<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE vuxml PUBLIC "-//vuxml.org//DTD VuXML 1.1//EN" "http://www.vuxml.org/dtd/vuxml-1/vuxml-11.dtd">
<!--
Copyright 2003-2005 Jacques Vidrine and contributors

Redistribution and use in source (VuXML) and 'compiled' forms (SGML,
HTML, PDF, PostScript, RTF and so forth) with or without modification,
are permitted provided that the following conditions are met:
1. Redistributions of source code (VuXML) must retain the above
   copyright notice, this list of conditions and the following
   disclaimer as the first lines of this file unmodified.
2. Redistributions in compiled form (transformed to other DTDs,
   published online in any format, converted to PDF, PostScript,
   RTF and other formats) must reproduce the above copyright
   notice, this list of conditions and the following disclaimer
   in the documentation and/or other materials provided with the
   distribution.

THIS DOCUMENTATION IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS "AS IS"
AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS
BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT
OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS DOCUMENTATION,
EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

  $FreeBSD$

-->
<vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">
  <vuln vid="107692a1-ee6c-11d9-8310-0001020eed82">
    <topic>acroread -- insecure temporary file creation</topic>
    <affects>
      <package>
	<name>acroread4</name>
	<name>acroread5</name>
	<range><ge>0</ge></range>
      </package>
      <package>
	<name>acroread</name>
	<range><lt>7.0.0</lt></range>
	<range><gt>5.*,1</gt><lt>7.0.0,1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia Research reports:</p>
	<blockquote cite="http://secunia.com/secunia_research/2005-6/advisory/">
	  <p>Secunia has discovered a security issue in Adobe Reader
	    for Linux, which can be exploited by malicious, local
	    users to gain knowledge of sensitive information.</p>
	  <p>The problem is caused due to temporary files being
	    created with permissions based on a user's umask in the
	    "/tmp" folder under certain circumstances when documents
	    are opened.</p>
	  <p>Successful exploitation allows an unprivileged user to
	    read arbitrary users' documents.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CAN-2005-1912</cvename>
      <url>http://secunia.com/secunia_research/2005-6/advisory/</url>
    </references>
    <dates>
      <discovery>2005-06-29</discovery>
      <entry>2005-07-06</entry>
    </dates>
  </vuln>

  <vuln vid="d8e1aadd-ee68-11d9-8310-0001020eed82">
    <topic>clamav -- cabinet file handling DoS vulnerability</topic>
    <affects>
      <package>
	<name>clamav</name>
	<range><lt>0.86</lt></range>
      </package>
      <package>
	<name>clamav-devel</name>
	<range><lt>20050620</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>An iDEFENSE Security Advisory reports:</p>
	<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=112006456809016">
	  <p>Remote exploitation of an input validation error in Clam
	    AntiVirus ClamAV allows attackers to cause a denial of
	    service condition.</p>
	  <p>The vulnerability specifically exists due to insufficient
	    validation on cabinet file header data. The
	    <code>ENSURE_BITS()</code> macro fails to check for zero
	    length reads, allowing a carefully constructed cabinet
	    file to cause an infinite loop.</p>
	  <p>ClamAV is used in a number of mail gateway
	    products. Successful exploitation requires an attacker to
	    send a specially constructed CAB file through a mail
	    gateway or personal anti-virus client utilizing the ClamAV
	    scanning engine. The infinate loop will cause the ClamAV
	    software to use all available processor resources,
	    resulting in a denial of service or severe degradation to
	    system performance. Remote exploitation can be achieved by
	    sending a malicious file in an e-mail message or during an
	    HTTP session.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CAN-2005-1923</cvename>
      <mlist msgid="FB24803D1DF2A34FA59FC157B77C97050462A3AB@IDSERV04.idef.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=112006456809016</mlist>
    </references>
    <dates>
      <discovery>2005-06-29</discovery>
      <entry>2005-07-06</entry>
    </dates>
  </vuln>

  <vuln vid="6d18fe19-ee67-11d9-8310-0001020eed82">
    <topic>clamav -- MS-Expand file handling DoS vulnerability</topic>
    <affects>
      <package>
	<name>clamav</name>
	<range><lt>0.86</lt></range>
      </package>
      <package>
	<name>clamav-devel</name>
	<range><lt>20050620</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>An iDEFENSE Security Advisory reports:</p>
	<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=112006402411598">
	  <p>Remote exploitation of an input validation error in Clam
	    AntiVirus ClamAV allows attackers to cause a denial of
	    service condition.</p>
	  <p>The vulnerability specifically exists due to improper
	    behavior during exceptional conditions.</p>
	  <p>Successful exploitation allows attackers to exhaust file
	    descriptors pool and memory. Anti-virus detection
	    functionality will fail if there is no file descriptors
	    available with which to open files. Remote exploitation
	    can be achieved by sending a malicious file in an e-mail
	    message or during an HTTP session.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CAN-2005-1922</cvename>
      <mlist msgid="FB24803D1DF2A34FA59FC157B77C97050462A3AC@IDSERV04.idef.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=112006402411598</mlist>
    </references>
    <dates>
      <discovery>2005-06-29</discovery>
      <entry>2005-07-06</entry>
    </dates>
  </vuln>

  <vuln vid="8efe93e2-ee62-11d9-8310-0001020eed82">
    <topic>zlib -- buffer overflow vulnerability</topic>
    <affects>
      <system>
	<name>FreeBSD</name>
	<range><ge>5.4</ge><lt>5.4_4</lt></range>
	<range><ge>5.3</ge><lt>5.3_18</lt></range>
      </system>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description</h1>
	<p>An error in the handling of corrupt compressed data streams
	  can result in a buffer being overflowed.</p>
	<h1>Impact</h1>
	<p>By carefully crafting a corrupt compressed data stream, an
	  attacker can overwrite data structures in a zlib-using
	  application.	This may cause the application to halt,
	  causing a denial of service; or it may result in the
	  attacker gaining elevated privileges.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2005-2096</cvename>
      <freebsdsa>SA-05:16.zlib</freebsdsa>
    </references>
    <dates>
      <discovery>2005-07-06</discovery>
      <entry>2005-07-06</entry>
    </dates>
  </vuln>

  <vuln vid="70c59485-ee5a-11d9-8310-0001020eed82">
    <topic>acroread -- buffer overflow vulnerability</topic>
    <affects>
      <package>
	<name>acroread4</name>
	<name>acroread5</name>
	<range><ge>0</ge></range>
      </package>
      <package>
	<name>acroread</name>
	<range><lt>7.0.0</lt></range>
	<range><gt>5.*,1</gt><lt>7.0.0,1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>An Adobe Security Advisory reports:</p>
	<blockquote cite="http://www.adobe.com/support/techdocs/329083.html">
	  <p>A vulnerability within Adobe Reader has been
	    identified. Under certain circumstances, remote
	    exploitation of a buffer overflow in Adobe Reader could
	    allow an attacker to execute arbitrary code.</p>
	  <p>If exploited, it could allow the execution of arbitrary
	    code under the privileges of the local user. Remote
	    exploitation is possible if the malicious PDF document is
	    sent as an email attachment or if the PDF document is
	    accessed via a web link.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CAN-2005-1625</cvename>
      <url>http://www.adobe.com/support/techdocs/329083.html</url>
      <mlist msgid="FB24803D1DF2A34FA59FC157B77C97050462A5E2@IDSERV04.idef.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=112059685332569</mlist>
    </references>
    <dates>
      <discovery>2005-07-05</discovery>
      <entry>2005-07-06</entry>
    </dates>
  </vuln>

  <vuln vid="b2a1a3b5-ed95-11d9-8310-0001020eed82">
    <topic>net-snmp -- remote DoS vulnerability</topic>
    <affects>
      <package>
	<name>net-snmp</name>
	<range><lt>5.2.1.2</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A Net-SNMP release announcement reports:</p>
	<blockquote cite="http://marc.theaimsgroup.com/?l=net-snmp-announce&amp;m=112059518426328">
	  <p>A security vulnerability has been found in Net-SNMP
	    releases that could allow a denial of service attack
	    against Net-SNMP agent's which have opened a stream based
	    protocol (EG, TCP but not UDP; it should be noted that
	    Net-SNMP does not by default open a TCP port).</p>
	</blockquote>
      </body>
    </description>
    <references>
      <mlist msgid="sdzmt5sul0.fsf@wes.hardakers.net">http://marc.theaimsgroup.com/?l=net-snmp-announce&amp;m=112059518426328</mlist>
    </references>
    <dates>
      <discovery>2005-07-02</discovery>
      <entry>2005-07-05</entry>
    </dates>
  </vuln>

  <vuln vid="1cf00643-ed8a-11d9-8310-0001020eed82">
    <topic>cacti -- multiple vulnerabilities</topic>
    <affects>
      <package>
	<name>cacti</name>
	<range><lt>0.8.6f</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Stefan Esser reports:</p>
	<blockquote cite="http://www.hardened-php.net/advisory-032005.php">
	  <p>Wrongly implemented user input filters lead to multiple
	    SQL Injection vulnerabilities which can lead f.e. to
	    disclosure of the admin password hash.</p>
	</blockquote>
	<blockquote cite="http://www.hardened-php.net/advisory-042005.php">
	  <p>Wrongly implemented user input filters allows injection
	    of user input into executed commandline.</p>
	  <p>Alberto Trivero posted his Remote Command Execution
	    Exploit for Cacti &lt;= 0.8.6d to Bugtraq on the 22th
	    June. Having analysed his bug we come to the conclusion,
	    that the malfunctioning input filters, which were already
	    mentioned in the previous advisory are also responsible
	    for this bug still being exploitable.</p>
	</blockquote>
	<blockquote cite="http://www.hardened-php.net/advisory-052005.php">
	  <p>A HTTP headers bypass switch can also be used to
	    completely bypass the authentification system of Cacti. As
	    admin it is possible to execute shell commands with the
	    permission of the webserver.</p>
	  <p>While looking at the source of Cacti a HTTP headers
	    bypass switch was discovered, that also switches off a
	    call to <code>session_start()</code> and the manual
	    application of <code>addslashes()</code> in case of
	    <code>magic_quotes_gpc=Off</code>.</p>
	  <p>When register_globals is turned on* an attacker can use
	    this switch to disables Cacti's use of PHP's session
	    support and therefore supply the session variables on his
	    own through f.e.  the URL. Additionally using the switch
	    renders several SQL statements vulnerable to SQL
	    Injections attacks, when magic_quotes_gpc is turned off,
	    which is the recommended setting.</p>
	  <p>Logged in as an admin it is possible to issue shell
	    commands.</p>
	  <p>(*) register_globals is turned off by default since PHP
	    4.2 but is activated on most servers because of older
	    scripts requiring it.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <mlist msgid="007301c57753$5ab17f60$0100a8c0@alberto">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=111954136315248</mlist>
      <url>http://www.hardened-php.net/advisory-032005.php</url>
      <url>http://www.hardened-php.net/advisory-042005.php</url>
      <url>http://www.hardened-php.net/advisory-052005.php</url>
    </references>
    <dates>
      <discovery>2005-06-22</discovery>
      <entry>2005-07-05</entry>
    </dates>
  </vuln>

  <vuln vid="dca0a345-ed81-11d9-8310-0001020eed82">
    <topic>wordpress -- multiple vulnerabilities</topic>
    <affects>
      <package>
	<name>wordpress</name>
	<range><lt>1.5.1.3,1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>GulfTech Security Research reports:</p>
	<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=112006967221438">
	  <p>There are a number of vulnerabilities in WordPress that
	    may allow an attacker to ultimately run arbitrary code on
	    the vulnerable system. These vulnerabilities include SQL
	    Injection, Cross Site Scripting, and also issues that may
	    aid an attacker in social engineering.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CAN-2005-2107</cvename>
      <cvename>CAN-2005-2108</cvename>
      <cvename>CAN-2005-2109</cvename>
      <cvename>CAN-2005-2110</cvename>
      <mlist msgid="42C2BE6E.2050408@gulftech.org">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=112006967221438</mlist>
    </references>
    <dates>
      <discovery>2005-06-28</discovery>
      <entry>2005-07-05</entry>
    </dates>
  </vuln>

  <vuln vid="a4955b32-ed84-11d9-8310-0001020eed82">
    <topic>wordpress -- multiple vulnerabilities</topic>
    <affects>
      <package>
	<name>wordpress</name>
	<range><lt>1.5.1.2,1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A Gentoo Linux Security Advisory reports:</p>
	<blockquote cite="http://www.gentoo.org/security/en/glsa/glsa-200506-04.xml">
	  <p>Due to a lack of input validation, WordPress is
	    vulnerable to SQL injection and XSS attacks.</p>
	  <p>An attacker could use the SQL injection vulnerabilites to
	    gain information from the database. Furthermore the
	    cross-site scripting issues give an attacker the ability
	    to inject and execute malicious script code or to steal
	    cookie-based authentication credentials, potentially
	    compromising the victim's browser.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CAN-2005-1810</cvename>
      <url>http://www.gentoo.org/security/en/glsa/glsa-200506-04.xml</url>
    </references>
    <dates>
      <discovery>2005-04-12</discovery>
      <entry>2005-07-05</entry>
    </dates>
  </vuln>

  <vuln vid="4afacca1-eb9d-11d9-a8bd-000cf18bbe54">
    <topic>phpbb -- remote PHP code execution vulnerability</topic>
    <affects>
      <package>
	<name>phpbb</name>
	<range><lt>2.0.16</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>FrSIRT Advisory reports:</p>
	<blockquote cite="http://www.frsirt.com/english/advisories/2005/0904">
	  <p>A vulnerability was identified in phpBB, which
	    may be exploited by attackers to compromise a vulnerable
	    web server. This flaw is due to an input validation error
	    in the "viewtopic.php" script that does not properly filter
	    the "highlight" parameter before calling the "preg_replace()"
	    function, which may be exploited by remote attackers to execute
	    arbitrary PHP commands with the privileges of the web server.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <url>http://www.frsirt.com/english/advisories/2005/0904</url>
      <url>http://www.phpbb.com/phpBB/viewtopic.php?t=302011</url>
    </references>
    <dates>
      <discovery>2005-06-28</discovery>
      <entry>2005-07-03</entry>
    </dates>
  </vuln>

  <vuln vid="523fad14-eb9d-11d9-a8bd-000cf18bbe54">
    <topic>pear-XML_RPC -- arbitrary remote code execution</topic>
    <affects>
      <package>
	<name>pear-XML_RPC</name>
	<range><lt>1.3.1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>GulfTech Security Research Team reports:</p>
	<blockquote cite="http://www.gulftech.org/?node=research&amp;article_id=00087-07012005">
	  <p>PEAR XML_RPC is vulnerable to a very high risk php code
	    injection vulnerability due to unsanatized data being
	    passed into an eval() call.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CAN-2005-1921</cvename>
      <url>http://www.gulftech.org/?node=research&amp;article_id=00087-07012005</url>
      <url>http://www.hardened-php.net/advisory-022005.php</url>
    </references>
    <dates>
      <discovery>2005-06-29</discovery>
      <entry>2005-07-03</entry>
    </dates>
  </vuln>

  <vuln vid="f70f8860-e8ee-11d9-b875-0001020eed82">
    <topic>kernel -- ipfw packet matching errors with address tables</topic>
    <affects>
      <system>
	<name>FreeBSD</name>
	<range><ge>5.4</ge><lt>5.4_3</lt></range>
      </system>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description</h1>
	<p>The ipfw tables lookup code caches the result of the last
	  query.  The kernel may process multiple packets
	  concurrently, performing several concurrent table lookups.
	  Due to an insufficient locking, a cached result can become
	  corrupted that could cause some addresses to be incorrectly
	  matched against a lookup table.</p>
	<h1>Impact</h1>
	<p>When lookup tables are used with ipfw, packets may on very
	  rare occasions incorrectly match a lookup table.  This could
	  result in a packet being treated contrary to the defined
	  packet filtering ruleset. For example, a packet may be
	  allowed to pass through when it should have been
	  discarded.</p>
	<p>The problem can only occur on Symmetric Multi-Processor
	  (SMP) systems, or on Uni Processor (UP) systems with the
	  PREEMPTION kernel option enabled (not the default).</p>
	<h1>Workaround</h1>
	<p>a) Do not use lookup tables.</p>
	<p>OR</p>
	<p>b) Disable concurrent processing of packets in the network
	  stack by setting the "debug.mpsafenet=0" tunable:</p>
	<p># echo "debug.mpsafenet=0" &lt;&lt; /boot/loader.conf</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2005-2019</cvename>
      <freebsdsa>SA-05:13.ipfw</freebsdsa>
    </references>
    <dates>
      <discovery>2005-06-29</discovery>
      <entry>2005-06-29</entry>
      <modified>2005-07-06</modified>
    </dates>
  </vuln>

  <vuln vid="197f444f-e8ef-11d9-b875-0001020eed82">
    <topic>bzip2 -- denial of service and permission race vulnerabilities</topic>
    <affects>
      <system>
	<name>FreeBSD</name>
	<range><ge>5.4</ge><lt>5.4_3</lt></range>
	<range><ge>5.*</ge><lt>5.3_17</lt></range>
	<range><ge>4.11</ge><lt>4.11_11</lt></range>
	<range><lt>4.10_16</lt></range>
      </system>
      <package>
	<name>bzip2</name>
	<range><lt>1.0.3_1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description</h1>
	<p>Two problems have been discovered relating to the
	  extraction of bzip2-compressed files.	 First, a carefully
	  constructed invalid bzip2 archive can cause bzip2 to enter
	  an infinite loop.  Second, when creating a new file, bzip2
	  closes the file before setting its permissions.</p>
	<h1>Impact</h1>
	<p>The first problem can cause bzip2 to extract a bzip2
	  archive to an infinitely large file.	If bzip2 is used in
	  automated processing of untrusted files this could be
	  exploited by an attacker to create an denial-of-service
	  situation by exhausting disk space or by consuming all
	  available cpu time.</p>
	<p>The second problem can allow a local attacker to change the
	  permissions of local files owned by the user executing bzip2
	  providing that they have write access to the directory in
	  which the file is being extracted.</p>
	<h1>Workaround</h1>
	<p>Do not uncompress bzip2 archives from untrusted sources and
	  do not uncompress files in directories where untrusted users
	  have write access.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2005-0953</cvename>
      <cvename>CAN-2005-1260</cvename>
      <freebsdsa>SA-05:14.bzip2</freebsdsa>
      <url>http://scary.beasts.org/security/CESA-2005-002.txt</url>
    </references>
    <dates>
      <discovery>2005-03-30</discovery>
      <entry>2005-06-29</entry>
      <modified>2005-07-06</modified>
    </dates>
  </vuln>

  <vuln vid="3ec8f43b-e8ef-11d9-b875-0001020eed82">
    <topic>kernel -- TCP connection stall denial of service</topic>
    <affects>
      <system>
	<name>FreeBSD</name>
	<range><ge>5.4</ge><lt>5.4_3</lt></range>
	<range><ge>5.*</ge><lt>5.3_17</lt></range>
	<range><ge>4.11</ge><lt>4.11_11</lt></range>
	<range><lt>4.10_16</lt></range>
      </system>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description</h1>
	<p>Two problems have been discovered in the FreeBSD TCP stack.</p>
	<p>First, when a TCP packets containing a timestamp is
	  received, inadequate checking of sequence numbers is
	  performed, allowing an attacker to artificially increase the
	  internal "recent" timestamp for a connection.</p>
	<p>Second, a TCP packet with the SYN flag set is accepted for
	  established connections, allowing an attacker to overwrite
	  certain TCP options.</p>
	<h1>Impact</h1>
	<p>Using either of the two problems an attacker with knowledge
	  of the local and remote IP and port numbers associated with
	  a connection can cause a denial of service situation by
	  stalling the TCP connection. The stalled TCP connection my
	  be closed after some time by the other host.</p>
	<h1>Workaround</h1>
	<p>In some cases it may be possible to defend against these
	  attacks by blocking the attack packets using a firewall.
	  Packets used to effect either of these attacks would have
	  spoofed source IP addresses.</p>
      </body>
    </description>
    <references>
      <certvu>637934</certvu>
      <cvename>CAN-2005-0356</cvename>
      <cvename>CAN-2005-2068</cvename>
      <freebsdsa>SA-05:15.tcp</freebsdsa>
    </references>
    <dates>
      <discovery>2005-06-29</discovery>
      <entry>2005-06-29</entry>
      <modified>2005-07-06</modified>
    </dates>
  </vuln>

  <vuln vid="76adaab0-e4e3-11d9-b875-0001020eed82">
    <topic>ethereal -- multiple protocol dissectors vulnerabilities</topic>
    <affects>
      <package>
	<name>ethereal</name>
	<name>ethereal-lite</name>
	<name>tethereal</name>
	<name>tethereal-lite</name>
	<range><ge>0.8.14</ge><lt>0.10.11</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>An Ethreal Security Advisories reports:</p>
	<blockquote cite="http://www.ethereal.com/appnotes/enpa-sa-00019.html">
	  <p>An aggressive testing program as well as independent
	    discovery has turned up a multitude of security issues:</p>
	  <ul>
	    <li>The ANSI A dissector was susceptible to format string
	      vulnerabilities. Discovered by Bryan Fulton.</li>
	    <li>The GSM MAP dissector could crash.</li>
	    <li>The AIM dissector could cause a crash.</li>
	    <li>The DISTCC dissector was susceptible to a buffer
	      overflow. Discovered by Ilja van Sprundel</li>
	    <li>The FCELS dissector was susceptible to a buffer
	      overflow. Discovered by Neil Kettle</li>
	    <li>The SIP dissector was susceptible to a buffer
	      overflow. Discovered by Ejovi Nuwere.</li>
	    <li>The KINK dissector was susceptible to a null pointer
	      exception, endless looping, and other problems.</li>
	    <li>The LMP dissector was susceptible to an endless
	      loop.</li>
	    <li>The Telnet dissector could abort.</li>
	    <li>The TZSP dissector could cause a segmentation
	      fault.</li>
	    <li>The WSP dissector was susceptible to a null pointer
	      exception and assertions.</li>
	    <li>The 802.3 Slow protocols dissector could throw an
	      assertion.</li>
	    <li>The BER dissector could throw assertions.</li>
	    <li>The SMB Mailslot dissector was susceptible to a null
	      pointer exception and could throw assertions.</li>
	    <li>The H.245 dissector was susceptible to a null pointer
	      exception.</li>
	    <li>The Bittorrent dissector could cause a segmentation
	      fault.</li>
	    <li>The SMB dissector could cause a segmentation fault and
	      throw assertions.</li>
	    <li>The Fibre Channel dissector could cause a crash.</li>
	    <li>The DICOM dissector could attempt to allocate large
	      amounts of memory.</li>
	    <li>The MGCP dissector was susceptible to a null pointer
	      exception, could loop indefinitely, and segfault.</li>
	    <li>The RSVP dissector could loop indefinitely.</li>
	    <li>The DHCP dissector was susceptible to format string
	      vulnerabilities, and could abort.</li>
	    <li>The SRVLOC dissector could crash unexpectedly or go
	      into an infinite loop.</li>
	    <li>The EIGRP dissector could loop indefinitely.</li>
	    <li>The ISIS dissector could overflow a buffer.</li>
	    <li>The CMIP, CMP, CMS, CRMF, ESS, OCSP, PKIX1Explitit,
	      PKIX Qualified, and X.509 dissectors could overflow
	      buffers.</li>
	    <li>The NDPS dissector could exhaust system memory or
	      cause an assertion, or crash.</li>
	    <li>The Q.931 dissector could try to free a null pointer
	      and overflow a buffer.</li>
	    <li>The IAX2 dissector could throw an assertion.</li>
	    <li>The ICEP dissector could try to free the same memory
	      twice.</li>
	    <li>The MEGACO dissector was susceptible to an infinite
	      loop and a buffer overflow.</li>
	    <li>The DLSw dissector was susceptible to an infinite
	      loop.</li>
	    <li>The RPC dissector was susceptible to a null pointer
	      exception.</li>
	    <li>The NCP dissector could overflow a buffer or loop for
	      a large amount of time.</li>
	    <li>The RADIUS dissector could throw an assertion.</li>
	    <li>The GSM dissector could access an invalid
	      pointer.</li>
	    <li>The SMB PIPE dissector could throw an assertion.</li>
	    <li>The L2TP dissector was susceptible to an infinite loop.</li>
	    <li>The SMB NETLOGON dissector could dereference a null
	      pointer.</li>
	    <li>The MRDISC dissector could throw an assertion.</li>
	    <li>The ISUP dissector could overflow a buffer or cause a
	      segmentation fault.</li>
	    <li>The LDAP dissector could crash.</li>
	    <li>The TCAP dissector could overflow a buffer or throw an
	      assertion.</li>
	    <li>The NTLMSSP dissector could crash.</li>
	    <li>The Presentation dissector could overflow a
	      buffer.</li>
	    <li>Additionally, a number of dissectors could throw an
	      assertion when passing an invalid protocol tree item
	      length.</li>
	  </ul>
	</blockquote>
      </body>
    </description>
    <references>
      <bid>13391</bid>
      <bid>13504</bid>
      <bid>13567</bid>
      <cvename>CAN-2005-1281</cvename>
      <cvename>CAN-2005-1456</cvename>
      <cvename>CAN-2005-1457</cvename>
      <cvename>CAN-2005-1458</cvename>
      <cvename>CAN-2005-1459</cvename>
      <cvename>CAN-2005-1460</cvename>
      <cvename>CAN-2005-1461</cvename>
      <cvename>CAN-2005-1462</cvename>
      <cvename>CAN-2005-1463</cvename>
      <cvename>CAN-2005-1464</cvename>
      <cvename>CAN-2005-1465</cvename>
      <cvename>CAN-2005-1466</cvename>
      <cvename>CAN-2005-1467</cvename>
      <cvename>CAN-2005-1468</cvename>
      <cvename>CAN-2005-1469</cvename>
      <cvename>CAN-2005-1470</cvename>
      <url>http://www.ethereal.com/appnotes/enpa-sa-00019.html</url>
    </references>
    <dates>
      <discovery>2005-05-04</discovery>
      <entry>2005-06-24</entry>
    </dates>
  </vuln>

  <vuln vid="691ed622-e499-11d9-a8bd-000cf18bbe54">
    <topic>tor -- information disclosure</topic>
    <affects>
      <package>
	<name>tor</name>
	<range><lt>0.1.0.10</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Roger Dingledine reports:</p>
	<blockquote cite="http://archives.seul.org/or/announce/Jun-2005/msg00001.html">
	  <p>The Tor 0.1.0.10 release from a few days ago
	    includes a fix for a bug that might allow an attacker
	    to read arbitrary memory (maybe even keys) from an exit
	    server's process space.  We haven't heard any reports of
	    exploits yet, but hey.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <mlist>http://archives.seul.org/or/announce/Jun-2005/msg00001.html</mlist>
    </references>
    <dates>
      <discovery>2005-06-16</discovery>
      <entry>2005-06-24</entry>
    </dates>
  </vuln>

  <vuln vid="95ee96f2-e488-11d9-bf22-080020c11455">
    <topic>linux-realplayer -- RealText parsing heap overflow</topic>
    <affects>
      <package>
	<name>linux-realplayer</name>
	<range><le>10.0.4_1</le></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>An iDEFENSE Security Advisory reports:</p>
	<blockquote cite="http://www.idefense.com/application/poi/display?id=250&amp;type=vulnerabilities&amp;flashstatus=false">
	  <p>Remote exploitation of a heap-based buffer
	    overflow vulnerability in the RealText file format
	    parser within various versions of RealNetworks
	    Inc.'s RealPlayer could allow attackers to
	    execute arbitrary code.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CAN-2005-1277</cvename>
      <url>http://www.idefense.com/application/poi/display?id=250&amp;type=vulnerabilities&amp;flashstatus=false</url>
      <url>http://service.real.com/help/faq/security/050623_player/EN/</url>
    </references>
    <dates>
      <discovery>2005-06-23</discovery>
      <entry>2005-06-24</entry>
    </dates>
  </vuln>

  <vuln vid="594eb447-e398-11d9-a8bd-000cf18bbe54">
    <topic>ruby -- arbitrary command execution on XMLRPC server</topic>
    <affects>
      <package>
	<name>ruby</name>
	<name>ruby_static</name>
	<range><le>1.8.2_3</le></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Nobuhiro IMAI reports:</p>
	<blockquote cite="http://blade.nagaokaut.ac.jp/cgi-bin/scat.rb/ruby/ruby-core/5237">
	  <p>the default value modification on
	    Module#public_instance_methods (from false to true) breaks
	    s.add_handler(XMLRPC::iPIMethods("sample"), MyHandler.new) style
	    security protection.</p>
	  <p>This problem could allow a remote attacker to execute arbitrary
	    commands on XMLRPC server of libruby.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CAN-2005-1992</cvename>
      <url>http://blade.nagaokaut.ac.jp/cgi-bin/scat.rb/ruby/ruby-core/5237</url>
      <url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=315064</url>
    </references>
    <dates>
      <discovery>2005-06-22</discovery>
      <entry>2005-06-23</entry>
    </dates>
  </vuln>

  <vuln vid="96948a6a-e239-11d9-83cf-0010dc5df42d">
    <topic>cacti -- potential SQL injection and cross site scripting attacks</topic>
    <affects>
      <package>
	<name>cacti</name>
	<range><le>0.8.6d</le></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
        <p>iDEFENSE security group disclosed potential SQL injection
	  attacks from unchecked user input and two security holes
	  regarding potential cross site scripting attacks</p>
      </body>
    </description>
    <references>
      <url>http://www.cacti.net/release_notes_0_8_6e.php</url>
    </references>
    <dates>
      <discovery>2005-06-21</discovery>
      <entry>2005-06-21</entry>
    </dates>
  </vuln>

  <vuln vid="79217c9b-e1d9-11d9-b875-0001020eed82">
    <topic>opera -- XMLHttpRequest security bypass</topic>
    <affects>
      <package>
	<name>linux-opera</name>
	<name>opera-devel</name>
	<name>opera</name>
	<range><gt>8.*</gt><lt>8.01</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A Secunia Advisory reports:</p>
	<blockquote cite="http://secunia.com/advisories/15008/">
	  <p>Secunia Research has discovered a vulnerability in Opera,
	    which can be exploited by malicious people to steal
	    content or to perform actions on other web sites with the
	    privileges of the user.</p>
	  <p>Normally, it should not be possible for the
	    <code>XMLHttpRequest</code> object to access resources
	    from outside the domain of which the object was
	    opened. However, due to insufficient validation of server
	    side redirects, it is possible to circumvent this
	    restriction.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CAN-2005-1475</cvename>
      <url>http://secunia.com/advisories/15008/</url>
      <url>http://secunia.com/secunia_research/2005-4/advisory/</url>
      <url>http://www.opera.com/freebsd/changelogs/801/#security</url>
    </references>
    <dates>
      <discovery>2005-06-16</discovery>
      <entry>2005-06-20</entry>
    </dates>
  </vuln>

  <vuln vid="40856a51-e1d9-11d9-b875-0001020eed82">
    <topic>opera -- "javascript:" URL cross-site scripting
      vulnerability</topic>
    <affects>
      <package>
	<name>linux-opera</name>
	<name>opera-devel</name>
	<name>opera</name>
	<range><lt>8.01</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A Secunia Advisory reports:</p>
	<blockquote cite="http://secunia.com/advisories/15411/">
	  <p>Secunia Research has discovered a vulnerability in Opera,
	    which can be exploited by malicious people to conduct
	    cross-site scripting attacks and to read local files.</p>
	  <p>The vulnerability is caused due to Opera not properly
	    restricting the privileges of "javascript:" URLs when
	    opened in e.g. new windows or frames.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CAN-2005-1669</cvename>
      <url>http://secunia.com/advisories/15411/</url>
      <url>http://www.opera.com/freebsd/changelogs/801/#security</url>
    </references>
    <dates>
      <discovery>2005-06-16</discovery>
      <entry>2005-06-20</entry>
    </dates>
  </vuln>

  <vuln vid="985bfcf0-e1d7-11d9-b875-0001020eed82">
    <topic>opera -- redirection cross-site scripting vulnerability</topic>
    <affects>
      <package>
	<name>linux-opera</name>
	<name>opera-devel</name>
	<name>opera</name>
	<range><gt>8.*</gt><lt>8.01</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A Secunia Advisory reports:</p>
	<blockquote cite="http://secunia.com/advisories/15423/">
	  <p>Secunia Research has discovered a vulnerability in Opera,
	    which can be exploited by malicious people to conduct
	    cross-site scripting attacks against users.</p>
	  <p>The vulnerability is caused due to input not being
	    sanitised, when Opera generates a temporary page for
	    displaying a redirection when "Automatic redirection" is
	    disabled (not default setting).</p>
	</blockquote>
      </body>
    </description>
    <references>
      <url>http://secunia.com/advisories/15423/</url>
      <url>http://secunia.com/secunia_research/2003-1/advisory/</url>
      <url>http://www.opera.com/freebsd/changelogs/801/#security</url>
    </references>
    <dates>
      <discovery>2005-06-16</discovery>
      <entry>2005-06-20</entry>
    </dates>
  </vuln>

  <vuln vid="3bf157fa-e1c6-11d9-b875-0001020eed82">
    <topic>sudo -- local race condition vulnerability</topic>
    <affects>
      <package>
	<name>sudo</name>
	<range><lt>1.6.8.9</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Todd C. Miller reports:</p>
	<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=111928183431376">
	  <p>A race condition in Sudo's command pathname handling
	    prior to Sudo version 1.6.8p9 that could allow a user with
	    Sudo privileges to run arbitrary commands.</p>
	  <p>Exploitation of the bug requires that the user be allowed
	    to run one or more commands via Sudo and be able to create
	    symbolic links in the filesystem.  Furthermore, a sudoers
	    entry giving another user access to the ALL pseudo-command
	    must follow the user's sudoers entry for the race to
	    exist.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <bid>13993</bid>
      <mlist msgid="200506201424.j5KEOhQI024645@xerxes.courtesan.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=111928183431376</mlist>
    </references>
    <dates>
      <discovery>2005-06-20</discovery>
      <entry>2005-06-20</entry>
    </dates>
  </vuln>

  <vuln vid="b02c1d80-e1bb-11d9-b875-0001020eed82">
    <topic>trac -- file upload/download vulnerability</topic>
    <affects>
      <package>
	<name>trac</name>
	<range><lt>0.8.4</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Stefan Esser reports:</p>
	<blockquote cite="http://www.hardened-php.net/advisory-012005.php">
	  <p>Trac's wiki and ticket systems allows to add attachments
	    to wiki entries and bug tracker tickets. These attachments
	    are stored within directories that are determined by the
	    id of the corresponding ticket or wiki entry.</p>
	  <p>Due to a missing validation of the id parameter it is
	    possible for an attacker to supply arbitrary paths to the
	    upload and attachment viewer scripts. This means that a
	    potential attacker can retrieve any file accessible by the
	    webserver user.</p>
	  <p>Additionally it is possible to upload arbitrary files (up
	    to a configured file length) to any place the webserver
	    has write access too.</p>
	  <p>For obvious reasons this can lead to the execution of
	    arbitrary code if it possible to upload files to the
	    document root or it's subdirectories. One example of a
	    configuration would be f.e.	 running Trac and
	    s9y/wordpress with writeable content directories on the
	    same webserver.</p>
	  <p>Another potential usage of this exploit would be to abuse
	    Trac powered webservers as storage for f.e. torrent
	    files.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <bid>13990</bid>
      <url>http://www.hardened-php.net/advisory-012005.php</url>
      <url>http://projects.edgewall.com/trac/wiki/ChangeLog</url>
    </references>
    <dates>
      <discovery>2005-06-20</discovery>
      <entry>2005-06-20</entry>
    </dates>
  </vuln>

  <vuln vid="85069fb6-e15b-11d9-83cf-0010dc5df42d">
    <topic>razor-agents -- denial of service vulnerability</topic>
    <affects>
      <package>
	<name>razor-agents</name>
	<range><le>2.71</le></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A Secunia security advisory reports:</p>
	<blockquote cite="http://secunia.com/advisories/15739/">
	  <p>Two vulnerabilities have been reported in Razor-agents,
	    which can be exploited by malicious people to cause a DoS
	    (Denial of Service).</p>
	  <ol>
	    <li>An unspecified error in the preprocessing of certain
	      HTML messages can be exploited to crash the
	      application.</li>
	    <li>A bug in the discovery logic causes Razor-agents to go
	      into an infinite loop and consume a large amount of
	      memory when discovery fails.</li>
	  </ol>
	</blockquote>
      </body>
    </description>
    <references>
      <url>http://secunia.com/advisories/15739/</url>
    </references>
    <dates>
      <discovery>2005-06-17</discovery>
      <entry>2005-06-20</entry>
    </dates>
  </vuln>

  <vuln vid="cc4ce06b-e01c-11d9-a8bd-000cf18bbe54">
    <topic>p5-Mail-SpamAssassin -- denial of service vulnerability</topic>
    <affects>
      <package>
	<name>p5-Mail-SpamAssassin</name>
	<range><ge>3.0.1</ge><lt>3.0.4</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Apache SpamAssassin Security Team reports:</p>
	<blockquote cite="http://mail-archives.apache.org/mod_mbox/spamassassin-announce/200506.mbox/%3c17072.35054.586017.822288@proton.pathname.com%3e">
	  <p>Apache SpamAssassin 3.0.4 was recently released, and
	    fixes a denial of service vulnerability in versions 3.0.1, 3.0.2,
	    and 3.0.3.	The vulnerability allows certain misformatted
	    long message headers to cause spam checking to
	    take a very long time.</p>
	  <p>While the exploit has yet to be seen in the wild,
	    we are concerned that there may be attempts to abuse
	    the vulnerability in the future.  Therefore, we strongly
	    recommend all users of these versions upgrade to
	    Apache SpamAssassin 3.0.4 as soon as possible.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CAN-2005-1266</cvename>
      <mlist msgid="c17072.35054.586017.822288@proton.pathname.com">http://mail-archives.apache.org/mod_mbox/spamassassin-announce/200506.mbox/%3c17072.35054.586017.822288@proton.pathname.com%3e</mlist>
    </references>
    <dates>
      <discovery>2005-06-15</discovery>
      <entry>2005-06-18</entry>
    </dates>
  </vuln>

  <vuln vid="e879ca68-e01b-11d9-a8bd-000cf18bbe54">
    <topic>squirrelmail -- Several cross site scripting vulnerabilities</topic>
    <affects>
      <package>
	<name>squirrelmail</name>
	<name>ja-squirrelmail</name>
	<range><ge>1.4.0</ge><le>1.4.4</le></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A SquirrelMail Security Advisory reports:</p>
	<blockquote cite="http://www.squirrelmail.org/security/issue/2005-06-15">
	  <p>Several cross site scripting (XSS) vulnerabilities have been discovered
	    in SquirrelMail versions 1.4.0 - 1.4.4.</p>
	  <p>The vulnerabilities are in two categories: the majority can be
	    exploited through URL manipulation, and some by sending a specially
	    crafted email to a victim. When done very carefully,
	    this can cause the session of the user to be hijacked.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CAN-2005-1769</cvename>
      <url>http://www.squirrelmail.org/security/issue/2005-06-15</url>
    </references>
    <dates>
      <discovery>2005-06-15</discovery>
      <entry>2005-06-18</entry>
    </dates>
  </vuln>

  <vuln vid="02bc9b7c-e019-11d9-a8bd-000cf18bbe54">
    <topic>acroread -- XML External Entity vulnerability</topic>
    <affects>
      <package>
	<name>acroread7</name>
	<name>ja-acroread</name>
	<range><ge>7.0.0</ge><lt>7.0.2</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Sverre H. Huseby discovered a vulnerability in Adobe Acrobat
	  and Adobe Reader.
	  Under certain circumstances, using XML scripts it is possible
	  to discover the existence of local files.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2005-1306</cvename>
      <url>http://shh.thathost.com/secadv/adobexxe/</url>
      <url>http://www.adobe.com/support/techdocs/331710.html</url>
      <url>http://support.adobe.co.jp/faq/faq/qadoc.sv?226360+002+3</url>
    </references>
    <dates>
      <discovery>2005-06-15</discovery>
      <entry>2005-06-18</entry>
    </dates>
  </vuln>

  <vuln vid="63bd4bad-dffe-11d9-b875-0001020eed82">
    <topic>gzip -- directory traversal and permission race
      vulnerabilities</topic>
    <affects>
      <system>
	<name>FreeBSD</name>
	<range><ge>5.4</ge><lt>5.4_2</lt></range>
	<range><ge>5.0</ge><lt>5.3_16</lt></range>
	<range><ge>4.11</ge><lt>4.11_10</lt></range>
	<range><ge>4.10</ge><lt>4.10_15</lt></range>
	<range><ge>4.9</ge><lt>4.9_18</lt></range>
	<range><lt>4.8_33</lt></range>
      </system>
      <package>
	<name>gzip</name>
	<range><lt>1.3.5_2</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description</h1>
	<p>Two problems related to extraction of files exist in gzip:</p>
	<p>The first problem is that gzip does not properly sanitize
	  filenames containing "/" when uncompressing files using the
	  -N command line option.</p>
	<p>The second problem is that gzip does not set permissions on
	  newly extracted files until after the file has been created
	  and the file descriptor has been closed.</p>
	<h1>Impact</h1>
	<p>The first problem can allow an attacker to overwrite
	  arbitrary local files when uncompressing a file using the -N
	  command line option.</p>
	<p>The second problem can allow a local attacker to change the
	  permissions of arbitrary local files, on the same partition
	  as the one the user is uncompressing a file on, by removing
	  the file the user is uncompressing and replacing it with a
	  hardlink before the uncompress operation is finished.</p>
	<h1>Workaround</h1>
	<p>Do not use the -N command line option on untrusted files
	  and do not uncompress files in directories where untrusted
	  users have write access.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2005-0988</cvename>
      <cvename>CAN-2005-1228</cvename>
      <freebsdsa>SA-05:11.gzip</freebsdsa>
      <mlist msgid="7389fc4b05040412574f819112@mail.gmail.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=111271860708210</mlist>
      <mlist msgid="7389fc4b0504201224759f31b@mail.gmail.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=111402732406477</mlist>
    </references>
    <dates>
      <discovery>2005-04-20</discovery>
      <entry>2005-06-18</entry>
      <modified>2005-07-06</modified>
    </dates>
  </vuln>

