ftp/distcc/distcc-2.16.NEWS">
- <p>Fix bug that might cause IP-based access control rules not to
+ <blockquote
+ cite="http://distcc.samba.org/ftp/distcc/distcc-2.16.NEWS">
+ <p>Fix bug that might cause IP-based access control rules
+ not to
be interpreted correctly on 64-bit platforms.</p>
</blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2004-0601</cvename>
<url>http://distcc.samba.org/ftp/distcc/distcc-2.16.NEWS</url>
- </references>
- <dates>
- <discovery>2004-06-23</discovery>
- <entry>2004-10-03</entry>
+ </references> <dates>
+ <discovery>2004-06-23</discovery> <entry>2004-10-03</entry>
</dates>
</vuln>
<vuln vid="b2e6d1d6-1339-11d9-bc4a-000c41e2cdad">
- <topic>mozilla -- scripting vulnerabilities</topic>
- <affects>
- <package>
- <name>thunderbird</name>
- <range><lt>0.8</lt></range>
- </package>
- <package>
- <name>de-linux-mozillafirebird</name>
- <name>el-linux-mozillafirebird</name>
- <name>firefox</name>
- <name>ja-linux-mozillafirebird-gtk1</name>
- <name>ja-mozillafirebird-gtk2</name>
- <name>linux-mozillafirebird</name>
- <name>ru-linux-mozillafirebird</name>
- <name>zhCN-linux-mozillafirebird</name>
- <name>zhTW-linux-mozillafirebird</name>
- <range><lt>1.p</lt></range>
- </package>
- <package>
- <name>de-netscape7</name>
- <name>fr-netscape7</name>
- <name>ja-netscape7</name>
- <name>netscape7</name>
- <name>pt_BR-netscape7</name>
- <range><le>7.2</le></range>
- </package>
- <package>
- <name>mozilla-gtk1</name>
- <name>linux-mozilla</name>
- <name>linux-mozilla-devel</name>
- <range><lt>1.7.3</lt></range>
- </package>
- <package>
- <name>mozilla</name>
- <range><lt>1.7.3,2</lt></range>
- </package>
+ <topic>mozilla -- scripting vulnerabilities</topic> <affects>
<package>
+ <name>thunderbird</name> <range><lt>0.8</lt></range>
+ </package> <package>
+ <name>de-linux-mozillafirebird</name>
+ <name>el-linux-mozillafirebird</name> <name>firefox</name>
+ <name>ja-linux-mozillafirebird-gtk1</name>
+ <name>ja-mozillafirebird-gtk2</name>
+ <name>linux-mozillafirebird</name>
+ <name>ru-linux-mozillafirebird</name>
+ <name>zhCN-linux-mozillafirebird</name>
+ <name>zhTW-linux-mozillafirebird</name> <range><lt>1.p</lt></range>
+ </package> <package>
+ <name>de-netscape7</name> <name>fr-netscape7</name>
+ <name>ja-netscape7</name> <name>netscape7</name>
+ <name>pt_BR-netscape7</name> <range><le>7.2</le></range>
+ </package> <package>
+ <name>mozilla-gtk1</name> <name>linux-mozilla</name>
+ <name>linux-mozilla-devel</name> <range><lt>1.7.3</lt></range>
+ </package> <package>
+ <name>mozilla</name> <range><lt>1.7.3,2</lt></range>
+ </package> <package>
<!-- These package names are obsolete. -->
- <name>de-linux-netscape</name>
- <name>fr-linux-netscape</name>
- <name>ja-linux-netscape</name>
- <name>linux-netscape</name>
- <name>linux-phoenix</name>
- <name>mozilla+ipv6</name>
- <name>mozilla-embedded</name>
- <name>mozilla-firebird</name>
- <name>mozilla-gtk2</name>
- <name>mozilla-gtk</name>
- <name>mozilla-thunderbird</name>
- <name>phoenix</name>
+ <name>de-linux-netscape</name> <name>fr-linux-netscape</name>
+ <name>ja-linux-netscape</name> <name>linux-netscape</name>
+ <name>linux-phoenix</name> <name>mozilla+ipv6</name>
+ <name>mozilla-embedded</name> <name>mozilla-firebird</name>
+ <name>mozilla-gtk2</name> <name>mozilla-gtk</name>
+ <name>mozilla-thunderbird</name> <name>phoenix</name>
<range><ge>0</ge></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Several scripting vulnerabilities were discovered and
corrected in Mozilla:</p>
<dl>
- <dt>CVE-2004-0905</dt>
- <dd>
- <blockquote cite="http://www.mozilla.org/projects/security/known-vulnerabilities.html">
+ <dt>CVE-2004-0905</dt> <dd>
+ <blockquote
+ cite="http://www.mozilla.org/projects/security/known-vulnerabilities.html">
<p>javascript; links dragged onto another frame or
page allows an attacker to steal or modify sensitive
- information from other sites. The user could be convinced
- to drag obscurred links in the context of a game or even a
- fake scrollbar. If the user could be convinced to drag two
- links in sequence into a separate window (not frame) the
- attacker would be able to run arbitrary programs.</p>
+ information from other sites. The user could be
+ convinced to drag obscurred links in the context
+ of a game or even a fake scrollbar. If the user
+ could be convinced to drag two links in sequence
+ into a separate window (not frame) the attacker
+ would be able to run arbitrary programs.</p>
</blockquote>
- </dd>
- <dt>CVE-2004-0908</dt>
- <dd>
- <blockquote cite="http://www.mozilla.org/projects/security/known-vulnerabilities.html">
- <p>Untrusted javascript code can read and write to the
- clipboard, stealing any sensitive data the user might
- have copied. <strong>Workaround:</strong> disable
- javascript</p>
+ </dd> <dt>CVE-2004-0908</dt> <dd>
+ <blockquote
+ cite="http://www.mozilla.org/projects/security/known-vulnerabilities.html">
+ <p>Untrusted javascript code can read and write to
+ the
+ clipboard, stealing any sensitive data the user
+ might have copied. <strong>Workaround:</strong>
+ disable javascript</p>
</blockquote>
- </dd>
- <dt>CVE-2004-0909</dt>
- <dd>
- <blockquote cite="http://www.mozilla.org/projects/security/known-vulnerabilities.html">
- <p>Signed scripts requesting enhanced abilities could
- construct the request in a way that led to a confusing
- grant dialog, possibly fooling the user into thinking
- the privilege requested was inconsequential while
- actually obtaining explicit permission to run and
- install software. <strong>Workaround:</strong> Never
- grant enhanced abilities of any kind to untrusted web
- pages.</p>
+ </dd> <dt>CVE-2004-0909</dt> <dd>
+ <blockquote
+ cite="http://www.mozilla.org/projects/security/known-vulnerabilities.html">
+ <p>Signed scripts requesting enhanced abilities could
+ construct the request in a way that led to a confusing
+ grant dialog, possibly fooling the user into thinking
+ the privilege requested was inconsequential while
+ actually obtaining explicit permission to run and
+ install software. <strong>Workaround:</strong> Never
+ grant enhanced abilities of any kind to untrusted
+ web pages.</p>
</blockquote>
</dd>
</dl>
</body>
- </description>
- <references>
- <cvename>CVE-2004-0905</cvename>
- <cvename>CVE-2004-0908</cvename>
+ </description> <references>
+ <cvename>CVE-2004-0905</cvename> <cvename>CVE-2004-0908</cvename>
<cvename>CVE-2004-0909</cvename>
<url>http://bugzilla.mozilla.org/show_bug.cgi?id=250862</url>
<url>http://bugzilla.mozilla.org/show_bug.cgi?id=257523</url>
<url>http://bugzilla.mozilla.org/show_bug.cgi?id=253942</url>
- </references>
- <dates>
- <discovery>2004-09-13</discovery>
- <entry>2004-09-30</entry>
+ </references> <dates>
+ <discovery>2004-09-13</discovery> <entry>2004-09-30</entry>
</dates>
</vuln>
<vuln vid="a7e0d783-131b-11d9-bc4a-000c41e2cdad">
- <topic>mozilla -- users may be lured into bypassing security dialogs</topic>
- <affects>
+ <topic>mozilla -- users may be lured into bypassing security
+ dialogs</topic> <affects>
<package>
- <name>thunderbird</name>
- <range><lt>0.7</lt></range>
- </package>
- <package>
- <name>de-linux-mozillafirebird</name>
- <name>el-linux-mozillafirebird</name>
- <name>firefox</name>
- <name>ja-linux-mozillafirebird-gtk1</name>
- <name>ja-mozillafirebird-gtk2</name>
- <name>linux-mozillafirebird</name>
- <name>ru-linux-mozillafirebird</name>
- <name>zhCN-linux-mozillafirebird</name>
- <name>zhTW-linux-mozillafirebird</name>
+ <name>thunderbird</name> <range><lt>0.7</lt></range>
+ </package> <package>
+ <name>de-linux-mozillafirebird</name>
+ <name>el-linux-mozillafirebird</name> <name>firefox</name>
+ <name>ja-linux-mozillafirebird-gtk1</name>
+ <name>ja-mozillafirebird-gtk2</name>
+ <name>linux-mozillafirebird</name>
+ <name>ru-linux-mozillafirebird</name>
+ <name>zhCN-linux-mozillafirebird</name>
+ <name>zhTW-linux-mozillafirebird</name>
<range><lt>0.9.2</lt></range>
- </package>
- <package>
- <name>de-netscape7</name>
- <name>fr-netscape7</name>
- <name>ja-netscape7</name>
- <name>netscape7</name>
- <name>pt_BR-netscape7</name>
- <range><le>7.2</le></range>
- </package>
- <package>
- <name>mozilla-gtk1</name>
- <name>linux-mozilla</name>
- <name>linux-mozilla-devel</name>
- <range><lt>1.7</lt></range>
- </package>
- <package>
- <name>mozilla</name>
- <range><lt>1.7,2</lt></range>
- </package>
- <package>
+ </package> <package>
+ <name>de-netscape7</name> <name>fr-netscape7</name>
+ <name>ja-netscape7</name> <name>netscape7</name>
+ <name>pt_BR-netscape7</name> <range><le>7.2</le></range>
+ </package> <package>
+ <name>mozilla-gtk1</name> <name>linux-mozilla</name>
+ <name>linux-mozilla-devel</name> <range><lt>1.7</lt></range>
+ </package> <package>
+ <name>mozilla</name> <range><lt>1.7,2</lt></range>
+ </package> <package>
<!-- These package names are obsolete. -->
- <name>de-linux-netscape</name>
- <name>fr-linux-netscape</name>
- <name>ja-linux-netscape</name>
- <name>linux-netscape</name>
- <name>linux-phoenix</name>
- <name>mozilla+ipv6</name>
- <name>mozilla-embedded</name>
- <name>mozilla-firebird</name>
- <name>mozilla-gtk2</name>
- <name>mozilla-gtk</name>
- <name>mozilla-thunderbird</name>
- <name>phoenix</name>
+ <name>de-linux-netscape</name> <name>fr-linux-netscape</name>
+ <name>ja-linux-netscape</name> <name>linux-netscape</name>
+ <name>linux-phoenix</name> <name>mozilla+ipv6</name>
+ <name>mozilla-embedded</name> <name>mozilla-firebird</name>
+ <name>mozilla-gtk2</name> <name>mozilla-gtk</name>
+ <name>mozilla-thunderbird</name> <name>phoenix</name>
<range><ge>0</ge></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>According to the Mozilla project:</p>
- <blockquote cite="http://www.mozilla.org/projects/security/known-vulnerabilities.html">
+ <p>According to the Mozilla project:</p> <blockquote
+ cite="http://www.mozilla.org/projects/security/known-vulnerabilities.html">
<p>An attacker who could lure users into clicking in
- particular places, or typing specific text, could cause a
- security permission or software installation dialog to pop
- up under the user's mouse click, clicking on the grant (or
- install) button.</p>
+ particular places, or typing specific text, could cause
+ a security permission or software installation dialog
+ to pop up under the user's mouse click, clicking on the
+ grant (or install) button.</p>
</blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2004-0762</cvename>
<url>http://bugzilla.mozilla.org/show_bug.cgi?id=162020</url>
- </references>
- <dates>
- <discovery>2004-06-05</discovery>
- <entry>2004-09-30</entry>
+ </references> <dates>
+ <discovery>2004-06-05</discovery> <entry>2004-09-30</entry>
</dates>
</vuln>
<vuln vid="5360a659-131c-11d9-bc4a-000c41e2cdad">
- <topic>mozilla -- hostname spoofing bug</topic>
- <affects>
+ <topic>mozilla -- hostname spoofing bug</topic> <affects>
<package>
- <name>thunderbird</name>
- <range><lt>0.7</lt></range>
- </package>
- <package>
- <name>de-linux-mozillafirebird</name>
- <name>el-linux-mozillafirebird</name>
- <name>firefox</name>
- <name>ja-linux-mozillafirebird-gtk1</name>
- <name>ja-mozillafirebird-gtk2</name>
- <name>linux-mozillafirebird</name>
- <name>ru-linux-mozillafirebird</name>
- <name>zhCN-linux-mozillafirebird</name>
- <name>zhTW-linux-mozillafirebird</name>
+ <name>thunderbird</name> <range><lt>0.7</lt></range>
+ </package> <package>
+ <name>de-linux-mozillafirebird</name>
+ <name>el-linux-mozillafirebird</name> <name>firefox</name>
+ <name>ja-linux-mozillafirebird-gtk1</name>
+ <name>ja-mozillafirebird-gtk2</name>
+ <name>linux-mozillafirebird</name>
+ <name>ru-linux-mozillafirebird</name>
+ <name>zhCN-linux-mozillafirebird</name>
+ <name>zhTW-linux-mozillafirebird</name>
<range><lt>0.9.2</lt></range>
- </package>
- <package>
- <name>de-netscape7</name>
- <name>fr-netscape7</name>
- <name>ja-netscape7</name>
- <name>netscape7</name>
- <name>pt_BR-netscape7</name>
- <range><le>7.2</le></range>
- </package>
- <package>
- <name>mozilla-gtk1</name>
- <name>linux-mozilla</name>
- <name>linux-mozilla-devel</name>
- <range><lt>1.7</lt></range>
- </package>
- <package>
- <name>mozilla</name>
- <range><lt>1.7,2</lt></range>
- </package>
- <package>
+ </package> <package>
+ <name>de-netscape7</name> <name>fr-netscape7</name>
+ <name>ja-netscape7</name> <name>netscape7</name>
+ <name>pt_BR-netscape7</name> <range><le>7.2</le></range>
+ </package> <package>
+ <name>mozilla-gtk1</name> <name>linux-mozilla</name>
+ <name>linux-mozilla-devel</name> <range><lt>1.7</lt></range>
+ </package> <package>
+ <name>mozilla</name> <range><lt>1.7,2</lt></range>
+ </package> <package>
<!-- These package names are obsolete. -->
- <name>de-linux-netscape</name>
- <name>fr-linux-netscape</name>
- <name>ja-linux-netscape</name>
- <name>linux-netscape</name>
- <name>linux-phoenix</name>
- <name>mozilla+ipv6</name>
- <name>mozilla-embedded</name>
- <name>mozilla-firebird</name>
- <name>mozilla-gtk2</name>
- <name>mozilla-gtk</name>
- <name>mozilla-thunderbird</name>
- <name>phoenix</name>
+ <name>de-linux-netscape</name> <name>fr-linux-netscape</name>
+ <name>ja-linux-netscape</name> <name>linux-netscape</name>
+ <name>linux-phoenix</name> <name>mozilla+ipv6</name>
+ <name>mozilla-embedded</name> <name>mozilla-firebird</name>
+ <name>mozilla-gtk2</name> <name>mozilla-gtk</name>
+ <name>mozilla-thunderbird</name> <name>phoenix</name>
<range><ge>0</ge></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>When processing URIs that contain an unqualified host name--
- specifically, a domain name of only one component--
- Mozilla will perform matching against the first component
- of the domain name in SSL certificates. In other words, in
- some situations, a certificate issued to "www.example.com"
+ <p>When processing URIs that contain an unqualified host
+ name--
+ specifically, a domain name of only one component-- Mozilla
+ will perform matching against the first component of the
+ domain name in SSL certificates. In other words, in some
+ situations, a certificate issued to "www.example.com"
will be accepted as matching "www".</p>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2004-0765</cvename>
<url>http://bugzilla.mozilla.org/show_bug.cgi?id=234058</url>
- </references>
- <dates>
- <discovery>2004-02-12</discovery>
- <entry>2004-09-30</entry>
+ </references> <dates>
+ <discovery>2004-02-12</discovery> <entry>2004-09-30</entry>
</dates>
</vuln>
<vuln vid="de16b056-132e-11d9-bc4a-000c41e2cdad">
- <topic>samba -- remote file disclosure</topic>
- <affects>
+ <topic>samba -- remote file disclosure</topic> <affects>
<package>
- <name>samba</name>
- <range><lt>2.2.12</lt></range>
+ <name>samba</name> <range><lt>2.2.12</lt></range>
<range><ge>3.a</ge><le>3.0.2a_1,1</le></range>
- </package>
- <package>
- <name>ja-samba</name>
- <range><lt>2.2.11.j1.0_1</lt></range>
- </package>
- </affects>
- <description>
- <body xmlns="http://www.w3.org/1999/xhtml">
- <p>According to a Samba Team security notice:</p>
- <blockquote cite="http://www.samba.org/samba/news/#security_2.2.12">
- <p>A security vulnerability has been located in Samba
- 2.2.x &lt;= 2.2.11 and Samba 3.0.x &lt;= 3.0.5. A remote
- attacker may be able to gain access to files which exist
- outside of the share's defined path. Such files must still
- be readable by the account used for the connection.</p>
- </blockquote>
- <blockquote cite="http://www.samba.org/samba/news/#errata_05oct">
- <p>The original notice for CAN-2004-0815 indicated that
- Samba 3.0.x &lt;= 3.0.5 was vulnerable to the security
- issue. After further research, Samba developers have
- confirmed that only Samba 3.0.2a and earlier releases
- contain the exploitable code.</p>
- </blockquote>
- </body>
- </description>
- <references>
+ </package> <package>
+ <name>ja-samba</name> <range><lt>2.2.11.j1.0_1</lt></range>
+ </package>
+ </affects> <description>
+ <body xmlns="http://www.w3.org/1999/xhtml">
+ <p>According to a Samba Team security notice:</p> <blockquote
+ cite="http://www.samba.org/samba/news/#security_2.2.12">
+ <p>A security vulnerability has been located in Samba
+ 2.2.x &lt;= 2.2.11 and Samba 3.0.x &lt;= 3.0.5. A remote
+ attacker may be able to gain access to files which exist
+ outside of the share's defined path. Such files must
+ still be readable by the account used for the connection.</p>
+ </blockquote> <blockquote
+ cite="http://www.samba.org/samba/news/#errata_05oct">
+ <p>The original notice for CAN-2004-0815 indicated that
+ Samba 3.0.x &lt;= 3.0.5 was vulnerable to the security
+ issue. After further research, Samba developers have
+ confirmed that only Samba 3.0.2a and earlier releases
+ contain the exploitable code.</p>
+ </blockquote>
+ </body>
+ </description> <references>
<cvename>CVE-2004-0815</cvename>
<url>http://www.samba.org/samba/news/#security_2.2.12</url>
- </references>
- <dates>
- <discovery>2004-09-30</discovery>
- <entry>2004-09-30</entry>
+ </references> <dates>
+ <discovery>2004-09-30</discovery> <entry>2004-09-30</entry>
<modified>2004-10-15</modified>
</dates>
</vuln>
<vuln vid="ab9c559e-115a-11d9-bc4a-000c41e2cdad">
- <topic>mozilla -- BMP decoder vulnerabilities</topic>
- <affects>
- <package>
- <name>thunderbird</name>
- <range><lt>0.7.3_1</lt></range>
- </package>
+ <topic>mozilla -- BMP decoder vulnerabilities</topic> <affects>
<package>
- <name>de-linux-mozillafirebird</name>
- <name>el-linux-mozillafirebird</name>
- <name>firefox</name>
- <name>ja-linux-mozillafirebird-gtk1</name>
- <name>ja-mozillafirebird-gtk2</name>
- <name>linux-mozillafirebird</name>
- <name>linux-phoenix</name>
- <name>phoenix</name>
- <name>ru-linux-mozillafirebird</name>
- <name>zhCN-linux-mozillafirebird</name>
- <name>zhTW-linux-mozillafirebird</name>
+ <name>thunderbird</name> <range><lt>0.7.3_1</lt></range>
+ </package> <package>
+ <name>de-linux-mozillafirebird</name>
+ <name>el-linux-mozillafirebird</name> <name>firefox</name>
+ <name>ja-linux-mozillafirebird-gtk1</name>
+ <name>ja-mozillafirebird-gtk2</name>
+ <name>linux-mozillafirebird</name> <name>linux-phoenix</name>
+ <name>phoenix</name> <name>ru-linux-mozillafirebird</name>
+ <name>zhCN-linux-mozillafirebird</name>
+ <name>zhTW-linux-mozillafirebird</name>
<range><lt>0.9.3_1</lt></range>
- </package>
- <package>
- <name>de-netscape7</name>
- <name>fr-netscape7</name>
- <name>ja-netscape7</name>
- <name>netscape7</name>
- <name>pt_BR-netscape7</name>
- <range><le>7.2</le></range>
- </package>
- <package>
- <name>linux-mozilla</name>
- <name>linux-mozilla-devel</name>
- <range><lt>1.7.3</lt></range>
- </package>
- <package>
- <name>mozilla-gtk1</name>
- <range><lt>1.7.2_3</lt></range>
- </package>
- <package>
- <name>mozilla</name>
- <range><lt>1.7.2_2,2</lt></range>
+ </package> <package>
+ <name>de-netscape7</name> <name>fr-netscape7</name>
+ <name>ja-netscape7</name> <name>netscape7</name>
+ <name>pt_BR-netscape7</name> <range><le>7.2</le></range>
+ </package> <package>
+ <name>linux-mozilla</name> <name>linux-mozilla-devel</name>
+ <range><lt>1.7.3</lt></range>
+ </package> <package>
+ <name>mozilla-gtk1</name> <range><lt>1.7.2_3</lt></range>
+ </package> <package>
+ <name>mozilla</name> <range><lt>1.7.2_2,2</lt></range>
<range><ge>1.8.a,2</ge><lt>1.8.a3_1,2</lt></range>
- </package>
- <package>
+ </package> <package>
<!-- These package names are obsolete. -->
- <name>mozilla+ipv6</name>
- <name>mozilla-embedded</name>
- <name>mozilla-firebird</name>
- <name>mozilla-gtk</name>
- <name>mozilla-gtk2</name>
- <name>mozilla-thunderbird</name>
- <name>linux-netscape</name>
- <name>de-linux-netscape</name>
- <name>fr-linux-netscape</name>
- <name>ja-linux-netscape</name>
+ <name>mozilla+ipv6</name> <name>mozilla-embedded</name>
+ <name>mozilla-firebird</name> <name>mozilla-gtk</name>
+ <name>mozilla-gtk2</name> <name>mozilla-thunderbird</name>
+ <name>linux-netscape</name> <name>de-linux-netscape</name>
+ <name>fr-linux-netscape</name> <name>ja-linux-netscape</name>
<range><ge>0</ge></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gael Delalleau discovered several integer overflows in
- Mozilla's BMP decoder that can result in denial-of-service or
- arbitrary code execution.</p>
+ Mozilla's BMP decoder that can result in denial-of-service
+ or arbitrary code execution.</p>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2004-0904</cvename>
<url>http://bugzilla.mozilla.org/show_bug.cgi?id=255067</url>
- <uscertta>TA04-261A</uscertta>
- <certvu>847200</certvu>
- </references>
- <dates>
- <discovery>2004-09-13</discovery>
- <entry>2004-09-28</entry>
+ <uscertta>TA04-261A</uscertta> <certvu>847200</certvu>
+ </references> <dates>
+ <discovery>2004-09-13</discovery> <entry>2004-09-28</entry>
<modified>2004-09-30</modified>
</dates>
</vuln>
<vuln vid="da690355-1159-11d9-bc4a-000c41e2cdad">
- <topic>mozilla -- vCard stack buffer overflow</topic>
- <affects>
+ <topic>mozilla -- vCard stack buffer overflow</topic> <affects>
<package>
- <name>thunderbird</name>
- <range><lt>0.7.3_1</lt></range>
- </package>
- <package>
- <name>mozilla</name>
- <range><lt>1.7.2_2,2</lt></range>
+ <name>thunderbird</name> <range><lt>0.7.3_1</lt></range>
+ </package> <package>
+ <name>mozilla</name> <range><lt>1.7.2_2,2</lt></range>
<range><ge>1.8.a,2</ge><lt>1.8.a3_1,2</lt></range>
+ </package> <package>
+ <name>mozilla-gtk1</name> <range><lt>1.7.2_3</lt></range>
+ </package> <package>
+ <name>linux-mozilla</name> <range><lt>1.7.3</lt></range>
</package>
- <package>
- <name>mozilla-gtk1</name>
- <range><lt>1.7.2_3</lt></range>
- </package>
- <package>
- <name>linux-mozilla</name>
- <range><lt>1.7.3</lt></range>
- </package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>Georgi Guninski discovered a stack buffer overflow which
- may be triggered when viewing email messages with vCard
- attachments.</p>
+ <p>Georgi Guninski discovered a stack buffer overflow which
+ may be triggered when viewing email messages with vCard
+ attachments.</p>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2004-0903</cvename>
<url>http://bugzilla.mozilla.org/show_bug.cgi?id=257314</url>
- <uscertta>TA04-261A</uscertta>
- <certvu>414240</certvu>
- </references>
- <dates>
- <discovery>2004-09-13</discovery>
- <entry>2004-09-28</entry>
+ <uscertta>TA04-261A</uscertta> <certvu>414240</certvu>
+ </references> <dates>
+ <discovery>2004-09-13</discovery> <entry>2004-09-28</entry>
<modified>2004-09-30</modified>
</dates>
</vuln>
<vuln vid="93d6162f-1153-11d9-bc4a-000c41e2cdad">
- <topic>mozilla -- multiple heap buffer overflows</topic>
- <affects>
+ <topic>mozilla -- multiple heap buffer overflows</topic> <affects>
<package>
- <name>thunderbird</name>
- <range><lt>0.7.3_1</lt></range>
- </package>
- <package>
- <name>firefox</name>
- <range><lt>0.9.3_1</lt></range>
- </package>
- <package>
- <name>mozilla</name>
- <range><lt>1.7.2_2,2</lt></range>
+ <name>thunderbird</name> <range><lt>0.7.3_1</lt></range>
+ </package> <package>
+ <name>firefox</name> <range><lt>0.9.3_1</lt></range>
+ </package> <package>
+ <name>mozilla</name> <range><lt>1.7.2_2,2</lt></range>
<range><ge>1.8.a,2</ge><lt>1.8.a3_1,2</lt></range>
+ </package> <package>
+ <name>mozilla-gtk1</name> <range><lt>1.7.2_3</lt></range>
+ </package> <package>
+ <name>linux-mozilla</name> <range><lt>1.7.3</lt></range>
+ </package> <package>
+ <name>linux-mozillafirebird</name> <range><ge>0</ge></range>
</package>
- <package>
- <name>mozilla-gtk1</name>
- <range><lt>1.7.2_3</lt></range>
- </package>
- <package>
- <name>linux-mozilla</name>
- <range><lt>1.7.3</lt></range>
- </package>
- <package>
- <name>linux-mozillafirebird</name>
- <range><ge>0</ge></range>
- </package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>Several heap buffer overflows were discovered and fixed in the
+ <p>Several heap buffer overflows were discovered and fixed
+ in the
most recent versions of Mozilla, Firefox, and Thunderbird.
These overflows may occur when:</p>
<ul>
- <li>Using the "Send Page" function.</li>
- <li>Checking mail on a malicious POP3 server.</li>
- <li>Processing non-ASCII URLs.</li>
- </ul>
- <p>Each of these vulnerabilities may be exploited for remote
+ <li>Using the "Send Page" function.</li> <li>Checking
+ mail on a malicious POP3 server.</li> <li>Processing
+ non-ASCII URLs.</li>
+ </ul> <p>Each of these vulnerabilities may be exploited for
+ remote
code execution.</p>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2004-0902</cvename>
<url>http://bugzilla.mozilla.org/show_bug.cgi?id=258005</url>
<url>http://bugzilla.mozilla.org/show_bug.cgi?id=245066</url>
<url>http://bugzilla.mozilla.org/show_bug.cgi?id=226669</url>
<url>http://bugzilla.mozilla.org/show_bug.cgi?id=256316</url>
<uscertta>TA04-261A</uscertta>
- </references>
- <dates>
- <discovery>2004-09-13</discovery>
- <entry>2004-09-28</entry>
+ </references> <dates>
+ <discovery>2004-09-13</discovery> <entry>2004-09-28</entry>
</dates>
</vuln>
@@ -15715,111 +12965,87 @@ http_access deny Gopher</pre>
<topic>php -- strip_tags cross-site scripting vulnerability</topic>
<affects>
<package>
- <name>mod_php4-twig</name>
- <name>php4</name>
- <name>php4-cgi</name>
- <name>php4-cli</name>
- <name>php4-dtc</name>
- <name>php4-horde</name>
- <name>php4-nms</name>
- <range><le>4.3.7_3</le></range>
- </package>
- <package>
- <name>mod_php4</name>
- <range><le>4.3.7_3,1</le></range>
- </package>
- <package>
- <name>php5</name>
- <name>php5-cgi</name>
- <name>php5-cli</name>
+ <name>mod_php4-twig</name> <name>php4</name> <name>php4-cgi</name>
+ <name>php4-cli</name> <name>php4-dtc</name> <name>php4-horde</name>
+ <name>php4-nms</name> <range><le>4.3.7_3</le></range>
+ </package> <package>
+ <name>mod_php4</name> <range><le>4.3.7_3,1</le></range>
+ </package> <package>
+ <name>php5</name> <name>php5-cgi</name> <name>php5-cli</name>
<range><le>5.0.0.r3_2</le></range>
+ </package> <package>
+ <name>mod_php5</name> <range><le>5.0.0.r3_2,1</le></range>
</package>
- <package>
- <name>mod_php5</name>
- <range><le>5.0.0.r3_2,1</le></range>
- </package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Stefan Esser of e-matters discovered that PHP's strip_tags()
- function would ignore certain characters during parsing of tags,
- allowing these tags to pass through. Select browsers could then
- parse these tags, possibly allowing cross-site scripting attacks.</p>
- </body>
- </description>
- <references>
- <cvename>CVE-2004-0595</cvename>
- <mlist msgid="20040713225525.GB26865@e-matters.de">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=108981589117423</mlist>
+ function would ignore certain characters during parsing
+ of tags, allowing these tags to pass through. Select
+ browsers could then parse these tags, possibly allowing
+ cross-site scripting attacks.</p>
+ </body>
+ </description> <references>
+ <cvename>CVE-2004-0595</cvename> <mlist
+ msgid="20040713225525.GB26865@e-matters.de">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=108981589117423</mlist>
<url>http://security.e-matters.de/advisories/122004.html</url>
<bid>10724</bid>
- </references>
- <dates>
- <discovery>2007-07-07</discovery>
- <entry>2004-09-27</entry>
+ </references> <dates>
+ <discovery>2007-07-07</discovery> <entry>2004-09-27</entry>
<modified>2004-10-02</modified>
</dates>
</vuln>
<vuln vid="dd7aa4f1-102f-11d9-8a8a-000c41e2cdad">
- <topic>php -- memory_limit related vulnerability</topic>
- <affects>
- <package>
- <name>mod_php4-twig</name>
- <name>php4</name>
- <name>php4-cgi</name>
- <name>php4-cli</name>
- <name>php4-dtc</name>
- <name>php4-horde</name>
- <name>php4-nms</name>
- <range><le>4.3.7_3</le></range>
- </package>
- <package>
- <name>mod_php4</name>
- <range><le>4.3.7_3,1</le></range>
- </package>
- <package>
- <name>php5</name>
- <name>php5-cgi</name>
- <name>php5-cli</name>
+ <topic>php -- memory_limit related vulnerability</topic> <affects>
+ <package>
+ <name>mod_php4-twig</name> <name>php4</name> <name>php4-cgi</name>
+ <name>php4-cli</name> <name>php4-dtc</name> <name>php4-horde</name>
+ <name>php4-nms</name> <range><le>4.3.7_3</le></range>
+ </package> <package>
+ <name>mod_php4</name> <range><le>4.3.7_3,1</le></range>
+ </package> <package>
+ <name>php5</name> <name>php5-cgi</name> <name>php5-cli</name>
<range><le>5.0.0.r3_2</le></range>
+ </package> <package>
+ <name>mod_php5</name> <range><le>5.0.0.r3_2,1</le></range>
</package>
- <package>
- <name>mod_php5</name>
- <range><le>5.0.0.r3_2,1</le></range>
- </package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>Stefan Esser of e-matters discovered a condition within PHP
+ <p>Stefan Esser of e-matters discovered a condition within
+ PHP
that may lead to remote execution of arbitrary code. The
- memory_limit facility is used to notify functions when memory
- contraints have been met. Under certain conditions, the entry
- into this facility is able to interrupt functions such as
- zend_hash_init() at locations not suitable for interruption.
- The result would leave these functions in a vulnerable state.</p>
- <blockquote cite="http://security.e-matters.de/advisories/112004.html">
- <p>An attacker that is able to trigger the memory_limit abort
- within zend_hash_init() and is additionally able to control
- the heap before the HashTable itself is allocated, is able to
- supply his own HashTable destructor pointer. [...]</p>
- <p>All mentioned places outside of the extensions are quite easy
- to exploit, because the memory allocation up to those places
- is deterministic and quite static throughout different PHP
- versions. [...]</p>
- <p>Because the exploit itself consist of supplying an arbitrary
- destructor pointer this bug is exploitable on any platform.</p>
- </blockquote>
- </body>
- </description>
- <references>
- <cvename>CVE-2004-0594</cvename>
- <mlist msgid="20040713225329.GA26865@e-matters.de">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=108981780109154</mlist>
+ memory_limit facility is used to notify functions when
+ memory contraints have been met. Under certain conditions,
+ the entry into this facility is able to interrupt functions
+ such as zend_hash_init() at locations not suitable for
+ interruption. The result would leave these functions in
+ a vulnerable state.</p>
+ <blockquote
+ cite="http://security.e-matters.de/advisories/112004.html">
+ <p>An attacker that is able to trigger the memory_limit
+ abort
+ within zend_hash_init() and is additionally able to
+ control the heap before the HashTable itself is allocated,
+ is able to supply his own HashTable destructor pointer.
+ [...]</p>
+ <p>All mentioned places outside of the extensions are
+ quite easy
+ to exploit, because the memory allocation up to those
+ places is deterministic and quite static throughout
+ different PHP versions. [...]</p>
+ <p>Because the exploit itself consist of supplying an
+ arbitrary
+ destructor pointer this bug is exploitable on any
+ platform.</p>
+ </blockquote>
+ </body>
+ </description> <references>
+ <cvename>CVE-2004-0594</cvename> <mlist
+ msgid="20040713225329.GA26865@e-matters.de">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=108981780109154</mlist>
<url>http://security.e-matters.de/advisories/112004.html</url>
<bid>10725</bid>
- </references>
- <dates>
- <discovery>2007-07-07</discovery>
- <entry>2004-09-27</entry>
+ </references> <dates>
+ <discovery>2007-07-07</discovery> <entry>2004-09-27</entry>
<modified>2004-10-02</modified>
</dates>
</vuln>
@@ -15828,76 +13054,68 @@ http_access deny Gopher</pre>
<topic>subversion -- WebDAV fails to protect metadata</topic>
<affects>
<package>
- <name>subversion</name>
- <name>subversion-perl</name>
- <name>subversion-python</name>
- <range><lt>1.0.8</lt></range>
+ <name>subversion</name> <name>subversion-perl</name>
+ <name>subversion-python</name> <range><lt>1.0.8</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>In some situations, subversion metadata may be unexpectedly
disclosed via WebDAV. A subversion advisory states:</p>
- <blockquote cite="http://subversion.tigris.org/security/CAN-2004-0749-advisory.txt">
- <p>mod_authz_svn, the Apache httpd module which does path-based
+ <blockquote
+ cite="http://subversion.tigris.org/security/CAN-2004-0749-advisory.txt">
+ <p>mod_authz_svn, the Apache httpd module which does
+ path-based
authorization on Subversion repositories, is not correctly
protecting all metadata on unreadable paths.</p>
- <p>This security issue is not about revealing the contents
- of protected files: it only reveals metadata about
- protected areas such as paths and log messages. This may
- or may not be important to your organization, depending
- on how you're using path-based authorization, and the
- sensitivity of the metadata. </p>
+ <p>This security issue is not about revealing the contents
+ of protected files: it only reveals metadata about
+ protected areas such as paths and log messages. This
+ may or may not be important to your organization,
+ depending on how you're using path-based authorization,
+ and the sensitivity of the metadata. </p>
</blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2004-0749</cvename>
<url>http://subversion.tigris.org/security/CAN-2004-0749-advisory.txt</url>
- </references>
- <dates>
- <discovery>2004-09-15</discovery>
- <entry>2004-09-26</entry>
+ </references> <dates>
+ <discovery>2004-09-15</discovery> <entry>2004-09-26</entry>
</dates>
- </vuln>
- <vuln vid="273cc1a3-0d6b-11d9-8a8a-000c41e2cdad">
- <topic>lha -- numerous vulnerabilities when extracting archives</topic>
- <affects>
+ </vuln> <vuln vid="273cc1a3-0d6b-11d9-8a8a-000c41e2cdad">
+ <topic>lha -- numerous vulnerabilities when extracting
+ archives</topic> <affects>
<package>
- <name>lha</name>
- <range><lt>1.14i_6</lt></range>
+ <name>lha</name> <range><lt>1.14i_6</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>Source code reviews of lha by Lukasz Wojtow, Thomas Biege,
+ <p>Source code reviews of lha by Lukasz Wojtow, Thomas
+ Biege,
and others uncovered a number of vulnerabilities affecting
lha:</p>
<ul>
<li>Buffer overflows when handling archives and filenames.
