- <name>ruby</name>

- <name>ruby_static</name>

- </affects>

- <description>

- <p>Ruby home page reports:</p>

- <blockquote cite="http://www.ruby-lang.org/en/20051003.html">

- <p>By using the vulnerability, arbitrary code can be executed

- Therefore, Ruby has to be updated on all systems that use

- safe level to execute untrusted code.</p>

- </description>

- <references>

- </references>

- <dates>

- <discovery>2005-10-02</discovery>

- <entry>2005-10-27</entry>

- <topic>xloadimage -- buffer overflows in NIFF image title handling</topic>

- <affects>

- <name>xloadimage</name>

- <range><lt>4.1.15</lt></range>

- <package>

- <name>xli</name>

- <range><lt>1.17.0_4</lt></range>

- </package>

- </affects>

- <description>

- <p>Ariel Berkman reports:</p>

- <blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=112862493918840&amp;w=2">

- </description>

- <references>

- <bid>15051</bid>

- <cvename>CVE-2005-3178</cvename>

- <mlist msgid="BOEKKJLADFNHIEFBHCECMEONCFAA.aberkm1@uic.edu">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=112862493918840&amp;w=2</mlist>

- </references>

- <dates>

- <discovery>2005-10-05</discovery>

- <entry>2005-10-20</entry>

- <name>snort</name>

- <range><ge>2.4.0</ge><lt>2.4.3</lt></range>

- </affects>

- <description>

- <p>Jennifer Steffens reports:</p>

- <blockquote cite="http://www.snort.org/pub-bin/snortnews.cgi#99">

- buffer overflow. This vulnerability could be leveraged by

- an attacker to execute code remotely on a Snort sensor

- where the Back Orifice preprocessor is enabled. However,

- there are a number of factors that make remote code

- execution difficult to achieve across different builds of

- Snort on different platforms, even on the same platform

- with different compiler versions, and it is more likely

- that an attacker could use the vulnerability as a denial

- of service attack.</p>

- commenting out the line "preprocessor bo" in

- snort.conf. This can be done in any text editor using the

- following procedure:</p>

- <li>Locate the line "preprocessor bo"</li>

- <li>Comment out this line by preceding it with a hash

- (#). The new line will look like "#preprocessor bo"</li>

- <li>Save the file</li>

- <li>Restart snort</li>

- </description>

- <references>

- </references>

- <dates>

- <discovery>2005-10-18</discovery>

- <entry>2005-10-18</entry>

- <topic>webcalendar -- multiple reports of websites getting defaced</topic>

- <affects>

- <name>WebCalendar</name>

- <range><lt>1.0.1</lt></range>

- </affects>

- <description>

- </description>

- <references>

- </references>

- <dates>

- <discovery>2005-08-26</discovery>

- <entry>2005-10-15</entry>

- <name>gallery2</name>

- <range><lt>2.0.1</lt></range>

- </affects>

- <description>

- <p>Michael Dipper wrote:</p>

- <blockquote cite="http://dipper.info/security/20051012/">

- the webserver process are subject to disclosure.

- The vulnerability is *not* restricted to the webserver's

- document root but extends to the whole server file space.</p>

- </description>

- <references>

- </references>

- <dates>

- <discovery>2005-10-12</discovery>

- <entry>2005-10-15</entry>

- <topic>openssl -- potential SSL 2.0 rollback</topic>

- <affects>

- <name>openssl</name>

- <name>openssl-overwrite-base</name>

- </package>

- <package>

- <name>openssl-beta</name>

- <name>openssl-beta-overwrite-base</name>

- </package>

- <package>

- <name>compat5x-alpha</name>

- <name>compat5x-amd64</name>

- <name>compat5x-i386</name>

- <name>compat5x-sparc64</name>

- </package>

- <system>

- <name>FreeBSD</name>

- <range><lt>4.10_19</lt></range>

- </affects>

- <description>

- <p>Vulnerability:</p>

- <blockquote cite="http://www.openssl.org/news/secadv_20051011.txt">

- SSL_OP_MSIE_SSLV2_RSA_PADDING. This option is implied by use of

- SSL_OP_ALL, which is intended to work around various bugs in

- third-party software that might prevent interoperability. The

- SSL_OP_MSIE_SSLV2_RSA_PADDING option disables a verification step in

- the SSL 2.0 server supposed to prevent active protocol-version

- rollback attacks. With this verification step disabled, an attacker

- acting as a "man in the middle" can force a client and a server to

- negotiate the SSL 2.0 protocol even if these parties both support SSL

- 3.0 or TLS 1.0. The SSL 2.0 protocol is known to have severe

- cryptographic weaknesses and is supported as a fallback only.</p>

- <p>Applications using neither SSL_OP_MSIE_SSLV2_RSA_PADDING nor

- SSL_OP_ALL are not affected. Also, applications that disable

- use of SSL 2.0 are not affected.</p>

- </blockquote>

- </body>

- </description>

- <references>

- </references>

- <dates>

- <discovery>2005-10-11</discovery>

- <entry>2005-10-12</entry>

- </affects>

- <description>

- <p>A phpMyAdmin security announcement reports:</p>

- <blockquote cite="http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-4">

- parameter was not correctly validated, opening the door to

- a local file inclusion attack.</p>

- </description>

- <references>

- <bid>15053</bid>

- <mlist msgid="20051010161119.1689.qmail@securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=112907764728209</mlist>

- </references>

- <dates>

- <discovery>2005-10-11</discovery>

- <entry>2005-10-11</entry>

- <topic>zope28 -- expose RestructuredText functionality to untrusted users</topic>

- <affects>

- <name>zope</name>

- <range><ge>2.6.0</ge><lt>2.7.8</lt></range>

- </affects>

- <description>

- <p>A Zope Hotfix Alert reports:</p>

- <blockquote cite="http://www.zope.org/Products/Zope/Hotfix_2005-10-09/security_alert">

- </description>

- <references>

- </references>

- <dates>

- <discovery>2005-10-09</discovery>

- <entry>2005-10-11</entry>

- <topic>libxine -- format string vulnerability</topic>

- <affects>

- <name>libxine</name>

- <range><lt>1.1.0_1</lt></range>

- </affects>

- <description>

- <p>Gentoo Linux Security Advisory reports:</p>

- <blockquote cite="http://www.gentoo.org/security/en/glsa/glsa-200510-08.xml">

- <p>Ulf Harnhammar discovered a format string bug in the routines

- <p>An attacker could submit malicious information about an audio

- CD to a public CDDB server (or impersonate a public CDDB server).

- When the victim plays this CD on a multimedia frontend relying

- on xine-lib, it could end up executing arbitrary code.</p>

- </description>

- <references>

- </references>

- <dates>

- <discovery>2005-10-08</discovery>

- <entry>2005-10-09</entry>

- <topic>imap-uw -- mailbox name handling remote buffer vulnerability</topic>

- <affects>

- <name>imap-uw</name>

- <range><lt>2004g</lt></range>

- </affects>

- <description>

- <p>FrSIRT reports:</p>

- <blockquote cite="http://www.frsirt.com/english/advisories/2005/1953">

- <p>A vulnerability has been identified in UW-IMAP, which could

- be exploited by remote attackers to execute arbitrary commands.

- This flaw is due to a stack overflow error in the

- "mail_valid_net_parse_work()" [src/c-client/mail.c] function that

- does not properly handle specially crafted mailbox names containing

- a quote (") character, which could be exploited by authenticated

- remote attackers to execute arbitrary commands with the privileges

- of the IMAP server.</p>

- </description>

- <references>

- </references>

- <dates>

- <discovery>2005-10-05</discovery>

- <entry>2005-10-05</entry>

- <name>weex</name>

- <range><lt>2.6.1.5_1</lt></range>

- </affects>

- <description>

- <p>Emanuel Haupt reports:</p>

- <blockquote cite="http://www.freebsd.org/cgi/query-pr.cgi?pr=ports/86833">

- <p>Someone who controls an FTP server that weex will log in to

- can set up malicious data in the account that weex will use,

- and that will cause a format string bug that will allow remote

- code execution. It will only happen when weex is first run or

- when its cache files are rebuilt with the -r option,

- though. The vulnerability was found by Ulf Harnhammar.</p>

- </description>

- <references>

- </references>

- <dates>

- <discovery>2005-10-02</discovery>

- <entry>2005-10-02</entry>

- <topic>picasm -- buffer overflow vulnerability</topic>

- <affects>

- <name>picasm</name>

- <range><lt>1.12c</lt></range>

- </affects>

- <description>

- <p>Shaun Colley reports:</p>

- <blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=111661253517089">

- <p>When generating error and warning messages, picasm copies

- </description>

- <references>

- <bid>13698</bid>

- <cvename>CVE-2005-1679</cvename>

- <mlist msgid="c522a35a0505200807744163c4@mail.gmail.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=111661253517089</mlist>

- </references>

- <dates>

- <discovery>2005-05-20</discovery>

- <entry>2005-10-02</entry>

- <topic>uim -- privilege escalation vulnerability</topic>

- <affects>

- <name>ja-uim</name>

- <range><lt>0.4.9.1</lt></range>

- </affects>

- <description>

- <p>The uim developers reports:</p>

- <blockquote cite="http://lists.freedesktop.org/archives/uim/2005-September/001346.html">

- of environment variables in uim. This bug causes

- privilege escalation if setuid/setgid applications

- was linked to libuim.</p>

- <p>This bug appears in 'immodule for Qt' enabled Qt.

- (Normal Qt is also safe.) In some distribution,

- mlterm is also an setuid/setgid application.</p>

- </description>

- <references>

- </references>

- <dates>

- <discovery>2005-09-28</discovery>

- <entry>2005-10-01</entry>

- <name>cfengine</name>

- <range><lt>2.1.6_1</lt></range>

- </package>

- <package>

- <name>cfengine2</name>

- <range><gt>0</gt></range>

- </affects>

- <description>

- <p>A Debian Security Advisory reports:</p>

- <blockquote cite="http://www.debian.org/security/2005/dsa-835">

- configuring and maintaining networked machines, that can

- be exploited by a symlink attack to overwrite arbitrary

- files owned by the user executing cfengine, which is

- probably root.</p>

- </description>

- <references>

- <cvename>CVE-2005-2960</cvename>

- <bid>14994</bid>

- </references>

- <dates>

- <discovery>2005-10-01</discovery>

- <entry>2005-10-01</entry>

- <name>clamav</name>

- <range><lt>0.87</lt></range>

- </package>

- <package>

- <name>clamav-devel</name>

- <range><lt>20050917</lt></range>

- </affects>

- <description>

- <p>Gentoo Linux Security Advisory reports:</p>

- <blockquote cite="http://www.gentoo.org/security/en/glsa/glsa-200509-13.xml">

- executables. It can also be sent into an infinite loop in

- "libclamav/fsg.c" when processing specially-crafted

- </description>

- <references>

- <certvu>363713</certvu>

- <cvename>CVE-2005-2919</cvename>

- </references>

- <dates>

- <discovery>2005-09-16</discovery>

- <entry>2005-09-24</entry>

- <name>firefox</name>

- <range><lt>1.0.7,1</lt></range>

- </package>

- <package>

- <name>linux-firefox</name>

- <range><lt>1.0.7</lt></range>

- </package>

- <package>

- <name>mozilla</name>

- <range><lt>1.7.12,2</lt></range>

- </package>

- <package>

- <name>linux-mozilla</name>

- <range><lt>1.7.12</lt></range>

- </package>

- <package>

- <name>linux-mozilla-devel</name>

- <range><gt>0</gt></range>

- </package>

- <package>

- <name>netscape7</name>

- <range><ge>0</ge></range>

- </package>

- <package>

- <name>zhTW-linux-mozillafirebird</name>

- <range><ge>0</ge></range>

- </package>

- <package>

- <name>de-linux-netscape</name>

- <name>de-netscape7</name>

- <name>fr-linux-netscape</name>

- <name>fr-netscape7</name>

- <name>ja-linux-netscape</name>

- <name>ja-netscape7</name>

- <name>linux-netscape</name>

- <name>linux-phoenix</name>

- <name>mozilla+ipv6</name>

- <name>mozilla-embedded</name>

- <name>mozilla-firebird</name>

- <name>mozilla-gtk1</name>

- <name>mozilla-gtk2</name>

- <name>mozilla-gtk</name>

- <name>mozilla-thunderbird</name>

- <name>phoenix</name>

- <name>pt_BR-netscape7</name>

- <range><ge>0</ge></range>

- </package>

- </affects>

- <description>

- <blockquote cite="http://www.mozilla.org/security/announce/mfsa2005-58.html">

- <h1>Heap overrun in XBM image processing</h1>

- <p>jackerror reports that an improperly terminated XBM image

- ending with space characters instead of the expected end

- tag can lead to a heap buffer overrun. This appears to be

- exploitable to install or run malicious code on the user's

- machine.</p>

- <h1>Crash on "zero-width non-joiner" sequence</h1>

- <p>Mats Palmgren discovered that a reported crash on Unicode

- sequences with "zero-width non-joiner" characters was due

- to stack corruption that may be exploitable.</p>

- <h1>XMLHttpRequest header spoofing</h1>

- <p>It was possible to add illegal and malformed headers to

- server or proxy flaws from the user's machine, or to fool

- a server or proxy into thinking a single request was a

- stream of separate requests. The severity of this

- vulnerability depends on the value of servers which might

- be vulnerable to HTTP request smuggling and similar

- <p>For users connecting to the web through a proxy this flaw

- single request as multiple pipe-lined requests directed at

- arbitrary hosts. This could be used, for example, to read

- files on intranet servers behind a firewall.</p>

- an internal interface. The severity depends on the version

- of Firefox: investigation so far indicates Firefox 1.0.x

- releases don't expose any vulnerable functionality to

- interfaces spoofed in this way, but that early Deer Park

- Alpha 1 versions did.</p>

- <h1>JavaScript integer overflow</h1>

- <p>Georgi Guninski reported an integer overflow in the

- JavaScript engine. We presume this could be exploited to

- run arbitrary code under favorable conditions.</p>

- <h1>Privilege escalation using about: scheme</h1>

- <p>heatsync and shutdown report two different ways to bypass

- the restriction on loading high privileged "chrome" pages

- from an unprivileged "about:" page. By itself this is

- harmless--once the "about" page's privilege is raised the

- original page no longer has access--but should this be

- combined with a same-origin violation this could lead to

- arbitrary code execution.</p>

- <h1>Chrome window spoofing</h1>

- <p>moz_bug_r_a4 demonstrates a way to get a blank "chrome"