  <vuln vid="9fae0f1f-df82-11d9-b875-0001020eed82">
    <topic>tcpdump -- infinite loops in protocol decoding</topic>
    <affects>
      <system>
        <name>FreeBSD</name>
        <range><ge>5.4</ge><lt>5.4_2</lt></range>
        <range><ge>5.3</ge><lt>5.3_16</lt></range>
      </system>
      <package>
	<name>tcpdump</name>
	<range><lt>3.8.3_2</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
        <h1>Problem Description</h1>
        <p>Several tcpdump protocol decoders contain programming
          errors which can cause them to go into infinite loops.</p>
        <h1>Impact</h1>
        <p>An attacker can inject specially crafted packets into the
           network which, when processed by tcpdump, could lead to a
           denial-of-service. After the attack, tcpdump would no
           longer capture traffic, and would potentially use all
           available processor time.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2005-1267</cvename>
      <cvename>CAN-2005-1278</cvename>
      <cvename>CAN-2005-1279</cvename>
      <cvename>CAN-2005-1280</cvename>
      <freebsdsa>SA-05:10.tcpdump</freebsdsa>
      <mlist msgid="20050426100140.1945.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=111454406222040</mlist>
      <mlist msgid="20050426100057.1748.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=111454461300644</mlist>
      <mlist msgid="20050619091553.GB982@zaphod.nitro.dk">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=111928309502304</mlist>
    </references>
    <dates>
      <discovery>2005-06-09</discovery>
      <entry>2005-06-18</entry>
      <modified>2005-06-20</modified>
    </dates>
  </vuln>

  <vuln vid="2701611f-df5c-11d9-b875-0001020eed82">
    <topic>gaim -- Yahoo! remote crash vulnerability</topic>
    <affects>
      <package>
	<name>gaim</name>
	<name>ja-gaim</name>
	<name>ko-gaim</name>
	<name>ru-gaim</name>
	<range><lt>1.3.1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Jacopo Ottaviani reports that Gaim can be crashed by being
	  offered files with names containing non-ASCII
	  characters via the Yahoo! protocol.</p>
      </body>
    </description>
    <references>
      <bid>13931</bid>
      <cvename>CAN-2005-1269</cvename>
      <url>http://gaim.sourceforge.net/security/index.php?id=18</url>
    </references>
    <dates>
      <discovery>2005-06-10</discovery>
      <entry>2005-06-17</entry>
    </dates>
  </vuln>

  <vuln vid="b6612eee-df5f-11d9-b875-0001020eed82">
    <topic>gaim -- MSN Remote DoS vulnerability</topic>
    <affects>
      <package>
	<name>gaim</name>
	<name>ja-gaim</name>
	<name>ko-gaim</name>
	<name>ru-gaim</name>
	<range><lt>1.3.1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The GAIM team reports:</p>
	<blockquote cite="http://gaim.sourceforge.net/security/index.php?id=19">
	  <p>Remote attackers can cause a denial of service (crash)
	    via a malformed MSN message that leads to a memory
	    allocation of a large size, possibly due to an integer
	    signedness error.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <bid>13932</bid>
      <cvename>CAN-2005-1934</cvename>
      <url>http://gaim.sourceforge.net/security/index.php?id=19</url>
    </references>
    <dates>
      <discovery>2005-06-10</discovery>
      <entry>2005-06-17</entry>
    </dates>
  </vuln>

  <vuln vid="12b1a62d-6056-4d90-9e21-45fcde6abae4">
    <topic>gallery -- remote code injection via HTTP_POST_VARS</topic>
    <affects>
      <package>
	<name>gallery</name>
	<range><lt>1.4.1.1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A web server running Gallery can be exploited for arbitrary
	  PHP code execution through the use of a maliciously crafted
	  URL.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-2124</cvename>
      <mlist msgid="0c0a01c3e525$1c0ed2b0$c90c030a@bmedirattatg">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=107524414317693</mlist>
    </references>
    <dates>
      <discovery>2004-01-27</discovery>
      <entry>2005-06-17</entry>
    </dates>
  </vuln>

  <vuln vid="5752a0df-60c5-4876-a872-f12f9a02fa05">
    <topic>gallery -- cross-site scripting</topic>
    <affects>
      <package>
	<name>gallery</name>
	<range><lt>1.4.4.5</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Gallery includes several cross-site scripting vulnerabilities
	  that could allow malicious content to be injected.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-1106</cvename>
      <cvename>CAN-2005-0219</cvename>
      <cvename>CAN-2005-0220</cvename>
      <cvename>CAN-2005-0221</cvename>
      <cvename>CAN-2005-0222</cvename>
      <bid>11602</bid>
      <url>http://gallery.menalto.com/modules.php?op=modload&amp;name=News&amp;file=article&amp;sid=147</url>
      <url>http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110608459222364</url>
    </references>
    <dates>
      <discovery>2005-01-26</discovery>
      <entry>2005-06-17</entry>
    </dates>
  </vuln>

  <vuln vid="0512b761-70fb-40d3-9954-aa4565528fa8">
    <topic>kstars -- exploitable set-user-ID application fliccd</topic>
    <affects>
      <package>
	<name>kdeedu</name>
	<range><lt>3.3.2_1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A KDE Security Advisory explains:</p>
	<blockquote cite="http://www.kde.org/info/security/advisory-20050215-1.txt">
	  <h1>Overview</h1>
	  <p>KStars includes support for the Instrument Neutral
            Distributed Interface (INDI). The build system of this
            extra 3rd party software contained an installation hook to
            install fliccd (part of INDI) as SUID root
            application.</p>
          <p>Erik Sjölund discovered that the code contains several
            vulnerabilities that allow stack based buffer
            overflows.</p>
	  <h1>Impact</h1>
	  <p>If the fliccd binary is installed as suid root, it
            enables root privilege escalation for local users, or, if
            the daemon is actually running (which it does not by
            default) and is running as root, remote root privilege
            escalation.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CAN-2005-0011</cvename>
      <url>http://www.kde.org/info/security/advisory-20050215-1.txt</url>
    </references>
    <dates>
      <discovery>2005-01-05</discovery>
      <entry>2005-06-17</entry>
    </dates>
  </vuln>

  <vuln vid="4c005a5e-2541-4d95-80a0-00c76919aa66">
    <topic>fd_set -- bitmap index overflow in multiple applications</topic>
    <affects>
      <package>
	<name>gatekeeper</name>
	<range><lt>2.2.1</lt></range>
      </package>
      <package>
	<name>citadel</name>
	<range><lt>6.29</lt></range>
      </package>
      <package>
	<name>3proxy</name>
	<range><lt>0.5.b</lt></range>
      </package>
      <package>
	<name>jabber</name>
	<name>bnc</name>
	<name>dante</name>
	<name>rinetd</name>
	<name>bld</name>
	<range><ge>0</ge></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>3APA3A reports:</p>
	<blockquote cite="http://www.security.nnov.ru/advisories/sockets.asp">
	  <p>If programmer fails to check socket number before using
	    select() or fd_set macros, it's possible to overwrite
	    memory behind fd_set structure. Very few select() based
	    application actually check FD_SETSIZE value. <em>[...]</em></p>
	  <p>Depending on vulnerable application it's possible to
	    overwrite portions of memory. Impact is close to
	    off-by-one overflows, code execution doesn't seems
	    exploitable.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <url>http://www.security.nnov.ru/advisories/sockets.asp</url>
      <mlist msgid="1473827718.20050124233008@security.nnov.ru">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110660879328901</mlist>
    </references>
    <dates>
      <discovery>2004-12-12</discovery>
      <entry>2005-06-17</entry>
    </dates>
  </vuln>

  <vuln vid="b5ffaa2a-ee50-4498-af99-61bc1b163c00">
    <topic>leafnode -- denial of service vulnerability</topic>
    <affects>
      <package>
	<name>leafnode</name>
	<range><lt>1.11.3</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Matthias Andree reports:</p>
	<blockquote cite="http://leafnode.sourceforge.net/leafnode-SA-2005-02.txt">
	  <p>A vulnerability was found in the fetchnews program (the NNTP
	    client) that may under some circumstances cause a wait for input
	    that never arrives, fetchnews "hangs". [...]</p>
	  <p>As only one fetchnews program can run at a time, subsequently
	    started fetchnews and texpire programs will terminate. [...]</p>
	  <p>Upgrade your leafnode package to version 1.11.3.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CAN-2005-1911</cvename>
      <url>http://leafnode.sourceforge.net/leafnode-SA-2005-02.txt</url>
      <freebsdpr>ports/82056</freebsdpr>
      <mlist msgid="20050608215155.GB27234@merlin.emma.line.org">http://marc.theaimsgroup.com/?l=vulnwatch&amp;m=111827180929063</mlist>
    </references>
    <dates>
      <discovery>2005-06-08</discovery>
      <entry>2005-06-09</entry>
    </dates>
  </vuln>

  <vuln vid="fe903533-ff96-4c7a-bd3e-4d40efa71897">
    <topic>gforge -- directory traversal vulnerability</topic>
    <affects>
      <package>
	<name>gforge</name>
	<range><lt>4.0</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>An STG Security Advisory reports:</p>
	  <blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110627132209963">
	    <p>GForge CVS module made by Dragos Moinescu and another
	      module made by Ronald Petty have a directory traversal
	      vulnerability. [...] malicious attackers can read
	      arbitrary directory lists.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CAN-2005-0299</cvename>
      <bid>12318</bid>
      <mlist msgid="20050120051735.2832.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110627132209963</mlist>
    </references>
    <dates>
      <discovery>2005-01-20</discovery>
      <entry>2005-06-03</entry>
    </dates>
  </vuln>

  <vuln vid="d1bbc235-c0c9-45cd-8d2d-c1b8fd22e616">
    <topic>imap-uw -- authentication bypass when CRAM-MD5 is enabled</topic>
    <affects>
      <package>
	<name>imap-uw</name>
	<range><lt>2004b,1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The CRAM-MD5 authentication support of the University of
	  Washington IMAP and POP3 servers contains a vulnerability that
	  may allow an attacker to bypass authentication and impersonate
	  arbitrary users.  Only installations with CRAM-MD5 support
	  configured are affected.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2005-0198</cvename>
      <certvu>702777</certvu>
    </references>
    <dates>
      <discovery>2005-01-04</discovery>
      <entry>2005-06-03</entry>
    </dates>
  </vuln>

  <vuln vid="5bf1a715-cc57-440f-b0a5-6406961c54a7">
    <topic>squid -- denial-of-service vulnerabilities</topic>
    <affects>
      <package>
	<name>squid</name>
	<range><lt>2.5.9</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Squid team reported several denial-of-service
	  vulnerabilities related to the handling of DNS responses and
	  NT Lan Manager messages.  These may allow an attacker to crash
	  the Squid cache.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2005-0446</cvename>
      <url>http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE8-dns_assert</url>
      <cvename>CAN-2005-0096</cvename>
      <cvename>CAN-2005-0097</cvename>
      <url>http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-fakeauth_auth</url>
    </references>
    <dates>
      <discovery>2005-01-16</discovery>
      <entry>2005-06-03</entry>
    </dates>
  </vuln>

  <vuln vid="3b260179-e464-460d-bf9f-d5cda6204020">
    <topic>racoon -- remote denial-of-service</topic>
    <affects>
      <package>
	<name>racoon</name>
	<range><lt>20050510a</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Sebastian Krahmer discovered that the racoon ISAKMP daemon
	  could be crashed with a maliciously crafted UDP packet.  No
	  authentication is required in order to perform the attack.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2005-0398</cvename>
      <mlist>http://sourceforge.net/mailarchive/forum.php?thread_id=6787713&amp;forum_id=32000</mlist>
      <url>http://xforce.iss.net/xforce/xfdb/19707</url>
      <url>https://bugzilla.redhat.com/bugzilla/attachment.cgi?id=109966&amp;action=view</url>
    </references>
    <dates>
      <discovery>2005-03-12</discovery>
      <entry>2005-06-03</entry>
    </dates>
  </vuln>

  <vuln vid="bfbbd505-3bd6-409c-8c67-445d3635cf4b">
    <topic>xli -- integer overflows in image size calculations</topic>
    <affects>
      <package>
	<name>xli</name>
	<range><le>1.17.0_1</le></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Tavis Ormandy discovered several integer overflows in xli's
	  image size handling.  A maliciously crafted image may be able
	  to cause a heap buffer overflow and execute arbitrary code.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2005-0639</cvename>
      <url>http://bugs.gentoo.org/show_bug.cgi?id=79762</url>
      <url>http://pantransit.reptiles.org/prog/xli/CHANGES</url>
    </references>
    <dates>
      <discovery>2005-02-08</discovery>
      <entry>2005-06-03</entry>
    </dates>
  </vuln>

  <vuln vid="310d0087-0fde-4929-a41f-96f17c5adffe">
    <topic>xloadimage -- arbitrary command execution when handling
      compressed files</topic>
    <affects>
      <package>
	<name>xli</name>
	<range><le>1.17.0_1</le></range>
      </package>
      <package>
	<name>xloadimage</name>
	<range><le>4.1.10</le></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Tavis Ormandy discovered that xli and xloadimage attempt to
	  decompress images by piping them through <code>gunzip</code>
	  or similar decompression tools.  Unfortunately, the
	  unsanitized file name is included as part of the command.
	  This is dangerous, as in some situations, such as mailcap
	  processing, an attacker may control the input file name.  As a
	  result, an attacker may be able to cause arbitrary command
	  execution.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2005-0638</cvename>
      <url>http://bugs.gentoo.org/show_bug.cgi?id=79762</url>
    </references>
    <dates>
      <discovery>2005-02-18</discovery>
      <entry>2005-06-03</entry>
    </dates>
  </vuln>

  <vuln vid="8c1da77d-d3e9-11d9-8ffb-00061bc2ad93">
    <topic>xloadimage -- buffer overflow in FACES image handling</topic>
    <affects>
      <package>
	<name>xli</name>
	<range><le>1.17.0_1</le></range>
      </package>
      <package>
	<name>xloadimage</name>
	<range><lt>4.1.9</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>In 2001, zen-parse discovered a buffer overflow in
	  xloadimage's FACES image loader.  A maliciously crafted image
	  could cause xloadimage to execute arbitrary code.  A published
	  exploit exists for this vulnerability.</p>
	<p>In 2005, Rob Holland discovered that the same vulnerability
	  was present in xli.</p>
      </body>
    </description>
    <references>
	<cvename>CAN-2001-0775</cvename>
	<mlist>http://marc.theaimsgroup.com/?l=bugtraq&amp;m=99477230306845</mlist>
	<url>https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=46186</url>
	<url>http://bugs.gentoo.org/show_bug.cgi?id=79762</url>
    </references>
    <dates>
      <discovery>2000-02-19</discovery>
      <entry>2005-06-03</entry>
    </dates>
  </vuln>

  <vuln vid="99b5cfa5-d3d2-11d9-8ffb-00061bc2ad93">
    <topic>yamt -- buffer overflow and directory traversal
      issues</topic>
    <affects>
      <package>
	<name>yamt</name>
	<range><lt>0.5_2</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Stanislav Brabec discovered errors in yamt's path name
	  handling that lead to buffer overflows and directory traversal
	  issues.  When processing a file with a maliciously crafted ID3
	  tag, yamt might overwrite arbitrary files or possibly execute 
	  arbitrary code.</p>
	<p>The SuSE package ChangeLog contains:</p>
	<blockquote>
	  <ul>
	    <li>Several security fixes (#49337):</li>
	    <li>directory traversal in rename</li>
	    <li>directory traversal in sort</li>
	    <li>buffer overflow in sort</li>
	    <li>buffer overflow in rename</li>
	  </ul>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CAN-2005-1846</cvename>
      <cvename>CAN-2005-1847</cvename>
      <url>http://rpmfind.net/linux/RPM/suse/updates/8.2/i386/rpm/i586/yamt-0.5-1277.i586.html</url>
      <url>ftp://ftp.suse.com/pub/suse/i386/update/8.2/rpm/src/yamt-0.5-1277.src.rpm</url>
    </references>
    <dates>
      <discovery>2005-01-20</discovery>
      <entry>2005-06-03</entry>
    </dates>
  </vuln>

  <vuln vid="ae6ec9b8-2f43-4d02-8129-c6a3a53ef09d">
    <topic>xview -- multiple buffer overflows in xv_parse_one</topic>
    <affects>
      <package>
	<name>xview</name>
	<range><lt>3.2.1_3</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A Debian Security Advisory reports:</p>
	<blockquote cite="http://www.debian.org/security/2005/dsa-672">
	  <p>Erik Sjölund discovered that programs linked against xview
	    are vulnerable to a number of buffer overflows in the XView
	    library. When the overflow is triggered in a program which
	    is installed setuid root a malicious user could perhaps
	    execute arbitrary code as privileged user.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CAN-2005-0076</cvename>
      <url>http://www.debian.org/security/2005/dsa-672</url>
      <url>http://xforce.iss.net/xforce/xfdb/19271</url>
    </references>
    <dates>
      <discovery>2005-02-09</discovery>
      <entry>2005-06-01</entry>
    </dates>
  </vuln>

  <vuln vid="f7e8d2ca-410e-40b2-8748-3abd021e44a9">
    <topic>xtrlock -- X display locking bypass</topic>
    <affects>
      <package>
	<name>xtrlock</name>
	<range><lt>2.0.10</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The X display locking program <code>xtrlock</code> contains
	  an integer overflow bug.  It is possible for an attacker with
	  physical access to the system to bypass the display lock.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2005-0079</cvename>
      <url>http://www.debian.org/security/2005/dsa-649</url>
      <url>http://xforce.iss.net/xforce/xfdb/18991</url>
      <url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=278191</url>
    </references>
    <dates>
      <discovery>2004-10-25</discovery>
      <entry>2005-06-01</entry>
    </dates>
  </vuln>

  <vuln vid="bf2e7483-d3fa-440d-8c6e-8f1f2f018818">
    <topic>linux_base -- vulnerabilities in Red Hat 7.1 libraries</topic>
    <affects>
      <package>
	<name>linux_base</name>
	<range><lt>7.3</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Trevor Johnson reported that the Red Hat Linux RPMs used
	  by linux_base contained multiple older vulnerabilities, such
	  as a DNS resolver issue and critical bugs in X font handling
	  and XPM image handling.</p>
      </body>
    </description>
    <references>
      <url>http://fedoralegacy.org/updates/RH7.3/2004-10-23-FLSA_2004_1947__Updated_glibc_packages_fix_flaws.html</url>
      <url>http://rhn.redhat.com/errata/RHSA-2004-059.html</url>
      <url>http://rhn.redhat.com/errata/RHSA-2004-478.html</url>
      <url>http://rhn.redhat.com/errata/RHSA-2004-612.html</url>
      <cvename>CAN-2002-0029</cvename>
      <cvename>CAN-2004-0083</cvename>
      <cvename>CAN-2004-0084</cvename>
      <cvename>CAN-2004-0106</cvename>
      <cvename>CAN-2004-0687</cvename>
      <cvename>CAN-2004-0688</cvename>
      <cvename>CAN-2004-0692</cvename>
      <cvename>CAN-2004-0914</cvename>
    </references>
    <dates>
      <discovery>2004-09-27</discovery>
      <entry>2005-06-01</entry>
    </dates>
  </vuln>

  <vuln vid="79630c0c-8dcc-45d0-9908-4087fe1d618c">
    <topic>squirrelmail -- XSS and remote code injection vulnerabilities</topic>
    <affects>
      <package>
	<name>squirrelmail</name>
	<name>ja-squirrelmail</name>
	<range><lt>1.4.4</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A SquirrelMail Security Advisory reports:</p>
	<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110702772714662">
	  <p>SquirrelMail 1.4.4 has been released to resolve a number of
	    security issues disclosed below.  It is strongly recommended
	    that all running SquirrelMail prior to 1.4.4 upgrade to the
	    latest release.</p>
	  <h1>Remote File Inclusion</h1>
	  <p>Manoel Zaninetti reported an issue in src/webmail.php which
	    would allow a crafted URL to include a remote web page.
	    This was assigned CAN-2005-0103 by the Common
	    Vulnerabilities and Exposures.</p>
	  <h1>Cross Site Scripting Issues</h1>
	  <p>A possible cross site scripting issue exists in
	    src/webmail.php that is only accessible when the PHP
	    installation is running with register_globals set to On.
	    This issue was uncovered internally by the SquirrelMail
	    Development team. This isssue was assigned CAN-2005-0104 by
	    the Common Vulnerabilities and Exposures.</p>
	  <p>A second issue which was resolved in the 1.4.4-rc1 release
	    was uncovered and assigned CAN-2004-1036 by the Common
	    Vulnerabilities and Exposures.  This issue could allow a
	    remote user to send a specially crafted header and cause
	    execution of script (such as javascript) in the client
	    browser.</p>
	  <h1>Local File Inclusion</h1>
	  <p>A possible local file inclusion issue was uncovered by one
	    of our developers involving custom preference handlers.
	    This issue is only active if the PHP installation is running
	    with register_globals set to On.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-1036</cvename>
      <cvename>CAN-2005-0075</cvename>
      <cvename>CAN-2005-0103</cvename>
      <cvename>CAN-2005-0104</cvename>
      <mlist msgid="47249.24.0.109.81.1106975343.squirrel@sm-14.netdork.net">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110702772714662</mlist>
      <url>http://www.squirrelmail.org/security/issue/2005-01-14</url>
      <url>http://www.squirrelmail.org/security/issue/2005-01-19</url>
      <url>http://www.squirrelmail.org/security/issue/2005-01-20</url>
    </references>
    <dates>
      <discovery>2005-01-29</discovery>
      <entry>2005-06-01</entry>
    </dates>
  </vuln>

  <vuln vid="0d9ba03b-0dbb-42b4-ae0f-60e27af78e22">
    <topic>sympa -- buffer overflow in "queue"</topic>
    <affects>
      <package>
	<name>sympa</name>
	<range><lt>4.1.2_1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Erik Sjölund discovered a vulnerabilitiy in Sympa.  The
	  <code>queue</code> application processes messages received via
	  aliases.  It contains a buffer overflow in the usage of
	  <code>sprintf</code>.  In some configurations, it may allow an
	  attacker to execute arbitrary code as the <code>sympa</code>
	  user.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2005-0073</cvename>
      <url>http://www.debian.org/security/2005/dsa-677</url>
    </references>
    <dates>
      <discovery>2005-02-11</discovery>
      <entry>2005-06-01</entry>
    </dates>
  </vuln>

  <vuln vid="b3cd00f7-c0c5-452d-87bc-086c5635333e">
    <topic>mailman -- generated passwords are poor quality</topic>
    <affects>
      <package>
	<name>mailman</name>
	<name>ja-mailman</name>
	<range><lt>2.1.6</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Florian Weimer wrote:</p>
	<blockquote cite="http://mail.python.org/pipermail/mailman-developers/attachments/20041215/be238297/attachment.mht">
	  <p>Mailman 2.1.5 uses weak auto-generated passwords for new
	    subscribers.  These passwords are assigned when members
	    subscribe without specifying their own password (either by
	    email or the web frontend).  Knowledge of this password
	    allows an attacker to gain access to the list archive even
	    though she's not a member and the archive is restricted to
	    members only.  [...]</p>
	  <p>This means that only about 5 million different passwords
	    are ever generated, a number that is in the range of brute
	    force attacks -- you only have to guess one subscriber
	    address (which is usually not that hard).</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-1143</cvename>
      <mlist>http://mail.python.org/pipermail/mailman-developers/2004-December/017553.html</mlist>
      <mlist msgid="87llc0u6l8.fsf@deneb.enyo.de">http://mail.python.org/pipermail/mailman-developers/attachments/20041215/be238297/attachment.mht</mlist>
    </references>
    <dates>
      <discovery>2004-12-15</discovery>
      <entry>2005-06-01</entry>
    </dates>
  </vuln>

  <vuln vid="ad9d2518-3471-4737-b60b-9a1f51023b28">
    <topic>mailman -- password disclosure</topic>
    <affects>
      <package>
	<name>mailman</name>
	<name>ja-mailman</name>
	<range><lt>2.1.5</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Barry Warsaw reports:</p>
	<blockquote
	  cite="http://mail.python.org/pipermail/mailman-announce/2004-May/000072.html">
	  <p>Today I am releasing Mailman 2.1.5, a bug fix release
	    [...] This version also contains a fix for an exploit that
	    could allow 3rd parties to retrieve member passwords.  It is
	    thus highly recommended that all existing sites upgrade to
	    the latest version.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-0412</cvename>
      <mlist>http://mail.python.org/pipermail/mailman-announce/2004-May/000072.html</mlist>
    </references>
    <dates>
      <discovery>2004-05-15</discovery>
      <entry>2005-06-01</entry>
    </dates>
  </vuln>

  <vuln vid="26a08c77-32da-4dd7-a884-a76fc49aa824">
    <topic>tomcat -- Tomcat Manager cross-site scripting</topic>
    <affects>
      <package>
	<name>jakarta-tomcat</name>
	<range><ge>5.*</ge><lt>5.5.7</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Oliver Karow discovered cross-site scripting issues in
	  the Apache Jakarta Tomcat manager.  The developers refer to
	  the issues as <q>minor</q>.</p>
      </body>
    </description>
    <references>
      <url>http://www.oliverkarow.de/research/jakarta556_xss.txt</url>
      <mlist>http://www.mail-archive.com/tomcat-dev@jakarta.apache.org/msg66978.html</mlist>
    </references>
    <dates>
      <discovery>2005-01-03</discovery>
      <entry>2005-06-01</entry>
    </dates>
  </vuln>

  <vuln vid="84479a62-ca5f-11d9-b772-000c29b00e99">
    <topic>fswiki -- XSS problem in file upload form</topic>
    <affects>
      <package>
	<name>fswiki</name>
	<range><le>3.5.6</le></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A Secunia security advisory reports:</p>
	<blockquote cite="http://secunia.com/advisories/15538">
	  <p>A vulnerability has been reported in FreeStyle Wiki and
	    FSWikiLite, which can be exploited by malicious people to
	    conduct script insertion attacks.</p>
	  <p>Input passed in uploaded attachments is not properly
	    sanitised before being used. This can be exploited to inject
	    arbitrary HTML and script code, which will be executed in a
	    user's browser session in context of an affected site when
	    the malicious attachment is viewed.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CAN-2005-1799</cvename>
      <url>http://secunia.com/advisories/15538</url>
      <freebsdpr>ports/81520</freebsdpr>
      <url>http://fswiki.poi.jp/wiki.cgi?page=%CD%FA%CE%F2%2F2005%2D5%2D19</url>
      <url>http://jvn.jp/jp/JVN%23465742E4/index.html</url>
    </references>
    <dates>
      <discovery>2005-05-19</discovery>
      <entry>2005-05-29</entry>
      <modified>2005-06-01</modified>
    </dates>
  </vuln>
  <vuln vid="2fbe16c2-cab6-11d9-9aed-000e0c2e438a">
    <topic>freeradius -- sql injection and denial of service vulnerability</topic>
    <affects>
      <package>
	<name>freeradius</name>
	<range><le>1.0.2_1</le></range>
      </package>
      <package>
	<name>freeradius-devel</name>
	<range><gt>0</gt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A Gentoo Advisory reports:</p>
	<blockquote cite="http://www.gentoo.org/security/en/glsa/glsa-200505-13.xml">
	  <p>The FreeRADIUS server is vulnerable to an SQL injection
	    attack and a buffer overflow, possibly resulting in
	    disclosure and modification of data and Denial of
	    Service.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <bid>13540</bid>
      <bid>13541</bid>
      <url>http://www.gentoo.org/security/en/glsa/glsa-200505-13.xml</url>
    </references>
    <dates>
      <discovery>2005-05-17</discovery>
      <entry>2005-05-22</entry>
    </dates>
  </vuln>

  <vuln vid="641e8609-cab5-11d9-9aed-000e0c2e438a">
    <topic>ppxp -- local root exploit</topic>
    <affects>
      <package>
	<name>ppxp</name>
	<range><gt>0</gt></range>
      </package>
      <package>
	<name>ja-ppxp</name>
	<range><gt>0</gt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A Debian Advisory reports:</p>
	<blockquote cite="http://www.debian.org/security/2005/dsa-725">
	  <p>Jens Steube discovered that ppxp, yet another PPP program,
	    does not release root privileges when opening potentially
	    user supplied log files.  This can be tricked into opening
	    a root shell.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CAN-2005-0392</cvename>
      <url>http://www.debian.org/security/2005/dsa-725</url>
    </references>
    <dates>
      <discovery>2005-05-19</discovery>
      <entry>2005-05-22</entry>
    </dates>
  </vuln>

  <vuln vid="1033750f-cab4-11d9-9aed-000e0c2e438a">
    <topic>oops -- format string vulnerability</topic>
    <affects>
      <package>
	<name>oops</name>
	<range><le>1.5.24</le></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A RST/GHC Advisory reports that there is an format string
	  vulnerability in oops.  The vulnerability can be found in
	  the MySQL/PgSQL authentication module.  Succesful
	  exploitation may allow execution of arbitrary code.</p>
      </body>
    </description>
    <references>
      <bid>13172</bid>
      <cvename>CAN-2005-1121</cvename>
      <url>http://rst.void.ru/papers/advisory24.txt</url>
    </references>
    <dates>
      <discovery>2005-04-14</discovery>
      <entry>2005-05-22</entry>
    </dates>
  </vuln>

  <vuln vid="d51a7e6e-c546-11d9-9aed-000e0c2e438a">
    <topic>cdrdao -- unspecified privilege escalation vulnerability</topic>
    <affects>
      <package>
	<name>cdrdao</name>
	<range><lt>1.2.0</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The developers of cdrdao report that there is a potential
	  root exploit in the software.  In order to be able to
	  succesfully exploit this vulnerability cdrdao must be
	  installed setuid root.  When succesfully exploited a local
	  user might get escalated privileges.  By default this port is
	  not installed setuid root.</p>
      </body>
    </description>
    <references>
      <url>http://secunia.com/advisories/15354/</url>
      <url>http://sourceforge.net/forum/forum.php?forum_id=466399</url>
    </references>
    <dates>
      <discovery>2005-05-13</discovery>
      <entry>2005-05-19</entry>
    </dates>
  </vuln>

  <vuln vid="ad5e70bb-c429-11d9-ac59-02061b08fc24">
    <topic>gaim -- MSN remote DoS vulnerability</topic>
    <affects>
      <package>
	<name>gaim</name>
	<name>ja-gaim</name>
	<name>ko-gaim</name>
	<name>ru-gaim</name>
	<range><lt>1.3.0</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The GAIM team reports:</p>
	<blockquote cite="http://gaim.sourceforge.net/security/index.php?id=17">
	  <p>Potential remote denial of service bug resulting from not
	    checking a pointer for non-NULL before passing it to
	    strncmp, which results in a crash. This can be triggered
	    by a remote client sending an SLP message with an empty
	    body.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CAN-2005-1262</cvename>
      <url>http://gaim.sourceforge.net/security/index.php?id=17</url>
    </references>
    <dates>
      <discovery>2005-05-10</discovery>
      <entry>2005-05-14</entry>
    </dates>
  </vuln>

  <vuln vid="889061af-c427-11d9-ac59-02061b08fc24">
    <topic>gaim -- remote crash on some protocols</topic>
    <affects>
      <package>
	<name>gaim</name>
	<name>ja-gaim</name>
	<name>ko-gaim</name>
	<name>ru-gaim</name>
	<range><lt>1.3.0</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The GAIM team reports that GAIM is vulnerable to a
	  denial-of-service vulnerability which can cause GAIM to
	  crash:</p>
	<blockquote cite="http://gaim.sourceforge.net/security/index.php?id=16">
	  <p>It is possible for a remote user to overflow a static
	    buffer by sending an IM containing a very large URL
	    (greater than 8192 bytes) to the Gaim user. This is not
	    possible on all protocols, due to message length
	    restrictions. Jabber are SILC are known to be
	    vulnerable.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CAN-2005-1261</cvename>
      <url>http://gaim.sourceforge.net/security/index.php?id=16</url>
    </references>
    <dates>
      <discovery>2005-05-10</discovery>
      <entry>2005-05-14</entry>
    </dates>
  </vuln>

  <vuln vid="180e9a38-060f-4c16-a6b7-49f3505ff22a">
    <topic>kernel -- information disclosure when using HTT</topic>
    <affects>
      <system>
	<name>FreeBSD</name>
	<range><ge>5.4</ge><lt>5.4_1</lt></range>
	<range><ge>5.0</ge><lt>5.3_15</lt></range>
	<range><ge>4.11</ge><lt>4.11_9</lt></range>
	<range><lt>4.10_14</lt></range>
      </system>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem description and impact</h1>
	<p>When running on processors supporting Hyper-Threading Technology, it is
	  possible for a malicious thread to monitor the execution of another
	  thread.</p>
	<p>Information may be disclosed to local users, allowing in many
	  cases for privilege escalation.  For example, on a multi-user
	  system, it may be possible to steal cryptographic keys used in
	  applications such as OpenSSH or SSL-enabled web servers.</p>
	<p><strong>NOTE:</strong> Similar problems may exist in other
	  simultaneous multithreading implementations, or even some
	  systems in the absence of simultaneous multithreading.
	  However, current research has only demonstrated this flaw in
	  Hyper-Threading Technology, where shared memory caches are
	  used.</p>
	<h1>Workaround</h1>
	<p>Systems not using processors with Hyper-Threading Technology
	  support are not affected by this issue.  On systems which are
	  affected, the security flaw can be eliminated by setting the
	  "machdep.hlt_logical_cpus" tunable:</p>
	<pre># echo "machdep.hlt_logical_cpus=1" >> /boot/loader.conf</pre>
	<p>The system must be rebooted in order for tunables to take effect.</p>
	<p>Use of this workaround is not recommended on "dual-core" systems, as
	  this workaround will also disable one of the processor
	  cores.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2005-0109</cvename>
      <freebsdsa>SA-05:09.htt</freebsdsa>
      <url>http://www.daemonology.net/hyperthreading-considered-harmful/</url>
    </references>
    <dates>
      <discovery>2005-05-13</discovery>
      <entry>2005-05-13</entry>
    </dates>
  </vuln>

  <vuln vid="66dbb2ee-99b8-45b2-bb3e-640caea67a60">
    <topic>leafnode -- fetchnews denial-of-service triggered by transmission abort/timeout</topic>
    <affects>
      <package>
        <name>leafnode</name>
        <range><ge>1.9.48</ge><lt>1.11.2</lt></range>
      </package>
    </affects>
    <description>
       <body xmlns="http://www.w3.org/1999/xhtml">
         <p>When an upstream server aborts the transmission or stops sending
	   data after the fetchnews program has requested an article header
	   or body, fetchnews may crash, without querying further servers
	   that are configured. This can prevent articles from being fetched.
	</p>
      </body>
    </description>
    <references>
      <url>http://leafnode.sourceforge.net/leafnode-SA-2005-01.txt</url>
      <cvename>CAN-2005-1453</cvename>
      <freebsdpr>ports/80663</freebsdpr>
      <bid>13489</bid>
      <bid>13492</bid>
      <mlist msgid="20050504152311.GA25593@merlin.emma.line.org">http://sourceforge.net/mailarchive/forum.php?thread_id=7186974&amp;forum_id=10210</mlist>
      <mlist msgid="20050504152311.GA25593@merlin.emma.line.org">http://article.gmane.org/gmane.network.leafnode.announce/52</mlist>
      <mlist msgid="20050504152311.GA25593@merlin.emma.line.org">http://www.dt.e-technik.uni-dortmund.de/pipermail/leafnode-list/2005q2/000900.html</mlist>
      <mlist msgid="20050504152311.GA25593@merlin.emma.line.org">http://www.fredi.de/maillist/msg00111.html</mlist>
      <mlist msgid="20050504152311.GA25593@merlin.emma.line.org">http://archives.neohapsis.com/archives/vulnwatch/2005-q2/0037.html</mlist>
      <url>http://www.frsirt.com/english/advisories/2005/0468</url>
      <url>http://secunia.com/advisories/15252</url>
    </references>
    <dates>
      <discovery>2005-05-04</discovery>
      <entry>2005-05-13</entry>
    </dates>
  </vuln>

  <vuln vid="a6427195-c2c7-11d9-89f7-02061b08fc24">
    <topic>mozilla -- privilege escalation via non-DOM property
      overrides</topic>
    <affects>
      <package>
	<name>firefox</name>
	<range><lt>1.0.4,1</lt></range>
      </package>
      <package>
	<name>linux-firefox</name>
	<range><lt>1.0.4</lt></range>
      </package>
      <package>
	<name>mozilla</name>
	<range><lt>1.7.8,2</lt></range>
	<range><ge>1.8.*,2</ge></range>
      </package>
      <package>
	<name>linux-mozilla</name>
	<name>linux-mozilla-devel</name>
	<range><lt>1.7.8</lt></range>
	<range><ge>1.8.*</ge></range>
      </package>
      <package>
	<name>netscape7</name>
	<range><ge>0</ge></range>
      </package>
      <package>
	<!-- These ports are obsolete. -->
	<name>de-linux-mozillafirebird</name>
	<name>el-linux-mozillafirebird</name>
	<name>ja-linux-mozillafirebird-gtk1</name>
	<name>ja-mozillafirebird-gtk2</name>
	<name>linux-mozillafirebird</name>
	<name>ru-linux-mozillafirebird</name>
	<name>zhCN-linux-mozillafirebird</name>
	<name>zhTW-linux-mozillafirebird</name>
	<range><ge>0</ge></range>
      </package>
      <package>
	<!-- These package names are obsolete. -->
	<name>de-linux-netscape</name>
	<name>de-netscape7</name>
	<name>fr-linux-netscape</name>
	<name>fr-netscape7</name>
	<name>ja-linux-netscape</name>
	<name>ja-netscape7</name>
	<name>linux-netscape</name>
	<name>linux-phoenix</name>
	<name>mozilla+ipv6</name>
	<name>mozilla-embedded</name>
	<name>mozilla-firebird</name>
	<name>mozilla-gtk1</name>
	<name>mozilla-gtk2</name>
	<name>mozilla-gtk</name>
	<name>mozilla-thunderbird</name>
	<name>phoenix</name>
	<name>pt_BR-netscape7</name>
	<range><ge>0</ge></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A Mozilla Foundation Security Advisory reports:</p>
	<blockquote cite="http://www.mozilla.org/security/announce/mfsa2005-44.html">
	  <p>Additional checks were added to make sure Javascript eval
	    and Script objects are run with the privileges of the
	    context that created them, not the potentially elevated
	    privilege of the context calling them in order to protect
	    against an additional variant of <a
	    href="http://www.mozilla.org/security/announce/mfsa2005-41.html">MFSA
	    2005-41</a>.</p>
	</blockquote>
	<p>The Mozilla Foundation Security Advisory MFSA 2005-41
	  reports:</p>
	<blockquote cite="http://www.mozilla.org/security/announce/mfsa2005-41.html">
	  <p>moz_bug_r_a4 reported several exploits giving an attacker
	    the ability to install malicious code or steal data,
	    requiring only that the user do commonplace actions like
	    click on a link or open the context menu.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <url>http://www.mozilla.org/security/announce/mfsa2005-44.html</url>
    </references>
    <dates>
      <discovery>2005-05-11</discovery>
      <entry>2005-05-12</entry>
    </dates>
  </vuln>