(CVE-2004-0694)</li>
- <li>Possible command execution via shell meta-characters when
+ <li>Possible command execution via shell meta-characters
+ when
built with NOMKDIR. (CVE-2004-0745)</li>
- <li>Buffer overflow resulting in arbitrary code execution when
+ <li>Buffer overflow resulting in arbitrary code execution
+ when
handling long pathnames in LHZ archives. (CVE-2004-0769)</li>
<li>Buffer overflow in the extract_one. (CVE-2004-0771)</li>
</ul>
</body>
- </description>
- <references>
- <cvename>CVE-2004-0694</cvename>
- <cvename>CVE-2004-0745</cvename>
- <cvename>CVE-2004-0769</cvename>
- <cvename>CVE-2004-0771</cvename>
- <mlist msgid="20040515110900.24784.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=108464470103227</mlist>
- <mlist msgid="20040606162856.29866.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=108668791510153</mlist>
+ </description> <references>
+ <cvename>CVE-2004-0694</cvename> <cvename>CVE-2004-0745</cvename>
+ <cvename>CVE-2004-0769</cvename> <cvename>CVE-2004-0771</cvename>
+ <mlist
+ msgid="20040515110900.24784.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=108464470103227</mlist>
+ <mlist
+ msgid="20040606162856.29866.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=108668791510153</mlist>
<url>http://bugs.gentoo.org/show_bug.cgi?id=51285</url>
- <url>http://xforce.iss.net/xforce/xfdb/16196</url>
- <bid>10354</bid>
- </references>
- <dates>
- <discovery>2004-05-17</discovery>
- <entry>2004-09-23</entry>
+ <url>http://xforce.iss.net/xforce/xfdb/16196</url> <bid>10354</bid>
+ </references> <dates>
+ <discovery>2004-05-17</discovery> <entry>2004-09-23</entry>
</dates>
</vuln>
@@ -15905,138 +13123,104 @@ http_access deny Gopher</pre>
<topic>mysql -- heap buffer overflow with prepared statements</topic>
<affects>
<package>
- <name>mysql-server</name>
- <name>mysql-client</name>
+ <name>mysql-server</name> <name>mysql-client</name>
<range><ge>4.1.0</ge><le>4.1.4</le></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>There is a buffer overflow in the prepared statements API
- (libmysqlclient) when a statement containing thousands of
- placeholders is executed.</p>
+ <p>There is a buffer overflow in the prepared statements
+ API
+ (libmysqlclient) when a statement containing thousands
+ of placeholders is executed.</p>
</body>
- </description>
- <references>
+ </description> <references>
<url>http://bugs.mysql.com/bug.php?id=5194</url>
<url>http://dev.mysql.com/doc/mysql/en/News-4.1.5.html</url>
<url>http://mysql.bkbits.net:8080/mysql-4.1/cset@1.1932.152.4</url>
- </references>
- <dates>
- <discovery>2004-09-08</discovery>
- <entry>2004-09-23</entry>
+ </references> <dates>
+ <discovery>2004-09-08</discovery> <entry>2004-09-23</entry>
</dates>
</vuln>
<vuln vid="e9f9d232-0cb2-11d9-8a8a-000c41e2cdad">
- <topic>mozilla -- security icon spoofing</topic>
- <affects>
- <package>
- <name>firefox</name>
- <range><lt>0.9</lt></range>
- </package>
+ <topic>mozilla -- security icon spoofing</topic> <affects>
<package>
- <name>linux-mozilla</name>
- <name>linux-mozilla-devel</name>
- <range><lt>1.7</lt></range>
- </package>
- <package>
- <name>mozilla</name>
- <range><lt>1.7,2</lt></range>
- </package>
- <package>
- <name>mozilla-gtk1</name>
+ <name>firefox</name> <range><lt>0.9</lt></range>
+ </package> <package>
+ <name>linux-mozilla</name> <name>linux-mozilla-devel</name>
<range><lt>1.7</lt></range>
+ </package> <package>
+ <name>mozilla</name> <range><lt>1.7,2</lt></range>
+ </package> <package>
+ <name>mozilla-gtk1</name> <range><lt>1.7</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>Under certain situations it is possible for the security icon
- which Mozilla displays when connected to a site using SSL to
- be spoofed. This could be used to make so-called "phishing
- attacks" more difficult to detect.</p>
+ <p>Under certain situations it is possible for the security
+ icon
+ which Mozilla displays when connected to a site using SSL
+ to be spoofed. This could be used to make so-called
+ "phishing attacks" more difficult to detect.</p>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2004-0761</cvename>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=240053</url>
- </references>
- <dates>
- <discovery>2004-04-08</discovery>
- <entry>2004-09-22</entry>
+ </references> <dates>
+ <discovery>2004-04-08</discovery> <entry>2004-09-22</entry>
</dates>
</vuln>
<vuln vid="7c188c55-0cb0-11d9-8a8a-000c41e2cdad">
- <topic>mozilla -- NULL bytes in FTP URLs</topic>
- <affects>
- <package>
- <name>firefox</name>
- <range><lt>0.9.3</lt></range>
- </package>
- <package>
- <name>linux-mozilla</name>
- <name>linux-mozilla-devel</name>
- <range><lt>1.7.2</lt></range>
- </package>
- <package>
- <name>mozilla</name>
- <range><lt>1.7.2,2</lt></range>
- <range><ge>1.8.a,2</ge></range>
- </package>
+ <topic>mozilla -- NULL bytes in FTP URLs</topic> <affects>
<package>
- <name>mozilla-gtk1</name>
+ <name>firefox</name> <range><lt>0.9.3</lt></range>
+ </package> <package>
+ <name>linux-mozilla</name> <name>linux-mozilla-devel</name>
<range><lt>1.7.2</lt></range>
+ </package> <package>
+ <name>mozilla</name> <range><lt>1.7.2,2</lt></range>
+ <range><ge>1.8.a,2</ge></range>
+ </package> <package>
+ <name>mozilla-gtk1</name> <range><lt>1.7.2</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>When handling FTP URLs containing NULL bytes, Mozilla will
- interpret the file content as HTML. This may allow unexpected
- execution of Javascript when viewing plain text or other file
- types via FTP.</p>
+ <p>When handling FTP URLs containing NULL bytes, Mozilla
+ will
+ interpret the file content as HTML. This may allow
+ unexpected execution of Javascript when viewing plain
+ text or other file types via FTP.</p>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2004-0760</cvename>
<url>http://bugzilla.mozilla.org/show_bug.cgi?id=250906</url>
- </references>
- <dates>
- <discovery>2004-07-11</discovery>
- <entry>2004-09-22</entry>
+ </references> <dates>
+ <discovery>2004-07-11</discovery> <entry>2004-09-22</entry>
<modified>2004-09-24</modified>
</dates>
</vuln>
<vuln vid="6e740881-0cae-11d9-8a8a-000c41e2cdad">
- <topic>mozilla -- automated file upload</topic>
- <affects>
+ <topic>mozilla -- automated file upload</topic> <affects>
<package>
- <name>mozilla</name>
- <range><ge>1.7.a,2</ge><lt>1.7,2</lt></range>
+ <name>mozilla</name> <range><ge>1.7.a,2</ge><lt>1.7,2</lt></range>
<range><ge>1.8.a,2</ge><lt>1.8.a2,2</lt></range>
+ </package> <package>
+ <name>mozilla-gtk1</name> <range><ge>1.7.a</ge><lt>1.7</lt></range>
</package>
- <package>
- <name>mozilla-gtk1</name>
- <range><ge>1.7.a</ge><lt>1.7</lt></range>
- </package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>A malicious web page can cause an automated file upload
- from the victim's machine when viewed with Mozilla with
- Javascript enabled. This is due to a bug permitting
- default values for type="file" &lt;input&gt; elements in
- certain situations.</p>
+ <p>A malicious web page can cause an automated file upload
+ from the victim's machine when viewed with Mozilla with
+ Javascript enabled. This is due to a bug permitting
+ default values for type="file" &lt;input&gt; elements in
+ certain situations.</p>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2004-0759</cvename>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=241924</url>
- </references>
- <dates>
- <discovery>2004-04-28</discovery>
- <entry>2004-09-22</entry>
+ </references> <dates>
+ <discovery>2004-04-28</discovery> <entry>2004-09-22</entry>
<modified>2004-09-26</modified>
</dates>
</vuln>
@@ -16045,82 +13229,66 @@ http_access deny Gopher</pre>
<topic>mozilla -- built-in CA certificates may be overridden</topic>
<affects>
<package>
- <name>firefox</name>
- <range><lt>0.9.3</lt></range>
- </package>
- <package>
- <name>linux-mozilla</name>
- <name>linux-mozilla-devel</name>
- <range><lt>1.7.2</lt></range>
- </package>
- <package>
- <name>mozilla</name>
- <range><lt>1.7.2,2</lt></range>
- <range><ge>1.8.a,2</ge></range>
- </package>
- <package>
- <name>mozilla-gtk1</name>
- <range><lt>1.7.2</lt></range>
+ <name>firefox</name> <range><lt>0.9.3</lt></range>
+ </package> <package>
+ <name>linux-mozilla</name> <name>linux-mozilla-devel</name>
+ <range><lt>1.7.2</lt></range>
+ </package> <package>
+ <name>mozilla</name> <range><lt>1.7.2,2</lt></range>
+ <range><ge>1.8.a,2</ge></range>
+ </package> <package>
+ <name>mozilla-gtk1</name> <range><lt>1.7.2</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>Under some situations, Mozilla will automatically import
- a certificate from an email message or web site. This
- behavior can be used as a denial-of-service attack: if the
- certificate has a distinguished name (DN) identical to one
- of the built-in Certificate Authorities (CAs), then Mozilla
- will no longer be able to certify sites with certificates
- issued from that CA.</p>
+ <p>Under some situations, Mozilla will automatically import
+ a certificate from an email message or web site. This
+ behavior can be used as a denial-of-service attack: if
+ the certificate has a distinguished name (DN) identical
+ to one of the built-in Certificate Authorities (CAs),
+ then Mozilla will no longer be able to certify sites with
+ certificates issued from that CA.</p>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2004-0758</cvename>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=249004</url>
- <certvu>160360</certvu>
- <url>http://banquo.inf.ethz.ch:8080/</url>
- </references>
- <dates>
- <discovery>2004-06-29</discovery>
- <entry>2004-09-22</entry>
+ <certvu>160360</certvu> <url>http://banquo.inf.ethz.ch:8080/</url>
+ </references> <dates>
+ <discovery>2004-06-29</discovery> <entry>2004-09-22</entry>
</dates>
</vuln>
<vuln vid="a4815970-c5cc-11d8-8898-000d6111a684">
- <topic>rssh -- file name disclosure bug</topic>
- <affects>
+ <topic>rssh -- file name disclosure bug</topic> <affects>
<package>
- <name>rssh</name>
- <range><lt>2.2.1</lt></range>
+ <name>rssh</name> <range><lt>2.2.1</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>rssh expands command line paramters before invoking chroot.
- This could result in the disclosure to the client of file
- names outside of the chroot directory. A posting by the rssh
- author explains:</p>
- <blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=108787373022844">
- <p>The cause of the problem identified by Mr. McCaw is that
- rssh expanded command-line arguments prior to entering
- the chroot jail. This bug DOES NOT allow a user to
- access any of the files outside the jail, but can allow
- them to discover what files are in a directory which is
- outside the jail, if their credentials on the server would
- normally allow them read/execute access in the specified
- directory.</p>
+ <p>rssh expands command line paramters before invoking
+ chroot.
+ This could result in the disclosure to the client of file
+ names outside of the chroot directory. A posting by the
+ rssh author explains:</p>
+ <blockquote
+ cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=108787373022844">
+ <p>The cause of the problem identified by Mr. McCaw is
+ that
+ rssh expanded command-line arguments prior to entering
+ the chroot jail. This bug DOES NOT allow a user to
+ access any of the files outside the jail, but can allow
+ them to discover what files are in a directory which
+ is outside the jail, if their credentials on the server
+ would normally allow them read/execute access in the
+ specified directory.</p>
</blockquote>
</body>
- </description>
- <references>
- <cvename>CVE-2004-0609</cvename>
- <mlist msgid="20040619074141.GG13649@sophic.org">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=108787373022844</mlist>
- <bid>10574</bid>
- <url>http://www.osvdb.org/7239</url>
- </references>
- <dates>
- <discovery>2004-06-19</discovery>
- <entry>2004-09-21</entry>
+ </description> <references>
+ <cvename>CVE-2004-0609</cvename> <mlist
+ msgid="20040619074141.GG13649@sophic.org">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=108787373022844</mlist>
+ <bid>10574</bid> <url>http://www.osvdb.org/7239</url>
+ </references> <dates>
+ <discovery>2004-06-19</discovery> <entry>2004-09-21</entry>
</dates>
</vuln>
@@ -16128,157 +13296,127 @@ http_access deny Gopher</pre>
<topic>gnu-radius -- SNMP-related denial-of-service</topic>
<affects>
<package>
- <name>gnu-radius</name>
- <range><lt>1.2.94</lt></range>
+ <name>gnu-radius</name> <range><lt>1.2.94</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>An iDEFENSE security advisory reports:</p>
- <blockquote
+ <p>An iDEFENSE security advisory reports:</p> <blockquote
cite="http://www.idefense.com/application/poi/display?id=141&amp;type=vulnerabilities">
- <p>Remote exploitation of an input validation error in
- version 1.2 of GNU radiusd could allow a denial of
- service.</p>
- <p>The vulnerability specifically exists within
- the asn_decode_string() function defined in
- snmplib/asn1.c. When a very large unsigned number is
- supplied, it is possible that an integer overflow will
- occur in the bounds-checking code. The daemon will then
- attempt to reference unallocated memory, resulting in an
- access violation that causes the process to terminate.</p>
- </blockquote>
- </body>
- </description>
- <references>
+ <p>Remote exploitation of an input validation error in
+ version 1.2 of GNU radiusd could allow a denial of
+ service.</p>
+ <p>The vulnerability specifically exists within
+ the asn_decode_string() function defined in snmplib/asn1.c.
+ When a very large unsigned number is supplied, it is
+ possible that an integer overflow will occur in the
+ bounds-checking code. The daemon will then attempt to
+ reference unallocated memory, resulting in an access
+ violation that causes the process to terminate.</p>
+ </blockquote>
+ </body>
+ </description> <references>
<cvename>CVE-2004-0849</cvename>
<url>http://www.idefense.com/application/poi/display?id=141&amp;type=vulnerabilities</url>
- </references>
- <dates>
- <discovery>2004-09-15</discovery>
- <entry>2004-09-20</entry>
+ </references> <dates>
+ <discovery>2004-09-15</discovery> <entry>2004-09-20</entry>
<modified>2005-05-03</modified>
</dates>
</vuln>
<vuln vid="a268ef4a-0b35-11d9-8a8a-000c41e2cdad">
- <topic>sudo -- sudoedit information disclosure</topic>
- <affects>
+ <topic>sudo -- sudoedit information disclosure</topic> <affects>
<package>
- <name>sudo</name>
- <range><eq>1.6.8</eq></range>
+ <name>sudo</name> <range><eq>1.6.8</eq></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>A new feature of sudo 1.6.8 called "sudoedit" (a safe
- editing facility) may allow users to read files to which
- they normally have no access.</p>
+ <p>A new feature of sudo 1.6.8 called "sudoedit" (a safe
+ editing facility) may allow users to read files to which
+ they normally have no access.</p>
</body>
- </description>
- <references>
+ </description> <references>
<url>http://www.sudo.ws/sudo/alerts/sudoedit.html</url>
- </references>
- <dates>
- <discovery>2004-09-18</discovery>
- <entry>2004-09-20</entry>
+ </references> <dates>
+ <discovery>2004-09-18</discovery> <entry>2004-09-20</entry>
</dates>
</vuln>
<vuln vid="ca6c8f35-0a5f-11d9-ad6f-00061bc2ad93">
- <topic>apache -- heap overflow in mod_proxy</topic>
- <affects>
- <package>
- <name>apache</name>
- <range><lt>1.3.31_1</lt></range>
- </package>
- <package>
- <name>apache13-ssl</name>
- <range><le>1.3.29.1.53_2</le></range>
- </package>
+ <topic>apache -- heap overflow in mod_proxy</topic> <affects>
<package>
+ <name>apache</name> <range><lt>1.3.31_1</lt></range>
+ </package> <package>
+ <name>apache13-ssl</name> <range><le>1.3.29.1.53_2</le></range>
+ </package> <package>
<name>apache13-modssl</name>
<range><lt>1.3.31+2.8.18_4</lt></range>
+ </package> <package>
+ <name>apache13+ipv6</name> <range><le>1.3.29_2</le></range>
+ </package> <package>
+ <name>apache13-modperl</name> <range><le>1.3.31</le></range>
</package>
- <package>
- <name>apache13+ipv6</name>
- <range><le>1.3.29_2</le></range>
- </package>
- <package>
- <name>apache13-modperl</name>
- <range><le>1.3.31</le></range>
- </package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A buffer overflow exists in mod_proxy which may
- allow an attacker to launch local DoS attacks
- and possibly execute arbitrary code.</p>
+ allow an attacker to launch local DoS attacks and possibly
+ execute arbitrary code.</p>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2004-0492</cvename>
<url>http://www.guninski.com/modproxy1.html</url>
- </references>
- <dates>
- <discovery>2004-06-10</discovery>
- <entry>2004-09-19</entry>
+ </references> <dates>
+ <discovery>2004-06-10</discovery> <entry>2004-09-19</entry>
<modified>2004-10-05</modified>
</dates>
</vuln>
<vuln vid="d2102505-f03d-11d8-81b0-000347a4fa7d">
- <topic>cvs -- numerous vulnerabilities</topic>
- <affects>
+ <topic>cvs -- numerous vulnerabilities</topic> <affects>
<package>
- <name>cvs+ipv6</name>
- <range><lt>1.11.17</lt></range>
- </package>
- <system>
- <name>FreeBSD</name>
- <range><ge>5.2</ge><lt>5.2.1_10</lt></range>
+ <name>cvs+ipv6</name> <range><lt>1.11.17</lt></range>
+ </package> <system>
+ <name>FreeBSD</name> <range><ge>5.2</ge><lt>5.2.1_10</lt></range>
<range><ge>4.10</ge><lt>4.10_3</lt></range>
<range><ge>4.9</ge><lt>4.9_12</lt></range>
<range><ge>4.8</ge><lt>4.8_25</lt></range>
</system>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>A number of vulnerabilities were discovered in CVS by
+ <p>A number of vulnerabilities were discovered in CVS by
Stefan Esser, Sebastian Krahmer, and Derek Price.</p>
<ul>
- <li>Insufficient input validation while processing "Entry"
+ <li>Insufficient input validation while processing "Entry"
lines. (CVE-2004-0414)</li>
- <li>A double-free resulting from erroneous state handling while
+ <li>A double-free resulting from erroneous state handling
+ while
processing "Argumentx" commands. (CVE-2004-0416)</li>
<li>Integer overflow while processing "Max-dotdot" commands.
(CVE-2004-0417)</li>
- <li>Erroneous handling of empty entries handled while processing
+ <li>Erroneous handling of empty entries handled while
+ processing
"Notify" commands. (CVE-2004-0418)</li>
<li>A format string bug while processing CVS wrappers.</li>
- <li>Single-byte buffer underflows while processing configuration files
+ <li>Single-byte buffer underflows while processing
+ configuration files
from CVSROOT.</li>
<li>Various other integer overflows.</li>
- </ul>
- <p>Additionally, iDEFENSE reports an undocumented command-line
- flag used in debugging does not perform input validation on
- the given path names.</p>
- <p>CVS servers ("cvs server" or :pserver: modes) are
- affected by these vulnerabilities. They vary in impact
- but include information disclosure (the iDEFENSE-reported
- bug), denial-of-service (CVE-2004-0414, CVE-2004-0416,
- CVE-2004-0417 and other bugs), or possibly arbitrary code
- execution (CVE-2004-0418). In very special situations where
- the attacker may somehow influence the contents of CVS
- configuration files in CVSROOT, additional attacks may be
- possible.</p>
- </body>
- </description>
- <references>
- <cvename>CVE-2004-0414</cvename>
- <cvename>CVE-2004-0416</cvename>
- <cvename>CVE-2004-0417</cvename>
- <cvename>CVE-2004-0418</cvename>
+ </ul> <p>Additionally, iDEFENSE reports an undocumented
+ command-line
+ flag used in debugging does not perform input validation
+ on the given path names.</p>
+ <p>CVS servers ("cvs server" or :pserver: modes) are
+ affected by these vulnerabilities. They vary in impact
+ but include information disclosure (the iDEFENSE-reported
+ bug), denial-of-service (CVE-2004-0414, CVE-2004-0416,
+ CVE-2004-0417 and other bugs), or possibly arbitrary code
+ execution (CVE-2004-0418). In very special situations
+ where the attacker may somehow influence the contents of
+ CVS configuration files in CVSROOT, additional attacks
+ may be possible.</p>
+ </body>
+ </description> <references>
+ <cvename>CVE-2004-0414</cvename> <cvename>CVE-2004-0416</cvename>
+ <cvename>CVE-2004-0417</cvename> <cvename>CVE-2004-0418</cvename>
<cvename>CVE-2004-0778</cvename>
<url>http://secunia.com/advisories/11817</url>
<url>http://secunia.com/advisories/12309</url>
@@ -16291,13 +13429,10 @@ http_access deny Gopher</pre>
<url>http://www.osvdb.org/6833</url>
<url>http://www.osvdb.org/6834</url>
<url>http://www.osvdb.org/6835</url>
- <url>http://www.osvdb.org/6836</url>
- <bid>10499</bid>
+ <url>http://www.osvdb.org/6836</url> <bid>10499</bid>
<freebsdsa>SA-04:14.cvs</freebsdsa>
- </references>
- <dates>
- <discovery>2004-05-20</discovery>
- <entry>2004-08-17</entry>
+ </references> <dates>
+ <discovery>2004-05-20</discovery> <entry>2004-08-17</entry>
<modified>2004-09-19</modified>
</dates>
</vuln>
@@ -16306,114 +13441,80 @@ http_access deny Gopher</pre>
<topic>gdk-pixbuf -- image decoding vulnerabilities</topic>
<affects>
<package>
- <name>linux-gdk-pixbuf</name>
- <range><lt>0.22.0.11.3.5</lt></range>
- </package>
- <package>
- <name>gtk</name>
- <range><ge>2.0</ge><lt>2.4.9_1</lt></range>
+ <name>linux-gdk-pixbuf</name> <range><lt>0.22.0.11.3.5</lt></range>
+ </package> <package>
+ <name>gtk</name> <range><ge>2.0</ge><lt>2.4.9_1</lt></range>
+ </package> <package>
+ <name>gdk-pixbuf</name> <range><lt>0.22.0_2</lt></range>
</package>
- <package>
- <name>gdk-pixbuf</name>
- <range><lt>0.22.0_2</lt></range>
- </package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>Chris Evans discovered several flaws in the gdk-pixbuf
- XPM image decoder:</p>
+ <p>Chris Evans discovered several flaws in the gdk-pixbuf
+ XPM image decoder:</p>
<ul>
<li>Heap-based overflow in pixbuf_create_from_xpm</li>
<li>Stack-based overflow in xpm_extract_color</li>
<li>Integer overflows in io-ico.c</li>
- </ul>
- <p>Some of these flaws are believed to be exploitable.</p>
+ </ul> <p>Some of these flaws are believed to be exploitable.</p>
</body>
- </description>
- <references>
- <cvename>CVE-2004-0782</cvename>
- <cvename>CVE-2004-0783</cvename>
+ </description> <references>
+ <cvename>CVE-2004-0782</cvename> <cvename>CVE-2004-0783</cvename>
<cvename>CVE-2004-0788</cvename>
<url>http://scary.beasts.org/security/CESA-2004-005.txt</url>
- </references>
- <dates>
- <discovery>2004-09-15</discovery>
- <entry>2004-09-15</entry>
+ </references> <dates>
+ <discovery>2004-09-15</discovery> <entry>2004-09-15</entry>
<modified>2004-11-09</modified>
</dates>
</vuln>
<vuln vid="ef253f8b-0727-11d9-b45d-000c41e2cdad">
- <topic>xpm -- image decoding vulnerabilities</topic>
- <affects>
- <package>
- <name>agenda-snow-libs</name>
- <name>linux_base</name>
- <name>open-motif-devel</name>
- <name>mupad</name>
- <name>zh-cle_base</name>
- <range><ge>0</ge></range>
- </package>
- <package>
- <name>libXpm</name>
- <range><lt>3.5.1_1</lt></range>
- </package>
- <package>
- <name>XFree86-libraries</name>
- <range><lt>4.4.0_1</lt></range>
- </package>
- <package>
- <name>xorg-libraries</name>
- <range><lt>6.7.0_2</lt></range>
- </package>
- <package>
- <name>lesstif</name>
- <range><lt>0.93.96,2</lt></range>
- </package>
- <package>
- <name>xpm</name>
- <range><lt>3.4k_1</lt></range>
- </package>
- <package>
- <name>linux-openmotif</name>
- <range><lt>2.2.4</lt></range>
- </package>
- <package>
- <name>open-motif</name>
- <range><lt>2.2.3_1</lt></range>
- </package>
- </affects>
- <description>
- <body xmlns="http://www.w3.org/1999/xhtml">
- <p>Chris Evans discovered several vulnerabilities in the libXpm
+ <topic>xpm -- image decoding vulnerabilities</topic> <affects>
+ <package>
+ <name>agenda-snow-libs</name> <name>linux_base</name>
+ <name>open-motif-devel</name> <name>mupad</name>
+ <name>zh-cle_base</name> <range><ge>0</ge></range>
+ </package> <package>
+ <name>libXpm</name> <range><lt>3.5.1_1</lt></range>
+ </package> <package>
+ <name>XFree86-libraries</name> <range><lt>4.4.0_1</lt></range>
+ </package> <package>
+ <name>xorg-libraries</name> <range><lt>6.7.0_2</lt></range>
+ </package> <package>
+ <name>lesstif</name> <range><lt>0.93.96,2</lt></range>
+ </package> <package>
+ <name>xpm</name> <range><lt>3.4k_1</lt></range>
+ </package> <package>
+ <name>linux-openmotif</name> <range><lt>2.2.4</lt></range>
+ </package> <package>
+ <name>open-motif</name> <range><lt>2.2.3_1</lt></range>
+ </package>
+ </affects> <description>
+ <body xmlns="http://www.w3.org/1999/xhtml">
+ <p>Chris Evans discovered several vulnerabilities in the
+ libXpm
image decoder:</p>
<ul>
<li>A stack-based buffer overflow in xpmParseColors</li>
- <li>An integer overflow in xpmParseColors</li>
- <li>A stack-based buffer overflow in ParsePixels and
+ <li>An integer overflow in xpmParseColors</li> <li>A
+ stack-based buffer overflow in ParsePixels and
ParseAndPutPixels</li>
- </ul>
- <p>The X11R6.8.1 release announcement reads:</p>
- <blockquote cite="http://freedesktop.org/pipermail/xorg/2004-September/003172.html">
- <p>This version is purely a security release, addressing
- multiple integer and stack overflows in libXpm, the X
- Pixmap library; all known versions of X (both XFree86
- and X.Org) are affected, so all users of X are strongly
- encouraged to upgrade.</p>
+ </ul> <p>The X11R6.8.1 release announcement reads:</p>
+ <blockquote
+ cite="http://freedesktop.org/pipermail/xorg/2004-September/003172.html">
+ <p>This version is purely a security release, addressing
+ multiple integer and stack overflows in libXpm, the X
+ Pixmap library; all known versions of X (both XFree86
+ and X.Org) are affected, so all users of X are strongly
+ encouraged to upgrade.</p>
</blockquote>
</body>
- </description>
- <references>
- <cvename>CVE-2004-0687</cvename>
- <cvename>CVE-2004-0688</cvename>
+ </description> <references>
+ <cvename>CVE-2004-0687</cvename> <cvename>CVE-2004-0688</cvename>
<url>http://freedesktop.org/pipermail/xorg/2004-September/003172.html</url>
<url>http://scary.beasts.org/security/CESA-2004-003.txt</url>
- <certvu>537878</certvu>
- <certvu>882750</certvu>
- </references>
- <dates>
- <discovery>2004-09-15</discovery>
- <entry>2004-09-15</entry>
+ <certvu>537878</certvu> <certvu>882750</certvu>
+ </references> <dates>
+ <discovery>2004-09-15</discovery> <entry>2004-09-15</entry>
<modified>2005-01-03</modified>
</dates>
</vuln>
@@ -16422,344 +13523,263 @@ http_access deny Gopher</pre>
<topic>cups -- print queue browser denial-of-service</topic>
<affects>
<package>
- <name>cups-base</name>
- <range><lt>1.1.21</lt></range>
+ <name>cups-base</name> <range><lt>1.1.21</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>If the CUPS server (cupsd) receives a zero-length UDP
message, it will disable its print queue browser service.</p>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2004-0558</cvename>
<url>http://www.cups.org/str.php?L863</url>
- </references>
- <dates>
- <discovery>2004-08-23</discovery>
- <entry>2004-09-15</entry>
+ </references> <dates>
+ <discovery>2004-08-23</discovery> <entry>2004-09-15</entry>
</dates>
</vuln>
<vuln vid="762d1c6d-0722-11d9-b45d-000c41e2cdad">
- <topic>apache -- apr_uri_parse IPv6 address handling vulnerability</topic>
- <affects>
+ <topic>apache -- apr_uri_parse IPv6 address handling
+ vulnerability</topic> <affects>
<package>
- <name>apache</name>
- <range><ge>2.0</ge><lt>2.0.50_3</lt></range>
+ <name>apache</name> <range><ge>2.0</ge><lt>2.0.50_3</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>The Apache Software Foundation Security Team discovered a
- programming error in the apr-util library function apr_uri_parse.
- When parsing IPv6 literal addresses, it is possible that a
- length is incorrectly calculated to be negative, and this
- value is passed to memcpy. This may result in an exploitable
- vulnerability on some platforms, including FreeBSD.</p>
+ <p>The Apache Software Foundation Security Team discovered
+ a
+ programming error in the apr-util library function
+ apr_uri_parse. When parsing IPv6 literal addresses, it
+ is possible that a length is incorrectly calculated to
+ be negative, and this value is passed to memcpy. This
+ may result in an exploitable vulnerability on some
+ platforms, including FreeBSD.</p>
</body>
- </description>
- <references>
- <cvename>CVE-2004-0786</cvename>
- <url>http://httpd.apache.org</url>
- </references>
- <dates>
- <discovery>2004-09-15</discovery>
- <entry>2004-09-15</entry>
+ </description> <references>
+ <cvename>CVE-2004-0786</cvename> <url>http://httpd.apache.org</url>
+ </references> <dates>
+ <discovery>2004-09-15</discovery> <entry>2004-09-15</entry>
</dates>
</vuln>
<vuln vid="013fa252-0724-11d9-b45d-000c41e2cdad">
- <topic>mod_dav -- lock related denial-of-service</topic>
- <affects>
+ <topic>mod_dav -- lock related denial-of-service</topic> <affects>
<package>
- <name>apache</name>
- <range><ge>2.0</ge><lt>2.0.50_3</lt></range>
+ <name>apache</name> <range><ge>2.0</ge><lt>2.0.50_3</lt></range>
+ </package> <package>
+ <name>mod_dav</name> <range><le>1.0.3_1</le></range>
</package>
- <package>
- <name>mod_dav</name>
- <range><le>1.0.3_1</le></range>
- </package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>A malicious user with DAV write privileges can trigger a null
+ <p>A malicious user with DAV write privileges can trigger
+ a null
pointer dereference in the Apache mod_dav module. This
could cause the server to become unavailable.</p>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2004-0809</cvename>
<url>http://nagoya.apache.org/bugzilla/show_bug.cgi?id=31183</url>
- </references>
- <dates>
- <discovery>2004-09-15</discovery>
- <entry>2004-09-15</entry>
+ </references> <dates>
+ <discovery>2004-09-15</discovery> <entry>2004-09-15</entry>
</dates>
</vuln>
<vuln vid="4d49f4ba-071f-11d9-b45d-000c41e2cdad">
- <topic>apache -- ap_resolve_env buffer overflow</topic>
- <affects>
+ <topic>apache -- ap_resolve_env buffer overflow</topic> <affects>
<package>
- <name>apache</name>
- <range><ge>2.0</ge><lt>2.0.50_3</lt></range>
+ <name>apache</name> <range><ge>2.0</ge><lt>2.0.50_3</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>SITIC discovered a vulnerability in Apache 2's handling of
+ <p>SITIC discovered a vulnerability in Apache 2's handling
+ of
environmental variable settings in the httpd configuration
files (the main `httpd.conf' and `.htaccess' files).
According to a SITIC advisory:</p>
- <blockquote cite="http://lists.netsys.com/pipermail/full-disclosure/2004-September/026463.html">
- <p>The buffer overflow occurs when expanding ${ENVVAR}
- constructs in .htaccess or httpd.conf files. The function
- ap_resolve_env() in server/util.c copies data from
- environment variables to the character array tmp with
- strcat(3), leading to a buffer overflow. </p>
+ <blockquote
+ cite="http://lists.netsys.com/pipermail/full-disclosure/2004-September/026463.html">
+ <p>The buffer overflow occurs when expanding ${ENVVAR}
+ constructs in .htaccess or httpd.conf files. The function
+ ap_resolve_env() in server/util.c copies data from
+ environment variables to the character array tmp with
+ strcat(3), leading to a buffer overflow. </p>
</blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2004-0747</cvename>
<mlist>http://lists.netsys.com/pipermail/full-disclosure/2004-September/026463.html</mlist>
- </references>
- <dates>
- <discovery>2004-09-15</discovery>
- <entry>2004-09-15</entry>
+ </references> <dates>
+ <discovery>2004-09-15</discovery> <entry>2004-09-15</entry>
</dates>
</vuln>
<vuln vid="ae7b7f65-05c7-11d9-b45d-000c41e2cdad">
- <topic>webmin -- insecure temporary file creation at installation time</topic>
- <affects>
+ <topic>webmin -- insecure temporary file creation at installation
+ time</topic> <affects>
<package>
- <name>webmin</name>
- <range><lt>1.150_5</lt></range>
+ <name>webmin</name> <range><lt>1.150_5</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Webmin developers documented a security issue in the
release notes for version 1.160:</p>
<blockquote cite="http://www.webmin.com/changes-1.160.html">
- <p>Fixed a security hole in the maketemp.pl script, used
- to create the /tmp/.webmin directory at install time. If
- an un-trusted user creates this directory before Webmin
- is installed, he could create in it a symbolic link
- pointing to a critical file on the system, which would be
- overwritten when Webmin writes to the link filename.</p>
+ <p>Fixed a security hole in the maketemp.pl script, used
+ to create the /tmp/.webmin directory at install time.
+ If an un-trusted user creates this directory before
+ Webmin is installed, he could create in it a symbolic
+ link pointing to a critical file on the system, which
+ would be overwritten when Webmin writes to the link
+ filename.</p>
</blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2004-0559</cvename>
<url>http://www.webmin.com/changes-1.160.html</url>
- </references>
- <dates>
- <discovery>2004-09-05</discovery>
- <entry>2004-09-14</entry>
+ </references> <dates>
+ <discovery>2004-09-05</discovery> <entry>2004-09-14</entry>
<modified>2004-09-15</modified>
</dates>
</vuln>
<vuln vid="a711de5c-05fa-11d9-a9b2-00061bc2ad93">
- <topic>samba3 DoS attack</topic>
- <affects>
+ <topic>samba3 DoS attack</topic> <affects>
<package>
- <name>samba3</name>
- <range><lt>3.0.7,1</lt></range>
+ <name>samba3</name> <range><lt>3.0.7,1</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>Code found in nmbd and smbd may allow a remote attacker
+ <p>Code found in nmbd and smbd may allow a remote attacker
to effectively crash the nmbd server or use the smbd
server to exhaust the system memory.</p>
</body>
- </description>
- <references>
- <cvename>CVE-2004-0807</cvename>
- <cvename>CVE-2004-0808</cvename>
+ </description> <references>
+ <cvename>CVE-2004-0807</cvename> <cvename>CVE-2004-0808</cvename>
<url>http://www.idefense.com/application/poi/display?id=139&amp;type=vulnerabilities</url>
- </references>
- <dates>
- <discovery>2004-09-02</discovery>
- <entry>2004-09-14</entry>
+ </references> <dates>
+ <discovery>2004-09-02</discovery> <entry>2004-09-14</entry>
</dates>
</vuln>
<vuln vid="c1d97a8b-05ed-11d9-b45d-000c41e2cdad">
- <topic>mozilla -- POP client heap overflow</topic>
- <affects>
+ <topic>mozilla -- POP client heap overflow</topic> <affects>
<package>
- <name>mozilla</name>
- <range><lt>1.7,2</lt></range>
+ <name>mozilla</name> <range><lt>1.7,2</lt></range>
+ </package> <package>
+ <name>linux-mozilla</name> <range><lt>1.7</lt></range>
+ </package> <package>
+ <name>netscape7</name> <range><lt>7.2</lt></range>
+ </package> <package>
+ <name>thunderbird</name> <range><lt>0.7</lt></range>
</package>
- <package>
- <name>linux-mozilla</name>
- <range><lt>1.7</lt></range>
- </package>
- <package>
- <name>netscape7</name>
- <range><lt>7.2</lt></range>
- </package>
- <package>
- <name>thunderbird</name>
- <range><lt>0.7</lt></range>
- </package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>zen-parse discovered a heap buffer overflow in Mozilla's
- POP client implementation. A malicious POP server
- could exploit this vulnerability to cause Mozilla to execute
+ <p>zen-parse discovered a heap buffer overflow in Mozilla's
+ POP client implementation. A malicious POP server could
+ exploit this vulnerability to cause Mozilla to execute
arbitrary code.</p>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2004-0757</cvename>
<url>http://bugzilla.mozilla.org/show_bug.cgi?id=229374</url>
<url>http://bugzilla.mozilla.org/show_bug.cgi?id=157644</url>
- </references>
- <dates>
- <discovery>2004-07-22</discovery>
- <entry>2004-09-14</entry>
+ </references> <dates>
+ <discovery>2004-07-22</discovery> <entry>2004-09-14</entry>
</dates>
</vuln>
<vuln vid="a4fd8f53-05eb-11d9-b45d-000c41e2cdad">
- <topic>mozilla -- SOAPParameter integer overflow</topic>
- <affects>
- <package>
- <name>firefox</name>
- <range><lt>0.9</lt></range>
- </package>
- <package>
- <name>linux-mozilla</name>
- <name>linux-mozilla-devel</name>
- <name>mozilla-gtk1</name>
- <range><lt>1.7</lt></range>
- </package>
- <package>
- <name>mozilla</name>
- <range><lt>1.7,2</lt></range>
- </package>
- <package>
- <name>netscape7</name>
- <range><lt>7.2</lt></range>
- </package>
- </affects>
- <description>
- <body xmlns="http://www.w3.org/1999/xhtml">
- <p>zen-parse discovered and iDEFENSE reported an exploitable
- integer overflow in a scriptable Mozilla component
- `SOAPParameter':</p>
- <blockquote cite="http://www.idefense.com/application/poi/display?id=117&amp;type=vulnerabilities">
- <p>Improper input validation to the SOAPParameter object
- constructor in Netscape and Mozilla allows execution of
- arbitrary code. The SOAPParameter object's constructor
- contains an integer overflow which allows controllable
- heap corruption. A web page can be constructed to
+ <topic>mozilla -- SOAPParameter integer overflow</topic> <affects>
+ <package>
+ <name>firefox</name> <range><lt>0.9</lt></range>
+ </package> <package>
+ <name>linux-mozilla</name> <name>linux-mozilla-devel</name>
+ <name>mozilla-gtk1</name> <range><lt>1.7</lt></range>
+ </package> <package>
+ <name>mozilla</name> <range><lt>1.7,2</lt></range>
+ </package> <package>
+ <name>netscape7</name> <range><lt>7.2</lt></range>
+ </package>
+ </affects> <description>
+ <body xmlns="http://www.w3.org/1999/xhtml">
+ <p>zen-parse discovered and iDEFENSE reported an exploitable
+ integer overflow in a scriptable Mozilla component
+ `SOAPParameter':</p>
+ <blockquote
+ cite="http://www.idefense.com/application/poi/display?id=117&amp;type=vulnerabilities">
+ <p>Improper input validation to the SOAPParameter object
+ constructor in Netscape and Mozilla allows execution
+ of arbitrary code. The SOAPParameter object's constructor
+ contains an integer overflow which allows controllable
+ heap corruption. A web page can be constructed to
leverage this into remote execution of arbitrary code.</p>
</blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2004-0722</cvename>
<url>http://bugzilla.mozilla.org/show_bug.cgi?id=236618</url>
- </references>
- <dates>
- <discovery>2004-08-02</discovery>
- <entry>2004-09-14</entry>
+ </references> <dates>
+ <discovery>2004-08-02</discovery> <entry>2004-09-14</entry>
<modified>2004-09-22</modified>
</dates>
</vuln>
<vuln vid="c62dc69f-05c8-11d9-b45d-000c41e2cdad">
- <topic>openoffice -- document disclosure</topic>
- <affects>
- <package>
- <name>openoffice</name>
- <name>ar-openoffice</name>
- <name>ca-openoffice</name>
- <name>cs-openoffice</name>
- <name>de-openoffice</name>
- <name>dk-openoffice</name>
- <name>el-openoffice</name>
- <name>es-openoffice</name>
- <name>et-openoffice</name>
- <name>fi-openoffice</name>
- <name>fr-openoffice</name>
- <name>gr-openoffice</name>
- <name>hu-openoffice</name>
- <name>it-openoffice</name>
- <name>ja-openoffice</name>
- <name>ko-openoffice</name>
- <name>nl-openoffice</name>
- <name>pl-openoffice</name>
- <name>pt-openoffice</name>
- <name>pt_BR-openoffice</name>
- <name>ru-openoffice</name>
- <name>se-openoffice</name>
- <name>sk-openoffice</name>
- <name>sl-openoffice-SI</name>
- <name>tr-openoffice</name>
- <name>zh-openoffice-CN</name>
- <name>zh-openoffice-TW</name>
- <range><lt>1.1.2_1</lt></range>
+ <topic>openoffice -- document disclosure</topic> <affects>
+ <package>
+ <name>openoffice</name> <name>ar-openoffice</name>
+ <name>ca-openoffice</name> <name>cs-openoffice</name>
+ <name>de-openoffice</name> <name>dk-openoffice</name>
+ <name>el-openoffice</name> <name>es-openoffice</name>
+ <name>et-openoffice</name> <name>fi-openoffice</name>
+ <name>fr-openoffice</name> <name>gr-openoffice</name>
+ <name>hu-openoffice</name> <name>it-openoffice</name>
+ <name>ja-openoffice</name> <name>ko-openoffice</name>
+ <name>nl-openoffice</name> <name>pl-openoffice</name>
+ <name>pt-openoffice</name> <name>pt_BR-openoffice</name>
+ <name>ru-openoffice</name> <name>se-openoffice</name>
+ <name>sk-openoffice</name> <name>sl-openoffice-SI</name>
+ <name>tr-openoffice</name> <name>zh-openoffice-CN</name>
+ <name>zh-openoffice-TW</name> <range><lt>1.1.2_1</lt></range>
<range><ge>2.0</ge></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>OpenOffice creates a working directory in /tmp on startup,
- and uses this directory to temporarily store document
- content. However, the permissions of the created directory
- may allow other user on the system to read these files,
- potentially exposing information the user likely assumed was
- inaccessible.</p>
+ <p>OpenOffice creates a working directory in /tmp on startup,
+ and uses this directory to temporarily store document
+ content. However, the permissions of the created directory
+ may allow other user on the system to read these files,
+ potentially exposing information the user likely assumed
+ was inaccessible.</p>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2004-0752</cvename>
<url>http://www.openoffice.org/issues/show_bug.cgi?id=33357</url>
<url>http://securitytracker.com/alerts/2004/Sep/1011205.html</url>
- <mlist msgid="20040910152759.7739.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=109483308421566</mlist>
- </references>
- <dates>
- <discovery>2004-08-24</discovery>
- <entry>2004-09-14</entry>
+ <mlist
+ msgid="20040910152759.7739.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=109483308421566</mlist>
+ </references> <dates>
+ <discovery>2004-08-24</discovery> <entry>2004-09-14</entry>
</dates>
</vuln>
<vuln vid="15e0e963-02ed-11d9-a209-00061bc2ad93">
- <topic>mpg123 buffer overflow</topic>
- <affects>
+ <topic>mpg123 buffer overflow</topic> <affects>
<package>
- <name>mpg123</name>
- <name>mpg123-nas</name>
- <name>mpg123-esound</name>
- <range><le>0.59r</le></range>
+ <name>mpg123</name> <name>mpg123-nas</name>
+ <name>mpg123-esound</name> <range><le>0.59r</le></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>The mpg123 software version 0.59r contains a
- buffer overflow vulnerability which may permit
- the execution of arbitrary code as the owner of
- the mpg123 process.</p>
+ <p>The mpg123 software version 0.59r contains a
+ buffer overflow vulnerability which may permit the execution
+ of arbitrary code as the owner of the mpg123 process.</p>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2004-0805</cvename>
<url>http://www.alighieri.org/advisories/advisory-mpg123.txt</url>
- </references>
- <dates>
- <discovery>2003-08-16</discovery>
- <entry>2004-09-14</entry>
+ </references> <dates>
+ <discovery>2003-08-16</discovery> <entry>2004-09-14</entry>
</dates>
</vuln>
@@ -16767,25 +13787,21 @@ http_access deny Gopher</pre>
<topic>ImageMagick -- BMP decoder buffer overflow</topic>
<affects>
<package>
- <name>ImageMagick</name>
- <name>ImageMagick-nox11</name>
+ <name>ImageMagick</name> <name>ImageMagick-nox11</name>
<range><lt>6.0.6.2</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>Marcus Meissner discovered that ImageMagick's BMP decoder would
- crash when loading the test BMP file created by Chris Evans
- for testing the previous Qt vulnerability.</p>
+ <p>Marcus Meissner discovered that ImageMagick's BMP decoder
+ would
+ crash when loading the test BMP file created by Chris
+ Evans for testing the previous Qt vulnerability.</p>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2004-0827</cvename>
<url>http://www.imagemagick.org/www/Changelog.html</url>
- </references>
- <dates>
- <discovery>2004-08-25</discovery>
- <entry>2004-08-31</entry>
+ </references> <dates>
+ <discovery>2004-08-25</discovery> <entry>2004-08-31</entry>
<modified>2004-09-14</modified>
</dates>
</vuln>
@@ -16794,89 +13810,74 @@ http_access deny Gopher</pre>
<topic>Mutiple browser frame injection vulnerability</topic>
<affects>
<package>
- <name>kdelibs</name>
- <range><lt>3.2.3_3</lt></range>
- </package>
- <package>
- <name>kdebase</name>
- <range><lt>3.2.3_1</lt></range>
- </package>
- <package>
- <name>linux-opera</name>
- <name>opera</name>
+ <name>kdelibs</name> <range><lt>3.2.3_3</lt></range>
+ </package> <package>
+ <name>kdebase</name> <range><lt>3.2.3_1</lt></range>
+ </package> <package>
+ <name>linux-opera</name> <name>opera</name>
<range><ge>7.50</ge><lt>7.52</lt></range>
- </package>
- <package>
- <name>firefox</name>
- <range><lt>0.9</lt></range>
- </package>
- <package>
- <name>linux-mozilla</name>
- <name>linux-mozilla-devel</name>
- <name>mozilla-gtk1</name>
- <range><lt>1.7</lt></range>
- </package>
- <package>
- <name>mozilla</name>
- <range><lt>1.7,2</lt></range>
- </package>
- <package>
- <name>netscape7</name>
- <range><lt>7.2</lt></range>
- </package>
- </affects>
- <description>
- <body xmlns="http://www.w3.org/1999/xhtml">
- <p>A class of bugs affecting many web browsers in the same way
+ </package> <package>
+ <name>firefox</name> <range><lt>0.9</lt></range>
+ </package> <package>
+ <name>linux-mozilla</name> <name>linux-mozilla-devel</name>
+ <name>mozilla-gtk1</name> <range><lt>1.7</lt></range>
+ </package> <package>
+ <name>mozilla</name> <range><lt>1.7,2</lt></range>
+ </package> <package>
+ <name>netscape7</name> <range><lt>7.2</lt></range>
+ </package>
+ </affects> <description>
+ <body xmlns="http://www.w3.org/1999/xhtml">
+ <p>A class of bugs affecting many web browsers in the same
+ way
was discovered. A Secunia advisory reports:</p>
<blockquote cite="http://secunia.com/advisories/11978">
- <p>The problem is that the browsers don't check if a target
- frame belongs to a website containing a malicious link,
- which therefore doesn't prevent one browser window from
+ <p>The problem is that the browsers don't check if a
+ target
+ frame belongs to a website containing a malicious link,
+ which therefore doesn't prevent one browser window from
loading content in a named frame in another window.</p>
- <p>Successful exploitation allows a malicious website to load
- arbitrary content in an arbitrary frame in another browser
- window owned by e.g. a trusted site.</p>
- </blockquote>
- <p>A KDE Security Advisory reports:</p>
- <blockquote cite="http://www.kde.org/info/security/advisory-20040811-3.txt">
- <p>A malicious website could abuse Konqueror to insert
- its own frames into the page of an otherwise trusted
- website. As a result the user may unknowingly send
- confidential information intended for the trusted website
- to the malicious website.</p>
- </blockquote>
- <p>Secunia has provided a demonstration of the vulnerability at <a href="http://secunia.com/multiple_browsers_frame_injection_vulnerability_test/">http://secunia.com/multiple_browsers_frame_injection_vulnerability_test/</a>.</p>
- </body>
- </description>
- <references>
- <cvename>CVE-2004-0717</cvename>
- <cvename>CVE-2004-0718</cvename>
+ <p>Successful exploitation allows a malicious website to
+ load
+ arbitrary content in an arbitrary frame in another
+ browser window owned by e.g. a trusted site.</p>
+ </blockquote> <p>A KDE Security Advisory reports:</p>
+ <blockquote
+ cite="http://www.kde.org/info/security/advisory-20040811-3.txt">
+ <p>A malicious website could abuse Konqueror to insert
+ its own frames into the page of an otherwise trusted
+ website. As a result the user may unknowingly send
+ confidential information intended for the trusted website
+ to the malicious website.</p>
+ </blockquote> <p>Secunia has provided a demonstration of
+ the vulnerability at <a
+ href="http://secunia.com/multiple_browsers_frame_injection_vulnerability_test/">http://secunia.com/multiple_browsers_frame_injection_vulnerability_test/</a>.</p>
+ </body>
+ </description> <references>
+ <cvename>CVE-2004-0717</cvename> <cvename>CVE-2004-0718</cvename>
<cvename>CVE-2004-0721</cvename>
<url>http://secunia.com/advisories/11978/</url>
<url>http://bugzilla.mozilla.org/show_bug.cgi?id=246448</url>
<url>ftp://ftp.kde.org/pub/kde/security_patches/post-3.2.3-kdelibs-htmlframes.patch</url>
<url>ftp://ftp.kde.org/pub/kde/security_patches/post-3.2.3-kdebase-htmlframes.patch</url>
- </references>
- <dates>
- <discovery>2004-08-11</discovery>
- <entry>2004-08-12</entry>
+ </references> <dates>
+ <discovery>2004-08-11</discovery> <entry>2004-08-12</entry>
<modified>2004-09-14</modified>
</dates>
</vuln>
<vuln vid="b7cb488c-8349-11d8-a41f-0020ed76ef5a">
- <topic>isakmpd payload handling denial-of-service vulnerabilities</topic>
- <affects>
+ <topic>isakmpd payload handling denial-of-service
+ vulnerabilities</topic> <affects>
<package>
- <name>isakmpd</name>
- <range><le>20030903</le></range>
+ <name>isakmpd</name> <range><le>20030903</le></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>Numerous errors in isakmpd's input packet validation lead to
- denial-of-service vulnerabilities. From the Rapid7 advisory:</p>
+ <p>Numerous errors in isakmpd's input packet validation
+ lead to
+ denial-of-service vulnerabilities. From the Rapid7
+ advisory:</p>
<blockquote cite="http://www.rapid7.com/advisories/R7-0018.html">
<p>The ISAKMP packet processing functions in OpenBSD's
isakmpd daemon contain multiple payload handling flaws
@@ -16887,87 +13888,71 @@ http_access deny Gopher</pre>
memory, or loop endlessly (consuming 100% of the CPU).</p>
</blockquote>
</body>
- </description>
- <references>
- <cvename>CVE-2004-0218</cvename>
- <cvename>CVE-2004-0219</cvename>
- <cvename>CVE-2004-0220</cvename>
- <cvename>CVE-2004-0221</cvename>
+ </description> <references>
+ <cvename>CVE-2004-0218</cvename> <cvename>CVE-2004-0219</cvename>
+ <cvename>CVE-2004-0220</cvename> <cvename>CVE-2004-0221</cvename>
<cvename>CVE-2004-0222</cvename>
<url>http://www.rapid7.com/advisories/R7-0018.html</url>
<url>http://www.openbsd.org/errata34.html</url>
- </references>
- <dates>
- <discovery>2004-03-17</discovery>
- <entry>2004-03-31</entry>
+ </references> <dates>
+ <discovery>2004-03-17</discovery> <entry>2004-03-31</entry>
<modified>2004-09-14</modified>
</dates>
</vuln>
<vuln vid="00644f03-fb58-11d8-9837-000c41e2cdad">
- <topic>imlib -- BMP decoder heap buffer overflow</topic>
- <affects>
+ <topic>imlib -- BMP decoder heap buffer overflow</topic> <affects>
<package>
- <name>imlib</name>
- <range><lt>1.9.14_4</lt></range>
+ <name>imlib</name> <range><lt>1.9.14_4</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Marcus Meissner discovered that imlib's BMP decoder would
- crash when loading the test BMP file created by Chris Evans
- for testing the previous Qt vulnerability. It is believed
- that this bug could be exploited for arbitrary code execution.</p>
+ crash when loading the test BMP file created by Chris
+ Evans for testing the previous Qt vulnerability. It is
+ believed that this bug could be exploited for arbitrary
+ code execution.</p>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2004-0817</cvename>
<url>http://bugzilla.gnome.org/show_bug.cgi?id=151034</url>
- </references>
- <dates>
- <discovery>2004-08-25</discovery>
- <entry>2004-08-31</entry>
+ </references> <dates>
+ <discovery>2004-08-25</discovery> <entry>2004-08-31</entry>
<modified>2004-09-02</modified>
</dates>
</vuln>
<vuln vid="86a98b57-fb8e-11d8-9343-000a95bc6fae">
- <topic>krb5 -- double-free vulnerabilities</topic>
- <affects>
+ <topic>krb5 -- double-free vulnerabilities</topic> <affects>
<package>
- <name>krb5</name>
- <range><le>1.3.4_1</le></range>
+ <name>krb5</name> <range><le>1.3.4_1</le></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>An advisory published by the MIT Kerberos team says:</p>
- <blockquote cite="http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2004-002-dblfree.txt">
- <p>The MIT Kerberos 5 implementation's Key Distribution Center
+ <blockquote
+ cite="http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2004-002-dblfree.txt">
+ <p>The MIT Kerberos 5 implementation's Key Distribution
+ Center
(KDC) program contains a double-free vulnerability that
- potentially allows a remote attacker to execute arbitrary code.