- browser chrome designed to alert users to phishing sites,

- such as the address bar and the status bar.</p>

- </description>

- <references>

- <cvename>CVE-2005-2701</cvename>

- <cvename>CVE-2005-2702</cvename>

- <cvename>CVE-2005-2703</cvename>

- <cvename>CVE-2005-2704</cvename>

- <cvename>CVE-2005-2705</cvename>

- <cvename>CVE-2005-2706</cvename>

- </references>

- <dates>

- <discovery>2005-09-22</discovery>

- <entry>2005-09-23</entry>

- <name>firefox</name>

- <range><lt>1.0.7,1</lt></range>

- </package>

- <package>

- <name>linux-firefox</name>

- <range><lt>1.0.7</lt></range>

- </package>

- <package>

- <name>mozilla</name>

- <range><lt>1.7.12,2</lt></range>

- </package>

- <package>

- <name>linux-mozilla</name>

- <range><lt>1.7.12</lt></range>

- </package>

- <package>

- <name>linux-mozilla-devel</name>

- <range><gt>0</gt></range>

- </package>

- <package>

- <name>netscape7</name>

- <range><ge>0</ge></range>

- </package>

- <package>

- <name>zhTW-linux-mozillafirebird</name>

- <range><ge>0</ge></range>

- </package>

- <package>

- <name>de-linux-netscape</name>

- <name>de-netscape7</name>

- <name>fr-linux-netscape</name>

- <name>fr-netscape7</name>

- <name>ja-linux-netscape</name>

- <name>ja-netscape7</name>

- <name>linux-netscape</name>

- <name>linux-phoenix</name>

- <name>mozilla+ipv6</name>

- <name>mozilla-embedded</name>

- <name>mozilla-firebird</name>

- <name>mozilla-gtk1</name>

- <name>mozilla-gtk2</name>

- <name>mozilla-gtk</name>

- <name>mozilla-thunderbird</name>

- <name>phoenix</name>

- <name>pt_BR-netscape7</name>

- <range><ge>0</ge></range>

- </package>

- </affects>

- <description>

- <body xmlns="http://www.w3.org/1999/xhtml">

- <p>A Secunia Advisory reports:</p>

- <blockquote cite="http://secunia.com/advisories/16869/">

- which can be exploited by malicious people to compromise a

- user's system.</p>

- <p>The vulnerability is caused due to the shell script used

- to launch Firefox parsing shell commands that are enclosed

- within backticks in the URL provided via the command

- line. This can e.g. be exploited to execute arbitrary

- shell commands by tricking a user into following a

- malicious link in an external application which uses

- </description>

- <references>

- </references>

- <dates>

- <discovery>2005-09-06</discovery>

- <entry>2005-09-22</entry>

- <topic>apache -- Certificate Revocation List (CRL) off-by-one vulnerability</topic>

- <affects>

- <name>apache</name>

- <range><gt>2.*</gt><lt>2.0.54_1</lt></range>

- </affects>

- <description>

- </description>

- <references>

- <bid>14366</bid>

- <cvename>CVE-2005-1268</cvename>

- </references>

- <dates>

- <discovery>2005-07-12</discovery>

- <entry>2005-09-17</entry>

- <topic>squirrelmail -- _$POST variable handling allows for various

- <name>squirrelmail</name>

- <name>ja-squirrelmail</name>

- </affects>

- <description>

- <p>A Squirrelmail Advisory reports:</p>

- <blockquote cite="http://www.squirrelmail.org/security/issue/2005-07-13">

- <p>An extract($_POST) was done in options_identities.php which

- writing) of other people's preferences, cross site scripting

- or writing files in webserver-writable locations.</p>

- </description>

- <references>

- <bid>14254</bid>

- <cvename>CVE-2005-2095</cvename>

- </references>

- <dates>

- <discovery>2005-07-13</discovery>

- <entry>2005-09-17</entry>

- <name>XFree86-Server</name>

- <range><lt>4.5.0_2</lt></range>

- </package>

- <package>

- <name>xorg-server</name>

- <range><lt>6.8.2_5</lt></range>

- </affects>

- <description>

- <p>Allocating large pixmaps by a client can trigger an integer

- overflow in the X server, potentially leading to execution of

- arbitrary code with elevated (root) privileges.</p>

- </description>

- <references>

- <bid>14807</bid>

- <certvu>102441</certvu>

- </references>

- <dates>

- <discovery>2005-09-12</discovery>

- <entry>2005-09-15</entry>

- <topic>unzip -- permission race vulnerability</topic>

- <affects>

- <name>unzip</name>

- <name>zh-unzip</name>

- <name>ko-unzip</name>

- </affects>

- <description>

- extracted files. This would give an attacker enough time to

- remove a file and hardlink it to another file owned by the

- user running unzip. When unzip changes the permissions of

- the file it could give the attacker access to files that

- normally would not have been accessible for others.</p>

- </description>

- <references>

- <bid>14450</bid>

- <cvename>CVE-2005-2475</cvename>

- <mlist msgid="7389fc4b05080116031536adf7@mail.gmail.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=112300046224117</mlist>

- </references>

- <dates>

- <discovery>2005-08-02</discovery>

- <entry>2005-09-13</entry>

- <name>firefox</name>

- <range><lt>1.0.6_5,1</lt></range>

- </package>

- <package>

- <name>linux-firefox</name>

- <range><lt>1.0.7</lt></range>

- </package>

- <package>

- <name>mozilla</name>

- <range><lt>1.7.11_1,2</lt></range>

- </package>

- <package>

- <name>linux-mozilla</name>

- <range><lt>1.7.12</lt></range>

- </package>

- <package>

- <name>linux-mozilla-devel</name>

- <range><gt>0</gt></range>

- </package>

- <package>

- <name>netscape7</name>

- <range><ge>0</ge></range>

- </package>

- <package>

- <name>zhTW-linux-mozillafirebird</name>

- <range><ge>0</ge></range>

- </package>

- <package>

- <name>de-linux-netscape</name>

- <name>de-netscape7</name>

- <name>fr-linux-netscape</name>

- <name>fr-netscape7</name>

- <name>ja-linux-netscape</name>

- <name>ja-netscape7</name>

- <name>linux-netscape</name>

- <name>linux-phoenix</name>

- <name>mozilla+ipv6</name>

- <name>mozilla-embedded</name>

- <name>mozilla-firebird</name>

- <name>mozilla-gtk1</name>

- <name>mozilla-gtk2</name>

- <name>mozilla-gtk</name>

- <name>mozilla-thunderbird</name>

- <name>phoenix</name>

- <name>pt_BR-netscape7</name>

- <range><ge>0</ge></range>

- </package>

- </affects>

- <description>

- <body xmlns="http://www.w3.org/1999/xhtml">

- <p>Tom Ferris reports:</p>

- <blockquote cite="http://marc.theaimsgroup.com/?l=full-disclosure&amp;m=112624614008387">

- for an attacker to remotely execute arbitrary code on an

- affected host.</p>

- nsStandardURL::BuildNormalizedSpec to return true, but is

- sets encHost to an empty string. Meaning, Firefox appends

- 0 to approxLen and then appends the long string of dashes

- to the buffer instead.</p>

- </blockquote>

- <p><strong>Note:</strong> It is possible to disable IDN

- href="http://www.mozilla.org/security/idn.html">What Firefox

- and Mozilla users should know about the IDN buffer overflow

- security issue</a></em> web page.</p>

- </description>

- <references>

- <bid>14784</bid>

- <certvu>573857</certvu>

- </references>

- <dates>

- <discovery>2005-09-08</discovery>

- <entry>2005-09-10</entry>

- <name>htdig</name>

- <range><lt>3.2.0.b6_1</lt></range>

- </affects>

- <description>

- code on the target's browser. This might allow the attacker

- to obtain the user's cookies which are associated with the

- site, including cookies used for authentication.</p>

- </description>

- <references>

- <bid>12442</bid>

- <cvename>CVE-2005-0085</cvename>

- </references>

- <dates>

- <discovery>2005-02-03</discovery>

- <entry>2005-09-04</entry>

- <topic>squid -- Denial Of Service Vulnerability in sslConnectTimeout</topic>

- <affects>

- <name>squid</name>

- <range><lt>2.5.10_5</lt></range>

- </affects>

- <description>

- <p>The squid patches page notes:</p>

- <blockquote cite="http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE10-sslConnectTimeout">

- <p>After certain slightly odd requests Squid crashes with a segmentation fault in sslConnectTimeout.</p>

- </description>

- <references>

- <bid>14731</bid>

- <cvename>CVE-2005-2796</cvename>

- </references>

- <dates>

- <discovery>2005-07-21</discovery>

- <entry>2005-09-04</entry>

- <topic>squid -- Possible Denial Of Service Vulnerability in store.c</topic>

- <affects>

- <name>squid</name>

- <range><lt>2.5.10_5</lt></range>

- </affects>

- <description>

- <p>The squid patches page notes:</p>

- <blockquote cite="http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE10-STORE_PENDING">

- <p>Squid crashes with the above assertion failure [assertion failed:

- store.c:523: "e->store_status == STORE_PENDING"] in certain

- conditions involving aborted requests.</p>

- </description>

- <references>

- <bid>14761</bid>

- <cvename>CVE-2005-2794</cvename>

- </references>

- <dates>

- <discovery>2005-08-02</discovery>

- <entry>2005-09-04</entry>

- <topic>bind9 -- denial of service</topic>

- <affects>

- <name>bind9</name>

- <range><eq>9.3.0</eq></range>

- </package>

- <system>

- <name>FreeBSD</name>

- <range><ge>5.3</ge><lt>5.3_16</lt></range>

- </affects>

- <description>

- <body xmlns="http://www.w3.org/1999/xhtml">

- <p>Problem description</p>

- <p>A DNSSEC-related validator function in BIND 9.3.0 contains an

- inappropriate internal consistency test. When this test is

- triggered, named(8) will exit.</p>

- <p>Impact</p>

- <p>On systems with DNSSEC enabled, a remote attacker may be able

- terminate. As a result, the name server will no longer be

- available to service requests.</p>

- <p>Workaround</p>

- <p>DNSSEC is not enabled by default, and the "dnssec-enable"

- enabled, disable it by changing the "dnssec-enable" directive

- to "dnssec-enable no;" in the named.conf(5) configuration

- file.</p>

- </description>

- <references>

- <certvu>938617</certvu>

- <cvename>CVE-2005-0034</cvename>

- </references>

- <dates>

- <discovery>2005-01-25</discovery>

- <entry>2005-09-03</entry>

- <topic>bind -- buffer overrun vulnerability</topic>

- <affects>

- <name>bind84</name>

- <range><ge>8.4.4</ge><lt>8.4.6</lt></range>

- </affects>

- <description>

- <p>An ISC advisory reports a buffer overrun vulnerability within

- bind. The vulnerability could result in a Denial of Service.

- A workaround is available by disabling recursion and glue

- fetching.</p>

- </description>

- <references>

- <certvu>327633</certvu>

- <cvename>CVE-2005-0033</cvename>

- </references>

- <dates>

- <discovery>2005-01-25</discovery>

- <entry>2005-09-03</entry>

- <topic>urban -- stack overflow vulnerabilities</topic>

- <affects>

- <name>urban</name>

- <range><lt>1.5.3_2</lt></range>

- </affects>

- <description>

- <p>Several filename-related stack overflow bugs allow a local

- attacker to elevate its privileges to the games group, since

- urban is installed setgid games.</p>

- </description>

- <references>

- <cvename>CVE-2005-2864</cvename>

- <mlist msgid="55104.213.107.125.108.1125844783.squirrel@webmail.rsc.cx">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=112604855119036</mlist>

- </references>

- <dates>

- <discovery>2005-09-02</discovery>

- <entry>2005-09-02</entry>

- <topic>fswiki - command injection vulnerability</topic>

- <affects>

- <name>fswiki</name>

- <range><lt>3.5.9</lt></range>

- </affects>

- <description>

- </description>

- <references>

- </references>

- <dates>

- <discovery>2005-08-29</discovery>

- <entry>2005-08-29</entry>

- </vuln>

- <vuln vid="e5afdf63-1746-11da-978e-0001020eed82">

- <name>evolution</name>

- <range><gt>1.5</gt><lt>2.2.3_1</lt></range>

- </affects>

- <description>

- <p>A SITIC Vulnerability Advisory reports:</p>

- <blockquote cite="http://www.sitic.se/eng/advisories_and_recommendations/sa05-001.html">

- occurs when the user goes to the Calendars tab to save

- task list data that is vulnerable to problem 3

- above. Other calendar entries that do not come from task

- lists are also affected.</li>

- </description>

- <references>

- <cvename>CVE-2005-2549</cvename>

- <cvename>CVE-2005-2550</cvename>

- </references>

- <dates>

- <discovery>2005-08-10</discovery>

- <entry>2005-08-27</entry>

- <name>pam_ldap</name>

- <range><lt>1.8.0</lt></range>

- </affects>

- <description>

- <p>Luke Howard reports:</p>

- <blockquote cite="https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=166163">

- <p>If a pam_ldap client authenticates against an LDAP server

- the optional "error" field of the

- PasswordPolicyResponseValue, then the LDAP authentication

- result will be ignored and the authentication step will

- always succeed.</p>

- </description>

- <references>

- <cvename>CVE-2005-2641</cvename>

- <certvu>778916</certvu>

- </references>

- <dates>

- <discovery>2005-08-22</discovery>

- <entry>2005-08-27</entry>

- <name>pcre</name>

- <name>pcre-utf8</name>

- </affects>

- <description>

- </description>

- <references>

- <bid>14620</bid>

- <cvename>CVE-2005-2491</cvename>

- </references>

- <dates>

- <discovery>2005-08-01</discovery>

- <entry>2005-08-26</entry>

- <name>elm</name>

- <range><lt>2.5.8</lt></range>

- </affects>

- <description>

- <p>Ulf Harnhammar has discovered a remotely exploitable buffer

- overflow in Elm e-mail client when parsing the Expires header

- of an e-mail message:</p>

- <blockquote cite="http://archives.neohapsis.com/archives/fulldisclosure/2005-08/0688.html">

- message. When the victim with that message in his or her

- inbox starts Elm or simply views the inbox in an already

- started copy of Elm, the buffer overflow will happen

- immediately. The overflow is stack-based, and it gives full

- control over EIP, EBP and EBX. It is caused by a bad

- sscanf(3) call, using a format string containing &quot;%s&quot;