  <vuln vid="a81746a1-c2c7-11d9-89f7-02061b08fc24">
    <topic>mozilla -- "Wrapped" javascript: urls bypass security
      checks</topic>
    <affects>
      <package>
	<name>firefox</name>
	<range><lt>1.0.4,1</lt></range>
      </package>
      <package>
	<name>linux-firefox</name>
	<range><lt>1.0.4</lt></range>
      </package>
      <package>
	<name>mozilla</name>
	<range><lt>1.7.8,2</lt></range>
	<range><ge>1.8.*,2</ge></range>
      </package>
      <package>
	<name>linux-mozilla</name>
	<name>linux-mozilla-devel</name>
	<range><lt>1.7.8</lt></range>
	<range><ge>1.8.*</ge></range>
      </package>
      <package>
	<name>netscape7</name>
	<range><ge>0</ge></range>
      </package>
      <package>
	<!-- These ports are obsolete. -->
	<name>de-linux-mozillafirebird</name>
	<name>el-linux-mozillafirebird</name>
	<name>ja-linux-mozillafirebird-gtk1</name>
	<name>ja-mozillafirebird-gtk2</name>
	<name>linux-mozillafirebird</name>
	<name>ru-linux-mozillafirebird</name>
	<name>zhCN-linux-mozillafirebird</name>
	<name>zhTW-linux-mozillafirebird</name>
	<range><ge>0</ge></range>
      </package>
      <package>
	<!-- These package names are obsolete. -->
	<name>de-linux-netscape</name>
	<name>de-netscape7</name>
	<name>fr-linux-netscape</name>
	<name>fr-netscape7</name>
	<name>ja-linux-netscape</name>
	<name>ja-netscape7</name>
	<name>linux-netscape</name>
	<name>linux-phoenix</name>
	<name>mozilla+ipv6</name>
	<name>mozilla-embedded</name>
	<name>mozilla-firebird</name>
	<name>mozilla-gtk1</name>
	<name>mozilla-gtk2</name>
	<name>mozilla-gtk</name>
	<name>mozilla-thunderbird</name>
	<name>phoenix</name>
	<name>pt_BR-netscape7</name>
	<range><ge>0</ge></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A Mozilla Foundation Security Advisory reports:</p>
	<blockquote cite="http://www.mozilla.org/security/announce/mfsa2005-43.html">
	  <p>Some security checks intended to prevent script injection
	    were incorrect and could be bypassed by wrapping a
	    javascript: url in the view-source:
	    pseudo-protocol. Michael Krax demonstrated that a variant
	    of his <a
	    href="http://www.mozilla.org/security/announce/mfsa2005-37.html">favicon</a>
	    exploit could still execute arbitrary code, and the same
	    technique could also be used to perform cross-site
	    scripting.</p>
	  <p>Georgi Guninski demonstrated the same flaw wrapping
	    javascript: urls with the jar: pseudo-protocol.</p>
	  <p>L. David Baron discovered a nested variant that defeated
	    checks in the script security manager.</p>
	  <p><strong>Workaround:</strong> Disable Javascript</p>
	</blockquote>
      </body>
    </description>
    <references>
      <url>http://www.mozilla.org/security/announce/mfsa2005-43.html</url>
    </references>
    <dates>
      <discovery>2005-05-11</discovery>
      <entry>2005-05-12</entry>
    </dates>
  </vuln>

  <vuln vid="eca6195a-c233-11d9-804c-02061b08fc24">
    <topic>mozilla -- code execution via javascript: IconURL
      vulnerability</topic>
    <affects>
      <package>
	<name>firefox</name>
	<range><lt>1.0.4,1</lt></range>
      </package>
      <package>
	<name>linux-firefox</name>
	<range><lt>1.0.4</lt></range>
      </package>
      <package>
	<name>mozilla</name>
	<range><lt>1.7.8,2</lt></range>
	<range><ge>1.8.*,2</ge></range>
      </package>
      <package>
	<name>linux-mozilla</name>
	<name>linux-mozilla-devel</name>
	<range><lt>1.7.8</lt></range>
	<range><ge>1.8.*</ge></range>
      </package>
      <package>
	<name>netscape7</name>
	<range><ge>0</ge></range>
      </package>
      <package>
	<!-- These ports are obsolete. -->
	<name>de-linux-mozillafirebird</name>
	<name>el-linux-mozillafirebird</name>
	<name>ja-linux-mozillafirebird-gtk1</name>
	<name>ja-mozillafirebird-gtk2</name>
	<name>linux-mozillafirebird</name>
	<name>ru-linux-mozillafirebird</name>
	<name>zhCN-linux-mozillafirebird</name>
	<name>zhTW-linux-mozillafirebird</name>
	<range><ge>0</ge></range>
      </package>
      <package>
	<!-- These package names are obsolete. -->
	<name>de-linux-netscape</name>
	<name>de-netscape7</name>
	<name>fr-linux-netscape</name>
	<name>fr-netscape7</name>
	<name>ja-linux-netscape</name>
	<name>ja-netscape7</name>
	<name>linux-netscape</name>
	<name>linux-phoenix</name>
	<name>mozilla+ipv6</name>
	<name>mozilla-embedded</name>
	<name>mozilla-firebird</name>
	<name>mozilla-gtk1</name>
	<name>mozilla-gtk2</name>
	<name>mozilla-gtk</name>
	<name>mozilla-thunderbird</name>
	<name>phoenix</name>
	<name>pt_BR-netscape7</name>
	<range><ge>0</ge></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A Mozilla Foundation Security Advisory reports:</p>
	<blockquote cite="http://www.mozilla.org/security/announce/mfsa2005-42.html">
	  <p>Two vulnerabilities have been discovered in Firefox,
	    which can be exploited by malicious people to conduct
	    cross-site scripting attacks and compromise a user's
	    system.</p>
	  <ol>
	    <li>The problem is that "IFRAME" JavaScript URLs are not
	      properly protected from being executed in context of
	      another URL in the history list. This can be exploited
	      to execute arbitrary HTML and script code in a user's
	      browser session in context of an arbitrary site.</li>
	    <li>Input passed to the "IconURL" parameter in
	      "InstallTrigger.install()" is not properly verified
	      before being used. This can be exploited to execute
	      arbitrary JavaScript code with escalated privileges via
	      a specially crafted JavaScript URL.</li>
	  </ol>
	  <p>Successful exploitation requires that the site is allowed
	    to install software (default sites are
	    "update.mozilla.org" and "addons.mozilla.org").</p>
	  <p>A combination of vulnerability 1 and 2 can be exploited
	    to execute arbitrary code.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CAN-2005-1476</cvename>
      <cvename>CAN-2005-1477</cvename>
      <url>http://www.mozilla.org/security/announce/mfsa2005-42.html</url>
    </references>
    <dates>
      <discovery>2005-05-08</discovery>
      <entry>2005-05-11</entry>
    </dates>
  </vuln>

  <vuln vid="01bb84e2-bd88-11d9-a281-02e018374e71">
    <topic>groff -- pic2graph and eqn2graph are vulnerable to symlink attack through temporary files</topic>
    <affects>
      <package>
	<name>ja-groff</name>
	<range><ge>1.18.1</ge><lt>1.18.1_8</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The eqn2graph and pic2graph scripts in groff 1.18.1
	  allow local users to overwrite arbitrary files via
	  a symlink attack on temporary files.</p>
      </body>
    </description>
    <references>
      <freebsdpr>ports/80671</freebsdpr>
      <bid>12058</bid>
      <cvename>CAN-2004-1296</cvename>
      <url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=286371</url>
      <url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=286372</url>
    </references>
    <dates>
      <discovery>2004-12-20</discovery>
      <entry>2005-05-09</entry>
    </dates>
  </vuln>

  <vuln vid="169f422f-bd88-11d9-a281-02e018374e71">
    <topic>groff -- groffer uses temporary files unsafely</topic>
    <affects>
      <package>
	<name>ja-groff</name>
	<range><ge>1.18</ge><lt>1.18.1_8</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The groffer script in the groff package 1.18 and later versions
	  allows local users to overwrite files via a symlink attack 
	  on temporary files.</p>
      </body>
    </description>
    <references>
      <freebsdpr>ports/80671</freebsdpr>
      <bid>11287</bid>
      <cvename>CAN-2004-0969</cvename>
      <url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=278265</url>
    </references>
    <dates>
      <discovery>2004-09-30</discovery>
      <entry>2005-05-09</entry>
    </dates>
  </vuln>

  <vuln vid="5f003a08-ba3c-11d9-837d-000e0c2e438a">
    <topic>sharutils -- unshar insecure temporary file creation</topic>
    <affects>
      <package>
	<name>sharutils</name>
	<range><lt>4.3.80</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>An Ubuntu Advisory reports:</p>
	<blockquote cite="http://www.ubuntulinux.org/support/documentation/usn/usn-104-1">
	  <p>Joey Hess discovered that "unshar" created temporary files
	    in an insecure manner. This could allow a symbolic link
	    attack to create or overwrite arbitrary files with the
	    privileges of the user invoking the program.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <bid>12981</bid>
      <cvename>CAN-2005-0990</cvename>
      <url>http://www.ubuntulinux.org/support/documentation/usn/usn-104-1</url>
    </references>
    <dates>
      <discovery>2005-04-04</discovery>
      <entry>2005-05-01</entry>
    </dates>
  </vuln>

  <vuln vid="8c5ad0cf-ba37-11d9-837d-000e0c2e438a">
    <topic>rsnapshot -- local privilege escalation</topic>
    <affects>
      <package>
	<name>rsnapshot</name>
	<range><lt>1.1.7</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>An rsnapshot Advisory reports:</p>
	<blockquote cite="http://www.rsnapshot.org/security/2005/001.html">
	  <p>The copy_symlink() subroutine in rsnapshot incorrectly
	    changes file ownership on the files pointed to by symlinks,
	    not on the symlinks themselves. This would allow, under
	    certain circumstances, an arbitrary user to take ownership
	    of a file on the main filesystem.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <bid>13095</bid>
      <cvename>CAN-2005-1064</cvename>
      <url>http://www.rsnapshot.org/security/2005/001.html</url>
    </references>
    <dates>
      <discovery>2005-04-10</discovery>
      <entry>2005-05-01</entry>
    </dates>
  </vuln>

  <vuln vid="756db070-b9d4-11d9-ae81-000ae42e9b93">
    <topic>coppermine -- IP spoofing and XSS vulnerability</topic>
    <affects>
      <package>
	<name>coppermine</name>
	<range><lt>1.3.2</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>GHC team reports about coppermine</p>
	<blockquote cite="http://www.securityfocus.com/archive/1/396080">
	  <p>The lack of sanitizing of user defined variables may
	    result in undesirable consequences such as IP spoofing
	    or XSS attack.</p>
	  <p>Generally users of Coppermine Gallery can post comments.
	    Remote address &amp; x-forwarded-for variables are logged
	    for admin's eyes.  X-Forwarded-for variable does not pass
	    throu any filtration before logging into database. User
	    can define/redefine this variable.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <mlist msgid="20050418122434.10438.qmail@www.securityfocus.com">http://www.securityfocus.com/archive/1/396080</mlist>
      <bid>13218</bid>
      <cvename>CAN-2005-1172</cvename>
      <url>http://coppermine.sourceforge.net/board/index.php?topic=17134.0</url>
    </references>
    <dates>
      <discovery>2005-04-18</discovery>
      <entry>2005-05-01</entry>
    </dates>
  </vuln>

  <vuln vid="cd286cc5-b762-11d9-bfb7-000c6ec775d9">
    <topic>ImageMagick -- ReadPNMImage() heap overflow vulnerability</topic>
    <affects>
      <package>
	<name>ImageMagick</name>
	<range><lt>6.2.2</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Damian Put reports about ImageMagick:</p>
	<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=111445767107869">
	  <p>Remote exploitation of a heap overflow vulnerability
	    could allow execution of arbitrary code or course denial
	    of service.</p>
	  <p>A heap overflow exists in ReadPNMImage() function, that
	    is used to decode a PNM image files.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <bid>13351</bid>
      <url>http://marc.theaimsgroup.com/?l=bugtraq&amp;m=111445767107869</url>
    </references>
    <dates>
      <discovery>2005-04-25</discovery>
      <entry>2005-04-27</entry>
    </dates>
  </vuln>

  <vuln vid="91c606fc-b5d0-11d9-a788-0001020eed82">
    <topic>mplayer &amp; libxine -- MMS and Real RTSP buffer overflow
      vulnerabilities</topic>
    <affects>
      <package>
	<name>mplayer</name>
	<name>mplayer-gtk</name>
	<name>mplayer-gtk2</name>
	<name>mplayer-esound</name>
	<name>mplayer-gtk-esound</name>
	<name>mplayer-gtk2-esound</name>
	<range><lt>0.99.7</lt></range>
      </package>
      <package>
	<name>libxine</name>
	<range><ge>0.9.9</ge><lt>1.0.1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A xine security announcement reports:</p>
	<blockquote cite="http://xinehq.de/index.php/security/XSA-2004-8">
	  <p>By a user receiving data from a malicious network
	    streaming server, an attacker can overrun a heap buffer,
	    which can, on some systems, lead to or help in executing
	    attacker-chosen malicious code with the permissions of the
	    user running a xine-lib based media application.</p>
	  <p>Both the MMS and Real RTSP streaming client code made
	    some too-strong assumptions on the transferred
	    data. Several critical bounds checks were missing,
	    resulting in the possibility of heap overflows, should the
	    remote server not adhere to these assumptions. In the MMS
	    case, a remote server could present content with too many
	    individual streams; in the RTSP case, a remote server's
	    reply could have too many lines.</p>
	  <p>An attacker can set up a server delivering malicious data
	    to the users. This can be used to overflow a heap buffer,
	    which can, with certain implementations of heap
	    management, lead to attacker chosen data written to the
	    stack. This can cause attacker-chosen code being executed
	    with the permissions of the user running the
	    application. By tricking users to retrieve a stream, which
	    can be as easy as providing a link on a website, this
	    vulnerability can be exploited remotely.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <bid>13270</bid>
      <bid>13271</bid>
      <cvename>CAN-2005-1195</cvename>
      <url>http://www.mplayerhq.hu/homepage/design7/news.html#vuln10</url>
      <url>http://www.mplayerhq.hu/homepage/design7/news.html#vuln11</url>
      <url>http://xinehq.de/index.php/security/XSA-2004-8</url>
    </references>
    <dates>
      <discovery>2005-04-16</discovery>
      <entry>2005-04-25</entry>
    </dates>
  </vuln>

  <vuln vid="8b0e94cc-b5cd-11d9-a788-0001020eed82">
    <topic>gaim -- AIM/ICQ remote denial of service vulnerability</topic>
    <affects>
      <package>
	<name>gaim</name>
	<name>ja-gaim</name>
	<name>ko-gaim</name>
	<name>ru-gaim</name>
	<range><lt>1.1.3</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The GAIM team reports that GAIM is vulnerable to a
	  denial-of-service vulnerability which can cause GAIM to
	  freeze:</p>
	<blockquote cite="http://gaim.sourceforge.net/security/index.php?id=10">
	  <p>Certain malformed SNAC packets sent by other AIM or ICQ
	    users can trigger an infinite loop in Gaim when parsing
	    the SNAC. The remote user would need a custom client, able
	    to generate malformed SNACs.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CAN-2005-0472</cvename>
      <url>http://gaim.sourceforge.net/security/index.php?id=10</url>
    </references>
    <dates>
      <discovery>2005-02-17</discovery>
      <entry>2005-04-25</entry>
    </dates>
  </vuln>

  <vuln vid="142353df-b5cc-11d9-a788-0001020eed82">
    <topic>gaim -- remote DoS on receiving malformed HTML</topic>
    <affects>
      <package>
	<name>gaim</name>
	<name>ja-gaim</name>
	<name>ko-gaim</name>
	<name>ru-gaim</name>
	<range><lt>1.1.4</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The GAIM team reports:</p>
	<blockquote cite="http://gaim.sourceforge.net/security/index.php?id=12">
	  <p>Receiving malformed HTML can result in an invalid memory
	    access causing Gaim to crash.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CAN-2005-0208</cvename>
      <cvename>CAN-2005-0473</cvename>
      <url>http://gaim.sourceforge.net/security/index.php?id=11</url>
      <url>http://gaim.sourceforge.net/security/index.php?id=12</url>
    </references>
    <dates>
      <discovery>2005-02-17</discovery>
      <entry>2005-04-25</entry>
    </dates>
  </vuln>

  <vuln vid="91f1adc7-b3e9-11d9-a788-0001020eed82">
    <topic>kdewebdev -- kommander untrusted code execution
      vulnerability</topic>
    <affects>
      <package>
	<name>kdewebdev</name>
	<range><lt>3.4.0_1,2</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A KDE Security Advisory reports:</p>
	<blockquote cite="http://www.kde.org/info/security/advisory-20050420-1.txt">
	  <p>Kommander executes without user confirmation data files
	    from possibly untrusted locations. As they contain
	    scripts, the user might accidentally run arbitrary
	    code.</p>
	  <p><strong>Impact:</strong> Remotly supplied kommander files
	    from untrusted sources are executed without
	    confirmation.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CAN-2005-0754</cvename>
      <url>http://www.kde.org/info/security/advisory-20050420-1.txt</url>
    </references>
    <dates>
      <discovery>2005-04-20</discovery>
      <entry>2005-04-23</entry>
    </dates>
  </vuln>

  <vuln vid="97edf5ab-b319-11d9-837d-000e0c2e438a">
    <topic>junkbuster -- heap corruption vulnerability and configuration
      modification vulnerability</topic>
    <affects>
      <package>
	<name>junkbuster</name>
	<range><lt>2.0.2_3</lt></range>
      </package>
      <package>
	<name>junkbuster-zlib</name>
	<range><gt>0</gt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A Debian advisory reports:</p>
	<blockquote cite="http://www.debian.org/security/2005/dsa-713">
	  <p>James Ranson discovered that an attacker can modify the
	    referrer setting with a carefully crafted URL by accidently
	    overwriting a global variable.</p>
	  <p>Tavis Ormandy from the Gentoo Security Team discovered
	    several heap corruptions due to inconsistent use of an
	    internal function that can crash the daemon or possibly
	    lead to the execution of arbitrary code.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <bid>13146</bid>
      <bid>13147</bid>
      <cvename>CAN-2005-1108</cvename>
      <cvename>CAN-2005-1109</cvename>
      <url>http://www.debian.org/security/2005/dsa-713</url>
      <url>http://www.gentoo.org/security/en/glsa/glsa-200504-11.xml</url>
    </references>
    <dates>
      <discovery>2005-04-13</discovery>
      <entry>2005-04-22</entry>
    </dates>
  </vuln>

  <vuln vid="06404241-b306-11d9-a788-0001020eed82">
    <topic>kdelibs -- kimgio input validation errors</topic>
    <affects>
      <package>
	<name>kdelibs</name>
	<range><ge>3.2</ge><lt>3.4.0_2</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A KDE Security Advisory reports:</p>
	<blockquote cite="http://www.kde.org/info/security/advisory-20050421-1.txt">
	  <p>kimgio contains a PCX image file format reader that does
	    not properly perform input validation. A source code audit
	    performed by the KDE security team discovered several
	    vulnerabilities in the PCX and other image file format
	    readers, some of them exploitable to execute arbitrary
	    code.</p>
	  <p><strong>Impact:</strong> Remotely supplied, specially
	    crafted image files can be used to execute arbitrary
	    code.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CAN-2005-1046</cvename>
      <url>http://bugs.kde.org/102328</url>
      <url>http://www.kde.org/info/security/advisory-20050421-1.txt</url>
    </references>
    <dates>
      <discovery>2005-04-21</discovery>
      <entry>2005-04-22</entry>
    </dates>
  </vuln>

  <vuln vid="6c2d4f29-af3e-11d9-837d-000e0c2e438a">
    <topic>gld -- format string and buffer overflow vulnerabilities</topic>
    <affects>
      <package>
	<name>gld</name>
	<range><lt>1.5</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Gld has been found vulnerable to multiple buffer overflows as
	  well as multiple format string vulnerabilities.</p>
	<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=111339935903880">
	  <p>An attacker could exploit this vulnerability to execute
	    arbitrary code with the permissions of the user running Gld,
	    the default user being root.</p>
	</blockquote>
	<p>The FreeBSD port defaults to running gld as the root user.
	  The risk of exploitation can be minimized by making gld
	  listen on the loopback address only, or configure it to only
	  accept connections from trusted smtp servers.</p>
      </body>
    </description>
    <references>
      <bid>13129</bid>
      <bid>13133</bid>
      <cvename>CAN-2005-1099</cvename>
      <cvename>CAN-2005-1100</cvename>
      <mlist msgid="20050412004111.562AC7A890E@ws4-4.us4.outblaze.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=111339935903880</mlist>
      <mlist msgid="20050413174736.20947.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=111342432325670</mlist>
    </references>
    <dates>
      <discovery>2005-04-12</discovery>
      <entry>2005-04-19</entry>
    </dates>
  </vuln>

  <vuln vid="0163b498-af54-11d9-acd0-000854d03344">
    <topic>axel -- remote buffer overflow</topic>
    <affects>
      <package>
	<name>axel</name>
	<range><lt>1.0a_4</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A Debian Security Advisory reports:</p>
	<blockquote cite="http://www.debian.org/security/2005/dsa-706">
	  <p>Ulf Härnhammar from the Debian Security Audit Project
	  discovered a buffer overflow in axel, a light download
	  accelerator.  When reading remote input the program did
	  not check if a part of the input can overflow a buffer
	  and maybe trigger the execution of arbitrary code.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <bid>13059</bid>
      <cvename>CAN-2005-0390</cvename>
      <url>http://www.debian.org/security/2005/dsa-706</url>
    </references>
    <dates>
      <discovery>2005-04-16</discovery>
      <entry>2005-04-17</entry>
    </dates>
  </vuln>

  <vuln vid="ce6ac624-aec8-11d9-a788-0001020eed82">
    <topic>firefox -- PLUGINSPAGE privileged javascript execution</topic>
    <affects>
      <package>
	<name>firefox</name>
	<range><lt>1.0.3,1</lt></range>
      </package>
      <package>
	<name>linux-firefox</name>
	<range><lt>1.0.3</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A Mozilla Foundation Security Advisory reports:</p>
	<blockquote cite="http://www.mozilla.org/security/announce/mfsa2005-34.html">
	  <p>When a webpage requires a plugin that is not installed
	    the user can click to launch the Plugin Finder Service
	    (PFS) to find an appropriate plugin. If the service does
	    not have an appropriate plugin the EMBED tag is checked
	    for a PLUGINSPAGE attribute, and if one is found the PFS
	    dialog will contain a "manual install" button that will
	    load the PLUGINSPAGE url.</p>
	  <p>Omar Khan reported that if the PLUGINSPAGE attribute
	    contains a javascript: url then pressing the button could
	    launch arbitrary code capable of stealing local data or
	    installing malicious code.</p>
	  <p>Doron Rosenberg reported a variant that injects script by
	    appending it to a malformed URL of any protocol.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CAN-2005-0752</cvename>
      <url>http://www.mozilla.org/security/announce/mfsa2005-34.html</url>
      <url>https://bugzilla.mozilla.org/show_bug.cgi?id=288556</url>
      <url>https://bugzilla.mozilla.org/show_bug.cgi?id=289171</url>
    </references>
    <dates>
      <discovery>2005-03-31</discovery>
      <entry>2005-04-16</entry>
    </dates>
  </vuln>

  <vuln vid="18e5428f-ae7c-11d9-837d-000e0c2e438a">
    <topic>jdk -- jar directory traversal vulnerability</topic>
    <affects>
      <package>
	<name>jdk</name>
	<range><le>1.2.2p11_3</le></range>
	<range><ge>1.3.*</ge><le>1.3.1p9_4</le></range>
	<range><ge>1.4.*</ge><le>1.4.2p7</le></range>
	<range><ge>1.5.*</ge><le>1.5.0p1_1</le></range>
      </package>
      <package>
	<name>linux-ibm-jdk</name>
	<range><le>1.4.2_1</le></range>
      </package>
      <package>
	<name>linux-sun-jdk</name>
	<range><le>1.4.2.08_1</le></range>
	<range><ge>1.5.*</ge><le>1.5.2.02,2</le></range>
      </package>
      <package>
	<name>linux-blackdown-jdk</name>
	<range><le>1.4.2_2</le></range>
      </package>
      <package>
	<name>diablo-jdk</name>
	<range><le>1.3.1.0_1</le></range>
      </package>
      <package>
	<name>linux-jdk</name>
	<range><ge>0</ge></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Pluf has discovered a vulnerability in Sun Java JDK/SDK,
	  which potentially can be exploited by malicious people to
	  compromise a user's system.</p>
	<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=111331593310508">
	  <p>The jar tool does not check properly if the files to be
	    extracted have the string "../" on its names, so it's
	    possible for an attacker to create a malicious jar file in
	    order to overwrite arbitrary files within the filesystem.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CAN-2005-1080</cvename>
      <mlist msgid="200504120226.10559.pluf@7a69ezine.org">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=111331593310508</mlist>
      <url>http://www.securiteam.com/securitynews/5IP0C0AFGW.html</url>
      <url>http://secunia.com/advisories/14902/</url>
    </references>
    <dates>
      <discovery>2005-04-11</discovery>
      <entry>2005-04-16</entry>
      <modified>2005-05-02</modified>
    </dates>
  </vuln>

  <vuln vid="f650d5b8-ae62-11d9-a788-0001020eed82">
    <topic>mozilla -- privilege escalation via DOM property overrides</topic>
    <affects>
      <package>
	<name>firefox</name>
	<range><lt>1.0.3,1</lt></range>
      </package>
      <package>
	<name>linux-firefox</name>
	<range><lt>1.0.3</lt></range>
      </package>
      <package>
	<name>mozilla</name>
	<range><lt>1.7.7,2</lt></range>
	<range><ge>1.8.*,2</ge></range>
      </package>
      <package>
	<name>linux-mozilla</name>
	<name>linux-mozilla-devel</name>
	<range><lt>1.7.7</lt></range>
	<range><ge>1.8.*</ge></range>
      </package>
      <package>
	<name>netscape7</name>
	<range><ge>0</ge></range>
      </package>
      <package>
	<!-- These ports are obsolete. -->
	<name>de-linux-mozillafirebird</name>
	<name>el-linux-mozillafirebird</name>
	<name>ja-linux-mozillafirebird-gtk1</name>
	<name>ja-mozillafirebird-gtk2</name>
	<name>linux-mozillafirebird</name>
	<name>ru-linux-mozillafirebird</name>
	<name>zhCN-linux-mozillafirebird</name>
	<name>zhTW-linux-mozillafirebird</name>
	<range><ge>0</ge></range>
      </package>
      <package>
	<!-- These package names are obsolete. -->
	<name>de-linux-netscape</name>
	<name>de-netscape7</name>
	<name>fr-linux-netscape</name>
	<name>fr-netscape7</name>
	<name>ja-linux-netscape</name>
	<name>ja-netscape7</name>
	<name>linux-netscape</name>
	<name>linux-phoenix</name>
	<name>mozilla+ipv6</name>
	<name>mozilla-embedded</name>
	<name>mozilla-firebird</name>
	<name>mozilla-gtk1</name>
	<name>mozilla-gtk2</name>
	<name>mozilla-gtk</name>
	<name>mozilla-thunderbird</name>
	<name>phoenix</name>
	<name>pt_BR-netscape7</name>
	<range><ge>0</ge></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A Mozilla Foundation Security Advisory reports:</p>
	<blockquote cite="http://www.mozilla.org/security/announce/mfsa2005-41.html">
	  <p>moz_bug_r_a4 reported several exploits giving an attacker
	    the ability to install malicious code or steal data,
	    requiring only that the user do commonplace actions like
	    click on a link or open the context menu. The common cause
	    in each case was privileged UI code ("chrome") being
	    overly trusting of DOM nodes from the content
	    window. Scripts in the web page can override properties
	    and methods of DOM nodes and shadow the native values,
	    unless steps are taken to get the true underlying values.</p>
	  <p>We found that most extensions also interacted with
	    content DOM in a natural, but unsafe, manner. Changes were
	    made so that chrome code using this natural DOM coding
	    style will now automatically use the native DOM value if
	    it exists without having to use cumbersome wrapper
	    objects.</p>
	  <p>Most of the specific exploits involved tricking the
	    privileged code into calling eval() on an
	    attacker-supplied script string, or the equivalent using
	    the Script() object. Checks were added in the security
	    manager to make sure eval and Script objects are run with
	    the privileges of the context that created them, not the
	    potentially elevated privileges of the context calling
	    them.</p>
	  <p><strong>Workaround</strong>: Disable Javascript</p>
	</blockquote>
      </body>
    </description>
    <references>
      <url>http://www.mozilla.org/security/announce/mfsa2005-41.html</url>
    </references>
    <dates>
      <discovery>2005-04-15</discovery>
      <entry>2005-04-16</entry>
    </dates>
  </vuln>

  <vuln vid="1989b511-ae62-11d9-a788-0001020eed82">
    <topic>mozilla -- code execution through javascript: favicons</topic>
    <affects>
      <package>
	<name>firefox</name>
	<range><lt>1.0.3,1</lt></range>
      </package>
      <package>
	<name>linux-firefox</name>
	<range><lt>1.0.3</lt></range>
      </package>
      <package>
	<name>mozilla</name>
	<range><lt>1.7.7,2</lt></range>
	<range><ge>1.8.*,2</ge></range>
      </package>
      <package>
	<name>linux-mozilla</name>
	<name>linux-mozilla-devel</name>
	<range><lt>1.7.7</lt></range>
	<range><ge>1.8.*</ge></range>
      </package>
      <package>
	<name>netscape7</name>
	<range><ge>0</ge></range>
      </package>
      <package>
	<!-- These ports are obsolete. -->
	<name>de-linux-mozillafirebird</name>
	<name>el-linux-mozillafirebird</name>
	<name>ja-linux-mozillafirebird-gtk1</name>
	<name>ja-mozillafirebird-gtk2</name>
	<name>linux-mozillafirebird</name>
	<name>ru-linux-mozillafirebird</name>
	<name>zhCN-linux-mozillafirebird</name>
	<name>zhTW-linux-mozillafirebird</name>
	<range><ge>0</ge></range>
      </package>
      <package>
	<!-- These package names are obsolete. -->
	<name>de-linux-netscape</name>
	<name>de-netscape7</name>
	<name>fr-linux-netscape</name>
	<name>fr-netscape7</name>
	<name>ja-linux-netscape</name>
	<name>ja-netscape7</name>
	<name>linux-netscape</name>
	<name>linux-phoenix</name>
	<name>mozilla+ipv6</name>
	<name>mozilla-embedded</name>
	<name>mozilla-firebird</name>
	<name>mozilla-gtk1</name>
	<name>mozilla-gtk2</name>
	<name>mozilla-gtk</name>
	<name>mozilla-thunderbird</name>
	<name>phoenix</name>
	<name>pt_BR-netscape7</name>
	<range><ge>0</ge></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A Mozilla Foundation Security Advisory reports:</p>
	<blockquote cite="http://www.mozilla.org/security/announce/mfsa2005-37.html">
	  <p>Firefox and the Mozilla Suite support custom "favicons"
	    through the &lt;LINK rel="icon"&gt; tag. If a link tag is added
	    to the page programmatically and a javascript: url is
	    used, then script will run with elevated privileges and
	    could run or install malicious software.</p>
	  <p><strong>Workaround</strong>: Disable Javascript</p>
	</blockquote>
      </body>
    </description>
    <references>
      <url>http://www.mozilla.org/security/announce/mfsa2005-37.html</url>
    </references>
    <dates>
      <discovery>2005-04-12</discovery>
      <entry>2005-04-16</entry>
    </dates>
  </vuln>

  <vuln vid="45b75152-ae5f-11d9-a788-0001020eed82">
    <topic>mozilla --  javascript "lambda" replace exposes memory
      contents</topic>
    <affects>
      <package>
	<name>firefox</name>
	<range><lt>1.0.3,1</lt></range>
      </package>
      <package>
	<name>linux-firefox</name>
	<range><lt>1.0.3</lt></range>
      </package>
      <package>
	<name>mozilla</name>
	<range><lt>1.7.7,2</lt></range>
	<range><ge>1.8.*,2</ge></range>
      </package>
      <package>
	<name>linux-mozilla</name>
	<name>linux-mozilla-devel</name>
	<range><lt>1.7.7</lt></range>
	<range><ge>1.8.*</ge></range>
      </package>
      <package>
	<name>netscape7</name>
	<range><ge>0</ge></range>
      </package>
      <package>
	<!-- These ports are obsolete. -->
	<name>de-linux-mozillafirebird</name>
	<name>el-linux-mozillafirebird</name>
	<name>ja-linux-mozillafirebird-gtk1</name>
	<name>ja-mozillafirebird-gtk2</name>
	<name>linux-mozillafirebird</name>
	<name>ru-linux-mozillafirebird</name>
	<name>zhCN-linux-mozillafirebird</name>
	<name>zhTW-linux-mozillafirebird</name>
	<range><ge>0</ge></range>
      </package>
      <package>
	<!-- These package names are obsolete. -->
	<name>de-linux-netscape</name>
	<name>de-netscape7</name>
	<name>fr-linux-netscape</name>
	<name>fr-netscape7</name>
	<name>ja-linux-netscape</name>
	<name>ja-netscape7</name>
	<name>linux-netscape</name>
	<name>linux-phoenix</name>
	<name>mozilla+ipv6</name>
	<name>mozilla-embedded</name>
	<name>mozilla-firebird</name>
	<name>mozilla-gtk1</name>
	<name>mozilla-gtk2</name>
	<name>mozilla-gtk</name>
	<name>mozilla-thunderbird</name>
	<name>phoenix</name>
	<name>pt_BR-netscape7</name>
	<range><ge>0</ge></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A Mozilla Foundation Security Advisory reports:</p>
	<blockquote cite="http://www.mozilla.org/security/announce/mfsa2005-33.html">
	  <p>A bug in javascript's regular expression string
	    replacement when using an anonymous function as the
	    replacement argument allows a malicious script to capture
	    blocks of memory allocated to the browser. A web site
	    could capture data and transmit it to a server without
	    user interaction or knowledge.</p>
	  <p><strong>Workaround</strong>: Disable Javascript</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CAN-2005-0989</cvename>
      <url>http://www.mozilla.org/security/announce/mfsa2005-33.html</url>
      <url>https://bugzilla.mozilla.org/show_bug.cgi?id=288688</url>
    </references>
    <dates>
      <discovery>2005-04-01</discovery>
      <entry>2005-04-16</entry>
    </dates>
  </vuln>

  <vuln vid="1f2fdcff-ae60-11d9-a788-0001020eed82">
    <topic>firefox -- arbitrary code execution in sidebar panel</topic>
    <affects>
      <package>
	<name>firefox</name>
	<range><lt>1.0.3,1</lt></range>
      </package>
      <package>
	<name>linux-firefox</name>
	<range><lt>1.0.3</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A Mozilla Foundation Security Advisory reports:</p>
	<blockquote cite="http://www.mozilla.org/security/announce/mfsa2005-39.html">
	  <p>Sites can use the _search target to open links in the
	    Firefox sidebar. Two missing security checks allow
	    malicious scripts to first open a privileged page (such as
	    about:config) and then inject script using a javascript:
	    url. This could be used to install malicious code or steal
	    data without user interaction.</p>
	  <p><strong>Workaround</strong>: Disable Javascript</p>
	</blockquote>
      </body>
    </description>
    <references>
      <url>http://www.mozilla.org/security/announce/mfsa2005-39.html</url>
    </references>
    <dates>
      <discovery>2005-04-12</discovery>
      <entry>2005-04-16</entry>
    </dates>
  </vuln>

  <vuln vid="b206dd82-ac67-11d9-a788-0001020eed82">
    <topic>openoffice -- DOC document heap overflow vulnerability</topic>
    <affects>
      <package>
	<name>openoffice</name>
	<name>ar-openoffice</name>
	<name>ca-openoffice</name>
	<name>cs-openoffice</name>
	<name>de-openoffice</name>
	<name>dk-openoffice</name>
	<name>el-openoffice</name>
	<name>es-openoffice</name>
	<name>et-openoffice</name>
	<name>fi-openoffice</name>
	<name>fr-openoffice</name>
	<name>gr-openoffice</name>
	<name>hu-openoffice</name>
	<name>it-openoffice</name>
	<name>ja-openoffice</name>
	<name>ko-openoffice</name>
	<name>nl-openoffice</name>
	<name>pl-openoffice</name>
	<name>pt-openoffice</name>
	<name>pt_BR-openoffice</name>
	<name>ru-openoffice</name>
	<name>se-openoffice</name>
	<name>sk-openoffice</name>
	<name>sl-openoffice-SI</name>
	<name>tr-openoffice</name>
	<name>zh-openoffice-CN</name>
	<name>zh-openoffice-TW</name>
	<!-- Deprecated names -->
	<name>jp-openoffice</name>
	<name>kr-openoffice</name>
	<name>sl-openoffice-SL</name>
	<name>zh-openoffice</name>
	<name>zh_TW-openoffice</name>
	<range><lt>1.1.4_2</lt></range>
	<range><gt>2.*</gt><le>2.0.20050406</le></range>
      </package>
      <package>
	<name>openoffice</name>
	<name>ja-openoffice</name>
	<range><ge>6.0.a609</ge><le>6.0.a638</le></range>
	<range><ge>641c</ge><le>645</le></range>
	<range><eq>1.1RC4</eq></range>
	<range><eq>1.1rc5</eq></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>AD-LAB reports that a heap-based buffer overflow
	  vulnerability exists in OpenOffice's handling of DOC
	  documents.  When reading a DOC document 16 bit from a 32 bit
	  integer is used for memory allocation, but the full 32 bit
	  is used for further processing of the document.  This can
	  allow an attacker to crash OpenOffice, or potentially
	  execute arbitrary code as the user running OpenOffice, by
	  tricking an user into opening a specially crafted DOC
	  document.</p>
      </body>
    </description>
    <references>
      <bid>13092</bid>
      <cvename>CAN-2005-0941</cvename>
      <mlist msgid="20050412000438.17342.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=111325305109137</mlist>
      <url>http://www.openoffice.org/issues/show_bug.cgi?id=46388</url>
    </references>
    <dates>
      <discovery>2005-04-11</discovery>
      <entry>2005-04-13</entry>
      <modified>2005-04-20</modified>
    </dates>
  </vuln>

  <vuln vid="22f00553-a09d-11d9-a788-0001020eed82">
    <topic>portupgrade -- insecure temporary file handling
      vulnerability</topic>
    <affects>
      <package>
	<name>portupgrade</name>
	<range><lt>20041226_2</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Simon L. Nielsen discovered that portupgrade handles
	  temporary files in an insecure manner.  This could allow an
	  unprivileged local attacker to execute arbitrary commands or
	  overwrite arbitrary files with the permissions of the user
	  running portupgrade, typically root, by way of a symlink
	  attack.</p>
	<p>The following issues exist where the temporary files are
	  created, by default in the world writeable directory
	  /var/tmp, with the permissions of the user running
	  portupgrade:</p>
	<ul>
	  <li>pkg_fetch download packages with a predictable local
	    filename allowing a local attacker to overwrite arbitrary
	    local files or potentially replace the downloaded package
	    after download but before install with a package with
	    malicious content, allowing the attacker to run arbitrary
	    commands.</li>
	  <li>portupgrade will, when upgrading ports/packages, write
	    the old package to a predictable temporary file, allowing
	    an attacker to overwrite arbitrary files via a symlink
	    attack.</li>
	  <li>portupgrade will <q>touch</q> a temporary temporary file
	    with a constant filename (pkgdb.fixme) allowing an
	    attacker to create arbitrary zero-byte files via a symlink
	    attack.</li>
	</ul>
	<p>A workaround for these issues is to set the
	  <code>PKG_TMPDIR</code> environment variable to a directory
	  only write-able by the user running portupgrade.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2005-0610</cvename>
    </references>
    <dates>
      <discovery>2005-04-12</discovery>
      <entry>2005-04-12</entry>
    </dates>
  </vuln>

  <vuln vid="ecf68408-a9f5-11d9-a788-0001020eed82">
    <topic>gaim -- jabber remote crash</topic>
    <affects>
      <package>
	<name>gaim</name>
	<name>ja-gaim</name>
	<name>ko-gaim</name>
	<name>ru-gaim</name>
	<range><lt>1.2.1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The GAIM team reports:</p>
	<blockquote cite="http://gaim.sourceforge.net/security/?id=15">
	  <p>A remote jabber user can cause Gaim to crash by sending a
	    specific file transfer request.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <bid>13004</bid>
      <cvename>CAN-2005-0967</cvename>
      <url>http://gaim.sourceforge.net/security/?id=15</url>
    </references>
    <dates>
      <discovery>2005-04-04</discovery>
      <entry>2005-04-10</entry>
    </dates>
  </vuln>

  <vuln vid="ec09baa3-a9f5-11d9-a788-0001020eed82">
    <topic>gaim -- remote DoS on receiving certain messages over IRC</topic>
    <affects>
      <package>
	<name>gaim</name>
	<name>ja-gaim</name>
	<name>ko-gaim</name>
	<name>ru-gaim</name>
	<range><lt>1.2.1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The GAIM team reports:</p>
	<blockquote cite="http://gaim.sourceforge.net/security/?id=14">
	  <p>The IRC protocol plugin in Gaim 1.2.0, and possibly
	    earlier versions, allows (1) remote attackers to inject
	    arbitrary Gaim markup via irc_msg_kick, irc_msg_mode,
	    irc_msg_part, irc_msg_quit, (2) remote attackers to inject
	    arbitrary Pango markup and pop up empty dialog boxes via
	    irc_msg_invite, or (3) malicious IRC servers to cause a
	    denial of service (application crash) by injecting certain
	    Pango markup into irc_msg_badmode, irc_msg_banned,
	    irc_msg_unknown, irc_msg_nochan functions.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <bid>13003</bid>
      <cvename>CAN-2005-0966</cvename>
      <url>http://gaim.sourceforge.net/security/?id=14</url>
    </references>
    <dates>
      <discovery>2005-04-02</discovery>
      <entry>2005-04-10</entry>
    </dates>
  </vuln>