- Compromise of a KDC host compromises the security of the entire
- authentication realm served by the KDC. Additionally, double-free
- vulnerabilities exist in MIT Kerberos 5 library code, making
- client programs and application servers vulnerable.</p>
- </blockquote>
- <p>Double-free vulnerabilities of this type are not believed to be
+ potentially allows a remote attacker to execute arbitrary
+ code. Compromise of a KDC host compromises the security
+ of the entire authentication realm served by the KDC.
+ Additionally, double-free vulnerabilities exist in MIT
+ Kerberos 5 library code, making client programs and
+ application servers vulnerable.</p>
+ </blockquote> <p>Double-free vulnerabilities of this type
+ are not believed to be
exploitable for code execution on FreeBSD systems. However,
the potential for other ill effects may exist.</p>
</body>
- </description>
- <references>
- <cvename>CVE-2004-0642</cvename>
- <cvename>CVE-2004-0643</cvename>
- <cvename>CVE-2004-0772</cvename>
- <certvu>795632</certvu>
- <certvu>866472</certvu>
- <certvu>350792</certvu>
+ </description> <references>
+ <cvename>CVE-2004-0642</cvename> <cvename>CVE-2004-0643</cvename>
+ <cvename>CVE-2004-0772</cvename> <certvu>795632</certvu>
+ <certvu>866472</certvu> <certvu>350792</certvu>
<url>http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2004-002-dblfree.txt</url>
- </references>
- <dates>
- <discovery>2004-08-31</discovery>
- <entry>2004-08-31</entry>
+ </references> <dates>
+ <discovery>2004-08-31</discovery> <entry>2004-08-31</entry>
</dates>
</vuln>
@@ -16975,60 +13960,54 @@ http_access deny Gopher</pre>
<topic>krb5 -- ASN.1 decoder denial-of-service vulnerability</topic>
<affects>
<package>
- <name>krb5</name>
- <range><ge>1.2.2</ge><le>1.3.4</le></range>
+ <name>krb5</name> <range><ge>1.2.2</ge><le>1.3.4</le></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>An advisory published by the MIT Kerberos team says:</p>
- <blockquote cite="http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2004-003-asn1.txt">
- <p>The ASN.1 decoder library in the MIT Kerberos 5 distribution
- is vulnerable to a denial-of-service attack causing an infinite
- loop in the decoder. The KDC is vulnerable to this attack.</p>
- <p>An unauthenticated remote attacker can cause a KDC or application
+ <blockquote
+ cite="http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2004-003-asn1.txt">
+ <p>The ASN.1 decoder library in the MIT Kerberos 5
+ distribution
+ is vulnerable to a denial-of-service attack causing an
+ infinite loop in the decoder. The KDC is vulnerable
+ to this attack.</p>
+ <p>An unauthenticated remote attacker can cause a KDC or
+ application
server to hang inside an infinite loop.</p>
<p>An attacker impersonating a legitimate KDC or application
- server may cause a client program to hang inside an infinite
- loop.</p>
+ server may cause a client program to hang inside an
+ infinite loop.</p>
</blockquote>
</body>
- </description>
- <references>
- <cvename>CVE-2004-0644</cvename>
- <certvu>550464</certvu>
+ </description> <references>
+ <cvename>CVE-2004-0644</cvename> <certvu>550464</certvu>
<url>http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2004-003-asn1.txt</url>
- </references>
- <dates>
- <discovery>2004-08-31</discovery>
- <entry>2004-08-31</entry>
+ </references> <dates>
+ <discovery>2004-08-31</discovery> <entry>2004-08-31</entry>
</dates>
</vuln>
<vuln vid="ba005226-fb5b-11d8-9837-000c41e2cdad">
- <topic>imlib2 -- BMP decoder buffer overflow</topic>
- <affects>
+ <topic>imlib2 -- BMP decoder buffer overflow</topic> <affects>
<package>
- <name>imlib2</name>
- <range><le>1.1.1</le></range>
+ <name>imlib2</name> <range><le>1.1.1</le></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>Marcus Meissner discovered that imlib2's BMP decoder would
- crash when loading the test BMP file created by Chris Evans
- for testing the previous Qt vulnerability. There appears to
- be both a stack-based and a heap-based buffer overflow that
- are believed to be exploitable for arbitrary code execution.</p>
+ <p>Marcus Meissner discovered that imlib2's BMP decoder
+ would
+ crash when loading the test BMP file created by Chris
+ Evans for testing the previous Qt vulnerability. There
+ appears to be both a stack-based and a heap-based buffer
+ overflow that are believed to be exploitable for arbitrary
+ code execution.</p>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2004-0802</cvename>
<url>http://cvs.sourceforge.net/viewcvs.py/enlightenment/e17/libs/imlib2/ChangeLog?rev=1.20&amp;view=markup</url>
- </references>
- <dates>
- <discovery>2004-08-31</discovery>
- <entry>2004-08-31</entry>
+ </references> <dates>
+ <discovery>2004-08-31</discovery> <entry>2004-08-31</entry>
</dates>
</vuln>
@@ -17036,31 +14015,26 @@ http_access deny Gopher</pre>
<topic>SpamAssassin -- denial-of-service in tokenize_headers</topic>
<affects>
<package>
- <name>p5-Mail-SpamAssassin</name>
- <range><lt>2.64</lt></range>
+ <name>p5-Mail-SpamAssassin</name> <range><lt>2.64</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>According to the SpamAssassin 2.64 release announcement:</p>
- <blockquote cite="http://marc.theaimsgroup.com/?l=spamassassin-announce&amp;m=109168121628767">
- <p>Security fix prevents a denial of service attack open
- to certain malformed messages; this DoS affects all
- SpamAssassin 2.5x and 2.6x versions to date.</p>
- </blockquote>
- <p>The issue appears to be triggered by overly long message
+ <blockquote
+ cite="http://marc.theaimsgroup.com/?l=spamassassin-announce&amp;m=109168121628767">
+ <p>Security fix prevents a denial of service attack open
+ to certain malformed messages; this DoS affects all
+ SpamAssassin 2.5x and 2.6x versions to date.</p>
+ </blockquote> <p>The issue appears to be triggered by overly
+ long message
headers.</p>
</body>
- </description>
- <references>
- <cvename>CVE-2004-0796</cvename>
- <bid>10957</bid>
+ </description> <references>
+ <cvename>CVE-2004-0796</cvename> <bid>10957</bid>
<mlist>http://marc.theaimsgroup.com/?l=spamassassin-announce&amp;m=109168121628767</mlist>
<url>http://search.cpan.org/src/JMASON/Mail-SpamAssassin-2.64/Changes</url>
- </references>
- <dates>
- <discovery>2004-08-04</discovery>
- <entry>2004-08-23</entry>
+ </references> <dates>
+ <discovery>2004-08-04</discovery> <entry>2004-08-23</entry>
<modified>2004-08-28</modified>
</dates>
</vuln>
@@ -17069,50 +14043,41 @@ http_access deny Gopher</pre>
<topic>tnftpd -- remotely exploitable vulnerability</topic>
<affects>
<package>
- <name>tnftpd</name>
- <range><lt>20040810</lt></range>
- </package>
- <package>
- <name>lukemftpd</name>
- <range><ge>0</ge></range>
- </package>
- <system>
- <name>FreeBSD</name>
- <range><ge>4.7</ge></range>
+ <name>tnftpd</name> <range><lt>20040810</lt></range>
+ </package> <package>
+ <name>lukemftpd</name> <range><ge>0</ge></range>
+ </package> <system>
+ <name>FreeBSD</name> <range><ge>4.7</ge></range>
</system>
- </affects>
- <description>
- <body xmlns="http://www.w3.org/1999/xhtml">
- <p>lukemftpd(8) is an enhanced BSD FTP server produced
- within the NetBSD project. The sources for lukemftpd are
- shipped with some versions of FreeBSD, however it is not
- built or installed by default. The build system option
- WANT_LUKEMFTPD must be set to build and install lukemftpd.
- [<strong>NOTE</strong>: An exception is FreeBSD 4.7-RELEASE,
- wherein lukemftpd was installed, but not enabled, by
+ </affects> <description>
+ <body xmlns="http://www.w3.org/1999/xhtml">
+ <p>lukemftpd(8) is an enhanced BSD FTP server produced
+ within the NetBSD project. The sources for lukemftpd are
+ shipped with some versions of FreeBSD, however it is not
+ built or installed by default. The build system option
+ WANT_LUKEMFTPD must be set to build and install lukemftpd.
+ [<strong>NOTE</strong>: An exception is FreeBSD 4.7-RELEASE,
+ wherein lukemftpd was installed, but not enabled, by
default.]</p>
- <p>Przemyslaw Frasunek discovered several vulnerabilities
- in lukemftpd arising from races in the out-of-band signal
- handling code used to implement the ABOR command. As a
- result of these races, the internal state of the FTP server
- may be manipulated in unexpected ways.</p>
- <p>A remote attacker may be able to cause FTP commands to
- be executed with the privileges of the running lukemftpd
- process. This may be a low-privilege `ftp' user if the `-r'
- command line option is specified, or it may be superuser
- privileges if `-r' is *not* specified.</p>
- </body>
- </description>
- <references>
- <cvename>CVE-2004-0794</cvename>
- <bid>10967</bid>
+ <p>Przemyslaw Frasunek discovered several vulnerabilities
+ in lukemftpd arising from races in the out-of-band signal
+ handling code used to implement the ABOR command. As a
+ result of these races, the internal state of the FTP
+ server may be manipulated in unexpected ways.</p>
+ <p>A remote attacker may be able to cause FTP commands to
+ be executed with the privileges of the running lukemftpd
+ process. This may be a low-privilege `ftp' user if the
+ `-r' command line option is specified, or it may be
+ superuser privileges if `-r' is *not* specified.</p>
+ </body>
+ </description> <references>
+ <cvename>CVE-2004-0794</cvename> <bid>10967</bid>
<url>http://cvsweb.netbsd.org/bsdweb.cgi/src/libexec/ftpd/ftpd.c#rev1.158</url>
<url>ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2004-009.txt.asc</url>
- <mlist msgid="412239E7.1070807@freebsd.lublin.pl">http://lists.netsys.com/pipermail/full-disclosure/2004-August/025418.html</mlist>
- </references>
- <dates>
- <discovery>2004-08-17</discovery>
- <entry>2004-08-17</entry>
+ <mlist
+ msgid="412239E7.1070807@freebsd.lublin.pl">http://lists.netsys.com/pipermail/full-disclosure/2004-August/025418.html</mlist>
+ </references> <dates>
+ <discovery>2004-08-17</discovery> <entry>2004-08-17</entry>
<modified>2004-08-28</modified>
</dates>
</vuln>
@@ -17121,250 +14086,210 @@ http_access deny Gopher</pre>
<topic>MySQL authentication bypass / buffer overflow</topic>
<affects>
<package>
- <name>mysql-server</name>
- <range><ge>4.1</ge><lt>4.1.3</lt></range>
- <range><ge>5</ge><le>5.0.0_2</le></range>
+ <name>mysql-server</name> <range><ge>4.1</ge><lt>4.1.3</lt></range>
+ <range><ge>5</ge><le>5.0.0_2</le></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>By submitting a carefully crafted authentication packet, it is possible
- for an attacker to bypass password authentication in MySQL 4.1. Using a
- similar method, a stack buffer used in the authentication mechanism can
- be overflowed.</p>
+ <p>By submitting a carefully crafted authentication packet,
+ it is possible
+ for an attacker to bypass password authentication in MySQL
+ 4.1. Using a similar method, a stack buffer used in the
+ authentication mechanism can be overflowed.</p>
</body>
- </description>
- <references>
- <cvename>CVE-2004-0627</cvename>
- <cvename>CVE-2004-0628</cvename>
- <certvu>184030</certvu>
- <certvu>645326</certvu>
+ </description> <references>
+ <cvename>CVE-2004-0627</cvename> <cvename>CVE-2004-0628</cvename>
+ <certvu>184030</certvu> <certvu>645326</certvu>
<url>http://www.nextgenss.com/advisories/mysql-authbypass.txt</url>
<url>http://dev.mysql.com/doc/mysql/en/News-4.1.3.html</url>
<url>http://secunia.com/advisories/12020</url>
<url>http://www.osvdb.org/7475</url>
- <url>http://www.osvdb.org/7476</url>
- <mlist msgid="Pine.LNX.4.44.0407080940550.9602-200000@pineapple.shacknet.nu">http://archives.neohapsis.com/archives/vulnwatch/2004-q3/0003.html</mlist>
- </references>
- <dates>
- <discovery>2004-07-01</discovery>
- <entry>2004-07-05</entry>
+ <url>http://www.osvdb.org/7476</url> <mlist
+ msgid="Pine.LNX.4.44.0407080940550.9602-200000@pineapple.shacknet.nu">http://archives.neohapsis.com/archives/vulnwatch/2004-q3/0003.html</mlist>
+ </references> <dates>
+ <discovery>2004-07-01</discovery> <entry>2004-07-05</entry>
<modified>2004-08-28</modified>
</dates>
</vuln>
<vuln vid="e811aaf1-f015-11d8-876f-00902714cc7c">
- <topic>Ruby insecure file permissions in the CGI session management</topic>
- <affects>
+ <topic>Ruby insecure file permissions in the CGI session
+ management</topic> <affects>
<package>
- <name>ruby</name>
- <range><lt>1.6.8.2004.07.26</lt></range>
- <range><ge>1.7.0</ge><lt>1.8.1.2004.07.23</lt></range>
+ <name>ruby</name> <range><lt>1.6.8.2004.07.26</lt></range>
+ <range><ge>1.7.0</ge><lt>1.8.1.2004.07.23</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>According to a Debian Security Advisory:</p>
- <blockquote cite="http://www.debian.org/security/2004/dsa-537">
- <p>Andres Salomon noticed a problem in the CGI session
- management of Ruby, an object-oriented scripting language.
- CGI::Session's FileStore (and presumably PStore [...])
- implementations store session information insecurely.
- They simply create files, ignoring permission issues.
- This can lead an attacker who has also shell access to the
- webserver to take over a session.</p>
+ <p>According to a Debian Security Advisory:</p> <blockquote
+ cite="http://www.debian.org/security/2004/dsa-537">
+ <p>Andres Salomon noticed a problem in the CGI session
+ management of Ruby, an object-oriented scripting language.
+ CGI::Session's FileStore (and presumably PStore [...])
+ implementations store session information insecurely.
+ They simply create files, ignoring permission issues.
+ This can lead an attacker who has also shell access to
+ the webserver to take over a session.</p>
</blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2004-0755</cvename>
<url>http://xforce.iss.net/xforce/xfdb/16996</url>
<url>http://www.debian.org/security/2004/dsa-537</url>
<mlist>http://marc.theaimsgroup.com/?l=bugtraq&amp;m=109267579822250&amp;w=2</mlist>
- </references>
- <dates>
- <discovery>2004-08-16</discovery>
- <entry>2004-08-16</entry>
+ </references> <dates>
+ <discovery>2004-08-16</discovery> <entry>2004-08-16</entry>
<modified>2004-08-28</modified>
</dates>
</vuln>
<vuln vid="207f8ff3-f697-11d8-81b0-000347a4fa7d">
- <topic>nss -- exploitable buffer overflow in SSLv2 protocol handler</topic>
- <affects>
+ <topic>nss -- exploitable buffer overflow in SSLv2 protocol
+ handler</topic> <affects>
<package>
- <name>nss</name>
- <range><lt>3.9.2</lt></range>
+ <name>nss</name> <range><lt>3.9.2</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>ISS X-Force reports that a remotely exploitable buffer
- overflow exists in the Netscape Security Services (NSS)
+ <p>ISS X-Force reports that a remotely exploitable buffer
+ overflow exists in the Netscape Security Services (NSS)
library's implementation of SSLv2. From their advisory:</p>
<blockquote cite="http://xforce.iss.net/xforce/alerts/id/180">
- <p>The NSS library contains a flaw in SSLv2 record parsing
- that may lead to remote compromise. When parsing the
- first record in an SSLv2 negotiation, the client hello
- message, the server fails to validate the length of a
- record field. As a result, it is possible for an attacker
- to trigger a heap-based overflow of arbitrary length.</p>
- </blockquote>
- <p>Note that the vulnerable NSS library is also present in
+ <p>The NSS library contains a flaw in SSLv2 record parsing
+ that may lead to remote compromise. When parsing the
+ first record in an SSLv2 negotiation, the client hello
+ message, the server fails to validate the length of a
+ record field. As a result, it is possible for an attacker
+ to trigger a heap-based overflow of arbitrary length.</p>
+ </blockquote> <p>Note that the vulnerable NSS library is
+ also present in
Mozilla-based browsers. However, it is not believed that
- browsers are affected, as the vulnerability is present only in
- code used by SSLv2 *servers*.</p>
+ browsers are affected, as the vulnerability is present
+ only in code used by SSLv2 *servers*.</p>
</body>
- </description>
- <references>
+ </description> <references>
<url>http://xforce.iss.net/xforce/alerts/id/180</url>
<url>http://www.osvdb.org/9116</url>
- <url>http://secunia.com/advisories/12362</url>
- <bid>11015</bid>
- </references>
- <dates>
- <discovery>2004-08-23</discovery>
- <entry>2004-08-27</entry>
+ <url>http://secunia.com/advisories/12362</url> <bid>11015</bid>
+ </references> <dates>
+ <discovery>2004-08-23</discovery> <entry>2004-08-27</entry>
</dates>
</vuln>
<vuln vid="85e19dff-e606-11d8-9b0a-000347a4fa7d">
- <topic>ripMIME -- decoding bug allowing content filter bypass</topic>
- <affects>
+ <topic>ripMIME -- decoding bug allowing content filter
+ bypass</topic> <affects>
<package>
- <name>ripmime</name>
- <range><lt>1.3.2.3</lt></range>
+ <name>ripmime</name> <range><lt>1.3.2.3</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ripMIME may prematurely terminate decoding Base64 encoded
messages when it encounters multiple blank lines or other
non-standard Base64 constructs. Virus scanning and content
filtering tools that use ripMIME may therefore be
bypassed.</p>
- <p>The ripMIME CHANGELOG file says:</p>
- <blockquote cite="http://www.pldaniels.com/ripmime/CHANGELOG">
- <p>There's viruses going around exploiting the ability to
- hide the majority of their data in an attachment by using
- blank lines and other tricks to make scanning systems
- prematurely terminate their base64 decoding.</p>
+ <p>The ripMIME CHANGELOG file says:</p> <blockquote
+ cite="http://www.pldaniels.com/ripmime/CHANGELOG">
+ <p>There's viruses going around exploiting the ability
+ to
+ hide the majority of their data in an attachment by
+ using blank lines and other tricks to make scanning
+ systems prematurely terminate their base64 decoding.</p>
</blockquote>
</body>
- </description>
- <references>
- <bid>10848</bid>
- <url>http://www.osvdb.org/8287</url>
+ </description> <references>
+ <bid>10848</bid> <url>http://www.osvdb.org/8287</url>
<url>http://www.pldaniels.com/ripmime/CHANGELOG</url>
<url>http://secunia.com/advisories/12201</url>
<url>http://xforce.iss.net/xforce/xfdb/16867</url>
- </references>
- <dates>
- <discovery>2004-07-30</discovery>
- <entry>2004-08-27</entry>
+ </references> <dates>
+ <discovery>2004-07-30</discovery> <entry>2004-08-27</entry>
</dates>
</vuln>
<vuln vid="1ecf4ca1-f7ad-11d8-96c9-00061bc2ad93">
- <topic>moinmoin -- ACL group bypass</topic>
- <affects>
+ <topic>moinmoin -- ACL group bypass</topic> <affects>
<package>
- <name>moinmoin</name>
- <range><lt>1.2.3</lt></range>
+ <name>moinmoin</name> <range><lt>1.2.3</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>The moinmoin package contains two bugs with ACLs and anonymous
- users. Both bugs may permit anonymous users to gain access to
- administrative functions; for example the delete function.</p>
- <p>There is no known workaround, the vulnerability exists regardless
+ <p>The moinmoin package contains two bugs with ACLs and
+ anonymous
+ users. Both bugs may permit anonymous users to gain
+ access to administrative functions; for example the delete
+ function.</p>
+ <p>There is no known workaround, the vulnerability exists
+ regardless
if a site is using ACLs or not.</p>
</body>
- </description>
- <references>
+ </description> <references>
<url>http://www.osvdb.org/8194</url>
<url>http://www.osvdb.org/8195</url>
<url>http://security.gentoo.org/glsa/glsa-200408-25.xml</url>
- <url>http://secunia.com/advisories/11832</url>
- <bid>10805</bid>
+ <url>http://secunia.com/advisories/11832</url> <bid>10805</bid>
<bid>10801</bid>
- </references>
- <dates>
- <discovery>2004-07-21</discovery>
- <entry>2004-08-26</entry>
+ </references> <dates>
+ <discovery>2004-07-21</discovery> <entry>2004-08-26</entry>
</dates>
</vuln>
<vuln vid="2689f4cb-ec4c-11d8-9440-000347a4fa7d">
- <topic>rsync -- path sanitizing vulnerability</topic>
- <affects>
+ <topic>rsync -- path sanitizing vulnerability</topic> <affects>
<package>
- <name>rsync</name>
- <range><lt>2.6.2_2</lt></range>
+ <name>rsync</name> <range><lt>2.6.2_2</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>An rsync security advisory reports:</p>
- <blockquote cite="http://samba.org/rsync/#security_aug04">
- <p>There is a path-sanitizing bug that affects daemon mode in
- all recent rsync versions (including 2.6.2) but only if
- chroot is disabled.</p>
- </blockquote>
- <p>The bug may allow a remote user to access files outside
+ <p>An rsync security advisory reports:</p> <blockquote
+ cite="http://samba.org/rsync/#security_aug04">
+ <p>There is a path-sanitizing bug that affects daemon
+ mode in
+ all recent rsync versions (including 2.6.2) but only
+ if chroot is disabled.</p>
+ </blockquote> <p>The bug may allow a remote user to access
+ files outside
of an rsync module's configured path with the privileges
configured for that module.</p>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2004-0792</cvename>
<url>http://samba.org/rsync/#security_aug04</url>
<mlist>http://lists.samba.org/archive/rsync-announce/2004/000017.html</mlist>
<url>http://secunia.com/advisories/12294</url>
<url>http://www.osvdb.org/8829</url>
- </references>
- <dates>
- <discovery>2004-08-12</discovery>
- <entry>2004-08-26</entry>
+ </references> <dates>
+ <discovery>2004-08-12</discovery> <entry>2004-08-26</entry>
</dates>
</vuln>
<vuln vid="7884d56f-f7a1-11d8-9837-000c41e2cdad">
- <topic>gnomevfs -- unsafe URI handling</topic>
- <affects>
- <package>
- <name>gnomevfs2</name>
- <range><lt>2.6.2_1</lt></range>
- </package>
- <package>
- <name>gnomevfs</name>
- <range><lt>1.0.5_6</lt></range>
- </package>
- <package>
- <name>mc</name>
- <range><le>4.6.0_12</le></range>
- </package>
- </affects>
- <description>
- <body xmlns="http://www.w3.org/1999/xhtml">
- <p>Alexander Larsson reports that some versions of gnome-vfs and
- MidnightCommander contain a number of `extfs' scripts that do not
- properly validate user input. If an attacker can cause her
- victim to process a specially-crafted URI, arbitrary commands
- can be executed with the privileges of the victim.</p>
- </body>
- </description>
- <references>
- <cvename>CVE-2004-0494</cvename>
- <bid>10864</bid>
+ <topic>gnomevfs -- unsafe URI handling</topic> <affects>
+ <package>
+ <name>gnomevfs2</name> <range><lt>2.6.2_1</lt></range>
+ </package> <package>
+ <name>gnomevfs</name> <range><lt>1.0.5_6</lt></range>
+ </package> <package>
+ <name>mc</name> <range><le>4.6.0_12</le></range>
+ </package>
+ </affects> <description>
+ <body xmlns="http://www.w3.org/1999/xhtml">
+ <p>Alexander Larsson reports that some versions of gnome-vfs
+ and
+ MidnightCommander contain a number of `extfs' scripts
+ that do not properly validate user input. If an attacker
+ can cause her victim to process a specially-crafted URI,
+ arbitrary commands can be executed with the privileges
+ of the victim.</p>
+ </body>
+ </description> <references>
+ <cvename>CVE-2004-0494</cvename> <bid>10864</bid>
<url>http://www.ciac.org/ciac/bulletins/o-194.shtml</url>
<url>http://xforce.iss.net/xforce/xfdb/16897</url>
<url>https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=127263</url>
- </references>
- <dates>
- <discovery>2004-08-04</discovery>
- <entry>2004-08-26</entry>
+ </references> <dates>
+ <discovery>2004-08-04</discovery> <entry>2004-08-26</entry>
</dates>
</vuln>
@@ -17372,29 +14297,25 @@ http_access deny Gopher</pre>
<topic>SoX buffer overflows when handling .WAV files</topic>
<affects>
<package>
- <name>sox</name>
- <range><gt>12.17.1</gt><le>12.17.4_1</le></range>
+ <name>sox</name> <range><gt>12.17.1</gt><le>12.17.4_1</le></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>Ulf Härnhammar discovered a pair of buffer overflows in the
- WAV file handling code of SoX. If an attacker can cause her
- victim to process a specially-crafted WAV file with SoX (e.g.
- through social engineering or through some other program that
- relies on SoX), arbitrary code can be executed with the
- privileges of the victim.</p>
+ <p>Ulf Härnhammar discovered a pair of buffer overflows
+ in the
+ WAV file handling code of SoX. If an attacker can cause
+ her victim to process a specially-crafted WAV file with
+ SoX (e.g. through social engineering or through some
+ other program that relies on SoX), arbitrary code can be
+ executed with the privileges of the victim.</p>
</body>
- </description>
- <references>
- <cvename>CVE-2004-0557</cvename>
- <mlist msgid="1091040793.4107f6193d81a@webmail.uu.se">http://archives.neohapsis.com/archives/vulnwatch/2004-q3/0014.html</mlist>
+ </description> <references>
+ <cvename>CVE-2004-0557</cvename> <mlist
+ msgid="1091040793.4107f6193d81a@webmail.uu.se">http://archives.neohapsis.com/archives/vulnwatch/2004-q3/0014.html</mlist>
<url>http://secunia.com/advisories/12175</url>
<url>http://www.osvdb.org/8267</url>
- </references>
- <dates>
- <discovery>2004-07-28</discovery>
- <entry>2004-08-26</entry>
+ </references> <dates>
+ <discovery>2004-07-28</discovery> <entry>2004-08-26</entry>
</dates>
</vuln>
@@ -17402,167 +14323,137 @@ http_access deny Gopher</pre>
<topic>kdelibs -- konqueror cross-domain cookie injection</topic>
<affects>
<package>
- <name>kdelibs</name>
- <range><lt>3.2.3_3</lt></range>
- </package>
- </affects>
- <description>
- <body xmlns="http://www.w3.org/1999/xhtml">
- <p>According to a KDE Security Advisory:</p>
- <blockquote cite="http://www.kde.org/info/security/advisory-20040823-1.txt">
- <p>WESTPOINT internet reconnaissance services alerted the
- KDE security team that the KDE web browser Konqueror
- allows websites to set cookies for certain country
- specific secondary top level domains.</p>
- <p>Web sites operating under the affected domains can
- set HTTP cookies in such a way that the Konqueror web
- browser will send them to all other web sites operating
- under the same domain. A malicious website can use
- this as part of a session fixation attack. See e.g.
- http://www.acros.si/papers/session_fixation.pdf</p>
- <p>Affected are all country specific secondary top level
- domains that use more than 2 characters in the secondary
- part of the domain name and that use a secondary part other
- than com, net, mil, org, gov, edu or int. Examples of
- affected domains are .ltd.uk, .plc.uk and .firm.in</p>
- <p>It should be noted that popular domains such as .co.uk, .co.in
+ <name>kdelibs</name> <range><lt>3.2.3_3</lt></range>
+ </package>
+ </affects> <description>
+ <body xmlns="http://www.w3.org/1999/xhtml">
+ <p>According to a KDE Security Advisory:</p> <blockquote
+ cite="http://www.kde.org/info/security/advisory-20040823-1.txt">
+ <p>WESTPOINT internet reconnaissance services alerted the
+ KDE security team that the KDE web browser Konqueror
+ allows websites to set cookies for certain country
+ specific secondary top level domains.</p>
+ <p>Web sites operating under the affected domains can
+ set HTTP cookies in such a way that the Konqueror web
+ browser will send them to all other web sites operating
+ under the same domain. A malicious website can use this
+ as part of a session fixation attack. See e.g.
+ http://www.acros.si/papers/session_fixation.pdf</p>
+ <p>Affected are all country specific secondary top level
+ domains that use more than 2 characters in the secondary
+ part of the domain name and that use a secondary part
+ other than com, net, mil, org, gov, edu or int. Examples
+ of affected domains are .ltd.uk, .plc.uk and .firm.in</p>
+ <p>It should be noted that popular domains such as .co.uk,
+ .co.in
and .com are NOT affected.</p>
</blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2004-0746</cvename>
<url>http://www.kde.org/info/security/advisory-20040823-1.txt</url>
<url>http://www.osvdb.org/9117</url>
<url>http://secunia.com/advisories/12341</url>
<url>http://www.acros.si/papers/session_fixation.pdf</url>
<bid>10991</bid>
- </references>
- <dates>
- <discovery>2004-08-23</discovery>
- <entry>2004-08-26</entry>
+ </references> <dates>
+ <discovery>2004-08-23</discovery> <entry>2004-08-26</entry>
</dates>
</vuln>
<vuln vid="bef4515b-eaa9-11d8-9440-000347a4fa7d">
- <cancelled superseded="b6939d5b-64a1-11d9-9106-000a95bc6fae" />
+ <cancelled superseded="b6939d5b-64a1-11d9-9106-000a95bc6fae"
+ />
</vuln>
<vuln vid="3243e839-f489-11d8-9837-000c41e2cdad">
- <topic>fidogate -- write files as `news' user</topic>
- <affects>
- <package>
- <name>fidogate</name>
- <range><lt>4.4.9_3</lt></range>
- </package>
+ <topic>fidogate -- write files as `news' user</topic> <affects>
<package>
- <name>fidogate-ds</name>
- <range><lt>5.1.1_1</lt></range>
+ <name>fidogate</name> <range><lt>4.4.9_3</lt></range>
+ </package> <package>
+ <name>fidogate-ds</name> <range><lt>5.1.1_1</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Neils Heinen reports that the setuid `news' binaries
- installed as part of fidogate may be used to create files or
- append to file with the privileges of the `news' user by
- setting the LOGFILE environmental variable.</p>
+ installed as part of fidogate may be used to create files
+ or append to file with the privileges of the `news' user
+ by setting the LOGFILE environmental variable.</p>
</body>
- </description>
- <references>
+ </description> <references>
<url>http://cvs.sourceforge.net/viewcvs.py/fidogate/fidogate/ChangeLog?rev=4.320&amp;view=markup</url>
- </references>
- <dates>
- <discovery>2004-08-21</discovery>
- <entry>2004-08-22</entry>
+ </references> <dates>
+ <discovery>2004-08-21</discovery> <entry>2004-08-22</entry>
<modified>2004-08-23</modified>
</dates>
</vuln>
<vuln vid="65a17a3f-ed6e-11d8-aff1-00061bc2ad93">
- <topic>Arbitrary code execution via a format string vulnerability in jftpgw</topic>
- <affects>
+ <topic>Arbitrary code execution via a format string vulnerability
+ in jftpgw</topic> <affects>
<package>
- <name>jftpgw</name>
- <range><lt>0.13.5</lt></range>
+ <name>jftpgw</name> <range><lt>0.13.5</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>The log functions in jftpgw may allow
- remotely authenticated user to execute
- arbitrary code via the format string
- specifiers in certain syslog messages.</p>
+ <p>The log functions in jftpgw may allow
+ remotely authenticated user to execute arbitrary code via
+ the format string specifiers in certain syslog messages.</p>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2004-0448</cvename>
<url>http://www.debian.org/security/2004/dsa-510</url>
- <bid>10438</bid>
- <url>http://xforce.iss.net/xforce/xfdb/16271</url>
- </references>
- <dates>
- <discovery>2004-05-30</discovery>
- <entry>2004-08-13</entry>
+ <bid>10438</bid> <url>http://xforce.iss.net/xforce/xfdb/16271</url>
+ </references> <dates>
+ <discovery>2004-05-30</discovery> <entry>2004-08-13</entry>
<modified>2004-08-23</modified>
</dates>
</vuln>
<vuln vid="ebffe27a-f48c-11d8-9837-000c41e2cdad">
- <topic>qt -- image loader vulnerabilities</topic>
- <affects>
+ <topic>qt -- image loader vulnerabilities</topic> <affects>
<package>
- <name>qt</name>
- <range><lt>3.3.3</lt></range>
+ <name>qt</name> <range><lt>3.3.3</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>Qt contains several vulnerabilities related to image
- loading, including possible crashes when loading corrupt
- GIF, BMP, or JPEG images. Most seriously, Chris Evans
- reports that the BMP crash is actually due to a heap
- buffer overflow. It is believed that an attacker may be
- able to construct a BMP image that could cause a Qt-using
- application to execute arbitrary code when it is loaded.</p>
+ <p>Qt contains several vulnerabilities related to image
+ loading, including possible crashes when loading corrupt
+ GIF, BMP, or JPEG images. Most seriously, Chris Evans
+ reports that the BMP crash is actually due to a heap
+ buffer overflow. It is believed that an attacker may be
+ able to construct a BMP image that could cause a Qt-using
+ application to execute arbitrary code when it is loaded.</p>
</body>
- </description>
- <references>
- <cvename>CVE-2004-0691</cvename>
- <cvename>CVE-2004-0692</cvename>
+ </description> <references>
+ <cvename>CVE-2004-0691</cvename> <cvename>CVE-2004-0692</cvename>
<cvename>CVE-2004-0693</cvename>
<url>http://www.trolltech.com/developer/changes/changes-3.3.3.html</url>
<url>http://scary.beasts.org/security/CESA-2004-004.txt</url>
- </references>
- <dates>
- <discovery>2004-08-11</discovery>
- <entry>2004-08-22</entry>
+ </references> <dates>
+ <discovery>2004-08-11</discovery> <entry>2004-08-22</entry>
</dates>
</vuln>
<vuln vid="616cf823-f48b-11d8-9837-000c41e2cdad">
- <topic>courier-imap -- format string vulnerability in debug mode</topic>
- <affects>
+ <topic>courier-imap -- format string vulnerability in debug
+ mode</topic> <affects>
<package>
- <name>courier-imap</name>
- <range><lt>3.0.7,1</lt></range>
+ <name>courier-imap</name> <range><lt>3.0.7,1</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>An iDEFENSE security advisory describes a format string
- vulnerability that could be exploited when Courier-IMAP is run
- in debug mode (DEBUG_LOGIN set).</p>
+ vulnerability that could be exploited when Courier-IMAP
+ is run in debug mode (DEBUG_LOGIN set).</p>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2004-0777</cvename>
<mlist>http://lists.netsys.com/pipermail/full-disclosure/2004-August/025478.html</mlist>
<url>http://www.idefense.com/application/poi/display?id=131&amp;type=vulnerabilities&amp;flashstatus=false</url>
<bid>10976</bid>
- </references>
- <dates>
- <discovery>2004-08-18</discovery>
- <entry>2004-08-22</entry>
+ </references> <dates>
+ <discovery>2004-08-18</discovery> <entry>2004-08-22</entry>
</dates>
</vuln>
@@ -17570,32 +14461,27 @@ http_access deny Gopher</pre>
<topic>mysql -- mysqlhotcopy insecure temporary file creation</topic>
<affects>
<package>
- <name>mysql-scripts</name>
- <range><le>3.23.58</le></range>
+ <name>mysql-scripts</name> <range><le>3.23.58</le></range>
<range><gt>4</gt><le>4.0.20</le></range>
<range><gt>4.1</gt><le>4.1.3</le></range>
<range><gt>5</gt><le>5.0.0_1</le></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>According to Christian Hammers:</p>
- <blockquote cite="http://packages.debian.org/changelogs/pool/main/m/mysql-dfsg/mysql-dfsg_4.0.20-11/changelog">
- <p>[mysqlhotcopy created] temporary files in /tmp which
- had predictable filenames and such could be used for a
- tempfile run attack.</p>
- </blockquote>
- <p>Jeroen van Wolffelaar is credited with discovering the issue.</p>
+ <p>According to Christian Hammers:</p> <blockquote
+ cite="http://packages.debian.org/changelogs/pool/main/m/mysql-dfsg/mysql-dfsg_4.0.20-11/changelog">
+ <p>[mysqlhotcopy created] temporary files in /tmp which
+ had predictable filenames and such could be used for a
+ tempfile run attack.</p>
+ </blockquote> <p>Jeroen van Wolffelaar is credited with
+ discovering the issue.</p>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2004-0457</cvename>
<url>http://www.debian.org/security/2004/dsa-540</url>
<mlist>http://lists.mysql.com/internals/15185</mlist>
- </references>
- <dates>
- <discovery>2004-08-18</discovery>
- <entry>2004-08-22</entry>
+ </references> <dates>
+ <discovery>2004-08-18</discovery> <entry>2004-08-22</entry>
</dates>
</vuln>
@@ -17603,43 +14489,38 @@ http_access deny Gopher</pre>
<topic>Multiple Potential Buffer Overruns in Samba</topic>
<affects>
<package>
- <name>samba</name>
- <range><ge>3</ge><lt>3.0.5,1</lt></range>
+ <name>samba</name> <range><ge>3</ge><lt>3.0.5,1</lt></range>
<range><lt>2.2.10</lt></range>
- </package>
- <package>
- <name>ja-samba</name>
- <range><lt>2.2.10.j1.0</lt></range>
- </package>
- </affects>
- <description>
- <body xmlns="http://www.w3.org/1999/xhtml">
- <p>Evgeny Demidov discovered that the Samba server has a
- buffer overflow in the Samba Web Administration Tool (SWAT)
- on decoding Base64 data during HTTP Basic Authentication.