- to copy from a long char array to a shorter array.</p>

- </description>

- <references>

- </references>

- <dates>

- <discovery>2005-08-20</discovery>

- <entry>2005-08-23</entry>

- <topic>openvpn -- multiple TCP clients connecting with the same certificate at the same time can crash the server</topic>

- <name>openvpn</name>

- <range><lt>2.0.1</lt></range>

- </affects>

- <description>

- <p>James Yonan reports:</p>

- <blockquote cite="http://openvpn.net/changelog.html">

- <p>If two or more client machines try to connect to the server

- at the same time via TCP, using the same client certificate,

- and when --duplicate-cn is not enabled on the server, a race

- condition can crash the server with "Assertion failed at

- mtcp.c:411"</p>

- </description>

- <references>

- </references>

- <dates>

- <discovery>2005-08-03</discovery>

- <entry>2005-08-19</entry>

- <topic>openvpn -- denial of service: malicious authenticated &quot;tap&quot; client can deplete server virtual memory</topic>

- <name>openvpn</name>

- <range><lt>2.0.1</lt></range>

- </affects>

- <description>

- <p>James Yonan reports:</p>

- <blockquote cite="http://openvpn.net/changelog.html">

- ethernet bridging mode could theoretically flood the server

- with packets appearing to come from hundreds of thousands

- of different MAC addresses, causing the OpenVPN process to

- deplete system virtual memory as it expands its internal

- routing table.</p>

- </description>

- <references>

- </references>

- <dates>

- <discovery>2005-07-27</discovery>

- <entry>2005-08-19</entry>

- <topic>openvpn -- denial of service: undecryptable packet from authorized client can disconnect unrelated clients</topic>

- <name>openvpn</name>

- <range><lt>2.0.1</lt></range>

- </affects>

- <description>

- <p>James Yonan reports:</p>

- <blockquote cite="http://openvpn.net/changelog.html">

- <p>If the client sends a packet which fails to decrypt on the

- which can result in another unrelated client instance on the

- server seeing the error and responding to it, resulting in

- disconnection of the unrelated client.</p>

- </description>

- <references>

- </references>

- <dates>

- <discovery>2005-07-27</discovery>

- <entry>2005-08-19</entry>

- <topic>openvpn -- denial of service: client certificate validation can disconnect unrelated clients</topic>

- <affects>

- <name>openvpn</name>

- <range><lt>2.0.1</lt></range>

- </affects>

- <description>

- <p>James Yonan reports:</p>

- <blockquote cite="http://openvpn.net/changelog.html">

- without "tls-auth". If a client connection to the server

- fails certificate verification, the OpenSSL error queue is

- not properly flushed, which can result in another unrelated

- client instance on the server seeing the error and

- responding to it, resulting in disconnection of the

- unrelated client.</p>

- </description>

- <references>

- </references>

- <dates>

- <discovery>2005-08-03</discovery>

- <entry>2005-08-19</entry>

- <topic>tor -- diffie-hellman handshake flaw</topic>

- <affects>

- <name>tor</name>

- <range><lt>0.1.0.14</lt></range>

- </affects>

- <description>

- <p>A tor advisory reports</p>

- <blockquote cite="http://archives.seul.org/or/announce/Aug-2005/msg00002.html">

- and data integrity if the first Tor server in their path is

- malicious. Specifically, if the Tor client chooses a

- malicious Tor server for her first hop in the circuit, that

- server can learn all the keys she negotiates for the rest of

- the circuit (or just spoof the whole circuit), and then read

- and/or modify all her traffic over that circuit.</p>

- </description>

- <references>

- </references>

- <dates>

- <discovery>2005-08-11</discovery>

- <entry>2005-08-17</entry>

- <name>acroread</name>

- <range><lt>7.0.1</lt></range>

- </package>

- <package>

- <name>acroread4</name>

- <name>acroread5</name>

- <package>

- <name>acroread7</name>

- <range><lt>7.0.1</lt></range>

- </package>

- </affects>

- <description>

- <p>A Adobe Security Advisory reports:</p>

- <blockquote cite="http://www.adobe.com/support/techdocs/321644.html">

- <p>The identified vulnerability is a buffer overflow within

- a core application plug-in, which is part of Adobe Acrobat

- and Adobe Reader. If a malicious file were opened it could

- trigger a buffer overflow as the file is being loaded into

- Adobe Acrobat and Adobe Reader. A buffer overflow can

- cause the application to crash and increase the risk of

- malicious code execution.</p>

- </description>

- <references>

- </references>

- <dates>

- <discovery>2005-08-16</discovery>

- <entry>2005-08-16</entry>

- <name>pear-XML_RPC</name>

- <range><lt>1.4.0</lt></range>

- </package>

- <package>

- <name>phpmyfaq</name>

- <range><lt>1.4.11</lt></range>

- </package>

- <package>

- <name>drupal</name>

- <range><lt>4.6.3</lt></range>

- </package>

- <package>

- <name>eGroupWare</name>

- <range><lt>1.0.0.009</lt></range>

- </package>

- <package>

- <name>phpAdsNew</name>

- <range><lt>2.0.5</lt></range>

- </package>

- <package>

- <name>phpgroupware</name>

- <range><lt>0.9.16.007</lt></range>

- </package>

- <package>

- <name>b2evolution</name>

- <range><lt>0.9.0.12_2</lt></range>

- </affects>

- <description>

- <blockquote cite="http://www.hardened-php.net/advisory_142005.66.html">

- <p>When the library parses XMLRPC requests/responses, it constructs

- a string of PHP code, that is later evaluated. This means any

- failure to properly handle the construction of this string can

- result in arbitrary execution of PHP code.</p>

- <p>This new injection vulnerability is cause by not properly

- in the parsed document, that were never meant to be nested

- at all. This can be easily exploited in a way, that

- user-input is placed outside of string delimiters within

- the evaluation string, which obviously results in

- arbitrary code execution.</p>

- </blockquote>

- <p>Note that several applications contains an embedded version

- on XML_RPC, therefor making them the vulnerable to the same

- code injection vulnerability.</p>

- </body>

- </description>

- <references>

- </references>

- <dates>

- <discovery>2005-08-15</discovery>

- <entry>2005-08-15</entry>

- <name>awstats</name>

- <range><lt>6.4_1</lt></range>

- </affects>

- <description>

- <p>An iDEFENSE Security Advisory reports:</p>

- <blockquote cite="http://www.idefense.com/application/poi/display?id=290&amp;type=vulnerabilities">

- input filtering before passing user-supplied data to an

- <code>eval()</code> function. As part of the statistics

- reporting function, AWStats displays information about the

- most common referrer values that caused users to visit the

- website. The referrer data is used without proper

- sanitation in an <code>eval()</code> statement, resulting

- in the execution of arbitrary perl code.</p>

- arbitrary commands with permissions of the web

- service. Exploitation will not occur until the stats page

- has been regenerated with the tainted referrer values from

- </description>

- <references>

- <cvename>CVE-2005-1527</cvename>

- <mlist msgid="20050811155502.61E3C7A00B4@mail.idefense.com">http://marc.theaimsgroup.com/?l=full-disclosure&amp;m=112377934108902</mlist>

- </references>

- <dates>

- <discovery>2005-08-09</discovery>

- <entry>2005-08-14</entry>

- <topic>libgadu -- multiple vulnerabilities</topic>

- <affects>

- <package>

- <name>gaim</name>

- <name>ja-gaim</name>

- <name>ko-gaim</name>

- <name>ru-gaim</name>

- <range><lt>1.4.0_1</lt></range>

- </package>

- <package>

- <name>kdenetwork</name>

- <range><gt>3.2.2</gt><lt>3.4.2</lt></range>

- </package>

- <package>

- <name>pl-ekg</name>

- <range><lt>1.6r3,1</lt></range>

- </package>

- <package>

- <name>centericq</name>

- <range><lt>4.21.0_1</lt></range>

- </package>

- </affects>

- <description>

- <body xmlns="http://www.w3.org/1999/xhtml">

- <p>Wojtek Kaniewski reports:</p>

- <blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=112198499417250">

- <p>Multiple vulnerabilities have been found in libgadu, a

- library for handling Gadu-Gadu instant messaging

- protocol. It is a part of ekg, a Gadu-Gadu client, but is

- widely used in other clients. Also some of the user

- contributed scripts were found to behave in an insecure

- manner.</p>

- <li>integer overflow in libgadu (CVE-2005-1852) that could

- triggered by an incomming message and lead to bus errors

- on architectures like SPARC</li>

- behaviour of applications on big-endian

- architectures</li>

- </description>

- <references>

- <bid>14345</bid>

- <cvename>CVE-2005-1850</cvename>

- <cvename>CVE-2005-1851</cvename>

- <cvename>CVE-2005-1852</cvename>

- <cvename>CVE-2005-2369</cvename>

- <cvename>CVE-2005-2370</cvename>

- <cvename>CVE-2005-2448</cvename>

- <mlist msgid="42DFF06F.7060005@toxygen.net">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=112198499417250</mlist>

- </references>

- <dates>

- <discovery>2005-07-21</discovery>

- <entry>2005-08-12</entry>

- <topic>gaim -- AIM/ICQ non-UTF-8 filename crash</topic>

- <affects>

- <name>gaim</name>

- <name>ja-gaim</name>

- <name>ko-gaim</name>

- <name>ru-gaim</name>

- <range><lt>1.4.0_1</lt></range>

- </affects>

- <description>

- <p>The GAIM team reports:</p>

- <blockquote cite="http://gaim.sourceforge.net/security/?id=21">

- </description>

- <references>

- </references>

- <dates>

- <discovery>2005-08-09</discovery>

- <entry>2005-08-12</entry>

- <name>gaim</name>

- <name>ja-gaim</name>

- <name>ko-gaim</name>

- <name>ru-gaim</name>

- <range><lt>1.4.0_1</lt></range>

- </affects>

- <description>

- <p>The GAIM team reports:</p>

- <blockquote cite="http://gaim.sourceforge.net/security/?id=22">

- <p>A remote AIM or ICQ user can cause a buffer overflow in

- </description>

- <references>

- </references>

- <dates>

- <discovery>2005-08-09</discovery>

- <entry>2005-08-12</entry>

- <topic>xpdf -- disk fill DoS vulnerability</topic>

- <affects>

- <name>xpdf</name>

- <range><lt>3.00_7</lt></range>

- </package>

- <package>

- <name>kdegraphics</name>

- <range><lt>3.4.2</lt></range>

- </package>

- <package>

- <name>gpdf</name>

- <range><lt>2.10.0_2</lt></range>

- </package>

- <package>

- <name>cups-base</name>

- <range><lt>1.1.23.0_5</lt></range>

- </affects>

- <description>

- <p>Note that several applications contains an embedded version

- </description>

- <references>

- <bid>14529</bid>

- <cvename>CVE-2005-2097</cvename>

- </references>

- <dates>

- <discovery>2005-08-09</discovery>

- <entry>2005-08-12</entry>

- <name>gforge</name>

- <range><gt>0</gt></range>

- </affects>

- <description>

- <blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=112259845904350">

- Scripting) attacks. This may be used to launch phising

- security problem) and putting in the e-mail an HTML link

- that points to an specially crafted url that inserts an

- html form in the GForge login page and when the user press

- the login button, he/she send the credentials to the

- attackers website.</p>

-

- <p>The 'forgot your password?' feature allows a remote user

- There is no limit to the number of messages sent over a

- period of time, so a remote user can flood the target

- </description>

- <references>

- <bid>14405</bid>

- <cvename>CVE-2005-2430</cvename>

- <cvename>CVE-2005-2431</cvename>

- <mlist msgid="1122496636.26878.2.camel@localhost.localdomain">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=112259845904350</mlist>

- </references>

- <dates>

- <discovery>2005-07-27</discovery>

- <entry>2005-08-09</entry>

- <topic>postnuke -- multiple vulnerabilities</topic>

- <affects>

- <name>postnuke</name>

- <range><lt>0.760</lt></range>

- </affects>

- <description>

- <li>missing input validation within /modules/Messages/readpmsg.php</li>

- <li>possible path disclosure within /user.php</li>

- <li>possible path disclosure within /modules/News/article.php</li>

- <li>possible remote code injection within /includes/pnMod.php</li>

- <li>possible cross-site-scripting in /index.php</li>

- </blockquote>

- <blockquote cite="http://news.postnuke.com/Article2699.html">

- </description>

- <references>

- <cvename>CVE-2005-1621</cvename>

- <cvename>CVE-2005-1695</cvename>

- <cvename>CVE-2005-1696</cvename>

- <cvename>CVE-2005-1698</cvename>

- <cvename>CVE-2005-1777</cvename>

- <cvename>CVE-2005-1778</cvename>

- <cvename>CVE-2005-1921</cvename>

- <mlist msgid="20050527223753.21735.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=111721364707520</mlist>

- </references>

- <dates>

- <discovery>2005-05-27</discovery>

- <entry>2005-08-08</entry>

- <topic>mambo -- multiple vulnerabilities</topic>

- <affects>

- <name>mambo</name>

- <range><lt>4.5.2.3</lt></range>

- </affects>

- <description>

- <p>A Secunia Advisory reports:</p>

- <blockquote cite="http://secunia.com/advisories/15710/">

- some have unknown impacts and others can be exploited by

- malicious people to conduct spoofing and SQL injection

- voting isn't properly sanitised before being used in a

- SQL query. This can be exploited to manipulate SQL

- </description>

- <references>

- <bid>13966</bid>

- <cvename>CVE-2005-2002</cvename>

- </references>

- <dates>

- <discovery>2005-06-15</discovery>

- <entry>2005-08-05</entry>

- <name>FreeBSD</name>

- <range><ge>5.4</ge><lt>5.4_6</lt></range>

- </affects>

- <description>

- <h1>Problem description</h1>

- <p>A programming error in the implementation of the

- constant key being used instead of the key specified by the

- system administrator.</p>

- <h1>Impact</h1>

- <p>If the AES-XCBC-MAC algorithm is used for authentication in

- the absence of any encryption, then an attacker may be able to

- forge packets which appear to originate from a different

- system and thereby succeed in establishing an IPsec session.