  <vuln vid="3fa2b372-a9f5-11d9-a788-0001020eed82">
    <topic>gaim -- remote DoS on receiving malformed HTML</topic>
    <affects>
      <package>
	<name>gaim</name>
	<name>ja-gaim</name>
	<name>ko-gaim</name>
	<name>ru-gaim</name>
	<range><lt>1.2.1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The GAIM team reports:</p>
	<blockquote cite="http://gaim.sourceforge.net/security/?id=13">
	  <p>The gaim_markup_strip_html function in Gaim 1.2.0, and
	    possibly earlier versions, allows remote attackers to
	    cause a denial of service (application crash) via a string
	    that contains malformed HTML, which causes an
	    out-of-bounds read.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <bid>12999</bid>
      <cvename>CAN-2005-0965</cvename>
      <url>http://gaim.sourceforge.net/security/?id=13</url>
    </references>
    <dates>
      <discovery>2005-04-02</discovery>
      <entry>2005-04-10</entry>
    </dates>
  </vuln>

  <vuln vid="07f3fe15-a9de-11d9-a788-0001020eed82">
    <topic>php -- readfile() DoS vulnerability</topic>
    <affects>
      <package>
	<name>mod_php4-twig</name>
	<name>php4-cgi</name>
	<name>php4-cli</name>
	<name>php4-dtc</name>
	<name>php4-horde</name>
	<name>php4-nms</name>
	<name>php4</name>
	<range><lt>4.3.5_7</lt></range>
      </package>
      <package>
	<name>mod_php</name>
	<name>mod_php4</name>
	<range><lt>4.3.5_7,1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A SUSE Security advisory reports:</p>
	<blockquote cite="http://www.novell.com/linux/security/advisories/2005_06_sr.html">
	  <p>A bug in the readfile() function of php4 could be used to
	    to crash the httpd running the php4 code when accessing
	    files with a multiple of the architectures page size
	    leading to a denial of service.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <bid>12665</bid>
      <cvename>CAN-2005-0596</cvename>
      <url>http://bugs.php.net/bug.php?id=27037</url>
      <url>http://www.novell.com/linux/security/advisories/2005_06_sr.html</url>
    </references>
    <dates>
      <discovery>2004-01-25</discovery>
      <entry>2005-04-10</entry>
    </dates>
  </vuln>

  <vuln vid="8dbf7894-a9a8-11d9-a788-0001020eed82">
    <topic>squid -- DoS on failed PUT/POST requests vulnerability</topic>
    <affects>
      <package>
	<name>squid</name>
	<range><le>2.5.7_12</le></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The squid patches page notes:</p>
	<blockquote cite="http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-post">
	  <p>An inconsistent state is entered on a failed PUT/POST
	    request making a high risk for segmentation faults or
	    other strange errors</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CAN-2005-0718</cvename>
      <url>http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-post</url>
      <url>http://www.squid-cache.org/bugs/show_bug.cgi?id=1224</url>
    </references>
    <dates>
      <discovery>2005-02-03</discovery>
      <entry>2005-04-10</entry>
    </dates>
  </vuln>

  <vuln vid="396ee517-a607-11d9-ac72-000bdb1444a4">
    <topic>horde -- Horde Page Title Cross-Site Scripting Vulnerability</topic>
    <affects>
      <package>
	<name>horde</name>
	<name>horde-php5</name>
	<range><gt>3.*</gt><lt>3.0.4</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia Advisory: SA14730</p>
	<blockquote cite="http://secunia.com/advisories/14730">
	  <p>A vulnerability has been reported in Horde, which can be
	     exploited by malicious people to conduct cross-site scripting
	     attacks.</p>
	  <p>Input passed when setting the parent frame's page title via
	     JavaScript is not properly sanitised before being returned to
	     the user. This can be exploited to execute arbitrary HTML and
	     script code in a user's browser session in context of an affected
	     site.</p>
	  <p>The vulnerability has been reported in version 3.0.4-RC2. Prior
	     versions may also be affected.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CAN-2005-0961</cvename>
      <mlist msgid="20050329111028.6A112117243@neo.wg.de">http://lists.horde.org/archives/announce/2005/000176.html</mlist>
      <url>http://cvs.horde.org/diff.php/horde/docs/CHANGES?r1=1.515.2.49&amp;r2=1.515.2.93&amp;ty=h</url>
    </references>
    <dates>
      <discovery>2005-03-29</discovery>
      <entry>2005-04-05</entry>
    </dates>
  </vuln>

  <vuln vid="ef410571-a541-11d9-a788-0001020eed82">
    <topic>wu-ftpd -- remote globbing DoS vulnerability</topic>
    <affects>
      <package>
	<name>wu-ftpd</name>
	<range><lt>2.6.2_6</lt></range>
      </package>
      <package>
	<name>wu-ftpd+ipv6</name>
	<range><lt>2.6.2_7</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>An iDEFENSE Security Advisory reports:</p>
	<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110935886414939">
	  <p>Remote exploitation of an input validation vulnerability
	    in version 2.6.2 of WU-FPTD could allow for a denial of
	    service of the system by resource exhaustion.</p>
	  <p>The vulnerability specifically exists in the
	    <code>wu_fnmatch()</code> function in wu_fnmatch.c. When a
	    pattern containing a '*' character is supplied as input,
	    the function calls itself recursively on a smaller
	    substring. By supplying a string which contains a large
	    number of '*' characters, the system will take a long time
	    to return the results, during which time it will be using
	    a large amount of CPU time.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CAN-2005-0256</cvename>
      <mlist msgid="FB24803D1DF2A34FA59FC157B77C970503E249AF@idserv04.idef.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110935886414939</mlist>
    </references>
    <dates>
      <discovery>2005-02-05</discovery>
      <entry>2005-04-04</entry>
    </dates>
  </vuln>

  <vuln vid="5ebfe901-a3cb-11d9-b248-000854d03344">
    <topic>hashcash -- format string vulnerability</topic>
    <affects>
      <package>
	<name>hashcash</name>
	<range><lt>1.17</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A Gentoo Linux Security Advisory reports:</p>
	<blockquote cite="http://www.gentoo.org/security/en/glsa/glsa-200503-12.xml">
	  <p>Tavis Ormandy of the Gentoo Linux Security Audit Team
	    identified a flaw in the Hashcash utility that an attacker
	    could expose by specifying a malformed reply address.</p>
	  <p>Successful exploitation would permit an attacker to disrupt
	    Hashcash users, and potentially execute arbitrary code.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CAN-2005-0687</cvename>
      <url>http://www.gentoo.org/security/en/glsa/glsa-200503-12.xml</url>
    </references>
    <dates>
      <discovery>2005-03-06</discovery>
      <entry>2005-04-02</entry>
      <modified>2005-04-03</modified>
    </dates>
  </vuln>

  <vuln vid="70b62f5e-9e2e-11d9-a256-0001020eed82">
    <topic>clamav -- zip handling DoS vulnerability</topic>
    <affects>
      <package>
	<name>clamav</name>
	<range><lt>0.81</lt></range>
      </package>
      <package>
	<name>clamav-devel</name>
	<range><lt>20050408</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The clamav daemon is vulnerable to a DoS vulnerability due
	  to insufficient handling of malformed zip files which can
	  crash the clamav daemon.</p>
      </body>
    </description>
    <references>
      <bid>12408</bid>
      <cvename>CAN-2005-0133</cvename>
      <url>http://sourceforge.net/project/shownotes.php?release_id=300116</url>
    </references>
    <dates>
      <discovery>2005-01-27</discovery>
      <entry>2005-03-26</entry>
      <modified>2005-04-09</modified>
    </dates>
  </vuln>

  <vuln vid="48a59c96-9c6e-11d9-a040-000a95bc6fae">
    <topic>wine -- information disclosure due to insecure temporary
      file handling</topic>
    <affects>
      <package>
	<name>wine</name>
	<range><lt>20050310</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Due to insecure temporary file creation in the Wine Windows
	  emulator, it is possible for any user to read potentially
	  sensitive information from temporary registry files.</p>
	<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=111082537009842">
	  <p>When a Win32 application is launched by wine, wine makes
	    a dump of the Windows registry in /tmp with name
	    regxxxxyyyy.tmp , where xxxxxx is the pid in hexadecimal
	    value of the current wine process and yyyy is an integer
	    value usually equal to zero.</p>
	  <p>regxxxxyyyy.tmp is created with 0644 (-rw-r--r--)
	    permissions.  This could represent a security problem in a
	    multi-user environment.  Indeed, any local user could
	    access to windows regstry's dump and get sensitive
	    information, like passwords and other private data.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CAN-2005-0787</cvename>
      <mlist msgid="20050314135701.30231.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=111082537009842</mlist>
      <url>http://bugs.winehq.org/show_bug.cgi?id=2715</url>
      <url>http://www.securitytracker.com/alerts/2005/Mar/1013428.html</url>
      <url>http://www.zone-h.org/advisories/read/id=7300</url>
      <url>http://www.securityfocus.com/bid/12791</url>
      <url>http://xforce.iss.net/xforce/xfdb/19697</url>
    </references>
    <dates>
      <discovery>2005-03-13</discovery>
      <entry>2005-03-24</entry>
    </dates>
  </vuln>

  <vuln vid="741f8841-9c6b-11d9-9dbe-000a95bc6fae">
    <topic>firefox -- arbitrary code execution from sidebar panel</topic>
    <affects>
      <package>
	<name>firefox</name>
	<range><lt>1.0.2,1</lt></range>
      </package>
      <package>
	<name>linux-firefox</name>
	<range><lt>1.0.2</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A Mozilla Foundation Security Advisory states:</p>
	<blockquote cite="http://www.mozilla.org/security/announce/mfsa2005-31.html">
	  <p>If a user bookmarked a malicious page as a Firefox
	    sidebar panel that page could execute arbitrary programs
	    by opening a privileged page and injecting javascript into
	    it.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CAN-2005-0402</cvename>
      <url>http://www.mozilla.org/security/announce/mfsa2005-31.html</url>
    </references>
    <dates>
      <discovery>2005-03-03</discovery>
      <entry>2005-03-24</entry>
    </dates>
  </vuln>

  <vuln vid="7d2aac52-9c6b-11d9-99a7-000a95bc6fae">
    <topic>mozilla -- heap buffer overflow in GIF image processing</topic>
    <affects>
      <package>
        <name>firefox</name>
        <range><lt>1.0.2,1</lt></range>
      </package>
      <package>
	<name>thunderbird</name>
        <name>linux-firefox</name>
        <range><lt>1.0.2</lt></range>
      </package>
      <package>
        <name>mozilla</name>
        <range><lt>1.7.6,2</lt></range>
	<range><ge>1.8.*,2</ge></range>
      </package>
      <package>
        <name>linux-mozilla</name>
        <name>linux-mozilla-devel</name>
        <range><lt>1.7.6</lt></range>
	<range><ge>1.8.*</ge></range>
      </package>
      <package>
	<name>netscape7</name>
	<range><ge>0</ge></range>
      </package>
      <package>
	<!-- These ports are obsolete. -->
        <name>de-linux-mozillafirebird</name>
	<name>el-linux-mozillafirebird</name>
        <name>ja-linux-mozillafirebird-gtk1</name>
        <name>ja-mozillafirebird-gtk2</name>
        <name>linux-mozillafirebird</name>
        <name>ru-linux-mozillafirebird</name>
        <name>zhCN-linux-mozillafirebird</name>
        <name>zhTW-linux-mozillafirebird</name>
	<range><ge>0</ge></range>
      </package>
      <package>
	<!-- These package names are obsolete. -->
        <name>de-linux-netscape</name>
        <name>de-netscape7</name>
        <name>fr-linux-netscape</name>
        <name>fr-netscape7</name>
        <name>ja-linux-netscape</name>
        <name>ja-netscape7</name>
        <name>linux-netscape</name>
        <name>linux-phoenix</name>
        <name>mozilla+ipv6</name>
        <name>mozilla-embedded</name>
        <name>mozilla-firebird</name>
        <name>mozilla-gtk1</name>
        <name>mozilla-gtk2</name>
        <name>mozilla-gtk</name>
        <name>mozilla-thunderbird</name>
        <name>phoenix</name>
        <name>pt_BR-netscape7</name>
	<range><ge>0</ge></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A Mozilla Foundation Security Advisory states:</p>
	<blockquote cite="http://www.mozilla.org/security/announce/mfsa2005-31.html">
	  <p>An <em>(sic)</em> GIF processing error when parsing the
	    obsolete Netscape extension 2 can lead to an exploitable
	    heap overrun, allowing an attacker to run arbitrary code on
	    the user's machine.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CAN-2005-0399</cvename>
      <url>http://www.mozilla.org/security/announce/mfsa2005-30.html</url>
      <url>http://xforce.iss.net/xforce/alerts/id/191</url>
      <url>https://bugzilla.mozilla.org/show_bug.cgi?id=285595</url>
    </references>
    <dates>
      <discovery>2005-03-10</discovery>
      <entry>2005-03-24</entry>
    </dates>
  </vuln>

  <vuln vid="f8536143-9bc4-11d9-b8b3-000a95bc6fae">
    <topic>sylpheed -- buffer overflow in header processing</topic>
    <affects>
      <package>
	<name>sylpheed</name>
	<name>sylpheed-claws</name>
	<name>sylpheed-gtk2</name>
	<range><ge>0.8.*</ge><lt>1.0.3</lt></range>
	<range><ge>1.9.*</ge><lt>1.9.5</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Sylpheed web site states:</p>
	<blockquote cite="http://sylpheed.good-day.net/index.cgi.en#changes">
	  <p>A buffer overflow which occurred when replying to a
	  message with certain headers which contain non-ascii
	  characters was fixed.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CAN-2005-0667</cvename>
      <url>http://sylpheed.good-day.net/index.cgi.en#changes</url>
    </references>
    <dates>
      <discovery>2005-03-07</discovery>
      <entry>2005-03-23</entry>
    </dates>
  </vuln>

  <vuln vid="a4bd3039-9a48-11d9-a256-0001020eed82">
    <topic>xv -- filename handling format string vulnerability</topic>
    <affects>
      <package>
	<name>xv</name>
	<name>ja-xv</name>
	<range><lt>3.10a_5</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A Gentoo Linux Security Advisory reports:</p>
	<blockquote cite="http://www.gentoo.org/security/en/glsa/glsa-200503-09.xml">
	  <p>Tavis Ormandy of the Gentoo Linux Security Audit Team
	    identified a flaw in the handling of image filenames by xv.</p>
	  <p>Successful exploitation would require a victim to process
	    a specially crafted image with a malformed filename,
	    potentially resulting in the execution of arbitrary code.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CAN-2005-0665</cvename>
      <url>http://www.gentoo.org/security/en/glsa/glsa-200503-09.xml</url>
    </references>
    <dates>
      <discovery>2005-03-01</discovery>
      <entry>2005-03-21</entry>
    </dates>
  </vuln>

  <vuln vid="972697a7-9a42-11d9-a256-0001020eed82">
    <topic>kdelibs -- local DCOP denial of service vulnerability</topic>
    <affects>
      <package>
	<name>ja-kdelibs</name>
	<name>kdelibs-nocups</name>
	<name>kdelibs</name>
	<range><lt>3.4.0</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A KDE Security Advisory reports:</p>
	<blockquote cite="http://www.kde.org/info/security/advisory-20050316-1.txt">
	  <p>Sebastian Krahmer of the SUSE LINUX Security Team
	    reported a local denial of service vulnerability in KDE's
	    Desktop Communication Protocol (DCOP) daemon better known
	    as dcopserver.</p>
	  <p>A local user can lock up the dcopserver of arbitrary
	    other users on the same machine. This can cause a
	    significant reduction in desktop functionality for the
	    affected users including, but not limited to, the
	    inability to browse the internet and the inability to
	    start new applications.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CAN-2005-0396</cvename>
      <url>http://www.kde.org/info/security/advisory-20050316-1.txt</url>
    </references>
    <dates>
      <discovery>2005-03-16</discovery>
      <entry>2005-03-21</entry>
    </dates>
  </vuln>

  <vuln vid="6192ae3d-9595-11d9-a9e0-0001020eed82">
    <topic>phpmyadmin -- increased privilege vulnerability</topic>
    <affects>
      <package>
	<name>phpmyadmin</name>
	<name>phpMyAdmin</name>
	<range><lt>2.6.1.3</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The phpMyAdmin team reports:</p>
	<blockquote cite="http://sourceforge.net/forum/forum.php?forum_id=450948">
	  <p>Escaping of the "_" character was not properly done,
	    giving a wildcard privilege when editing db-specific
	    privileges with phpMyAdmin.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CAN-2005-0653</cvename>
      <url>http://sourceforge.net/forum/forum.php?forum_id=450948</url>
      <url>http://sourceforge.net/tracker/index.php?func=detail&amp;aid=1113788&amp;group_id=23067&amp;atid=377408</url>
    </references>
    <dates>
      <discovery>2005-02-01</discovery>
      <entry>2005-03-15</entry>
    </dates>
  </vuln>

  <vuln vid="cb470368-94d2-11d9-a9e0-0001020eed82">
    <topic>ethereal -- multiple protocol dissectors vulnerabilities</topic>
    <affects>
      <package>
	<name>ethereal</name>
	<name>ethereal-lite</name>
	<name>tethereal</name>
	<name>tethereal-lite</name>
	<range><ge>0.9.1</ge><lt>0.10.10</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>An Ethreal Security Advisories reports:</p>
	<blockquote cite="http://www.ethereal.com/appnotes/enpa-sa-00018.html">
	  <p>Issues have been discovered in the following protocol
	    dissectors:</p>
	  <ul>
	    <li>Matevz Pustisek discovered a buffer overflow in the
	      Etheric dissector. CVE: CAN-2005-0704</li>
	    <li>The GPRS-LLC dissector could crash if the "ignore
	      cipher bit" option was enabled. CVE: CAN-2005-0705</li>
	    <li>Diego Giago discovered a buffer overflow in the 3GPP2
	      A11 dissector. This flaw was later reported by Leon
	      Juranic. CVE: CAN-2005-0699</li>
	    <li>Leon Juranic discovered a buffer overflow in the IAPP dissector.
	      CVE: CAN-2005-0739</li>
	    <li>A bug in the JXTA dissector could make Ethereal crash.</li>
	    <li>A bug in the sFlow dissector could make Ethereal crash.</li>
	  </ul>
	</blockquote>
      </body>
    </description>
    <references>
      <bid>12759</bid>
      <cvename>CAN-2005-0699</cvename>
      <cvename>CAN-2005-0704</cvename>
      <cvename>CAN-2005-0705</cvename>
      <cvename>CAN-2005-0739</cvename>
      <url>http://www.ethereal.com/appnotes/enpa-sa-00018.html</url>
    </references>
    <dates>
      <discovery>2005-03-09</discovery>
      <entry>2005-03-14</entry>
      <modified>2005-06-24</modified>
    </dates>
  </vuln>

  <vuln vid="bcf27002-94c3-11d9-a9e0-0001020eed82">
    <topic>grip -- CDDB response multiple matches buffer overflow
      vulnerability</topic>
    <affects>
      <package>
	<name>grip</name>
	<range><lt>3.2.0_7</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Joseph VanAndel reports that grip is vulnerability to a
	  buffer overflow vulnerability when receiving more than 16
	  CDDB responses.  This could lead to a crash in grip and
	  potentially execution arbitrary code.</p>
	<p>A workaround is to disable CDDB lookups.</p>
      </body>
    </description>
    <references>
      <bid>12770</bid>
      <cvename>CAN-2005-0706</cvename>
      <url>http://sourceforge.net/tracker/index.php?func=detail&amp;aid=834724&amp;group_id=3714&amp;atid=103714</url>
    </references>
    <dates>
      <discovery>2003-11-02</discovery>
      <entry>2005-03-14</entry>
      <modified>2005-03-18</modified>
    </dates>
  </vuln>

  <vuln vid="619ef337-949a-11d9-b813-00d05964249f">
    <topic>mysql-server -- multiple remote vulnerabilities</topic>
    <affects>
      <package>
	<name>mysql-server</name>
	<range><ge>4.0.0</ge><lt>4.0.24</lt></range>
	<range><ge>4.1.0</ge><lt>4.1.10a</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>SecurityFocus reports:</p>
	<blockquote cite="http://www.securityfocus.com/bid/12781/discussion/">
	  <p>MySQL is reported prone to an insecure temporary file creation
	    vulnerability.</p>
	  <p>Reports indicate that an attacker that has 'CREATE TEMPORARY TABLE'
	    privileges on an affected installation may leverage this
	    vulnerability to corrupt files with the privileges of the MySQL
	    process.</p>
	  <p>MySQL is reported prone to an input validation vulnerability that
	    can be exploited by remote users that have INSERT and DELETE
	    privileges on the 'mysql' administrative database.</p>
	  <p>Reports indicate that this issue may be leveraged to load an
	    execute a malicious library in the context of the MySQL process.</p>
	  <p>Finally, MySQL is reported prone to a remote arbitrary code
	    execution vulnerability. It is reported that the vulnerability may
	    be triggered by employing the 'CREATE FUNCTION' statement to
	    manipulate functions in order to control sensitive data
	    structures.</p>
	  <p>This issue may be exploited to execute arbitrary code in the
	    context of the database process.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <bid>12781</bid>
      <cvename>CAN-2005-0709</cvename>
      <cvename>CAN-2005-0710</cvename>
      <cvename>CAN-2005-0711</cvename>
    </references>
    <dates>
      <discovery>2005-03-11</discovery>
      <entry>2005-03-14</entry>
    </dates>
  </vuln>

  <vuln vid="d4bd4046-93a6-11d9-8378-000bdb1444a4">
    <topic>rxvt-unicode -- buffer overflow vulnerability</topic>
    <affects>
      <package>
	<name>rxvt-unicode</name>
	<range><lt>5.3</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A rxvt-unicode changelog reports:</p>
	<blockquote cite="http://dist.schmorp.de/rxvt-unicode/Changes">
	  <p>Fix a bug that allowed to overflow a buffer via a long
	    escape sequence, which is probably exploitable (fix by
	    Rob Holland / Yoann Vandoorselaere / Gentoo Audit Team).</p>
	</blockquote>
      </body>
    </description>
    <references>
      <url>http://dist.schmorp.de/rxvt-unicode/Changes</url>
    </references>
    <dates>
      <discovery>2005-03-13</discovery>
      <entry>2005-03-13</entry>
    </dates>
  </vuln>

  <vuln vid="a7062952-9023-11d9-a22c-0001020eed82">
    <topic>phpmyadmin -- information disclosure vulnerability</topic>
    <affects>
      <package>
	<name>phpmyadmin</name>
	<name>phpMyAdmin</name>
	<range><lt>2.6.1.2</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A phpMyAdmin security announcement reports:</p>
	<blockquote cite="http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-2">
	  <p>By calling some scripts that are part of phpMyAdmin in an
	    unexpected way (especially scripts in the libraries
	    subdirectory), it is possible to trigger phpMyAdmin to
	    display a PHP error message which contains the full path
	    of the directory where phpMyAdmin is installed.</p>
	  <p><strong>Mitigation factor:</strong> This path disclosure
	    is possible on servers where the recommended setting of
	    the PHP configuration directive
	    <code>display_errors</code> is set to on, which is against
	    the recommendations given in the PHP manual.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CAN-2005-0544</cvename>
      <url>http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-2</url>
    </references>
    <dates>
      <discovery>2005-02-22</discovery>
      <entry>2005-03-08</entry>
    </dates>
  </vuln>

  <vuln vid="882ef43b-901f-11d9-a22c-0001020eed82">
    <topic>phpmyadmin -- arbitrary file include and XSS vulnerabilities</topic>
    <affects>
      <package>
	<name>phpmyadmin</name>
	<name>phpMyAdmin</name>
	<range><gt>1.3.1</gt><lt>2.6.1.2</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A phpMyAdmin security announcement reports:</p>
	<blockquote cite="http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-1">
	  <p>We received two bug reports by Maksymilian Arciemowicz
	    about those vulnerabilities and we wish to thank him for
	    his work.  The vulnerabilities apply to those points:</p>
	  <ol>
	    <li>css/phpmyadmin.css.php was vulnerable against
	      <code>$cfg</code> and <code>GLOBALS</code> variable
	      injections. This way, a possible attacker could
	      manipulate any configuration parameter. Using
	      phpMyAdmin's theming mechanism, he was able to include
	      arbitrary files. This is especially dangerous if php is
	      not running in safe mode.</li>
	    <li>A possible attacker could manipulate phpMyAdmin's
	      localized strings via the URL and inject harmful
	      JavaScript code this way, which could be used for XSS
	      attacks.</li>
	  </ol>
	</blockquote>
      </body>
    </description>
    <references>
      <bid>12644</bid>
      <bid>12645</bid>
      <cvename>CAN-2005-0543</cvename>
      <cvename>CAN-2005-0567</cvename>
      <mlist msgid="20050224190307.20197.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110929725801154</mlist>
      <url>http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-1</url>
    </references>
    <dates>
      <discovery>2005-02-21</discovery>
      <entry>2005-03-08</entry>
    </dates>
  </vuln>

  <vuln vid="624fe633-9006-11d9-a22c-0001020eed82">
    <topic>libexif -- buffer overflow vulnerability</topic>
    <affects>
      <package>
	<name>libexif</name>
	<range><lt>0.6.10_1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Sylvain Defresne reports that libexif is vulnerable to a
	  buffer overflow vulnerability due to insufficient input
	  checking.  This could lead crash of applications using
	  libexif.</p>
      </body>
    </description>
    <references>
      <bid>12744</bid>
      <cvename>CAN-2005-0664</cvename>
      <url>https://bugzilla.ubuntulinux.org/show_bug.cgi?id=7152</url>
    </references>
    <dates>
      <discovery>2005-03-03</discovery>
      <entry>2005-03-08</entry>
    </dates>
  </vuln>

  <vuln vid="4a0b334d-8d8d-11d9-afa0-003048705d5a">
    <topic>phpbb - Insuffient check against HTML code in usercp_register.php</topic>
    <affects>
      <package>
	<name>phpbb</name>
	<range><le>2.0.13</le></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Neo Security Team reports:</p>
	<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110987231502274">
	  <p>If we specify a variable in the html code (any type:
	    hidden, text, radio, check, etc) with the name allowhtml,
	    allowbbcode or allowsmilies, is going to be on the html,
	    bbcode and smilies in our signature.</p>
	</blockquote>
	<p>This is a low risk vulnerability that allows users to bypass
	  forum-wide configuration.</p>
      </body>
    </description>
    <references>
      <mlist msgid="20050303055339.3109.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110987231502274</mlist>
      <mlist msgid="38599.166.68.134.174.1109875231.squirrel@166.68.134.174">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110988400407204</mlist>
    </references>
    <dates>
      <discovery>2005-02-28</discovery>
      <entry>2005-03-05</entry>
      <modified>2005-03-07</modified>
    </dates>
  </vuln>

  <vuln vid="f3eec2b5-8cd8-11d9-8066-000a95bc6fae">
    <topic>postnuke -- SQL injection vulnerabilities</topic>
    <affects>
      <package>
        <name>postnuke</name>
        <range><lt>0.760</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
        <p>Two separate SQL injection vulnerabilites have been
           identified in the PostNuke PHP content management
           system. An attacker can use this vulnerability to
           potentially insert executable PHP code into the content
           management system (to view all files within the PHP scope,
           for instance). Various other SQL injection vulnerabilities
           exist, which give attackers the ability to run SQL queries
           on any tables within the database.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2005-0617</cvename>
      <cvename>CAN-2005-0615</cvename>
      <mlist>http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110962710805864</mlist>
      <mlist>http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110962819232255</mlist>
      <url>http://news.postnuke.com/Article2669.html</url>
    </references>
    <dates>
      <discovery>2005-02-28</discovery>
      <entry>2005-03-04</entry>
    </dates>
  </vuln>

  <vuln vid="7e580822-8cd8-11d9-8c81-000a95bc6fae">
    <topic>postnuke -- cross-site scripting (XSS) vulnerabilities</topic>
    <affects>
      <package>
        <name>postnuke</name>
        <range><lt>0.760</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
        <p>A cross-site scripting vulnerability is present in the
           PostNuke PHP content management system. By passing data
           injected through exploitable errors in input validation, an
           attacker can insert code which will run on the machine of
           anybody viewing the page. It is feasible that this attack
           could be used to retrieve session information from cookies,
           thereby allowing the attacker to gain administrative access
           to the CMS.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2005-0616</cvename>
      <mlist>http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110962768300373</mlist>
      <url>http://news.postnuke.com/Article2669.html</url>
    </references>
    <dates>
      <discovery>2005-02-28</discovery>
      <entry>2005-03-04</entry>
    </dates>
  </vuln>

   <vuln vid="c73305ae-8cd7-11d9-9873-000a95bc6fae">
     <topic>realplayer -- remote heap overflow</topic>
    <affects>
      <package>
        <name>linux-realplayer</name>
        <range><le>10.0.2</le></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
        <p>Two exploits have been identified in the Linux RealPlayer client.
           RealNetworks states:</p>
        <blockquote cite="http://service.real.com/help/faq/security/050224_player/EN/">
	  <p>RealNetworks, Inc. has addressed recently discovered
	     security vulnerabilities that offered the potential for
	     an attacker to run arbitrary or malicious code on a
	     customer's machine. RealNetworks has received no reports
	     of machines compromised as a result of the now-remedied
	     vulnerabilities. RealNetworks takes all security
	     vulnerabilities very seriously.</p>
	  <p>The specific exploits were:</p>
	  <ul>
	    <li><strong>Exploit 1:</strong> To fashion a malicious WAV
	      file to cause a buffer overflow which could have allowed
	      an attacker to execute arbitrary code on a customer's
	      machine.</li>
	    <li><strong>Exploit 2:</strong> To fashion a malicious
	      SMIL file to cause a buffer overflow which could have
	      allowed an attacker to execute arbitrary code on a
	      customer's machine.</li>
	  </ul>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CAN-2005-0611</cvename>
      <mlist>http://marc.theaimsgroup.com/?l=vulnwatch&amp;m=110977858619314</mlist>
      <url>http://service.real.com/help/faq/security/050224_player/EN/</url>
    </references>
    <dates>
      <discovery>2005-03-01</discovery>
      <entry>2005-03-04</entry>
    </dates>
  </vuln>

  <vuln vid="713c3913-8c2b-11d9-b58c-0001020eed82">
    <topic>ImageMagick -- format string vulnerability</topic>
    <affects>
      <package>
	<name>ImageMagick</name>
	<range><lt>6.2.0.3</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Tavis Ormandy reports:</p>
	<blockquote>
	  <p>magemagick-6.2.0-3 fixes an potential issue handling
	    malformed filenames, the flaw may affect webapps or
	    scripts that use the imagemagick utilities for image
	    processing, or applications linked with libMagick.</p>
	</blockquote>
	<p>This vulnerability could crash ImageMagick or potentially
	  lead to the execution of arbitrary code with the permissions
	  of the user running ImageMagick.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2005-0397</cvename>
      <url>http://www.ubuntulinux.org/support/documentation/usn/usn-90-1</url>
    </references>
    <dates>
      <discovery>2005-03-02</discovery>
      <entry>2005-03-03</entry>
    </dates>
  </vuln>

  <vuln vid="fb03b1c6-8a8a-11d9-81f7-02023f003c9f">
    <topic>uim -- privilege escalation vulnerability</topic>
    <affects>
      <package>
	<name>ja-uim</name>
	<range><lt>0.4.6</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The uim developers reports:</p>
	<blockquote cite="http://lists.freedesktop.org/pipermail/uim/2005-February/000996.html">
	  <p>Takumi ASAKI discovered that uim always trusts environment variables. 
             But this is not correct behavior, sometimes environment variables 
             shouldn't be trusted. This bug causes privilege escalation when libuim 
             is linked against setuid/setgid application. Since GTK+ prohibits 
             setuid/setgid applications, the bug appears only in 'immodule for Qt' 
             enabled Qt. (Normal Qt is also safe.)</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CAN-2005-0503</cvename>
      <mlist>http://lists.freedesktop.org/pipermail/uim/2005-February/000996.html</mlist>
      <bid>12604</bid>
      <url>http://secunia.com/advisories/13981</url>
    </references>
    <dates>
      <discovery>2005-02-21</discovery>
      <entry>2005-03-01</entry>
    </dates>
  </vuln>

  <vuln vid="bdad9ada-8a52-11d9-9e53-000a95bc6fae">
    <topic>lighttpd -- script source disclosure vulnerability</topic>
    <affects>
      <package>
        <name>lighttpd</name>
        <range><lt>1.3.8</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
        <p>The lighttpd website reports:</p>
	<blockquote cite="http://article.gmane.org/gmane.comp.web.lighttpd/1171">
          <p>In lighttpd 1.3.7 and below it is possible to fetch the source
            files which should be handled by CGI or FastCGI applications.</p>
        </blockquote>
	<p>The vulnerability is in the handling of urlencoded trailing
	  NUL bytes.  Installations that do not use CGI or FastCGI are
	  not affected.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2005-0453</cvename>
      <mlist>http://article.gmane.org/gmane.comp.web.lighttpd/1171</mlist>
      <url>http://www.lighttpd.net/news/</url>
      <url>http://xforce.iss.net/xforce/xfdb/19350</url>
      <bid>12567</bid>
    </references>
    <dates>
      <discovery>2005-02-12</discovery>
      <entry>2005-03-01</entry>
    </dates>
  </vuln>

  <vuln vid="53e711ed-8972-11d9-9ff8-00306e01dda2">
    <topic>phpbb -- privilege elevation and path disclosure</topic>
    <affects>
      <package>
        <name>phpbb</name>
        <range><lt>2.0.13</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
        <p>The phpbb developer group reports:</p>
        <blockquote cite="http://www.phpbb.com/phpBB/viewtopic.php?t=267563">
          <p>phpBB Group announces the release of phpBB 2.0.13, the
	    "Beware of the furries" edition. This release addresses two
	    recent security exploits, one of them critical. They were
	    reported a few days after .12 was released and no one is
	    more annoyed than us, having to release a new version ini
	    such a short period of time. Fortunately both fixes are
	    easy and in each case just one line needs to be edited.</p>
        </blockquote>
      </body>
    </description>
    <references>
        <url>http://www.phpbb.com/phpBB/viewtopic.php?t=267563</url>
	<bid>12678</bid>
    </references>
    <dates>
      <discovery>2005-02-27</discovery>
      <entry>2005-02-28</entry>
      <modified>2005-03-05</modified>
    </dates>
  </vuln>

  <vuln vid="96df5fd0-8900-11d9-aa18-0001020eed82">
    <topic>curl -- authentication buffer overflow vulnerability</topic>
    <affects>
      <package>
	<name>curl</name>
	<range><lt>7.13.1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Two iDEFENSE Security Advisories reports:</p>
	<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110902601221592">
	  <p>An exploitable stack-based buffer overflow condition
	    exists when using NT Lan Manager (NTLM)
	    authentication. The problem specifically exists within
	    <code>Curl_input_ntlm()</code> defined in
	    lib/http_ntlm.c.</p>
	  <p>Successful exploitation allows remote attackers to
	    execute arbitrary code under the privileges of the target
	    user. Exploitation requires that an attacker either coerce
	    or force a target to connect to a malicious server using
	    NTLM authentication.</p>
	</blockquote>
	<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110902850731457">
	  <p>An exploitable stack-based buffer overflow condition
	    exists when using Kerberos authentication. The problem
	    specifically exists within the functions
	    <code>Curl_krb_kauth()</code> and <code>krb4_auth()</code>
	    defined in lib/krb4.c.</p>
	  <p>Successful exploitation allows remote attackers to
	    execute arbitrary code under the privileges of the target
	    user. Exploitation requires that an attacker either coerce
	    or force a target to connect to a malicious server using
	    Kerberos authentication.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <bid>12615</bid>
      <bid>12616</bid>
      <cvename>CAN-2005-0490</cvename>
      <mlist msgid="FB24803D1DF2A34FA59FC157B77C970503E2462D@idserv04.idef.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110902850731457</mlist>
      <mlist msgid="FB24803D1DF2A34FA59FC157B77C970503E2462E@idserv04.idef.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110902601221592</mlist>
    </references>
    <dates>
      <discovery>2004-12-21</discovery>
      <entry>2005-02-27</entry>
    </dates>
  </vuln>

  <vuln vid="b2d248ad-88f6-11d9-aa18-0001020eed82">
    <topic>cyrus-imapd -- multiple buffer overflow vulnerabilities</topic>
    <affects>
      <package>
	<name>cyrus-imapd</name>
	<range><lt>2.1.18</lt></range>
	<range><gt>2.2.*</gt><lt>2.2.11</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Cyrus IMAP Server ChangeLog states:</p>
	<blockquote cite="http://asg.web.cmu.edu/cyrus/download/imapd/changes.html">
	  <ul>
	    <li>Fix possible single byte overflow in mailbox handling
	      code.</li>
	    <li>Fix possible single byte overflows in the imapd
	      annotate extension.</li>
	    <li>Fix stack buffer overflows in fetchnews (exploitable
	      by peer news server), backend (exploitable by admin),
	      and in imapd (exploitable by users though only on
	      platforms where a filename may be larger than a mailbox
	      name).</li>
	  </ul>
	</blockquote>
	<p>The 2.1.X series are reportedly only affected by the second
	  issue.</p>
	<p>These issues may lead to execution of arbitrary code with
	  the permissions of the user running the Cyrus IMAP
	  Server.</p>
      </body>
    </description>
    <references>
      <bid>12636</bid>
      <cvename>CAN-2005-0546</cvename>
      <url>http://asg.web.cmu.edu/cyrus/download/imapd/changes.html</url>
    </references>
    <dates>
      <discovery>2005-02-14</discovery>
      <entry>2005-02-27</entry>
      <modified>2005-04-05</modified>
    </dates>
  </vuln>

  <vuln vid="2c5757f4-88bf-11d9-8720-0007e900f87b">
    <topic>sup -- format string vulnerability</topic>
    <affects>
      <package>
	<name>sup</name>
	<range><lt>2.0.20050226</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Debian Security Advisory reports:</p>
	<blockquote cite="http://www.securityfocus.com/advisories/6874">
	  <p>jaguar@felinemenace.org discovered a format string
	    vulnerability in sup, a set of programs to synchronize
	    collections of files across a number of machines,
	    whereby a remote attacker could potentially cause
	    arbitrary code to be executed with the privileges
	    of the supfilesrv process (this process does not run
	    automatically by default). </p>
	</blockquote>
      </body>
    </description>
    <references>
      <bid>10571</bid>
      <cvename>CAN-2004-0451</cvename>
      <url>http://www.securityfocus.com/advisories/6874</url>
    </references>
    <dates>
      <discovery>2004-06-19</discovery>
      <entry>2005-02-27</entry>
    </dates>
  </vuln>

  <vuln vid="d022754d-8839-11d9-aa18-0001020eed82">
    <topic>mozilla -- insecure temporary directory vulnerability</topic>
    <affects>
      <package>
        <name>firefox</name>
        <range><lt>1.0.1,1</lt></range>
      </package>
      <package>
        <name>mozilla</name>
        <range><lt>1.7.6,2</lt></range>
      </package>
      <package>
        <name>linux-mozilla</name>
        <name>linux-mozilla-devel</name>
        <range><lt>1.7.6</lt></range>
      </package>
      <package>
	<name>netscape7</name>
	<range><ge>0</ge></range>
      </package>
      <package>
	<!-- These ports are obsolete. -->
        <name>de-linux-mozillafirebird</name>
	<name>el-linux-mozillafirebird</name>
        <name>ja-linux-mozillafirebird-gtk1</name>
        <name>ja-mozillafirebird-gtk2</name>
        <name>linux-mozillafirebird</name>
        <name>ru-linux-mozillafirebird</name>
        <name>zhCN-linux-mozillafirebird</name>
        <name>zhTW-linux-mozillafirebird</name>
	<range><ge>0</ge></range>
      </package>
      <package>
	<!-- These package names are obsolete. -->
        <name>de-linux-netscape</name>
        <name>de-netscape7</name>
        <name>fr-linux-netscape</name>
        <name>fr-netscape7</name>
        <name>ja-linux-netscape</name>
        <name>ja-netscape7</name>
        <name>linux-netscape</name>
        <name>linux-phoenix</name>
        <name>mozilla+ipv6</name>
        <name>mozilla-embedded</name>
        <name>mozilla-firebird</name>
        <name>mozilla-gtk1</name>
        <name>mozilla-gtk2</name>
        <name>mozilla-gtk</name>
        <name>mozilla-thunderbird</name>
        <name>phoenix</name>
        <name>pt_BR-netscape7</name>
	<range><ge>0</ge></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A Mozilla Foundation Security Advisory reports:</p>
	<blockquote cite="http://www.mozilla.org/security/announce/mfsa2005-28.html">
	  <p>A predictable name is used for the plugin temporary
	    directory. A malicious local user could symlink this to
	    the victim's home directory and wait for the victim to run
	    Firefox. When Firefox shuts down the victim's directory
	    would be erased.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <url>http://www.mozilla.org/security/announce/mfsa2005-28.html</url>
      <url>https://bugzilla.mozilla.org/show_bug.cgi?id=281284</url>
    </references>
    <dates>
      <discovery>2005-02-06</discovery>
      <entry>2005-02-26</entry>
    </dates>
  </vuln>