- Versions 3.0.2 through 3.0.4 are affected.</p>
- <p>Another buffer overflow bug has been found in the code
- used to support the "mangling method = hash" smb.conf
- option. The default setting for this parameter is "mangling
- method = hash2" and therefore not vulnerable. Versions
- between 2.2.0 through 2.2.9 and 3.0.0 through 3.0.4 are affected.
- </p>
- </body>
- </description>
- <references>
- <cvename>CVE-2004-0600</cvename>
- <cvename>CVE-2004-0686</cvename>
- <mlist msgid="web-53121174@cgp.agava.net">http://www.securityfocus.com/archive/1/369698</mlist>
- <mlist msgid="200407222031.25086.bugtraq@beyondsecurity.com">http://www.securityfocus.com/archive/1/369706</mlist>
+ </package> <package>
+ <name>ja-samba</name> <range><lt>2.2.10.j1.0</lt></range>
+ </package>
+ </affects> <description>
+ <body xmlns="http://www.w3.org/1999/xhtml">
+ <p>Evgeny Demidov discovered that the Samba server has a
+ buffer overflow in the Samba Web Administration Tool
+ (SWAT) on decoding Base64 data during HTTP Basic
+ Authentication. Versions 3.0.2 through 3.0.4 are
+ affected.</p>
+ <p>Another buffer overflow bug has been found in the code
+ used to support the "mangling method = hash" smb.conf
+ option. The default setting for this parameter is "mangling
+ method = hash2" and therefore not vulnerable. Versions
+ between 2.2.0 through 2.2.9 and 3.0.0 through 3.0.4 are
+ affected. </p>
+ </body>
+ </description> <references>
+ <cvename>CVE-2004-0600</cvename> <cvename>CVE-2004-0686</cvename>
+ <mlist
+ msgid="web-53121174@cgp.agava.net">http://www.securityfocus.com/archive/1/369698</mlist>
+ <mlist
+ msgid="200407222031.25086.bugtraq@beyondsecurity.com">http://www.securityfocus.com/archive/1/369706</mlist>
<url>http://www.samba.org/samba/whatsnew/samba-3.0.5.html</url>
<url>http://www.samba.org/samba/whatsnew/samba-2.2.10.html</url>
<url>http://www.osvdb.org/8190</url>
<url>http://www.osvdb.org/8191</url>
<url>http://secunia.com/advisories/12130</url>
- </references>
- <dates>
- <discovery>2004-07-14</discovery>
- <entry>2004-07-21</entry>
+ </references> <dates>
+ <discovery>2004-07-14</discovery> <entry>2004-07-21</entry>
<modified>2004-08-15</modified>
</dates>
</vuln>
@@ -17648,287 +14529,218 @@ http_access deny Gopher</pre>
<topic>Mozilla / Firefox user interface spoofing vulnerability</topic>
<affects>
<package>
- <name>firefox</name>
- <range><le>0.9.1_1</le></range>
- </package>
- <package>
- <name>linux-mozilla</name>
- <range><le>1.7.1</le></range>
- </package>
- <package>
- <name>linux-mozilla-devel</name>
- <range><le>1.7.1</le></range>
- </package>
- <package>
- <name>mozilla</name>
- <range><le>1.7.1,2</le></range>
- <range><ge>1.8.a,2</ge><le>1.8.a2,2</le></range>
- </package>
- <package>
- <name>mozilla-gtk1</name>
- <range><le>1.7.1_1</le></range>
+ <name>firefox</name> <range><le>0.9.1_1</le></range>
+ </package> <package>
+ <name>linux-mozilla</name> <range><le>1.7.1</le></range>
+ </package> <package>
+ <name>linux-mozilla-devel</name> <range><le>1.7.1</le></range>
+ </package> <package>
+ <name>mozilla</name> <range><le>1.7.1,2</le></range>
+ <range><ge>1.8.a,2</ge><le>1.8.a2,2</le></range>
+ </package> <package>
+ <name>mozilla-gtk1</name> <range><le>1.7.1_1</le></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla project's family of browsers contain a design
- flaw that can allow a website to spoof almost perfectly any
- part of the Mozilla user interface, including spoofing web
- sites for phishing or internal elements such as the "Master
- Password" dialog box. This achieved by manipulating "chrome"
- through remote XUL content. Recent versions of Mozilla have
- been fixed to not allow untrusted documents to utilize
- "chrome" in this way.</p>
- </body>
- </description>
- <references>
+ flaw that can allow a website to spoof almost perfectly
+ any part of the Mozilla user interface, including spoofing
+ web sites for phishing or internal elements such as the
+ "Master Password" dialog box. This achieved by manipulating
+ "chrome" through remote XUL content. Recent versions of
+ Mozilla have been fixed to not allow untrusted documents
+ to utilize "chrome" in this way.</p>
+ </body>
+ </description> <references>
<cvename>CVE-2004-0764</cvename>
<url>http://bugzilla.mozilla.org/show_bug.cgi?id=22183</url>
<url>http://bugzilla.mozilla.org/show_bug.cgi?id=244965</url>
<url>http://bugzilla.mozilla.org/show_bug.cgi?id=252198</url>
<url>http://www.nd.edu/~jsmith30/xul/test/spoof.html</url>
- <url>http://secunia.com/advisories/12188</url>
- <bid>10832</bid>
- </references>
- <dates>
- <discovery>2004-07-19</discovery>
- <entry>2004-07-30</entry>
+ <url>http://secunia.com/advisories/12188</url> <bid>10832</bid>
+ </references> <dates>
+ <discovery>2004-07-19</discovery> <entry>2004-07-30</entry>
<modified>2004-08-15</modified>
</dates>
</vuln>
<vuln vid="f9e3e60b-e650-11d8-9b0a-000347a4fa7d">
- <topic>libpng stack-based buffer overflow and other code concerns</topic>
- <affects>
- <package>
- <name>png</name>
- <range><le>1.2.5_7</le></range>
- </package>
- <package>
- <name>linux-png</name>
- <range><le>1.0.14_3</le></range>
- <range><ge>1.2</ge><le>1.2.2</le></range>
- </package>
- <package>
- <name>firefox</name>
- <range><lt>0.9.3</lt></range>
- </package>
- <package>
- <name>thunderbird</name>
- <range><lt>0.7.3</lt></range>
- </package>
- <package>
- <name>linux-mozilla</name>
- <range><lt>1.7.2</lt></range>
- </package>
+ <topic>libpng stack-based buffer overflow and other code
+ concerns</topic> <affects>
<package>
- <name>linux-mozilla-devel</name>
- <range><lt>1.7.2</lt></range>
- </package>
- <package>
- <name>mozilla</name>
- <range><lt>1.7.2,2</lt></range>
- <range><ge>1.8.a,2</ge><le>1.8.a2,2</le></range>
- </package>
- <package>
- <name>mozilla-gtk1</name>
- <range><lt>1.7.2</lt></range>
- </package>
- <package>
- <name>netscape-communicator</name>
- <name>netscape-navigator</name>
- <range><le>4.78</le></range>
- </package>
- <package>
- <name>linux-netscape-communicator</name>
- <name>linux-netscape-navigator</name>
- <name>ko-netscape-navigator-linux</name>
- <name>ko-netscape-communicator-linux</name>
- <name>ja-netscape-communicator-linux</name>
- <name>ja-netscape-navigator-linux</name>
- <range><le>4.8</le></range>
- </package>
- <package>
- <name>netscape7</name>
- <name>ja-netscape7</name>
- <range><le>7.1</le></range>
- </package>
- <package>
- <name>pt_BR-netscape7</name>
- <name>fr-netscape7</name>
- <name>de-netscape7</name>
- <range><le>7.02</le></range>
- </package>
- </affects>
- <description>
- <body xmlns="http://www.w3.org/1999/xhtml">
- <p>Chris Evans has discovered multiple vulnerabilities in libpng,
- which can be exploited by malicious people to compromise a
- vulnerable system or cause a DoS (Denial of Service).</p>
- </body>
- </description>
- <references>
- <mlist msgid="Pine.LNX.4.58.0408041840080.20655@sphinx.mythic-beasts.com">http://www.securityfocus.com/archive/1/370853</mlist>
+ <name>png</name> <range><le>1.2.5_7</le></range>
+ </package> <package>
+ <name>linux-png</name> <range><le>1.0.14_3</le></range>
+ <range><ge>1.2</ge><le>1.2.2</le></range>
+ </package> <package>
+ <name>firefox</name> <range><lt>0.9.3</lt></range>
+ </package> <package>
+ <name>thunderbird</name> <range><lt>0.7.3</lt></range>
+ </package> <package>
+ <name>linux-mozilla</name> <range><lt>1.7.2</lt></range>
+ </package> <package>
+ <name>linux-mozilla-devel</name> <range><lt>1.7.2</lt></range>
+ </package> <package>
+ <name>mozilla</name> <range><lt>1.7.2,2</lt></range>
+ <range><ge>1.8.a,2</ge><le>1.8.a2,2</le></range>
+ </package> <package>
+ <name>mozilla-gtk1</name> <range><lt>1.7.2</lt></range>
+ </package> <package>
+ <name>netscape-communicator</name> <name>netscape-navigator</name>
+ <range><le>4.78</le></range>
+ </package> <package>
+ <name>linux-netscape-communicator</name>
+ <name>linux-netscape-navigator</name>
+ <name>ko-netscape-navigator-linux</name>
+ <name>ko-netscape-communicator-linux</name>
+ <name>ja-netscape-communicator-linux</name>
+ <name>ja-netscape-navigator-linux</name>
+ <range><le>4.8</le></range>
+ </package> <package>
+ <name>netscape7</name> <name>ja-netscape7</name>
+ <range><le>7.1</le></range>
+ </package> <package>
+ <name>pt_BR-netscape7</name> <name>fr-netscape7</name>
+ <name>de-netscape7</name> <range><le>7.02</le></range>
+ </package>
+ </affects> <description>
+ <body xmlns="http://www.w3.org/1999/xhtml">
+ <p>Chris Evans has discovered multiple vulnerabilities in
+ libpng,
+ which can be exploited by malicious people to compromise
+ a vulnerable system or cause a DoS (Denial of Service).</p>
+ </body>
+ </description> <references>
+ <mlist
+ msgid="Pine.LNX.4.58.0408041840080.20655@sphinx.mythic-beasts.com">http://www.securityfocus.com/archive/1/370853</mlist>
<url>http://scary.beasts.org/security/CESA-2004-001.txt</url>
<url>http://www.osvdb.org/8312</url>
<url>http://www.osvdb.org/8313</url>
<url>http://www.osvdb.org/8314</url>
<url>http://www.osvdb.org/8315</url>
- <url>http://www.osvdb.org/8316</url>
- <cvename>CVE-2004-0597</cvename>
- <cvename>CVE-2004-0598</cvename>
- <cvename>CVE-2004-0599</cvename>
- <certvu>388984</certvu>
- <certvu>236656</certvu>
- <certvu>160448</certvu>
- <certvu>477512</certvu>
- <certvu>817368</certvu>
- <certvu>286464</certvu>
+ <url>http://www.osvdb.org/8316</url> <cvename>CVE-2004-0597</cvename>
+ <cvename>CVE-2004-0598</cvename> <cvename>CVE-2004-0599</cvename>
+ <certvu>388984</certvu> <certvu>236656</certvu>
+ <certvu>160448</certvu> <certvu>477512</certvu>
+ <certvu>817368</certvu> <certvu>286464</certvu>
<url>http://secunia.com/advisories/12219</url>
<url>http://secunia.com/advisories/12232</url>
<url>http://bugzilla.mozilla.org/show_bug.cgi?id=251381</url>
<uscertta>TA04-217A</uscertta>
<url>http://dl.sourceforge.net/sourceforge/libpng/ADVISORY.txt</url>
- </references>
- <dates>
- <discovery>2004-08-04</discovery>
- <entry>2004-08-04</entry>
+ </references> <dates>
+ <discovery>2004-08-04</discovery> <entry>2004-08-04</entry>
<modified>2004-08-15</modified>
</dates>
</vuln>
<vuln vid="603fe36d-ec9d-11d8-b913-000c41e2cdad">
- <topic>kdelibs insecure temporary file handling</topic>
- <affects>
+ <topic>kdelibs insecure temporary file handling</topic> <affects>
<package>
- <name>kdelibs</name>
- <range><le>3.2.3_3</le></range>
+ <name>kdelibs</name> <range><le>3.2.3_3</le></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>According to a KDE Security Advisory, KDE may sometimes
- create temporary files without properly checking the ownership
- and type of the target path. This could allow a local
- attacker to cause KDE applications to overwrite arbitrary
- files.</p>
+ create temporary files without properly checking the
+ ownership and type of the target path. This could allow
+ a local attacker to cause KDE applications to overwrite
+ arbitrary files.</p>
</body>
- </description>
- <references>
- <cvename>CVE-2004-0689</cvename>
- <cvename>CVE-2004-0690</cvename>
+ </description> <references>
+ <cvename>CVE-2004-0689</cvename> <cvename>CVE-2004-0690</cvename>
<url>http://www.kde.org/info/security/advisory-20040811-1.txt</url>
<url>http://www.kde.org/info/security/advisory-20040811-2.txt</url>
<url>ftp://ftp.kde.org/pub/kde/security_patches/post-3.2.3-kdelibs-kstandarddirs.patch</url>
<url>ftp://ftp.kde.org/pub/kde/security_patches/post-3.2.3-kdelibs-dcopserver.patch</url>
- </references>
- <dates>
- <discovery>2004-08-11</discovery>
- <entry>2004-08-12</entry>
+ </references> <dates>
+ <discovery>2004-08-11</discovery> <entry>2004-08-12</entry>
</dates>
</vuln>
<vuln vid="5b8f9a02-ec93-11d8-b913-000c41e2cdad">
- <topic>gaim remotely exploitable vulnerabilities in MSN component</topic>
- <affects>
- <package>
- <name>gaim</name>
- <name>ja-gaim</name>
- <name>ko-gaim</name>
- <name>ru-gaim</name>
- <range><lt>0.81_1</lt></range>
- </package>
+ <topic>gaim remotely exploitable vulnerabilities in MSN
+ component</topic> <affects>
<package>
- <name>gaim</name>
- <range><ge>20030000</ge></range>
+ <name>gaim</name> <name>ja-gaim</name> <name>ko-gaim</name>
+ <name>ru-gaim</name> <range><lt>0.81_1</lt></range>
+ </package> <package>
+ <name>gaim</name> <range><ge>20030000</ge></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>Sebastian Krahmer discovered several remotely exploitable
- buffer overflow vulnerabilities in the MSN component of
- gaim.</p>
+ <p>Sebastian Krahmer discovered several remotely exploitable
+ buffer overflow vulnerabilities in the MSN component of
+ gaim.</p>
<blockquote cite="http://gaim.sourceforge.net/security/?id=0">
- <p>In two places in the MSN protocol plugins (object.c and
- slp.c), strncpy was used incorrectly; the size of the array
- was not checked before copying to it. Both bugs affect MSN's
- MSNSLP protocol, which is peer-to-peer, so this could
- potentially be easy to exploit.</p>
+ <p>In two places in the MSN protocol plugins (object.c
+ and
+ slp.c), strncpy was used incorrectly; the size of the
+ array was not checked before copying to it. Both bugs
+ affect MSN's MSNSLP protocol, which is peer-to-peer,
+ so this could potentially be easy to exploit.</p>
</blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2004-0500</cvename>
<url>http://gaim.sourceforge.net/security/?id=0</url>
- </references>
- <dates>
- <discovery>2004-08-12</discovery>
- <entry>2004-08-12</entry>
+ </references> <dates>
+ <discovery>2004-08-12</discovery> <entry>2004-08-12</entry>
<modified>2004-10-25</modified>
</dates>
</vuln>
<vuln vid="78348ea2-ec91-11d8-b913-000c41e2cdad">
- <topic>acroread uudecoder input validation error</topic>
- <affects>
+ <topic>acroread uudecoder input validation error</topic> <affects>
<package>
- <name>acroread</name>
- <name>acroread4</name>
- <name>acroread5</name>
+ <name>acroread</name> <name>acroread4</name> <name>acroread5</name>
<range><lt>5.0.9</lt></range>
</package>
- </affects>
- <description>
- <body xmlns="http://www.w3.org/1999/xhtml">
- <p>An iDEFENSE security advisory reports:</p>
- <blockquote cite="www.idefense.com/application/poi/display?id=124&amp;type=vulnerabilities">
- <p>Remote exploitation of an input validation error in the
- uudecoding feature of Adobe Acrobat Reader (Unix) 5.0
- allows an attacker to execute arbitrary code.</p>
- <p>The Unix and Linux versions of Adobe Acrobat Reader 5.0
- automatically attempt to convert uuencoded documents
- back into their original format. The vulnerability
- specifically exists in the failure of Acrobat Reader to
- check for the backtick shell metacharacter in the filename
- before executing a command with a shell. This allows a
- maliciously constructed filename to execute arbitrary
- programs.</p>
- </blockquote>
- </body>
- </description>
- <references>
+ </affects> <description>
+ <body xmlns="http://www.w3.org/1999/xhtml">
+ <p>An iDEFENSE security advisory reports:</p> <blockquote
+ cite="www.idefense.com/application/poi/display?id=124&amp;type=vulnerabilities">
+ <p>Remote exploitation of an input validation error in
+ the
+ uudecoding feature of Adobe Acrobat Reader (Unix) 5.0
+ allows an attacker to execute arbitrary code.</p>
+ <p>The Unix and Linux versions of Adobe Acrobat Reader
+ 5.0
+ automatically attempt to convert uuencoded documents
+ back into their original format. The vulnerability
+ specifically exists in the failure of Acrobat Reader
+ to check for the backtick shell metacharacter in the
+ filename before executing a command with a shell. This
+ allows a maliciously constructed filename to execute
+ arbitrary programs.</p>
+ </blockquote>
+ </body>
+ </description> <references>
<cvename>CVE-2004-0630</cvename>
<url>http://www.idefense.com/application/poi/display?id=124&amp;type=vulnerabilities</url>
- </references>
- <dates>
- <discovery>2004-08-12</discovery>
- <entry>2004-08-12</entry>
+ </references> <dates>
+ <discovery>2004-08-12</discovery> <entry>2004-08-12</entry>
<modified>2005-01-06</modified>
</dates>
</vuln>
<vuln vid="12c7b7ae-ec90-11d8-b913-000c41e2cdad">
- <topic>popfile file disclosure</topic>
- <affects>
+ <topic>popfile file disclosure</topic> <affects>
<package>
- <name>popfile</name>
- <range><le>0.21.1_2</le></range>
+ <name>popfile</name> <range><le>0.21.1_2</le></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>John Graham-Cumming reports that certain configurations of
+ <p>John Graham-Cumming reports that certain configurations
+ of
POPFile may allow the retrieval of any files with the
- extensions .gif, .png, .ico, .css, as well as some files with
- the extension .html.</p>
+ extensions .gif, .png, .ico, .css, as well as some files
+ with the extension .html.</p>
</body>
- </description>
- <references>
+ </description> <references>
<mlist>http://sourceforge.net/mailarchive/forum.php?thread_id=5248725&amp;forum_id=12356</mlist>
- </references>
- <dates>
- <discovery>2004-08-02</discovery>
- <entry>2004-08-12</entry>
+ </references> <dates>
+ <discovery>2004-08-02</discovery> <entry>2004-08-12</entry>
</dates>
</vuln>
@@ -17936,176 +14748,136 @@ http_access deny Gopher</pre>
<topic>isc-dhcp3-server buffer overflow in logging mechanism</topic>
<affects>
<package>
- <name>isc-dhcp3-relay</name>
- <name>isc-dhcp3-server</name>
+ <name>isc-dhcp3-relay</name> <name>isc-dhcp3-server</name>
<range><ge>3.0.1.r12</ge><lt>3.0.1.r14</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A buffer overflow exists in the logging functionality
of the DHCP daemon which could lead to Denial of Service
- attacks and has the potential to allow attackers to
- execute arbitrary code.</p>
+ attacks and has the potential to allow attackers to execute
+ arbitrary code.</p>
</body>
- </description>
- <references>
- <cvename>CVE-2004-0460</cvename>
- <url>http://www.osvdb.org/7237</url>
- <uscertta>TA04-174A</uscertta>
- <certvu>317350</certvu>
- <mlist msgid="BAY13-F94UHMuEEkHMz0005c4f7@hotmail.com">http://www.securityfocus.com/archive/1/366801</mlist>
- <mlist msgid="40DFAB69.1060909@sympatico.ca">http://www.securityfocus.com/archive/1/367286</mlist>
- </references>
- <dates>
- <discovery>2004-06-22</discovery>
- <entry>2004-06-25</entry>
+ </description> <references>
+ <cvename>CVE-2004-0460</cvename> <url>http://www.osvdb.org/7237</url>
+ <uscertta>TA04-174A</uscertta> <certvu>317350</certvu> <mlist
+ msgid="BAY13-F94UHMuEEkHMz0005c4f7@hotmail.com">http://www.securityfocus.com/archive/1/366801</mlist>
+ <mlist
+ msgid="40DFAB69.1060909@sympatico.ca">http://www.securityfocus.com/archive/1/367286</mlist>
+ </references> <dates>
+ <discovery>2004-06-22</discovery> <entry>2004-06-25</entry>
<modified>2004-08-12</modified>
</dates>
</vuln>
<vuln vid="3a408f6f-9c52-11d8-9366-0020ed76ef5a">
- <topic>libpng denial-of-service</topic>
- <affects>
+ <topic>libpng denial-of-service</topic> <affects>
<package>
- <name>linux-png</name>
- <range><le>1.0.14_3</le></range>
+ <name>linux-png</name> <range><le>1.0.14_3</le></range>
<range><ge>1.2</ge><le>1.2.2</le></range>
+ </package> <package>
+ <name>png</name> <range><lt>1.2.5_4</lt></range>
</package>
- <package>
- <name>png</name>
- <range><lt>1.2.5_4</lt></range>
- </package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Steve Grubb reports a buffer read overrun in
- libpng's png_format_buffer function. A specially
- constructed PNG image processed by an application using
- libpng may trigger the buffer read overrun and possibly
- result in an application crash.</p>
+ libpng's png_format_buffer function. A specially constructed
+ PNG image processed by an application using libpng may
+ trigger the buffer read overrun and possibly result in
+ an application crash.</p>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2004-0421</cvename>
<url>http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=120508</url>
<url>http://rhn.redhat.com/errata/RHSA-2004-181.html</url>
<url>http://secunia.com/advisories/11505</url>
- <url>http://www.osvdb.org/5726</url>
- <bid>10244</bid>
- </references>
- <dates>
- <discovery>2004-04-29</discovery>
- <entry>2004-05-02</entry>
+ <url>http://www.osvdb.org/5726</url> <bid>10244</bid>
+ </references> <dates>
+ <discovery>2004-04-29</discovery> <entry>2004-05-02</entry>
<modified>2004-08-12</modified>
</dates>
</vuln>
<vuln vid="4764cfd6-d630-11d8-b479-02e0185c0b53">
- <cancelled superseded="dd7aa4f1-102f-11d9-8a8a-000c41e2cdad" />
+ <cancelled superseded="dd7aa4f1-102f-11d9-8a8a-000c41e2cdad"
+ />
</vuln>
<vuln vid="abe47a5a-e23c-11d8-9b0a-000347a4fa7d">
- <topic>Mozilla certificate spoofing</topic>
- <affects>
- <package>
- <name>firefox</name>
- <range><ge>0.9.1</ge><le>0.9.2</le></range>
- </package>
- <package>
- <name>linux-mozilla</name>
- <range><lt>1.7.2</lt></range>
- </package>
- <package>
- <name>linux-mozilla-devel</name>
- <range><lt>1.7.2</lt></range>
- </package>
- <package>
- <name>mozilla</name>
- <range><lt>1.7.2,2</lt></range>
- <range><ge>1.8,2</ge><le>1.8.a2,2</le></range>
- </package>
- <package>
- <name>mozilla-gtk1</name>
- <range><lt>1.7.2</lt></range>
- </package>
- </affects>
- <description>
- <body xmlns="http://www.w3.org/1999/xhtml">
- <p>Mozilla and Mozilla Firefox contains a flaw that may
- allow a malicious user to spoof SSL certification.</p>
- </body>
- </description>
- <references>
- <mlist msgid="003a01c472ba$b2060900$6501a8c0@sec">http://www.securityfocus.com/archive/1/369953</mlist>
+ <topic>Mozilla certificate spoofing</topic> <affects>
+ <package>
+ <name>firefox</name> <range><ge>0.9.1</ge><le>0.9.2</le></range>
+ </package> <package>
+ <name>linux-mozilla</name> <range><lt>1.7.2</lt></range>
+ </package> <package>
+ <name>linux-mozilla-devel</name> <range><lt>1.7.2</lt></range>
+ </package> <package>
+ <name>mozilla</name> <range><lt>1.7.2,2</lt></range>
+ <range><ge>1.8,2</ge><le>1.8.a2,2</le></range>
+ </package> <package>
+ <name>mozilla-gtk1</name> <range><lt>1.7.2</lt></range>
+ </package>
+ </affects> <description>
+ <body xmlns="http://www.w3.org/1999/xhtml">
+ <p>Mozilla and Mozilla Firefox contains a flaw that may
+ allow a malicious user to spoof SSL certification.</p>
+ </body>
+ </description> <references>
+ <mlist
+ msgid="003a01c472ba$b2060900$6501a8c0@sec">http://www.securityfocus.com/archive/1/369953</mlist>
<url>http://www.cipher.org.uk/index.php?p=advisories/Certificate_Spoofing_Mozilla_FireFox_25-07-2004.advisory</url>
<url>http://secunia.com/advisories/12160</url>
<url>http://bugzilla.mozilla.org/show_bug.cgi?id=253121</url>
- <url>http://www.osvdb.org/8238</url>
- <bid>10796</bid>
+ <url>http://www.osvdb.org/8238</url> <bid>10796</bid>
<cvename>CVE-2004-0763</cvename>
- </references>
- <dates>
- <discovery>2004-07-25</discovery>
- <entry>2004-07-30</entry>
+ </references> <dates>
+ <discovery>2004-07-25</discovery> <entry>2004-07-30</entry>
<modified>2004-08-12</modified>
</dates>
</vuln>
<vuln vid="a713c0f9-ec54-11d8-9440-000347a4fa7d">
- <topic>ImageMagick png vulnerability fix</topic>
- <affects>
+ <topic>ImageMagick png vulnerability fix</topic> <affects>
<package>
- <name>ImageMagick</name>
- <name>ImageMagick-nox11</name>
- <range><lt>6.0.4.2</lt></range>
+ <name>ImageMagick</name> <name>ImageMagick-nox11</name>
+ <range><lt>6.0.4.2</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>Glenn Randers-Pehrson has contributed a fix for the png
- vulnerabilities discovered by Chris Evans.</p>
+ <p>Glenn Randers-Pehrson has contributed a fix for the png
+ vulnerabilities discovered by Chris Evans.</p>
</body>
- </description>
- <references>
+ </description> <references>
<url>http://studio.imagemagick.org/pipermail/magick-users/2004-August/013218.html</url>
<url>http://freshmeat.net/releases/169228</url>
<url>http://secunia.com/advisories/12236</url>
<url>http://www.freebsd.org/ports/portaudit/f9e3e60b-e650-11d8-9b0a-000347a4fa7d.html</url>
- </references>
- <dates>
- <discovery>2004-08-04</discovery>
- <entry>2004-08-04</entry>
+ </references> <dates>
+ <discovery>2004-08-04</discovery> <entry>2004-08-04</entry>
<modified>2004-08-12</modified>
</dates>
</vuln>
<vuln vid="98bd69c3-834b-11d8-a41f-0020ed76ef5a">
- <topic>Courier mail services: remotely exploitable buffer overflows</topic>
- <affects>
- <package>
- <name>courier</name>
- <range><lt>0.45</lt></range>
- </package>
+ <topic>Courier mail services: remotely exploitable buffer
+ overflows</topic> <affects>
<package>
- <name>courier-imap</name>
- <range><lt>3.0,1</lt></range>
+ <name>courier</name> <range><lt>0.45</lt></range>
+ </package> <package>
+ <name>courier-imap</name> <range><lt>3.0,1</lt></range>
+ </package> <package>
+ <name>sqwebmail</name> <range><lt>4.0</lt></range>
</package>
- <package>
- <name>sqwebmail</name>
- <range><lt>4.0</lt></range>
- </package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Courier set of mail services use a common Unicode
library. This library contains buffer overflows in the
converters for two popular Japanese character encodings.
- These overflows may be remotely exploitable, triggered by
- a maliciously formatted email message that is later processed
- by one of the Courier mail services.
- From the release notes for the corrected versions of the
- Courier set of mail services:</p>
+ These overflows may be remotely exploitable, triggered
+ by a maliciously formatted email message that is later
+ processed by one of the Courier mail services. From the
+ release notes for the corrected versions of the Courier
+ set of mail services:</p>
<blockquote>
<p>iso2022jp.c: Converters became (upper-)compatible with
ISO-2022-JP (RFC1468 / JIS X 0208:1997 Annex 2) and
@@ -18113,227 +14885,176 @@ http_access deny Gopher</pre>
(when Unicode character is out of BMP range) has been
closed. Convert error handling was implemented.</p>
<p>shiftjis.c: Broken SHIFT_JIS converters has been fixed
- and became (upper-)compatible with Shifted Encoding Method
- (JIS X 0208:1997 Annex 1). Buffer overflow vulnerability
- (when Unicode character is out of BMP range) has been
- closed. Convert error handling was implemented.</p>
+ and became (upper-)compatible with Shifted Encoding
+ Method (JIS X 0208:1997 Annex 1). Buffer overflow
+ vulnerability (when Unicode character is out of BMP
+ range) has been closed. Convert error handling was
+ implemented.</p>
</blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2004-0224</cvename>
<url>http://cvs.sourceforge.net/viewcvs.py/courier/libs/unicode/iso2022jp.c?rev=1.10&amp;view=markup</url>
<url>http://cvs.sourceforge.net/viewcvs.py/courier/libs/unicode/shiftjis.c?rev=1.6&amp;view=markup</url>
- <bid>9845</bid>
- <url>http://secunia.com/advisories/11087</url>
+ <bid>9845</bid> <url>http://secunia.com/advisories/11087</url>
<url>http://www.osvdb.org/4194</url>
<url>http://www.osvdb.org/6927</url>
- </references>
- <dates>
- <discovery>2004-02-01</discovery>
- <entry>2004-03-31</entry>
+ </references> <dates>
+ <discovery>2004-02-01</discovery> <entry>2004-03-31</entry>
<modified>2004-07-16</modified>
</dates>
</vuln>
<vuln vid="cdf18ed9-7f4a-11d8-9645-0020ed76ef5a">
- <topic>multiple vulnerabilities in ethereal</topic>
- <affects>
+ <topic>multiple vulnerabilities in ethereal</topic> <affects>
<package>
- <name>ethereal</name>
- <name>tethereal</name>
+ <name>ethereal</name> <name>tethereal</name>
<range><lt>0.10.3</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>Stefan Esser of e-matters Security discovered a baker's dozen
+ <p>Stefan Esser of e-matters Security discovered a baker's
+ dozen
of buffer overflows in Ethereal's decoders, including:</p>
<ul>
- <li>NetFlow</li>
- <li>IGAP</li>
- <li>EIGRP</li>
- <li>PGM</li>
- <li>IRDA</li>
- <li>BGP</li>
- <li>ISUP</li>
- <li>TCAP</li>
+ <li>NetFlow</li> <li>IGAP</li> <li>EIGRP</li> <li>PGM</li>
+ <li>IRDA</li> <li>BGP</li> <li>ISUP</li> <li>TCAP</li>
<li>UCP</li>
- </ul>
- <p>In addition, a vulnerability in the RADIUS decoder was found
+ </ul> <p>In addition, a vulnerability in the RADIUS decoder
+ was found
by Jonathan Heusser.</p>
- <p>Finally, there is one uncredited vulnerability described by the
+ <p>Finally, there is one uncredited vulnerability described
+ by the
Ethereal team as:</p>
- <blockquote cite="http://www.ethereal.com/appnotes/enpa-sa-00013.html">
- <p>A zero-length Presentation protocol selector could make
- Ethereal crash.</p>
+ <blockquote
+ cite="http://www.ethereal.com/appnotes/enpa-sa-00013.html">
+ <p>A zero-length Presentation protocol selector could
+ make Ethereal crash.</p>
</blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<url>http://www.ethereal.com/appnotes/enpa-sa-00013.html</url>
- <cvename>CVE-2004-0176</cvename>
- <cvename>CVE-2004-0365</cvename>
- <cvename>CVE-2004-0367</cvename>
- <certvu>119876</certvu>
- <certvu>124454</certvu>
- <certvu>125156</certvu>
- <certvu>433596</certvu>
- <certvu>591820</certvu>
- <certvu>644886</certvu>
- <certvu>659140</certvu>
- <certvu>695486</certvu>
- <certvu>740188</certvu>
- <certvu>792286</certvu>
- <certvu>864884</certvu>
+ <cvename>CVE-2004-0176</cvename> <cvename>CVE-2004-0365</cvename>
+ <cvename>CVE-2004-0367</cvename> <certvu>119876</certvu>
+ <certvu>124454</certvu> <certvu>125156</certvu>
+ <certvu>433596</certvu> <certvu>591820</certvu>
+ <certvu>644886</certvu> <certvu>659140</certvu>
+ <certvu>695486</certvu> <certvu>740188</certvu>
+ <certvu>792286</certvu> <certvu>864884</certvu>
<certvu>931588</certvu>
<url>http://security.e-matters.de/advisories/032004.html</url>
- <url>http://secunia.com/advisories/11185</url>
- <bid>9952</bid>
+ <url>http://secunia.com/advisories/11185</url> <bid>9952</bid>
<url>http://www.osvdb.org/4462</url>
<url>http://www.osvdb.org/4463</url>
<url>http://www.osvdb.org/4464</url>
- </references>
- <dates>
- <discovery>2004-03-23</discovery>
- <entry>2004-03-26</entry>
+ </references> <dates>
+ <discovery>2004-03-23</discovery> <entry>2004-03-26</entry>
<modified>2004-07-11</modified>
</dates>
</vuln>
<vuln vid="74d06b67-d2cf-11d8-b479-02e0185c0b53">
- <topic>multiple vulnerabilities in ethereal</topic>
- <affects>
+ <topic>multiple vulnerabilities in ethereal</topic> <affects>
<package>
- <name>ethereal</name>
- <name>ethereal-lite</name>
- <name>tethereal</name>
- <name>tethereal-lite</name>
+ <name>ethereal</name> <name>ethereal-lite</name>
+ <name>tethereal</name> <name>tethereal-lite</name>
<range><lt>0.10.4</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>Issues have been discovered in multiple protocol dissectors.</p>
+ <p>Issues have been discovered in multiple protocol
+ dissectors.</p>
</body>
- </description>
- <references>
+ </description> <references>
<url>http://www.ethereal.com/appnotes/enpa-sa-00014.html</url>
- <cvename>CVE-2004-0504</cvename>
- <cvename>CVE-2004-0505</cvename>
- <cvename>CVE-2004-0506</cvename>
- <cvename>CVE-2004-0507</cvename>
- <url>http://secunia.com/advisories/11608</url>
- <bid>10347</bid>
+ <cvename>CVE-2004-0504</cvename> <cvename>CVE-2004-0505</cvename>
+ <cvename>CVE-2004-0506</cvename> <cvename>CVE-2004-0507</cvename>
+ <url>http://secunia.com/advisories/11608</url> <bid>10347</bid>
<url>http://www.osvdb.org/6131</url>
<url>http://www.osvdb.org/6132</url>
<url>http://www.osvdb.org/6133</url>
<url>http://www.osvdb.org/6134</url>
- </references>
- <dates>
- <discovery>2004-05-13</discovery>
- <entry>2004-07-11</entry>
+ </references> <dates>
+ <discovery>2004-05-13</discovery> <entry>2004-07-11</entry>
</dates>
</vuln>
<vuln vid="265c8b00-d2d0-11d8-b479-02e0185c0b53">
- <topic>multiple vulnerabilities in ethereal</topic>
- <affects>
+ <topic>multiple vulnerabilities in ethereal</topic> <affects>
<package>
- <name>ethereal</name>
- <name>ethereal-lite</name>
- <name>tethereal</name>
- <name>tethereal-lite</name>
+ <name>ethereal</name> <name>ethereal-lite</name>
+ <name>tethereal</name> <name>tethereal-lite</name>
<range><lt>0.10.5</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>Issues have been discovered in multiple protocol dissectors.</p>
+ <p>Issues have been discovered in multiple protocol
+ dissectors.</p>
</body>
- </description>
- <references>
+ </description> <references>
<url>http://www.ethereal.com/appnotes/enpa-sa-00015.html</url>
- <cvename>CVE-2004-0633</cvename>
- <cvename>CVE-2004-0634</cvename>
+ <cvename>CVE-2004-0633</cvename> <cvename>CVE-2004-0634</cvename>
<cvename>CVE-2004-0635</cvename>
- <url>http://secunia.com/advisories/12024</url>
- <bid>10672</bid>
+ <url>http://secunia.com/advisories/12024</url> <bid>10672</bid>
<url>http://www.osvdb.org/7536</url>
<url>http://www.osvdb.org/7537</url>
<url>http://www.osvdb.org/7538</url>
- </references>
- <dates>
- <discovery>2004-07-06</discovery>
- <entry>2004-07-11</entry>
+ </references> <dates>
+ <discovery>2004-07-06</discovery> <entry>2004-07-11</entry>
</dates>
</vuln>
<vuln vid="4aec9d58-ce7b-11d8-858d-000d610a3b12">
- <topic>Format string vulnerability in SSLtelnet</topic>
- <affects>
+ <topic>Format string vulnerability in SSLtelnet</topic> <affects>
<package>
- <name>SSLtelnet</name>
- <range><le>0.13_1</le></range>
+ <name>SSLtelnet</name> <range><le>0.13_1</le></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>SSLtelnet contains a format string vulnerability that could
+ <p>SSLtelnet contains a format string vulnerability that
+ could
allow remote code execution and privilege escalation.</p>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2004-0640</cvename>
<url>http://www.idefense.com/application/poi/display?id=114&amp;type=vulnerabilities</url>
- </references>
- <dates>
- <discovery>2003-04-03</discovery>
- <entry>2004-07-05</entry>
+ </references> <dates>
+ <discovery>2003-04-03</discovery> <entry>2004-07-05</entry>
</dates>
</vuln>
<vuln vid="c5519420-cec2-11d8-8898-000d6111a684">
- <topic>"Content-Type" XSS vulnerability affecting other webmail systems</topic>
- <affects>
- <package>
- <name>openwebmail</name>
- <range><le>2.32</le></range>
- </package>
+ <topic>"Content-Type" XSS vulnerability affecting other webmail
+ systems</topic> <affects>
<package>
- <name>ilohamail</name>
- <range><lt>0.8.13</lt></range>
+ <name>openwebmail</name> <range><le>2.32</le></range>
+ </package> <package>
+ <name>ilohamail</name> <range><lt>0.8.13</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>Roman Medina-Heigl Hernandez did a survey which other webmail systems
- where vulnerable to a bug he discovered in SquirrelMail. This advisory
- summarizes the results.</p>
+ <p>Roman Medina-Heigl Hernandez did a survey which other
+ webmail systems
+ where vulnerable to a bug he discovered in SquirrelMail.