- If access to sensitive information or systems is controlled

- based on the identity of the source system, this may result

- in information disclosure or privilege escalation.</p>

- </description>

- <references>

- </references>

- <dates>

- <discovery>2005-07-27</discovery>

- <entry>2005-08-05</entry>

- <topic>zlib -- buffer overflow vulnerability</topic>

- <affects>

- <name>linux_base-suse</name>

- <range><lt>9.3_1</lt></range>

- </package>

- <system>

- <name>FreeBSD</name>

- <range><ge>5.4</ge><lt>5.4_6</lt></range>

- </affects>

- <description>

- <body xmlns="http://www.w3.org/1999/xhtml">

- <h1>Problem description</h1>

- <p>A fixed-size buffer is used in the decompression of data

- streams. Due to erronous analysis performed when zlib was

- written, this buffer, which was belived to be sufficiently

- large to handle any possible input stream, is in fact too

- small.</p>

- <h1>Impact</h1>

- <p>A carefully constructed compressed data stream can result in

- applications to halt, resulting in a denial of service; or

- it may result in an attacker gaining elevated privileges.</p>

- </description>

- <references>

- <cvename>CVE-2005-1849</cvename>

- <freebsdsa>SA-05:18.zlib</freebsdsa>

- </references>

- <dates>

- <discovery>2005-07-27</discovery>

- <entry>2005-08-05</entry>

- <topic>devfs -- ruleset bypass</topic>

- <affects>

- <name>FreeBSD</name>

- <range><ge>5.4</ge><lt>5.4_5</lt></range>

- </affects>

- <description>

- <h1>Problem description</h1>

- <p>Due to insufficient parameter checking of the node type

- <h1>Impact</h1>

- <p>Jailed processes can get access to restricted resources on

- the host system. For jailed processes running with superuser

- privileges this implies access to all devices on the system.

- This level of access can lead to information leakage and

- privilege escalation.</p>

- </body>

- </description>

- <references>

- </references>

- <dates>

- <discovery>2005-07-20</discovery>

- <entry>2005-08-05</entry>

- <topic>proftpd -- format string vulnerabilities</topic>

- <affects>

- <name>proftpd</name>

- <name>proftpd-mysql</name>

- </affects>

- <description>

- <p>The ProFTPD release notes states:</p>

- <blockquote cite="http://www.proftpd.org/docs/RELEASE_NOTES-1.3.0rc2">

- <p>sean &lt;infamous42md at hotpop.com&gt; found two format

- directive, and one involving the 'ftpshut' utility. Both

- can be considered low risk, as they require active

- involvement on the part of the site administrator in order

- to be exploited.</p>

- </blockquote>

- <p>These vulnerabilities could potentially lead to information

- disclosure, a denial-of-server situation, or execution of

- arbitrary code with the permissions of the user running

- </description>

- <references>

- </references>

- <dates>

- <discovery>2005-07-26</discovery>

- <entry>2005-08-03</entry>

- <topic>nbsmtp -- format string vulnerability</topic>

- <affects>

- <name>nbsmtp</name>

- <range><lt>0.99_1</lt></range>

- </affects>

- <description>

- <p>When nbsmtp is executed in debug mode, server messages

- will be printed to stdout and logged via syslog. Syslog is

- used insecurely and user-supplied format characters are

- directly fed to the syslog function, which results in a

- format string vulnerability.</p>

- <p>Under some circumstances, an SMTP server may be able to

- abuse this vulnerability in order to alter the nbsmtp

- process and execute malicious code.</p>

- </description>

- <references>

- </references>

- <dates>

- <discovery>2005-07-25</discovery>

- <entry>2005-08-01</entry>

- </vuln>

- <vuln vid="b1e8c810-01d0-11da-bc08-0001020eed82">

- <name>sylpheed</name>

- <name>sylpheed-gtk2</name>

- <name>sylpheed-claws</name>

- <range><lt>1.0.4</lt></range>

- </affects>

- <description>

- </description>

- <references>

- <bid>12934</bid>

- <cvename>CVE-2005-0926</cvename>

- </references>

- <dates>

- <discovery>2005-03-29</discovery>

- <entry>2005-07-31</entry>

- <name>phpmyadmin</name>

- <name>phpMyAdmin</name>

- </affects>

- <description>

- <p>A phpMyAdmin security announcement reports:</p>

- <blockquote cite="http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-3">

- </description>

- <references>

- <bid>12982</bid>

- <cvename>CVE-2005-0992</cvename>

- <mlist msgid="4f9e4516050404101223fbdeed@mail.gmail.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=111264361622660</mlist>

- </references>

- <dates>

- <discovery>2005-04-03</discovery>

- <entry>2005-07-31</entry>

- <name>gnupg</name>

- <range><lt>1.4.1</lt></range>

- </package>

- <package>

- <name>p5-Crypt-OpenPGP</name>

- <name>pgp</name>

- <name>pgpin</name>

- </affects>

- <description>

- <p>Serge Mister and Robert Zuccherato reports that the OpenPGP

- protocol is vulnerable to a cryptographic attack when using

- symmetric encryption in an automated way.</p>

- <p>David Shaw reports about the impact:</p>

- <blockquote cite="http://lists.gnupg.org/pipermail/gnupg-announce/2005q1/000191.html">

- response to the submitter, then this does not affect you

- at all.</p>

- </blockquote>

- <p>Note that the <q>fix</q> in GnuPG does note completely

- <blockquote cite="http://lists.gnupg.org/pipermail/gnupg-announce/2005q1/000191.html">

- that the attack is exploiting. This change should not be

- user visible. With the patch in place, this attack will

- not work using a public-key encrypted message. It will

- still work using a passphrase-encrypted message.</p>

- </description>

- <references>

- <certvu>303094</certvu>

- <cvename>CVE-2005-0366</cvename>

- </references>

- <dates>

- <discovery>2005-02-08</discovery>

- <entry>2005-07-31</entry>

- <topic>vim -- vulnerabilities in modeline handling: glob, expand</topic>

- <affects>

- <name>vim</name>

- <name>vim-lite</name>

- <name>vim+ruby</name>

- </affects>

- <description>

- execute arbitrary commands with the privileges of the user.</p>

- <p><strong>Note:</strong> It is generally recommended that VIM

- users use <code>set nomodeline</code> in

- <code>~/.vimrc</code> to avoid the possibility of trojaned

- text files.</p>

- </description>

- <references>

- <bid>14374</bid>

- <cvename>CVE-2005-2368</cvename>

- </references>

- <dates>

- <discovery>2005-07-25</discovery>

- <entry>2005-07-31</entry>

- <topic>tiff -- buffer overflow vulnerability</topic>

- <affects>

- <name>tiff</name>

- <range><lt>3.7.3</lt></range>

- </package>

- <package>

- <name>linux-tiff</name>

- <range><lt>3.6.1_3</lt></range>

- </package>

- <package>

- <name>pdflib</name>

- <name>pdflib-perl</name>

- </package>

- <package>

- <name>gdal</name>

- <range><lt>1.2.1_2</lt></range>

- </package>

- <package>

- <name>fractorama</name>

- <name>iv</name>

- <name>ivtools</name>

- <name>ja-iv</name>

- <name>ja-libimg</name>

- <name>paraview</name>

- </affects>

- <description>

- <p>A Gentoo Linux Security Advisory reports:</p>

- <blockquote cite="http://www.gentoo.org/security/en/glsa/glsa-200505-07.xml">

- <p>Successful exploitation would require the victim to open

- </description>

- <references>

- </references>

- <dates>

- <discovery>2005-05-10</discovery>

- <entry>2005-07-30</entry>

- <topic>opera -- image dragging vulnerability</topic>

- <affects>

- <name>linux-opera</name>

- <name>opera-devel</name>

- <name>opera</name>

- <range><lt>8.02</lt></range>

- </affects>

- <description>

- <p>A Secunia Advisory reports:</p>

- <blockquote cite="http://secunia.com/advisories/15756/">

- <p>Secunia Research has discovered a vulnerability in Opera,

- <p>The vulnerability is caused due to Opera allowing a user

- upload form, resulting in uploading of arbitrary files to

- a malicious web site.</p>

- <p>Successful exploitation requires that the user is tricked

- </description>

- <references>

- </references>

- <dates>

- <discovery>2005-07-28</discovery>

- <entry>2005-07-30</entry>

- <name>linux-opera</name>

- <name>opera-devel</name>

- <name>opera</name>

- <range><lt>8.02</lt></range>

- </affects>

- <description>

- <p>A Secunia Advisory reports:</p>

- <blockquote cite="http://secunia.com/advisories/15870/">

- <p>Secunia Research has discovered a vulnerability in Opera,

- which can be exploited by malicious people to trick users

- into executing malicious files.</p>

- handling of extended ASCII codes in the download

- dialog. This can be exploited to spoof the file extension

- in the file download dialog via a specially crafted

- <p>Successful exploitation may result in users being tricked

- but requires that the "Arial Unicode MS" font

- (ARIALUNI.TTF) has been installed on the system.</p>

- </description>

- <references>

- </references>

- <dates>

- <discovery>2005-07-28</discovery>

- <entry>2005-07-30</entry>

- <name>ethereal</name>

- <name>ethereal-lite</name>

- <name>tethereal</name>

- <name>tethereal-lite</name>

- </affects>

- <description>

- <p>An Ethreal Security Advisories reports:</p>

- <blockquote cite="http://www.ethereal.com/appnotes/enpa-sa-00020.html">

- <li>The LDAP dissector could free static memory and crash.</li>

- <li>The AgentX dissector could crash.</li>

- <li>The 802.3 dissector could go into an infinite loop.</li>

- <li>The PER dissector could abort.</li>

- <li>The DHCP dissector could go into an infinite loop.</li>

- <li>The BER dissector could abort or loop infinitely.</li>

- <li>The MEGACO dissector could go into an infinite loop.</li>

- <li>The GIOP dissector could dereference a null pointer.</li>

- <li>The SMB dissector was susceptible to a buffer overflow.</li>

- <li>The WBXML could dereference a null pointer.</li>

- <li>The H1 dissector could go into an infinite loop.</li>

- <li>The DOCSIS dissector could cause a crash.</li>

- <li>The SMPP dissector could go into an infinite loop.</li>

- <li>SCTP graphs could crash.</li>

- <li>The HTTP dissector could crash.</li>

- <li>The SMB dissector could go into a large loop.</li>

- <li>The DCERPC dissector could crash.</li>

- <li>Several dissectors could crash while reassembling packets.</li>

- </ul>

- <p>Steve Grubb at Red Hat found the following issues:</p>

- <ul>

- <li>The CAMEL dissector could dereference a null pointer.</li>

- <li>The DHCP dissector could crash.</li>

- <li>The CAMEL dissector could crash.</li>

- <li>The PER dissector could crash.</li>

- <li>The RADIUS dissector could crash.</li>

- <li>The Telnet dissector could crash.</li>

- <li>The IS-IS LSP dissector could crash.</li>

- </ul>

- <p>iDEFENSE found the following issues:</p>

- <ul>

- <li>Several dissectors were susceptible to a format string

- </ul>

- <h1>Impact:</h1>

- <p>It may be possible to make Ethereal crash, use up

- </description>

- <references>

- </references>

- <dates>

- <discovery>2005-07-26</discovery>

- <entry>2005-07-30</entry>

- <topic>apache -- http request smuggling</topic>

- <affects>

- <name>apache</name>

- <range><lt>1.3.33_2</lt></range>

- </package>

- <package>

- <name>apache+ssl</name>

- <range><lt>1.3.33.1.55_1</lt></range>

- </package>

- <package>

- <name>apache+mod_perl</name>

- <range><lt>1.3.33_3</lt></range>

- </package>

- <package>

- <name>apache+mod_ssl</name>

- <name>apache+mod_ssl+ipv6</name>

- </package>

- <package>

- <name>apache_fp</name>

- <name>apache+ipv6</name>

- <name>ru-apache+mod_ssl</name>

- <name>ru-apache</name>

- </affects>

- <description>

- crafted HTTP requests, taking advantage of an caching server,

- proxy server, web application firewall etc. This only affects

- installations where Apache is used as HTTP proxy in

- combination with the following web servers:</p>

- <li>IIS/6.0 and 5.0</li>

- <li>Apache 2.0.45 (as web server)</li>

- <li>apache 1.3.29</li>

- <li>WebSphere 5.1 and 5.0</li>

- <li>WebLogic 8.1 SP1</li>

- <li>Oracle9iAS web server 9.0.2</li>

- <li>SunONE web server 6.1 SP4</li>

- </description>

- <references>

- <bid>14106</bid>

- <cvename>CVE-2005-2088</cvename>

- </references>

- <dates>

- <discovery>2005-07-25</discovery>

- <entry>2005-07-26</entry>

- <name>clamav</name>

- <range><lt>0.86.2</lt></range>

- </package>

- <package>

- <name>clamav-devel</name>

- <range><le>20050704</le></range>

- </affects>

- <description>

- <p>An Secunia Advisory reports:</p>

- <blockquote cite="http://secunia.com/advisories/16180/">

- via a specially crafted CHM file with a chunk entry that

- has a filename length of -1.</li>

- </description>

- <references>

- </references>

- <dates>

- <discovery>2005-07-24</discovery>

- <entry>2005-07-25</entry>

- <name>isc-dhcp3-client</name>

- <name>isc-dhcp3-devel</name>

- <name>isc-dhcp3-relay</name>

- <name>isc-dhcp3-server</name>

- <name>isc-dhcp3</name>

- <name>isc-dhcp</name>

- <name>isc-dhcpd</name>

- </affects>

- <description>

- string vulnerabilities which may allow a remote attacker to

- execute arbitrary code with the permissions of the DHCP

- programs, typically root for the DHCP server.</p>

- </description>

- <references>

- <bid>11591</bid>

- <certvu>448384</certvu>

- <cvename>CVE-2004-1006</cvename>

- <mlist msgid="20041109003345.GG763@isc.org">http://marc.theaimsgroup.com/?l=dhcp-announce&amp;m=109996073218290</mlist>

- </references>

- <dates>

- <discovery>2004-11-08</discovery>

- <entry>2005-07-23</entry>

- <topic>egroupware -- multiple cross-site scripting (XSS) and SQL

- <name>egroupware</name>

- <range><lt>1.0.0.007</lt></range>

- </affects>

- <description>

- <p>Multiple cross-site scripting (XSS) vulnerabilities in eGroupware

- before 1.0.0.007 allow remote attackers to inject arbitrary web

- script or HTML via the (1) ab_id, (2) page, (3) type,

- or (4) lang parameter to index.php or (5) category_id parameter.

- </p>

- <p>Multiple SQL injection vulnerabilities in index.php in eGroupware

- before 1.0.0.007 allow remote attackers to execute arbitrary SQL

- commands via the (1) filter or (2) cats_app parameter.