  <vuln vid="cbfde1cd-87eb-11d9-aa18-0001020eed82">
    <topic>mozilla -- arbitrary code execution vulnerability</topic>
    <affects>
      <package>
        <name>firefox</name>
        <range><lt>1.0.1,1</lt></range>
      </package>
      <package>
        <name>mozilla</name>
        <range><lt>1.7.6,2</lt></range>
      </package>
      <package>
        <name>linux-mozilla</name>
        <name>linux-mozilla-devel</name>
        <range><lt>1.7.6</lt></range>
      </package>
      <package>
	<name>netscape7</name>
	<range><ge>0</ge></range>
      </package>
      <package>
	<!-- These ports are obsolete. -->
        <name>de-linux-mozillafirebird</name>
	<name>el-linux-mozillafirebird</name>
        <name>ja-linux-mozillafirebird-gtk1</name>
        <name>ja-mozillafirebird-gtk2</name>
        <name>linux-mozillafirebird</name>
        <name>ru-linux-mozillafirebird</name>
        <name>zhCN-linux-mozillafirebird</name>
        <name>zhTW-linux-mozillafirebird</name>
	<range><ge>0</ge></range>
      </package>
      <package>
	<!-- These package names are obsolete. -->
        <name>de-linux-netscape</name>
        <name>de-netscape7</name>
        <name>fr-linux-netscape</name>
        <name>fr-netscape7</name>
        <name>ja-linux-netscape</name>
        <name>ja-netscape7</name>
        <name>linux-netscape</name>
        <name>linux-phoenix</name>
        <name>mozilla+ipv6</name>
        <name>mozilla-embedded</name>
        <name>mozilla-firebird</name>
        <name>mozilla-gtk1</name>
        <name>mozilla-gtk2</name>
        <name>mozilla-gtk</name>
        <name>mozilla-thunderbird</name>
        <name>phoenix</name>
        <name>pt_BR-netscape7</name>
	<range><ge>0</ge></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A Mozilla Foundation Security Advisory reports:</p>
	<blockquote cite="http://www.mozilla.org/security/announce/mfsa2005-27.html">
	  <p>Plugins (such as flash) can be used to load privileged
	    content into a frame. Once loaded various spoofs can be
	    applied to get the user to interact with the privileged
	    content. Michael Krax's "Fireflashing" example
	    demonstrates that an attacker can open about:config in a
	    frame, hide it with an opacity setting, and if the
	    attacker can get the victim to click at a particular spot
	    (design some kind of simple game) you could toggle boolean
	    preferences, some of which would make further attacks
	    easier.</p>
	  <p>The "firescrolling" example demonstrates arbitrary code
	    execution (in this case downloading a file) by convincing
	    the user to scroll twice.</p>
	</blockquote>
	<p><strong>Workaround:</strong> Disable JavaScript.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2005-0527</cvename>
      <url>http://www.mikx.de/fireflashing/</url>
      <url>http://www.mikx.de/firescrolling/</url>
      <url>http://www.mozilla.org/security/announce/mfsa2005-27.html</url>
    </references>
    <dates>
      <discovery>2005-02-24</discovery>
      <entry>2005-02-26</entry>
    </dates>
  </vuln>

  <vuln vid="32d4f0f1-85c3-11d9-b6dc-0007e900f747">
    <topic>mkbold-mkitalic -- format string vulnerability</topic>
    <affects>
      <package>
	<name>mkbold-mkitalic</name>
	<range><lt>0.07</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The version 0.06_1 and prior
	  have a format string vulnerability which can be triggered
	  by using a carefully-crafted BDF font file.</p>
      </body>
    </description>
    <references>
      <url>http://home.jp.FreeBSD.org/cgi-bin/showmail/ports-jp/15568</url>
    </references>
    <dates>
      <discovery>2005-02-23</discovery>
      <entry>2005-02-24</entry>
    </dates>
  </vuln>

  <vuln vid="03653079-8594-11d9-afa0-003048705d5a">
    <topic>phpbb -- multiple information disclosure vulnerabilities</topic>
    <affects>
      <package>
	<name>phpbb</name>
	<range><lt>2.0.12</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>psoTFX reports:</p>
	<blockquote cite="http://www.phpbb.com/phpBB/viewtopic.php?f=14&amp;t=265423">
	  <p>phpBB Group are pleased to announce the release of phpBB
	    2.0.12 the "Horray for Furrywood" release. This release
	    addresses a number of bugs and a couple of potential
	    exploits.  [...] one of the potential exploits addressed
	    in this release could be serious in certain situations and
	    thus we urge all users, as always, to upgrade to this
	    release as soon as possible. Mostly this release is
	    concerned with eliminating disclosures of information
	    which while useful in debug situations may allow third
	    parties to gain information which could be used to do harm
	    via unknown or unfixed exploits in this or other
	    applications.</p>
	</blockquote>
	<p>The ChangeLog for phpBB 2.0.12 states:</p>
	<blockquote cite="http://www.phpbb.com/support/documents.php?mode=changelog">
	  <ul>
	    <li>Prevented full path display on critical messages</li>
	    <li>Fixed full path disclosure in username handling caused
	      by a PHP 4.3.10 bug - <strong>AnthraX101</strong></li>
	    <li>Added exclude list to unsetting globals (if
	      register_globals is on) -
	      <strong>SpoofedExistence</strong></li>
	    <li>Fixed arbitrary file disclosure vulnerability in avatar
	      handling functions - <strong>AnthraX101</strong></li>
	    <li>Fixed arbitrary file unlink vulnerability in avatar
	      handling functions - <strong>AnthraX101</strong></li>
	    <li>Fixed path disclosure bug in search.php caused by a
	      PHP 4.3.10 bug (related to AnthraX101's discovery)</li>
	    <li>Fixed path disclosure bug in viewtopic.php caused by
	      a PHP 4.3.10 bug - <strong>matrix_killer</strong></li>
	  </ul>
	</blockquote>
      </body>
    </description>
    <references>
      <url>http://www.phpbb.com/support/documents.php?mode=changelog</url>
      <url>http://www.phpbb.com/phpBB/viewtopic.php?f=14&amp;t=265423</url>
      <freebsdpr>ports/77943</freebsdpr>
    </references>
    <dates>
      <discovery>2005-02-22</discovery>
      <entry>2005-02-23</entry>
      <modified>2005-02-25</modified>
    </dates>
  </vuln>

  <vuln vid="1d3a2737-7eb7-11d9-acf7-000854d03344">
    <topic>unace -- multiple vulnerabilities</topic>
    <affects>
      <package>
	<name>unace</name>
	<range><lt>unace-1.2b_2</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Ulf Härnhammar reports multiple security vulnerabilities
	  in unace-1.2b:</p>
	<ul>
	  <li>There are buffer overflows when extracting, testing or
	    listing specially prepared ACE archives.</li>
	  <li>There are directory traversal bugs when extracting ACE
	    archives.</li>
	  <li>There are also buffer overflows when dealing with long
	    (>17000 characters) command line arguments.</li>
	</ul>
      </body>
    </description>
    <references>
      <cvename>CAN-2005-0160</cvename>
      <cvename>CAN-2005-0161</cvename>
    </references>
    <dates>
      <discovery>2005-02-14</discovery>
      <entry>2005-02-22</entry>
    </dates>
  </vuln>

  <vuln vid="a413ed94-836e-11d9-a9e7-0001020eed82">
    <topic>putty -- pscp/psftp heap corruption vulnerabilities</topic>
    <affects>
      <package>
	<name>putty</name>
	<range><lt>0.57</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Simon Tatham reports:</p>
	<blockquote cite="http://lists.tartarus.org/pipermail/putty-announce/2005/000012.html">
	  <p>This version fixes a security hole in previous versions
            of PuTTY, which can allow a malicious SFTP server to
            attack your client. If you use either PSCP or PSFTP, you
            should upgrade. Users of the main PuTTY program are not
            affected. (However, note that the server must have passed
            host key verification before this attack can be launched,
            so a man-in-the-middle shouldn't be able to attack you if
            you're careful.)</p>
	</blockquote>
      </body>
    </description>
    <references>
      <bid>12601</bid>
      <cvename>CAN-2005-0467</cvename>
      <mlist msgid="E1D2taM-0005R1-00@ixion.tartarus.org">http://lists.tartarus.org/pipermail/putty-announce/2005/000012.html</mlist>
      <mlist msgid="FB24803D1DF2A34FA59FC157B77C970503E2462F@idserv04.idef.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110902510713763</mlist>
      <url>http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-sftp-readdir.html</url>
      <url>http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-sftp-string.html</url>
    </references>
    <dates>
      <discovery>2005-02-20</discovery>
      <entry>2005-02-20</entry>
      <modified>2005-02-23</modified>
    </dates>
  </vuln>

  <vuln vid="29dd0065-81fa-11d9-a9e7-0001020eed82">
    <topic>kdelibs -- insecure temporary file creation</topic>
    <affects>
      <package>
	<name>kdelibs</name>
	<name>ja-kdelibs</name>
	<range><lt>3.3.2_5</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Davide Madrisan reports:</p>
	<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110814653804757">
	  <p>The `dcopidlng' script in the KDE library package
	    (kdelibs-3.3.2/dcop/dcopidlng/dcopidlng) creates temporary
	    files in a unsecure manner.</p>
	</blockquote>
	<p><strong>Note:</strong> dcopidlng is only used at build
	  time, so only users installing KDE are vulnerable, not users
	  already running KDE.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2005-0365</cvename>
      <url>http://bugs.kde.org/show_bug.cgi?id=97608</url>
      <mlist msgid="200502110916.48921.davide.madrisan@qilinux.it">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110814653804757</mlist>
    </references>
    <dates>
      <discovery>2005-01-21</discovery>
      <entry>2005-02-18</entry>
      <modified>2005-02-20</modified>
    </dates>
  </vuln>

  <vuln vid="74c86a29-81ef-11d9-a9e7-0001020eed82">
    <topic>bidwatcher -- format string vulnerability</topic>
    <affects>
      <package>
	<name>bidwatcher</name>
	<range><lt>1.3.17</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A Debian Security Advisory reports:</p>
	<blockquote cite="http://www.debian.org/security/2005/dsa-687">
	  <p>Ulf Härnhammer from the Debian Security Audit Project
	    discovered a format string vulnerability in bidwatcher, a
	    tool for watching and bidding on eBay auctions. This
	    problem can be triggered remotely by a web server of eBay,
	    or someone pretending to be eBay, sending certain data
	    back.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <bid>12590</bid>
      <cvename>CAN-2005-0158</cvename>
      <url>http://www.debian.org/security/2005/dsa-687</url>
    </references>
    <dates>
      <discovery>2005-02-18</discovery>
      <entry>2005-02-18</entry>
    </dates>
  </vuln>

  <vuln vid="2d8cf857-81ea-11d9-a9e7-0001020eed82">
    <topic>gftp -- directory traversal vulnerability</topic>
    <affects>
      <package>
	<name>gftp</name>
	<range><lt>2.0.18</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A Debian Security Advisory reports:</p>
	<blockquote cite="http://www.debian.org/security/2005/dsa-686">
	  <p>Albert Puigsech Galicia discovered a directory traversal
	    vulnerability in a proprietary FTP client (CAN-2004-1376)
	    which is also present in gftp, a GTK+ FTP client.  A
	    malicious server could provide a specially crafted
	    filename that could cause arbitrary files to be
	    overwritten or created by the client.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <bid>12539</bid>
      <cvename>CAN-2005-0372</cvename>
      <url>http://www.debian.org/security/2005/dsa-686</url>
      <url>http://www.gftp.org/changelog.html</url>
    </references>
    <dates>
      <discovery>2005-02-04</discovery>
      <entry>2005-02-18</entry>
    </dates>
  </vuln>

  <vuln vid="20c9bb14-81e6-11d9-a9e7-0001020eed82">
    <topic>opera -- "data:" URI handler spoofing vulnerability</topic>
    <affects>
      <package>
	<name>opera</name>
	<name>opera-devel</name>
	<name>linux-opera</name>
	<range><lt>7.54.20050131</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A Secunia Advisory reports:</p>
	<blockquote cite="http://secunia.com/advisories/13818/">
	  <p>Michael Holzt has discovered a vulnerability in Opera,
	    which can be exploited by malicious people to trick users
	    into executing malicious files.</p>
	  <p>The vulnerability is caused due to an error in the
	    processing of "data:" URIs, causing wrong information to
	    be shown in a download dialog. This can be exploited by
	    e.g. a malicious website to trick users into executing a
	    malicious file by supplying a specially crafted "data:"
	    URI.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CAN-2005-0456</cvename>
      <certvu>882926</certvu>
      <url>http://secunia.com/advisories/13818/</url>
      <url>http://www.opera.com/freebsd/changelogs/754u2/</url>
    </references>
    <dates>
      <discovery>2005-01-12</discovery>
      <entry>2005-02-18</entry>
    </dates>
  </vuln>

  <vuln vid="d8e55d65-81d6-11d9-a9e7-0001020eed82">
    <topic>opera -- kfmclient exec command execution vulnerability</topic>
    <affects>
      <package>
	<name>opera</name>
	<name>opera-devel</name>
	<name>linux-opera</name>
	<range><lt>7.54.20050131</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Giovanni Delvecchio reports:</p>
	<blockquote cite="http://www.zone-h.org/advisories/read/id=6503">
	  <p>Opera for linux uses "kfmclient exec" as "Default
	    Application" to handle saved files.	 This could be used by
	    malicious remote users to execute arbitrary shell commands
	    on a target system.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-1491</cvename>
      <url>http://secunia.com/advisories/13447/</url>
      <url>http://www.opera.com/freebsd/changelogs/754u2/</url>
      <url>http://www.zone-h.org/advisories/read/id=6503</url>
    </references>
    <dates>
      <discovery>2004-12-12</discovery>
      <entry>2005-02-18</entry>
    </dates>
  </vuln>

  <vuln vid="6b4b0b3f-8127-11d9-a9e7-0001020eed82">
    <topic>postgresql -- multiple buffer overflows in PL/PgSQL
      parser</topic>
    <affects>
      <package>
	<name>postgresql</name>
	<name>postgresql-server</name>
	<name>ja-postgresql</name>
	<range><lt>7.3.9_1</lt></range>
	<range><gt>7.4.*</gt><lt>7.4.7_1</lt></range>
	<range><gt>8.*</gt><lt>8.0.1_1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The PL/PgSQL parser in postgresql is vulnerable to several
	  buffer overflows.  These could be exploited by a remote
	  attacker to execute arbitrary code with the permissions of
	  the postgresql server by running a specially crafted
	  query.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2005-0247</cvename>
      <url>http://archives.postgresql.org/pgsql-committers/2005-02/msg00049.php</url>
    </references>
    <dates>
      <discovery>2005-02-07</discovery>
      <entry>2005-02-17</entry>
      <modified>2005-02-19</modified>
    </dates>
  </vuln>

  <vuln vid="fdad8a87-7f94-11d9-a9e7-0001020eed82">
    <topic>awstats -- arbitrary command execution</topic>
    <affects>
      <package>
	<name>awstats</name>
	<range><lt>6.4</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Several input validation errors exist in AWStats that allow a
	  remote unauthenticated attacker to execute arbitrary commands
	  with the priviliges of the web server.  These programming
	  errors involve CGI parameters including
	  <code>loadplugin</code>, <code>logfile</code>,
	  <code>pluginmode</code>, <code>update</code>, and possibly
	  others.</p>
	<p>Additionally, the <code>debug</code> and other CGI parameters
	  may be used to cause AWStats to disclose AWStats and system
	  configuration information.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2005-0362</cvename>
      <cvename>CAN-2005-0363</cvename>
      <cvename>CAN-2005-0435</cvename>
      <cvename>CAN-2005-0436</cvename>
      <cvename>CAN-2005-0437</cvename>
      <cvename>CAN-2005-0438</cvename>
      <bid>12543</bid>
      <bid>12545</bid>
      <mlist msgid="20050214081040.3370.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110840530924124</mlist>
      <url>http://awstats.sourceforge.net/docs/awstats_changelog.txt</url>
      <url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=294488</url>
      <url>http://packetstormsecurity.nl/0501-exploits/AWStatsVulnAnalysis.pdf</url>
    </references>
    <dates>
      <discovery>2005-02-10</discovery>
      <entry>2005-02-16</entry>
      <modified>2005-02-23</modified>
    </dates>
  </vuln>

  <vuln vid="5a5422fd-7e1a-11d9-a9e7-0001020eed82">
    <topic>powerdns -- DoS vulnerability</topic>
    <affects>
      <package>
	<name>powerdns</name>
	<range><lt>2.9.17</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>PowerDNS is vulnerable to a temporary denial-of-service
	  vulnerability that can be triggered using a random stream of
	  bytes.</p>
      </body>
    </description>
    <references>
      <bid>12446</bid>
      <url>http://ds9a.nl/cgi-bin/cvstrac/pdns/tktview?tn=21</url>
      <url>http://doc.powerdns.com/changelog.html#CHANGELOG-2-9-17</url>
    </references>
    <dates>
      <discovery>2004-09-18</discovery>
      <entry>2005-02-14</entry>
    </dates>
  </vuln>

  <vuln vid="3e3c860d-7dae-11d9-a9e7-0001020eed82">
    <topic>emacs -- movemail format string vulnerability</topic>
    <affects>
      <package>
	<name>zh-emacs</name>
	<name>emacs</name>
	<range><lt>20.7_4</lt></range>
	<range><gt>21.*</gt><lt>21.3_4</lt></range>
      </package>
      <package>
	<name>xemacs</name>
	<name>xemacs-mule</name>
	<name>zh-xemacs</name>
	<name>zh-xemacs-mule</name>
	<range><lt>21.4.17</lt></range>
      </package>
      <package>
	<name>xemacs-devel</name>
	<range><lt>21.5.b19,1</lt></range>
      </package>
      <package>
	<name>xemacs-devel-21.5</name>
	<range><eq>b11</eq></range>
      </package>
      <package>
	<name>xemacs-devel-mule</name>
	<range><lt>21.5.b19</lt></range>
      </package>
      <package>
	<name>mule-common</name>
	<name>hanemacs</name>
	<range><gt>0</gt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Max Vozeler discovered several format string
	  vulnerabilities in the movemail utility of Emacs.  They can
	  be exploited when connecting to a malicious POP server and
	  can allow an attacker can execute arbitrary code under the
	  privileges of the user running Emacs.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2005-0100</cvename>
      <bid>12462</bid>
    </references>
    <dates>
      <discovery>2005-01-31</discovery>
      <entry>2005-02-14</entry>
    </dates>
  </vuln>

  <vuln vid="bc4a7efa-7d9a-11d9-a9e7-0001020eed82">
    <topic>ngircd -- format string vulnerability</topic>
    <affects>
      <package>
	<name>ngircd</name>
	<range><lt>0.8.3</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A No System Group security advisory reports that ngircd is
	  vulnerable to a format string vulnerability in the
	  <code>Log_Resolver()</code> function of log.c, if IDENT
	  support is enabled.  This could allow a remote attacker to
	  execute arbitrary code with the permissions of the ngircd
	  daemon, which is <q>root</q> by default.</p>
	<p><strong>Note:</strong> By default the FreeBSD ngircd port
	  does not enable IDENT support.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2005-0226</cvename>
      <bid>12434</bid>
      <mlist msgid="20050203020909.21785.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110746413108183</mlist>
    </references>
    <dates>
      <discovery>2005-02-03</discovery>
      <entry>2005-02-13</entry>
    </dates>
  </vuln>

  <vuln vid="7f6dd1bd-7d99-11d9-a9e7-0001020eed82">
    <topic>ngircd -- buffer overflow vulnerability</topic>
    <affects>
      <package>
	<name>ngircd</name>
	<range><lt>0.8.2</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Florian Westphal discovered a buffer overflow in ngircd
	  which can be used remotely crash the server and possibly
	  execute arbitrary code.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2005-0199</cvename>
      <bid>12397</bid>
      <mlist>http://arthur.ath.cx/pipermail/ngircd-ml/2005-January/000228.html</mlist>
    </references>
    <dates>
      <discovery>2005-01-26</discovery>
      <entry>2005-02-13</entry>
    </dates>
  </vuln>

  <vuln vid="5192e7ca-7d4f-11d9-a9e7-0001020eed82">
    <topic>mod_python -- information leakage vulnerability</topic>
    <affects>
      <package>
	<name>mod_python</name>
	<range><lt>2.7.11</lt></range>
	<range><gt>3.*</gt><lt>3.1.4</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Mark J Cox reports:</p>
	<blockquote>
	  <p>Graham Dumpleton discovered a flaw which can affect
	    anyone using the publisher handle of the Apache Software
	    Foundation mod_python. The publisher handle lets you
	    publish objects inside modules to make them callable via
	    URL. The flaw allows a carefully crafted URL to obtain
	    extra information that should not be visible (information
	    leak).</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CAN-2005-0088</cvename>
    </references>
    <dates>
      <discovery>2005-01-30</discovery>
      <entry>2005-02-13</entry>
    </dates>
  </vuln>

  <vuln vid="c7ccc33f-7d31-11d9-a9e7-0001020eed82">
    <topic>mailman -- directory traversal vulnerability</topic>
    <affects>
      <package>
	<name>mailman</name>
	<name>ja-mailman</name>
	<range><lt>2.1.5_2</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A directory traversal vulnerability in mailman allow remote
	  attackers to read arbitrary files due to inadequate input
	  sanitizing.  This could, among other things, lead remote
	  attackers to gaining access to the mailman configuration
	  database (which contains subscriber email addresses and
	  passwords) or to the mail archives for private lists.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2005-0202</cvename>
      <mlist msgid="20050209181502.GA26136@grok.org.uk">http://marc.theaimsgroup.com/?l=full-disclosure&amp;m=110797575304304</mlist>
    </references>
    <dates>
      <discovery>2005-01-02</discovery>
      <entry>2005-02-12</entry>
    </dates>
  </vuln>

  <vuln vid="72da8af6-7c75-11d9-8cc5-000854d03344">
    <topic>enscript -- multiple vulnerabilities</topic>
    <affects>
      <package>
	<name>enscript-a4</name>
	<name>enscript-letter</name>
	<name>enscript-letterdj</name>
	<range><lt>1.6.4_1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Erik Sjölund discovered several issues in enscript:
	  it suffers from several buffer overflows, quotes and shell
	  escape characters are insufficiently sanitized in filenames,
	  and it supported taking input from an arbitrary command
	  pipe, with unwanted side effects.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-1184</cvename>
      <cvename>CAN-2004-1185</cvename>
      <cvename>CAN-2004-1186</cvename>
      <url>http://www.gentoo.org/security/en/glsa/glsa-200502-03.xml</url>
    </references>
    <dates>
      <discovery>2005-02-02</discovery>
      <entry>2005-02-11</entry>
    </dates>
  </vuln>

  <vuln vid="5d425189-7a03-11d9-a9e7-0001020eed82">
    <topic>postgresql -- privilege escalation vulnerability</topic>
    <affects>
      <package>
	<name>postgresql</name>
	<name>postgresql-server</name>
	<name>ja-postgresql</name>
	<range><lt>7.3.9</lt></range>
	<range><gt>7.4.*</gt><lt>7.4.7</lt></range>
	<range><gt>8.*</gt><lt>8.0.1</lt></range>
      </package>
      <package>
	<name>postgresql-devel</name>
	<range><le>8.0.1,1</le></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>John Heasman and others disovered that non-privileged users
	  could use the <q>LOAD</q> extension to load arbitrary
	  libraries into the postgres server process space.  This
	  could be used by non-privileged local users to execute
	  arbitrary code with the privileges of the postgresql
	  server.</p>
      </body>
    </description>
    <references>
      <bid>12411</bid>
      <cvename>CAN-2005-0227</cvename>
      <mlist>http://archives.postgresql.org/pgsql-announce/2005-02/msg00000.php</mlist>
      <mlist>http://archives.postgresql.org/pgsql-bugs/2005-01/msg00269.php</mlist>
    </references>
    <dates>
      <discovery>2005-01-21</discovery>
      <entry>2005-02-08</entry>
    </dates>
  </vuln>

  <vuln vid="831a6a66-79fa-11d9-a9e7-0001020eed82">
    <topic>ethereal -- multiple protocol dissectors vulnerabilities</topic>
    <affects>
      <package>
	<name>ethereal</name>
	<name>ethereal-lite</name>
	<name>tethereal</name>
	<name>tethereal-lite</name>
	<range><ge>0.8.10</ge><lt>0.10.9</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>An Ethreal Security Advisories reports:</p>
	<blockquote cite="http://www.ethereal.com/appnotes/enpa-sa-00017.html">
	  <p>Issues have been discovered in the following protocol dissectors:</p>
	  <ul>
	    <li>The COPS dissector could go into an infinite
	      loop. CVE: CAN-2005-0006</li>
	    <li>The DLSw dissector could cause an assertion. CVE:
	      CAN-2005-0007</li>
	    <li>The DNP dissector could cause memory corruption. CVE:
	      CAN-2005-0008</li>
	    <li>The Gnutella dissector could cuase an assertion. CVE:
	      CAN-2005-0009</li>
	    <li>The MMSE dissector could free statically-allocated
	      memory. CVE: CAN-2005-0010</li>
	    <li>The X11 dissector is vulnerable to a string buffer
	      overflow. CVE: CAN-2005-0084</li>
	  </ul>
	  <p>Impact: It may be possible to make Ethereal crash or run
	    arbitrary code by injecting a purposefully malformed
	    packet onto the wire or by convincing someone to read a
	    malformed packet trace file.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CAN-2005-0006</cvename>
      <cvename>CAN-2005-0007</cvename>
      <cvename>CAN-2005-0008</cvename>
      <cvename>CAN-2005-0009</cvename>
      <cvename>CAN-2005-0010</cvename>
      <cvename>CAN-2005-0084</cvename>
      <bid>12326</bid>
      <url>http://www.ethereal.com/appnotes/enpa-sa-00017.html</url>
    </references>
    <dates>
      <discovery>2005-01-18</discovery>
      <entry>2005-02-08</entry>
    </dates>
  </vuln>

  <vuln vid="bfda39de-7467-11d9-9e1e-c296ac722cb3">
    <topic>squid -- correct handling of oversized HTTP reply headers</topic>
    <affects>
      <package>
        <name>squid</name>
        <range><lt>2.5.7_12</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
        <p>The squid patches page notes:</p>
        <blockquote cite="http://www.squid-cache.org/Versions/v2/2.5/bugs/squid-2.5.STABLE7-oversize_reply_headers.patch">
          <p>This patch addresses a HTTP protocol mismatch related to oversized
            reply headers. In addition it enhances the cache.log reporting on
            reply header parsing failures to make it easier to track down which
            sites are malfunctioning.</p>
        </blockquote>
	<p>It is believed that this bug may lead to cache pollution or
	  allow access controls to be bypassed.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2005-0241</cvename>
      <url>http://www.squid-cache.org/bugs/show_bug.cgi?id=1216</url>
      <url>http://www.squid-cache.org/Versions/v2/2.5/bugs/squid-2.5.STABLE7-oversize_reply_headers.patch</url>
      <freebsdpr>ports/76967</freebsdpr>
      <certvu>823350</certvu>
    </references>
    <dates>
      <discovery>2005-01-31</discovery>
      <entry>2005-02-08</entry>
    </dates>
  </vuln>

  <vuln vid="6afa87d3-764b-11d9-b0e7-0000e249a0a2">
    <topic>python -- SimpleXMLRPCServer.py allows unrestricted traversal</topic>
    <affects>
      <package>
	<name>python</name>
	<name>python23</name>
	<name>python22</name>
        <name>python-devel</name>
	<range><ge>2.2</ge><lt>2.2.3_7</lt></range>
	<range><ge>2.3</ge><lt>2.3.4_4</lt></range>
	<range><ge>2.4</ge><lt>2.4_1</lt></range>
	<range><ge>2.5.a0.20050129</ge><lt>2.5.a0.20050129_1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
      	<p>According to Python Security Advisory PSF-2005-001,</p>
	<blockquote cite="http://www.python.org/security/PSF-2005-001/">
	  <p>The Python development team has discovered a flaw in
	    the <code>SimpleXMLRPCServer</code> library module which
	    can give remote attackers access to internals of the
	    registered object or its module or possibly other modules.
	    The flaw only affects Python XML-RPC servers that use the
	    <code>register_instance()</code> method to register an object
	    without a <code>_dispatch()</code> method.  Servers using
	    only <code>register_function()</code> are not affected.</p>
	  <p>On vulnerable XML-RPC servers, a remote attacker may
	    be able to view or modify globals of the module(s)
	    containing the registered instance's class(es), potentially
	    leading to data loss or arbitrary code execution.  If the
	    registered object is a module, the danger is particularly
	    serious.  For example, if the registered module imports
	    the <code>os</code> module, an attacker could invoke the
	    <code>os.system()</code> function.</p>
	</blockquote>
	<p><strong>Note:</strong> This vulnerability affects your
	  system only if you're running
	  <code>SimpleXMLRPCServer</code>-based server.  This isn't
	  harmful at all if you don't run any internet server written
	  in Python or your server doesn't serve in XML-RPC protocol.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2005-0089</cvename>
      <url>http://www.python.org/security/PSF-2005-001/</url>
    </references>
    <dates>
      <discovery>2005-02-03</discovery>
      <entry>2005-02-03</entry>
    </dates>
  </vuln>

  <vuln vid="a5eb760a-753c-11d9-a36f-000a95bc6fae">
    <topic>perl -- vulnerabilities in PERLIO_DEBUG handling</topic>
    <affects>
      <package>
	<name>perl</name>
	<range><ge>5.8</ge><lt>5.8.6_2</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Kevin Finisterre discovered bugs in perl's I/O debug support:</p>
	<ul>
	  <li>The environmental variable PERLIO_DEBUG is honored even
	    by the set-user-ID perl command (usually
	    named <code>sperl</code> or <code>suidperl</code>).  As a
	    result, a local attacker may be able to gain elevated
	    privileges. <em>(CAN-2005-0155)</em></li>
	  <li>A buffer overflow may occur in threaded versions of perl
	    when the full pathname of the script being executed is
	    very long. <em>(CAN-2005-0156)</em>.</li>
	</ul>
	<p><strong>Note:</strong> By default, no set-user-ID perl
	  binary is installed.  An administrator must enable it
	  manually at build time with the <code>ENABLE_SUIDPERL</code>
	  port flag.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2005-0155</cvename>
      <cvename>CAN-2005-0156</cvename>
    </references>
    <dates>
      <discovery>2005-02-02</discovery>
      <entry>2005-02-02</entry>
    </dates>
  </vuln>

  <vuln vid="cd7e260a-6bff-11d9-a5df-00065be4b5b6">
   <topic>newsgrab -- insecure file and directory creation</topic>
   <affects>
    <package>
     <name>newsgrab</name>
     <range><le>0.4.0</le></range>
    </package>
   </affects>
   <description>
    <body xmlns="http://www.w3.org/1999/xhtml">
     <p>The newsgrab script uses insecure permissions during the
     creation of the local output directory and downloaded files.</p>
     <p>After a file is created, permissions on it are set using the mode
     value of the newsgroup posting. This can potentially be a problem
     when the mode is not restrictive enough. In addition, the output
     directory is created with world writable permissions allowing other
     users to drop symlinks or other files at that location.</p>
    </body>
   </description>
   <references>
    <url>http://people.freebsd.org/~niels/issues/newsgrab-20050114.txt</url>
    <url>http://sourceforge.net/project/shownotes.php?release_id=300562</url>
    <cvename>CAN-2005-0154</cvename>
   </references>
   <dates>
    <discovery>2005-01-18</discovery>
    <entry>2005-02-01</entry>
   </dates>
  </vuln>

  <vuln vid="35f6093c-73c3-11d9-8a93-00065be4b5b6">
   <topic>newsgrab -- directory traversal vulnerability</topic>
    <affects>
     <package>
      <name>newsgrab</name>
      <range><le>0.4.0</le></range>
     </package>
    </affects>
    <description>
    <body xmlns="http://www.w3.org/1999/xhtml">
     <p>The newsgrab script creates files by using the names provided
     in the newsgroup messages in a perl open() call.  This is done
     without performing any security checks to prevent a
     directory traversal. A specially crafted newsgroup message
     could cause newsgrab to drop an attachment anywhere on the
     file system using the permissions of the user running the
     script.</p>
    </body>
   </description>
   <references>
    <url>http://people.freebsd.org/~niels/issues/newsgrab-20050114.txt</url>
    <url>http://sourceforge.net/project/shownotes.php?release_id=300562</url>
    <cvename>CAN-2005-0153</cvename>
   </references>
   <dates>
    <discovery>2005-01-18</discovery>
    <entry>2005-02-01</entry>
   </dates>
  </vuln>
  <vuln vid="7f13607b-6948-11d9-8937-00065be4b5b6">
   <topic>newspost -- server response buffer overflow vulnerability</topic>
   <affects>
    <package>
     <name>newspost</name>
     <range><le>2.1.1</le></range>
    </package>
   </affects>
   <description>
    <body xmlns="http://www.w3.org/1999/xhtml">
      <p>The newspost program uses a function named socket_getline to
      read server responses from the network socket. Unfortunately this
      function does not check the length of the buffer in which the read
      data is stored and only stops reading when a newline character is found.</p>
      <p>A malicious NNTP server could use this bug to cause a buffer
      overflow by sending an overly long response. Such an overflow allows
      arbitrary code to be executed, with the privileges of the newspost
      process, on the affected systems.</p>
    </body>
   </description>
   <references>
    <url>http://people.freebsd.org/~niels/issues/newspost-20050114.txt</url>
    <cvename>CAN-2005-0101</cvename>
   </references>
   <dates>
    <discovery>2005-01-14</discovery>
    <entry>2005-02-01</entry>
   </dates>
  </vuln>

  <vuln vid="76e0b133-6bfd-11d9-a5df-00065be4b5b6">
   <topic>newsfetch -- server response buffer overflow vulnerability</topic>
   <affects>
     <package>
      <name>newsfetch</name>
      <range><le>2.1.1_1</le></range>
    </package>
   </affects>
   <description>
    <body xmlns="http://www.w3.org/1999/xhtml">
     <p>The newsfetch program uses the sscanf function to read information
       from server responses into static memory buffers. Unfortunately
       this is done without any proper bounds checking. As a result long
       server responses may cause an overflow when a newsgroup listing is
       requested from an NNTP server.</p>
    </body>
   </description>
   <references>
    <url>http://people.freebsd.org/~niels/issues/newsfetch-20050119.txt</url>
    <cvename>CAN-2005-0132</cvename>
   </references>
   <dates>
    <discovery>2005-01-18</discovery>
    <entry>2005-02-01</entry>
   </dates>
  </vuln>

  <vuln vid="23fb5a04-722b-11d9-9e1e-c296ac722cb3">
    <topic>squid -- buffer overflow in WCCP recvfrom() call</topic>
    <affects>
      <package>
	<name>squid</name>
	<range><lt>2.5.7_10</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>According to the Squid Proxy Cache Security Update Advisory SQUID-2005:3,</p>
	<blockquote cite="http://www.squid-cache.org/Advisories/SQUID-2005_3.txt">
	  <p>The WCCP recvfrom() call accepts more data than will fit in
	    the allocated buffer.  An attacker may send a larger-than-normal
	    WCCP message to Squid and overflow this buffer.</p>
	  <p>Severity:</p>
	  <p>The bug is important because it allows remote attackers to crash
	    Squid, causing a disription in service.  However, the bug is
	    exploitable only if you have configured Squid to send WCCP messages
	    to, and expect WCCP replies from, a router.</p>
	  <p>Sites that do not use WCCP are not vulnerable.</p>
	</blockquote>
	<p>Note that while the default configuration of the FreeBSD squid port
	  enables WCCP support in general, the default configuration
	  supplied does not actually configure squid to send and receive WCCP
	  messages.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2005-0211</cvename>
      <certvu>886006</certvu>
      <url>http://www.squid-cache.org/Advisories/SQUID-2005_3.txt</url>
      <url>http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-wccp_buffer_overflow</url>
      <url>http://www.squid-cache.org/bugs/show_bug.cgi?id=1217</url>
    </references>
    <dates>
      <discovery>2005-01-28</discovery>
      <entry>2005-01-28</entry>
      <modified>2005-02-13</modified>
    </dates>
  </vuln>

  <vuln vid="f755545e-6fcd-11d9-abec-00061bd2d56f">
    <topic>xpdf -- makeFileKey2() buffer overflow vulnerability</topic>
    <affects>
      <package>
	<name>xpdf</name>
	<range><lt>3.00_6</lt></range>
      </package>
      <package>
	<name>kdegraphics</name>
	<range><lt>3.3.2_2</lt></range>
      </package>
      <package>
	<name>gpdf</name>
	<range><lt>2.8.3</lt></range>
      </package>
      <package>
	<name>teTeX-base</name>
	<range><lt>2.0.2_9</lt></range>
      </package>
      <package>
	<name>cups-base</name>
	<range><lt>1.1.23.0_3</lt></range>
      </package>
      <package>
	<name>koffice</name>
	<range><lt>1.3.5_2,1</lt></range>
      </package>
      <package>
	<name>pdftohtml</name>
	<range><lt>0.36_2</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>An iDEFENSE Security Advisory reports:</p>
	<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110608898221554">
	  <p>Remote exploitation of a buffer overflow vulnerability in
	    the xpdf PDF viewer included in multiple Unix and Linux
	    distributions could allow for arbitrary code execution as
	    the user viewing a PDF file.</p>
	  <p>The vulnerability specifically exists due to insufficient
	    bounds checking while processing a PDF file that provides
	    malicious values in the /Encrypt /Length tag. The
	    offending code can be found in the
	    <code>Decrypt::makeFileKey2</code> function in the source
	    file xpdf/Decrypt.cc.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CAN-2005-0064</cvename>
      <mlist msgid="FB24803D1DF2A34FA59FC157B77C970503C8B298@idserv04.idef.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110608898221554</mlist>
      <url>http://www.koffice.org/security/advisory-20050120-1.txt</url>
    </references>
    <dates>
      <discovery>2005-01-06</discovery>
      <entry>2005-01-26</entry>
      <modified>2005-02-03</modified>
    </dates>
  </vuln>

  <vuln vid="d371b627-6ed5-11d9-bd18-000a95bc6fae">
    <topic>zhcon -- unauthorized file access</topic>
    <affects>
      <package>
	<name>zhcon</name>
	<name>zh-zhcon</name>
	<range><lt>0.2.3_3</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Martin <q>Joey</q> Schulze reports:</p>
	<blockquote>
	  <p>Erik Sjöund discovered that zhcon, a fast console CJK
	    system using the Linux framebuffer, accesses a
	    user-controlled configuration file with elevated
	    privileges. Thus, it is possible to read arbitrary files.</p>
	</blockquote>
	<p>When installed from the FreeBSD Ports Collection, zhcon is
	  installed set-user-ID root.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2005-0072</cvename>
    </references>
    <dates>
      <discovery>2005-01-25</discovery>
      <entry>2005-01-25</entry>
    </dates>
  </vuln>

  <vuln vid="b8943e61-6e68-11d9-a9e7-0001020eed82">
    <topic>evolution -- arbitrary code execution vulnerability</topic>
    <affects>
      <package>
	<name>evolution</name>
	<range><lt>2.0.3_1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Martin <q>Joey</q> Schulze reports:</p>
	<blockquote>
	  <p>Max Vozeler discovered an integer overflow in the helper
	    application camel-lock-helper which runs setuid root or
	    setgid mail inside of Evolution, a free groupware suite.
	    A local attacker can cause the setuid root helper to
	    execute arbitrary code with elevated privileges via a
	    malicious POP server.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <bid>12354</bid>
      <cvename>CAN-2005-0102</cvename>
      <url>http://cvs.gnome.org/viewcvs/evolution/camel/camel-lock-helper.c?rev=1.7&amp;view=log#rev1.5.74.1</url>
    </references>
    <dates>
      <discovery>2005-01-20</discovery>
      <entry>2005-01-25</entry>
      <modified>2005-02-02</modified>
    </dates>
  </vuln>

  <vuln vid="88ff90f2-6e43-11d9-8c87-000a95bc6fae">
    <topic>mod_dosevasive -- insecure temporary file creation</topic>
    <affects>
      <package>
	<name>mod_dosevasive20</name>
	<range><lt>1.10</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>An LSS Security Advisory reports:</p>
	<blockquote cite="http://security.lss.hr/en/index.php?page=details&amp;ID=LSS-2005-01-01">
	  <p>When a denial of service attack is detected,
	    mod_dosevasive will, among other things, create a
	    temporary file which it will use to trace actions from the
	    offensive IP address. This file is insecurely created in
	    /tmp and it's name is easily predictable.</p>
	  <p>It is then easy for an attacker to create arbitrary files
	    in any directory that the user under which apache runs has
	    privileges to write.</p>
	  <p><em>[...]</em> once the target file is opened, there is a
	    race attack (although difficult to exploit) which can lead
	    to mod_dosevasive overwriting any file that the user under
	    which apache runs has privileges to write.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <freebsdpr>ports/77513</freebsdpr>
      <url>http://security.lss.hr/en/index.php?page=details&amp;ID=LSS-2005-01-01</url>
    </references>
    <dates>
      <discovery>2005-01-04</discovery>
      <entry>2005-01-24</entry>
      <modified>2005-02-22</modified>
    </dates>
  </vuln>