+ This advisory summarizes the results.</p>
</body>
- </description>
- <references>
+ </description> <references>
<url>http://www.rs-labs.com/adv/RS-Labs-Advisory-2004-2.txt</url>
<url>http://www.freebsd.org/ports/portaudit/89a0de27-bf66-11d8-a252-02e0185c0b53.html</url>
<url>http://www.freebsd.org/ports/portaudit/911f1b19-bd20-11d8-84f9-000bdb1444a4.html</url>
<url>http://www.freebsd.org/ports/portaudit/c3e56efa-c42f-11d8-864c-02e0185c0b53.html</url>
<cvename>CVE-2004-0519</cvename>
- </references>
- <dates>
- <discovery>2004-05-29</discovery>
- <entry>2004-07-05</entry>
+ </references> <dates>
+ <discovery>2004-05-29</discovery> <entry>2004-07-05</entry>
</dates>
</vuln>
<vuln vid="76904dce-ccf3-11d8-babb-000854d03344">
- <topic>Pavuk HTTP Location header overflow</topic>
- <affects>
+ <topic>Pavuk HTTP Location header overflow</topic> <affects>
<package>
- <name>pavuk</name>
- <range><lt>0.9.28_5</lt></range>
+ <name>pavuk</name> <range><lt>0.9.28_5</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>When pavuk sends a request to a web server and the server
sends back the HTTP status code 305 (Use Proxy), pavuk
@@ -18341,96 +15062,79 @@ http_access deny Gopher</pre>
manner. This leads to a stack-based buffer overflow with
control over EIP.</p>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2004-0456</cvename>
<mlist>http://lists.netsys.com/pipermail/full-disclosure/2004-July/023322.html</mlist>
<url>http://www.osvdb.org/7319</url>
- </references>
- <dates>
- <discovery>2004-06-30</discovery>
- <entry>2004-07-03</entry>
+ </references> <dates>
+ <discovery>2004-06-30</discovery> <entry>2004-07-03</entry>
</dates>
</vuln>
<vuln vid="33ab4a47-bfc1-11d8-b00e-000347a4fa7d">
- <topic>Several vulnerabilities found in PHPNuke</topic>
- <affects>
+ <topic>Several vulnerabilities found in PHPNuke</topic> <affects>
<package>
- <name>phpnuke</name>
- <range><lt>7.3</lt></range>
+ <name>phpnuke</name> <range><lt>7.3</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Janek Vind "waraxe" reports that several issues in the
PHPNuke software may be exploited via carefully crafted
URL requests. These URLs will permit the injection of
- SQL code, cookie theft, and the readability of the
- PHPNuke administrator account.</p>
+ SQL code, cookie theft, and the readability of the PHPNuke
+ administrator account.</p>
</body>
- </description>
- <references>
- <cvename>CVE-2003-0279</cvename>
- <cvename>CVE-2003-0318</cvename>
- <cvename>CVE-2004-0266</cvename>
- <cvename>CVE-2004-0269</cvename>
+ </description> <references>
+ <cvename>CVE-2003-0279</cvename> <cvename>CVE-2003-0318</cvename>
+ <cvename>CVE-2004-0266</cvename> <cvename>CVE-2004-0269</cvename>
<url>http://www.waraxe.us/index.php?modname=sa&amp;id=27</url>
<url>http://secunia.com/advisories/11920</url>
- </references>
- <dates>
- <discovery>2004-05-05</discovery>
- <entry>2004-07-03</entry>
+ </references> <dates>
+ <discovery>2004-05-05</discovery> <entry>2004-07-03</entry>
<modified>2004-09-28</modified>
</dates>
</vuln>
<vuln vid="0d4c31ac-cb91-11d8-8898-000d6111a684">
- <topic>Remote code injection in phpMyAdmin</topic>
- <affects>
+ <topic>Remote code injection in phpMyAdmin</topic> <affects>
<package>
- <name>phpMyAdmin</name>
- <range><lt>2.5.7.1</lt></range>
+ <name>phpMyAdmin</name> <range><lt>2.5.7.1</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>This vulnerability would allow remote user to inject PHP code
- to be executed by eval() function. This vulnerability is only
- exploitable if variable $cfg['LeftFrameLight'] is set to FALSE (in
- file config.inc.php).</p>
+ <p>This vulnerability would allow remote user to inject PHP
+ code
+ to be executed by eval() function. This vulnerability
+ is only exploitable if variable $cfg['LeftFrameLight']
+ is set to FALSE (in file config.inc.php).</p>
</body>
- </description>
- <references>
+ </description> <references>
<url>http://sf.net/forum/forum.php?forum_id=387635</url>
- <mlist msgid="20040629025752.976.qmail@www.securityfocus.com">http://www.securityfocus.com/archive/1/367486</mlist>
+ <mlist
+ msgid="20040629025752.976.qmail@www.securityfocus.com">http://www.securityfocus.com/archive/1/367486</mlist>
<url>http://secunia.com/advisories/11974</url>
<url>http://eagle.kecapi.com/sec/fd/phpMyAdmin.html</url>
- </references>
- <dates>
- <discovery>2004-06-29</discovery>
- <entry>2004-07-02</entry>
+ </references> <dates>
+ <discovery>2004-06-29</discovery> <entry>2004-07-02</entry>
<modified>2004-09-28</modified>
</dates>
</vuln>
<vuln vid="4d837296-cc28-11d8-a54c-02e0185c0b53">
- <topic>GNATS local privilege elevation</topic>
- <affects>
+ <topic>GNATS local privilege elevation</topic> <affects>
<package>
- <name>gnats</name>
- <range><le>3.113.1_9</le></range>
+ <name>gnats</name> <range><le>3.113.1_9</le></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>GNATS 3.113.1 contains multiple buffer overflows, through which a
- local attacker could gain elevated privileges on the system.</p>
+ <p>GNATS 3.113.1 contains multiple buffer overflows, through
+ which a
+ local attacker could gain elevated privileges on the
+ system.</p>
</body>
- </description>
- <references>
- <freebsdpr>ports/56006</freebsdpr>
- <mlist msgid="20040625164231.7437.qmail@www.securityfocus.com">http://www.securityfocus.com/archive/1/326337</mlist>
+ </description> <references>
+ <freebsdpr>ports/56006</freebsdpr> <mlist
+ msgid="20040625164231.7437.qmail@www.securityfocus.com">http://www.securityfocus.com/archive/1/326337</mlist>
<url>http://www.securiteam.com/unixfocus/5CP0N0UAAA.html</url>
<url>http://secunia.com/advisories/9096</url>
<url>http://x82.inetcop.org/h0me/adv1sor1es/INCSA.2003-0x82-018-GNATS-bt.txt</url>
@@ -18439,23 +15143,19 @@ http_access deny Gopher</pre>
<url>http://www.osvdb.org/4600</url>
<url>http://www.osvdb.org/4601</url>
<url>http://www.osvdb.org/4607</url>
- </references>
- <dates>
- <discovery>2003-06-21</discovery>
- <entry>2004-07-02</entry>
+ </references> <dates>
+ <discovery>2003-06-21</discovery> <entry>2004-07-02</entry>
</dates>
</vuln>
<vuln vid="8ecaaca2-cc07-11d8-858d-000d610a3b12">
- <topic>Linux binary compatibility mode input validation error</topic>
- <affects>
+ <topic>Linux binary compatibility mode input validation
+ error</topic> <affects>
<system>
- <name>FreeBSD</name>
- <range><ge>4.9</ge><lt>4.9_10</lt></range>
+ <name>FreeBSD</name> <range><ge>4.9</ge><lt>4.9_10</lt></range>
<range><ge>4.8</ge><lt>4.8_23</lt></range>
</system>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A programming error in the handling of some Linux system
calls may result in memory locations being accessed without
@@ -18465,14 +15165,11 @@ http_access deny Gopher</pre>
of sensitive information or potential privilege escalation.
A local attacker can cause a system panic.</p>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2004-0602</cvename>
<freebsdsa>SA-04:13.linux</freebsdsa>
- </references>
- <dates>
- <discovery>2004-06-18</discovery>
- <entry>2004-06-30</entry>
+ </references> <dates>
+ <discovery>2004-06-18</discovery> <entry>2004-06-30</entry>
</dates>
</vuln>
@@ -18480,185 +15177,149 @@ http_access deny Gopher</pre>
<topic>Remote Denial of Service of HTTP server and client</topic>
<affects>
<package>
- <name>giFT-FastTrack</name>
- <range><lt>0.8.7</lt></range>
+ <name>giFT-FastTrack</name> <range><lt>0.8.7</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>giFT-FastTrack is susceptible to a remote
- Denial of Service attack which could allow
- a remote attacker to render HTTP services
- unusable. According to the developers, no
- code execution is possible; however, they
- recommend an immediate upgrade.</p>
+ Denial of Service attack which could allow a remote
+ attacker to render HTTP services unusable. According to
+ the developers, no code execution is possible; however,
+ they recommend an immediate upgrade.</p>
</body>
- </description>
- <references>
+ </description> <references>
<url>http://developer.berlios.de/forum/forum.php?forum_id=5814</url>
<url>http://www.osvdb.org/7266</url>
- <url>http://secunia.com/advisories/11941</url>
- <bid>10604</bid>
- </references>
- <dates>
- <discovery>2004-06-19</discovery>
- <entry>2004-06-25</entry>
+ <url>http://secunia.com/advisories/11941</url> <bid>10604</bid>
+ </references> <dates>
+ <discovery>2004-06-19</discovery> <entry>2004-06-25</entry>
<modified>2004-06-29</modified>
</dates>
</vuln>
<vuln vid="ff00f2ce-c54c-11d8-b708-00061bc2ad93">
- <topic>XFree86 opens a chooserFd TCP socket even when DisplayManager.requestPort is 0</topic>
- <affects>
+ <topic>XFree86 opens a chooserFd TCP socket even when
+ DisplayManager.requestPort is 0</topic> <affects>
<package>
- <name>xorg-clients</name>
- <range><eq>6.7.0</eq></range>
+ <name>xorg-clients</name> <range><eq>6.7.0</eq></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>When the IPv6 code was added to xdm a critical
test to disable xdmcp was accidentally removed. This
caused xdm to create the chooser socket regardless if
- DisplayManager.requestPort was disabled in xdm-config
- or not.</p>
+ DisplayManager.requestPort was disabled in xdm-config or
+ not.</p>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2004-0419</cvename>
<url>http://bugs.xfree86.org/show_bug.cgi?id=1376</url>
<url>https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=124900</url>
- </references>
- <dates>
- <discovery>2004-05-19</discovery>
- <entry>2004-06-28</entry>
+ </references> <dates>
+ <discovery>2004-05-19</discovery> <entry>2004-06-28</entry>
<modified>2004-06-28</modified>
</dates>
</vuln>
<vuln vid="da9e6438-bfc0-11d8-b00e-000347a4fa7d">
- <topic>MoinMoin administrative group name privilege escalation vulnerability</topic>
- <affects>
+ <topic>MoinMoin administrative group name privilege escalation
+ vulnerability</topic> <affects>
<package>
- <name>moinmoin</name>
- <range><lt>1.2.2</lt></range>
+ <name>moinmoin</name> <range><lt>1.2.2</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A serious flaw exists in the MoinMoin software
which may allow a malicious user to gain access to
unauthorized privileges.</p>
</body>
- </description>
- <references>
- <url>http://www.osvdb.org/6704</url>
- <cvename>CVE-2004-0708</cvename>
- <bid>10568</bid>
- <url>http://secunia.com/advisories/11807</url>
- </references>
- <dates>
- <discovery>2004-05-04</discovery>
- <entry>2004-06-28</entry>
+ </description> <references>
+ <url>http://www.osvdb.org/6704</url> <cvename>CVE-2004-0708</cvename>
+ <bid>10568</bid> <url>http://secunia.com/advisories/11807</url>
+ </references> <dates>
+ <discovery>2004-05-04</discovery> <entry>2004-06-28</entry>
</dates>
</vuln>
<vuln vid="35f6fdf8-a425-11d8-9c6d-0020ed76ef5a">
- <topic>Cyrus IMAP pre-authentication heap overflow vulnerability</topic>
- <affects>
+ <topic>Cyrus IMAP pre-authentication heap overflow
+ vulnerability</topic> <affects>
<package>
- <name>cyrus</name>
- <range><lt>2.0.17</lt></range>
+ <name>cyrus</name> <range><lt>2.0.17</lt></range>
<range><ge>2.1</ge><lt>2.1.11</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>In December 2002, Timo Sirainen reported:</p>
- <blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=103886607825605">
+ <p>In December 2002, Timo Sirainen reported:</p> <blockquote
+ cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=103886607825605">
<p>Cyrus IMAP server has a a remotely exploitable pre-login
- buffer overflow. [...] Note that you don't have to log in
- before exploiting this, and since Cyrus
- runs everything under one UID, it's possible to read every
- user's mail in the system.</p>
- </blockquote>
- <p>It is unknown whether this vulnerability is exploitable for code
+ buffer overflow. [...] Note that you don't have to log
+ in before exploiting this, and since Cyrus runs everything
+ under one UID, it's possible to read every user's mail
+ in the system.</p>
+ </blockquote> <p>It is unknown whether this vulnerability
+ is exploitable for code
execution on FreeBSD systems.</p>
</body>
- </description>
- <references>
- <cvename>CVE-2002-1580</cvename>
- <bid>6298</bid>
- <certvu>740169</certvu>
- <mlist msgid="20021202175606.GA26254@irccrew.org">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=103886607825605</mlist>
+ </description> <references>
+ <cvename>CVE-2002-1580</cvename> <bid>6298</bid>
+ <certvu>740169</certvu> <mlist
+ msgid="20021202175606.GA26254@irccrew.org">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=103886607825605</mlist>
<mlist>http://asg.web.cmu.edu/archive/message.php?mailbox=archive.info-cyrus&amp;msg=19349</mlist>
- </references>
- <dates>
- <discovery>2002-12-02</discovery>
- <entry>2004-05-12</entry>
+ </references> <dates>
+ <discovery>2002-12-02</discovery> <entry>2004-05-12</entry>
<modified>2004-06-27</modified>
</dates>
</vuln>
<vuln vid="700d43b4-a42a-11d8-9c6d-0020ed76ef5a">
- <topic>Cyrus IMSPd multiple vulnerabilities</topic>
- <affects>
+ <topic>Cyrus IMSPd multiple vulnerabilities</topic> <affects>
<package>
- <name>cyrus-imspd</name>
- <range><lt>1.6a5</lt></range>
+ <name>cyrus-imspd</name> <range><lt>1.6a5</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Cyrus team reported multiple vulnerabilities in older
versions of Cyrus IMSPd:</p>
- <blockquote cite="http://asg.web.cmu.edu/archive/message.php?mailbox=archive.cyrus-announce&amp;msg=25">
+ <blockquote
+ cite="http://asg.web.cmu.edu/archive/message.php?mailbox=archive.cyrus-announce&amp;msg=25">
<p>These releases correct a recently discovered buffer
overflow vulnerability, as well as clean up a significant
amount of buffer handling throughout the code.</p>
</blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<mlist>http://asg.web.cmu.edu/archive/message.php?mailbox=archive.cyrus-announce&amp;msg=25</mlist>
- </references>
- <dates>
- <discovery>2004-12-12</discovery>
- <entry>2004-05-12</entry>
+ </references> <dates>
+ <discovery>2004-12-12</discovery> <entry>2004-05-12</entry>
<modified>2004-06-27</modified>
</dates>
</vuln>
<vuln vid="5e7f58c3-b3f8-4258-aeb8-795e5e940ff8">
- <topic>mplayer heap overflow in http requests</topic>
- <affects>
+ <topic>mplayer heap overflow in http requests</topic> <affects>
<package>
- <name>mplayer</name>
- <name>mplayer-gtk</name>
- <name>mplayer-esound</name>
- <name>mplayer-gtk-esound</name>
+ <name>mplayer</name> <name>mplayer-gtk</name>
+ <name>mplayer-esound</name> <name>mplayer-gtk-esound</name>
<range><lt>0.92.1</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>A remotely exploitable heap buffer overflow vulnerability was
+ <p>A remotely exploitable heap buffer overflow vulnerability
+ was
found in MPlayer's URL decoding code. If an attacker can
- cause MPlayer to visit a specially crafted URL, arbitrary code
- execution with the privileges of the user running MPlayer may
- occur. A `visit' might be caused by social engineering, or a
- malicious web server could use HTTP redirects which MPlayer
- would then process.</p>
+ cause MPlayer to visit a specially crafted URL, arbitrary
+ code execution with the privileges of the user running
+ MPlayer may occur. A `visit' might be caused by social
+ engineering, or a malicious web server could use HTTP
+ redirects which MPlayer would then process.</p>
</body>
- </description>
- <references>
+ </description> <references>
<url>http://www.mplayerhq.hu/homepage/design6/news.html</url>
<mlist>http://marc.theaimsgroup.com/?l=bugtraq&amp;m=108066964709058</mlist>
<freebsdpr>ports/64974</freebsdpr>
- </references>
- <dates>
- <discovery>2004-03-30</discovery>
- <entry>2004-03-31</entry>
+ </references> <dates>
+ <discovery>2004-03-30</discovery> <entry>2004-03-31</entry>
<modified>2004-06-27</modified>
</dates>
</vuln>
@@ -18667,29 +15328,24 @@ http_access deny Gopher</pre>
<topic>ecartis buffer overflows and input validation bugs</topic>
<affects>
<package>
- <name>ecartis</name>
- <range><lt>1.0.0.s20030814,1</lt></range>
+ <name>ecartis</name> <range><lt>1.0.0.s20030814,1</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>Timo Sirainen reports multiple buffer overflows that may be
- triggered while parsing messages, as well as input validation
- errors that could result in disclosure of mailing list
- passwords.</p>
+ <p>Timo Sirainen reports multiple buffer overflows that may
+ be
+ triggered while parsing messages, as well as input
+ validation errors that could result in disclosure of
+ mailing list passwords.</p>
<p>These bugs were resolved in the August 2003 snapshot of
ecartis.</p>
</body>
- </description>
- <references>
- <cvename>CVE-2003-0781</cvename>
- <cvename>CVE-2003-0782</cvename>
+ </description> <references>
+ <cvename>CVE-2003-0781</cvename> <cvename>CVE-2003-0782</cvename>
<url>http://www.securiteam.com/unixfocus/5YP0H2AAUY.html</url>
<freebsdpr>ports/57082</freebsdpr>
- </references>
- <dates>
- <discovery>2003-08-14</discovery>
- <entry>2004-03-29</entry>
+ </references> <dates>
+ <discovery>2003-08-14</discovery> <entry>2004-03-29</entry>
<modified>2004-06-27</modified>
</dates>
</vuln>
@@ -18698,138 +15354,109 @@ http_access deny Gopher</pre>
<topic>ModSecurity for Apache 2.x remote off-by-one overflow</topic>
<affects>
<package>
- <name>mod_security</name>
- <range><lt>1.7.5</lt></range>
+ <name>mod_security</name> <range><lt>1.7.5</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>When the directive "SecFilterScanPost" is enabled,
- the Apache 2.x version of ModSecurity is vulnerable
- to an off-by-one overflow</p>
+ the Apache 2.x version of ModSecurity is vulnerable to
+ an off-by-one overflow</p>
</body>
- </description>
- <references>
+ </description> <references>
<url>http://www.s-quadra.com/advisories/Adv-20040315.txt</url>
- <bid>9885</bid>
- <url>http://secunia.com/advisories/11138</url>
+ <bid>9885</bid> <url>http://secunia.com/advisories/11138</url>
<certvu>779438</certvu>
- </references>
- <dates>
- <discovery>2004-02-09</discovery>
- <entry>2004-03-17</entry>
+ </references> <dates>
+ <discovery>2004-02-09</discovery> <entry>2004-03-17</entry>
<modified>2004-06-27</modified>
</dates>
</vuln>
<vuln vid="74a9541d-5d6c-11d8-80e3-0020ed76ef5a">
- <topic>clamav remote denial-of-service</topic>
- <affects>
+ <topic>clamav remote denial-of-service</topic> <affects>
<package>
- <name>clamav</name>
- <range><lt>0.65_7</lt></range>
+ <name>clamav</name> <range><lt>0.65_7</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>clamav will exit when a programming
assertion is not met. A malformed uuencoded message can
trigger this assertion, allowing an attacker to trivially
crash clamd or other components of clamav.</p>
</body>
- </description>
- <references>
- <freebsdpr>ports/62586</freebsdpr>
- <mlist msgid="40279811.9050407@fillmore-labs.com">http://www.securityfocus.com/archive/1/353186</mlist>
- <url>http://www.osvdb.org/3894</url>
- <bid>9610</bid>
+ </description> <references>
+ <freebsdpr>ports/62586</freebsdpr> <mlist
+ msgid="40279811.9050407@fillmore-labs.com">http://www.securityfocus.com/archive/1/353186</mlist>
+ <url>http://www.osvdb.org/3894</url> <bid>9610</bid>
<url>http://secunia.com/advisories/10826</url>
<cvename>CVE-2004-0270</cvename>
<url>http://xforce.iss.net/xforce/xfdb/15077</url>
- </references>
- <dates>
- <discovery>2004-02-09</discovery>
- <entry>2004-02-12</entry>
+ </references> <dates>
+ <discovery>2004-02-09</discovery> <entry>2004-02-12</entry>
<modified>2004-06-27</modified>
</dates>
</vuln>
<vuln vid="8d075001-a9ce-11d8-9c6d-0020ed76ef5a">
- <topic>neon date parsing vulnerability</topic>
- <affects>
- <package>
- <name>neon</name>
- <range><lt>0.24.5_1</lt></range>
- </package>
+ <topic>neon date parsing vulnerability</topic> <affects>
<package>
- <name>sitecopy</name>
- <range><le>0.13.4_1</le></range>
+ <name>neon</name> <range><lt>0.24.5_1</lt></range>
+ </package> <package>
+ <name>sitecopy</name> <range><le>0.13.4_1</le></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>Stefan Esser reports:</p>
- <blockquote cite="http://security.e-matters.de/advisories/062004.html">
+ <p>Stefan Esser reports:</p> <blockquote
+ cite="http://security.e-matters.de/advisories/062004.html">
<p>A vulnerability within a libneon date parsing function
could cause a heap overflow which could lead to remote
code execution, depending on the application using
libneon.</p>
- </blockquote>
- <p>The vulnerability is in the function ne_rfc1036_parse,
+ </blockquote> <p>The vulnerability is in the function
+ ne_rfc1036_parse,
which is in turn used by the function ne_httpdate_parse.
Applications using either of these neon functions may be
vulnerable.</p>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2004-0398</cvename>
<url>http://security.e-matters.de/advisories/062004.html</url>
<url>http://secunia.com/advisories/11785</url>
- </references>
- <dates>
- <discovery>2004-05-19</discovery>
- <entry>2004-05-19</entry>
+ </references> <dates>
+ <discovery>2004-05-19</discovery> <entry>2004-05-19</entry>
<modified>2004-06-25</modified>
</dates>
</vuln>
<vuln vid="84237895-8f39-11d8-8b29-0020ed76ef5a">
- <topic>neon format string vulnerabilities</topic>
- <affects>
- <package>
- <name>neon</name>
- <range><lt>0.24.5</lt></range>
- </package>
- <package>
- <name>tla</name>
- <range><lt>1.2_1</lt></range>
- </package>
- <package>
- <name>sitecopy</name>
- <range><le>0.13.4_1</le></range>
- </package>
- </affects>
- <description>
- <body xmlns="http://www.w3.org/1999/xhtml">
- <p>Greuff reports that the neon WebDAV client library contains
- several format string bugs within error reporting code. A
- malicious server may exploit these bugs by sending specially
- crafted PROPFIND or PROPPATCH responses.</p>
- <p>Although several applications include neon, such as cadaver and
- subversion, the FreeBSD Ports of these applications are not
- impacted. They are specifically configured to NOT use the
- included neon. Only packages listed as affected in this
- notice are believed to be impacted.</p>
- </body>
- </description>
- <references>
+ <topic>neon format string vulnerabilities</topic> <affects>
+ <package>
+ <name>neon</name> <range><lt>0.24.5</lt></range>
+ </package> <package>
+ <name>tla</name> <range><lt>1.2_1</lt></range>
+ </package> <package>
+ <name>sitecopy</name> <range><le>0.13.4_1</le></range>
+ </package>
+ </affects> <description>
+ <body xmlns="http://www.w3.org/1999/xhtml">
+ <p>Greuff reports that the neon WebDAV client library
+ contains
+ several format string bugs within error reporting code.
+ A malicious server may exploit these bugs by sending
+ specially crafted PROPFIND or PROPPATCH responses.</p>
+ <p>Although several applications include neon, such as
+ cadaver and
+ subversion, the FreeBSD Ports of these applications are
+ not impacted. They are specifically configured to NOT
+ use the included neon. Only packages listed as affected
+ in this notice are believed to be impacted.</p>
+ </body>
+ </description> <references>
<cvename>CVE-2004-0179</cvename>
<url>http://www.webdav.org/neon/</url>
<url>http://secunia.com/advisories/11785</url>
- </references>
- <dates>
- <discovery>2004-04-14</discovery>
- <entry>2004-04-15</entry>
+ </references> <dates>
+ <discovery>2004-04-14</discovery> <entry>2004-04-15</entry>
<modified>2004-06-25</modified>
</dates>
</vuln>
@@ -18838,40 +15465,33 @@ http_access deny Gopher</pre>
<topic>Gallery 1.4.3 and ealier user authentication bypass</topic>
<affects>
<package>
- <name>gallery</name>
- <range><lt>1.4.3.2</lt></range>
+ <name>gallery</name> <range><lt>1.4.3.2</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A flaw exists in Gallery versions previous to
- 1.4.3-pl1 and post 1.2 which may give an attacker
- the potential to log in under the "admin" account.
- Data outside of the gallery is unaffected and the
- attacker cannot modify any data other than the
- photos or photo albums.</p>
+ 1.4.3-pl1 and post 1.2 which may give an attacker the
+ potential to log in under the "admin" account. Data
+ outside of the gallery is unaffected and the attacker
+ cannot modify any data other than the photos or photo
+ albums.</p>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2004-0522</cvename>
<url>http://gallery.menalto.com/modules.php?op=modload&amp;name=News&amp;file=article&amp;sid=123</url>
<url>http://secunia.com/advisories/11752</url>
- </references>
- <dates>
- <discovery>2004-06-01</discovery>
- <entry>2004-06-24</entry>
+ </references> <dates>
+ <discovery>2004-06-01</discovery> <entry>2004-06-24</entry>
</dates>
</vuln>
<vuln vid="0c6f3fde-9c51-11d8-9366-0020ed76ef5a">
- <topic>Midnight Commander buffer overflows, format string bugs, and insecure temporary file handling</topic>
- <affects>
+ <topic>Midnight Commander buffer overflows, format string bugs,
+ and insecure temporary file handling</topic> <affects>
<package>
- <name>mc</name>
- <range><lt>4.6.0_10</lt></range>
+ <name>mc</name> <range><lt>4.6.0_10</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jakub Jelinek reports several security related bugs in
Midnight Commander, including:</p>
@@ -18881,15 +15501,11 @@ http_access deny Gopher</pre>
<li>Format string bug (CVE-2004-0232)</li>
</ul>
</body>
- </description>
- <references>
- <cvename>CVE-2004-0226</cvename>
- <cvename>CVE-2004-0231</cvename>
+ </description> <references>
+ <cvename>CVE-2004-0226</cvename> <cvename>CVE-2004-0231</cvename>
<cvename>CVE-2004-0232</cvename>
- </references>
- <dates>
- <discovery>2004-04-29</discovery>
- <entry>2004-05-02</entry>
+ </references> <dates>
+ <discovery>2004-04-29</discovery> <entry>2004-05-02</entry>
<modified>2004-06-14</modified>
</dates>
</vuln>
@@ -18898,55 +15514,43 @@ http_access deny Gopher</pre>
<topic>Buffer overflow in Squid NTLM authentication helper</topic>
<affects>
<package>
- <name>squid</name>
- <range><lt>2.5.5_9</lt></range>
+ <name>squid</name> <range><lt>2.5.5_9</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>Remote exploitation of a buffer overflow vulnerability in
+ <p>Remote exploitation of a buffer overflow vulnerability
+ in
the NTLM authentication helper routine of the Squid Web
Proxy Cache could allow a remote attacker to execute
arbitrary code. A remote attacker can compromise a target
system if the Squid Proxy is configured to use the NTLM
- authentication helper. The attacker can send an overly long
- password to overflow the buffer and execute arbitrary
+ authentication helper. The attacker can send an overly
+ long password to overflow the buffer and execute arbitrary
code.</p>
</body>
- </description>
- <references>
+ </description> <references>
<url>http://www.idefense.com/application/poi/display?id=107&amp;type=vulnerabilities&amp;flashstatus=false</url>
- <cvename>CVE-2004-0541</cvename>
- <url>http://www.osvdb.org/6791</url>
- <url>http://secunia.com/advisories/11804</url>
- <bid>10500</bid>
+ <cvename>CVE-2004-0541</cvename> <url>http://www.osvdb.org/6791</url>
+ <url>http://secunia.com/advisories/11804</url> <bid>10500</bid>
<url>http://www.squid-cache.org/bugs/show_bug.cgi?id=998</url>
- </references>
- <dates>
- <discovery>2004-05-20</discovery>
- <entry>2004-06-09</entry>
+ </references> <dates>
+ <discovery>2004-05-20</discovery> <entry>2004-06-09</entry>
</dates>
</vuln>
<vuln vid="27c331d5-64c7-11d8-80e3-0020ed76ef5a">
- <topic>Vulnerabilities in H.323 implementations</topic>
- <affects>
- <package>
- <name>pwlib</name>
- <range><lt>1.5.0_5</lt></range>
- </package>
+ <topic>Vulnerabilities in H.323 implementations</topic> <affects>
<package>
- <name>asterisk</name>
- <range><le>0.7.2</le></range>
+ <name>pwlib</name> <range><lt>1.5.0_5</lt></range>
+ </package> <package>
+ <name>asterisk</name> <range><le>0.7.2</le></range>
+ </package> <package>
+ <name>openh323</name> <range><lt>1.12.0_4</lt></range>
</package>
- <package>
- <name>openh323</name>
- <range><lt>1.12.0_4</lt></range>
- </package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>The <a href="http://www.niscc.gov.uk/">NISCC</a> and the <a href="http://www.ee.oulu.fi/research/ouspg/">OUSPG</a>
+ <p>The <a href="http://www.niscc.gov.uk/">NISCC</a> and the
+ <a href="http://www.ee.oulu.fi/research/ouspg/">OUSPG</a>
developed a test suite for the H.323 protocol. This test
suite has uncovered vulnerabilities in several H.323
implementations with impacts ranging from denial-of-service
@@ -18956,20 +15560,15 @@ http_access deny Gopher</pre>
`openh323' incorporate `pwlib' statically and so are also
independently affected.</p>
</body>
- </description>
- <references>
+ </description> <references>
<!-- General references -->
<url>http://www.uniras.gov.uk/vuls/2004/006489/h323.htm</url>
<url>http://www.ee.oulu.fi/research/ouspg/protos/testing/c07/h2250v4/index.html</url>
- <certsa>CA-2004-01</certsa>
- <certvu>749342</certvu>
- <!-- pwlib and pwlib-using applications -->
- <cvename>CVE-2004-0097</cvename>
+ <certsa>CA-2004-01</certsa> <certvu>749342</certvu> <!-- pwlib
+ and pwlib-using applications --> <cvename>CVE-2004-0097</cvename>
<url>http://www.southeren.com/blog/archives/000055.html</url>
- </references>
- <dates>
- <discovery>2004-01-13</discovery>
- <entry>2004-02-22</entry>
+ </references> <dates>
+ <discovery>2004-01-13</discovery> <entry>2004-02-22</entry>
<modified>2004-06-08</modified>
</dates>
</vuln>
@@ -18978,16 +15577,15 @@ http_access deny Gopher</pre>
<topic>jailed processes can manipulate host routing tables</topic>
<affects>
<system>
- <name>FreeBSD</name>
- <range><ge>4.9</ge><lt>4.9_10</lt></range>
+ <name>FreeBSD</name> <range><ge>4.9</ge><lt>4.9_10</lt></range>
<range><ge>4.8</ge><lt>4.8_23</lt></range>
</system>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>A programming error resulting in a failure to verify that
- an attempt to manipulate routing tables originated from a
- non-jailed process.</p>
+ <p>A programming error resulting in a failure to verify
+ that
+ an attempt to manipulate routing tables originated from
+ a non-jailed process.</p>
<p>Jailed processes running with superuser privileges could
modify host routing tables. This could result in a variety
@@ -18995,14 +15593,11 @@ http_access deny Gopher</pre>
incorrect network interface and packets being discarded
entirely.</p>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2004-0125</cvename>
<freebsdsa>SA-04:12.jailroute</freebsdsa>
- </references>
- <dates>
- <discovery>2004-02-03</discovery>
- <entry>2004-06-07</entry>
+ </references> <dates>
+ <discovery>2004-02-03</discovery> <entry>2004-06-07</entry>
</dates>
</vuln>
@@ -19010,123 +15605,111 @@ http_access deny Gopher</pre>
<topic>buffer cache invalidation implementation issues</topic>
<affects>
<system>
- <name>FreeBSD</name>
- <range><ge>5.0</ge><lt>5.2_8</lt></range>
+ <name>FreeBSD</name> <range><ge>5.0</ge><lt>5.2_8</lt></range>
<range><ge>4.9</ge><lt>4.9_9</lt></range>
<range><ge>4.0</ge><lt>4.8_22</lt></range>
</system>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Programming errors in the implementation of the msync(2)
- system call involving the MS_INVALIDATE operation lead to
- cache consistency problems between the virtual memory system
- and on-disk contents.</p>
+ system call involving the MS_INVALIDATE operation lead
+ to cache consistency problems between the virtual memory
+ system and on-disk contents.</p>
- <p>In some situations, a user with read access to a file may
+ <p>In some situations, a user with read access to a file
+ may
be able to prevent changes to that file from being committed
to disk.</p>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2004-0435</cvename>
<freebsdsa>SA-04:11.msync</freebsdsa>
- </references>
- <dates>
- <discovery>2004-04-24</discovery>
- <entry>2004-05-26</entry>
+ </references> <dates>
+ <discovery>2004-04-24</discovery> <entry>2004-05-26</entry>
</dates>
</vuln>
<vuln vid="f7a3b18c-624c-4703-9756-b6b27429e5b0">
- <topic>leafnode denial-of-service triggered by article request</topic>
- <affects>
+ <topic>leafnode denial-of-service triggered by article
+ request</topic> <affects>
<package>
- <name>leafnode</name>
- <range><ge>1.9.20</ge><lt>1.9.30</lt></range>
+ <name>leafnode</name> <range><ge>1.9.20</ge><lt>1.9.30</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>The leafnode NNTP server may go into an unterminated loop with 100%
- CPU use when an article is requested by Message-ID that has been
- crossposted to several news groups when one of the group names is the
- prefix of another group name that the article was cross-posted
- to. Found by Jan Knutar.</p>
+ <p>The leafnode NNTP server may go into an unterminated
+ loop with 100%
+ CPU use when an article is requested by Message-ID that
+ has been crossposted to several news groups when one of
+ the group names is the prefix of another group name that
+ the article was cross-posted to. Found by Jan Knutar.</p>
</body>
- </description>
- <references>
+ </description> <references>
<url>http://leafnode.sourceforge.net/leafnode-SA-2002-01.txt</url>
- <cvename>CVE-2002-1661</cvename>
- <mlist msgid="20021229205023.GA5216@merlin.emma.line.org">http://sourceforge.net/mailarchive/message.php?msg_id=2796226</mlist>
- <mlist msgid="20021229205023.GA5216@merlin.emma.line.org">http://article.gmane.org/gmane.network.leafnode.announce/8</mlist>
- <bid>6490</bid>
- <freebsdpr>ports/46613</freebsdpr>
- </references>
- <dates>
- <discovery>2002-11-06</discovery>
- <entry>2004-05-21</entry>
+ <cvename>CVE-2002-1661</cvename> <mlist
+ msgid="20021229205023.GA5216@merlin.emma.line.org">http://sourceforge.net/mailarchive/message.php?msg_id=2796226</mlist>
+ <mlist
+ msgid="20021229205023.GA5216@merlin.emma.line.org">http://article.gmane.org/gmane.network.leafnode.announce/8</mlist>
+ <bid>6490</bid> <freebsdpr>ports/46613</freebsdpr>
+ </references> <dates>
+ <discovery>2002-11-06</discovery> <entry>2004-05-21</entry>
<modified>2005-05-13</modified>
</dates>
</vuln>
<vuln vid="7b0208ff-3f65-4e16-8d4d-48fd9851f085">
- <topic>leafnode fetchnews denial-of-service triggered by missing header</topic>
- <affects>
+ <topic>leafnode fetchnews denial-of-service triggered by missing
+ header</topic> <affects>
<package>
- <name>leafnode</name>
- <range><ge>1.9.3</ge><le>1.9.41</le></range>
+ <name>leafnode</name> <range><ge>1.9.3</ge><le>1.9.41</le></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>Fetchnews could hang when a news article to be downloaded lacked one
+ <p>Fetchnews could hang when a news article to be downloaded
+ lacked one
of the mandatory headers. Found by Joshua Crawford.</p>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2003-0744</cvename>
<url>http://leafnode.sourceforge.net/leafnode-SA-2003-01.txt</url>
- <mlist msgid="20030904011904.GB12350@merlin.emma.line.org">http://sourceforge.net/mailarchive/message.php?msg_id=5975563</mlist>
- <mlist msgid="20030904011904.GB12350@merlin.emma.line.org">http://article.gmane.org/gmane.network.leafnode.announce/21</mlist>
- <bid>8541</bid>
- <freebsdpr>ports/53838</freebsdpr>
- </references>
- <dates>
- <discovery>2003-06-20</discovery>
- <entry>2004-05-21</entry>
+ <mlist
+ msgid="20030904011904.GB12350@merlin.emma.line.org">http://sourceforge.net/mailarchive/message.php?msg_id=5975563</mlist>
+ <mlist
+ msgid="20030904011904.GB12350@merlin.emma.line.org">http://article.gmane.org/gmane.network.leafnode.announce/21</mlist>
+ <bid>8541</bid> <freebsdpr>ports/53838</freebsdpr>
+ </references> <dates>
+ <discovery>2003-06-20</discovery> <entry>2004-05-21</entry>
<modified>2005-05-13</modified>
</dates>
</vuln>
<vuln vid="a051a4ec-3aa1-4dd1-9bdc-a61eb5700153">
- <topic>leafnode fetchnews denial-of-service triggered by truncated transmission</topic>
- <affects>
+ <topic>leafnode fetchnews denial-of-service triggered by truncated
+ transmission</topic> <affects>
<package>
- <name>leafnode</name>
- <range><le>1.9.47</le></range>
+ <name>leafnode</name> <range><le>1.9.47</le></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>When a downloaded news article ends prematurely, i. e. when the
- server sends [CR]LF.[CR]LF before sending a blank line, fetchnews may
- wait indefinitely for data that never arrives. Workaround: configure
- "minlines=1" (or use a bigger value) in the configuration file. Found
- by Toni Viemerö.</p>
+ <p>When a downloaded news article ends prematurely, i. e.
+ when the
+ server sends [CR]LF.[CR]LF before sending a blank line,
+ fetchnews may wait indefinitely for data that never
+ arrives. Workaround: configure "minlines=1" (or use a
+ bigger value) in the configuration file. Found by Toni
+ Viemerö.</p>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2004-2068</cvename>
<url>http://leafnode.sourceforge.net/leafnode-SA-2004-01.txt</url>
<url>http://sourceforge.net/tracker/index.php?func=detail&amp;aid=873149&amp;group_id=57767&amp;atid=485349</url>
- <mlist msgid="20040109015625.GA12319@merlin.emma.line.org">http://article.gmane.org/gmane.network.leafnode.announce/32</mlist>
- <mlist msgid="20040109015625.GA12319@merlin.emma.line.org">http://sourceforge.net/mailarchive/message.php?msg_id=6922570</mlist>
+ <mlist
+ msgid="20040109015625.GA12319@merlin.emma.line.org">http://article.gmane.org/gmane.network.leafnode.announce/32</mlist>
+ <mlist
+ msgid="20040109015625.GA12319@merlin.emma.line.org">http://sourceforge.net/mailarchive/message.php?msg_id=6922570</mlist>
<freebsdpr>ports/61105</freebsdpr>
- </references>
- <dates>
- <discovery>2004-01-08</discovery>
- <entry>2004-05-21</entry>
+ </references> <dates>
+ <discovery>2004-01-08</discovery> <entry>2004-05-21</entry>
<modified>2005-05-13</modified>
</dates>
</vuln>
@@ -19140,127 +15723,104 @@ http_access deny Gopher</pre>
<range><ge>4.1</ge><lt>4.1.1_2</lt></range>
<range><ge>5.0</ge><lt>5.0.0_2</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Shaun Colley reports that the script `mysqlbug' included
with MySQL sometimes creates temporary files in an unsafe
- manner. As a result, an attacker may create a symlink in
- /tmp so that if another user invokes `mysqlbug' and <em>quits
- without making <strong>any</strong> changes</em>, an
- arbitrary file may be overwritten with the bug report
+ manner. As a result, an attacker may create a symlink
+ in /tmp so that if another user invokes `mysqlbug' and
+ <em>quits without making <strong>any</strong> changes</em>,
+ an arbitrary file may be overwritten with the bug report
template.</p>
</body>
- </description>
- <references>
+ </description> <references>
<mlist>http://marc.theaimsgroup.com/?l=bugtraq&amp;m=108023246916294&amp;w=2</mlist>
- <url>http://bugs.mysql.com/bug.php?id=3284</url>
- <bid>9976</bid>
+ <url>http://bugs.mysql.com/bug.php?id=3284</url> <bid>9976</bid>
<cvename>CVE-2004-0381</cvename>
- </references>
- <dates>
- <discovery>2004-03-25</discovery>
- <entry>2004-04-16</entry>
+ </references> <dates>
+ <discovery>2004-03-25</discovery> <entry>2004-04-16</entry>
<modified>2004-05-21</modified>
</dates>
</vuln>
<vuln vid="5d36ef32-a9cf-11d8-9c6d-0020ed76ef5a">
- <topic>subversion date parsing vulnerability</topic>
- <affects>
+ <topic>subversion date parsing vulnerability</topic> <affects>
<package>
- <name>subversion</name>
- <range><lt>1.0.2_1</lt></range>
+ <name>subversion</name> <range><lt>1.0.2_1</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>Stefan Esser reports:</p>
- <blockquote cite="http://security.e-matters.de/advisories/082004.html">
- <p>Subversion versions up to 1.0.2 are vulnerable to a date
- parsing vulnerability which can be abused to allow remote
- code execution on Subversion servers and therefore could
- lead to a repository compromise.</p>
- </blockquote>
- <p><em>NOTE:</em> This vulnerability is similar to the date
- parsing issue that affected neon. However, it is a different
- and distinct bug.</p>
+ <p>Stefan Esser reports:</p> <blockquote
+ cite="http://security.e-matters.de/advisories/082004.html">
+ <p>Subversion versions up to 1.0.2 are vulnerable to a
+ date
+ parsing vulnerability which can be abused to allow
+ remote code execution on Subversion servers and therefore
+ could lead to a repository compromise.</p>
+ </blockquote> <p><em>NOTE:</em> This vulnerability is similar
+ to the date
+ parsing issue that affected neon. However, it is a
+ different and distinct bug.</p>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2004-0397</cvename>
<url>http://security.e-matters.de/advisories/082004.html</url>
- </references>
- <dates>
- <discovery>2004-05-19</discovery>
- <entry>2004-05-19</entry>
+ </references> <dates>
+ <discovery>2004-05-19</discovery> <entry>2004-05-19</entry>
</dates>
</vuln>
<vuln vid="f93be979-a992-11d8-aecc-000d610a3b12">
- <topic>cvs pserver remote heap buffer overflow</topic>
- <affects>
+ <topic>cvs pserver remote heap buffer overflow</topic> <affects>
<system>
- <name>FreeBSD</name>
- <range><ge>5.2</ge><lt>5.2_7</lt></range>
+ <name>FreeBSD</name> <range><ge>5.2</ge><lt>5.2_7</lt></range>
<range><ge>5.1</ge><lt>5.1_17</lt></range>
<range><ge>5.0</ge><lt>5.0_21</lt></range>
<range><ge>4.9</ge><lt>4.9_8</lt></range>
<range><ge>4.8</ge><lt>4.8_21</lt></range>
<range><ge>4.0</ge><lt>4.7_27</lt></range>
</system>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Due to a programming error in code used to parse data
received from the client, malformed data can cause a heap
buffer to overflow, allowing the client to overwrite
arbitrary portions of the server's memory.</p>
<p>A malicious CVS client can exploit this to run arbitrary
- code on the server at the privilege level of the CVS server
- software.</p>
+ code on the server at the privilege level of the CVS
+ server software.</p>
</body>
- </description>
- <references>
- <cvename>CVE-2004-0396</cvename>
- <freebsdsa>SA-04:10.cvs</freebsdsa>
- </references>
- <dates>
- <discovery>2004-05-02</discovery>
- <entry>2004-05-19</entry>
+ </description> <references>
+ <cvename>CVE-2004-0396</cvename> <freebsdsa>SA-04:10.cvs</freebsdsa>
+ </references> <dates>
+ <discovery>2004-05-02</discovery> <entry>2004-05-19</entry>
</dates>
</vuln>
<vuln vid="492f8896-70fa-11d8-873f-0020ed76ef5a">
- <topic>Apache 2 mod_ssl denial-of-service</topic>
- <affects>
+ <topic>Apache 2 mod_ssl denial-of-service</topic> <affects>
<package>
- <name>apache</name>
- <range><ge>2.0</ge><le>2.0.48_3</le></range>
+ <name>apache</name> <range><ge>2.0</ge><le>2.0.48_3</le></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Joe Orton reports a memory leak in Apache 2's mod_ssl.