- </description>

- <references>

- <cvename>CVE-2005-1202</cvename>

- <cvename>CVE-2005-1203</cvename>

- </references>

- <dates>

- <discovery>2005-04-20</discovery>

- <entry>2005-07-23</entry>

- <topic>fetchmail -- denial of service/crash from malicious POP3 server</topic>

- <affects>

- <name>fetchmail</name>

- <range><eq>6.2.5.1</eq></range>

- </affects>

- <description>

- of RFC-1939), or a message without Message-ID when no UIDL

- support is available.</p>

- </description>

- <references>

- <mlist msgid="20050721172317.GB3071@amilo.ms.mff.cuni.cz">http://lists.berlios.de/pipermail/fetchmail-devel/2005-July/000397.html</mlist>

- </references>

- <dates>

- <discovery>2005-07-21</discovery>

- <entry>2005-07-22</entry>

- <name>dnrd</name>

- <range><lt>2.19.1</lt></range>

- </affects>

- <description>

- </description>

- <references>

- <cvename>CVE-2005-2315</cvename>

- <cvename>CVE-2005-2316</cvename>

- </references>

- <dates>

- <discovery>2005-07-21</discovery>

- <entry>2005-07-21</entry>

- <name>powerdns</name>

- <range><lt>2.9.18</lt></range>

- </affects>

- <description>

- </description>

- <references>

- </references>

- <dates>

- <discovery>2005-07-16</discovery>

- <entry>2005-07-21</entry>

- <topic>fetchmail -- remote root/code injection from malicious POP3 server</topic>

- <affects>

- <name>fetchmail</name>

- <range><lt>6.2.5.1</lt></range>

- </affects>

- <description>

- <p>fetchmail's POP3/UIDL code does not truncate received UIDs properly.

- A malicious or compromised POP3 server can thus corrupt fetchmail's

- stack and inject code when fetchmail is using UIDL, either through

- configuration, or as a result of certain server capabilities. Note

- that fetchmail is run as root on some sites, so an attack might

- compromise the root account and thus the whole machine.</p>

- </description>

- <references>

- <cvename>CVE-2005-2335</cvename>

- <freebsdpr>ports/83805</freebsdpr>

- </references>

- <dates>

- <discovery>2005-07-20</discovery>

- <entry>2005-07-20</entry>

- <name>kdebase</name>

- <range><ge>3.2.0</ge><lt>3.4.1</lt></range>

- </package>

- <package>

- </affects>

- <description>

- <p>A KDE Security Advisory explains:</p>

- <blockquote cite="http://www.kde.org/info/security/advisory-20050718-1.txt">

- <p>Kate / Kwrite create a file backup before saving a modified

- file. These backup files are created with default permissions,

- even if the original file had more strict permissions set.</p>

- </description>

- <references>

- </references>

- <dates>

- <discovery>2005-07-18</discovery>

- <entry>2005-07-18</entry>

- <name>firefox</name>

- <range><lt>1.0.5,1</lt></range>

- </package>

- <package>

- <name>linux-firefox</name>

- <range><lt>1.0.5</lt></range>

- </package>

- <package>

- <name>mozilla</name>

- <range><lt>1.7.9,2</lt></range>

- </package>

- <package>

- <name>linux-mozilla</name>

- <name>linux-mozilla-devel</name>

- <range><lt>1.7.9</lt></range>

- <range><ge>1.8.*</ge></range>

- </package>

- <package>

- <name>netscape7</name>

- <range><ge>0</ge></range>

- </package>

- <package>

- <name>zhTW-linux-mozillafirebird</name>

- <range><ge>0</ge></range>

- </package>

- <package>

- <name>de-linux-netscape</name>

- <name>de-netscape7</name>

- <name>fr-linux-netscape</name>

- <name>fr-netscape7</name>

- <name>ja-linux-netscape</name>

- <name>ja-netscape7</name>

- <name>linux-netscape</name>

- <name>linux-phoenix</name>

- <name>mozilla+ipv6</name>

- <name>mozilla-embedded</name>

- <name>mozilla-firebird</name>

- <name>mozilla-gtk1</name>

- <name>mozilla-gtk2</name>

- <name>mozilla-gtk</name>

- <name>mozilla-thunderbird</name>

- <name>phoenix</name>

- <name>pt_BR-netscape7</name>

- <range><ge>0</ge></range>

- </package>

- </affects>

- <description>

- <blockquote cite="http://www.mozilla.org/projects/security/known-vulnerabilities.html">

- <li><em>MFSA 2005-56</em> Code execution through shared function

- <li><em>MFSA 2005-54</em> Javascript prompt origin spoofing</li>

- <li><em>MFSA 2005-53</em> Standalone applications can run arbitrary

- <li><em>MFSA 2005-52</em> Same origin violation: frame calling

- <li><em>MFSA 2005-50</em> Possibly exploitable crash in

- <li><em>MFSA 2005-49</em> Script injection from Firefox sidebar

- <li><em>MFSA 2005-48</em> Same-origin violation with InstallTrigger

- <li><em>MFSA 2005-46</em> XBL scripts ran even when Javascript

- </description>

- <references>

- <cvename>CVE-2005-1937</cvename>

- <cvename>CVE-2005-2260</cvename>

- <cvename>CVE-2005-2261</cvename>

- <cvename>CVE-2005-2262</cvename>

- <cvename>CVE-2005-2263</cvename>

- <cvename>CVE-2005-2264</cvename>

- <cvename>CVE-2005-2265</cvename>

- <cvename>CVE-2005-2266</cvename>

- <cvename>CVE-2005-2267</cvename>

- <cvename>CVE-2005-2268</cvename>

- <cvename>CVE-2005-2269</cvename>

- <cvename>CVE-2005-2270</cvename>

- </references>

- <dates>

- <discovery>2005-07-12</discovery>

- <entry>2005-07-16</entry>

- <name>drupal</name>

- <range><lt>4.6.2</lt></range>

- </affects>

- <description>

- <p>Kuba Zygmunt discovered a flaw in the input validation routines

- arbitrary PHP code on a target site when public comments or

- postings are allowed.</p>

- </description>

- <references>

- <cvename>CVE-2005-1921</cvename>

- <cvename>CVE-2005-2106</cvename>

- </references>

- <dates>

- <discovery>2005-06-29</discovery>

- <entry>2005-07-16</entry>

- <name>phpSysInfo</name>

- <range><gt>0</gt></range>

- </affects>

- <description>

- Input is not properly sanitised before it is returned to the

- user. A malicious person could exploit this to execute

- Also it is possible to view the full path of certain scripts

- by accessing them directly.</p>

- </description>

- <references>

- <bid>12887</bid>

- <cvename>CVE-2005-0869</cvename>

- <cvename>CVE-2005-0870</cvename>

- <mlist msgid="20050323180207.11987.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=111161017209422</mlist>

- </references>

- <dates>

- <discovery>2005-03-22</discovery>

- <entry>2005-07-09</entry>

- </affects>

- <description>

- </description>

- <references>

- <bid>13660</bid>

- <cvename>CVE-2005-1636</cvename>

- </references>

- <dates>

- <discovery>2005-05-07</discovery>

- <entry>2005-07-09</entry>

- <name>net-snmp</name>

- <range><lt>5.2.1.2</lt></range>

- </affects>

- <description>

- <p>A Gentoo advisory reports:</p>

- <blockquote cite="http://www.gentoo.org/security/en/glsa/glsa-200505-18.xml">

- to change the content of the temporary files before they

- are executed by fixproc, possibly leading to the execution

- of arbitrary code. A local attacker could also create

- symbolic links in the temporary files directory, pointing

- to a valid file somewhere on the filesystem. When fixproc

- is executed, this would result in the file being

- overwritten.</p>

- </description>

- <references>

- <bid>13715</bid>

- <cvename>CVE-2005-1740</cvename>

- </references>

- <dates>

- <discovery>2005-05-23</discovery>

- <entry>2005-07-09</entry>

- <topic>phpbb -- multiple vulnerabilities</topic>

- <affects>

- <name>phpbb</name>

- <range><lt>2.0.12</lt></range>

- </affects>

- <description>

- </description>

- <references>

- <bid>12618</bid>

- <bid>12621</bid>

- <bid>12623</bid>

- <cvename>CVE-2005-0258</cvename>

- <cvename>CVE-2005-0259</cvename>

- </references>

- <dates>

- <name>shtool</name>

- <range><le>2.0.1</le></range>

- </affects>

- <description>

- flaw which could allow a malicious local user to create or

- overwrite the contents of arbitrary files. The attacker

- could fool a user into executing the arbitrary file possibly

- executing arbitrary code.</p>

- </description>

- <references>

- </references>

- <dates>

- <discovery>2005-05-25</discovery>

- <entry>2005-07-09</entry>

- <topic>phppgadmin -- "formLanguage" local file inclusion vulnerability</topic>

- <affects>

- <name>phppgadmin</name>

- <range><lt>3.5.4</lt></range>

- </affects>

- <description>

- <p>A Secunia Advisory reports:</p>

- <blockquote cite="http://secunia.com/advisories/15941/">

- "index.php" isn't properly verified, before it is used to

- include files. This can be exploited to include arbitrary

- files from local resources.</p>

- </description>

- <references>

- <bid>14142</bid>

- <cvename>CVE-2005-2256</cvename>

- </references>

- <dates>

- <discovery>2005-07-05</discovery>

- <entry>2005-07-08</entry>

- <name>pear-XML_RPC</name>

- <range><lt>1.3.2</lt></range>

- </affects>

- <description>

- <blockquote cite="http://pear.php.net/package/XML_RPC/download/1.3.2">

- <p>Eliminate path disclosure vulnerability by catching bogus

- </description>

- <references>

- </references>

- <dates>

- <discovery>2005-07-07</discovery>

- <entry>2005-07-08</entry>

- <topic>ekg -- insecure temporary file creation</topic>

- <affects>

- <name>pl-ekg</name>

- <range><lt>1.6r2,1</lt></range>

- </affects>

- <description>

- <p>Eric Romang reports that ekg creates temporary files in an

- insecure manner. This can be exploited by an attacker using

- a symlink attack to overwrite arbitrary files and possibly

- execute arbitrary commands with the permissions of the user

- running ekg.</p>

- </description>

- <references>

- <bid>14146</bid>

- <cvename>CVE-2005-1916</cvename>

- <mlist msgid="42CA2DDB.5030606@zataz.net">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=112060146011122</mlist>

- </references>

- <dates>

- <discovery>2005-07-05</discovery>

- <entry>2005-07-08</entry>

- <topic>bugzilla -- multiple vulnerabilities</topic>

- <affects>

- <name>bugzilla</name>

- <name>ja-bugzilla</name>

- </affects>

- <description>

- <p>A Bugzilla Security Advisory reports:</p>

- <blockquote cite="http://www.bugzilla.org/security/2.18.1/">

- normally make bug changes. This also allows them to expose

- the summary of a bug.</p>

- replication can lag in between the time that the bug is

- inserted and when it is marked as private (usually less

- than a second). If replication lags at this point, the bug

- summary will be accessible to all users until replication

- catches up. Also, on a very slow machine, there may be a

- pause longer than a second that allows users to see the

- title of the newly-filed bug.</p>

- </description>

- <references>

- <cvename>CVE-2005-2173</cvename>

- <cvename>CVE-2005-2174</cvename>

- </references>

- <dates>

- <discovery>2005-07-07</discovery>

- <entry>2005-07-08</entry>

- <topic>nwclient -- multiple vulnerabilities</topic>

- <affects>

- <name>nwclient</name>

- <range><gt>0</gt></range>

- </affects>

- <description>

- <p>Insecure file permissions, network access control and DNS

- unauthorized backups to be made. Sensitive information can

- be extracted from these backups.</p>

- </description>

- <references>

- <bid>3564</bid>

- <bid>3840</bid>

- <bid>3842</bid>

- <cvename>CVE-2001-0910</cvename>

- <cvename>CVE-2002-0113</cvename>

- </references>

- <dates>

- <discovery>2002-01-10</discovery>

- <entry>2005-07-08</entry>

- <name>acroread4</name>

- <name>acroread5</name>

- </package>

- <package>

- <name>acroread</name>

- <range><lt>7.0.0</lt></range>

- </affects>

- <description>

- <p>Secunia Research reports:</p>

- <blockquote cite="http://secunia.com/secunia_research/2005-6/advisory/">

- <p>Successful exploitation allows an unprivileged user to

- </description>

- <references>

- </references>

- <dates>

- <discovery>2005-06-29</discovery>

- <entry>2005-07-06</entry>

- <name>clamav</name>

- <range><lt>0.86</lt></range>

- </package>

- <package>

- <name>clamav-devel</name>

- <range><lt>20050620</lt></range>

- </affects>

- <description>

- <p>An iDEFENSE Security Advisory reports:</p>

- <blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=112006456809016">

- <p>Remote exploitation of an input validation error in Clam

- <code>ENSURE_BITS()</code> macro fails to check for zero

- length reads, allowing a carefully constructed cabinet

- file to cause an infinite loop.</p>

- products. Successful exploitation requires an attacker to

- send a specially constructed CAB file through a mail

- gateway or personal anti-virus client utilizing the ClamAV

- scanning engine. The infinate loop will cause the ClamAV

- software to use all available processor resources,

- resulting in a denial of service or severe degradation to

- system performance. Remote exploitation can be achieved by

- sending a malicious file in an e-mail message or during an

- HTTP session.</p>

- </description>

- <references>

- <cvename>CVE-2005-1923</cvename>

- <mlist msgid="FB24803D1DF2A34FA59FC157B77C97050462A3AB@IDSERV04.idef.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=112006456809016</mlist>

- </references>

- <dates>

- <discovery>2005-06-29</discovery>

- <entry>2005-07-06</entry>

- <name>clamav</name>

- <range><lt>0.86</lt></range>

- </package>

- <package>

- <name>clamav-devel</name>

- <range><lt>20050620</lt></range>

- </affects>

- <description>

- <p>An iDEFENSE Security Advisory reports:</p>

- <blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=112006402411598">

- <p>Remote exploitation of an input validation error in Clam

- <p>Successful exploitation allows attackers to exhaust file

- </description>

- <references>

- <cvename>CVE-2005-1922</cvename>

- <mlist msgid="FB24803D1DF2A34FA59FC157B77C97050462A3AC@IDSERV04.idef.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=112006402411598</mlist>