  <vuln vid="b4d94fa0-6e38-11d9-9e1e-c296ac722cb3">
    <topic>squid -- possible cache-poisoning via malformed HTTP
      responses</topic>
    <affects>
      <package>
        <name>squid</name>
        <range><lt>2.5.7_9</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
        <p>The squid patches page notes:</p>
        <blockquote cite="http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-header_parsing">
          <p>This patch makes Squid considerably stricter while
            parsing the HTTP protocol.</p>
          <ol>
            <li>A Content-length header should only appear once in a
              valid request or response. Multiple Content-length
              headers, in conjunction with specially crafted requests,
              may allow Squid's cache to be poisioned with bad content
              in certain situations.</li>
            <li>CR characters is only allowed as part of the CR NL
              line terminator, not alone. This to ensure that all
              involved agrees on the structure of HTTP headers.</li>
            <li>Rejects requests/responses that have whitespace in an
              HTTP header name.</li>
          </ol>
        </blockquote>
        <p>To enable these strict parsing rules, update to at least
          squid-2.5.7_9 and specify <code>relaxed_header_parser
          off</code> in squid.conf.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2005-0174</cvename>
      <url>http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-header_parsing</url>
      <certvu>768702</certvu>
    </references>
    <dates>
      <discovery>2005-01-24</discovery>
      <entry>2005-01-24</entry>
      <modified>2005-02-07</modified>
    </dates>
  </vuln>

  <vuln vid="97c3a452-6e36-11d9-8324-000a95bc6fae">
    <topic>bugzilla -- cross-site scripting vulnerability</topic>
    <affects>
      <package>
	<name>bugzilla</name>
	<name>ja-bugzilla</name>
	<range><lt>2.16.8</lt></range>
	<range><ge>2.17.*</ge><lt>2.18</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A Bugzilla advisory states:</p>
	<blockquote cite="http://www.bugzilla.org/security/2.16.7-nr/">
	  <p>This advisory covers a single cross-site scripting issue
	    that has recently been discovered and fixed in the
	    Bugzilla code: If a malicious user links to a Bugzilla
	    site using a specially crafted URL, a script in the error
	    page generated by Bugzilla will display the URL unaltered
	    in the page, allowing scripts embedded in the URL to
	    execute.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-1061</cvename>
      <url>http://www.bugzilla.org/security/2.16.7-nr/</url>
      <url>https://bugzilla.mozilla.org/show_bug.cgi?id=272620</url>
    </references>
    <dates>
      <discovery>2004-12-01</discovery>
      <entry>2005-01-24</entry>
    </dates>
  </vuln>

  <vuln vid="b0911985-6e2a-11d9-9557-000a95bc6fae">
    <topic>web browsers -- window injection vulnerabilities</topic>
    <affects>
      <package>
        <name>firefox</name>
        <range><lt>1.0.1,1</lt></range>
      </package>
      <package>
        <name>mozilla</name>
        <range><lt>1.7.6,2</lt></range>
      </package>
      <package>
        <name>linux-mozilla</name>
        <name>linux-mozilla-devel</name>
        <range><lt>1.7.6</lt></range>
      </package>
      <package>
        <name>de-linux-mozillafirebird</name>
	<name>el-linux-mozillafirebird</name>
        <name>ja-linux-mozillafirebird-gtk1</name>
        <name>ja-mozillafirebird-gtk2</name>
        <name>linux-mozillafirebird</name>
        <name>ru-linux-mozillafirebird</name>
        <name>zhCN-linux-mozillafirebird</name>
        <name>zhTW-linux-mozillafirebird</name>
        <name>de-netscape7</name>
        <name>fr-netscape7</name>
        <name>ja-netscape7</name>
        <name>netscape7</name>
        <name>pt_BR-netscape7</name>
        <name>mozilla-gtk1</name>
	<range><ge>0</ge></range>
      </package>
      <package>
	<!-- These package names are obsolete. -->
        <name>de-linux-netscape</name>
        <name>fr-linux-netscape</name>
        <name>ja-linux-netscape</name>
        <name>linux-netscape</name>
        <name>linux-phoenix</name>
        <name>mozilla+ipv6</name>
        <name>mozilla-embedded</name>
        <name>mozilla-firebird</name>
        <name>mozilla-gtk2</name>
        <name>mozilla-gtk</name>
        <name>mozilla-thunderbird</name>
        <name>phoenix</name>
	<range><ge>0</ge></range>
      </package>
      <package>
	<name>kdebase</name>
	<name>kdelibs</name>
	<range><lt>3.3.2</lt></range>
      </package>
      <package>
	<name>opera</name>
	<name>opera-devel</name>
	<name>linux-opera</name>
	<range><lt>7.54.20050131</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A Secunia Research advisory reports:</p>
	<blockquote cite="http://secunia.com/secunia_research/2004-13/advisory/">
	  <p>Secunia Research has reported a vulnerability in multiple
	    browsers, which can be exploited by malicious people to
	    spoof the content of websites.</p>
	  <p>The problem is that a website can inject content into
	    another site's window if the target name of the window is
	    known. This can e.g. be exploited by a malicious website
	    to spoof the content of a pop-up window opened on a
	    trusted website.</p>
	  <p>Secunia has constructed a test, which can be used to
	    check if your browser is affected by this issue:
	    <a href="http://secunia.com/multiple_browsers_window_injection_vulnerability_test/">http://secunia.com/multiple_browsers_window_injection_vulnerability_test/</a></p>
	</blockquote>
	<p>A <a href="http://mozillanews.org/?article_date=2004-12-08+06-48-46">workaround
	    for Mozilla-based browsers</a> is available.</p>
      </body>
    </description>
    <references>
      <url>http://secunia.com/secunia_research/2004-13/advisory/</url>
      <url>http://secunia.com/multiple_browsers_window_injection_vulnerability_test/</url>
      <!-- mozilla -->
      <cvename>CAN-2004-1156</cvename>
      <url>http://secunia.com/advisories/13129/</url>
      <url>https://bugzilla.mozilla.org/show_bug.cgi?id=273699</url>
      <url>https://bugzilla.mozilla.org/show_bug.cgi?id=103638</url>
      <url>http://mozillanews.org/?article_date=2004-12-08+06-48-46</url>
      <!-- opera -->
      <cvename>CAN-2004-1157</cvename>
      <url>http://secunia.com/advisories/13253/</url>
      <!-- konqueror -->
      <cvename>CAN-2004-1158</cvename>
      <url>http://secunia.com/advisories/13254/</url>
      <url>http://www.kde.org/info/security/advisory-20041213-1.txt</url>
      <!-- netscape -->
      <cvename>CAN-2004-1160</cvename>
      <url>http://secunia.com/advisories/13402/</url>
    </references>
    <dates>
      <discovery>2004-12-08</discovery>
      <entry>2005-01-24</entry>
      <modified>2005-02-26</modified>
    </dates>
  </vuln>

  <vuln vid="d4a7054a-6d96-11d9-a9e7-0001020eed82">
    <topic>yamt -- arbitrary command execution vulnerability</topic>
    <affects>
      <package>
	<name>yamt</name>
	<range><lt>0.5_2</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Manigandan Radhakrishnan discovered a security
	  vulnerability in YAMT which can lead to execution of
	  arbitrary commands with the privileges of the user running
	  YAMT when sorting based on MP3 tags.  The problem exist in
	  the <code>id3tag_sort()</code> routine which does not
	  properly sanitize the artist tag from the MP3 file before
	  using it as an argument to the mv command.</p>
      </body>
    </description>
    <references>
      <bid>11999</bid>
      <cvename>CAN-2004-1302</cvename>
      <url>http://tigger.uic.edu/~jlongs2/holes/yamt.txt</url>
    </references>
    <dates>
      <discovery>2004-12-15</discovery>
      <entry>2005-01-23</entry>
      <modified>2005-01-25</modified>
    </dates>
  </vuln>

  <vuln vid="4e4bd2c2-6bd5-11d9-9e1e-c296ac722cb3">
    <topic>squid -- HTTP response splitting cache pollution attack</topic>
    <affects>
      <package>
	  <name>squid</name>
	  <range><lt>2.5.7_8</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	  <p>According to a whitepaper published by Sanctum, Inc., it
	    is possible to mount cache poisoning attacks against, among others,
	    squid proxies by inserting false replies into the HTTP stream.</p>
	  <p>The squid patches page notes:</p>
	  <blockquote cite="http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-response_splitting">
	    <p>This patch additionally strengthens Squid from the HTTP response
	      attack described by Sanctum.</p>
	  </blockquote>
      </body>
    </description>
    <references>
      <cvename>CAN-2005-0175</cvename>
      <url>http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-response_splitting</url>
      <url>http://www.squid-cache.org/bugs/show_bug.cgi?id=1200</url>
      <url>https://www.watchfire.com/securearea/whitepapers.aspx?id=8</url>
      <certvu>625878</certvu>
    </references>
    <dates>
      <discovery>2004-03-01</discovery>
      <entry>2005-01-22</entry>
      <modified>2005-02-07</modified>
    </dates>
  </vuln>

  <vuln vid="338d1723-5f03-11d9-92a7-000bdb1444a4">
    <topic>horde -- XSS vulnerabilities</topic>
    <affects>
      <package>
	<name>horde</name>
	<name>horde-php5</name>
	<range><gt>3.*</gt><lt>3.0.1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A Hyperdose Security Advisory reports:</p>
	<blockquote cite="http://lists.horde.org/archives/announce/2005/000159.html">
	  <p>Horde contains two XSS attacks that can be exploited
	    through GET requests.  Once exploited, these requests
	    could be used to execute any javascript commands in the
	    context of that user, potentially including but not
	    limited to reading and deleting email, and stealing auth
	    tokens.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <bid>12255</bid>
      <mlist msgid="1105593825.8638@mx249a.mysite4now.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110564059322774</mlist>
      <mlist>http://lists.horde.org/archives/announce/2005/000159.html</mlist>
    </references>
    <dates>
      <discovery>2005-01-04</discovery>
      <entry>2005-01-22</entry>
    </dates>
  </vuln>

  <vuln vid="2b2b333b-6bd3-11d9-95f8-000a95bc6fae">
    <topic>mc -- multiple vulnerabilities</topic>
    <affects>
      <package>
	<name>mc</name>
	<range><lt>4.6.0</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Andrew V. Samoilov reported several vulnerabilities that
	  were corrected in MidnightCommand 4.6.0:</p>
	<ul>
	  <li>Format string issues (CAN-2004-1004)</li>
	  <li>Buffer overflows (CAN-2004-1005)</li>
	  <li>Denial-of-service, infinite loop (CAN-2004-1009)</li>
	  <li>Denial-of-service, corrupted section header
	    (CAN-2004-1090)</li>
	  <li>Denial-of-service, null pointer dereference (CAN-2004-1091)</li>
	  <li>Freeing unallocated memory (CAN-2004-1092)</li>
	  <li>Using already freed memory (CAN-2004-1093)</li>
	</ul>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-1004</cvename>
      <cvename>CAN-2004-1005</cvename>
      <cvename>CAN-2004-1009</cvename>
      <cvename>CAN-2004-1090</cvename>
      <cvename>CAN-2004-1091</cvename>
      <cvename>CAN-2004-1092</cvename>
      <cvename>CAN-2004-1093</cvename>
    </references>
    <dates>
      <discovery>2004-12-01</discovery>
      <entry>2005-01-21</entry>
    </dates>
  </vuln>

  <vuln vid="c418d472-6bd1-11d9-93ca-000a95bc6fae">
    <topic>perl -- File::Path insecure file/directory permissions</topic>
    <affects>
      <package>
	<name>perl</name>
	<range><ge>0</ge><lt>5.6.2</lt></range>
	<range><ge>5.8.0</ge><lt>5.8.6</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Jeroen van Wolffelaar reports that the Perl module File::Path
	  contains a race condition wherein traversed directories and files
	  are temporarily made world-readable/writable.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-0452</cvename>
      <url>http://www.debian.org/security/2004/dsa-620</url>
      <url>http://xforce.iss.net/xforce/xfdb/18650</url>
    </references>
    <dates>
      <discovery>2004-12-30</discovery>
      <entry>2005-01-21</entry>
      <modified>2005-02-01</modified>
    </dates>
  </vuln>

  <vuln vid="e8c6ade2-6bcc-11d9-8e6f-000a95bc6fae">
    <cancelled superseded="e3cf89f0-53da-11d9-92b7-ceadd4ac2edd" />
  </vuln>

  <vuln vid="1489df94-6bcb-11d9-a21e-000a95bc6fae">
    <topic>opera -- multiple vulnerabilities in Java implementation</topic>
    <affects>
      <package>
	<name>opera</name>
	<name>opera-devel</name>
	<name>linux-opera</name>
	<range><lt>7.54.20041210</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Marc Schoenefeld reports:</p>
	<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110088923127820">
	  <p>Opera 7.54 is vulnerable to leakage of the java sandbox,
            allowing malicious applets to gain unacceptable
            privileges. This allows them to be used for information
            gathering (spying) of local identity information and
            system configurations as well as causing annoying crash
            effects.</p>
	  <p>Opera 754 <em>[sic]</em> which was released Aug 5,2004 is
            vulnerable to the XSLT processor covert channel attack,
            which was corrected with JRE 1.4.2_05 [released in July
            04], but in disadvantage to the users the opera packaging
            guys chose to bundle the JRE 1.4.2_04 <em>[...]</em></p>
	  <p>Internal pointer DoS exploitation: Opera.jar contains the
            opera replacement of the java plugin. It therefore handles
            communication between javascript and the Java VM via the
            liveconnect protocol. The public class EcmaScriptObject
            exposes a system memory pointer to the java address space,
            by constructing a special variant of this type an internal
            cache table can be polluted by false entries that infer
            proper function of the JSObject class and in the following
            proof-of-concept crash the browser.</p>
	  <p>Exposure of location of local java installation Sniffing
            the URL classpath allows to retrieve the URLs of the
            bootstrap class path and therefore the JDK installation
            directory.</p>
	  <p>Exposure of local user name to an untrusted applet An
            attacker could use the sun.security.krb5.Credentials class
            to retrieve the name of the currently logged in user and
            parse his home directory from the information which is
            provided by the thrown
            java.security.AccessControlException.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <mlist msgid="Pine.A41.4.58.0411191800510.57436@zivunix.uni-muenster.de">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110088923127820</mlist>
    </references>
    <dates>
      <discovery>2004-11-19</discovery>
      <entry>2005-01-24</entry>
    </dates>
  </vuln>

  <vuln vid="045944a0-6bca-11d9-aaa6-000a95bc6fae">
    <topic>sudo -- environmental variable CDPATH is not cleared</topic>
    <affects>
      <package>
	<name>sudo</name>
	<range><lt>1.6.8.4</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A sudo bug report says:</p>
	<blockquote cite="http://www.sudo.ws/bugs/show_bug.cgi?id=155">
	  <p>sudo doesn't unset the CDPATH variable, which leads to
	    possible security problems.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <url>http://www.sudo.ws/bugs/show_bug.cgi?id=155</url>
      <mlist>http://www.sudo.ws/pipermail/sudo-announce/2004-November/000044.html</mlist>
    </references>
    <dates>
      <discovery>2004-10-18</discovery>
      <entry>2005-01-21</entry>
    </dates>
  </vuln>

  <vuln vid="e480ccb2-6bc8-11d9-8dbe-000a95bc6fae">
    <topic>fcron -- multiple vulnerabilities</topic>
    <affects>
      <package>
	<name>fcron</name>
	<range><lt>2.9.5.1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>An iDEFENSE Security Advisory states:</p>
	<blockquote cite="http://www.idefense.com/application/poi/display?id=157&amp;type=vulnerabilities&amp;flashstatus=false">
	  <p>Multiple vulnerabilities have been found in Fcron.</p>
	  <ol>
	    <li>File contents disclosure</li>
	    <li>Configuration Bypass Vulnerability</li>
	    <li>File Removal and Empty File Creation Vulnerability</li>
	    <li>Information Disclosure Vulnerability</li>
	  </ol>
	</blockquote>
      </body>
    </description>
    <references>
      <url>http://www.idefense.com/application/poi/display?id=157&amp;type=vulnerabilities&amp;flashstatus=false</url>
      <cvename>CAN-2004-1030</cvename>
      <cvename>CAN-2004-1031</cvename>
      <cvename>CAN-2004-1032</cvename>
      <cvename>CAN-2004-1033</cvename>
    </references>
    <dates>
      <discovery>2004-11-15</discovery>
      <entry>2005-01-21</entry>
    </dates>
  </vuln>

  <vuln vid="02274fd9-6bc5-11d9-8edb-000a95bc6fae">
    <topic>realplayer -- arbitrary file deletion and other vulnerabilities</topic>
    <affects>
      <package>
	<name>linux-realplayer</name>
	<range><lt>10.0.2</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>An NGSSoftware Insight Security Research Advisory reports:</p>
	<blockquote cite="http://www.ngssoftware.com/advisories/real-03full.txt">
	  <p>Two vulnerabilities have been discovered in RealPlayer
            which may potentially be leveraged to allow remote code
            execution, or may used in combination with the Real
            Metadata Package File Deletion vulnerability to reliably
            delete files from a users system.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <url>http://www.ngssoftware.com/advisories/real-02full.txt</url>
      <url>http://www.ngssoftware.com/advisories/real-03full.txt</url>
      <url>http://service.real.com/help/faq/security/040928_player/EN/</url>
    </references>
    <dates>
      <discovery>2004-10-06</discovery>
      <entry>2005-01-21</entry>
    </dates>
  </vuln>

  <vuln vid="2001103a-6bbd-11d9-851d-000a95bc6fae">
    <topic>imlib -- xpm heap buffer overflows and integer overflows</topic>
    <affects>
      <package>
	<name>imlib</name>
	<range><lt>1.9.15_2</lt></range>
      </package>
      <package>
	<name>imlib2</name>
	<range><lt>1.1.2_1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Pavel Kankovsky reports:</p>
	<blockquote cite="https://bugzilla.fedora.us/show_bug.cgi?id=2051#c11">
	  <p>Imlib affected by a variant of CAN-2004-0782 too.</p>
	  <p>I've discovered more vulnerabilities in Imlib
	    (1.9.13). In particular, it appears to be affected by a
	    variant of Chris Evans' libXpm flaw #1 (CAN-2004-0782, see
	    http://scary.beasts.org/security/CESA-2004-003.txt). Look
	    at the attached image, it kills ee on my 7.3.</p>
	</blockquote>
	<p>The flaws also affect imlib2.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-1025</cvename>
      <cvename>CAN-2004-1026</cvename>
      <bid>11830</bid>
      <url>https://bugzilla.fedora.us/show_bug.cgi?id=2051#c11</url>
      <url>https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=138516</url>
      <url>http://cvs.sourceforge.net/viewcvs.py/enlightenment/e17/libs/imlib2/src/modules/loaders/loader_xpm.c#rev1.3</url>
    </references>
    <dates>
      <discovery>2004-12-06</discovery>
      <entry>2005-01-21</entry>
    </dates>
  </vuln>

  <vuln vid="39953788-6bbb-11d9-8bc9-000a95bc6fae">
    <topic>egroupware -- arbitrary file download in JiNN</topic>
    <affects>
      <package>
	<name>eGroupWare</name>
	<range><lt>1.0.0.006</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>eGroupWare contains a bug in the JiNN component that allows
  	  a remote attacker to download arbitrary files.</p>
      </body>
    </description>
    <references>
      <url>http://cvs.sourceforge.net/viewcvs.py/egroupware/jinn/CHANGELOG#rev1.24</url>
      <mlist>http://sourceforge.net/mailarchive/forum.php?thread_id=5915445&amp;forum_id=35178</mlist>
    </references>
    <dates>
      <discovery>2004-10-15</discovery>
      <entry>2005-01-21</entry>
    </dates>
  </vuln>

  <vuln vid="2c25e762-6bb9-11d9-93db-000a95bc6fae">
    <topic>quake2 -- multiple critical vulnerabilities</topic>
    <affects>
      <package>
	<name>quake2forge</name>
	<range><ge>0</ge></range>
      </package>
      <package>
	<name>quake2lnx</name>
	<range><lt>0.16.2</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>An advisory published by Richard Stanway describes numerous
	  critical vulnerabilities in the Quake II engine:</p>
	<blockquote cite="http://secur1ty.net/advisories/001">
	  <p>Due to unchecked input at various stages in the server,
            remote users are able to cause the server to crash, reveal
            sensitive information or potentially execute arbitrary
            code.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <url>http://secur1ty.net/advisories/001</url>
      <mlist msgid="NGEHLEPKOGIHAIJAMDPKOEHJCGAA.bugtraq@secur1ty.net">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=109892527321706</mlist>
    </references>
    <dates>
      <discovery>2004-10-27</discovery>
      <entry>2005-01-21</entry>
      <modified>2005-03-15</modified>
    </dates>
  </vuln>

  <vuln vid="5c7bb4dd-6a56-11d9-97ec-000c6e8f12ef">
    <topic>konversation  --  shell script command injection</topic>
    <affects>
      <package>
	<name>konversation</name>
	<range><lt>0.15</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Konversation comes with Perl scripts that do not properly escape
	  shell characters on executing a script. This makes it possible
	  to attack Konversation with shell script command injection.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2005-0129</cvename>
      <cvename>CAN-2005-0130</cvename>
      <cvename>CAN-2005-0131</cvename>
      <mlist msgid="200501191739.56585.wouter@coekaerts.be">http://marc.theaimsgroup.com/?l=full-disclosure&amp;m=110616016509114</mlist>
    </references>
    <dates>
      <discovery>2005-01-19</discovery>
      <entry>2005-01-19</entry>
      <modified>2005-01-21</modified>
    </dates>
  </vuln>

  <vuln vid="7a921e9e-68b1-11d9-9e1e-c296ac722cb3">
    <topic>squid -- no sanity check of usernames in squid_ldap_auth</topic>
    <affects>
      <package>
	<name>squid</name>
	<range><lt>2.5.7_7</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The LDAP authentication helper did not strip
	  leading or trailing spaces from the login name.
	  According to the squid patches page:</p>
	<blockquote cite="http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-ldap_spaces">
	  <p>LDAP is very forgiving about spaces in search
	    filters and this could be abused to log in
	    using several variants of the login name,
	    possibly bypassing explicit access controls
	    or confusing accounting.</p>
	  <p>Workaround: Block logins with spaces</p>
	    <pre>
	    acl login_with_spaces proxy_auth_regex [:space:]
		    http_access deny login_with_spaces
	    </pre>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CAN-2005-0173</cvename>
      <url>http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-ldap_spaces</url>
      <url>http://www.squid-cache.org/bugs/show_bug.cgi?id=1187</url>
      <certvu>924198</certvu>
    </references>
    <dates>
      <discovery>2005-01-10</discovery>
      <entry>2005-01-19</entry>
      <modified>2005-02-08</modified>
    </dates>
  </vuln>

  <vuln vid="990cf07e-6988-11d9-a9e7-0001020eed82">
    <topic>cups-base -- CUPS server remote DoS vulnerability</topic>
    <affects>
      <package>
	<name>cups-base</name>
	<range><ge>1.1.21</ge><lt>1.1.23</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Kenshi Muto discovered that the CUPS server would enter an
	  infinite loop when processing a URL containing
	  <q><code>/..</code></q>.</p>
      </body>
    </description>
    <references>
      <bid>12200</bid>
      <url>http://www.cups.org/str.php?L1042</url>
    </references>
    <dates>
      <discovery>2004-12-30</discovery>
      <entry>2005-01-18</entry>
    </dates>
  </vuln>

  <vuln vid="b58ff497-6977-11d9-ae49-000c41e2cdad">
    <topic>tiff -- divide-by-zero denial-of-service</topic>
    <affects>
      <package>
	<name>tiff</name>
	<name>linux-tiff</name>
	<range><lt>3.6.0</lt></range>
      </package>
      <package>
	<name>pdflib</name>
	<range><lt>6.0.1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A US-CERT vulnerability note reports:</p>
	<blockquote cite="http://www.kb.cert.org/vuls/id/555304">
	  <p>An Integer overflow in the LibTIFF library may allow a
	    remote attacker to cause a divide-by-zero error that results
	    in a denial-of-service condition.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-0804</cvename>
      <certvu>555304</certvu>
      <url>http://bugzilla.remotesensing.org/show_bug.cgi?id=111</url>
    </references>
    <dates>
      <discovery>2002-03-27</discovery>
      <entry>2005-01-18</entry>
    </dates>
  </vuln>

  <vuln vid="249a8c42-6973-11d9-ae49-000c41e2cdad">
    <topic>zgv -- exploitable heap overflows</topic>
    <affects>
      <package>
	<name>zgv</name>
	<range><lt>5.8_1</lt></range>
      </package>
      <package>
	<name>xzgv</name>
	<range><lt>0.8_2</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>infamous41md reports:</p>
	<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=109886210702781">
	  <p>zgv uses malloc() frequently to allocate memory for storing
	    image data.  When calculating how much to allocate, user
	    supplied data from image headers is multiplied and/or added
	    without any checks for arithmetic overflows.  We can
	    overflow numerous calculations, and cause small buffers to
	    be allocated.  Then we can overflow the buffer, and
	    eventually execute code.  There are a total of
	    11 overflows that are exploitable to execute arbitrary
	    code.</p>
	</blockquote>
	<p>These bugs exist in both zgv and xzgv.</p>
      </body>
    </description>
    <references>
      <mlist msgid="20041025210717.2799d9c1.infamous41md@hotpop.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=109886210702781</mlist>
      <mlist msgid="20041027233907.A3678@netdirect.ca">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=109898111915661</mlist>
      <url>http://rus.members.beeb.net/xzgv.html</url>
      <url>http://www.svgalib.org/rus/zgv/</url>
      <cvename>CAN-2004-0994</cvename>
      <url>http://www.idefense.com/application/poi/display?id=160&amp;type=vulnerabilities&amp;flashstatus=false</url>
    </references>
    <dates>
      <discovery>2004-10-26</discovery>
      <entry>2005-01-18</entry>
      <modified>2005-01-21</modified>
    </dates>
  </vuln>

  <vuln vid="a77849a5-696f-11d9-ae49-000c41e2cdad">
    <topic>mozilla -- insecure permissions for some downloaded files</topic>
    <affects>
      <package>
        <name>thunderbird</name>
	<range><lt>0.9</lt></range>
      </package>
      <package>
        <name>de-linux-mozillafirebird</name>
	<name>el-linux-mozillafirebird</name>
        <name>firefox</name>
        <name>ja-linux-mozillafirebird-gtk1</name>
        <name>ja-mozillafirebird-gtk2</name>
        <name>linux-mozillafirebird</name>
        <name>ru-linux-mozillafirebird</name>
        <name>zhCN-linux-mozillafirebird</name>
        <name>zhTW-linux-mozillafirebird</name>
	<range><lt>1.0.r2,1</lt></range>
      </package>
      <package>
        <name>de-netscape7</name>
        <name>fr-netscape7</name>
        <name>ja-netscape7</name>
        <name>netscape7</name>
        <name>pt_BR-netscape7</name>
	<range><le>7.2</le></range>
      </package>
      <package>
        <name>mozilla-gtk1</name>
        <name>linux-mozilla</name>
        <name>linux-mozilla-devel</name>
        <range><lt>1.7.5</lt></range>
      </package>
      <package>
	<name>mozilla</name>
	<range><lt>1.7.5,2</lt></range>
      </package>
      <package>
	<!-- These package names are obsolete. -->
        <name>de-linux-netscape</name>
        <name>fr-linux-netscape</name>
        <name>ja-linux-netscape</name>
        <name>linux-netscape</name>
        <name>linux-phoenix</name>
        <name>mozilla+ipv6</name>
        <name>mozilla-embedded</name>
        <name>mozilla-firebird</name>
        <name>mozilla-gtk2</name>
        <name>mozilla-gtk</name>
        <name>mozilla-thunderbird</name>
        <name>phoenix</name>
	<range><ge>0</ge></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>In a Mozilla bug report, Daniel Kleinsinger writes:</p>
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=251297">
	  <p>I was comparing treatment of attachments opened directly
	    from emails on different platforms. I discovered that Linux
	    builds save attachments in /tmp with world readable rights.
	    This doesn't seem like a good thing. Couldn't someone else
	    logged onto the same machine read your attachments?</p>
	</blockquote>
	<p>This could expose the contents of downloaded files or email
	  attachments to other users on a multi-user system.</p>
      </body>
    </description>
    <references>
      <url>https://bugzilla.mozilla.org/show_bug.cgi?id=251297</url>
      <mlist msgid="417C19F1.2040107@ptraced.net">http://marc.theaimsgroup.com/?l=full-disclosure&amp;m=109865078103911</mlist>
    </references>
    <dates>
      <discovery>2004-07-13</discovery>
      <entry>2005-01-18</entry>
    </dates>
  </vuln>

  <vuln vid="0f5a2b4d-694b-11d9-a9e7-0001020eed82">
    <topic>awstats -- remote command execution vulnerability</topic>
    <affects>
      <package>
	<name>awstats</name>
	<range><lt>6.3</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>An iDEFENSE Security Advisory  reports:</p>
	<blockquote cite="http://marc.theaimsgroup.com/?l=full-disclosure&amp;m=110600949323439">
	  <p>Remote exploitation of an input validation vulnerability
	    in AWStats allows attackers to execute arbitrary commands
	    under the privileges of the web server.</p>
	  <p>The problem specifically exists when the application is
	    running as a CGI script on a web server. The "configdir"
	    parameter contains unfiltered user-supplied data that is
	    utilized in a call to the Perl routine open()...</p>
	  <p>Successful exploitation allows remote attackers to
	    execute arbitrary commands under the privileges of the web
	    server. This can lead to further compromise as it provides
	    remote attackers with local access.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <bid>12270</bid>
      <cvename>CAN-2005-0116</cvename>
      <certvu>272296</certvu>
      <mlist msgid="FB24803D1DF2A34FA59FC157B77C970503C8B20C@idserv04.idef.com">http://marc.theaimsgroup.com/?l=full-disclosure&amp;m=110600949323439</mlist>
      <url>http://awstats.sourceforge.net/docs/awstats_changelog.txt</url>
      <url>http://www.idefense.com/application/poi/display?id=185&amp;type=vulnerabilities&amp;flashstatus=false</url>
    </references>
    <dates>
      <discovery>2004-10-21</discovery>
      <entry>2005-01-18</entry>
      <modified>2005-02-23</modified>
    </dates>
  </vuln>

  <vuln vid="597e2bee-68ea-11d9-a9e7-0001020eed82">
    <topic>ImageMagick -- PSD handler heap overflow vulnerability</topic>
    <affects>
      <package>
	<name>ImageMagick</name>
	<range><lt>6.1.8.8</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>An iDEFENSE Security Advisory reports:</p>
	<blockquote cite="http://www.idefense.com/application/poi/display?id=184&amp;type=vulnerabilities">
	  <p>Remote exploitation of a buffer overflow vulnerability in
	    The ImageMagick's Project's ImageMagick PSD image-decoding
	    module could allow an attacker to execute arbitrary
	    code.</p>
	  <p>Exploitation may allow attackers to run arbitrary code on
	    a victim's computer if the victim opens a specially
	    formatted image. Such images could be delivered by e-mail
	    or HTML, in some cases, and would likely not raise
	    suspicion on the victim's part. Exploitation is also
	    possible when a web-based application uses ImageMagick to
	    process user-uploaded image files.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CAN-2005-0005</cvename>
      <url>http://www.idefense.com/application/poi/display?id=184&amp;type=vulnerabilities</url>
    </references>
    <dates>
      <discovery>2004-12-21</discovery>
      <entry>2005-01-18</entry>
    </dates>
  </vuln>

  <vuln vid="7850a238-680a-11d9-a9e7-0001020eed82">
    <topic>cups-lpr -- lppasswd multiple vulnerabilities</topic>
    <affects>
      <package>
	<name>cups-lpr</name>
	<name>fr-cups-lpr</name>
	<range><lt>1.1.23</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>D. J. Bernstein reports that Bartlomiej Sieka has
	  discovered several security vulnerabilities in lppasswd,
	  which is part of CUPS.  In the following excerpt from
	  Bernstein's email, CVE names have been added for each issue:</p>
	<blockquote cite="http://tigger.uic.edu/~jlongs2/holes/cups2.txt">
	  <p>First, lppasswd blithely ignores write errors in
	    fputs(line,outfile) at lines 311 and 315 of lppasswd.c,
	    and in fprintf(...) at line 346. An attacker who fills up
	    the disk at the right moment can arrange for
	    /usr/local/etc/cups/passwd to be truncated.
	    <em>(CAN-2004-1268)</em></p>
	  <p>Second, if lppasswd bumps into a file-size resource limit
	    while writing passwd.new, it leaves passwd.new in place,
	    disabling all subsequent invocations of lppasswd. Any
	    local user can thus disable lppasswd...
	    <em>(CAN-2004-1269)</em></p>
	  <p>Third, line 306 of lppasswd.c prints an error message to
	    stderr but does not exit. This is not a problem on systems
	    that ensure that file descriptors 0, 1, and 2 are open for
	    setuid programs, but it is a problem on other systems;
	    lppasswd does not check that passwd.new is different from
	    stderr, so it ends up writing a user-controlled error
	    message to passwd if the user closes file descriptor
	    2. <em>(CAN-2004-1270)</em></p>
	</blockquote>
	<p><strong>Note:</strong> The third issue, CAN-2004-1270, does
	  not affect FreeBSD 4.6-RELEASE or later systems, as these
	  systems ensure that the file descriptors 0, 1, and 2 are
	  always open for set-user-ID and set-group-ID programs.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-1268</cvename>
      <cvename>CAN-2004-1269</cvename>
      <cvename>CAN-2004-1270</cvename>
      <bid>12007</bid>
      <bid>12004</bid>
      <url>http://www.cups.org/str.php?L1023</url>
      <url>http://tigger.uic.edu/~jlongs2/holes/cups2.txt</url>
    </references>
    <dates>
      <discovery>2004-12-11</discovery>
      <entry>2005-01-17</entry>
    </dates>
  </vuln>

  <vuln vid="40a3bca2-6809-11d9-a9e7-0001020eed82">
    <topic>cups-base -- HPGL buffer overflow vulnerability</topic>
    <affects>
      <package>
	<name>cups-base</name>
	<name>fr-cups-base</name>
	<range><lt>1.1.22.0_2</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Ariel Berkman has discovered a buffer overflow
	  vulnerability in CUPS's HPGL input driver.  This
	  vulnerability could be exploited to execute arbitrary code
	  with the permission of the CUPS server by printing a
	  specially crated HPGL file.</p>
      </body>
    </description>
    <references>
      <bid>11968</bid>
      <cvename>CAN-2004-1267</cvename>
      <url>http://tigger.uic.edu/~jlongs2/holes/cups.txt</url>
      <url>http://www.cups.org/str.php?L1024</url>
    </references>
    <dates>
      <discovery>2004-12-15</discovery>
      <entry>2005-01-17</entry>
    </dates>
  </vuln>

  <vuln vid="ce109fd4-67f3-11d9-a9e7-0001020eed82">
    <topic>mysql-scripts -- mysqlaccess insecure temporary file creation</topic>
    <affects>
      <package>
	<name>mysql-scripts</name>
	<range><lt>3.23.58_2</lt></range>
	<range><gt>4.*</gt><lt>4.0.23a_1</lt></range>
	<range><gt>4.1.*</gt><lt>4.1.9_1</lt></range>
	<range><gt>5.*</gt><lt>5.0.2_1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Debian Security Team reports:</p>
	<blockquote>
	  <p>Javier Fernández-Sanguino Peña from the Debian Security
	    Audit Project discovered a temporary file vulnerability in
	    the mysqlaccess script of MySQL that could allow an
	    unprivileged user to let root overwrite arbitrary files
	    via a symlink attack and could also could unveil the
	    contents of a temporary file which might contain sensitive
	    information.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CAN-2005-0004</cvename>
      <url>http://lists.mysql.com/internals/20600</url>
    </references>
    <dates>
      <discovery>2005-01-12</discovery>
      <entry>2005-01-16</entry>
      <modified>2005-01-17</modified>
    </dates>
  </vuln>

  <vuln vid="f2d5e56e-67eb-11d9-a9e7-0001020eed82">
    <topic>unrtf -- buffer overflow vulnerability</topic>
    <affects>
      <package>
	<name>unrtf</name>
	<range><lt>0.19.3_1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Yosef Klein and Limin Wang have found a buffer overflow
	  vulnerability in unrtf that can allow an attacker to execute
	  arbitrary code with the permissions of the user running
	  unrtf, by running unrtf on a specially crafted rtf
	  document.</p>
      </body>
    </description>
    <references>
      <bid>12030</bid>
      <cvename>CAN-2004-1297</cvename>
      <url>http://tigger.uic.edu/~jlongs2/holes/unrtf.txt</url>
    </references>
    <dates>
      <discovery>2004-12-15</discovery>
      <entry>2005-01-16</entry>
      <modified>2005-02-11</modified>
    </dates>
  </vuln>

  <vuln vid="3fbf9db2-658b-11d9-abad-000a95bc6fae">
    <topic>mozilla -- heap overflow in NNTP handler</topic>
    <affects>
      <package>
        <name>de-netscape7</name>
        <name>fr-netscape7</name>
        <name>ja-netscape7</name>
        <name>netscape7</name>
        <name>pt_BR-netscape7</name>
	<range><gt>0</gt></range>
      </package>
      <package>
        <name>mozilla-gtk1</name>
        <name>linux-mozilla</name>
        <name>linux-mozilla-devel</name>
        <range><lt>1.7.5</lt></range>
      </package>
      <package>
	<name>mozilla</name>
	<range><lt>1.7.5,2</lt></range>
      </package>
      <package>
	<!-- These package names are obsolete. -->
        <name>de-linux-netscape</name>
        <name>fr-linux-netscape</name>
        <name>ja-linux-netscape</name>
        <name>linux-netscape</name>
        <name>mozilla+ipv6</name>
        <name>mozilla-embedded</name>
        <name>mozilla-gtk2</name>
        <name>mozilla-gtk</name>
	<range><ge>0</ge></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Maurycy Prodeus reports a critical vulnerability in
	  Mozilla-based browsers:</p>
	<blockquote cite="http://isec.pl/vulnerabilities/isec-0020-mozilla.txt">
	  <p>Mozilla browser supports NNTP urls. Remote side is able to
	    trigger  news:// connection to any server. I found a flaw in
	    NNTP handling code which may cause heap overflow and allow
	    remote attacker to execute arbitrary code on client
	    machine.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-1316</cvename>
      <url>http://isec.pl/vulnerabilities/isec-0020-mozilla.txt</url>
      <mlist msgid="Pine.LNX.4.44.0412292228440.19239-200000@isec.pl">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110436284718949</mlist>
    </references>
    <dates>
      <discovery>2004-12-29</discovery>
      <entry>2005-01-13</entry>
    </dates>
  </vuln>

  <vuln vid="3cc84400-6576-11d9-a9e7-0001020eed82">
    <topic>mpg123 -- buffer overflow vulnerability</topic>
    <affects>
      <package>
	<name>mpg123</name>
	<name>mpg123-nas</name>
	<name>mpg123-esound</name>
	<range><lt>0.59r_17</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Yuri D'Elia has found a buffer overflow vulnerability in
	  mpg123's parsing of frame headers in input streams.  This
	  vulnerability can potentially lead to execution of arbitrary
	  code with the permissions of the user running mpg123, if the
	  user runs mpg123 on a specially crafted MP2 or MP3 file.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-0991</cvename>
    </references>
    <dates>
      <discovery>2005-01-01</discovery>
      <entry>2005-01-13</entry>
    </dates>
  </vuln>

  <vuln vid="5fe7e27a-64cb-11d9-9e1e-c296ac722cb3">
    <topic>squid -- denial of service with forged WCCP messages</topic>
    <affects>
      <package>
	<name>squid</name>
	<range><lt>2.5.7_6</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The squid patches page notes:</p>
	<blockquote cite="http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-wccp_denial_of_service">
	  <p>WCCP_I_SEE_YOU messages contain a 'number of caches'
	    field which should be between 1 and 32. Values outside
	    that range may crash Squid if WCCP is enabled, and if an
	    attacker can spoof UDP packets with the WCCP router's IP
	    address.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CAN-2005-0095</cvename>
      <url>http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-wccp_denial_of_service</url>
      <url>http://www.squid-cache.org/bugs/show_bug.cgi?id=1190</url>
      <url>http://www.squid-cache.org/Advisories/SQUID-2005_2.txt</url>
    </references>
    <dates>
      <discovery>2005-01-07</discovery>
      <entry>2005-01-12</entry>
      <modified>2005-01-22</modified>
    </dates>
  </vuln>

  <vuln vid="184ab9e0-64cd-11d9-9e1e-c296ac722cb3">
    <topic>squid -- buffer overflow vulnerability in gopherToHTML</topic>
    <affects>
      <package>
	<name>squid</name>
	<range><lt>2.5.7_6</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The squid patches page notes:</p>
	<blockquote cite="http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-gopher_html_parsing">
	  <p>A malicious gopher server may return a response with very
	    long lines that cause a buffer overflow in Squid.</p>
	  <p>Workaround: Since gopher is very obscure these days, do
	    not allow Squid to any gopher servers. Use an ACL rule
	    like:</p>
	  <pre>acl Gopher proto gopher
http_access deny Gopher</pre>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CAN-2005-0094</cvename>
      <url>http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-gopher_html_parsing</url>
      <url>http://www.squid-cache.org/bugs/show_bug.cgi?id=1189</url>
      <url>http://www.squid-cache.org/Advisories/SQUID-2005_1.txt</url>
    </references>
    <dates>
      <discovery>2005-01-11</discovery>
      <entry>2005-01-12</entry>
      <modified>2005-01-22</modified>
    </dates>
  </vuln>