A remote attacker may issue HTTP requests on an HTTPS
port, causing an error. Due to a bug in processing this
- condition, memory associated with the connection is
- not freed. Repeated requests can result in consuming
- all available memory resources, probably resulting in
- termination of the Apache process.</p>
+ condition, memory associated with the connection is not
+ freed. Repeated requests can result in consuming all
+ available memory resources, probably resulting in termination
+ of the Apache process.</p>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2004-0113</cvename>
<url>http://www.apacheweek.com/features/security-20</url>
<url>http://cvs.apache.org/viewcvs.cgi/httpd-2.0/modules/ssl/ssl_engine_io.c?r1=1.100.2.11&amp;r2=1.100.2.12</url>
<mlist>http://marc.theaimsgroup.com/?l=apache-cvs&amp;m=107869699329638</mlist>
<url>http://nagoya.apache.org/bugzilla/show_bug.cgi?id=27106</url>
<bid>9826</bid>
- </references>
- <dates>
- <discovery>2004-02-20</discovery>
- <entry>2004-03-08</entry>
+ </references> <dates>
+ <discovery>2004-02-20</discovery> <entry>2004-03-08</entry>
<modified>2004-05-19</modified>
</dates>
</vuln>
@@ -19269,72 +15829,60 @@ http_access deny Gopher</pre>
<topic>URI handler vulnerabilities in several browsers</topic>
<affects>
<package>
- <name>linux-opera</name>
- <name>opera</name>
+ <name>linux-opera</name> <name>opera</name>
<range><lt>7.50</lt></range>
+ </package> <package>
+ <name>kdelibs</name> <range><lt>3.2.2_3</lt></range>
</package>
- <package>
- <name>kdelibs</name>
- <range><lt>3.2.2_3</lt></range>
- </package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>Karol Wiesek and Greg MacManus reported via iDEFENSE that the
+ <p>Karol Wiesek and Greg MacManus reported via iDEFENSE
+ that the
Opera web browser contains a flaw in the handling of
certain URIs. When presented with these URIs, Opera would
invoke external commands to process them after some
validation. However, if the hostname component of a URI
- begins with a `-', it may be treated as an option by an external
- command. This could have undesirable side-effects, from
- denial-of-service to code execution. The impact is very
- dependent on local configuration.</p>
+ begins with a `-', it may be treated as an option by an
+ external command. This could have undesirable side-effects,
+ from denial-of-service to code execution. The impact is
+ very dependent on local configuration.</p>
<p>After the iDEFENSE advisory was published, the KDE team
discovered similar problems in KDE's URI handlers.</p>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2004-0411</cvename>
<url>http://www.idefense.com/application/poi/display?id=104&amp;type=vulnerabilities</url>
<url>http://www.kde.org/info/security/advisory-20040517-1.txt</url>
<url>http://freebsd.kde.org/index.php#n20040517</url>
- </references>
- <dates>
- <discovery>2004-05-12</discovery>
- <entry>2004-05-18</entry>
+ </references> <dates>
+ <discovery>2004-05-12</discovery> <entry>2004-05-18</entry>
</dates>
</vuln>
<vuln vid="20be2982-4aae-11d8-96f2-0020ed76ef5a">
- <topic>fsp buffer overflow and directory traversal vulnerabilities</topic>
- <affects>
+ <topic>fsp buffer overflow and directory traversal
+ vulnerabilities</topic> <affects>
<package>
- <name>fspd</name>
- <range><lt>2.8.1.19</lt></range>
+ <name>fspd</name> <range><lt>2.8.1.19</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The <a href="http://www.debian.org/security">Debian
security team</a> reported a pair of vulnerabilities in
- fsp:</p>
- <blockquote cite="http://www.debian.org/security/2004/dsa-416">
+ fsp:</p> <blockquote
+ cite="http://www.debian.org/security/2004/dsa-416">
<p>A vulnerability was discovered in fsp, client utilities
- for File Service Protocol (FSP), whereby a remote user could
- both escape from the FSP root directory (CAN-2003-1022), and
- also overflow a fixed-length buffer to execute arbitrary
+ for File Service Protocol (FSP), whereby a remote user
+ could both escape from the FSP root directory (CAN-2003-1022),
+ and also overflow a fixed-length buffer to execute arbitrary
code (CAN-2004-0011).</p>
</blockquote>
</body>
- </description>
- <references>
- <cvename>CVE-2003-1022</cvename>
- <cvename>CVE-2004-0011</cvename>
+ </description> <references>
+ <cvename>CVE-2003-1022</cvename> <cvename>CVE-2004-0011</cvename>
<url>http://www.debian.org/security/2004/dsa-416</url>
- </references>
- <dates>
- <discovery>2004-01-06</discovery>
- <entry>2004-01-19</entry>
+ </references> <dates>
+ <discovery>2004-01-06</discovery> <entry>2004-01-19</entry>
<modified>2004-05-17</modified>
</dates>
</vuln>
@@ -19346,103 +15894,83 @@ http_access deny Gopher</pre>
<name>proftpd</name>
<range><ge>1.2.9</ge><lt>1.2.10.r1</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jindrich Makovicka reports a regression in proftpd's
- handling of IP address access control lists (IP ACLs). Due
- to this regression, some IP ACLs are treated as ``allow
+ handling of IP address access control lists (IP ACLs).
+ Due to this regression, some IP ACLs are treated as ``allow
all''.</p>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2004-0432</cvename>
<url>http://bugs.proftpd.org/show_bug.cgi?id=2267</url>
- </references>
- <dates>
- <discovery>2003-11-04</discovery>
- <entry>2004-05-02</entry>
+ </references> <dates>
+ <discovery>2003-11-04</discovery> <entry>2004-05-02</entry>
<modified>2004-05-15</modified>
</dates>
</vuln>
<vuln vid="fde53204-7ea6-11d8-9645-0020ed76ef5a">
- <topic>insecure temporary file creation in xine-check, xine-bugreport</topic>
- <affects>
+ <topic>insecure temporary file creation in xine-check,
+ xine-bugreport</topic> <affects>
<package>
- <name>xine</name>
- <range><lt>0.9.23_3</lt></range>
+ <name>xine</name> <range><lt>0.9.23_3</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Some scripts installed with xine create temporary files
- insecurely. It is recommended that these scripts (xine-check,
- xine-bugreport) not be used. They are not needed for normal
- operation.</p>
+ insecurely. It is recommended that these scripts
+ (xine-check, xine-bugreport) not be used. They are not
+ needed for normal operation.</p>
</body>
- </description>
- <references>
+ </description> <references>
<mlist>http://marc.theaimsgroup.com/?l=bugtraq&amp;m=107997911025558</mlist>
<bid>9939</bid>
- </references>
- <dates>
- <discovery>2004-03-20</discovery>
- <entry>2004-03-26</entry>
+ </references> <dates>
+ <discovery>2004-03-20</discovery> <entry>2004-03-26</entry>
<modified>2004-05-09</modified>
</dates>
</vuln>
<vuln vid="5f29c2e4-9f6a-11d8-abbc-00e08110b673">
- <topic>exim buffer overflow when verify = header_syntax is used</topic>
- <affects>
+ <topic>exim buffer overflow when verify = header_syntax is
+ used</topic> <affects>
<package>
- <name>exim</name>
- <name>exim-ldap2</name>
- <name>exim-mysql</name>
- <name>exim-postgresql</name>
- <range><lt>4.33+20_1</lt></range>
+ <name>exim</name> <name>exim-ldap2</name> <name>exim-mysql</name>
+ <name>exim-postgresql</name> <range><lt>4.33+20_1</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A remote exploitable buffer overflow has been discovered
in exim when verify = header_syntax is used in the
configuration file. This does not affect the default
configuration.</p>
</body>
- </description>
- <references>
+ </description> <references>
<url>http://www.guninski.com/exim1.html</url>
<cvename>CVE-2004-0400</cvename>
- </references>
- <dates>
- <discovery>2004-05-06</discovery>
- <entry>2004-05-06</entry>
+ </references> <dates>
+ <discovery>2004-05-06</discovery> <entry>2004-05-06</entry>
</dates>
</vuln>
<vuln vid="a56a72bb-9f72-11d8-9585-0020ed76ef5a">
- <topic>phpBB session table exhaustion</topic>
- <affects>
+ <topic>phpBB session table exhaustion</topic> <affects>
<package>
- <name>phpbb</name>
- <range><le>2.0.8_2</le></range>
+ <name>phpbb</name> <range><le>2.0.8_2</le></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>The includes/sessions.php unnecessarily adds session item into
+ <p>The includes/sessions.php unnecessarily adds session
+ item into
session table and therefore vulnerable to a denial-of-service
attack.</p>
</body>
- </description>
- <references>
- <mlist msgid="20040421011055.GA1448@frontfree.net">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=108256462710010</mlist>
- </references>
- <dates>
- <discovery>2004-03-05</discovery>
- <entry>2004-05-06</entry>
+ </description> <references>
+ <mlist
+ msgid="20040421011055.GA1448@frontfree.net">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=108256462710010</mlist>
+ </references> <dates>
+ <discovery>2004-03-05</discovery> <entry>2004-05-06</entry>
</dates>
</vuln>
@@ -19450,62 +15978,51 @@ http_access deny Gopher</pre>
<topic>heimdal kadmind remote heap buffer overflow</topic>
<affects>
<package>
- <name>heimdal</name>
- <range><lt>0.6.1_1</lt></range>
- </package>
- <system>
- <name>FreeBSD</name>
- <range><ge>4.9</ge><lt>4.9_7</lt></range>
+ <name>heimdal</name> <range><lt>0.6.1_1</lt></range>
+ </package> <system>
+ <name>FreeBSD</name> <range><ge>4.9</ge><lt>4.9_7</lt></range>
<range><ge>4.0</ge><lt>4.8_20</lt></range>
</system>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>An input validation error was discovered in the kadmind
code that handles the framing of Kerberos 4 compatibility
administration requests. The code assumed that the length
given in the framing was always two or more bytes. Smaller
- lengths will cause kadmind to read an arbitrary amount of
- data into a minimally-sized buffer on the heap.</p>
+ lengths will cause kadmind to read an arbitrary amount
+ of data into a minimally-sized buffer on the heap.</p>
<p>A remote attacker may send a specially formatted message
to kadmind, causing it to crash or possibly resulting in
arbitrary code execution.</p>
<p>The kadmind daemon is part of Kerberos 5 support. However,
this bug will only be present if kadmind was built with
- additional Kerberos 4 support. Thus, only systems that have
- *both* Heimdal Kerberos 5 and Kerberos 4 installed might
- be affected.</p>
+ additional Kerberos 4 support. Thus, only systems that
+ have *both* Heimdal Kerberos 5 and Kerberos 4 installed
+ might be affected.</p>
<p><em>NOTE:</em> On FreeBSD 4 systems, `kadmind' may be
installed as `k5admind'.</p>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2004-0434</cvename>
<freebsdsa>SA-04:09.kadmind</freebsdsa>
- </references>
- <dates>
- <discovery>2004-05-05</discovery>
- <entry>2004-05-05</entry>
+ </references> <dates>
+ <discovery>2004-05-05</discovery> <entry>2004-05-05</entry>
</dates>
</vuln>
<vuln vid="0792e7a7-8e37-11d8-90d1-0020ed76ef5a">
- <topic>CVS path validation errors</topic>
- <affects>
+ <topic>CVS path validation errors</topic> <affects>
<package>
- <name>cvs+ipv6</name>
- <range><le>1.11.5_1</le></range>
- </package>
- <system>
- <name>FreeBSD</name>
- <range><ge>5.2</ge><lt>5.2.1_5</lt></range>
+ <name>cvs+ipv6</name> <range><le>1.11.5_1</le></range>
+ </package> <system>
+ <name>FreeBSD</name> <range><ge>5.2</ge><lt>5.2.1_5</lt></range>
<range><ge>4.9</ge><lt>4.9_5</lt></range>
<range><ge>4.8</ge><lt>4.8_18</lt></range>
</system>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>Two programming errors were discovered in which path names
+ <p>Two programming errors were discovered in which path
+ names
handled by CVS were not properly validated. In one case,
the CVS client accepts absolute path names from the server
when determining which files to update. In another case,
@@ -19521,41 +16038,35 @@ http_access deny Gopher</pre>
These RCS files need not be part of any CVS repository
themselves.</p>
</body>
- </description>
- <references>
- <cvename>CVE-2004-0180</cvename>
- <cvename>CVE-2004-0405</cvename>
+ </description> <references>
+ <cvename>CVE-2004-0180</cvename> <cvename>CVE-2004-0405</cvename>
<url>http://ccvs.cvshome.org/servlets/NewsItemView?newsID=102</url>
<freebsdsa>SA-04:07.cvs</freebsdsa>
- </references>
- <dates>
- <discovery>2004-04-14</discovery>
- <entry>2004-04-14</entry>
+ </references> <dates>
+ <discovery>2004-04-14</discovery> <entry>2004-04-14</entry>
<modified>2004-05-05</modified>
</dates>
</vuln>
<vuln vid="7229d900-88af-11d8-90d1-0020ed76ef5a">
- <topic>mksnap_ffs clears file system options</topic>
- <affects>
+ <topic>mksnap_ffs clears file system options</topic> <affects>
<system>
- <name>FreeBSD</name>
- <range><ge>5.2</ge><lt>5.2_1</lt></range>
+ <name>FreeBSD</name> <range><ge>5.2</ge><lt>5.2_1</lt></range>
<range><ge>5.1</ge><lt>5.1_12</lt></range>
</system>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The kernel interface for creating a snapshot of a
filesystem is the same as that for changing the flags on
- that filesystem. Due to an oversight, the <a href="http://www.freebsd.org/cgi/man.cgi?query=mksnap_ffs">mksnap_ffs(8)</a>
+ that filesystem. Due to an oversight, the <a
+ href="http://www.freebsd.org/cgi/man.cgi?query=mksnap_ffs">mksnap_ffs(8)</a>
command called that interface with only the snapshot flag
set, causing all other flags to be reset to the default
value.</p>
<p>A regularly scheduled backup of a live filesystem, or
- any other process that uses the mksnap_ffs command
- (for instance, to provide a rough undelete functionality
- on a file server), will clear any flags in effect on the
+ any other process that uses the mksnap_ffs command (for
+ instance, to provide a rough undelete functionality on a
+ file server), will clear any flags in effect on the
filesystem being snapshot. Possible consequences depend
on local usage, but can include disabling extended access
control lists or enabling the use of setuid executables
@@ -19563,40 +16074,36 @@ http_access deny Gopher</pre>
<p>The mksnap_ffs command is normally only available to
the superuser and members of the `operator' group. There
is therefore no risk of a user gaining elevated privileges
- directly through use of the mksnap_ffs command unless
- it has been intentionally made available to unprivileged
+ directly through use of the mksnap_ffs command unless it
+ has been intentionally made available to unprivileged
users.</p>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2004-0099</cvename>
<freebsdsa>SA-04:01.mksnap_ffs</freebsdsa>
- </references>
- <dates>
- <discovery>2004-01-30</discovery>
- <entry>2004-04-07</entry>
+ </references> <dates>
+ <discovery>2004-01-30</discovery> <entry>2004-04-07</entry>
<modified>2004-05-05</modified>
</dates>
</vuln>
<vuln vid="f95a9005-88ae-11d8-90d1-0020ed76ef5a">
- <topic>shmat reference counting bug</topic>
- <affects>
+ <topic>shmat reference counting bug</topic> <affects>
<system>
- <name>FreeBSD</name>
- <range><ge>5.2</ge><lt>5.2_2</lt></range>
+ <name>FreeBSD</name> <range><ge>5.2</ge><lt>5.2_2</lt></range>
<range><ge>5.1</ge><lt>5.1_14</lt></range>
<range><ge>5.0</ge><lt>5.0_20</lt></range>
<range><ge>4.9</ge><lt>4.9_2</lt></range>
<range><ge>4.8</ge><lt>4.8_15</lt></range>
<range><lt>4.7_25</lt></range>
</system>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>A programming error in the <a href="http://www.freebsd.org/cgi/man.cgi?query=shmat">shmat(2)</a> system call can result
- in a shared memory segment's reference count being erroneously
- incremented.</p>
+ <p>A programming error in the <a
+ href="http://www.freebsd.org/cgi/man.cgi?query=shmat">shmat(2)</a>
+ system call can result
+ in a shared memory segment's reference count being
+ erroneously incremented.</p>
<p>It may be possible to cause a shared memory segment to
reference unallocated kernel memory, but remain valid.
This could allow a local attacker to gain read or write
@@ -19604,15 +16111,12 @@ http_access deny Gopher</pre>
information disclosure, bypass of access control mechanisms,
or privilege escalation. </p>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2004-0114</cvename>
<freebsdsa>SA-04:02.shmat</freebsdsa>
<url>http://www.pine.nl/press/pine-cert-20040201.txt</url>
- </references>
- <dates>
- <discovery>2004-02-01</discovery>
- <entry>2004-04-07</entry>
+ </references> <dates>
+ <discovery>2004-02-01</discovery> <entry>2004-04-07</entry>
<modified>2004-05-05</modified>
</dates>
</vuln>
@@ -19621,14 +16125,13 @@ http_access deny Gopher</pre>
<topic>jailed processes can attach to other jails</topic>
<affects>
<system>
- <name>FreeBSD</name>
- <range><ge>5.1</ge><lt>5.1_14</lt></range>
+ <name>FreeBSD</name> <range><ge>5.1</ge><lt>5.1_14</lt></range>
<range><ge>5.2</ge><lt>5.2.1</lt></range>
</system>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>A programming error has been found in the <a href="http://www.freebsd.org/cgi/man.cgi?query=jail_attach">jail_attach(2)</a>
+ <p>A programming error has been found in the <a
+ href="http://www.freebsd.org/cgi/man.cgi?query=jail_attach">jail_attach(2)</a>
system call which affects the way that system call verifies
the privilege level of the calling process. Instead of
failing immediately if the calling process was already
@@ -19639,14 +16142,10 @@ http_access deny Gopher</pre>
and thus gain full read and write access to files and
directories within the target jail. </p>
</body>
- </description>
- <references>
- <cvename>CVE-2004-0126</cvename>
- <freebsdsa>SA-04:03.jail</freebsdsa>
- </references>
- <dates>
- <discovery>2004-02-19</discovery>
- <entry>2004-04-07</entry>
+ </description> <references>
+ <cvename>CVE-2004-0126</cvename> <freebsdsa>SA-04:03.jail</freebsdsa>
+ </references> <dates>
+ <discovery>2004-02-19</discovery> <entry>2004-04-07</entry>
<modified>2004-05-05</modified>
</dates>
</vuln>
@@ -19655,34 +16154,28 @@ http_access deny Gopher</pre>
<topic>many out-of-sequence TCP packets denial-of-service</topic>
<affects>
<system>
- <name>FreeBSD</name>
- <range><ge>5.2</ge><lt>5.2.1_2</lt></range>
+ <name>FreeBSD</name> <range><ge>5.2</ge><lt>5.2.1_2</lt></range>
<range><ge>5.0</ge><lt>5.1_15</lt></range>
<range><ge>4.9</ge><lt>4.9_3</lt></range>
<range><ge>4.8</ge><lt>4.8_16</lt></range>
<range><lt>4.7_26</lt></range>
</system>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>FreeBSD does not limit the number of TCP segments that
may be held in a reassembly queue. A remote attacker may
- conduct a low-bandwidth denial-of-service attack against
- a machine providing services based on TCP (there are many
+ conduct a low-bandwidth denial-of-service attack against a
+ machine providing services based on TCP (there are many
such services, including HTTP, SMTP, and FTP). By sending
many out-of-sequence TCP segments, the attacker can cause
the target machine to consume all available memory buffers
(``mbufs''), likely leading to a system crash. </p>
</body>
- </description>
- <references>
- <cvename>CVE-2004-0171</cvename>
- <freebsdsa>SA-04:04.tcp</freebsdsa>
+ </description> <references>
+ <cvename>CVE-2004-0171</cvename> <freebsdsa>SA-04:04.tcp</freebsdsa>
<url>http://www.idefense.com/application/poi/display?id=78&amp;type=vulnerabilities</url>
- </references>
- <dates>
- <discovery>2004-02-18</discovery>
- <entry>2004-04-07</entry>
+ </references> <dates>
+ <discovery>2004-02-18</discovery> <entry>2004-04-07</entry>
<modified>2004-05-05</modified>
</dates>
</vuln>
@@ -19691,32 +16184,26 @@ http_access deny Gopher</pre>
<topic>setsockopt(2) IPv6 sockets input validation error</topic>
<affects>
<system>
- <name>FreeBSD</name>
- <range><ge>5.2</ge><lt>5.2.1_4</lt></range>
+ <name>FreeBSD</name> <range><ge>5.2</ge><lt>5.2.1_4</lt></range>
</system>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>From the FreeBSD Security Advisory:</p>
- <blockquote>
+ <p>From the FreeBSD Security Advisory:</p> <blockquote>
<p>A programming error in the handling of some IPv6 socket
- options within the <a href="http://www.freebsd.org/cgi/man.cgi?query=setsockopt">setsockopt(2)</a> system call may result
- in memory locations being accessed without proper
- validation.</p>
+ options within the <a
+ href="http://www.freebsd.org/cgi/man.cgi?query=setsockopt">setsockopt(2)</a>
+ system call may result in memory locations being accessed
+ without proper validation.</p>
<p>It may be possible for a local attacker to read portions
of kernel memory, resulting in disclosure of sensitive
information. A local attacker can cause a system
panic.</p>
</blockquote>
</body>
- </description>
- <references>
- <cvename>CVE-2004-0370</cvename>
- <freebsdsa>SA-04:06.ipv6</freebsdsa>
- </references>
- <dates>
- <discovery>2004-03-29</discovery>
- <entry>2004-03-29</entry>
+ </description> <references>
+ <cvename>CVE-2004-0370</cvename> <freebsdsa>SA-04:06.ipv6</freebsdsa>
+ </references> <dates>
+ <discovery>2004-03-29</discovery> <entry>2004-03-29</entry>
<modified>2004-05-05</modified>
</dates>
</vuln>
@@ -19725,49 +16212,38 @@ http_access deny Gopher</pre>
<topic>OpenSSL ChangeCipherSpec denial-of-service vulnerability</topic>
<affects>
<package>
- <name>openssl</name>
- <name>openssl-beta</name>
+ <name>openssl</name> <name>openssl-beta</name>
<range><lt>0.9.7d</lt></range>
- </package>
- <system>
- <name>FreeBSD</name>
- <range><ge>4.0</ge><lt>4.8_17</lt></range>
+ </package> <system>
+ <name>FreeBSD</name> <range><ge>4.0</ge><lt>4.8_17</lt></range>
<range><ge>4.9</ge><lt>4.9_4</lt></range>
<range><ge>5.0</ge><lt>5.1_16</lt></range>
<range><ge>5.2</ge><lt>5.2.1_3</lt></range>
</system>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>A remote attacker could cause an application using OpenSSL to
+ <p>A remote attacker could cause an application using OpenSSL
+ to
crash by performing a specially crafted SSL/TLS handshake.</p>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2004-0079</cvename>
<url>http://www.openssl.org/news/secadv_20040317.txt</url>
- <freebsdsa>SA-04:05.openssl</freebsdsa>
- <certvu>288574</certvu>
+ <freebsdsa>SA-04:05.openssl</freebsdsa> <certvu>288574</certvu>
<bid>9899</bid>
- </references>
- <dates>
- <discovery>2004-03-17</discovery>
- <entry>2004-03-17</entry>
+ </references> <dates>
+ <discovery>2004-03-17</discovery> <entry>2004-03-17</entry>
<modified>2004-05-05</modified>
</dates>
</vuln>
<vuln vid="f04cc5cb-2d0b-11d8-beaf-000a95c4d922">
- <topic>bind8 negative cache poison attack</topic>
- <affects>
+ <topic>bind8 negative cache poison attack</topic> <affects>
<package>
- <name>bind</name>
- <range><ge>8.3</ge><lt>8.3.7</lt></range>
+ <name>bind</name> <range><ge>8.3</ge><lt>8.3.7</lt></range>
<range><ge>8.4</ge><lt>8.4.3</lt></range>
- </package>
- <system>
- <name>FreeBSD</name>
- <range><ge>5.1</ge><lt>5.1_11</lt></range>
+ </package> <system>
+ <name>FreeBSD</name> <range><ge>5.1</ge><lt>5.1_11</lt></range>
<range><ge>5.0</ge><lt>5.0_19</lt></range>
<range><ge>4.9</ge><lt>4.9_1</lt></range>
<range><ge>4.8</ge><lt>4.8_14</lt></range>
@@ -19776,27 +16252,23 @@ http_access deny Gopher</pre>
<range><ge>4.5</ge><lt>4.5_37</lt></range>
<range><lt>4.4_47</lt></range>
</system>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A programming error in BIND 8 named can result in a DNS
- message being incorrectly cached as a negative response. As
- a result, an attacker may arrange for malicious DNS messages
- to be delivered to a target name server, and cause that name
- server to cache a negative response for some target domain
- name. The name server would thereafter respond negatively
- to legitimate queries for that domain name, resulting in a
- denial-of-service for applications that require DNS.</p>
- </body>
- </description>
- <references>
- <cvename>CVE-2003-0914</cvename>
- <freebsdsa>SA-03:19.bind</freebsdsa>
+ message being incorrectly cached as a negative response.
+ As a result, an attacker may arrange for malicious DNS
+ messages to be delivered to a target name server, and cause
+ that name server to cache a negative response for some
+ target domain name. The name server would thereafter respond
+ negatively to legitimate queries for that domain name,
+ resulting in a denial-of-service for applications that
+ require DNS.</p>
+ </body>
+ </description> <references>
+ <cvename>CVE-2003-0914</cvename> <freebsdsa>SA-03:19.bind</freebsdsa>
<certvu>734644</certvu>
- </references>
- <dates>
- <discovery>2003-11-28</discovery>
- <entry>2003-12-12</entry>
+ </references> <dates>
+ <discovery>2003-11-28</discovery> <entry>2003-12-12</entry>
<modified>2004-05-05</modified>
</dates>
</vuln>
@@ -19805,33 +16277,27 @@ http_access deny Gopher</pre>
<topic>Incorrect cross-realm trust handling in Heimdal</topic>
<affects>
<package>
- <name>heimdal</name>
- <range><lt>0.6.1</lt></range>
- </package>
- <system>
- <name>FreeBSD</name>
- <range><ge>5.0</ge><lt>5.2_6</lt></range>
+ <name>heimdal</name> <range><lt>0.6.1</lt></range>
+ </package> <system>
+ <name>FreeBSD</name> <range><ge>5.0</ge><lt>5.2_6</lt></range>
<range><ge>4.9</ge><lt>4.9_6</lt></range>
<range><ge>4.0</ge><lt>4.8_19</lt></range>
</system>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>Heimdal does not correctly validate the `transited' field of
- Kerberos tickets when computing the authentication path. This
- could allow a rogue KDC with which cross-realm relationships
- have been established to impersonate any KDC in the
- authentication path.</p>
+ <p>Heimdal does not correctly validate the `transited' field
+ of
+ Kerberos tickets when computing the authentication path.
+ This could allow a rogue KDC with which cross-realm
+ relationships have been established to impersonate any
+ KDC in the authentication path.</p>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2004-0371</cvename>
<freebsdsa>SA-04:08.heimdal</freebsdsa>
<url>http://www.pdc.kth.se/heimdal/advisory/2004-04-01/</url>
- </references>
- <dates>
- <discovery>2004-04-01</discovery>
- <entry>2004-04-02</entry>
+ </references> <dates>
+ <discovery>2004-04-01</discovery> <entry>2004-04-02</entry>
<modified>2004-05-05</modified>
</dates>
</vuln>
@@ -19840,28 +16306,22 @@ http_access deny Gopher</pre>
<topic>lha buffer overflows and path traversal issues</topic>
<affects>
<package>
- <name>lha</name>
- <range><lt>1.14i_4</lt></range>
+ <name>lha</name> <range><lt>1.14i_4</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ulf Härnhammar discovered several vulnerabilities in
- LHa for UNIX's path name handling code. Specially constructed
- archive files may cause LHa to overwrite files or
- execute arbitrary code with the privileges of the user
+ LHa for UNIX's path name handling code. Specially
+ constructed archive files may cause LHa to overwrite files
+ or execute arbitrary code with the privileges of the user
invoking LHa. This could be particularly harmful for
- automated systems that might handle archives such as
- virus scanning processes.</p>
+ automated systems that might handle archives such as virus
+ scanning processes.</p>
</body>
- </description>
- <references>
- <cvename>CVE-2004-0234</cvename>
- <cvename>CVE-2004-0235</cvename>
- </references>
- <dates>
- <discovery>2004-04-29</discovery>
- <entry>2004-05-02</entry>
+ </description> <references>
+ <cvename>CVE-2004-0234</cvename> <cvename>CVE-2004-0235</cvename>
+ </references> <dates>
+ <discovery>2004-04-29</discovery> <entry>2004-05-02</entry>
<modified>2004-05-03</modified>
</dates>
</vuln>
@@ -19870,198 +16330,163 @@ http_access deny Gopher</pre>
<topic>xchat remotely exploitable buffer overflow (Socks5)</topic>
<affects>
<package>
- <name>xchat2</name>
- <range><ge>1.8</ge><lt>2.0.8_2</lt></range>
+ <name>xchat2</name> <range><ge>1.8</ge><lt>2.0.8_2</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A straightforward stack buffer overflow exists in XChat's
Socks5 proxy support.</p>
- <p>The XChat developers report that `tsifra' discovered this
+ <p>The XChat developers report that `tsifra' discovered
+ this
issue.</p>
<p>NOTE: XChat Socks5 support is disabled by support in the
FreeBSD Ports Collection.</p>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2004-0409</cvename>
<url>http://xchat.org/files/source/2.0/patches/xc208-fixsocks5.diff</url>
- <mlist msgid="20040405171305.04f19c44.zed@xchat.org">http://marc.theaimsgroup.com/?l=xchat-announce&amp;m=108114935507357</mlist>
- </references>
- <dates>
- <discovery>2004-04-05</discovery>
- <entry>2004-04-23</entry>
+ <mlist
+ msgid="20040405171305.04f19c44.zed@xchat.org">http://marc.theaimsgroup.com/?l=xchat-announce&amp;m=108114935507357</mlist>
+ </references> <dates>
+ <discovery>2004-04-05</discovery> <entry>2004-04-23</entry>
<modified>2004-05-03</modified>
</dates>
</vuln>
<vuln vid="73ea0706-9c57-11d8-9366-0020ed76ef5a">
- <topic>rsync path traversal issue</topic>
- <affects>
+ <topic>rsync path traversal issue</topic> <affects>
<package>
- <name>rsync</name>
- <range><lt>2.6.1</lt></range>
+ <name>rsync</name> <range><lt>2.6.1</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>When running rsync in daemon mode, no checks were made
to prevent clients from writing outside of a module's
`path' setting.</p>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2004-0426</cvename>
<url>http://rsync.samba.org/#security_apr04</url>
- </references>
- <dates>
- <discovery>2004-04-26</discovery>
- <entry>2004-05-02</entry>
+ </references> <dates>
+ <discovery>2004-04-26</discovery> <entry>2004-05-02</entry>
</dates>
</vuln>
<vuln vid="e50b04e8-9c55-11d8-9366-0020ed76ef5a">
- <topic>xine-lib arbitrary file overwrite</topic>
- <affects>
+ <topic>xine-lib arbitrary file overwrite</topic> <affects>
<package>
- <name>libxine</name>
- <range><gt>0.9</gt><lt>1.0.r3_5</lt></range>
+ <name>libxine</name> <range><gt>0.9</gt><lt>1.0.r3_5</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>From the xinehq advisory:</p>
- <blockquote cite="http://www.xinehq.de/index.php/security/XSA-2004-1">
+ <p>From the xinehq advisory:</p> <blockquote
+ cite="http://www.xinehq.de/index.php/security/XSA-2004-1">
<p>By opening a malicious MRL in any xine-lib based media
player, an attacker can write arbitrary content to an
- arbitrary file, only restricted by the permissions of the
- user running the application.</p>
- </blockquote>
- <p>The flaw is a result of a feature that allows MRLs (media
+ arbitrary file, only restricted by the permissions of
+ the user running the application.</p>
+ </blockquote> <p>The flaw is a result of a feature that
+ allows MRLs (media
resource locator URIs) to specify arbitrary configuration
options.</p>
</body>
- </description>
- <references>
+ </description> <references>
<bid>10193</bid>
<url>http://www.xinehq.de/index.php/security/XSA-2004-1</url>
- </references>
- <dates>
- <discovery>2004-04-20</discovery>
- <entry>2004-05-02</entry>
+ </references> <dates>
+ <discovery>2004-04-20</discovery> <entry>2004-05-02</entry>
</dates>
</vuln>
<vuln vid="fb521119-9bc4-11d8-9366-0020ed76ef5a">
- <topic>pound remotely exploitable vulnerability</topic>
- <affects>
+ <topic>pound remotely exploitable vulnerability</topic> <affects>
<package>
- <name>pound</name>
- <range><lt>1.6</lt></range>
+ <name>pound</name> <range><lt>1.6</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>An unknown remotely exploitable vulnerability was disclosed.
+ <p>An unknown remotely exploitable vulnerability was
+ disclosed.
Robert Segall writes:</p>
- <blockquote cite="http://www.apsis.ch/pound/pound_list/archive/2003/2003-12/1070234315000">
+ <blockquote
+ cite="http://www.apsis.ch/pound/pound_list/archive/2003/2003-12/1070234315000">
<p>a security vulnerability was brought to my attention
(many thanks to Akira Higuchi). Everyone running any
- previous version should upgrade to 1.6 immediately - the
- vulnerability may allow a remote exploit. No exploits are
- currently known and none have been observed in the wild
- till now. The danger is minimised if you run Pound in a
- root jail and/or you run Pound as non-root user.</p>
+ previous version should upgrade to 1.6 immediately -
+ the vulnerability may allow a remote exploit. No exploits
+ are currently known and none have been observed in the
+ wild till now. The danger is minimised if you run Pound
+ in a root jail and/or you run Pound as non-root user.</p>
</blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<mlist>http://www.apsis.ch/pound/pound_list/archive/2003/2003-12/1070234315000</mlist>
- </references>
- <dates>
- <discovery>2003-12-01</discovery>
- <entry>2004-05-02</entry>
+ </references> <dates>
+ <discovery>2003-12-01</discovery> <entry>2004-05-02</entry>
</dates>
</vuln>
<vuln vid="cfe17ca6-6858-4805-ba1d-a60a61ec9b4d">
- <topic>phpBB IP address spoofing</topic>
- <affects>
+ <topic>phpBB IP address spoofing</topic> <affects>
<package>
- <name>phpbb</name>
- <range><le>2.0.8_2</le></range>
+ <name>phpbb</name> <range><le>2.0.8_2</le></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The common.php script always trusts the `X-Forwarded-For'
header in the client's HTTP request. A remote user could
forge this header in order to bypass any IP address access
control lists (ACLs).</p>
</body>
- </description>
- <references>
- <mlist msgid="20040419000129.28917.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=108239864203144</mlist>
- </references>
- <dates>
- <discovery>2004-04-18</discovery>
- <entry>2004-04-23</entry>
+ </description> <references>
+ <mlist
+ msgid="20040419000129.28917.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=108239864203144</mlist>
+ </references> <dates>
+ <discovery>2004-04-18</discovery> <entry>2004-04-23</entry>
</dates>
</vuln>
<vuln vid="c7705712-92e6-11d8-8b29-0020ed76ef5a">
- <topic>TCP denial-of-service attacks against long lived connections</topic>
- <affects>
+ <topic>TCP denial-of-service attacks against long lived
+ connections</topic> <affects>
<system>
- <name>FreeBSD</name>
- <range><ge>0</ge></range>
+ <name>FreeBSD</name> <range><ge>0</ge></range>
</system>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p><a href="http://www.niscc.gov.uk/">NISCC</a> /
<a href="http://www.uniras.gov.uk/">UNIRAS</a> has published
- an advisory that re-visits the long discussed spoofed TCP RST
- denial-of-service vulnerability. This new look emphasizes
- the fact that for some applications such attacks are
- practically feasible.</p>
+ an advisory that re-visits the long discussed spoofed TCP
+ RST denial-of-service vulnerability. This new look
+ emphasizes the fact that for some applications such attacks
+ are practically feasible.</p>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2004-0230</cvename>
<url>http://www.uniras.gov.uk/vuls/2004/236929/index.htm</url>
- </references>
- <dates>
- <discovery>1995-06-01</discovery>
- <entry>2004-04-23</entry>
+ </references> <dates>
+ <discovery>1995-06-01</discovery> <entry>2004-04-23</entry>
</dates>
</vuln>
<vuln vid="99230277-8fb4-11d8-8b29-0020ed76ef5a">
- <topic>ident2 double byte buffer overflow</topic>
- <affects>
+ <topic>ident2 double byte buffer overflow</topic> <affects>
<package>
- <name>ident2</name>
- <range><le>1.04</le></range>
+ <name>ident2</name> <range><le>1.04</le></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jack of RaptureSecurity reported a double byte buffer
- overflow in ident2. The bug may allow a remote attacker to
- execute arbitrary code within the context of the ident2
- daemon. The daemon typically runs as user-ID `nobody', but
- with group-ID `wheel'.</p>
+ overflow in ident2. The bug may allow a remote attacker
+ to execute arbitrary code within the context of the ident2
+ daemon. The daemon typically runs as user-ID `nobody',
+ but with group-ID `wheel'.</p>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2004-0408</cvename>
<url>http://cvsweb.freebsd.org/ports/security/ident2/files/patch-common.c</url>
- </references>
- <dates>
- <discovery>2004-04-15</discovery>
- <entry>2004-04-23</entry>
+ </references> <dates>
+ <discovery>2004-04-15</discovery> <entry>2004-04-23</entry>
</dates>
</vuln>
@@ -20069,78 +16494,65 @@ http_access deny Gopher</pre>
<topic>kdepim exploitable buffer overflow in VCF reader</topic>
<affects>
<package>
- <name>kdepim</name>
- <range><ge>3.1.0</ge><lt>3.1.4_1</lt></range>
+ <name>kdepim</name> <range><ge>3.1.0</ge><lt>3.1.4_1</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A buffer overflow is present in some versions of the KDE
personal information manager (kdepim) which may be triggered
when processing a specially crafted VCF file.</p>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2003-0988</cvename>
<url>http://www.kde.org/info/security/advisory-20040114-1.txt</url>
- </references>
- <dates>
- <discovery>2004-01-14</discovery>
- <entry>2004-04-15</entry>
+ </references> <dates>
+ <discovery>2004-01-14</discovery> <entry>2004-04-15</entry>
</dates>
</vuln>
<vuln vid="ccd698df-8e20-11d8-90d1-0020ed76ef5a">
- <topic>racoon remote denial of service vulnerability (ISAKMP header length field)</topic>
- <affects>
+ <topic>racoon remote denial of service vulnerability (ISAKMP
+ header length field)</topic> <affects>
<package>
- <name>racoon</name>
- <range><lt>20040408a</lt></range>
+ <name>racoon</name> <range><lt>20040408a</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>When racoon receives an ISAKMP header, it will attempt to
+ <p>When racoon receives an ISAKMP header, it will attempt
+ to
allocate sufficient memory for the entire ISAKMP message
according to the header's length field. If an attacker
crafts an ISAKMP header with a ridiculously large value
in the length field, racoon may exceed operating system
- resource limits and be terminated, resulting in a denial of
- service.</p>
+ resource limits and be terminated, resulting in a denial
+ of service.</p>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2004-0403</cvename>
<url>http://www.kame.net/dev/cvsweb2.cgi/kame/kame/kame/racoon/isakmp.c.diff?r1=1.180&amp;r2=1.181</url>
- </references>
- <dates>
- <discovery>2004-03-31</discovery>
- <entry>2004-04-14</entry>
+ </references> <dates>
+ <discovery>2004-03-31</discovery> <entry>2004-04-14</entry>
</dates>
</vuln>
<vuln vid="40fcf20f-8891-11d8-90d1-0020ed76ef5a">
- <topic>racoon remote denial of service vulnerability (IKE Generic Payload Header)</topic>
- <affects>
+ <topic>racoon remote denial of service vulnerability (IKE Generic
+ Payload Header)</topic> <affects>
<package>
- <name>racoon</name>
- <range><lt>20040407b</lt></range>
+ <name>racoon</name> <range><lt>20040407b</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>When racoon receives an IKE message with an incorrectly
- constructed Generic Payload Header, it may behave erratically,
- going into a tight loop and dropping connections.</p>
+ constructed Generic Payload Header, it may behave
+ erratically, going into a tight loop and dropping
+ connections.</p>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2004-0392</cvename>
<url>http://orange.kame.net/dev/query-pr.cgi?pr=555</url>
- </references>
- <dates>
- <discovery>2003-12-03</discovery>
- <entry>2004-04-07</entry>
+ </references> <dates>
+ <discovery>2003-12-03</discovery> <entry>2004-04-07</entry>
<modified>2004-04-14</modified>
</dates>
</vuln>
@@ -20149,70 +16561,57 @@ http_access deny Gopher</pre>
<topic>tcpdump ISAKMP payload handling remote denial-of-service</topic>
<affects>
<package>
- <name>tcpdump</name>
- <range><lt>3.8.3</lt></range>
- </package>
- <package>
- <name>racoon</name>
- <range><lt>20040408a</lt></range>
- </package>
- <system>
- <name>FreeBSD</name>
- <range><ge>0</ge></range>
+ <name>tcpdump</name> <range><lt>3.8.3</lt></range>
+ </package> <package>
+ <name>racoon</name> <range><lt>20040408a</lt></range>
+ </package> <system>
+ <name>FreeBSD</name> <range><ge>0</ge></range>
</system>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chad Loder has discovered vulnerabilities in tcpdump's
ISAKMP protocol handler. During an audit to repair these
issues, Bill Fenner discovered some related problems.</p>
- <p>These vulnerabilities may be used by an attacker to crash a
- running `tcpdump' process. They can only be triggered if
- the `-v' command line option is being used.</p>
- <p>NOTE: the racoon ISAKMP/IKE daemon incorporates the ISAKMP
- protocol handler from tcpdump, and so is also affected by
- this issue.</p>
- </body>
- </description>
- <references>
+ <p>These vulnerabilities may be used by an attacker to crash
+ a
+ running `tcpdump' process. They can only be triggered
+ if the `-v' command line option is being used.</p>
+ <p>NOTE: the racoon ISAKMP/IKE daemon incorporates the
+ ISAKMP
+ protocol handler from tcpdump, and so is also affected
+ by this issue.</p>
+ </body>
+ </description> <references>
<mlist>http://marc.theaimsgroup.com/?l=bugtraq&amp;m=108067265931525</mlist>
<url>http://www.rapid7.com/advisories/R7-0017.html</url>
- <cvename>CVE-2004-0183</cvename>
- <cvename>CVE-2004-0184</cvename>
- </references>
- <dates>
- <discovery>2004-03-12</discovery>
- <entry>2004-03-31</entry>
+ <cvename>CVE-2004-0183</cvename> <cvename>CVE-2004-0184</cvename>
+ </references> <dates>
+ <discovery>2004-03-12</discovery> <entry>2004-03-31</entry>
<modified>2004-04-14</modified>
</dates>
</vuln>
<vuln vid="322d4ff6-85c3-11d8-a41f-0020ed76ef5a">
- <topic>Midnight Commander buffer overflow during symlink resolution</topic>
- <affects>
+ <topic>Midnight Commander buffer overflow during symlink
+ resolution</topic> <affects>
<package>
- <name>mc</name>
- <range><lt>4.6.0_9</lt></range>
+ <name>mc</name> <range><lt>4.6.0_9</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Midnight Commander uses a fixed sized stack buffer while
- resolving symbolic links within file archives (tar or cpio).