- </references>

- <dates>

- <discovery>2005-06-29</discovery>

- <entry>2005-07-06</entry>

- <topic>zlib -- buffer overflow vulnerability</topic>

- <affects>

- <name>zsync</name>

- <range><lt>0.4.1</lt></range>

- </package>

- <system>

- <name>FreeBSD</name>

- <range><ge>5.4</ge><lt>5.4_4</lt></range>

- </affects>

- <description>

- <h1>Problem Description</h1>

- <p>An error in the handling of corrupt compressed data streams

- <h1>Impact</h1>

- <p>By carefully crafting a corrupt compressed data stream, an

- application. This may cause the application to halt,

- </description>

- <references>

- <cvename>CVE-2005-2096</cvename>

- <freebsdsa>SA-05:16.zlib</freebsdsa>

- </references>

- <dates>

- <discovery>2005-07-06</discovery>

- <entry>2005-07-06</entry>

- <topic>acroread -- buffer overflow vulnerability</topic>

- <affects>

- <name>acroread4</name>

- <name>acroread5</name>

- </package>

- <package>

- <name>acroread</name>

- <range><lt>7.0.0</lt></range>

- </affects>

- <description>

- <p>An Adobe Security Advisory reports:</p>

- <blockquote cite="http://www.adobe.com/support/techdocs/329083.html">

- exploitation is possible if the malicious PDF document is

- sent as an email attachment or if the PDF document is

- accessed via a web link.</p>

- </description>

- <references>

- <url>http://www.adobe.com/support/techdocs/329083.html</url>

- <mlist msgid="FB24803D1DF2A34FA59FC157B77C97050462A5E2@IDSERV04.idef.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=112059685332569</mlist>

- </references>

- <dates>

- <discovery>2005-07-05</discovery>

- <entry>2005-07-06</entry>

- <topic>net-snmp -- remote DoS vulnerability</topic>

- <affects>

- <name>net-snmp</name>

- <range><lt>5.2.1.2</lt></range>

- </affects>

- <description>

- <p>A Net-SNMP release announcement reports:</p>

- <blockquote cite="http://marc.theaimsgroup.com/?l=net-snmp-announce&amp;m=112059518426328">

- against Net-SNMP agent's which have opened a stream based

- protocol (EG, TCP but not UDP; it should be noted that

- Net-SNMP does not by default open a TCP port).</p>

- </description>

- <references>

- <bid>14168</bid>

- <cvename>CVE-2005-2177</cvename>

- <mlist msgid="sdzmt5sul0.fsf@wes.hardakers.net">http://marc.theaimsgroup.com/?l=net-snmp-announce&amp;m=112059518426328</mlist>

- </references>

- <dates>

- <discovery>2005-07-02</discovery>

- <entry>2005-07-05</entry>

- <topic>cacti -- multiple vulnerabilities</topic>

- <affects>

- <name>cacti</name>

- <range><lt>0.8.6f</lt></range>

- </affects>

- <description>

- <p>Stefan Esser reports:</p>

- <blockquote cite="http://www.hardened-php.net/advisory-032005.php">

- </blockquote>

- <blockquote cite="http://www.hardened-php.net/advisory-042005.php">

- </blockquote>

- <blockquote cite="http://www.hardened-php.net/advisory-052005.php">

- completely bypass the authentification system of Cacti. As

- admin it is possible to execute shell commands with the

- permission of the webserver.</p>

- <p>When register_globals is turned on* an attacker can use

- support and therefore supply the session variables on his

- own through f.e. the URL. Additionally using the switch

- renders several SQL statements vulnerable to SQL

- Injections attacks, when magic_quotes_gpc is turned off,

- which is the recommended setting.</p>

- <p>(*) register_globals is turned off by default since PHP

- </description>

- <references>

- <mlist msgid="007301c57753$5ab17f60$0100a8c0@alberto">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=111954136315248</mlist>

- </references>

- <dates>

- <discovery>2005-06-22</discovery>

- <entry>2005-07-05</entry>

- <topic>wordpress -- multiple vulnerabilities</topic>

- <affects>

- <name>wordpress</name>

- <range><lt>1.5.1.3,1</lt></range>

- </affects>

- <description>

- <p>GulfTech Security Research reports:</p>

- <blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=112006967221438">

- <p>There are a number of vulnerabilities in WordPress that

- may allow an attacker to ultimately run arbitrary code on

- the vulnerable system. These vulnerabilities include SQL

- Injection, Cross Site Scripting, and also issues that may

- aid an attacker in social engineering.</p>

- </description>

- <references>

- <cvename>CVE-2005-2107</cvename>

- <cvename>CVE-2005-2108</cvename>

- <cvename>CVE-2005-2109</cvename>

- <cvename>CVE-2005-2110</cvename>

- <mlist msgid="42C2BE6E.2050408@gulftech.org">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=112006967221438</mlist>

- </references>

- <dates>

- <discovery>2005-06-28</discovery>

- <entry>2005-07-05</entry>

- <topic>wordpress -- multiple vulnerabilities</topic>

- <affects>

- <name>wordpress</name>

- <range><lt>1.5.1.2,1</lt></range>

- </affects>

- <description>

- <p>A Gentoo Linux Security Advisory reports:</p>

- <blockquote cite="http://www.gentoo.org/security/en/glsa/glsa-200506-04.xml">

- <p>An attacker could use the SQL injection vulnerabilites to

- </description>

- <references>

- </references>

- <dates>

- <discovery>2005-04-12</discovery>

- <entry>2005-07-05</entry>

- <name>phpbb</name>

- <range><lt>2.0.16</lt></range>

- </affects>

- <description>

- <p>FrSIRT Advisory reports:</p>

- <blockquote cite="http://www.frsirt.com/english/advisories/2005/0904">

- web server. This flaw is due to an input validation error

- in the "viewtopic.php" script that does not properly filter

- the "highlight" parameter before calling the "preg_replace()"

- function, which may be exploited by remote attackers to execute

- arbitrary PHP commands with the privileges of the web server.</p>

- </description>

- <references>

- </references>

- <dates>

- <discovery>2005-06-28</discovery>

- <entry>2005-07-03</entry>

- <name>pear-XML_RPC</name>

- <range><lt>1.3.1</lt></range>

- </affects>

- <description>

- <p>GulfTech Security Research Team reports:</p>

- <blockquote cite="http://www.gulftech.org/?node=research&amp;article_id=00087-07012005">

- <p>PEAR XML_RPC is vulnerable to a very high risk php code

- </description>

- <references>

- </references>

- <dates>

- <discovery>2005-06-29</discovery>

- <entry>2005-07-03</entry>

- <topic>kernel -- ipfw packet matching errors with address tables</topic>

- <affects>

- <name>FreeBSD</name>

- <range><ge>5.4</ge><lt>5.4_3</lt></range>

- </affects>

- <description>

- <body xmlns="http://www.w3.org/1999/xhtml">

- <h1>Problem Description</h1>

- <p>The ipfw tables lookup code caches the result of the last

- query. The kernel may process multiple packets

- concurrently, performing several concurrent table lookups.

- Due to an insufficient locking, a cached result can become

- corrupted that could cause some addresses to be incorrectly

- matched against a lookup table.</p>

- <h1>Impact</h1>

- <p>When lookup tables are used with ipfw, packets may on very

- rare occasions incorrectly match a lookup table. This could

- result in a packet being treated contrary to the defined

- packet filtering ruleset. For example, a packet may be

- allowed to pass through when it should have been

- <h1>Workaround</h1>

- <p>a) Do not use lookup tables.</p>

- <p>OR</p>

- <p>b) Disable concurrent processing of packets in the network

- </description>

- <references>

- <cvename>CVE-2005-2019</cvename>

- <freebsdsa>SA-05:13.ipfw</freebsdsa>

- </references>

- <dates>

- <discovery>2005-06-29</discovery>

- <entry>2005-06-29</entry>

- <topic>bzip2 -- denial of service and permission race vulnerabilities</topic>

- <affects>

- <name>FreeBSD</name>

- <range><ge>5.4</ge><lt>5.4_3</lt></range>

- </system>

- <package>

- <name>bzip2</name>

- <range><lt>1.0.3_1</lt></range>

- </affects>

- <description>

- <h1>Problem Description</h1>

- <p>Two problems have been discovered relating to the

- extraction of bzip2-compressed files. First, a carefully

- <h1>Impact</h1>

- <p>The first problem can cause bzip2 to extract a bzip2

- archive to an infinitely large file. If bzip2 is used in

- automated processing of untrusted files this could be

- <p>The second problem can allow a local attacker to change the

- permissions of local files owned by the user executing bzip2

- providing that they have write access to the directory in

- which the file is being extracted.</p>

- <h1>Workaround</h1>

- <p>Do not uncompress bzip2 archives from untrusted sources and

- do not uncompress files in directories where untrusted users

- have write access.</p>

- </description>

- <references>

- <cvename>CVE-2005-0953</cvename>

- <cvename>CVE-2005-1260</cvename>

- </references>

- <dates>

- <discovery>2005-03-30</discovery>

- <entry>2005-06-29</entry>

- <name>FreeBSD</name>

- <range><ge>5.4</ge><lt>5.4_3</lt></range>

- </affects>

- <description>

- <h1>Problem Description</h1>

- <p>Two problems have been discovered in the FreeBSD TCP stack.</p>

- <p>First, when a TCP packets containing a timestamp is

- performed, allowing an attacker to artificially increase the

- internal "recent" timestamp for a connection.</p>

- <p>Second, a TCP packet with the SYN flag set is accepted for

- <h1>Impact</h1>

- <p>Using either of the two problems an attacker with knowledge

- of the local and remote IP and port numbers associated with

- a connection can cause a denial of service situation by

- stalling the TCP connection. The stalled TCP connection my

- be closed after some time by the other host.</p>

- <h1>Workaround</h1>

- <p>In some cases it may be possible to defend against these

- </description>

- <references>

- <certvu>637934</certvu>

- <cvename>CVE-2005-0356</cvename>

- <cvename>CVE-2005-2068</cvename>

- <freebsdsa>SA-05:15.tcp</freebsdsa>

- </references>

- <dates>

- <discovery>2005-06-29</discovery>

- <entry>2005-06-29</entry>

- <name>ethereal</name>

- <name>ethereal-lite</name>

- <name>tethereal</name>

- <name>tethereal-lite</name>

- </affects>

- <description>

- <p>An Ethreal Security Advisories reports:</p>

- <blockquote cite="http://www.ethereal.com/appnotes/enpa-sa-00019.html">

- <li>The ANSI A dissector was susceptible to format string

- <li>The GSM MAP dissector could crash.</li>

- <li>The AIM dissector could cause a crash.</li>

- <li>The DISTCC dissector was susceptible to a buffer

- <li>The Telnet dissector could abort.</li>

- <li>The TZSP dissector could cause a segmentation

- <li>The SMB Mailslot dissector was susceptible to a null

- <li>The SMB dissector could cause a segmentation fault and

- <li>The SRVLOC dissector could crash unexpectedly or go

- <li>The NCP dissector could overflow a buffer or loop for

- <li>The L2TP dissector was susceptible to an infinite loop.</li>

- <li>The SMB NETLOGON dissector could dereference a null

- <li>The ISUP dissector could overflow a buffer or cause a

- <li>The LDAP dissector could crash.</li>

- <li>The TCAP dissector could overflow a buffer or throw an

- <li>The NTLMSSP dissector could crash.</li>

- <li>The Presentation dissector could overflow a

- <li>Additionally, a number of dissectors could throw an

- </description>

- <references>

- <bid>13391</bid>

- <bid>13504</bid>

- <bid>13567</bid>

- <cvename>CVE-2005-1281</cvename>

- <cvename>CVE-2005-1456</cvename>

- <cvename>CVE-2005-1457</cvename>

- <cvename>CVE-2005-1458</cvename>

- <cvename>CVE-2005-1459</cvename>

- <cvename>CVE-2005-1460</cvename>

- <cvename>CVE-2005-1461</cvename>

- <cvename>CVE-2005-1462</cvename>

- <cvename>CVE-2005-1463</cvename>

- <cvename>CVE-2005-1464</cvename>

- <cvename>CVE-2005-1465</cvename>

- <cvename>CVE-2005-1466</cvename>

- <cvename>CVE-2005-1467</cvename>

- <cvename>CVE-2005-1468</cvename>

- <cvename>CVE-2005-1469</cvename>

- <cvename>CVE-2005-1470</cvename>

- </references>

- <dates>

- <discovery>2005-05-04</discovery>

- <entry>2005-06-24</entry>

- <topic>tor -- information disclosure</topic>

- <affects>

- <name>tor</name>

- <range><lt>0.1.0.10</lt></range>

- </affects>

- <description>

- <p>Roger Dingledine reports:</p>

- <blockquote cite="http://archives.seul.org/or/announce/Jun-2005/msg00001.html">

- server's process space. We haven't heard any reports of

- exploits yet, but hey.</p>

- </description>

- <references>

- </references>

- <dates>

- <discovery>2005-06-16</discovery>

- <entry>2005-06-24</entry>

- <name>linux-realplayer</name>

- <range><le>10.0.4_1</le></range>

- </affects>

- <description>

- <p>An iDEFENSE Security Advisory reports:</p>

- <blockquote cite="http://www.idefense.com/application/poi/display?id=250&amp;type=vulnerabilities&amp;flashstatus=false">

- parser within various versions of RealNetworks

- Inc.'s RealPlayer could allow attackers to

- execute arbitrary code.</p>

- </description>

- <references>

- </references>

- <dates>

- <discovery>2005-06-23</discovery>

- <entry>2005-06-24</entry>

- <name>ruby</name>

- <name>ruby_static</name>

- </affects>

- <description>

- <p>Nobuhiro IMAI reports:</p>

- <blockquote cite="http://blade.nagaokaut.ac.jp/cgi-bin/scat.rb/ruby/ruby-core/5237">

- Module#public_instance_methods (from false to true) breaks

- s.add_handler(XMLRPC::iPIMethods("sample"), MyHandler.new) style

- security protection.</p>

- <p>This problem could allow a remote attacker to execute arbitrary

- </description>

- <references>

- </references>

- <dates>

- <discovery>2005-06-22</discovery>

- <entry>2005-06-23</entry>

- <topic>cacti -- potential SQL injection and cross site scripting attacks</topic>