  <vuln vid="131bd7c4-64a3-11d9-829a-000a95bc6fae">
    <topic>libxine -- DVD subpicture decoder heap overflow</topic>
    <affects>
      <package>
	<name>libxine</name>
	<range><lt>1.0.r6</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A xine security announcement states:</p>
	<blockquote cite="http://xinehq.de/index.php/security/XSA-2004-5">
	  <p>A heap overflow has been found in the DVD subpicture
	    decoder of xine-lib. This can be used for a remote heap
	    overflow exploit, which can, on some systems, lead to or
	    help in executing malicious code with the permissions of the
	    user running a xine-lib based media application.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-1379</cvename>
      <url>http://xinehq.de/index.php/security/XSA-2004-5</url>
    </references>
    <dates>
      <discovery>2004-09-06</discovery>
      <entry>2005-01-12</entry>
      <modified>2005-01-19</modified>
    </dates>
  </vuln>

  <vuln vid="b6939d5b-64a1-11d9-9106-000a95bc6fae">
    <topic>libxine -- multiple vulnerabilities in VideoCD handling</topic>
    <affects>
      <package>
	<name>libxine</name>
	<range><ge>1.0.r2</ge><lt>1.0.r6</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A xine security announcement states:</p>
	<blockquote cite="http://xinehq.de/index.php/security/XSA-2004-4">
	  <p>Several string overflows on the stack have been fixed in
	    xine-lib, some of them can be used for remote buffer
	    overflow exploits leading to the execution of arbitrary code
	    with the permissions of the user running a xine-lib based
	    media application.</p>
	  <p>Stack-based string overflows have been found:</p>
	  <ol>
	    <li>in the code which handles VideoCD MRLs</li>
	    <li>in VideoCD code reading the disc label</li>
	    <li>in the code which parses text subtitles and prepares
	      them for display</li>
	  </ol>
	</blockquote>
      </body>
    </description>
    <references>
      <url>http://xinehq.de/index.php/security/XSA-2004-4</url>
    </references>
    <dates>
      <discovery>2004-09-07</discovery>
      <entry>2005-01-12</entry>
    </dates>
  </vuln>

  <vuln vid="1b70bef4-649f-11d9-a30e-000a95bc6fae">
    <topic>libxine -- multiple buffer overflows in RTSP</topic>
    <affects>
      <package>
	<name>mplayer</name>
	<name>mplayer-gtk</name>
	<name>mplayer-gtk2</name>
	<name>mplayer-esound</name>
	<name>mplayer-gtk-esound</name>
	<name>mplayer-gtk2-esound</name>
	<range><lt>0.99.4</lt></range>
      </package>
      <package>
	<name>libxine</name>
	<range><lt>1.0.r4</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A xine security announcement states:</p>
	<blockquote cite="http://xinehq.de/index.php/security/XSA-2004-3">
	  <p>Multiple vulnerabilities have been found and fixed in the
	    Real-Time Streaming Protocol (RTSP) client for RealNetworks
	    servers, including a series of potentially remotely
	    exploitable buffer overflows. This is a joint advisory by
	    the MPlayer and xine teams as the code in question is common
	    to these projects.</p>
	  <p>Severity: High (arbitrary remote code execution under the
	    user ID running the player) when playing Real RTSP streams.
	    At this time, there is no known exploit for these
	    vulnerabilities.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-0433</cvename>
      <url>http://xinehq.de/index.php/security/XSA-2004-3</url>
      <url>http://xforce.iss.net/xforce/xfdb/16019</url>
      <bid>10245</bid>
    </references>
    <dates>
      <discovery>2004-05-25</discovery>
      <entry>2005-01-12</entry>
    </dates>
  </vuln>

  <vuln vid="8eabaad9-641f-11d9-92a7-000a95bc6fae">
    <topic>hylafax -- unauthorized login vulnerability</topic>
    <affects>
      <package>
	<name>hylafax</name>
	<range><lt>4.2.1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A flaw in HylaFAX may allow an attacker to bypass normal
	  authentication by spoofing their DNS PTR records.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-1182</cvename>
      <mlist msgid="20050111155949.GU9853@bilbo.x101.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110546971307585</mlist>
    </references>
    <dates>
      <discovery>2005-01-11</discovery>
      <entry>2005-01-11</entry>
    </dates>
  </vuln>

  <vuln vid="56971fa6-641c-11d9-a097-000854d03344">
    <topic>xshisen -- local buffer overflows</topic>
    <affects>
      <package>
        <name>xshisen</name>
        <range><lt>1.36_1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Steve Kemp has found buffer overflows in the handling
	  of the command line flag -KCONV and the XSHISENLIB environment
	  variable.  Ulf Härnhammer has detected an unbounded copy from
          the GECOS field to a char array.  All overflows can be exploited
          to gain group games privileges.</p>
      </body>
    </description>
    <references>
      <url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=213957</url>
      <url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=289784</url>
      <cvename>CAN-2003-1053</cvename>
      <cvename>CAN-2005-0117</cvename>
    </references>
    <dates>
      <discovery>2005-01-11</discovery>
      <entry>2005-01-11</entry>
      <modified>2005-01-19</modified>
    </dates>
  </vuln>

  <vuln vid="0cf3480d-5fdf-11d9-b721-00065be4b5b6">
    <topic>helvis -- arbitrary file deletion problem</topic>
    <affects>
      <package>
        <name>ko-helvis</name>
        <range><le>1.8h2_1</le></range>
      </package>
      <package>
        <name>helvis</name>
        <range><le>1.8h2_1</le></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
        <p>The setuid root elvprsv utility, used to preserve
	 recovery helvis files, can be abused by local users to delete
        with root privileges.</p>
	<p>The problem is that elvprsv deletes files when it thinks they
	have become corrupt. When elvprsv is pointed to a normal file then
	it will almost always think the file is corrupt and deletes it.
	This behavior may be exploited by local attackers to delete critical
	files.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2005-0120</cvename>
      <url>http://people.freebsd.org/~niels/ports/korean/helvis/issues.txt</url>
    </references>
    <dates>
      <discovery>2004-11-24</discovery>
      <entry>2005-01-10</entry>
      <modified>2005-01-19</modified>
    </dates>
  </vuln>

  <vuln vid="bb99f803-5fde-11d9-b721-00065be4b5b6">
    <topic>helvis -- information leak vulnerabilities</topic>
    <affects>
      <package>
        <name>ko-helvis</name>
        <range><le>1.8h2_1</le></range>
      </package>
      <package>
        <name>helvis</name>
        <range><le>1.8h2_1</le></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Once a recovery file has been preserved by the setuid root elvprsv
	utility it is placed in a worldreadable directory with worldreadable
	permissions.  This possibly allows sensitive information to leak.</p>
	<p>In addition to this information leak, it is possible for users
	to recover files that belong to other users by using elvrec, another
	setuid root binary.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2005-0118</cvename>
      <cvename>CAN-2005-0119</cvename>
      <url>http://people.freebsd.org/~niels/ports/korean/helvis/issues.txt</url>
    </references>
    <dates>
      <discovery>2004-11-24</discovery>
      <entry>2005-01-10</entry>
      <modified>2005-01-19</modified>
    </dates>
  </vuln>

  <vuln vid="28ab7ddf-61ab-11d9-a9e7-0001020eed82">
    <topic>dillo -- format string vulnerability</topic>
    <affects>
      <package>
	<name>dillo</name>
	<range><lt>0.8.3_1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>dillo contains a format string vulnerability which could
	  lead to execution of arbitrary code simply by viewing a web
	  page or opening a HTML file.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2005-0012</cvename>
      <url>http://bugs.gentoo.org/show_bug.cgi?id=76665</url>
    </references>
    <dates>
      <discovery>2005-01-04</discovery>
      <entry>2005-01-08</entry>
    </dates>
  </vuln>

  <vuln vid="f92e1bbc-5e18-11d9-839a-0050da134090">
    <topic>tnftp -- mget does not check for directory escapes</topic>
    <affects>
      <package>
        <name>tnftp</name>
        <range><lt>20050103</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
        <p>When downloading a batch of files from an FTP server the
         mget command does not check for directory escapes.  A
         specially crafted file on the FTP server could then
         potentially overwrite an existing file of the user.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-1294</cvename>
      <url>http://tigger.uic.edu/~jlongs2/holes/tnftp.txt</url>
      <url>http://cvsweb.netbsd.org/bsdweb.cgi/othersrc/usr.bin/tnftp/src/cmds.c?rev=1.1.1.3&amp;content-type=text/x-cvsweb-markup</url>
      <url>http://it.slashdot.org/article.pl?sid=04/12/15/2113202</url>
      <mlist msgid="653D74053BA6F54A81ED83DCF969DF08CFA2AA@pivxes1.pivx.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110321888413132</mlist>
    </references>
    <dates>
      <discovery>2004-12-15</discovery>
      <entry>2005-01-07</entry>
      <modified>2005-01-13</modified>
    </dates>
  </vuln>

  <vuln vid="8f86d8b5-6025-11d9-a9e7-0001020eed82">
    <topic>tiff -- tiffdump integer overflow vulnerability</topic>
    <affects>
      <package>
	<name>tiff</name>
	<range><lt>3.7.1_2</lt></range>
      </package>
      <package>
	<name>linux-tiff</name>
	<range><lt>3.6.1_1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Dmitry V. Levin found a potential integer overflow in the
	  tiffdump utility which could lead to execution of arbitrary
	  code.  This could be exploited by tricking an user into
	  executing tiffdump on a specially crafted tiff image.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-1183</cvename>
    </references>
    <dates>
      <discovery>2005-01-06</discovery>
      <entry>2005-01-06</entry>
      <modified>2005-03-01</modified>
    </dates>
  </vuln>

  <vuln vid="fc7e6a42-6012-11d9-a9e7-0001020eed82">
    <topic>tiff -- directory entry count integer overflow vulnerability</topic>
    <affects>
      <package>
	<name>tiff</name>
	<range><lt>3.7.1</lt></range>
      </package>
      <package>
	<name>linux-tiff</name>
	<range><lt>3.6.1_1</lt></range>
      </package>
      <package>
	<name>pdflib</name>
	<range><lt>6.0.1_1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>In an iDEFENSE Security Advisory infamous41md reports:</p>
	<blockquote cite="http://www.idefense.com/application/poi/display?id=174&amp;type=vulnerabilities">
	  <p>Remote exploitation of a heap-based buffer overflow
	    vulnerability within the LibTIFF package could allow
	    attackers to execute arbitrary code.</p>
	  <p>The vulnerability specifically exists due to insufficient
	    validation of user-supplied data when calculating the size
	    of a directory entry. A TIFF file includes a number of
	    directory entry header fields that describe the data in
	    the file. Included in these entries is an entry count and
	    offset value that are calculated to determine the size and
	    location of the data for that entry.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <bid>12075</bid>
      <cvename>CAN-2004-1308</cvename>
      <url>http://www.idefense.com/application/poi/display?id=174&amp;type=vulnerabilities</url>
      <certvu>125598</certvu>
    </references>
    <dates>
      <discovery>2004-12-17</discovery>
      <entry>2005-01-06</entry>
      <modified>2005-02-28</modified>
    </dates>
  </vuln>

  <vuln vid="14e8f315-600e-11d9-a9e7-0001020eed82">
    <cancelled superseded="3897a2f8-1d57-11d9-bc4a-000c41e2cdad" />
  </vuln>

  <vuln vid="bd9fc2bf-5ffe-11d9-a11a-000a95bc6fae">
    <topic>vim -- vulnerabilities in modeline handling</topic>
    <affects>
      <package>
	<name>vim</name>
	<name>vim-lite</name>
	<name>vim+ruby</name>
	<range><lt>6.3.45</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Ciaran McCreesh discovered news ways in which a VIM modeline
	  can be used to trojan a text file.  The patch by Bram
	  Moolenaar reads:</p>
	<blockquote cite="ftp://ftp.vim.org/pub/vim/patches/6.3/6.3.045">
	  <p>Problem: Unusual characters in an option value may cause
	    unexpected behavior, especially for a modeline. (Ciaran
	    McCreesh)</p>
	  <p>Solution: Don't allow setting termcap options or
	    'printdevice' or 'titleold' in a modeline. Don't list
	    options for "termcap" and "all" in a modeline. Don't allow
	    unusual characters in 'filetype', 'syntax', 'backupext',
	    'keymap', 'patchmode' and 'langmenu'.</p>
	</blockquote>
	<p><strong>Note:</strong> It is generally recommended that VIM
	  users use <code>set nomodeline</code> in
	  <code>~/.vimrc</code> to avoid the possibility of trojaned
	  text files.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-1138</cvename>
      <url>ftp://ftp.vim.org/pub/vim/patches/6.3/6.3.045</url>
      <mlist>http://groups.yahoo.com/group/vimdev/message/38084</mlist>
    </references>
    <dates>
      <discovery>2004-12-09</discovery>
      <entry>2005-01-06</entry>
      <modified>2005-01-13</modified>
    </dates>
  </vuln>

  <vuln vid="58fc2752-5f74-11d9-a9e7-0001020eed82">
    <topic>pcal -- buffer overflow vulnerabilities</topic>
    <affects>
      <package>
	<name>pcal</name>
	<range><lt>4.8.0</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Danny Lungstrom has found two buffer overflow
	  vulnerabilities in pcal which can lead to execution of
	  arbitrary code by making a user run pcal on a specially
	  crafted calendar file.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-1289</cvename>
      <bid>12035</bid>
      <bid>12036</bid>
      <mlist msgid="20041215083219.56092.qmail@cr.yp.to">http://securesoftware.list.cr.yp.to/archive/0/46</mlist>
    </references>
    <dates>
      <discovery>2004-12-15</discovery>
      <entry>2005-01-06</entry>
    </dates>
  </vuln>

  <vuln vid="ca9ce879-5ebb-11d9-a01c-0050569f0001">
    <topic>exim -- two buffer overflow vulnerabilities</topic>
    <affects>
      <package>
        <name>exim</name>
        <name>exim-ldap</name>
        <name>exim-ldap2</name>
        <name>exim-mysql</name>
        <name>exim-postgresql</name>
        <name>exim-sa-exim</name>
        <range><lt>4.43+28_1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>1. The function host_aton() can overflow a buffer
	   if it is presented with an illegal IPv6 address
	   that has more than 8 components.</p>
	<p>2. The second report described a buffer overflow
	   in the function spa_base64_to_bits(), which is part
	   of the code for SPA authentication.</p>
      </body>
    </description>
    <references>
      <mlist msgid="Pine.SOC.4.61.0501041452540.1114@draco.cus.cam.ac.uk">http://www.exim.org/mail-archives/exim-announce/2005/msg00000.html</mlist>
      <mlist msgid="1CE07882ECEE894CA2D5A89B8DEBC4011CFDE5@porgy.admin.idefense.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110573573800377</mlist>
      <cvename>CAN-2005-0021</cvename>
      <cvename>CAN-2005-0022</cvename>
      <bid>12185</bid>
      <bid>12188</bid>
      <bid>12268</bid>
    </references>
    <dates>
      <discovery>2005-01-05</discovery>
      <entry>2005-01-05</entry>
      <modified>2005-01-18</modified>
    </dates>
  </vuln>

  <vuln vid="877e918e-5362-11d9-96d4-00065be4b5b6">
    <topic>mpg123 -- playlist processing buffer overflow vulnerability</topic>
    <affects>
      <package>
        <name>mpg123</name>
        <name>mpg123-nas</name>
        <name>mpg123-esound</name>
        <range><le>0.59r_15</le></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A buffer overflow vulnerability exists in the playlist
	  processing of mpg123. A specially crafted playlist entry
	  can cause a stack overflow that can be used to inject
	  arbitrary code into the mpg123 process </p>
	<p>Note that a malicious playlist, demonstrating this
	  vulnerability, was released by the bug finder and may be
	  used as a template by attackers.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-1284</cvename>
      <url>http://tigger.uic.edu/~jlongs2/holes/mpg123.txt</url>
      <url>http://secunia.com/advisories/13511/</url>
      <url>http://xforce.iss.net/xforce/xfdb/18626</url>
      <bid>11958</bid>
      <mlist msgid="653D74053BA6F54A81ED83DCF969DF08CFA2AA@pivxes1.pivx.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110321888413132</mlist>
    </references>
    <dates>
      <discovery>2004-12-15</discovery>
      <entry>2005-01-03</entry>
      <modified>2005-01-13</modified>
    </dates>
  </vuln>

  <vuln vid="bd579366-5290-11d9-ac20-00065be4b5b6">
    <topic>greed -- insecure GRX file processing</topic>
    <affects>
      <package>
        <name>greed</name>
        <range><le>0.81p</le></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A buffer overflow vulnerability has been detected in the greed
	URL handling code. This bug can especially be a problem when greed is
	used to process GRX (GetRight) files that originate from untrusted
	sources.</p>
	<p>The bug finder, Manigandan Radhakrishnan, gave the following description:</p>
	<blockquote cite='http://tigger.uic.edu/~jlongs2/holes/greed.txt'>
	  <p>Here are the bugs. First, in main.c, DownloadLoop() uses strcat()
	    to copy an input filename to the end of a 128-byte COMMAND array.
	    Second, DownloadLoop() passes the input filename to system() without
	    checking for special characters such as semicolons.</p></blockquote>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-1273</cvename>
      <cvename>CAN-2004-1274</cvename>
      <url>http://tigger.uic.edu/~jlongs2/holes/greed.txt</url>
      <url>http://secunia.com/advisories/13534/</url>
      <mlist msgid="653D74053BA6F54A81ED83DCF969DF08CFA2AA@pivxes1.pivx.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110321888413132</mlist>
    </references>
    <dates>
      <discovery>2004-12-15</discovery>
      <entry>2005-01-03</entry>
      <modified>2005-01-13</modified>
    </dates>
  </vuln>

  <vuln vid="949c470e-528f-11d9-ac20-00065be4b5b6">
    <topic>golddig -- local buffer overflow vulnerabilities</topic>
    <affects>
      <package>
        <name>golddig</name>
        <range><le>2.0</le></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
        <p>Two buffer overflow vulnerabilities where detected. Both issues can
	be used by local users to gain group games privileges on affected systems.</p>
        <p>The first overflow exists in the map name handling and can be triggered
        when a very long name is given to the program during command-line execution</p>
         <p>The second overflow exists in the username processing while writing
	the players score to disk. Excessivly long usernames, set via the USER environment
	variable, are stored without any length checks in a memory buffer.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2005-0121</cvename>
      <mlist msgid="200412021055.iB2AtweU067125@repoman.freebsd.org">http://docs.FreeBSD.org/cgi/mid.cgi?200412021055.iB2AtweU067125</mlist>
    </references>
    <dates>
      <discovery>2004-11-11</discovery>
      <entry>2005-01-03</entry>
      <modified>2005-01-19</modified>
    </dates>
  </vuln>

  <vuln vid="927743d4-5ca9-11d9-a9e7-0001020eed82">
    <topic>up-imapproxy -- multiple vulnerabilities</topic>
    <affects>
      <package>
	<name>up-imapproxy</name>
	<range><lt>1.2.2</lt></range>
      </package>
      <package>
	<name>pop3proxy</name>
	<range><le>1.1</le></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Timo Sirainen reports:</p>
	<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=109995749510773">
	  <p>There are various bugs in up-imapproxy which can crash
	    it. Since up-imapproxy runs in a single process with each
	    connection handled in a separate thread, any crash kills
	    all the connections and stops listening for new ones.</p>
	  <p>In 64bit systems it might be possible to make it leak
	    data (mails, passwords, ..) from other connections to
	    attacker's connection. However I don't think up-imapproxy
	    actually works in any 64bit system so this is just a
	    theoretical problem.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-1035</cvename>
      <bid>11630</bid>
      <mlist msgid="1099851138.3716.3.camel@hurina">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=109995749510773</mlist>
    </references>
    <dates>
      <discovery>2004-11-17</discovery>
      <entry>2005-01-02</entry>
      <modified>2005-01-13</modified>
    </dates>
  </vuln>

  <vuln vid="832e9d75-5bfc-11d9-a9e7-0001020eed82">
    <topic>kdelibs3 -- konqueror FTP command injection vulnerability</topic>
    <affects>
      <package>
	<name>ja-kdelibs</name>
	<name>kdelibs</name>
	<range><lt>3.3.2_2</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Albert Puigsech Galicia reports that Konqueror (more
	  specifically kio_ftp) and Microsoft Internet Explorer are
	  vulnerable to a FTP command injection vulnerability which
	  can be exploited by tricking an user into clicking a
	  specially crafted FTP URI.</p>
	<p>It is also reported by Ian Gulliver and Emanuele Balla that
	  this vulnerability can be used to tricking a client into
	  sending out emails without user interaction.</p>
      </body>
    </description>
    <references>
      <bid>11827</bid>
      <cvename>CAN-2004-1165</cvename>
      <mlist msgid="200412051011.54045.ripe@7a69ezine.org">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110245752232681</mlist>
      <mlist msgid="20041223235620.GA2846@penguinhosting.net">http://marc.theaimsgroup.com/?l=full-disclosure&amp;m=110387390226693</mlist>
      <mlist msgid="20041224142506.GB12939@penguinhosting.net">http://marc.theaimsgroup.com/?l=full-disclosure&amp;m=110390734925183</mlist>
      <url>http://www.kde.org/info/security/advisory-20050101-1.txt</url>
    </references>
    <dates>
      <discovery>2004-12-01</discovery>
      <entry>2005-01-01</entry>
      <modified>2005-01-04</modified>
    </dates>
  </vuln>

  <vuln vid="9168253c-5a6d-11d9-a9e7-0001020eed82">
    <topic>a2ps -- insecure temporary file creation</topic>
    <affects>
      <package>
	<name>a2ps-a4</name>
	<name>a2ps-letter</name>
	<name>a2ps-letterdj</name>
	<range><lt>4.13b_3</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A Secunia Security Advisory reports that Javier
	  Fernández-Sanguino Peña has found temporary file
	  creation vulnerabilities in the fixps and psmandup scripts
	  which are part of a2ps.  These vulnerabilities could lead to
	  an attacker overwriting arbitrary files with the credentials
	  of the user running the vulnerable scripts.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-1377</cvename>
      <bid>12108</bid>
      <bid>12109</bid>
      <url>http://secunia.com/advisories/13641/</url>
    </references>
    <dates>
      <discovery>2004-12-27</discovery>
      <entry>2004-12-30</entry>
      <modified>2005-01-19</modified>
    </dates>
  </vuln>

  <vuln vid="64c8cc2a-59b1-11d9-8a99-000c6e8f12ef">
    <topic>libxine -- buffer-overflow vulnerability in aiff support</topic>
    <affects>
      <package>
	<name>libxine</name>
	<range><le>1.0.r5_3</le></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Due to a buffer overflow in the open_aiff_file function in
	  demux_aiff.c, a remote attacker is able to execute arbitrary
	  code via a modified AIFF file.</p></body>
    </description>
    <references>
      <cvename>CAN-2004-1300</cvename>
      <url>http://tigger.uic.edu/~jlongs2/holes/xine-lib.txt</url>
      <url>http://xinehq.de/index.php/security/XSA-2004-7</url>
    </references>
    <dates>
      <discovery>2004-12-15</discovery>
      <entry>2004-12-29</entry>
      <modified>2005-01-12</modified>
    </dates>
  </vuln>

  <vuln vid="2e25d38b-54d1-11d9-b612-000c6e8f12ef">
    <topic>jabberd -- denial-of-service vulnerability</topic>
    <affects>
      <package>
	<name>jabber</name>
	<range><lt>1.4.3.1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>José Antonio Calvo discovered a bug in the Jabber 1.x server.
	  According to Matthias Wimmer:</p>
	<blockquote cite="http://devel.amessage.info/jabberd14/README.html">
	  <p>Without this patch, it is possible to remotly crash
	    jabberd14, if there is access to one of the following types
	    of network sockets:</p>
	  <ul>
	    <li>Socket accepting client connections</li>
	    <li>Socket accepting connections from other servers</li>
	    <li>Socket connecting to an other Jabber server</li>
	    <li>Socket accepting connections from server components</li>
	    <li>Socket connecting to server components</li>
	  </ul>
	  <p>This is any socket on which the jabberd server parses
	    XML!</p>
	  <p>The problem existed in the included expat XML parser code.
	    This patch removes the included expat code from jabberd14
	    and links jabberd against an installed version of expat.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-1378</cvename>
      <url>http://devel.amessage.info/jabberd14/README.html</url>
      <url>http://mail.jabber.org/pipermail/jabberd/2004-September/002004.html</url>
    </references>
    <dates>
      <discovery>2004-09-19</discovery>
      <entry>2004-12-26</entry>
      <modified>2005-01-19</modified>
    </dates>
  </vuln>

  <vuln vid="a30e5e44-5440-11d9-9e1e-c296ac722cb3">
    <topic>squid -- confusing results on empty acl declarations</topic>
    <affects>
      <package>
	<name>squid</name>
	<range><lt>2.5.7_5</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Applying an empty ACL list results in unexpected behavior:
	  anything will match an empty ACL list.  For example,</p>
	<blockquote cite="http://www.squid-cache.org/bugs/show_bug.cgi?id=1166">
	  <p>The meaning of the configuration gets very confusing when
	    we encounter empty ACLs such as</p>
	  <p><code>acl something src "/path/to/empty_file.txt"<br />
	      http_access allow something somewhere</code></p>
	  <p>gets parsed (with warnings) as</p>
	  <p><code>http_access allow somwhere</code></p>
	  <p>And similarily if you are using proxy_auth acls without
	    having any auth schemes defined.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CAN-2005-0194</cvename>
      <url>http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-empty_acls</url>
      <url>http://www.squid-cache.org/bugs/show_bug.cgi?id=1166</url>
    </references>
    <dates>
      <discovery>2004-12-21</discovery>
      <entry>2004-12-23</entry>
      <modified>2005-02-08</modified>
    </dates>
  </vuln>

  <vuln vid="efa1344b-5477-11d9-a9e7-0001020eed82">
    <topic>ethereal -- multiple vulnerabilities</topic>
    <affects>
      <package>
	<name>ethereal</name>
	<name>ethereal-lite</name>
	<name>tethereal</name>
	<name>tethereal-lite</name>
	<range><lt>0.10.8</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>An Ethreal Security Advisories reports:</p>
	<blockquote cite="http://www.ethereal.com/appnotes/enpa-sa-00016.html">
	  <p>Issues have been discovered in the following protocol
	    dissectors:</p>
	  <ul>
	    <li>Matthew Bing discovered a bug in DICOM dissection that
	      could make Ethereal crash.</li>
	    <li>An invalid RTP timestamp could make Ethereal hang and
	      create a large temporary file, possibly filling
	      available disk space.</li>
	    <li>The HTTP dissector could access previously-freed
	      memory, causing a crash.</li>
	    <li>Brian Caswell discovered that an improperly formatted
	      SMB packet could make Ethereal hang, maximizing CPU
	      utilization.</li>
	  </ul>
	  <p>Impact: It may be possible to make Ethereal crash or run
	    arbitrary code by injecting a purposefully malformed
	    packet onto the wire or by convincing someone to read a
	    malformed packet trace file.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-1139</cvename>
      <cvename>CAN-2004-1140</cvename>
      <cvename>CAN-2004-1141</cvename>
      <cvename>CAN-2004-1142</cvename>
      <url>http://www.ethereal.com/appnotes/enpa-sa-00016.html</url>
    </references>
    <dates>
      <discovery>2004-12-14</discovery>
      <entry>2004-12-23</entry>
    </dates>
  </vuln>

  <vuln vid="e3e266e9-5473-11d9-a9e7-0001020eed82">
    <topic>xpdf -- buffer overflow vulnerability</topic>
    <affects>
      <package>
	<name>xpdf</name>
	<range><lt>3.00_5</lt></range>
      </package>
      <package>
        <name>kdegraphics</name>
	<range><lt>3.3.2_1</lt></range>
      </package>
      <package>
	<name>gpdf</name>
	<range><le>2.8.1</le></range>
      </package>
      <package>
	<name>teTeX-base</name>
	<range><le>2.0.2_6</le></range>
      </package>
      <package>
        <name>cups-base</name>
        <range><le>1.1.22.0</le></range>
      </package>
      <package>
	<name>koffice</name>
	<range><le>1.3.5,1</le></range>
      </package>
      <package>
	<name>pdftohtml</name>
	<range><lt>0.36_1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>An iDEFENSE Security Advisory reports:</p>
	<blockquote cite="http://www.idefense.com/application/poi/display?id=172&amp;type=vulnerabilities">
	  <p>Remote exploitation of a buffer overflow vulnerability in
	    the xpdf PDF viewer, as included in multiple Linux
	    distributions, could allow attackers to execute arbitrary
	    code as the user viewing a PDF file. The offending code
	    can be found in the Gfx::doImage() function in the source
	    file xpdf/Gfx.cc.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-1125</cvename>
      <url>http://www.idefense.com/application/poi/display?id=172&amp;type=vulnerabilities</url>
    </references>
    <dates>
      <discovery>2004-11-23</discovery>
      <entry>2004-12-23</entry>
      <modified>2005-01-13</modified>
    </dates>
  </vuln>

  <vuln vid="28e93883-539f-11d9-a9e7-0001020eed82">
    <topic>acroread5 -- mailListIsPdf() buffer overflow vulnerability</topic>
    <affects>
      <package>
	<name>acroread</name>
	<name>acroread4</name>
	<name>acroread5</name>
	<range><lt>5.10</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>An iDEFENSE Security Advisory reports:</p>
	<blockquote cite="http://www.idefense.com/application/poi/display?id=161&amp;type=vulnerabilities">
	  <p>Remote exploitation of a buffer overflow in version 5.09
	    of Adobe Acrobat Reader for Unix could allow for execution
	    of arbitrary code.</p>
	  <p>The vulnerability specifically exists in a the function
	    mailListIsPdf().  This function checks if the input file
	    is an email message containing a PDF. It unsafely copies
	    user supplied data using strcat into a fixed sized
	    buffer.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-1152</cvename>
      <certvu>253024</certvu>
      <url>http://www.adobe.com/support/techdocs/331153.html</url>
      <url>http://www.idefense.com/application/poi/display?id=161&amp;type=vulnerabilities</url>
    </references>
    <dates>
      <discovery>2004-10-14</discovery>
      <entry>2004-12-21</entry>
      <modified>2005-01-06</modified>
    </dates>
  </vuln>

  <vuln vid="be543d74-539a-11d9-a9e7-0001020eed82">
    <topic>ecartis -- unauthorised access to admin interface</topic>
    <affects>
      <package>
	<name>ecartis</name>
	<range><lt>1.0.0.s20031228_2,1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A Debian security advisory reports:</p>
	<blockquote cite="http://www.debian.org/security/2004/dsa-572">
	  <p>A problem has been discovered in ecartis, a mailing-list
	    manager, which allows an attacker in the same domain as
	    the list admin to gain administrator privileges and alter
	    list settings.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-0913</cvename>
      <url>http://www.debian.org/security/2004/dsa-572</url>
      <url>http://secunia.com/advisories/12918/</url>
    </references>
    <dates>
      <discovery>2004-10-12</discovery>
      <entry>2004-12-21</entry>
    </dates>
  </vuln>

  <vuln vid="85d76f02-5380-11d9-a9e7-0001020eed82">
    <topic>mplayer -- multiple vulnerabilities</topic>
    <affects>
      <package>
	<name>mplayer</name>
	<name>mplayer-gtk</name>
	<name>mplayer-gtk2</name>
	<name>mplayer-esound</name>
	<name>mplayer-gtk-esound</name>
	<name>mplayer-gtk2-esound</name>
	<range><lt>0.99.5_5</lt></range>
      </package>
      <package>
	<name>libxine</name>
	<range><le>1.0.r5_3</le></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>iDEFENSE and the MPlayer Team have found multiple
	  vulnerabilities in MPlayer:</p>
	<ul>
	  <li>Potential heap overflow in Real RTSP streaming code</li>
	  <li>Potential stack overflow in MMST streaming code</li>
	  <li>Multiple buffer overflows in BMP demuxer</li>
	  <li>Potential heap overflow in pnm streaming code</li>
	  <li>Potential buffer overflow in mp3lib</li>
	</ul>
	<p>These vulnerabilities could allow a remote attacker to
	  execute arbitrary code as the user running MPlayer. The
	  problem in the pnm streaming code also affects xine.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-1187</cvename>
      <cvename>CAN-2004-1188</cvename>
      <url>http://mplayerhq.hu/homepage/design7/news.html#mplayer10pre5try2</url>
      <mlist msgid="IDSERV04yz5b6KZmcK80000000c@exchange.idefense.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110322526210300</mlist>
      <url>http://www.idefense.com/application/poi/display?id=166</url>
      <mlist msgid="IDSERV04FVjCRGryWtI0000000f@exchange.idefense.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110322829807443</mlist>
      <url>http://www.idefense.com/application/poi/display?id=167</url>
      <mlist msgid="IDSERV046beUzmRf6Ci00000012@exchange.idefense.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110323022605345</mlist>
      <url>http://www.idefense.com/application/poi/display?id=168</url>
      <url>http://xinehq.de/index.php/security/XSA-2004-6</url>
    </references>
    <dates>
      <discovery>2004-12-10</discovery>
      <entry>2004-12-21</entry>
      <modified>2005-01-12</modified>
    </dates>
  </vuln>

  <vuln vid="0bb7677d-52f3-11d9-a9e7-0001020eed82">
    <topic>krb5 -- heap buffer overflow vulnerability in libkadm5srv</topic>
    <affects>
      <package>
	<name>krb5</name>
	<name>krb5-beta</name>
	<range><lt>1.3.6</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A  MIT krb5 Security Advisory reports:</p>
	<blockquote cite="http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2004-004-pwhist.txt">
	  <p>The MIT Kerberos 5 administration library (libkadm5srv)
	    contains a heap buffer overflow in password history
	    handling code which could be exploited to execute
	    arbitrary code on a Key Distribution Center (KDC)
	    host. The overflow occurs during a password change of a
	    principal with a certain password history state. An
	    administrator must have performed a certain password
	    policy change in order to create the vulnerable state.</p>
	  <p>An authenticated user, not necessarily one with
	    administrative privileges, could execute arbitrary code on
	    the KDC host, compromising an entire Kerberos realm.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-1189</cvename>
      <url>http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2004-004-pwhist.txt</url>
    </references>
    <dates>
      <discovery>2004-12-06</discovery>
      <entry>2004-12-21</entry>
    </dates>
  </vuln>

  <vuln vid="3b3676be-52e1-11d9-a9e7-0001020eed82">
    <topic>samba -- integer overflow vulnerability</topic>
    <affects>
      <package>
	<name>samba</name>
	<range><lt>3.0.10,1</lt></range>
      </package>
      <package>
	<name>ja-samba</name>
	<range><lt>2.2.12.j1.0beta1_2</lt></range>
	<range><gt>3.*</gt><lt>3.0.10,1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Greg MacManus, iDEFENSE Labs reports:</p>
	<blockquote cite="http://www.samba.org/samba/security/CAN-2004-1154.html">
	  <p>Remote exploitation of an integer overflow vulnerability
	    in the smbd daemon included in Samba 2.0.x, Samba 2.2.x,
	    and Samba 3.0.x prior to and including 3.0.9 could allow
	    an attacker to cause controllable heap corruption, leading
	    to execution of arbitrary commands with root
	    privileges.</p>
	  <p>Successful remote exploitation allows an attacker to gain
	    root privileges on a vulnerable system. In order to
	    exploit this vulnerability an attacker must possess
	    credentials that allow access to a share on the Samba
	    server.  Unsuccessful exploitation attempts will cause the
	    process serving the request to crash with signal 11, and
	    may leave evidence of an attack in logs.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-1154</cvename>
      <url>http://www.idefense.com/application/poi/display?id=165&amp;type=vulnerabilities</url>
      <url>http://www.samba.org/samba/security/CAN-2004-1154.html</url>
    </references>
    <dates>
      <discovery>2004-12-02</discovery>
      <entry>2004-12-21</entry>
      <modified>2005-05-29</modified>
    </dates>
  </vuln>

  <vuln vid="d47e9d19-5016-11d9-9b5f-0050569f0001">
    <topic>php -- multiple vulnerabilities</topic>
    <affects>
      <package>
        <name>mod_php4-twig</name>
        <name>php4-cgi</name>
        <name>php4-cli</name>
        <name>php4-dtc</name>
        <name>php4-horde</name>
        <name>php4-nms</name>
        <name>php4</name>
        <range><lt>4.3.10</lt></range>
      </package>
      <package>
        <name>mod_php</name>
        <name>mod_php4</name>
	<range><ge>4</ge><lt>4.3.10,1</lt></range>
      </package>
      <package>
        <name>php5</name>
        <name>php5-cgi</name>
        <name>php5-cli</name>
        <range><lt>5.0.3</lt></range>
      </package>
      <package>
        <name>mod_php5</name>
        <range><lt>5.0.3,1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/13481/">
          <p>Multiple vulnerabilities have been reported in PHP,
             which can be exploited to gain escalated privileges,
             bypass certain security restrictions, gain knowledge
             of sensitive information, or compromise a vulnerable
             system.</p>
	</blockquote>
      </body>
    </description>
    <references>
       <url>http://secunia.com/advisories/13481/</url>
       <cvename>CAN-2004-1019</cvename>
       <cvename>CAN-2004-1065</cvename>
      <url>http://www.php.net/release_4_3_10.php</url>
      <url>http://www.hardened-php.net/advisories/012004.txt</url>
    </references>
    <dates>
      <discovery>2004-12-16</discovery>
      <entry>2004-12-17</entry>
      <modified>2004-12-18</modified>
    </dates>
  </vuln>

   <vuln vid="01c231cd-4393-11d9-8bb9-00065be4b5b6">
     <topic>mysql -- GRANT access restriction problem</topic>
     <affects>
       <package>
         <name>mysql-server</name>
         <range><le>3.23.58_3</le></range>
         <range><ge>4.*</ge><lt>4.0.21</lt></range>
       </package>
     </affects>
     <description>
       <body xmlns="http://www.w3.org/1999/xhtml">
         <p>When a user is granted access to a database with a name containing an
         underscore and the underscore is not escaped then that user might
         also be able to access other, similarly named, databases on the
         affected system. </p>
        <p>The problem is that the underscore is seen as a wildcard by MySQL
        and therefore it is possible that an admin might accidently GRANT
        a user access to multiple databases.</p>
       </body>
     </description>
     <references>
        <cvename>CAN-2004-0957</cvename>
        <bid>11435</bid>
        <url>http://bugs.mysql.com/bug.php?id=3933</url>
        <url>http://rhn.redhat.com/errata/RHSA-2004-611.html</url>
        <url>http://www.openpkg.org/security/OpenPKG-SA-2004.045-mysql.html</url>
     </references>
     <dates>
       <discovery>2004-03-29</discovery>
       <entry>2004-12-16</entry>
       <modified>2005-03-15</modified>
     </dates>
   </vuln>

   <vuln vid="06a6b2cf-484b-11d9-813c-00065be4b5b6">
     <topic>mysql -- ALTER MERGE denial of service vulnerability</topic>
     <affects>
       <package>
         <name>mysql-server</name>
         <range><le>3.23.58_3</le></range>
         <range><ge>4.*</ge><lt>4.0.21</lt></range>
         <range><ge>4.1.*</ge><lt>4.1.1</lt></range>
       </package>
     </affects>
     <description>
       <body xmlns="http://www.w3.org/1999/xhtml">
         <p>Dean Ellis reported a denial of service vulnerability in the MySQL server:</p>
        <blockquote cite="http://bugs.mysql.com/bug.php?id=4017">
                <p>
                Multiple threads ALTERing the same (or different) MERGE tables to change the
                UNION eventually crash the server or hang the individual threads.
                </p>
        </blockquote>
        <p>Note that a script demonstrating the problem is included in the
        MySQL bug report. Attackers that have control of a MySQL account
        can easily use a modified version of that script during an attack. </p>
       </body>
     </description>
     <references>
        <cvename>CAN-2004-0837</cvename>
        <bid>11357</bid>
        <url>http://bugs.mysql.com/bug.php?id=2408</url>
        <url>http://rhn.redhat.com/errata/RHSA-2004-611.html</url>
     </references>
     <dates>
       <discovery>2004-01-15</discovery>
       <entry>2004-12-16</entry>
       <modified>2005-03-15</modified>
     </dates>
   </vuln>

   <vuln vid="29edd807-438d-11d9-8bb9-00065be4b5b6">
     <topic>mysql -- FTS request denial of service vulnerability</topic>
     <affects>
       <package>
         <name>mysql-server</name>
         <range><ge>4.*</ge><lt>4.0.21</lt></range>
       </package>
     </affects>
     <description>
       <body xmlns="http://www.w3.org/1999/xhtml">
         <p>A special crafted MySQL FTS request can cause the server to crash.
         Malicious MySQL users can abuse this bug in a denial of service
         attack against systems running an affected MySQL daemon. </p>
         <p>Note that because this bug is related to the parsing of requests,
         it may happen that this bug is triggered accidently by a user when he
         or she makes a typo. </p>
       </body>
     </description>
     <references>
       <url>http://bugs.mysql.com/bug.php?id=3870</url>
       <cvename>CAN-2004-0956</cvename>
       <bid>11432</bid>
     </references>
     <dates>
       <discovery>2004-03-23</discovery>
       <entry>2004-12-16</entry>
     </dates>
   </vuln>