- If an attacker can cause a user to process a specially
- crafted file archive with Midnight Commander,
+ resolving symbolic links within file archives (tar or
+ cpio). If an attacker can cause a user to process a
+ specially crafted file archive with Midnight Commander,
the attacker may be able to obtain the privileges of the
target user.</p>
</body>
- </description>
- <references>
- <cvename>CVE-2003-1023</cvename>
- <mlist msgid="E1A0LbX-000NPk-00.alienhard-mail-ru@f9.mail.ru">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=106399528518704</mlist>
+ </description> <references>
+ <cvename>CVE-2003-1023</cvename> <mlist
+ msgid="E1A0LbX-000NPk-00.alienhard-mail-ru@f9.mail.ru">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=106399528518704</mlist>
<bid>8658</bid>
- </references>
- <dates>
- <discovery>2003-09-19</discovery>
- <entry>2004-04-03</entry>
+ </references> <dates>
+ <discovery>2003-09-19</discovery> <entry>2004-04-03</entry>
<modified>2004-04-13</modified>
</dates>
</vuln>
@@ -20221,11 +16620,9 @@ http_access deny Gopher</pre>
<topic>racoon fails to verify signature during Phase 1</topic>
<affects>
<package>
- <name>racoon</name>
- <range><lt>20040407b</lt></range>
+ <name>racoon</name> <range><lt>20040407b</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ralf Spenneberg discovered a serious flaw in racoon.
When using Phase 1 main or aggressive mode, racoon does
@@ -20235,73 +16632,60 @@ http_access deny Gopher</pre>
<p>Installations using <em>pre-shared keys</em> are believed
to be unaffected.</p>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2004-0155</cvename>
<url>http://www.kame.net/dev/cvsweb2.cgi/kame/kame/kame/racoon/crypto_openssl.c?rev=1.84&amp;content-type=text/x-cvsweb-markup</url>
- </references>
- <dates>
- <discovery>2004-04-05</discovery>
- <entry>2004-04-07</entry>
+ </references> <dates>
+ <discovery>2004-04-05</discovery> <entry>2004-04-07</entry>
</dates>
</vuln>
<vuln vid="6fd02439-5d70-11d8-80e3-0020ed76ef5a">
- <topic>Several remotely exploitable buffer overflows in gaim</topic>
- <affects>
+ <topic>Several remotely exploitable buffer overflows in
+ gaim</topic> <affects>
<package>
- <name>gaim</name>
- <name>ja-gaim</name>
- <name>ko-gaim</name>
- <name>ru-gaim</name>
- <range><lt>0.75_3</lt></range>
- <range><eq>0.75_5</eq></range>
- <range><eq>0.76</eq></range>
+ <name>gaim</name> <name>ja-gaim</name> <name>ko-gaim</name>
+ <name>ru-gaim</name> <range><lt>0.75_3</lt></range>
+ <range><eq>0.75_5</eq></range> <range><eq>0.76</eq></range>
+ </package> <package>
+ <name>gaim</name> <range><ge>20030000</ge></range>
</package>
- <package>
- <name>gaim</name>
- <range><ge>20030000</ge></range>
- </package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Stefan Esser of e-matters found almost a dozen remotely
exploitable vulnerabilities in Gaim. From the e-matters
advisory:</p>
- <blockquote cite="http://security.e-matters.de/advisories/012004.txt">
+ <blockquote
+ cite="http://security.e-matters.de/advisories/012004.txt">
<p>While developing a custom add-on, an integer overflow
in the handling of AIM DirectIM packets was revealed that
could lead to a remote compromise of the IM client. After
disclosing this bug to the vendor, they had to make a
hurried release because of a change in the Yahoo connection
- procedure that rendered GAIM useless. Unfourtunately at the
- same time a closer look onto the sourcecode revealed 11 more
- vulnerabilities.</p>
+ procedure that rendered GAIM useless. Unfourtunately at
+ the same time a closer look onto the sourcecode revealed
+ 11 more vulnerabilities.</p>
<p>The 12 identified problems range from simple standard
stack overflows, over heap overflows to an integer overflow
that can be abused to cause a heap overflow. Due to the
nature of instant messaging many of these bugs require
- man-in-the-middle attacks between client and server. But the
- underlying protocols are easy to implement and MIM attacks
- on ordinary TCP sessions is a fairly simple task.</p>
+ man-in-the-middle attacks between client and server. But
+ the underlying protocols are easy to implement and MIM
+ attacks on ordinary TCP sessions is a fairly simple
+ task.</p>
- <p>In combination with the latest kernel vulnerabilities or
- the habit of users to work as root/administrator these bugs
- can result in remote root compromises.</p>
+ <p>In combination with the latest kernel vulnerabilities
+ or the habit of users to work as root/administrator these
+ bugs can result in remote root compromises.</p>
</blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<url>http://security.e-matters.de/advisories/012004.txt</url>
- <cvename>CVE-2004-0005</cvename>
- <cvename>CVE-2004-0006</cvename>
- <cvename>CVE-2004-0007</cvename>
- <cvename>CVE-2004-0008</cvename>
- </references>
- <dates>
- <discovery>2004-01-26</discovery>
- <entry>2004-02-12</entry>
+ <cvename>CVE-2004-0005</cvename> <cvename>CVE-2004-0006</cvename>
+ <cvename>CVE-2004-0007</cvename> <cvename>CVE-2004-0008</cvename>
+ </references> <dates>
+ <discovery>2004-01-26</discovery> <entry>2004-02-12</entry>
<modified>2004-10-25</modified>
</dates>
</vuln>
@@ -20310,55 +16694,44 @@ http_access deny Gopher</pre>
<topic>oftpd denial-of-service vulnerability (PORT command)</topic>
<affects>
<package>
- <name>oftpd</name>
- <range><lt>0.3.7</lt></range>
+ <name>oftpd</name> <range><lt>0.3.7</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Philippe Oechslin reported a denial-of-service vulnerability
- in oftpd. The oftpd server can be crashed by sending a PORT
- command containing an integer over 8 bits long (over 255).</p>
+ in oftpd. The oftpd server can be crashed by sending a
+ PORT command containing an integer over 8 bits long (over
+ 255).</p>
</body>
- </description>
- <references>
+ </description> <references>
<url>http://www.time-travellers.org/oftpd/oftpd-dos.html</url>
- <bid>9980</bid>
- <cvename>CVE-2004-0376</cvename>
- </references>
- <dates>
- <discovery>2004-03-04</discovery>
- <entry>2004-03-28</entry>
+ <bid>9980</bid> <cvename>CVE-2004-0376</cvename>
+ </references> <dates>
+ <discovery>2004-03-04</discovery> <entry>2004-03-28</entry>
<modified>2004-04-05</modified>
</dates>
</vuln>
<vuln vid="705e003a-7f36-11d8-9645-0020ed76ef5a">
- <topic>squid ACL bypass due to URL decoding bug</topic>
- <affects>
+ <topic>squid ACL bypass due to URL decoding bug</topic> <affects>
<package>
- <name>squid</name>
- <range><lt>squid-2.5.5</lt></range>
+ <name>squid</name> <range><lt>squid-2.5.5</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>From the Squid advisory:</p>
- <blockquote cite="http://www.squid-cache.org/Advisories/SQUID-2004_1.txt">
+ <p>From the Squid advisory:</p> <blockquote
+ cite="http://www.squid-cache.org/Advisories/SQUID-2004_1.txt">
<p>Squid versions 2.5.STABLE4 and earlier contain a bug
in the "%xx" URL decoding function. It may insert a NUL
- character into decoded URLs, which may allow users to bypass
- url_regex ACLs.</p>
+ character into decoded URLs, which may allow users to
+ bypass url_regex ACLs.</p>
</blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<url>http://www.squid-cache.org/Advisories/SQUID-2004_1.txt</url>
<cvename>CVE-2004-0189</cvename>
- </references>
- <dates>
- <discovery>2004-02-29</discovery>
- <entry>2004-03-26</entry>
+ </references> <dates>
+ <discovery>2004-02-29</discovery> <entry>2004-03-26</entry>
<modified>2004-03-30</modified>
</dates>
</vuln>
@@ -20367,56 +16740,44 @@ http_access deny Gopher</pre>
<topic>zebra/quagga denial of service vulnerability</topic>
<affects>
<package>
- <name>zebra</name>
- <range><lt>0.93b_7</lt></range>
- </package>
- <package>
- <name>quagga</name>
- <range><lt>0.96.4</lt></range>
+ <name>zebra</name> <range><lt>0.93b_7</lt></range>
+ </package> <package>
+ <name>quagga</name> <range><lt>0.96.4</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A remote attacker could cause zebra/quagga to crash by
sending a malformed telnet command to their management
port.</p>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2003-0858</cvename>
<url>http://rhn.redhat.com/errata/RHSA-2003-305.html</url>
<url>http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=107140</url>
<mlist>http://lists.quagga.net/pipermail/quagga-users/2003-November/000906.html</mlist>
- </references>
- <dates>
- <discovery>2003-11-20</discovery>
- <entry>2004-03-29</entry>
+ </references> <dates>
+ <discovery>2003-11-20</discovery> <entry>2004-03-29</entry>
</dates>
</vuln>
<vuln vid="c551ae17-7f00-11d8-868e-000347dd607f">
- <topic>multiple vulnerabilities in phpBB</topic>
- <affects>
+ <topic>multiple vulnerabilities in phpBB</topic> <affects>
<package>
- <name>phpbb</name>
- <range><lt>2.0.8</lt></range>
+ <name>phpbb</name> <range><lt>2.0.8</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>Users with admin rights can severly damage an phpBB installation,
- potentially triggered by viewing a page with a malicious link sent
- by an attacker.</p>
+ <p>Users with admin rights can severly damage an phpBB
+ installation,
+ potentially triggered by viewing a page with a malicious
+ link sent by an attacker.</p>
</body>
- </description>
- <references>
+ </description> <references>
<url>http://www.gulftech.org/03202004.php</url>
<url>http://www.phpbb.com/phpBB/viewtopic.php?t=183982</url>
<bid>9942</bid>
- </references>
- <dates>
- <discovery>2004-03-20</discovery>
- <entry>2004-03-26</entry>
+ </references> <dates>
+ <discovery>2004-03-20</discovery> <entry>2004-03-26</entry>
<modified>2004-03-29</modified>
</dates>
</vuln>
@@ -20425,26 +16786,21 @@ http_access deny Gopher</pre>
<topic>ezbounce remote format string vulnerability</topic>
<affects>
<package>
- <name>ezbounce</name>
- <range><lt>1.04.a_1</lt></range>
+ <name>ezbounce</name> <range><lt>1.04.a_1</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>A security hole exists that can be used to crash the proxy and
- execute arbitrary code. An exploit is circulating that takes
- advantage of this, and in some cases succeeds in obtaining a login
- shell on the machine.</p>
+ <p>A security hole exists that can be used to crash the
+ proxy and
+ execute arbitrary code. An exploit is circulating that
+ takes advantage of this, and in some cases succeeds in
+ obtaining a login shell on the machine.</p>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2003-0510</cvename>
- <url>http://ezbounce.dc-team.com/</url>
- <bid>8071</bid>
- </references>
- <dates>
- <discovery>2003-07-01</discovery>
- <entry>2004-03-26</entry>
+ <url>http://ezbounce.dc-team.com/</url> <bid>8071</bid>
+ </references> <dates>
+ <discovery>2003-07-01</discovery> <entry>2004-03-26</entry>
<modified>2004-03-29</modified>
</dates>
</vuln>
@@ -20453,11 +16809,9 @@ http_access deny Gopher</pre>
<topic>racoon security association deletion vulnerability</topic>
<affects>
<package>
- <name>racoon</name>
- <range><lt>20040116a</lt></range>
+ <name>racoon</name> <range><lt>20040116a</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A remote attacker may use specially crafted IKE/ISAKMP
messages to cause racoon to delete security associations.
@@ -20465,150 +16819,126 @@ http_access deny Gopher</pre>
sensitive traffic to be transmitted in plaintext, depending
upon configuration.</p>
</body>
- </description>
- <references>
- <mlist msgid="20040113213940.GA1727@hzeroseven.org">http://www.securityfocus.com/archive/1/349756</mlist>
- <bid>9416</bid>
- <bid>9417</bid>
- <cvename>CVE-2004-0164</cvename>
- </references>
- <dates>
- <discovery>2004-01-13</discovery>
- <entry>2004-03-25</entry>
+ </description> <references>
+ <mlist
+ msgid="20040113213940.GA1727@hzeroseven.org">http://www.securityfocus.com/archive/1/349756</mlist>
+ <bid>9416</bid> <bid>9417</bid> <cvename>CVE-2004-0164</cvename>
+ </references> <dates>
+ <discovery>2004-01-13</discovery> <entry>2004-03-25</entry>
<modified>2004-03-29</modified>
</dates>
</vuln>
<vuln vid="3b7c7f6c-7102-11d8-873f-0020ed76ef5a">
- <topic>wu-ftpd ftpaccess `restricted-uid'/`restricted-gid' directive may be bypassed</topic>
- <affects>
+ <topic>wu-ftpd ftpaccess `restricted-uid'/`restricted-gid'
+ directive may be bypassed</topic> <affects>
<package>
- <name>wu-ftpd</name>
- <range><le>2.6.2_3</le></range>
+ <name>wu-ftpd</name> <range><le>2.6.2_3</le></range>
+ </package> <package>
+ <name>wu-ftpd+ipv6</name> <range><le>2.6.2_5</le></range>
</package>
- <package>
- <name>wu-ftpd+ipv6</name>
- <range><le>2.6.2_5</le></range>
- </package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Glenn Stewart reports a bug in wu-ftpd's ftpaccess
`restricted-uid'/`restricted-gid' directives:</p>
<blockquote>
<p>Users can get around the restriction to their home
- directory by issuing a simple chmod command on their home
- directory. On the next ftp log in, the user will have '/'
- as their root directory.</p>
- </blockquote>
- <p>Matt Zimmerman discovered that the cause of the bug was a
- missing check for a restricted user within a code path that
- is executed only when a certain error is encountered.</p>
- </body>
- </description>
- <references>
- <cvename>CVE-2004-0148</cvename>
- <bid>9832</bid>
- </references>
- <dates>
- <discovery>2004-02-17</discovery>
- <entry>2004-03-08</entry>
+ directory by issuing a simple chmod command on their
+ home directory. On the next ftp log in, the user will
+ have '/' as their root directory.</p>
+ </blockquote> <p>Matt Zimmerman discovered that the cause
+ of the bug was a
+ missing check for a restricted user within a code path
+ that is executed only when a certain error is encountered.</p>
+ </body>
+ </description> <references>
+ <cvename>CVE-2004-0148</cvename> <bid>9832</bid>
+ </references> <dates>
+ <discovery>2004-02-17</discovery> <entry>2004-03-08</entry>
<modified>2004-03-29</modified>
</dates>
</vuln>
<vuln vid="8471bb85-6fb0-11d8-873f-0020ed76ef5a">
- <topic>GNU Anubis buffer overflows and format string vulnerabilities</topic>
- <affects>
+ <topic>GNU Anubis buffer overflows and format string
+ vulnerabilities</topic> <affects>
<package>
- <name>anubis</name>
- <range><le>3.6.2_1</le></range>
+ <name>anubis</name> <range><le>3.6.2_1</le></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>Ulf Härnhammar discovered several vulnerabilities in GNU
+ <p>Ulf Härnhammar discovered several vulnerabilities in
+ GNU
Anubis.</p>
<ul>
- <li>Unsafe uses of `sscanf'. The `%s' format specifier is
- used, which allows a classical buffer overflow. (auth.c)</li>
+ <li>Unsafe uses of `sscanf'. The `%s' format specifier
+ is
+ used, which allows a classical buffer overflow.
+ (auth.c)</li>
<li>Format string bugs invoking `syslog'. (log.c, errs.c,
ssl.c)</li>
- </ul>
- <p>Ulf notes that these vulnerabilities can be exploited by a
+ </ul> <p>Ulf notes that these vulnerabilities can be exploited
+ by a
malicious IDENT server as a denial-of-service attack.</p>
</body>
- </description>
- <references>
+ </description> <references>
<mlist>http://lists.netsys.com/pipermail/full-disclosure/2004-March/018290.html</mlist>
- <bid>9772</bid>
- <cvename>CVE-2004-0353</cvename>
+ <bid>9772</bid> <cvename>CVE-2004-0353</cvename>
<cvename>CVE-2004-0354</cvename>
- </references>
- <dates>
- <discovery>2004-03-04</discovery>
- <entry>2004-03-06</entry>
+ </references> <dates>
+ <discovery>2004-03-04</discovery> <entry>2004-03-06</entry>
<modified>2004-03-29</modified>
</dates>
</vuln>
<vuln vid="3837f462-5d6b-11d8-80e3-0020ed76ef5a">
- <topic>Buffer overflows in XFree86 servers</topic>
- <affects>
+ <topic>Buffer overflows in XFree86 servers</topic> <affects>
<package>
- <name>XFree86-Server</name>
- <range><le>4.3.0_13</le></range>
+ <name>XFree86-Server</name> <range><le>4.3.0_13</le></range>
<range><ge>4.3.99</ge><le>4.3.99.15_1</le></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>A number of buffer overflows were recently discovered in
- XFree86, prompted by initial discoveries by iDEFENSE. These
- buffer overflows are present in the font alias handling. An
- attacker with authenticated access to a running X server may
- exploit these vulnerabilities to obtain root privileges on
- the machine running the X server.</p>
+ <p>A number of buffer overflows were recently discovered
+ in
+ XFree86, prompted by initial discoveries by iDEFENSE.
+ These buffer overflows are present in the font alias
+ handling. An attacker with authenticated access to a
+ running X server may exploit these vulnerabilities to
+ obtain root privileges on the machine running the X
+ server.</p>
</body>
- </description>
- <references>
+ </description> <references>
<url>http://www.idefense.com/application/poi/display?id=72</url>
<url>http://www.idefense.com/application/poi/display?id=73</url>
- <cvename>CVE-2004-0083</cvename>
- <cvename>CVE-2004-0084</cvename>
- <cvename>CVE-2004-0106</cvename>
- <bid>9636</bid>
- <bid>9652</bid>
+ <cvename>CVE-2004-0083</cvename> <cvename>CVE-2004-0084</cvename>
+ <cvename>CVE-2004-0106</cvename> <bid>9636</bid> <bid>9652</bid>
<bid>9655</bid>
- </references>
- <dates>
- <discovery>2004-02-10</discovery>
- <entry>2004-02-12</entry>
+ </references> <dates>
+ <discovery>2004-02-10</discovery> <entry>2004-02-12</entry>
<modified>2004-03-29</modified>
</dates>
</vuln>
<vuln vid="e25566d5-6d3f-11d8-83a4-000a95bc6fae">
- <topic>multiple buffer overflows in xboing</topic>
- <affects>
+ <topic>multiple buffer overflows in xboing</topic> <affects>
<package>
- <name>xboing</name>
- <range><lt>2.4_2</lt></range>
+ <name>xboing</name> <range><lt>2.4_2</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Steve Kemp reports (in a Debian bug submission):</p>
- <blockquote cite="http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=174924">
+ <blockquote
+ cite="http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=174924">
<p>Due to improper bounds checking it is possible for a
malicious user to gain a shell with membership group
'games'. (The binary is installed setgid games).</p>
- <p>Environmental variables are used without being bounds-checked
+ <p>Environmental variables are used without being
+ bounds-checked
in any way, from the source code:</p>
-<pre>
-highscore.c:
- /* Use the environment variable if it exists */
- if ((str = getenv("XBOING_SCORE_FILE")) != NULL)
+<pre> highscore.c:
+ /* Use the environment variable if it exists */ if ((str =
+ getenv("XBOING_SCORE_FILE")) != NULL)
strcpy(filename, str);
else
strcpy(filename, HIGH_SCORE_FILE);
@@ -20621,15 +16951,12 @@ misc.c:
arbitary shell code to be run.</p>
</blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2004-0149</cvename>
<url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=174924</url>
<bid>9764</bid>
- </references>
- <dates>
- <discovery>2003-01-01</discovery>
- <entry>2004-03-05</entry>
+ </references> <dates>
+ <discovery>2003-01-01</discovery> <entry>2004-03-05</entry>
<modified>2004-03-29</modified>
</dates>
</vuln>
@@ -20638,29 +16965,24 @@ misc.c:
<topic>metamail format string bugs and buffer overflows</topic>
<affects>
<package>
- <name>metamail</name>
- <range><lt>2.7_2</lt></range>
+ <name>metamail</name> <range><lt>2.7_2</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>Ulf Härnhammar reported four bugs in metamail: two are format
- string bugs and two are buffer overflows. The bugs are in
- SaveSquirrelFile(), PrintHeader(), and ShareThisHeader().</p>
+ <p>Ulf Härnhammar reported four bugs in metamail: two are
+ format
+ string bugs and two are buffer overflows. The bugs are
+ in SaveSquirrelFile(), PrintHeader(), and ShareThisHeader().</p>
<p>These vulnerabilities could be triggered by a maliciously
- formatted email message if `metamail' or `splitmail' is used
- to process it, possibly resulting in arbitrary code execution
- with the privileges of the user reading mail.</p>
+ formatted email message if `metamail' or `splitmail' is
+ used to process it, possibly resulting in arbitrary code
+ execution with the privileges of the user reading mail.</p>
</body>
- </description>
- <references>
- <cvename>CVE-2004-0104</cvename>
- <cvename>CVE-2004-0105</cvename>
+ </description> <references>
+ <cvename>CVE-2004-0104</cvename> <cvename>CVE-2004-0105</cvename>
<bid>9692</bid>
- </references>
- <dates>
- <discovery>2004-02-18</discovery>
- <entry>2004-02-18</entry>
+ </references> <dates>
+ <discovery>2004-02-18</discovery> <entry>2004-02-18</entry>
<modified>2004-03-29</modified>
</dates>
</vuln>
@@ -20669,110 +16991,83 @@ misc.c:
<topic>Buffer overflows and format string bugs in Emil</topic>
<affects>
<package>
- <name>emil</name>
- <range><le>2.1b9</le></range>
+ <name>emil</name> <range><le>2.1b9</le></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ulf Härnhammar reports multiple buffer overflows in
- Emil, some of which are triggered during the parsing
- of attachment filenames. In addition, some format string bugs
- are present in the error reporting code.</p>
+ Emil, some of which are triggered during the parsing of
+ attachment filenames. In addition, some format string
+ bugs are present in the error reporting code.</p>
<p>Depending upon local configuration, these vulnerabilities
may be exploited using specially crafted messages in order
to execute arbitrary code running with the privileges of
the user invoking Emil.</p>
</body>
- </description>
- <references>
+ </description> <references>
<mlist>http://lists.netsys.com/pipermail/full-disclosure/2004-March/019325.html</mlist>
<url>http://www.debian.org/security/2004/dsa-468</url>
- <cvename>CVE-2004-0152</cvename>
- <cvename>CVE-2004-0153</cvename>
- </references>
- <dates>
- <discovery>2004-03-24</discovery>
- <entry>2004-03-28</entry>
+ <cvename>CVE-2004-0152</cvename> <cvename>CVE-2004-0153</cvename>
+ </references> <dates>
+ <discovery>2004-03-24</discovery> <entry>2004-03-28</entry>
</dates>
</vuln>
<vuln vid="70f5b3c6-80f0-11d8-9645-0020ed76ef5a">
- <topic>Critical SQL injection in phpBB</topic>
- <affects>
+ <topic>Critical SQL injection in phpBB</topic> <affects>
<package>
- <name>phpbb</name>
- <range><le>2.0.8</le></range>
+ <name>phpbb</name> <range><le>2.0.8</le></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>Anyone can get admin's username and password's md5 hash via a
- single web request.
- A working example is provided in the advisory.</p>
+ <p>Anyone can get admin's username and password's md5 hash
+ via a
+ single web request. A working example is provided in the
+ advisory.</p>
</body>
- </description>
- <references>
+ </description> <references>
<mlist>http://marc.theaimsgroup.com/?l=bugtraq&amp;m=108032454818873</mlist>
<bid>9984</bid>
- </references>
- <dates>
- <discovery>2004-03-26</discovery>
- <entry>2004-03-28</entry>
+ </references> <dates>
+ <discovery>2004-03-26</discovery> <entry>2004-03-28</entry>
</dates>
</vuln>
<vuln vid="6c7661ff-7912-11d8-9645-0020ed76ef5a">
- <topic>uudeview buffer overflows</topic>
- <affects>
+ <topic>uudeview buffer overflows</topic> <affects>
<package>
- <name>uulib</name>
- <name>uudeview</name>
- <name>xdeview</name>
+ <name>uulib</name> <name>uudeview</name> <name>xdeview</name>
<range><lt>0.5.20</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The authors of UUDeview report repairing two buffer
overflows in their software.</p>
</body>
- </description>
- <references>
+ </description> <references>
<url>http://www.fpx.de/fp/Software/UUDeview/HISTORY.txt</url>
- </references>
- <dates>
- <discovery>2004-03-01</discovery>
- <entry>2004-03-18</entry>
+ </references> <dates>
+ <discovery>2004-03-01</discovery> <entry>2004-03-18</entry>
<modified>2004-03-25</modified>
</dates>
</vuln>
<vuln vid="09d418db-70fd-11d8-873f-0020ed76ef5a">
- <topic>Apache 1.3 IP address access control failure on some 64-bit platforms</topic>
- <affects>
- <package>
- <name>apache</name>
- <range><lt>1.3.29_2</lt></range>
- </package>
- <package>
- <name>apache+mod_ssl</name>
- <range><lt>1.3.29+2.8.16_1</lt></range>
- </package>
- <package>
- <name>apache+ssl</name>
- <range><lt>1.3.29.1.53_1</lt></range>
- </package>
- <package>
- <name>ru-apache</name>
- <range><lt>1.3.29+30.19_1</lt></range>
- </package>
- <package>
+ <topic>Apache 1.3 IP address access control failure on some
+ 64-bit platforms</topic> <affects>
+ <package>
+ <name>apache</name> <range><lt>1.3.29_2</lt></range>
+ </package> <package>
+ <name>apache+mod_ssl</name> <range><lt>1.3.29+2.8.16_1</lt></range>
+ </package> <package>
+ <name>apache+ssl</name> <range><lt>1.3.29.1.53_1</lt></range>
+ </package> <package>
+ <name>ru-apache</name> <range><lt>1.3.29+30.19_1</lt></range>
+ </package> <package>
<name>ru-apache+mod_ssl</name>
<range><lt>1.3.29+30.19+2.8.16_1</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Henning Brauer discovered a programming error in Apache
1.3's mod_access that results in the netmasks in IP address
@@ -20781,18 +17076,15 @@ misc.c:
cause a `deny from' IP address access control rule including
a netmask to fail.</p>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2003-0993</cvename>
<url>http://cvs.apache.org/viewcvs.cgi/apache-1.3/src/modules/standard/mod_access.c?r1=1.46&amp;r2=1.47</url>
<url>http://www.apacheweek.com/features/security-13</url>
<url>http://nagoya.apache.org/bugzilla/show_bug.cgi?id=23850</url>
<mlist>http://marc.theaimsgroup.com/?l=apache-cvs&amp;m=107869603013722</mlist>
<bid>9829</bid>
- </references>
- <dates>
- <discovery>2004-03-07</discovery>
- <entry>2004-03-08</entry>
+ </references> <dates>
+ <discovery>2004-03-07</discovery> <entry>2004-03-08</entry>
<modified>2004-03-12</modified>
</dates>
</vuln>
@@ -20801,273 +17093,213 @@ misc.c:
<topic>mod_python denial-of-service vulnerability in parse_qs</topic>
<affects>
<package>
- <name>mod_python</name>
- <range><ge>2.7</ge><lt>2.7.10</lt></range>
+ <name>mod_python</name> <range><ge>2.7</ge><lt>2.7.10</lt></range>
<range><ge>3.0</ge><lt>3.0.4</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>An attacker may cause Apache with mod_python to crash
by using a specially constructed query string.</p>
</body>
- </description>
- <references>
- <cvename>CVE-2003-0973</cvename>
- <bid>9129</bid>
+ </description> <references>
+ <cvename>CVE-2003-0973</cvename> <bid>9129</bid>
<url>http://www.modpython.org/pipermail/mod_python/2003-November/014532.html</url>
<url>http://www.modpython.org/pipermail/mod_python/2004-January/014879.html</url>
- </references>
- <dates>
- <discovery>2003-11-28</discovery>
- <entry>2004-03-03</entry>
+ </references> <dates>
+ <discovery>2003-11-28</discovery> <entry>2004-03-03</entry>
<modified>2004-03-11</modified>
</dates>
</vuln>
<vuln vid="9fccad5a-7096-11d8-873f-0020ed76ef5a">
- <topic>mpg123 vulnerabilities</topic>
- <affects>
+ <topic>mpg123 vulnerabilities</topic> <affects>
<package>
- <name>mpg123</name>
- <name>mpg123-nas</name>
- <name>mpg123-esound</name>
- <range><le>0.59r_12</le></range>
+ <name>mpg123</name> <name>mpg123-nas</name>
+ <name>mpg123-esound</name> <range><le>0.59r_12</le></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>In 2003, two vulnerabilities were discovered in mpg123
that could result in remote code execution when using
untrusted input or streaming from an untrusted server.</p>
</body>
- </description>
- <references>
- <cvename>CVE-2003-0577</cvename>
- <cvename>CVE-2003-0865</cvename>
- <bid>6629</bid>
- <bid>8680</bid>
- </references>
- <dates>
- <discovery>2003-01-16</discovery>
- <entry>2004-03-07</entry>
+ </description> <references>
+ <cvename>CVE-2003-0577</cvename> <cvename>CVE-2003-0865</cvename>
+ <bid>6629</bid> <bid>8680</bid>
+ </references> <dates>
+ <discovery>2003-01-16</discovery> <entry>2004-03-07</entry>
</dates>
</vuln>
<vuln vid="ac4b9d18-67a9-11d8-80e3-0020ed76ef5a">
- <topic>fetchmail denial-of-service vulnerability</topic>
- <affects>
+ <topic>fetchmail denial-of-service vulnerability</topic> <affects>
<package>
- <name>fetchmail</name>
- <range><lt>6.2.5</lt></range>
+ <name>fetchmail</name> <range><lt>6.2.5</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Dave Jones discovered a denial-of-service vulnerability
- in fetchmail. An email message containing a very long line
- could cause fetchmail to segfault due to missing NUL
+ in fetchmail. An email message containing a very long
+ line could cause fetchmail to segfault due to missing NUL
termination in transact.c.</p>
<p>Eric Raymond decided not to mention this issue in the
release notes for fetchmail 6.2.5, but it was fixed
there.</p>
</body>
- </description>
- <references>
- <cvename>CVE-2003-0792</cvename>
- <bid>8843</bid>
+ </description> <references>
+ <cvename>CVE-2003-0792</cvename> <bid>8843</bid>
<url>http://xforce.iss.net/xforce/xfdb/13450</url>
<url>http://www.openbsd.org/cgi-bin/cvsweb/ports/mail/fetchmail/patches/Attic/patch-rfc822_c?rev=1.1</url>
- </references>
- <dates>
- <discovery>2003-10-16</discovery>
- <entry>2004-02-25</entry>
+ </references> <dates>
+ <discovery>2003-10-16</discovery> <entry>2004-02-25</entry>
<modified>2004-03-05</modified>
</dates>
</vuln>
<vuln vid="b0e76877-67a8-11d8-80e3-0020ed76ef5a">
- <topic>mailman denial-of-service vulnerability in MailCommandHandler</topic>
- <affects>
+ <topic>mailman denial-of-service vulnerability in
+ MailCommandHandler</topic> <affects>
<package>
- <name>mailman</name>
- <range><lt>2.1</lt></range>
+ <name>mailman</name> <range><lt>2.1</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A malformed message could cause mailman to crash.</p>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2003-0991</cvename>
<url>http://umn.dl.sourceforge.net/sourceforge/mailman/mailman-2.0.13-2.0.14-diff.txt</url>
- </references>
- <dates>
- <discovery>2003-11-18</discovery>
- <entry>2004-02-25</entry>
+ </references> <dates>
+ <discovery>2003-11-18</discovery> <entry>2004-02-25</entry>
</dates>
</vuln>
<vuln vid="3cb88bb2-67a6-11d8-80e3-0020ed76ef5a">
- <topic>mailman XSS in admin script</topic>
- <affects>
+ <topic>mailman XSS in admin script</topic> <affects>
<package>
- <name>mailman</name>
- <range><lt>2.1.4</lt></range>
+ <name>mailman</name> <range><lt>2.1.4</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Dirk Mueller reports:</p>
<blockquote><p>I've found a cross-site scripting
- vulnerability in the admin interface of mailman 2.1.3 that
- allows, under certain circumstances, for anyone to retrieve
- the (valid) session cookie.</p></blockquote>
+ vulnerability in the admin interface of mailman 2.1.3
+ that allows, under certain circumstances, for anyone to
+ retrieve the (valid) session cookie.</p></blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2003-0965</cvename>
<url>http://mail.python.org/pipermail/mailman-announce/2003-December/000066.html</url>
<url>http://xforce.iss.net/xforce/xfdb/14121</url>
- </references>
- <dates>
- <discovery>2003-12-31</discovery>
- <entry>2004-02-25</entry>
+ </references> <dates>
+ <discovery>2003-12-31</discovery> <entry>2004-02-25</entry>
</dates>
</vuln>
<vuln vid="429249d2-67a7-11d8-80e3-0020ed76ef5a">
- <topic>mailman XSS in create script</topic>
- <affects>
+ <topic>mailman XSS in create script</topic> <affects>
<package>
- <name>mailman</name>
- <range><lt>2.1.3</lt></range>
+ <name>mailman</name> <range><lt>2.1.3</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>From the 2.1.3 release notes:</p>
- <blockquote><p>Closed a cross-site scripting exploit in the
- create cgi script.</p></blockquote>
+ <p>From the 2.1.3 release notes:</p> <blockquote><p>Closed
+ a cross-site scripting exploit in the create cgi
+ script.</p></blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2003-0992</cvename>
<url>http://mail.python.org/pipermail/mailman-announce/2003-September/000061.html</url>
- </references>
- <dates>
- <discovery>2003-09-28</discovery>
- <entry>2004-02-25</entry>
+ </references> <dates>
+ <discovery>2003-09-28</discovery> <entry>2004-02-25</entry>
</dates>
</vuln>
<vuln vid="00263aa3-67a8-11d8-80e3-0020ed76ef5a">
- <topic>mailman XSS in user options page</topic>
- <affects>
+ <topic>mailman XSS in user options page</topic> <affects>
<package>
- <name>mailman</name>
- <range><lt>2.1.1</lt></range>
+ <name>mailman</name> <range><lt>2.1.1</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>From the 2.1.1 release notes:</p>
- <blockquote><p>Closed a cross-site scripting vulnerability in
- the user options page.</p></blockquote>
+ <p>From the 2.1.1 release notes:</p> <blockquote><p>Closed
+ a cross-site scripting vulnerability in the user options
+ page.</p></blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2003-0038</cvename>
<url>http://mail.python.org/pipermail/mailman-announce/2003-February/000056.html</url>
- </references>
- <dates>
- <discovery>2003-02-08</discovery>
- <entry>2004-02-25</entry>
+ </references> <dates>
+ <discovery>2003-02-08</discovery> <entry>2004-02-25</entry>
</dates>
</vuln>
<vuln vid="75770425-67a2-11d8-80e3-0020ed76ef5a">
- <topic>SQL injection vulnerability in phpnuke</topic>
- <affects>
+ <topic>SQL injection vulnerability in phpnuke</topic> <affects>
<package>
- <name>phpnuke</name>
- <range><le>6.9</le></range>
+ <name>phpnuke</name> <range><le>6.9</le></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Multiple researchers have discovered multiple SQL injection
vulnerabilities in some versions of Php-Nuke. These
- vulnerabilities may lead to information disclosure, compromise
- of the Php-Nuke site, or compromise of the back-end
- database.</p>
+ vulnerabilities may lead to information disclosure,
+ compromise of the Php-Nuke site, or compromise of the
+ back-end database.</p>
</body>
- </description>
- <references>
+ </description> <references>
<url>http://security.nnov.ru/search/document.asp?docid=5748</url>
<mlist>http://www.securityfocus.com/archive/1/348375</mlist>
<url>http://www.security-corporation.com/advisories-027.html</url>
<mlist>http://www.securityfocus.com/archive/1/353201</mlist>
- </references>
- <dates>
- <discovery>2003-12-12</discovery>
- <entry>2004-02-25</entry>
+ </references> <dates>
+ <discovery>2003-12-12</discovery> <entry>2004-02-25</entry>
</dates>
</vuln>
<vuln vid="ad4f6ca4-6720-11d8-9fb5-000a95bc6fae">
- <topic>lbreakout2 vulnerability in environment variable handling</topic>
- <affects>
+ <topic>lbreakout2 vulnerability in environment variable
+ handling</topic> <affects>
<package>
- <name>lbreakout2</name>
- <range><le>2.2.2_1</le></range>
+ <name>lbreakout2</name> <range><le>2.2.2_1</le></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>Ulf Härnhammar discovered an exploitable vulnerability in
+ <p>Ulf Härnhammar discovered an exploitable vulnerability
+ in
lbreakout2's environmental variable handling. In several
instances, the contents of the HOME environmental variable
are copied to a stack or global buffer without range
- checking. A local attacker may use this vulnerability to
- acquire group-ID `games' privileges.</p>
+ checking. A local attacker may use this vulnerability
+ to acquire group-ID `games' privileges.</p>
<p>An exploit for this vulnerability has been published by
``Li0n7 voila fr''.</p>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2004-0158</cvename>
<url>http://www.debian.org/security/2004/dsa-445</url>
<mlist>http://www.securityfocus.com/archive/1/354760</mlist>
- </references>
- <dates>
- <discovery>2004-02-21</discovery>
- <entry>2004-02-25</entry>
+ </references> <dates>
+ <discovery>2004-02-21</discovery> <entry>2004-02-25</entry>
</dates>
</vuln>
<vuln vid="316e1c9b-671c-11d8-9aad-000a95bc6fae">
- <topic>hsftp format string vulnerabilities</topic>
- <affects>
+ <topic>hsftp format string vulnerabilities</topic> <affects>
<package>
- <name>hsftp</name>
- <range><lt>1.14</lt></range>
+ <name>hsftp</name> <range><lt>1.14</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>Ulf Härnhammar discovered a format string bug in hsftp's file
+ <p>Ulf Härnhammar discovered a format string bug in hsftp's
+ file
listing code may allow a malicious server to cause arbitrary
code execution by the client.</p>
</body>
- </description>
- <references>
+ </description> <references>
<mlist>http://lists.debian.org/debian-security-announce/debian-security-announce-2004/msg00044.html</mlist>
- </references>
- <dates>
- <discovery>2004-02-22</discovery>
- <entry>2004-02-25</entry>
+ </references> <dates>
+ <discovery>2004-02-22</discovery> <entry>2004-02-25</entry>
</dates>
</vuln>
@@ -21075,23 +17307,18 @@ misc.c:
<topic>Darwin Streaming Server denial-of-service vulnerability</topic>
<affects>
<package>
- <name>DarwinStreamingServer</name>
- <range><le>4.1.3g</le></range>
+ <name>DarwinStreamingServer</name> <range><le>4.1.3g</le></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>An attacker can cause an assertion to trigger by sending
a long User-Agent field in a request.</p>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2004-0169</cvename>
<url>http://www.idefense.com/application/poi/display?id=75</url>
- </references>
- <dates>
- <discovery>2004-02-23</discovery>
- <entry>2004-02-25</entry>
+ </references> <dates>
+ <discovery>2004-02-23</discovery> <entry>2004-02-25</entry>
</dates>
</vuln>
@@ -21099,54 +17326,45 @@ misc.c:
<topic>libxml2 stack buffer overflow in URI parsing</topic>
<affects>
<package>
- <name>libxml2</name>
- <range><lt>2.6.6</lt></range>
+ <name>libxml2</name> <range><lt>2.6.6</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>Yuuichi Teranishi reported a crash in libxml2's URI handling
- when a long URL is supplied. The implementation in nanohttp.c
- and nanoftp.c uses a 4K stack buffer, and longer URLs will
- overwrite the stack. This could result in denial-of-service
- or arbitrary code execution in applications using libxml2
- to parse documents.</p>
+ <p>Yuuichi Teranishi reported a crash in libxml2's URI
+ handling
+ when a long URL is supplied. The implementation in
+ nanohttp.c and nanoftp.c uses a 4K stack buffer, and
+ longer URLs will overwrite the stack. This could result
+ in denial-of-service or arbitrary code execution in
+ applications using libxml2 to parse documents.</p>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2004-0110</cvename>
<url>http://www.xmlsoft.org/news.html</url>
<url>http://mail.gnome.org/archives/xml/2004-February/msg00070.html</url>
- </references>
- <dates>
- <discovery>2004-02-08</discovery>
- <entry>2004-02-25</entry>
+ </references> <dates>
+ <discovery>2004-02-08</discovery> <entry>2004-02-25</entry>
</dates>
</vuln>
<vuln vid="cc0fb686-6550-11d8-80e3-0020ed76ef5a">
- <topic>file disclosure in phpMyAdmin</topic>
- <affects>
+ <topic>file disclosure in phpMyAdmin</topic> <affects>
<package>
- <name>phpMyAdmin</name>
- <range><le>2.5.4</le></range>
+ <name>phpMyAdmin</name> <range><le>2.5.4</le></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>Lack of proper input validation in phpMyAdmin may allow an
+ <p>Lack of proper input validation in phpMyAdmin may allow
+ an
attacker to obtain the contents of any file on the target
system that is readable by the web server.</p>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2004-0129</cvename>
<mlist>http://marc.theaimsgroup.com/?l=bugtraq&amp;m=107582619125932&amp;w=2</mlist>
<url>http://cvs.sourceforge.net/viewcvs.py/phpmyadmin/phpMyAdmin/export.php#rev2.3.2.1</url>
- </references>
- <dates>
- <discovery>2004-02-17</discovery>
- <entry>2004-02-22</entry>
+ </references> <dates>
+ <discovery>2004-02-17</discovery> <entry>2004-02-22</entry>
</dates>
</vuln>
@@ -21157,13 +17375,14 @@ misc.c:
<name>mnogosearch</name>
<range><ge>3.2.*</ge><lt>3.2.15</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>Jedi/Sector One &lt;j@pureftpd.org&gt; reported the following
+ <p>Jedi/Sector One &lt;j@pureftpd.org&gt; reported the
+ following
on the full-disclosure list:</p>
<blockquote>
- <p>Every document is stored in multiple parts according to
+ <p>Every document is stored in multiple parts according
+ to
its sections (description, body, etc) in databases. And
when the content has to be sent to the client,
UdmDocToTextBuf() concatenates those parts together and
@@ -21176,17 +17395,14 @@ misc.c:
document and on the indexer settings (the sample
configuration file has low limits that work around the
bug, though).</p>
- <p>Exploitation should be easy, moreover textbuf points to
- the stack.</p>
+ <p>Exploitation should be easy, moreover textbuf points
+ to the stack.</p>
</blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<mlist>http://lists.netsys.com/pipermail/full-disclosure/2004-February/017366.html</mlist>
- </references>
- <dates>
- <discovery>2004-02-15</discovery>
- <entry>2004-02-15</entry>
+ </references> <dates>
+ <discovery>2004-02-15</discovery> <entry>2004-02-15</entry>
</dates>
</vuln>
@@ -21194,17 +17410,15 @@ misc.c:
<topic>GNU libtool insecure temporary file handling</topic>
<affects>
<package>
- <name>libtool</name>
- <range><ge>1.3</ge><lt>1.3.5_2</lt></range>
+ <name>libtool</name> <range><ge>1.3</ge><lt>1.3.5_2</lt></range>
<range><ge>1.4</ge><lt>1.4.3_3</lt></range>
<range><ge>1.5</ge><lt>1.5.2</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>libtool attempts to create a temporary directory in
- which to write scratch files needed during processing. A
- malicious user may create a symlink and then manipulate
+ which to write scratch files needed during processing.