- <affects>

- <name>cacti</name>

- <range><le>0.8.6d</le></range>

- </affects>

- <description>

- <p>iDEFENSE security group disclosed potential SQL injection

- </description>

- <references>

- </references>

- <dates>

- <discovery>2005-06-21</discovery>

- <entry>2005-06-21</entry>

- <topic>opera -- XMLHttpRequest security bypass</topic>

- <affects>

- <name>linux-opera</name>

- <name>opera-devel</name>

- <name>opera</name>

- <range><gt>8.*</gt><lt>8.01</lt></range>

- </affects>

- <description>

- <p>A Secunia Advisory reports:</p>

- <blockquote cite="http://secunia.com/advisories/15008/">

- <p>Secunia Research has discovered a vulnerability in Opera,

- content or to perform actions on other web sites with the

- privileges of the user.</p>

- from outside the domain of which the object was

- opened. However, due to insufficient validation of server

- side redirects, it is possible to circumvent this

- restriction.</p>

- </description>

- <references>

- </references>

- <dates>

- <discovery>2005-06-16</discovery>

- <entry>2005-06-20</entry>

- <name>linux-opera</name>

- <name>opera-devel</name>

- <name>opera</name>

- <range><lt>8.01</lt></range>

- </affects>

- <description>

- <p>A Secunia Advisory reports:</p>

- <blockquote cite="http://secunia.com/advisories/15411/">

- <p>Secunia Research has discovered a vulnerability in Opera,

- </description>

- <references>

- </references>

- <dates>

- <discovery>2005-06-16</discovery>

- <entry>2005-06-20</entry>

- <name>linux-opera</name>

- <name>opera-devel</name>

- <name>opera</name>

- <range><gt>8.*</gt><lt>8.01</lt></range>

- </affects>

- <description>

- <p>A Secunia Advisory reports:</p>

- <blockquote cite="http://secunia.com/advisories/15423/">

- <p>Secunia Research has discovered a vulnerability in Opera,

- displaying a redirection when "Automatic redirection" is

- disabled (not default setting).</p>

- </description>

- <references>

- </references>

- <dates>

- <discovery>2005-06-16</discovery>

- <entry>2005-06-20</entry>

- <name>sudo</name>

- <range><lt>1.6.8.9</lt></range>

- </affects>

- <description>

- <p>Todd C. Miller reports:</p>

- <blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=111928183431376">

- prior to Sudo version 1.6.8p9 that could allow a user with

- Sudo privileges to run arbitrary commands.</p>

- <p>Exploitation of the bug requires that the user be allowed

- to run one or more commands via Sudo and be able to create

- symbolic links in the filesystem. Furthermore, a sudoers

- entry giving another user access to the ALL pseudo-command

- must follow the user's sudoers entry for the race to

- exist.</p>

- </description>

- <references>

- <bid>13993</bid>

- <mlist msgid="200506201424.j5KEOhQI024645@xerxes.courtesan.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=111928183431376</mlist>

- </references>

- <dates>

- <discovery>2005-06-20</discovery>

- <entry>2005-06-20</entry>

- <name>trac</name>

- <range><lt>0.8.4</lt></range>

- </affects>

- <description>

- <p>Stefan Esser reports:</p>

- <blockquote cite="http://www.hardened-php.net/advisory-012005.php">

- are stored within directories that are determined by the

- id of the corresponding ticket or wiki entry.</p>

- possible for an attacker to supply arbitrary paths to the

- upload and attachment viewer scripts. This means that a

- potential attacker can retrieve any file accessible by the

- webserver user.</p>

- <p>Additionally it is possible to upload arbitrary files (up

- configuration would be f.e. running Trac and

- s9y/wordpress with writeable content directories on the

- same webserver.</p>

- <p>Another potential usage of this exploit would be to abuse

- </description>

- <references>

- </references>

- <dates>

- <discovery>2005-06-20</discovery>

- <entry>2005-06-20</entry>

- <name>razor-agents</name>

- <range><le>2.71</le></range>

- </affects>

- <description>

- <p>A Secunia security advisory reports:</p>

- <blockquote cite="http://secunia.com/advisories/15739/">

- which can be exploited by malicious people to cause a DoS

- (Denial of Service).</p>

- <li>A bug in the discovery logic causes Razor-agents to go

- </description>

- <references>

- </references>

- <dates>

- <discovery>2005-06-17</discovery>

- <entry>2005-06-20</entry>

- </affects>

- <description>

- <p>Apache SpamAssassin Security Team reports:</p>

- <blockquote cite="http://mail-archives.apache.org/mod_mbox/spamassassin-announce/200506.mbox/%3c17072.35054.586017.822288@proton.pathname.com%3e">

- fixes a denial of service vulnerability in versions 3.0.1, 3.0.2,

- and 3.0.3. The vulnerability allows certain misformatted

- long message headers to cause spam checking to

- take a very long time.</p>

- recommend all users of these versions upgrade to

- Apache SpamAssassin 3.0.4 as soon as possible.</p>

- </description>

- <references>

- <cvename>CVE-2005-1266</cvename>

- <mlist msgid="c17072.35054.586017.822288@proton.pathname.com">http://mail-archives.apache.org/mod_mbox/spamassassin-announce/200506.mbox/%3c17072.35054.586017.822288@proton.pathname.com%3e</mlist>

- </references>

- <dates>

- <discovery>2005-06-15</discovery>

- <entry>2005-06-18</entry>

- <topic>squirrelmail -- Several cross site scripting vulnerabilities</topic>

- <affects>

- <name>squirrelmail</name>

- <name>ja-squirrelmail</name>

- </affects>

- <description>

- <p>A SquirrelMail Security Advisory reports:</p>

- <blockquote cite="http://www.squirrelmail.org/security/issue/2005-06-15">

- <p>Several cross site scripting (XSS) vulnerabilities have been discovered

- <p>The vulnerabilities are in two categories: the majority can be

- exploited through URL manipulation, and some by sending a specially

- crafted email to a victim. When done very carefully,

- this can cause the session of the user to be hijacked.</p>

- </description>

- <references>

- </references>

- <dates>

- <discovery>2005-06-15</discovery>

- <entry>2005-06-18</entry>

- <name>acroread7</name>

- <name>ja-acroread</name>

- </affects>

- <description>

- <p>Sverre H. Huseby discovered a vulnerability in Adobe Acrobat

- and Adobe Reader.

- Under certain circumstances, using XML scripts it is possible

- to discover the existence of local files.</p>

- </description>

- <references>

- </references>

- <dates>

- <discovery>2005-06-15</discovery>

- <entry>2005-06-18</entry>

- <name>FreeBSD</name>

- <range><ge>5.4</ge><lt>5.4_2</lt></range>

- </system>

- <package>

- <name>gzip</name>

- <range><lt>1.3.5_2</lt></range>

- </package>

- </affects>

- <description>

- <body xmlns="http://www.w3.org/1999/xhtml">

- <h1>Problem Description</h1>

- <p>Two problems related to extraction of files exist in gzip:</p>

- <p>The first problem is that gzip does not properly sanitize

- filenames containing "/" when uncompressing files using the

- -N command line option.</p>

- <p>The second problem is that gzip does not set permissions on

- <h1>Impact</h1>

- <p>The first problem can allow an attacker to overwrite

- arbitrary local files when uncompressing a file using the -N

- command line option.</p>

- <p>The second problem can allow a local attacker to change the

- the file the user is uncompressing and replacing it with a

- hardlink before the uncompress operation is finished.</p>

- <h1>Workaround</h1>

- <p>Do not use the -N command line option on untrusted files

- </description>

- <references>

- <cvename>CVE-2005-0988</cvename>

- <cvename>CVE-2005-1228</cvename>

- <freebsdsa>SA-05:11.gzip</freebsdsa>

- <mlist msgid="7389fc4b05040412574f819112@mail.gmail.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=111271860708210</mlist>

- <mlist msgid="7389fc4b0504201224759f31b@mail.gmail.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=111402732406477</mlist>

- </references>

- <dates>

- <discovery>2005-04-20</discovery>

- <entry>2005-06-18</entry>

- <name>FreeBSD</name>

- <range><ge>5.4</ge><lt>5.4_2</lt></range>

- <range><ge>5.3</ge><lt>5.3_16</lt></range>

- </system>

- <package>

- <name>tcpdump</name>

- <range><lt>3.8.3_2</lt></range>

- </package>

- </affects>

- <description>

- <body xmlns="http://www.w3.org/1999/xhtml">

- <h1>Problem Description</h1>

- <p>Several tcpdump protocol decoders contain programming

- errors which can cause them to go into infinite loops.</p>

- <h1>Impact</h1>

- <p>An attacker can inject specially crafted packets into the

- network which, when processed by tcpdump, could lead to a

- denial-of-service. After the attack, tcpdump would no

- longer capture traffic, and would potentially use all

- available processor time.</p>

- </body>

- </description>

- <references>

- <cvename>CVE-2005-1267</cvename>

- <cvename>CVE-2005-1278</cvename>

- <cvename>CVE-2005-1279</cvename>

- <cvename>CVE-2005-1280</cvename>

- <freebsdsa>SA-05:10.tcpdump</freebsdsa>

- <mlist msgid="20050426100140.1945.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=111454406222040</mlist>

- <mlist msgid="20050426100057.1748.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=111454461300644</mlist>

- <mlist msgid="20050619091553.GB982@zaphod.nitro.dk">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=111928309502304</mlist>

- </references>

- <dates>

- <discovery>2005-06-09</discovery>

- <entry>2005-06-18</entry>

- <topic>gaim -- Yahoo! remote crash vulnerability</topic>

- <affects>

- <name>gaim</name>

- <name>ja-gaim</name>

- <name>ko-gaim</name>

- <name>ru-gaim</name>

- <range><lt>1.3.1</lt></range>

- </affects>

- <description>

- <p>Jacopo Ottaviani reports that Gaim can be crashed by being

- offered files with names containing non-ASCII

- characters via the Yahoo! protocol.</p>

- </description>

- <references>

- <bid>13931</bid>

- <cvename>CVE-2005-1269</cvename>

- </references>

- <dates>

- <discovery>2005-06-10</discovery>

- <entry>2005-06-17</entry>

- <topic>gaim -- MSN Remote DoS vulnerability</topic>

- <affects>

- <name>gaim</name>

- <name>ja-gaim</name>

- <name>ko-gaim</name>

- <name>ru-gaim</name>

- <range><lt>1.3.1</lt></range>

- </affects>

- <description>

- <p>The GAIM team reports:</p>

- <blockquote cite="http://gaim.sourceforge.net/security/index.php?id=19">

- </description>

- <references>

- <bid>13932</bid>

- <cvename>CVE-2005-1934</cvename>

- </references>

- <dates>

- <discovery>2005-06-10</discovery>

- <entry>2005-06-17</entry>

- <name>gallery</name>

- <range><lt>1.4.1.1</lt></range>

- </affects>

- <description>

- </description>

- <references>

- <cvename>CVE-2004-2124</cvename>

- <mlist msgid="0c0a01c3e525$1c0ed2b0$c90c030a@bmedirattatg">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=107524414317693</mlist>

- </references>

- <dates>

- <discovery>2004-01-27</discovery>

- <entry>2005-06-17</entry>

- <topic>gallery -- cross-site scripting</topic>

- <affects>

- <name>gallery</name>

- <range><lt>1.4.4.5</lt></range>

- </affects>

- <description>

- </description>

- <references>

- <cvename>CVE-2004-1106</cvename>

- <cvename>CVE-2005-0219</cvename>

- <cvename>CVE-2005-0220</cvename>

- <cvename>CVE-2005-0221</cvename>

- <cvename>CVE-2005-0222</cvename>

- <bid>11602</bid>

- </references>

- <dates>

- <discovery>2005-01-26</discovery>

- <entry>2005-06-17</entry>

- <name>kdeedu</name>

- <range><lt>3.3.2_1</lt></range>

- </affects>

- <description>

- <p>A KDE Security Advisory explains:</p>

- <blockquote cite="http://www.kde.org/info/security/advisory-20050215-1.txt">

- <h1>Overview</h1>

- <p>KStars includes support for the Instrument Neutral

- Distributed Interface (INDI). The build system of this

- extra 3rd party software contained an installation hook to

- install fliccd (part of INDI) as SUID root

- application.</p>

- <p>Erik Sjölund discovered that the code contains several

- vulnerabilities that allow stack based buffer

- overflows.</p>

- <h1>Impact</h1>

- <p>If the fliccd binary is installed as suid root, it

- enables root privilege escalation for local users, or, if

- the daemon is actually running (which it does not by

- default) and is running as root, remote root privilege

- escalation.</p>

- </description>

- <references>

- </references>

- <dates>

- <discovery>2005-01-05</discovery>

- <entry>2005-06-17</entry>

- <name>gatekeeper</name>

- <range><lt>2.2.1</lt></range>

- </package>

- <package>

- <name>citadel</name>

- <range><lt>6.29</lt></range>

- </package>

- <package>

- <name>3proxy</name>

- <range><lt>0.5.b</lt></range>

- </package>

- <package>

- <name>jabber</name>

- <name>bnc</name>

- <range><ge>0</ge></range>

- </package>

- <package>

- <name>rinetd</name>

- <range><lt>0.62_1</lt></range>

- </package>

- <package>

- <name>dante</name>

- <range><lt>1.1.15</lt></range>

- </package>

- <package>

- <name>bld</name>

- <range><lt>0.3.3</lt></range>

- </package>

- </affects>

- <description>

- <body xmlns="http://www.w3.org/1999/xhtml">

- <p>3APA3A reports:</p>

- <blockquote cite="http://www.security.nnov.ru/advisories/sockets.asp">

- application actually check FD_SETSIZE value. <em>[...]</em></p>

- </description>

- <references>

- <mlist msgid="1473827718.20050124233008@security.nnov.ru">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110660879328901</mlist>

- </references>

- <dates>

- <discovery>2004-12-12</discovery>

- <entry>2005-06-17</entry>

- <name>leafnode</name>

- <range><lt>1.11.3</lt></range>

- </affects>

- <description>

- <p>Matthias Andree reports:</p>

- <blockquote cite="http://leafnode.sourceforge.net/leafnode-SA-2005-02.txt">

- <p>A vulnerability was found in the fetchnews program (the NNTP

- client) that may under some circumstances cause a wait for input

- that never arrives, fetchnews "hangs". [...]</p>

- <p>As only one fetchnews program can run at a time, subsequently

- started fetchnews and texpire programs will terminate. [...]</p>

- </description>

- <references>

- <freebsdpr>ports/82056</freebsdpr>

- <mlist msgid="20050608215155.GB27234@merlin.emma.line.org">http://marc.theaimsgroup.com/?l=vulnwatch&amp;m=111827180929063</mlist>

- </references>

- <dates>

- <discovery>2005-06-08</discovery>

- <entry>2005-06-09</entry>

- <name>gforge</name>

- <range><lt>4.0</lt></range>

- </affects>

- <description>

- <blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110627132209963">

- </description>

- <references>

- <cvename>CVE-2005-0299</cvename>

- <bid>12318</bid>

- <mlist msgid="20050120051735.2832.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110627132209963</mlist>

- </references>

- <dates>

- <discovery>2005-01-20</discovery>

- <entry>2005-06-03</entry>

- <topic>imap-uw -- authentication bypass when CRAM-MD5 is enabled</topic>

- <affects>

- <name>imap-uw</name>

- <range><lt>2004b,1</lt></range>

- </affects>

- <description>

- <p>The CRAM-MD5 authentication support of the University of

- Washington IMAP and POP3 servers contains a vulnerability that

- may allow an attacker to bypass authentication and impersonate

- arbitrary users. Only installations with CRAM-MD5 support

- configured are affected.</p>

- </description>

- <references>

- <cvename>CVE-2005-0198</cvename>

- <certvu>702777</certvu>

- </references>

- <dates>

- <discovery>2005-01-04</discovery>

- <entry>2005-06-03</entry>

- <name>squid</name>

- <range><lt>2.5.9</lt></range>

- </affects>

- <description>

- vulnerabilities related to the handling of DNS responses and

- NT Lan Manager messages. These may allow an attacker to crash

- the Squid cache.</p>

- </description>

- <references>

- <cvename>CVE-2005-0096</cvename>

- <cvename>CVE-2005-0097</cvename>

- </references>

- <dates>

- <discovery>2005-01-16</discovery>

- <entry>2005-06-03</entry>

- <topic>racoon -- remote denial-of-service</topic>

- <affects>

- <name>racoon</name>

- <range><lt>20050510a</lt></range>

- </affects>

- <description>

- <p>Sebastian Krahmer discovered that the racoon ISAKMP daemon

- could be crashed with a maliciously crafted UDP packet. No

- authentication is required in order to perform the attack.</p>

- </description>

- <references>

- </references>

- <dates>

- <discovery>2005-03-12</discovery>

- <entry>2005-06-03</entry>

- <name>xli</name>

- <range><le>1.17.0_1</le></range>

- </affects>

- <description>

- <p>Tavis Ormandy discovered several integer overflows in xli's

- image size handling. A maliciously crafted image may be able

- to cause a heap buffer overflow and execute arbitrary code.</p>

- </description>

- <references>

- </references>

- <dates>

- <discovery>2005-02-08</discovery>

- <entry>2005-06-03</entry>

- <name>xli</name>

- <range><le>1.17.0_1</le></range>

- <package>

- <name>xloadimage</name>

- <range><le>4.1.10</le></range>

- </package>

- </affects>

- <description>

- <p>Tavis Ormandy discovered that xli and xloadimage attempt to

- processing, an attacker may control the input file name. As a

- result, an attacker may be able to cause arbitrary command

- execution.</p>

- </description>

- <references>

- </references>

- <dates>

- <discovery>2005-02-18</discovery>

- <entry>2005-06-03</entry>

- <name>xli</name>

- <range><le>1.17.0_1</le></range>

- </package>

- <package>

- <name>xloadimage</name>

- <range><lt>4.1.9</lt></range>

- </affects>

- <description>

- xloadimage's FACES image loader. A maliciously crafted image

- could cause xloadimage to execute arbitrary code. A published

- exploit exists for this vulnerability.</p>

- </description>

- <references>

- </references>

- <dates>

- <discovery>2000-02-19</discovery>

- <entry>2005-06-03</entry>

- <name>yamt</name>

- <range><lt>0.5_2</lt></range>

- </affects>

- <description>

- handling that lead to buffer overflows and directory traversal

- issues. When processing a file with a maliciously crafted ID3

- tag, yamt might overwrite arbitrary files or possibly execute

- arbitrary code.</p>

- <p>The SuSE package ChangeLog contains:</p>

- <blockquote>

- <li>Several security fixes (#49337):</li>

- <li>directory traversal in rename</li>

- <li>directory traversal in sort</li>

- <li>buffer overflow in sort</li>

- <li>buffer overflow in rename</li>

- </description>

- <references>

- <cvename>CVE-2005-1846</cvename>

- <cvename>CVE-2005-1847</cvename>

- </references>

- <dates>

- <discovery>2005-01-20</discovery>

- <entry>2005-06-03</entry>

- <name>xview</name>

- <range><lt>3.2.1_3</lt></range>

- </affects>

- <description>

- <p>A Debian Security Advisory reports:</p>

- <blockquote cite="http://www.debian.org/security/2005/dsa-672">

- <p>Erik Sjölund discovered that programs linked against xview

- are vulnerable to a number of buffer overflows in the XView

- library. When the overflow is triggered in a program which

- is installed setuid root a malicious user could perhaps

- execute arbitrary code as privileged user.</p>

- </description>

- <references>

- </references>

- <dates>

- <discovery>2005-02-09</discovery>

- <entry>2005-06-01</entry>

- <topic>xtrlock -- X display locking bypass</topic>

- <affects>

- <name>xtrlock</name>

- <range><lt>2.0.10</lt></range>

- </affects>

- <description>

- <p>The X display locking program <code>xtrlock</code> contains

- an integer overflow bug. It is possible for an attacker with

- physical access to the system to bypass the display lock.</p>

- </description>

- <references>

- </references>

- <dates>

- <discovery>2004-10-25</discovery>

- <entry>2005-06-01</entry>

- <name>linux_base</name>

- <range><lt>7.3</lt></range>

- </affects>

- <description>

- by linux_base contained multiple older vulnerabilities, such

- as a DNS resolver issue and critical bugs in X font handling

- and XPM image handling.</p>

- </description>

- <references>

- <cvename>CVE-2002-0029</cvename>

- <cvename>CVE-2004-0083</cvename>

- <cvename>CVE-2004-0084</cvename>

- <cvename>CVE-2004-0106</cvename>

- <cvename>CVE-2004-0687</cvename>

- <cvename>CVE-2004-0688</cvename>

- <cvename>CVE-2004-0692</cvename>

- <cvename>CVE-2004-0914</cvename>

- </references>

- <dates>

- <discovery>2004-09-27</discovery>

- <entry>2005-06-01</entry>

- <topic>squirrelmail -- XSS and remote code injection vulnerabilities</topic>

- <affects>

- <name>squirrelmail</name>

- <name>ja-squirrelmail</name>

- </affects>

- <description>

- <body xmlns="http://www.w3.org/1999/xhtml">

- <p>A SquirrelMail Security Advisory reports:</p>

- <blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110702772714662">

- <p>SquirrelMail 1.4.4 has been released to resolve a number of

- security issues disclosed below. It is strongly recommended

- that all running SquirrelMail prior to 1.4.4 upgrade to the

- latest release.</p>

- <h1>Remote File Inclusion</h1>

- <p>Manoel Zaninetti reported an issue in src/webmail.php which

- This was assigned CAN-2005-0103 by the Common

- Vulnerabilities and Exposures.</p>

- <h1>Cross Site Scripting Issues</h1>

- <p>A possible cross site scripting issue exists in

- installation is running with register_globals set to On.

- This issue was uncovered internally by the SquirrelMail

- Development team. This isssue was assigned CAN-2005-0104 by

- the Common Vulnerabilities and Exposures.</p>

- <p>A second issue which was resolved in the 1.4.4-rc1 release

- Vulnerabilities and Exposures. This issue could allow a

- remote user to send a specially crafted header and cause

- execution of script (such as javascript) in the client

- browser.</p>

- <h1>Local File Inclusion</h1>

- <p>A possible local file inclusion issue was uncovered by one

- This issue is only active if the PHP installation is running

- with register_globals set to On.</p>

- </description>

- <references>

- <cvename>CVE-2004-1036</cvename>

- <cvename>CVE-2005-0075</cvename>

- <cvename>CVE-2005-0103</cvename>

- <cvename>CVE-2005-0104</cvename>

- <mlist msgid="47249.24.0.109.81.1106975343.squirrel@sm-14.netdork.net">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110702772714662</mlist>

- </references>

- <dates>

- <discovery>2005-01-29</discovery>

- <entry>2005-06-01</entry>

- <topic>sympa -- buffer overflow in "queue"</topic>

- <affects>

- <name>sympa</name>

- <range><lt>4.1.2_1</lt></range>

- </affects>

- <description>

- <code>queue</code> application processes messages received via

- aliases. It contains a buffer overflow in the usage of

- <code>sprintf</code>. In some configurations, it may allow an

- attacker to execute arbitrary code as the <code>sympa</code>

- user.</p>

- </description>

- <references>

- </references>

- <dates>

- <discovery>2005-02-11</discovery>

- <entry>2005-06-01</entry>

- <name>mailman</name>

- <name>ja-mailman</name>

- </affects>

- <description>

- <p>Florian Weimer wrote:</p>

- <blockquote cite="http://mail.python.org/pipermail/mailman-developers/attachments/20041215/be238297/attachment.mht">

- <p>Mailman 2.1.5 uses weak auto-generated passwords for new

- subscribe without specifying their own password (either by

- email or the web frontend). Knowledge of this password

- allows an attacker to gain access to the list archive even

- though she's not a member and the archive is restricted to

- members only. [...]</p>

- are ever generated, a number that is in the range of brute

- force attacks -- you only have to guess one subscriber

- address (which is usually not that hard).</p>

- </description>

- <references>

- <mlist msgid="87llc0u6l8.fsf@deneb.enyo.de">http://mail.python.org/pipermail/mailman-developers/attachments/20041215/be238297/attachment.mht</mlist>

- </references>

- <dates>

- <discovery>2004-12-15</discovery>

- <entry>2005-06-01</entry>

- <topic>mailman -- password disclosure</topic>

- <affects>

- <name>mailman</name>

- <name>ja-mailman</name>

- </affects>

- <description>

- <p>Barry Warsaw reports:</p>

- <blockquote

- [...] This version also contains a fix for an exploit that

- could allow 3rd parties to retrieve member passwords. It is

- thus highly recommended that all existing sites upgrade to

- the latest version.</p>

- </description>

- <references>

- </references>

- <dates>

- <discovery>2004-05-15</discovery>

- <entry>2005-06-01</entry>

- </affects>

- <description>

- the Apache Jakarta Tomcat manager. The developers refer to

- the issues as <q>minor</q>.</p>

- </description>

- <references>

- </references>

- <dates>

- <discovery>2005-01-03</discovery>

- <entry>2005-06-01</entry>

- <topic>fswiki -- XSS problem in file upload form</topic>

- <affects>

- <name>fswiki</name>

- <range><le>3.5.6</le></range>

- </affects>

- <description>

- <p>A Secunia security advisory reports:</p>

- <blockquote cite="http://secunia.com/advisories/15538">

- <p>A vulnerability has been reported in FreeStyle Wiki and

- FSWikiLite, which can be exploited by malicious people to

- conduct script insertion attacks.</p>

- sanitised before being used. This can be exploited to inject

- arbitrary HTML and script code, which will be executed in a

- user's browser session in context of an affected site when

- the malicious attachment is viewed.</p>

- </description>

- <references>

- </references>

- <dates>

- <discovery>2005-05-19</discovery>

- <entry>2005-05-29</entry>

- </vuln>

- <vuln vid="2fbe16c2-cab6-11d9-9aed-000e0c2e438a">

- <topic>freeradius -- sql injection and denial of service vulnerability</topic>

- <affects>

- <package>

- <name>freeradius</name>

- <range><le>1.0.2_1</le></range>

- </package>

- <name>freeradius-devel</name>

- <range><gt>0</gt></range>

- </affects>

- <description>

- <p>A Gentoo Advisory reports:</p>

- <blockquote cite="http://www.gentoo.org/security/en/glsa/glsa-200505-13.xml">

- </description>

- <references>

- <bid>13540</bid>

- <bid>13541</bid>

- </references>

- <dates>

- <discovery>2005-05-17</discovery>

- <entry>2005-05-22</entry>

- <topic>ppxp -- local root exploit</topic>

- <affects>

- <name>ppxp</name>

- <range><gt>0</gt></range>

- <package>

- <name>ja-ppxp</name>

- <range><gt>0</gt></range>

- </package>

- </affects>

- <description>

- <p>A Debian Advisory reports:</p>

- <blockquote cite="http://www.debian.org/security/2005/dsa-725">

- <p>Jens Steube discovered that ppxp, yet another PPP program,

- user supplied log files. This can be tricked into opening

- a root shell.</p>

- </description>

- <references>

- </references>

- <dates>

- <discovery>2005-05-19</discovery>

- <entry>2005-05-22</entry>

- <topic>oops -- format string vulnerability</topic>

- <affects>

- <name>oops</name>

- <range><le>1.5.24</le></range>

- </affects>

- <description>

- vulnerability in oops. The vulnerability can be found in

- the MySQL/PgSQL authentication module. Succesful

- </description>

- <references>

- <bid>13172</bid>

- <cvename>CVE-2005-1121</cvename>

- </references>

- <dates>

- <discovery>2005-04-14</discovery>

- <entry>2005-05-22</entry>

- <name>cdrdao</name>

- <range><lt>1.2.0</lt></range>

- </affects>

- <description>

- user might get escalated privileges. By default this port is

- not installed setuid root.</p>

- </description>

- <references>

- </references>

- <dates>

- <discovery>2005-05-13</discovery>

- <entry>2005-05-19</entry>

- <topic>gaim -- MSN remote DoS vulnerability</topic>

- <affects>

- <name>gaim</name>

- <name>ja-gaim</name>

- <name>ko-gaim</name>

- <name>ru-gaim</name>

- <range><lt>1.3.0</lt></range>

- </affects>

- <description>

- <p>The GAIM team reports:</p>

- <blockquote cite="http://gaim.sourceforge.net/security/index.php?id=17">

- <p>Potential remote denial of service bug resulting from not

- </description>

- <references>

- </references>

- <dates>

- <discovery>2005-05-10</discovery>

- <entry>2005-05-14</entry>

- <topic>gaim -- remote crash on some protocols</topic>

- <affects>

- <name>gaim</name>

- <name>ja-gaim</name>

- <name>ko-gaim</name>

- <name>ru-gaim</name>

- <range><lt>1.3.0</lt></range>

- </affects>

- <description>

- <blockquote cite="http://gaim.sourceforge.net/security/index.php?id=16">

- restrictions. Jabber are SILC are known to be

- vulnerable.</p>

- </description>

- <references>

- </references>

- <dates>

- <discovery>2005-05-10</discovery>

- <entry>2005-05-14</entry>

- <name>FreeBSD</name>

- <range><ge>5.4</ge><lt>5.4_1</lt></range>

- </affects>

- <description>

- <body xmlns="http://www.w3.org/1999/xhtml">

- <h1>Problem description and impact</h1>

- <p>When running on processors supporting Hyper-Threading Technology, it is

- possible for a malicious thread to monitor the execution of another

- thread.</p>