+ A malicious user may create a symlink and then manipulate
the directory so as to write to files to which she normally
has no permissions.</p>
<p>This has been reported as a ``symlink vulnerability'',
@@ -21214,14 +17428,11 @@ misc.c:
packages, and another user successfully exploits this
vulnerability to write to a system file.</p>
</body>
- </description>
- <references>
+ </description> <references>
<mlist>http://www.geocrawler.com/mail/msg.php3?msg_id=3438808&amp;list=405</mlist>
<mlist>http://www.securityfocus.com/archive/1/352333</mlist>
- </references>
- <dates>
- <discovery>2004-01-30</discovery>
- <entry>2004-02-13</entry>
+ </references> <dates>
+ <discovery>2004-01-30</discovery> <entry>2004-02-13</entry>
</dates>
</vuln>
@@ -21229,129 +17440,98 @@ misc.c:
<topic>seti@home remotely exploitable buffer overflow</topic>
<affects>
<package>
- <name>setiathome</name>
- <range><lt>3.0.8</lt></range>
+ <name>setiathome</name> <range><lt>3.0.8</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>The seti@home client contains a buffer overflow in the HTTP
- response handler. A malicious, spoofed seti@home server can
- exploit this buffer overflow to cause remote code execution
- on the client. Exploit programs are widely available.</p>
+ <p>The seti@home client contains a buffer overflow in the
+ HTTP
+ response handler. A malicious, spoofed seti@home server
+ can exploit this buffer overflow to cause remote code
+ execution on the client. Exploit programs are widely
+ available.</p>
</body>
- </description>
- <references>
+ </description> <references>
<url>http://setiathome.berkeley.edu/version308.html</url>
<url>http://web.archive.org/web/20030609204812/http://spoor12.edup.tudelft.nl/</url>
- </references>
- <dates>
- <discovery>2003-04-08</discovery>
- <entry>2004-02-12</entry>
+ </references> <dates>
+ <discovery>2003-04-08</discovery> <entry>2004-02-12</entry>
</dates>
</vuln>
<vuln vid="5e92e8a2-5d7b-11d8-80e3-0020ed76ef5a">
- <topic>icecast 1.x multiple vulnerabilities</topic>
- <affects>
+ <topic>icecast 1.x multiple vulnerabilities</topic> <affects>
<package>
- <name>icecast</name>
- <range><lt>1.3.12</lt></range>
+ <name>icecast</name> <range><lt>1.3.12</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>icecast 1.3.11 and earlier contained numerous security
vulnerabilities, the most severe allowing a remote attacker
to execute arbitrary code as root.</p>
</body>
- </description>
- <references>
- <cvename>CVE-2002-0177</cvename>
- <cvename>CVE-2001-1230</cvename>
- <cvename>CVE-2001-1229</cvename>
- <cvename>CVE-2001-1083</cvename>
- <cvename>CVE-2001-0784</cvename>
- <bid>4415</bid>
- <bid>2933</bid>
- </references>
- <dates>
- <discovery>2002-04-28</discovery>
- <entry>2004-02-12</entry>
+ </description> <references>
+ <cvename>CVE-2002-0177</cvename> <cvename>CVE-2001-1230</cvename>
+ <cvename>CVE-2001-1229</cvename> <cvename>CVE-2001-1083</cvename>
+ <cvename>CVE-2001-0784</cvename> <bid>4415</bid> <bid>2933</bid>
+ </references> <dates>
+ <discovery>2002-04-28</discovery> <entry>2004-02-12</entry>
</dates>
</vuln>
<vuln vid="83119e27-5d7c-11d8-80e3-0020ed76ef5a">
- <topic>nap allows arbitrary file access</topic>
- <affects>
+ <topic>nap allows arbitrary file access</topic> <affects>
<package>
- <name>nap</name>
- <range><lt>1.4.5</lt></range>
+ <name>nap</name> <range><lt>1.4.5</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>According to the author:</p>
- <blockquote>
+ <p>According to the author:</p> <blockquote>
<p>Fixed security loophole which allowed remote
- clients to access arbitrary files on our
- system.</p>
+ clients to access arbitrary files on our system.</p>
</blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<url>http://quasar.mathstat.uottawa.ca/~selinger/nap/NEWS</url>
- </references>
- <dates>
- <discovery>2001-04-12</discovery>
- <entry>2004-02-12</entry>
+ </references> <dates>
+ <discovery>2001-04-12</discovery> <entry>2004-02-12</entry>
</dates>
</vuln>
<vuln vid="a736deab-5d7d-11d8-80e3-0020ed76ef5a">
- <topic>CCE contains exploitable buffer overflows</topic>
- <affects>
+ <topic>CCE contains exploitable buffer overflows</topic> <affects>
<package>
- <name>zh-cce</name>
- <range><lt>0.40</lt></range>
+ <name>zh-cce</name> <range><lt>0.40</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>The Chinese Console Environment contains exploitable buffer
+ <p>The Chinese Console Environment contains exploitable
+ buffer
overflows.</p>
</body>
- </description>
- <references>
+ </description> <references>
<url>http://programmer.lib.sjtu.edu.cn/cce/cce.html</url>
- </references>
- <dates>
- <discovery>2000-06-22</discovery>
- <entry>2004-02-12</entry>
+ </references> <dates>
+ <discovery>2000-06-22</discovery> <entry>2004-02-12</entry>
</dates>
</vuln>
<vuln vid="49ad1bf8-5d7e-11d8-80e3-0020ed76ef5a">
- <topic>ChiTeX/ChiLaTeX unsafe set-user-id root</topic>
- <affects>
+ <topic>ChiTeX/ChiLaTeX unsafe set-user-id root</topic> <affects>
<package>
- <name>zh-chitex</name>
- <range><gt>0</gt></range>
+ <name>zh-chitex</name> <range><gt>0</gt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>Niels Heinen reports that ChiTeX installs set-user-id root
+ <p>Niels Heinen reports that ChiTeX installs set-user-id
+ root
executables that invoked system(3) without setting up the
environment, trivially allowing local root compromise.</p>
</body>
- </description>
- <references>
+ </description> <references>
<url>http://cvsweb.freebsd.org/ports/chinese/chitex/Attic/Makefile?rev=1.5&amp;content-type=text/x-cvsweb-markup</url>
- </references>
- <dates>
- <discovery>2003-04-25</discovery>
- <entry>2004-02-12</entry>
+ </references> <dates>
+ <discovery>2003-04-25</discovery> <entry>2004-02-12</entry>
</dates>
</vuln>
@@ -21359,91 +17539,68 @@ misc.c:
<topic>pine remotely exploitable buffer overflow in newmail.c</topic>
<affects>
<package>
- <name>zh-pine</name>
- <name>iw-pine</name>
- <name>pine</name>
- <name>pine4-ssl</name>
- <range><le>4.21</le></range>
+ <name>zh-pine</name> <name>iw-pine</name> <name>pine</name>
+ <name>pine4-ssl</name> <range><le>4.21</le></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>Kris Kennaway reports a remotely exploitable buffer overflow
+ <p>Kris Kennaway reports a remotely exploitable buffer
+ overflow
in newmail.c. Mike Silbersack submitted the fix.</p>
</body>
- </description>
- <references>
+ </description> <references>
<url>http://www.freebsd.org/cgi/cvsweb.cgi/ports/mail/pine4/Makefile?rev=1.43&amp;content-type=text/x-cvsweb-markup</url>
- </references>
- <dates>
- <discovery>2000-09-29</discovery>
- <entry>2004-02-12</entry>
+ </references> <dates>
+ <discovery>2000-09-29</discovery> <entry>2004-02-12</entry>
</dates>
</vuln>
<vuln vid="34134fd4-5d81-11d8-80e3-0020ed76ef5a">
- <topic>pine insecure URL handling</topic>
- <affects>
+ <topic>pine insecure URL handling</topic> <affects>
<package>
- <name>pine</name>
- <name>zh-pine</name>
- <name>iw-pine</name>
+ <name>pine</name> <name>zh-pine</name> <name>iw-pine</name>
<range><lt>4.44</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>An attacker may send an email message containing a specially
+ <p>An attacker may send an email message containing a
+ specially
constructed URL that will execute arbitrary commands when
viewed.</p>
</body>
- </description>
- <references>
+ </description> <references>
<freebsdsa>SA-02:05.pine</freebsdsa>
- </references>
- <dates>
- <discovery>2002-01-04</discovery>
- <entry>2004-02-12</entry>
+ </references> <dates>
+ <discovery>2002-01-04</discovery> <entry>2004-02-12</entry>
</dates>
</vuln>
<vuln vid="5abfee2d-5d82-11d8-80e3-0020ed76ef5a">
- <topic>pine remote denial-of-service attack</topic>
- <affects>
+ <topic>pine remote denial-of-service attack</topic> <affects>
<package>
- <name>pine</name>
- <name>zh-pine</name>
- <name>iw-pine</name>
+ <name>pine</name> <name>zh-pine</name> <name>iw-pine</name>
<range><lt>4.50</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>An attacker may send a specially-formatted email message
that will cause pine to crash.</p>
</body>
- </description>
- <references>
+ </description> <references>
<mlist>http://marc.theaimsgroup.com/?l=bugtraq&amp;m=103668430620531&amp;w=2</mlist>
<cvename>CVE-2002-1320</cvename>
- </references>
- <dates>
- <discovery>2002-10-23</discovery>
- <entry>2004-02-12</entry>
+ </references> <dates>
+ <discovery>2002-10-23</discovery> <entry>2004-02-12</entry>
</dates>
</vuln>
<vuln vid="39bd57e6-5d83-11d8-80e3-0020ed76ef5a">
- <topic>pine remotely exploitable vulnerabilities</topic>
- <affects>
+ <topic>pine remotely exploitable vulnerabilities</topic> <affects>
<package>
- <name>pine</name>
- <name>zh-pine</name>
- <name>iw-pine</name>
+ <name>pine</name> <name>zh-pine</name> <name>iw-pine</name>
<range><lt>4.58</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Pine versions prior to 4.58 are affected by two
vulnerabilities discovered by iDEFENSE, a buffer overflow
@@ -21451,98 +17608,76 @@ misc.c:
vulnerabilities can result in arbitrary code execution
when processing a malicious message.</p>
</body>
- </description>
- <references>
- <cvename>CVE-2003-0720</cvename>
- <cvename>CVE-2003-0721</cvename>
+ </description> <references>
+ <cvename>CVE-2003-0720</cvename> <cvename>CVE-2003-0721</cvename>
<url>http://www.idefense.com/application/poi/display?id=5</url>
- </references>
- <dates>
- <discovery>2003-09-10</discovery>
- <entry>2004-02-12</entry>
+ </references> <dates>
+ <discovery>2003-09-10</discovery> <entry>2004-02-12</entry>
</dates>
</vuln>
<vuln vid="5729b8ed-5d75-11d8-80e3-0020ed76ef5a">
- <topic>rsync buffer overflow in server mode</topic>
- <affects>
+ <topic>rsync buffer overflow in server mode</topic> <affects>
<package>
- <name>rsync</name>
- <range><lt>2.5.7</lt></range>
+ <name>rsync</name> <range><lt>2.5.7</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>When rsync is run in server mode, a buffer overflow could
- allow a remote attacker to execute arbitrary code with the
- privileges of the rsync server. Anonymous rsync servers are
- at the highest risk.</p>
+ allow a remote attacker to execute arbitrary code with
+ the privileges of the rsync server. Anonymous rsync
+ servers are at the highest risk.</p>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2003-0962</cvename>
<mlist>http://lists.samba.org/archive/rsync-announce/2003/000011.html</mlist>
<url>http://rsync.samba.org/#security</url>
- </references>
- <dates>
- <discovery>2003-12-04</discovery>
- <entry>2004-02-12</entry>
+ </references> <dates>
+ <discovery>2003-12-04</discovery> <entry>2004-02-12</entry>
</dates>
</vuln>
<vuln vid="3388eff9-5d6e-11d8-80e3-0020ed76ef5a">
- <topic>Samba 3.0.x password initialization bug</topic>
- <affects>
+ <topic>Samba 3.0.x password initialization bug</topic> <affects>
<package>
- <name>samba</name>
- <range><ge>3.0,1</ge><lt>3.0.1_2,1</lt></range>
+ <name>samba</name> <range><ge>3.0,1</ge><lt>3.0.1_2,1</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>From the Samba 3.0.2 release notes:</p>
- <blockquote cite="http://www.samba.org/samba/whatsnew/samba-3.0.2.html">
+ <p>From the Samba 3.0.2 release notes:</p> <blockquote
+ cite="http://www.samba.org/samba/whatsnew/samba-3.0.2.html">
<p>Security Announcement: It has been confirmed that
- previous versions of Samba 3.0 are susceptible to a password
- initialization bug that could grant an attacker unauthorized
- access to a user account created by the mksmbpasswd.sh shell
- script.</p>
+ previous versions of Samba 3.0 are susceptible to a
+ password initialization bug that could grant an attacker
+ unauthorized access to a user account created by the
+ mksmbpasswd.sh shell script.</p>
</blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<url>http://www.samba.org/samba/whatsnew/samba-3.0.2.html</url>
<cvename>CVE-2004-0082</cvename>
- </references>
- <dates>
- <discovery>2004-02-09</discovery>
- <entry>2004-02-12</entry>
+ </references> <dates>
+ <discovery>2004-02-09</discovery> <entry>2004-02-12</entry>
</dates>
</vuln>
<vuln vid="67c05283-5d62-11d8-80e3-0020ed76ef5a">
- <topic>Buffer overflow in Mutt 1.4</topic>
- <affects>
+ <topic>Buffer overflow in Mutt 1.4</topic> <affects>
<package>
- <name>mutt</name>
- <name>ja-mutt</name>
+ <name>mutt</name> <name>ja-mutt</name>
<range><ge>1.4</ge><lt>1.4.2</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mutt 1.4 contains a buffer overflow that could be exploited
- with a specially formed message, causing Mutt to crash or
- possibly execute arbitrary code.</p>
+ with a specially formed message, causing Mutt to crash
+ or possibly execute arbitrary code.</p>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2004-0078</cvename>
<url>http://www.mutt.org/news.html</url>
- </references>
- <dates>
- <discovery>2004-02-11</discovery>
- <entry>2004-02-12</entry>
+ </references> <dates>
+ <discovery>2004-02-11</discovery> <entry>2004-02-12</entry>
</dates>
</vuln>
@@ -21550,18 +17685,15 @@ misc.c:
<topic>Apache-SSL optional client certificate vulnerability</topic>
<affects>
<package>
- <name>apache+ssl</name>
- <range><lt>1.3.29.1.53</lt></range>
+ <name>apache+ssl</name> <range><lt>1.3.29.1.53</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>From the Apache-SSL security advisory:</p>
- <blockquote>
+ <p>From the Apache-SSL security advisory:</p> <blockquote>
<p>If configured with SSLVerifyClient set to 1 or 3 (client
certificates optional) and SSLFakeBasicAuth, Apache-SSL
- 1.3.28+1.52 and all earlier versions would permit a
- client to use real basic authentication to forge a client
+ 1.3.28+1.52 and all earlier versions would permit a client
+ to use real basic authentication to forge a client
certificate.</p>
<p>All the attacker needed is the "one-line DN" of a valid
@@ -21569,46 +17701,35 @@ misc.c:
fixed password ("password" by default).</p>
</blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<url>http://www.apache-ssl.org/advisory-20040206.txt</url>
- </references>
- <dates>
- <discovery>2004-02-06</discovery>
- <entry>2004-02-10</entry>
+ </references> <dates>
+ <discovery>2004-02-06</discovery> <entry>2004-02-10</entry>
</dates>
</vuln>
<vuln vid="96ba2dae-4ab0-11d8-96f2-0020ed76ef5a">
- <topic>L2TP, ISAKMP, and RADIUS parsing vulnerabilities in tcpdump</topic>
- <affects>
+ <topic>L2TP, ISAKMP, and RADIUS parsing vulnerabilities in
+ tcpdump</topic> <affects>
<package>
- <name>tcpdump</name>
- <range><lt>3.8.1_351</lt></range>
- </package>
- <system>
- <name>FreeBSD</name>
- <range><lt>5.2.1</lt></range>
+ <name>tcpdump</name> <range><lt>3.8.1_351</lt></range>
+ </package> <system>
+ <name>FreeBSD</name> <range><lt>5.2.1</lt></range>
</system>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jonathan Heusser discovered vulnerabilities in tcpdump's
L2TP, ISAKMP, and RADIUS protocol handlers. These
vulnerabilities may be used by an attacker to crash a running
`tcpdump' process.</p>
</body>
- </description>
- <references>
- <cvename>CVE-2003-0989</cvename>
- <cvename>CVE-2003-1029</cvename>
+ </description> <references>
+ <cvename>CVE-2003-0989</cvename> <cvename>CVE-2003-1029</cvename>
<cvename>CVE-2004-0057</cvename>
<mlist>http://www.tcpdump.org/lists/workers/2003/12/msg00083.html</mlist>
<mlist>http://marc.theaimsgroup.com/?l=tcpdump-workers&amp;m=107325073018070&amp;w=2</mlist>
- </references>
- <dates>
- <discovery>2003-12-24</discovery>
- <entry>2004-01-19</entry>
+ </references> <dates>
+ <discovery>2003-12-24</discovery> <entry>2004-01-19</entry>
</dates>
</vuln>
@@ -21616,86 +17737,75 @@ misc.c:
<topic>Buffer overflow in INN control message handling</topic>
<affects>
<package>
- <name>inn</name>
- <range><ge>2.4.*</ge><lt>2.4.1</lt></range>
- </package>
- <package>
- <name>inn-stable</name>
- <range><lt>20031022_1</lt></range>
+ <name>inn</name> <range><ge>2.4.*</ge><lt>2.4.1</lt></range>
+ </package> <package>
+ <name>inn-stable</name> <range><lt>20031022_1</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A small, fixed-size stack buffer is used to construct a
filename based on a received control message. This could
result in a stack buffer overflow.</p>
</body>
- </description>
- <references>
- <mlist msgid="87d69v7222.fsf@windlord.stanford.edu">http://marc.theaimsgroup.com/?l=inn-workers&amp;m=107351974008605</mlist>
- </references>
- <dates>
- <discovery>2004-01-07</discovery>
- <entry>2004-01-08</entry>
+ </description> <references>
+ <mlist
+ msgid="87d69v7222.fsf@windlord.stanford.edu">http://marc.theaimsgroup.com/?l=inn-workers&amp;m=107351974008605</mlist>
+ </references> <dates>
+ <discovery>2004-01-07</discovery> <entry>2004-01-08</entry>
<modified>2004-10-21</modified>
</dates>
</vuln>
<vuln vid="cf0fb426-3f96-11d8-b096-0020ed76ef5a">
- <topic>ProFTPD ASCII translation bug resulting in remote root compromise</topic>
- <affects>
+ <topic>ProFTPD ASCII translation bug resulting in remote root
+ compromise</topic> <affects>
<package>
- <name>proftpd</name>
- <range><lt>1.2.8_1</lt></range>
+ <name>proftpd</name> <range><lt>1.2.8_1</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A buffer overflow exists in the ProFTPD code that handles
translation of newline characters during ASCII-mode file
- uploads. An attacker may exploit this buffer overflow by
- uploading a specially crafted file, resulting in code
+ uploads. An attacker may exploit this buffer overflow
+ by uploading a specially crafted file, resulting in code
execution and ultimately a remote root compromise.</p>
</body>
- </description>
- <references>
+ </description> <references>
<url>http://xforce.iss.net/xforce/alerts/id/154</url>
<cvename>CVE-2003-0831</cvename>
- </references>
- <dates>
- <discovery>2003-09-23</discovery>
- <entry>2004-01-05</entry>
+ </references> <dates>
+ <discovery>2003-09-23</discovery> <entry>2004-01-05</entry>
</dates>
</vuln>
<vuln vid="81313647-2d03-11d8-9355-0020ed76ef5a">
- <topic>ElGamal sign+encrypt keys created by GnuPG can be compromised</topic>
- <affects>
+ <topic>ElGamal sign+encrypt keys created by GnuPG can be
+ compromised</topic> <affects>
<package>
- <name>gnupg</name>
- <range><ge>1.0.2</ge><lt>1.2.3_4</lt></range>
+ <name>gnupg</name> <range><ge>1.0.2</ge><lt>1.2.3_4</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>Any ElGamal sign+encrypt keys created by GnuPG contain a
+ <p>Any ElGamal sign+encrypt keys created by GnuPG contain
+ a
cryptographic weakness that may allow someone to obtain
the private key. <strong>These keys should be considered
unusable and should be revoked.</strong></p>
<p>The following summary was written by Werner Koch, GnuPG
author:</p>
- <blockquote cite="http://lists.gnupg.org/pipermail/gnupg-devel/2003-November/020570.html">
+ <blockquote
+ cite="http://lists.gnupg.org/pipermail/gnupg-devel/2003-November/020570.html">
<p>Phong Nguyen identified a severe bug in the way GnuPG
- creates and uses ElGamal keys for signing. This is
- a significant security failure which can lead to a
+ creates and uses ElGamal keys for signing. This is a
+ significant security failure which can lead to a
compromise of almost all ElGamal keys used for signing.
Note that this is a real world vulnerability which will
reveal your private key within a few seconds.</p>
- <p>...</p>
- <p>Please <em>take immediate action and revoke your ElGamal
+ <p>...</p> <p>Please <em>take immediate action and revoke
+ your ElGamal
signing keys</em>. Furthermore you should take whatever
- measures necessary to limit the damage done for signed or
- encrypted documents using that key.</p>
+ measures necessary to limit the damage done for signed
+ or encrypted documents using that key.</p>
<p>Note that the standard keys as generated by GnuPG (DSA
and ElGamal encryption) as well as RSA keys are NOT
vulnerable. Note also that ElGamal signing keys cannot
@@ -21705,111 +17815,84 @@ misc.c:
identify vulnerable keys.</p>
</blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2003-0971</cvename>
<mlist>http://lists.gnupg.org/pipermail/gnupg-devel/2003-November/020570.html</mlist>
- </references>
- <dates>
- <discovery>2003-11-27</discovery>
- <entry>2003-12-12</entry>
+ </references> <dates>
+ <discovery>2003-11-27</discovery> <entry>2003-12-12</entry>
</dates>
</vuln>
<vuln vid="96fdbf5b-2cfd-11d8-9355-0020ed76ef5a">
- <topic>Mathopd buffer overflow</topic>
- <affects>
+ <topic>Mathopd buffer overflow</topic> <affects>
<package>
- <name>mathopd</name>
- <range><lt>1.4p2</lt></range>
+ <name>mathopd</name> <range><lt>1.4p2</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mathopd contains a buffer overflow in the prepare_reply()
function that may be remotely exploitable.</p>
</body>
- </description>
- <references>
+ </description> <references>
<url>http://www.mail-archive.com/mathopd%40mathopd.org/msg00136.html</url>
- </references>
- <dates>
- <discovery>2003-12-04</discovery>
- <entry>2003-12-12</entry>
+ </references> <dates>
+ <discovery>2003-12-04</discovery> <entry>2003-12-12</entry>
</dates>
</vuln>
<vuln vid="d7af61c8-2cc0-11d8-9355-0020ed76ef5a">
- <topic>lftp HTML parsing vulnerability</topic>
- <affects>
+ <topic>lftp HTML parsing vulnerability</topic> <affects>
<package>
- <name>lftp</name>
- <range><le>2.6.10</le></range>
+ <name>lftp</name> <range><le>2.6.10</le></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>A buffer overflow exists in lftp which may be triggered when
- requesting a directory listing from a malicious server over
- HTTP.</p>
+ <p>A buffer overflow exists in lftp which may be triggered
+ when
+ requesting a directory listing from a malicious server
+ over HTTP.</p>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2003-0963</cvename>
<url>http://lftp.yar.ru/news.html#2.6.10</url>
- </references>
- <dates>
- <discovery>2003-12-11</discovery>
- <entry>2003-12-12</entry>
+ </references> <dates>
+ <discovery>2003-12-11</discovery> <entry>2003-12-12</entry>
</dates>
</vuln>
<vuln vid="ebdf65c7-2ca6-11d8-9355-0020ed76ef5a">
- <topic>qpopper format string vulnerability</topic>
- <affects>
+ <topic>qpopper format string vulnerability</topic> <affects>
<package>
- <name>qpopper</name>
- <range><lt>2.53_1</lt></range>
+ <name>qpopper</name> <range><lt>2.53_1</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>An authenticated user may trigger a format string
vulnerability present in qpopper's UIDL code, resulting
in arbitrary code execution with group ID `mail'
privileges.</p>
</body>
- </description>
- <references>
- <bid>1241</bid>
- <cvename>CVE-2000-0442</cvename>
+ </description> <references>
+ <bid>1241</bid> <cvename>CVE-2000-0442</cvename>
<url>http://www.netsys.com/suse-linux-security/2000-May/att-0137/01-b0f5-Qpopper.txt</url>
- </references>
- <dates>
- <discovery>2000-05-23</discovery>
- <entry>2003-12-12</entry>
+ </references> <dates>
+ <discovery>2000-05-23</discovery> <entry>2003-12-12</entry>
</dates>
</vuln>
<vuln vid="af0296be-2455-11d8-82e5-0020ed76ef5a">
- <topic>Fetchmail address parsing vulnerability</topic>
- <affects>
+ <topic>Fetchmail address parsing vulnerability</topic> <affects>
<package>
- <name>fetchmail</name>
- <range><le>6.2.0</le></range>
+ <name>fetchmail</name> <range><le>6.2.0</le></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Fetchmail can be crashed by a malicious email message.</p>
</body>
- </description>
- <references>
+ </description> <references>
<url>http://security.e-matters.de/advisories/052002.html</url>
- </references>
- <dates>
- <discovery>2003-10-25</discovery>
- <entry>2003-10-25</entry>
+ </references> <dates>
+ <discovery>2003-10-25</discovery> <entry>2003-10-25</entry>
</dates>
</vuln>
@@ -21817,52 +17900,40 @@ misc.c:
<topic>Buffer overflow in pam_smb password handling</topic>
<affects>
<package>
- <name>pam_smb</name>
- <range><lt>1.9.9_3</lt></range>
+ <name>pam_smb</name> <range><lt>1.9.9_3</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Applications utilizing pam_smb can be compromised by
- any user who can enter a password. In many cases,
- this is a remote root compromise.</p>
+ any user who can enter a password. In many cases, this
+ is a remote root compromise.</p>
</body>
- </description>
- <references>
+ </description> <references>
<url>http://www.skynet.ie/~airlied/pam_smb/</url>
<cvename>CVE-2003-0686</cvename>
- </references>
- <dates>
- <discovery>2003-10-25</discovery>
- <entry>2003-10-25</entry>
+ </references> <dates>
+ <discovery>2003-10-25</discovery> <entry>2003-10-25</entry>
<modified>2003-10-25</modified>
</dates>
</vuln>
<vuln vid="c4b7badf-24ca-11d8-82e5-0020ed76ef5a">
- <topic>Buffer overflows in libmcrypt</topic>
- <affects>
+ <topic>Buffer overflows in libmcrypt</topic> <affects>
<package>
- <name>libmcrypt</name>
- <range><lt>2.5.6</lt></range>
+ <name>libmcrypt</name> <range><lt>2.5.6</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>libmcrypt does incomplete input validation, leading to
- several buffer overflows. Additionally,
- a memory leak is present. Both of these problems may be
- exploited in a denial-of-service attack.</p>
+ several buffer overflows. Additionally, a memory leak
+ is present. Both of these problems may be exploited in
+ a denial-of-service attack.</p>
</body>
- </description>
- <references>
+ </description> <references>
<mlist>http://marc.theaimsgroup.com/?l=bugtraq&amp;m=104162752401212&amp;w=2</mlist>
- <cvename>CVE-2003-0031</cvename>
- <cvename>CVE-2003-0032</cvename>
- </references>
- <dates>
- <discovery>2003-10-25</discovery>
- <entry>2003-10-25</entry>
+ <cvename>CVE-2003-0031</cvename> <cvename>CVE-2003-0032</cvename>
+ </references> <dates>
+ <discovery>2003-10-25</discovery> <entry>2003-10-25</entry>
<modified>2003-10-25</modified>
</dates>
</vuln>
@@ -21876,87 +17947,76 @@ misc.c:
</vuln>
<vuln vid="e3cf89f0-53da-11d9-92b7-ceadd4ac2edd">
- <topic>phpbb -- arbitrary command execution and other vulnerabilities</topic>
- <affects>
+ <topic>phpbb -- arbitrary command execution and other
+ vulnerabilities</topic> <affects>
<package>
- <name>phpbb</name>
- <range><lt>2.0.11</lt></range>
+ <name>phpbb</name> <range><lt>2.0.11</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>The ChangeLog for phpBB 2.0.11 states:</p>
- <blockquote cite="http://www.phpbb.com/support/documents.php?mode=changelog">
- <p>Changes since 2.0.10</p>
- <ul>
+ <p>The ChangeLog for phpBB 2.0.11 states:</p> <blockquote
+ cite="http://www.phpbb.com/support/documents.php?mode=changelog">
+ <p>Changes since 2.0.10</p> <ul>
<li>Fixed vulnerability in highlighting code (<strong>very
- high severity, please update your installation as soon
- as possible</strong>)</li>
+ high severity, please update your installation as
+ soon as possible</strong>)</li>
<li>Fixed unsetting global vars - <strong>Matt
Kavanagh</strong></li>
<li>Fixed XSS vulnerability in username handling
- <strong>AnthraX101</strong></li>
- <li>Fixed not confirmed sql injection in username handling
+ <li>Fixed not confirmed sql injection in username
+ handling
- <strong>warmth</strong></li>
<li>Added check for empty topic id in topic_review
function</li>
<li>Added visual confirmation mod to code base</li>
</ul>
- </blockquote>
- <p>Additionally, a US-CERT Technical Cyber Security Alert reports:</p>
- <blockquote
- cite="http://www.us-cert.gov/cas/techalerts/TA04-356A.html">
- <p>phpBB contains an user input validation problem with
- regard to the parsing of the URL. An intruder can deface a
- phpBB website, execute arbitrary commands, or gain
+ </blockquote> <p>Additionally, a US-CERT Technical Cyber
+ Security Alert reports:</p> <blockquote
+ cite="http://www.us-cert.gov/cas/techalerts/TA04-356A.html">
+ <p>phpBB contains an user input validation problem with
+ regard to the parsing of the URL. An intruder can deface
+ a phpBB website, execute arbitrary commands, or gain
administrative privileges on a compromised bulletin
board.</p>
</blockquote>
</body>
- </description>
- <references>
- <cvename>CVE-2004-1315</cvename>
- <freebsdpr>ports/74106</freebsdpr>
- <uscertta>TA04-356A</uscertta>
- <certvu>497400</certvu>
+ </description> <references>
+ <cvename>CVE-2004-1315</cvename> <freebsdpr>ports/74106</freebsdpr>
+ <uscertta>TA04-356A</uscertta> <certvu>497400</certvu>
<url>http://www.phpbb.com/support/documents.php?mode=changelog</url>
- <mlist msgid="20041113030542.11396.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110029415208724</mlist>
- <mlist msgid="20041118123055.28647.qmail@mail.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110079436714518</mlist>
+ <mlist
+ msgid="20041113030542.11396.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110029415208724</mlist>
+ <mlist
+ msgid="20041118123055.28647.qmail@mail.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110079436714518</mlist>
<url>http://www.phpbb.com/phpBB/viewtopic.php?f=14&amp;t=240636</url>
- </references>
- <dates>
- <discovery>2004-11-18</discovery>
- <entry>2004-12-22</entry>
+ </references> <dates>
+ <discovery>2004-11-18</discovery> <entry>2004-12-22</entry>
<modified>2005-01-24</modified>
</dates>
</vuln>
<vuln vid="a395397c-c7c8-11d9-9e1e-c296ac722cb3">
- <topic>squid -- possible abuse of cachemgr.cgi</topic>
- <affects>
+ <topic>squid -- possible abuse of cachemgr.cgi</topic> <affects>
<package>
- <name>squid</name>
- <range><lt>2.5.10</lt></range>
+ <name>squid</name> <range><lt>2.5.10</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>The squid patches page notes:</p>
- <blockquote cite="http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE9-cachemgr_conf">
- <p>This patch adds access controls to the cachemgr.cgi script,
- preventing it from being abused to reach other servers than
- allowed in a local configuration file.</p>
+ <p>The squid patches page notes:</p> <blockquote
+ cite="http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE9-cachemgr_conf">
+ <p>This patch adds access controls to the cachemgr.cgi
+ script,
+ preventing it from being abused to reach other servers
+ than allowed in a local configuration file.</p>
</blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-1999-0710</cvename>
<url>http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE9-cachemgr_conf</url>
<url>http://www.squid-cache.org/bugs/show_bug.cgi?id=1094</url>
- </references>
- <dates>
- <discovery>1999-07-29</discovery>
- <entry>2005-05-19</entry>
+ </references> <dates>
+ <discovery>1999-07-29</discovery> <entry>2005-05-19</entry>
</dates>
</vuln>
@@ -21964,44 +18024,37 @@ misc.c:
<topic>squid -- DNS lookup spoofing vulnerability</topic>
<affects>
<package>
- <name>squid</name>
- <range><lt>2.5.10</lt></range>
+ <name>squid</name> <range><lt>2.5.10</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>The squid patches page notes:</p>
- <blockquote cite="http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE9-dns_query">
- <p>Malicious users may spoof DNS lookups if the DNS client UDP port
- (random, assigned by OS as startup) is unfiltered and your network
- is not protected from IP spoofing.</p>
+ <p>The squid patches page notes:</p> <blockquote
+ cite="http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE9-dns_query">
+ <p>Malicious users may spoof DNS lookups if the DNS client
+ UDP port
+ (random, assigned by OS as startup) is unfiltered and
+ your network is not protected from IP spoofing.</p>
</blockquote>
</body>
- </description>
- <references>
+ </description> <references>
<cvename>CVE-2005-1519</cvename>
<url>http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE9-dns_reply</url>
<url>http://secunia.com/advisories/15294</url>
- </references>
- <dates>
- <discovery>2005-05-11</discovery>
- <entry>2005-05-19</entry>
+ </references> <dates>
+ <discovery>2005-05-11</discovery> <entry>2005-05-19</entry>
</dates>
</vuln>
<vuln vid="55041d37-ff62-11d9-a9a5-000ae4641456">
- <topic>jabberd -- 3 buffer overflows</topic>
- <affects>
+ <topic>jabberd -- 3 buffer overflows</topic> <affects>
<package>
- <name>jabberd</name>
- <range><lt>2.0.9</lt></range>
+ <name>jabberd</name> <range><lt>2.0.9</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>There are 3 buffer overflows in jid.c that are triggered
- during parsing of JID strings when components (user, host or
- resource) are too long.</p>
+ during parsing of JID strings when components (user, host
+ or resource) are too long.</p>
<ol>
<li>jid.c, line 103: overflow in `str' buffer through
<code>strcpy()</code> when "user" part is too long.</li>
@@ -22010,48 +18063,40 @@ misc.c:
<li>jid.c, line 127: overflow in `str' buffer through
<code>strcpy()</code> when "resource" part is too
long.</li>
- </ol>
- <p>These overflows can be used to perform a DoS attack on the
- server (sm process segfaults) and can possible be used for
- arbitrary code execution.</p>
+ </ol> <p>These overflows can be used to perform a DoS attack
+ on the
+ server (sm process segfaults) and can possible be used
+ for arbitrary code execution.</p>
</body>
- </description>
- <references>
+ </description> <references>
<url>http://j2.openaether.org/bugzilla/show_bug.cgi?id=99</url>
- </references>
- <dates>
- <discovery>2005-07-25</discovery>
- <entry>2005-07-30</entry>
+ </references> <dates>
+ <discovery>2005-07-25</discovery> <entry>2005-07-30</entry>
</dates>
</vuln>
<vuln vid="44e7764c-2614-11da-9e1e-c296ac722cb3">
- <topic>squid -- possible denial of service condition regarding NTLM authentication</topic>
- <affects>
+ <topic>squid -- possible denial of service condition regarding
+ NTLM authentication</topic> <affects>
<package>
- <name>squid</name>
- <range><lt>2.5.10_6</lt></range>
+ <name>squid</name> <range><lt>2.5.10_6</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>The squid patches page notes:</p>
- <blockquote cite="http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE10-NTLM-scheme_assert">
- <p>Squid may crash with the above error [FATAL: Incorrect scheme in auth header] when given certain request sentences.</p>
- <p>Workaround: disable NTLM authentication.</p>
+ <p>The squid patches page notes:</p> <blockquote
+ cite="http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE10-NTLM-scheme_assert">
+ <p>Squid may crash with the above error [FATAL: Incorrect
+ scheme in auth header] when given certain request
+ sentences.</p> <p>Workaround: disable NTLM authentication.</p>
</blockquote>
</body>
- </description>
- <references>
- <bid>14977</bid>
- <cvename>CVE-2005-2917</cvename>
+ </description> <references>
+ <bid>14977</bid> <cvename>CVE-2005-2917</cvename>
<url>http://www.squid-cache.org/bugs/show_bug.cgi?id=1391</url>
<url>http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE10-NTLM-scheme_assert</url>
<url>http://secunia.com/advisories/16992/</url>
- </references>
- <dates>
- <discovery>2005-09-12</discovery>
- <entry>2005-09-15</entry>
+ </references> <dates>
+ <discovery>2005-09-12</discovery> <entry>2005-09-15</entry>
<modified>2005-10-02</modified>
</dates>
</vuln>
@@ -22061,36 +18106,26 @@ misc.c:
remote code execution</topic>
<affects>
<package>
- <name>phpmyfaq</name>
- <range><lt>1.5.2</lt></range>
+ <name>phpmyfaq</name> <range><lt>1.5.2</lt></range>
</package>
- </affects>
- <description>
+ </affects> <description>
<body xmlns="http://www.w3.org/1999/xhtml">
- <p>If magic quotes are off there's a SQL injection when
+ <p>If magic quotes are off there's a SQL injection when
sending a forgotten password. It's possible to overwrite
the admin password and to take over the whole system. In
some files in the admin section there are some cross site
scripting vulnerabilities. In the public frontend it's
possible to include arbitrary php files.</p>
</body>
- </description>
- <references>
- <bid>14927</bid>
- <bid>14928</bid>
- <bid>14929</bid>
- <bid>14930</bid>
- <cvename>CVE-2005-3046</cvename>
- <cvename>CVE-2005-3047</cvename>
- <cvename>CVE-2005-3048</cvename>
- <cvename>CVE-2005-3049</cvename>
+ </description> <references>
+ <bid>14927</bid> <bid>14928</bid> <bid>14929</bid> <bid>14930</bid>
+ <cvename>CVE-2005-3046</cvename> <cvename>CVE-2005-3047</cvename>
+ <cvename>CVE-2005-3048</cvename> <cvename>CVE-2005-3049</cvename>
<cvename>CVE-2005-3050</cvename>
<url>http://www.phpmyfaq.de/advisory_2005-09-23.php</url>
- </references>
- <dates>
- <discovery>2005-09-23</discovery>
- <entry>2005-09-29</entry>
+ </references> <dates>
+ <discovery>2005-09-23</discovery> <entry>2005-09-29</entry>
</dates>
</vuln>
-</vuxml>
-<!-- Note: Please add new entries to the beginning of this file. -->
+</vuxml> <!-- Note: Please add new entries to the beginning of
+this file. -->
generated by cgit (git 2.34.1) at 2024-11-22 21:19:53 +0800