   <vuln vid="835256b8-46ed-11d9-8ce0-00065be4b5b6">
     <topic>mysql -- mysql_real_connect buffer overflow vulnerability</topic>
     <affects>
       <package>
         <name>mysql-server</name>
         <range><le>3.23.58_3</le></range>
         <range><ge>4.*</ge><lt>4.0.21</lt></range>
       </package>
       <package>
         <name>mysql-client</name>
         <range><le>3.23.58_3</le></range>
         <range><ge>4.*</ge><lt>4.0.21</lt></range>
       </package>
     </affects>
     <description>
       <body xmlns="http://www.w3.org/1999/xhtml">
         <p>The mysql_real_connect function doesn't properly handle DNS replies
         by copying the IP address into a buffer without any length checking.
         A specially crafted DNS reply may therefore be used to cause a
         buffer overflow on affected systems.</p>
         <p>Note that whether this issue can be exploitable depends on the system library responsible for
         the gethostbyname function. The bug finder, Lukasz Wojtow, explaines this with the following words:</p>
         <blockquote cite="http://bugs.mysql.com/bug.php?id=4017">
                <p>In glibc there is a limitation for an IP address to have only 4
                bytes (obviously), but generally speaking the length of the address
                comes with a response for dns query (i know it sounds funny but
                read rfc1035 if you don't believe). This bug can occur on libraries
                where gethostbyname function takes length from dns's response</p>
         </blockquote>
       </body>
     </description>
     <references>
        <cvename>CAN-2004-0836</cvename>
        <bid>10981</bid>
        <url>http://bugs.mysql.com/bug.php?id=4017</url>
        <url>http://lists.mysql.com/internals/14726</url>
        <url>http://rhn.redhat.com/errata/RHSA-2004-611.html</url>
        <url>http://www.osvdb.org/displayvuln.php?osvdb_id=10658</url>
     </references>
     <dates>
       <discovery>2004-06-04</discovery>
       <entry>2004-12-16</entry>
       <modified>2005-03-15</modified>
     </dates>
   </vuln>

   <vuln vid="035d17b2-484a-11d9-813c-00065be4b5b6">
     <topic>mysql -- erroneous access restrictions applied to table renames</topic>
     <affects>
       <package>
         <name>mysql-server</name>
         <range><le>3.23.58_3</le></range>
         <range><ge>4.*</ge><lt>4.0.21</lt></range>
       </package>
     </affects>
     <description>
       <body xmlns="http://www.w3.org/1999/xhtml">
        <p>A Red Hat advisory reports:</p>
        <blockquote cite="http://rhn.redhat.com/errata/RHSA-2004-611.html">
                <p>Oleksandr Byelkin discovered that "ALTER TABLE ... RENAME"
                checked the CREATE/INSERT rights of the old table instead of the new one.</p>
        </blockquote>
                <p>Table access restrictions, on the affected MySQL servers,
                may accidently or intentially be bypassed due to this
                bug.</p>
       </body>
     </description>
     <references>
        <cvename>CAN-2004-0835</cvename>
        <bid>11357</bid>
        <url>http://bugs.mysql.com/bug.php?id=3270</url>
        <url>http://rhn.redhat.com/errata/RHSA-2004-611.html</url>
        <url>http://xforce.iss.net/xforce/xfdb/17666</url>
     </references>
     <dates>
       <discovery>2004-03-23</discovery>
       <entry>2004-12-16</entry>
       <modified>2005-03-15</modified>
     </dates>
   </vuln>

  <vuln vid="0ff0e9a6-4ee0-11d9-a9e7-0001020eed82">
    <topic>phpmyadmin -- command execution vulnerability</topic>
    <affects>
      <package>
	<name>phpMyAdmin</name>
	<range><ge>2.6.0.2</ge><lt>2.6.1.r1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A phpMyAdmin security announcement reports:</p>
	<blockquote cite="http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2004-4">
	  <p>Command execution: since phpMyAdmin 2.6.0-pl2, on a
	    system where external MIME-based transformations are
	    activated, an attacker can put into MySQL data an
	    offensive value that starts a shell command when
	    browsed.</p>
	</blockquote>
	<p>Enabling <q>PHP safe mode</q> on the server can be used as
	  a workaround for this vulnerability.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-1147</cvename>
      <url>http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2004-4</url>
      <url>http://www.exaprobe.com/labs/advisories/esa-2004-1213.html</url>
    </references>
    <dates>
      <discovery>2004-12-13</discovery>
      <entry>2004-12-15</entry>
      <modified>2004-12-19</modified>
    </dates>
  </vuln>

  <vuln vid="9f0a405e-4edd-11d9-a9e7-0001020eed82">
    <topic>phpmyadmin -- file disclosure vulnerability</topic>
    <affects>
      <package>
	<name>phpMyAdmin</name>
	<range><lt>2.6.1.r1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A phpMyAdmin security announcement reports:</p>
	<blockquote cite="http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2004-4">
          <p>File disclosure: on systems where the UploadDir mecanism
            is active, read_dump.php can be called with a crafted
            form; using the fact that the sql_localfile variable is
            not sanitized can lead to a file disclosure.</p>
	</blockquote>
	<p>Enabling <q>PHP safe mode</q> on the server can be used as
	  a workaround for this vulnerability.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-1148</cvename>
      <url>http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2004-4</url>
      <url>http://www.exaprobe.com/labs/advisories/esa-2004-1213.html</url>
    </references>
    <dates>
      <discovery>2004-12-13</discovery>
      <entry>2004-12-15</entry>
      <modified>2004-12-19</modified>
    </dates>
  </vuln>

  <vuln vid="06f142ff-4df3-11d9-a9e7-0001020eed82">
    <topic>wget -- multiple vulnerabilities</topic>
    <affects>
      <package>
	<name>wget</name>
	<name>wget-devel</name>
	<range><lt>1.10.a1</lt></range>
      </package>
      <package>
	<name>wgetpro</name>
	<name>wget+ipv6</name>
	<range><ge>0</ge></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Jan Minar reports that there exists multiple
	  vulnerabilities in wget:</p>
	<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110269474112384">
	  <p>Wget erroneously thinks that the current directory is a
            fair game, and will happily write in any file in and below
            it.  Malicious HTTP response or malicious HTML file can
            redirect wget to a file that is vital to the system, and
            wget will create/append/overwrite it.</p>
	  <p>Wget apparently has at least two methods of
            ``sanitizing'' the potentially malicious data it receives
            from the HTTP stream, therefore a malicious redirects can
            pass the check.  We haven't find a way to trick wget into
            writing above the parent directory, which doesn't mean
            it's not possible.</p>
	  <p>Malicious HTTP response can overwrite parts of the
            terminal so that the user will not notice anything wrong,
            or will believe the error was not fatal.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-1487</cvename>
      <cvename>CAN-2004-1488</cvename>
      <bid>11871</bid>
      <mlist msgid="20041209091438.GA15010@kontryhel.haltyr.dyndns.org">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110269474112384</mlist>
      <url>http://bugs.debian.org/261755</url>
    </references>
    <dates>
      <discovery>2004-12-09</discovery>
      <entry>2004-12-14</entry>
      <modified>2005-04-15</modified>
    </dates>
  </vuln>

  <vuln vid="4593cb09-4c81-11d9-983e-000c6e8f12ef">
    <topic>konqueror -- Password Disclosure for SMB Shares</topic>
    <affects>
      <package>
	<name>kdebase</name>
	<name>kdelibs</name>
	<range><ge>3.2.0</ge><le>3.3.1</le></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>When browsing SMB shares with Konqueror, shares with
	  authentication show up with hidden password in the browser
	  bar.  It is possible to store the URL as a shortcut on the
	  desktop where the password is then available in plain text.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-1171</cvename>
      <certvu>305294</certvu>
      <url>http://www.kde.org/info/security/advisory-20041209-1.txt</url>
      <mlist msgid="ICEEJPLEDKODPNFKJEGAIEBJGFAA.df@sec-consult.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110178786809694</mlist>
    </references>
    <dates>
      <discovery>2004-10-06</discovery>
      <entry>2004-12-12</entry>
      <modified>2005-01-13</modified>
    </dates>
  </vuln>

  <vuln vid="af747389-42ba-11d9-bd37-00065be4b5b6">
    <topic>mod_access_referer -- null pointer dereference vulnerability</topic>
    <affects>
      <package>
	<name>mod_access_referer</name>
	<range><lt>1.0.2_1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A malformed <q>Referer</q> header field causes the Apache
	  ap_parse_uri_components function to discard it with the
	  result that a pointer is not initialized.  The
	  mod_access_referer module does not take this into account
	  with the result that it may use such a pointer.</p>
	<p>The null pointer vulnerability may possibly be used in a
	  remote denial of service attack against affected Apache
	  servers.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2003-1054</cvename>
      <bid>7375</bid>
      <url>http://secunia.com/advisories/8612/</url>
      <mlist>http://marc.theaimsgroup.com/?l=full-disclosure&amp;m=105053485515811</mlist>
    </references>
    <dates>
      <discovery>2003-04-16</discovery>
      <entry>2004-12-11</entry>
      <modified>2005-01-19</modified>
    </dates>
  </vuln>

  <vuln vid="f0db930b-496b-11d9-bf86-0050569f0001">
    <topic>squid -- possible information disclosure</topic>
      <affects>
	<package>
	  <name>squid</name>
	  <range><lt>2.5.7_4</lt></range>
	</package>
      </affects>
      <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	  <p>The squid-2.5 patches pages notes:</p>
	  <blockquote cite="http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-dothost">
	    <p>In certain conditions Squid returns random data as error messages
	       in response to malformed host name, possibly leaking random
	       internal information which may come from other requests.</p>
	  </blockquote>
	</body>
      </description>
      <references>
	<url>http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-dothost</url>
      </references>
      <dates>
	<discovery>2004-11-23</discovery>
        <entry>2004-12-09</entry>
      </dates>
  </vuln>

  <vuln vid="323784cf-48a6-11d9-a9e7-0001020eed82">
    <topic>viewcvs -- information leakage</topic>
    <affects>
      <package>
	<name>viewcvs</name>
	<range><lt>0.9.2_2</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The <code>hide_cvsroot</code> and <code>forbidden</code>
	  configuration options are not properly honored by viewcvs
	  when exporting to a tar file which can lead to information
	  leakage.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-0915</cvename>
      <bid>11819</bid>
    </references>
    <dates>
      <discovery>2004-11-25</discovery>
      <entry>2004-12-08</entry>
      <modified>2004-12-12</modified>
    </dates>
  </vuln>

  <vuln vid="a7bfd423-484f-11d9-a9e7-0001020eed82">
    <topic>cscope -- symlink attack vulnerability</topic>
    <affects>
      <package>
	<name>cscope</name>
	<range><lt>15.5_1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>cscope is vulnerable to a symlink attack which could lead
	  to an attacker overwriting arbitrary files with the
	  permissions of the user running cscope.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-0996</cvename>
      <bid>11697</bid>
      <mlist msgid="20041124025903.9337.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110133485519690</mlist>
      <mlist msgid="20041118012718.78b07d79.research@rexotec.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110072752707293</mlist>
      <url>http://sourceforge.net/tracker/index.php?func=detail&amp;aid=1062807&amp;group_id=4664&amp;atid=104664</url>
    </references>
    <dates>
      <discovery>2003-04-03</discovery>
      <entry>2004-12-07</entry>
    </dates>
  </vuln>

  <vuln vid="9be819c6-4633-11d9-a9e7-0001020eed82">
    <topic>bnc -- remotely exploitable buffer overflow in
      getnickuserhost</topic>
    <affects>
      <package>
	<name>bnc</name>
	<range><lt>2.9.1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A LSS Security Advisory reports:</p>
	<blockquote cite="http://security.lss.hr/en/index.php?page=details&amp;ID=LSS-2004-11-03">
	  <p>There is a buffer overflow vulnerability in
	    getnickuserhost() function that is called when BNC is
	    processing response from IRC server.</p>
	  <p>Vulnerability can be exploited if attacker tricks user to
	    connect to his fake IRC server that will exploit this
	    vulnerability. If the attacker has access to BNC proxy
	    server, this vulnerability can be used to gain shell
	    access on machine where BNC proxy server is set.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-1052</cvename>
      <mlist msgid="20041110131046.GA21604@cecilija.zesoi.fer.hr">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110011817627839</mlist>
      <url>http://security.lss.hr/en/index.php?page=details&amp;ID=LSS-2004-11-03</url>
      <url>http://www.gotbnc.com/changes.html</url>
    </references>
    <dates>
      <discovery>2004-11-10</discovery>
      <entry>2004-12-04</entry>
      <modified>2005-02-22</modified>
    </dates>
  </vuln>

  <vuln vid="f11b219a-44b6-11d9-ae2f-021106004fd6">
    <topic>rssh &amp; scponly -- arbitrary command execution</topic>
    <affects>
      <package>
	<name>rssh</name>
	<range><le>2.2.2</le></range>
      </package>
      <package>
	<name>scponly</name>
	<range><lt>4.0</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Jason Wies identified both rssh &amp; scponly have a vulnerability
	  that allows arbitrary command execution.  He reports:</p>
	<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110202047507273">
	  <p>The problem is compounded when you recognize that the main use of rssh and
	    scponly is to allow file transfers, which in turn allows a malicious user to
	    transfer and execute entire custom scripts on the remote machine.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <bid>11791</bid>
      <bid>11792</bid>
      <freebsdpr>ports/74633</freebsdpr>
      <mlist msgid="20041202135143.GA7105@xc.net">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110202047507273</mlist>
    </references>
    <dates>
      <discovery>2004-11-28</discovery>
      <entry>2004-12-02</entry>
      <modified>2004-12-12</modified>
    </dates>
  </vuln>

  <vuln vid="2b4d5288-447e-11d9-9ebb-000854d03344">
    <topic>rockdodger -- buffer overflows</topic>
    <affects>
      <package>
	<name>rockdodger</name>
	<range><lt>0.6_3</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The environment variable HOME is copied without regard
	  to buffer size, which can be used to gain elevated privilege
	  if the binary is installed setgid games, and a string is
	  read from the high score file without bounds check.</p>
	<p>The port installs the binary without setgid, but with a
	  world-writable high score file.</p>
      </body>
    </description>
    <references>
      <url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=278878</url>
    </references>
    <dates>
      <discovery>2004-10-29</discovery>
      <entry>2004-12-02</entry>
    </dates>
  </vuln>

  <vuln vid="40549bbf-43b5-11d9-a9e7-0001020eed82">
    <topic>zip -- long path buffer overflow</topic>
    <affects>
      <package>
	<name>zip</name>
	<range><lt>2.3_2</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A HexView security advisory reports:</p>
	<blockquote cite="http://www.hexview.com/docs/20041103-1.txt">
	  <p>When zip performs recursive folder compression, it does
	    not check for the length of resulting path. If the path is
	    too long, a buffer overflow occurs leading to stack
	    corruption and segmentation fault.	It is possible to
	    exploit this vulnerability by embedding a shellcode in
	    directory or file name. While the issue is not of primary
	    concern for regular users, it can be critical for
	    environments where zip archives are re-compressed
	    automatically using Info-Zip application.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-1010</cvename>
      <bid>11603</bid>
      <url>http://www.hexview.com/docs/20041103-1.txt</url>
    </references>
    <dates>
      <discovery>2004-10-03</discovery>
      <entry>2004-12-01</entry>
      <modified>2004-12-12</modified>
    </dates>
  </vuln>

  <vuln vid="85edfb6a-43a5-11d9-a9e7-0001020eed82">
    <topic>sudoscript -- signal delivery vulnerability</topic>
    <affects>
      <package>
	<name>sudoscript</name>
	<range><lt>2.1.2</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>If non-root access is enabled in sudoscript, any member of
	  the ssers group can send a SIGHUP signal to any process.</p>
      </body>
    </description>
    <references>
      <url>http://egbok.com/sudoscript/archives/2004/11/sudoscript_212.html</url>
    </references>
    <dates>
      <discovery>2004-11-14</discovery>
      <entry>2004-12-01</entry>
    </dates>
  </vuln>

  <vuln vid="553224e7-4325-11d9-a3d5-000c6e8f12ef">
    <topic>jabberd -- remote buffer overflow vulnerability</topic>
    <affects>
      <package>
	<name>jabberd</name>
	<range><ge>2.*</ge><le>2.0.4</le></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Caused by improper bounds-checking of username
	  and password in the C2S module, it is possible
	  for an attacker to cause a remote buffer overflow.
	  The server directly handles the userinput with
	  SQL backend functions - malicious input may lead
	  to buffer overflow.</p>
      </body>
    </description>
    <references>
      <mlist msgid="41A3FEE1.5030701@0x557.org">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110144303826709</mlist>
    </references>
    <dates>
      <discovery>2004-11-24</discovery>
      <entry>2004-11-30</entry>
    </dates>
  </vuln>

  <vuln vid="cdf14b68-3ff9-11d9-8405-00065be4b5b6">
    <topic>Open DC Hub -- remote buffer overflow vulnerability</topic>
    <affects>
      <package>
	<name>opendchub</name>
	<range><lt>0.7.14_2</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Donato Ferrante reported an exploitable buffer overflow in
	  this software package. Any user that can login with 'admin'
	  privileges can abuse it, trough the $RedirectAll command,
	  to execute arbitrary code.</p>
      </body>
    </description>
    <references>
      <mlist msgid="20041124155429.893852455E@chernobyl.investici.org">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110144606411674</mlist>
      <url>http://www.gentoo.org/security/en/glsa/glsa-200411-37.xml</url>
    </references>
    <dates>
      <discovery>2004-11-24</discovery>
      <entry>2004-11-27</entry>
      <modified>2005-02-13</modified>
    </dates>
  </vuln>

  <vuln vid="a163baff-3fe1-11d9-a9e7-0001020eed82">
    <topic>unarj -- long filename buffer overflow</topic>
    <affects>
      <package>
	<name>unarj</name>
	<range><lt>2.43_2</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Ludwig Nussel has discovered a buffer overflow
	  vulnerability in unarj's handling of long filenames which
	  could potentially lead to execution of arbitrary code with
	  the permissions of the user running unarj.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-0947</cvename>
      <bid>11665</bid>
    </references>
    <dates>
      <discovery>2004-11-09</discovery>
      <entry>2004-11-26</entry>
    </dates>
  </vuln>

  <vuln vid="1f922de0-3fe5-11d9-a9e7-0001020eed82">
    <topic>unarj -- directory traversal vulnerability</topic>
    <affects>
      <package>
	<name>unarj</name>
	<range><lt>2.43_2</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>unarj has insufficient checks for filenames that contain
	  <q>..</q>.  This can allow an attacker to overwrite
	  arbitrary files with the permissions of the user running
	  unarj.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-1027</cvename>
      <bid>11436</bid>
      <mlist msgid="200410102243.i9AMhA9F083398@mailserver2.hushmail.com">http://marc.theaimsgroup.com/?l=full-disclosure&amp;m=109748984030292</mlist>
    </references>
    <dates>
      <discovery>2004-10-10</discovery>
      <entry>2004-11-26</entry>
    </dates>
  </vuln>

  <vuln vid="ac619d06-3ef8-11d9-8741-c942c075aa41">
    <topic>jdk/jre -- Security Vulnerability With Java Plugin</topic>
    <affects>
      <package>
	<name>jdk</name>
	<range><ge>1.4.0</ge><le>1.4.2p6_6</le></range>
	<range><ge>1.3.0</ge><le>1.3.1p9_5</le></range>
      </package>
      <package>
	<name>linux-jdk</name>
	<name>linux-sun-jdk</name>
	<range><ge>1.4.0</ge><le>1.4.2.05</le></range>
	<range><ge>1.3.0</ge><le>1.3.1.13</le></range>
      </package>
      <package>
	<name>linux-blackdown-jdk</name>
	<range><ge>1.3.0</ge><le>1.4.2</le></range>
      </package>
      <package>
	<name>linux-ibm-jdk</name>
	<range><ge>1.3.0</ge><le>1.4.2</le></range>
      </package>
      <package>
	<name>diablo-jdk</name>
	<name>diablo-jre</name>
	<range><ge>1.3.1.0</ge><le>1.3.1.0_1</le></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
      <p>
      The Sun Java Plugin capability in Java 2 Runtime Environment
      (JRE) 1.4.2_01, 1.4.2_04, and possibly earlier versions, does
      not properly restrict access between Javascript and Java
      applets during data transfer, which allows remote attackers
      to load unsafe classes and execute arbitrary code.
      </p>
      </body>
    </description>
    <references>
      <url>http://sunsolve.sun.com/search/document.do?assetkey=1-26-57591-1&amp;searchclause=%22category:security%22%20%22availability,%20security%22</url>
      <url>http://www.securityfocus.com/archive/1/382072</url>
      <cvename>CAN-2004-1029</cvename>
      <mlist msgid="20041123070248.GA25385@jouko.iki.fi">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110125046627909</mlist>
    </references>
    <dates>
      <discovery>2004-11-24</discovery>
      <entry>2004-11-25</entry>
      <modified>2005-04-27</modified>
    </dates>
  </vuln>

  <vuln vid="1a32e8ee-3edb-11d9-8699-00065be4b5b6">
    <topic>ProZilla -- server response buffer overflow vulnerabilities</topic>
    <affects>
      <package>
	<name>prozilla</name>
	<range><le>1.3.6_3</le></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Buffer overflow vulnerabilities have been reported to exist
	  in this software package.  The vulnerabilities can be triggered by
	  a remote server and can be used to inject malicious code in the
	  ProZilla process.</p>
      </body>
    </description>
    <references>
      <url>http://www.gentoo.org/security/en/glsa/glsa-200411-31.xml</url>
      <url>http://bugs.gentoo.org/show_bug.cgi?id=70090</url>
      <mlist msgid="41A411E0.2010907@gmx.net">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110136626320497</mlist>
    </references>
    <dates>
      <discovery>2004-11-23</discovery>
      <entry>2004-11-25</entry>
    </dates>
  </vuln>

  <vuln vid="31952117-3d17-11d9-8818-008088034841">
    <topic>Cyrus IMAPd -- APPEND command uses undefined programming construct</topic>
    <affects>
      <package>
	<name>cyrus-imapd</name>
	<range><ge>2.2.7</ge><le>2.2.8</le></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>To support MULTIAPPENDS the cmd_append handler uses the
	  global stage array. This array is one of the things that gets
	  destructed when the fatal() function is triggered. When the
	  Cyrus IMAP code adds new entries to this array this is done
	  with the help of the postfix increment operator in combination
	  with memory allocation functions. The increment is performed
	  on a global variable counting the number of allocated
	  stages. Because the memory allocation function can fail and
	  therefore internally call fatal() this construct is undefined
	  arcording to ANSI C. This means that it is not clearly defined
	  if the numstage counter is already increased when fatal() is
	  called or not. While older gcc versions increase the counter
	  after the memory allocation function has returned, on newer
	  gcc versions (3.x) the counter gets actually increased
	  before. In such a case the stage destructing process will try
	  to free an uninitialised and maybe attacker supplied
	  pointer. Which again could lead to remote code
	  execution. (Because it is hard for an attacker to let the
	  memory allocation functions fail in the right moment no PoC
	  code for this problem was designed)</p>
      </body>
    </description>
    <references>
      <url>http://security.e-matters.de/advisories/152004.html</url>
    </references>
    <dates>
      <discovery>2004-11-06</discovery>
      <entry>2004-11-22</entry>
    </dates>
  </vuln>

  <vuln vid="c0a269d5-3d16-11d9-8818-008088034841">
    <topic>Cyrus IMAPd -- FETCH command out of bounds memory corruption</topic>
    <affects>
      <package>
	<name>cyrus-imapd</name>
	<range><lt>2.1.17</lt></range>
	<range><ge>2.2.*</ge><le>2.2.8</le></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The argument parser of the fetch command suffers a bug very
	  similiar to the partial command problem. Arguments like
	  "body[p", "binary[p" or "binary[p" will be wrongly detected
	  and the bufferposition can point outside of the allocated
	  buffer for the rest of the parsing process. When the parser
	  triggers the PARSE_PARTIAL macro after such a malformed
	  argument was received this can lead to a similiar one byte
	  memory corruption and allows remote code execution, when the
	  heap layout was successfully controlled by the attacker.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-1013</cvename>
      <url>http://security.e-matters.de/advisories/152004.html</url>
    </references>
    <dates>
      <discovery>2004-11-06</discovery>
      <entry>2004-11-22</entry>
      <modified>2004-11-24</modified>
    </dates>
  </vuln>

  <vuln vid="114d70f3-3d16-11d9-8818-008088034841">
    <topic>Cyrus IMAPd -- PARTIAL command out of bounds memory corruption</topic>
    <affects>
      <package>
	<name>cyrus-imapd</name>
	<range><lt>2.1.17</lt></range>
	<range><ge>2.2.*</ge><le>2.2.6</le></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Due to a bug within the argument parser of the partial
	  command an argument like "body[p" will be wrongly detected as
	  "body.peek". Because of this the bufferposition gets increased
	  by 10 instead of 5 and could therefore point outside the
	  allocated memory buffer for the rest of the parsing
	  process. In imapd versions prior to 2.2.7 the handling of
	  "body" or "bodypeek" arguments was broken so that the
	  terminating ']' got overwritten by a '\0'. Combined the two
	  problems allow a potential attacker to overwrite a single byte
	  of malloc() control structures, which leads to remote code
	  execution if the attacker successfully controls the heap
	  layout.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-1012</cvename>
      <url>http://security.e-matters.de/advisories/152004.html</url>
    </references>
    <dates>
      <discovery>2004-11-06</discovery>
      <entry>2004-11-22</entry>
      <modified>2004-11-24</modified>
    </dates>
  </vuln>

  <vuln vid="816fdd8b-3d14-11d9-8818-008088034841">
    <topic>Cyrus IMAPd -- IMAPMAGICPLUS preauthentification overflow</topic>
    <affects>
      <package>
	<name>cyrus-imapd</name>
	<range><ge>2.2.4</ge><le>2.2.8</le></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>When the option imapmagicplus is activated on a server the
	  PROXY and LOGIN commands suffer a standard stack overflow,
	  because the username is not checked against a maximum length
	  when it is copied into a temporary stack buffer. This bug is
	  especially dangerous because it can be triggered before any
	  kind of authentification took place.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-1011</cvename>
      <url>http://security.e-matters.de/advisories/152004.html</url>
    </references>
    <dates>
      <discovery>2004-11-06</discovery>
      <entry>2004-11-22</entry>
    </dates>
  </vuln>

  <vuln vid="6a33477e-3a9c-11d9-84ad-000c6e8f12ef">
    <topic>phpMyAdmin -- cross-site scripting vulnerabilities</topic>
    <affects>
      <package>
	<name>phpMyAdmin</name>
	<range><le>2.6.0.2</le></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Multiple cross-site scripting vulnerabilities, caused
	  by improper input parameter sanitizing, were
	  detected in phpMyAdmin, which may enable an attacker
	  to do cross-site scripting attacks.</p>
      </body>
    </description>
    <references>
      <url>http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2004-3</url>
    </references>
    <dates>
      <discovery>2004-11-18</discovery>
      <entry>2004-11-20</entry>
    </dates>
  </vuln>

  <vuln vid="759b8dfe-3972-11d9-a9e7-0001020eed82">
    <topic>Overflow error in fetch</topic>
    <affects>
      <system>
	<name>FreeBSD</name>
	<range><ge>5.3</ge><lt>5.3_1</lt></range>
	<range><ge>5.2.1</ge><lt>5.2.1_12</lt></range>
	<range><ge>5.1</ge><lt>5.1_18</lt></range>
	<range><ge>5.0</ge><lt>5.0_22</lt></range>
	<range><ge>4.10</ge><lt>4.10_4</lt></range>
	<range><ge>4.9</ge><lt>4.9_13</lt></range>
	<range><ge>4.8</ge><lt>4.8_26</lt></range>
	<range><lt>4.7_28</lt></range>
      </system>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>An integer overflow condition in <a
	    href="http://www.freebsd.org/cgi/man.cgi?query=fetch">fetch(1)</a>
	  in the processing of HTTP headers can result in a buffer
	  overflow.</p>
	<p>A malicious server or CGI script can respond to an HTTP or
	  HTTPS request in such a manner as to cause arbitrary
	  portions of the client's memory to be overwritten, allowing
	  for arbitrary code execution.</p>
      </body>
    </description>
    <references>
      <freebsdsa>SA-04:16.fetch</freebsdsa>
      <cvename>CAN-2004-1053</cvename>
      <bid>11702</bid>
    </references>
    <dates>
      <discovery>2004-11-14</discovery>
      <entry>2004-11-18</entry>
    </dates>
  </vuln>

  <vuln vid="f3d3f621-38d8-11d9-8fff-000c6e8f12ef">
    <topic>smbd -- buffer-overrun vulnerability</topic>
    <affects>
      <package>
	<name>samba</name>
	<range><ge>3.*</ge><lt>3.0.8,1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Caused by improper bounds checking of certain trans2
	  requests, there is a possible buffer overrun in smbd.
	  The attacker needs to be able to create files with
	  very specific Unicode filenames on the share to take
	  advantage of this issue.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-0882</cvename>
      <bid>11678</bid>
      <mlist msgid="4198AE84.7020509@samba.org">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110055646329581</mlist>
    </references>
    <dates>
      <discovery>2004-11-15</discovery>
      <entry>2004-11-17</entry>
      <modified>2004-12-12</modified>
    </dates>
  </vuln>

  <vuln vid="b4af3ede-36e9-11d9-a9e7-0001020eed82">
    <topic>twiki -- arbitrary shell command execution</topic>
    <affects>
      <package>
	<name>twiki</name>
	<range><lt>20040902</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Hans Ulrich Niedermann reports:</p>
	<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110037207516456">
	  <p>The TWiki search function uses a user supplied search
	    string to compose a command line executed by the Perl
	    backtick (``) operator.</p>
	  <p>The search string is not checked properly for shell
	    metacharacters and is thus vulnerable to search string
	    containing quotes and shell commands.</p>
	  <p>IMPACT: An attacker is able to execute arbitrary shell
	    commands with the privileges of the TWiki process.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-1037</cvename>
      <mlist msgid="86zn1mhchx.fsf@n-dimensional.de">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110037207516456</mlist>
      <url>http://twiki.org/cgi-bin/view/Codev/SecurityAlertExecuteCommandsWithSearch</url>
    </references>
    <dates>
      <discovery>2004-11-12</discovery>
      <entry>2004-11-15</entry>
      <modified>2004-11-23</modified>
    </dates>
  </vuln>

  <vuln vid="50744596-368f-11d9-a9e7-0001020eed82">
    <topic>proxytunnel -- format string vulnerability</topic>
    <affects>
      <package>
	<name>proxytunnel</name>
	<range><lt>1.2.3</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A Gentoo Linux Security Advisory reports:</p>
	<blockquote cite="http://www.gentoo.org/security/en/glsa/glsa-200411-07.xml">
	  <p>Florian Schilhabel of the Gentoo Linux Security Audit
	    project found a format string vulnerability in
	    Proxytunnel. When the program is started in daemon mode
	    (-a [port]), it improperly logs invalid proxy answers to
	    syslog.</p>
	  <p>A malicious remote server could send specially-crafted
	    invalid answers to exploit the format string
	    vulnerability, potentially allowing the execution of
	    arbitrary code on the tunnelling host with the rights of
	    the Proxytunnel process.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-0992</cvename>
      <url>http://proxytunnel.sourceforge.net/news.html</url>
      <url>http://www.gentoo.org/security/en/glsa/glsa-200411-07.xml</url>
    </references>
    <dates>
      <discovery>2004-11-01</discovery>
      <entry>2004-11-15</entry>
    </dates>
  </vuln>

  <vuln vid="bdd1537b-354c-11d9-a9e7-0001020eed82">
    <topic>sudo -- privilege escalation with bash scripts</topic>
    <affects>
      <package>
	<name>sudo</name>
	<range><lt>1.6.8.2</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A Sudo Security Alerts reports:</p>
	<blockquote cite="http://www.courtesan.com/sudo/alerts/bash_functions.html">
	  <p>A flaw in exists in sudo's environment sanitizing prior
	    to sudo version 1.6.8p2 that could allow a malicious user
	    with permission to run a shell script that utilized the
	    bash shell to run arbitrary commands.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <url>http://www.courtesan.com/sudo/alerts/bash_functions.html</url>
    </references>
    <dates>
      <discovery>2004-11-11</discovery>
      <entry>2004-11-13</entry>
    </dates>
  </vuln>

  <vuln vid="d656296b-33ff-11d9-a9e7-0001020eed82">
    <topic>ruby -- CGI DoS</topic>
    <affects>
      <package>
	<name>ruby</name>
	<name>ruby_r</name>
	<range><gt>1.7.*</gt><lt>1.8.2.p2_2</lt></range>
	<range><lt>1.6.8.2004.07.28_1</lt></range>
      </package>
      <package>
	<name>ruby-1.7.0</name>
	<range><ge>a2001.05.12</ge><le>a2001.05.26</le></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Ruby CGI.rb module contains a bug which can cause the
	  CGI module to go into an infinite loop, thereby causing a
	  denial-of-service situation on the web server by using all
	  available CPU time.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-0983</cvename>
      <url>http://www.debian.org/security/2004/dsa-586</url>
    </references>
    <dates>
      <discovery>2004-11-06</discovery>
      <entry>2004-11-13</entry>
      <modified>2004-11-25</modified>
    </dates>
  </vuln>

  <vuln vid="ba13dc13-340d-11d9-ac1b-000d614f7fad">
  <topic>samba -- potential remote DoS vulnerability</topic>
    <affects>
      <package>
        <name>samba</name>
	<range><ge>3</ge><lt>3.0.8,1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
      <p>Karol Wiesek at iDEFENSE reports:</p>
        <blockquote cite="http://us4.samba.org/samba/security/CAN-2004-0930.html">
          <p>A remote attacker could cause an smbd process to consume
            abnormal amounts of system resources due to an input
            validation error when matching filenames containing
            wildcard characters.</p>
	</blockquote>
        <p>Although samba.org classifies this as a DoS vulnerability,
          several members of the security community believe it may be
          exploitable for arbitrary code execution.</p>
      </body>
    </description>
    <references>
      <freebsdpr>ports/73701</freebsdpr>
      <cvename>CAN-2004-0930</cvename>
      <url>http://us4.samba.org/samba/security/CAN-2004-0930.html</url>
    </references>
    <dates>
      <discovery>2004-09-30</discovery>
      <entry>2004-11-12</entry>
    </dates>
  </vuln>

  <vuln vid="fc99c736-3499-11d9-98a7-0090962cff2a">
    <topic>gnats -- format string vulnerability</topic>
    <affects>
      <package>
	<name>gnats</name>
	<range><ge>4.*</ge><le>4.0_2</le></range>
	<range><le>3.113.1_9</le></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Gnats suffers from a format string bug, which may enable an
	  attacker to execute arbitary code.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-0623</cvename>
      <mlist msgid="20040625164231.7437.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=108820000823191</mlist>
    </references>
    <dates>
      <discovery>2004-06-21</discovery>
      <entry>2004-11-12</entry>
    </dates>
  </vuln>

  <vuln vid="7fbfe159-3438-11d9-a9e7-0001020eed82">
    <topic>squirrelmail -- cross site scripting vulnerability</topic>
    <affects>
      <package>
	<name>ja-squirrelmail</name>
	<range><lt>1.4.3a_4,2</lt></range>
      </package>
      <package>
	<name>squirrelmail</name>
	<range><lt>1.4.3a_3</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A SquirrelMail Security Notice reports:</p>
	<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110012133608004">
	  <p>There is a cross site scripting issue in the decoding of
	    encoded text in certain headers. SquirrelMail correctly
	    decodes the specially crafted header, but doesn't sanitize
	    the decoded strings.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <mlist msgid="544475695.20041110000451@netdork.net">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110012133608004</mlist>
    </references>
    <dates>
      <discovery>2004-11-03</discovery>
      <entry>2004-11-12</entry>
    </dates>
  </vuln>

  <vuln vid="1f8dea68-3436-11d9-952f-000c6e8f12ef">
    <cancelled superseded="9be819c6-4633-11d9-a9e7-0001020eed82" />
  </vuln>

  <vuln vid="027380b7-3404-11d9-ac1b-000d614f7fad">
    <topic>hafiye -- lack of terminal escape sequence filtering</topic>
    <affects>
      <package>
	<name>hafiye</name>
	<range><lt>1.0_1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A siyahsapka.org advisory reads:</p>
	<blockquote cite="http://deicide.siyahsapka.org/hafiye_esc.txt">
          <p>Hafiye-1.0 doesnt filter the payload when printing it to
            the terminal.  A malicious attacker can send packets with
	    escape sequence payloads to exploit this vulnerability.</p>
          <p>If Hafiye has been started with -n packet count option ,
            the vulnerability could allow remote code execution.  For
            remote code execution the victim must press Enter after
            program exit.</p>
	</blockquote>
	<p>Note that it appears that this bug can only be exploited in
	  conjunction with a terminal emulator that honors the
	  appropriate escape sequences.</p>
      </body>
    </description>
    <references>
      <freebsdpr>ports/70978</freebsdpr>
      <url>http://deicide.siyahsapka.org/hafiye_esc.txt</url>
      <url>http://www.enderunix.org/hafiye/</url>
    </references>
    <dates>
      <discovery>2004-08-23</discovery>
      <entry>2004-11-11</entry>
    </dates>
  </vuln>

  <vuln vid="e69ba632-326f-11d9-b5b7-000854d03344">
    <topic>ez-ipupdate -- format string vulnerability</topic>
    <affects>
      <package>
         <name>ez-ipupdate</name>
         <range><lt>3.0.11b8_2</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
        <p>Data supplied by a remote server is used as the format string
          instead of as parameters in a syslog() call.  This may lead
          to crashes or potential running of arbitrary code.  It is
          only a problem when running in daemon mode (very common) and
          when using some service types.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-0980</cvename>
      <mlist>http://lists.netsys.com/pipermail/full-disclosure/2004-November/028590.html</mlist>
    </references>
    <dates>
      <discovery>2004-11-11</discovery>
      <entry>2004-11-11</entry>
    </dates>
  </vuln>

  <vuln vid="eeb1c128-33e7-11d9-a9e7-0001020eed82">
    <topic>ImageMagick -- EXIF parser buffer overflow</topic>
    <affects>
      <package>
	<name>ImageMagick</name>
	<range><lt>6.1.3</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>There exists a buffer overflow vulnerability in
	  ImageMagick's EXIF parsing code which may lead to execution
	  of arbitrary code.</p>
      </body>
    </description>
    <references>
      <bid>11548</bid>
      <cvename>CAN-2004-0981</cvename>
      <url>http://secunia.com/advisories/12995/</url>
      <url>http://www.imagemagick.org/www/Changelog.html</url>
    </references>
    <dates>
      <discovery>2004-10-25</discovery>
      <entry>2004-11-11</entry>
      <modified>2004-12-12</modified>
    </dates>
  </vuln>

  <vuln vid="282dfea0-3378-11d9-b404-000c6e8f12ef">
    <topic>apache2 multiple space header denial-of-service vulnerability</topic>
    <affects>
      <package>
	<name>apache</name>
	<range><gt>2.*</gt><le>2.0.52_2</le></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>It is possible for remote attackers to cause a denial-of-service
	  scenario on Apache 2.0.52 and earlier by sending an HTTP GET
	  request with a MIME header containing multiple lines full of
	  whitespaces.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-0942</cvename>
      <mlist msgid="a62f45480411010157571febcc.mail@gmail.com">http://marc.theaimsgroup.com/?l=full-disclosure&amp;m=109930632317208</mlist>
    </references>
    <dates>
      <discovery>2004-11-01</discovery>
      <entry>2004-11-10</entry>
      <modified>2004-11-11</modified>
    </dates>
  </vuln>

  <vuln vid="f3017ce1-32a4-11d9-a9e7-0001020eed82">
    <topic>socat -- format string vulnerability</topic>
    <affects>
      <package>
	<name>socat</name>
	<range><lt>1.4.0.3</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Socat Security Advisory 1 states:</p>
	<blockquote cite="http://www.dest-unreach.org/socat/advisory/socat-adv-1.html">
	  <p>socat up to version 1.4.0.2 contains a syslog() based
	    format string vulnerability. This issue was originally
	    reported by CoKi on 19 Oct.2004 <a
	      href="http://www.nosystem.com.ar/advisories/advisory-07.txt">http://www.nosystem.com.ar/advisories/advisory-07.txt</a>.
	    Further investigation showed that this vulnerability could
	    under some circumstances lead to local or remote execution
	    of arbitrary code with the privileges of the socat
	    process.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <url>http://www.dest-unreach.org/socat/advisory/socat-adv-1.html</url>
      <url>http://www.nosystem.com.ar/advisories/advisory-07.txt</url>
    </references>
    <dates>
      <discovery>2004-10-18</discovery>
      <entry>2004-11-10</entry>
    </dates>
  </vuln>

  <vuln vid="9ff4c91e-328c-11d9-a9e7-0001020eed82">
    <topic>libxml -- remote buffer overflows</topic>
    <affects>
      <package>
	<name>libxml</name>
	<range><lt>1.8.17_3</lt></range>
      </package>
      <package>
	<name>libxml2</name>
	<range><lt>2.6.15</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p><q>infamous41md</q> reports that libxml contains multiple
	  buffer overflows in the URL parsing and DNS name resolving
	  functions.  These vulnerabilities could lead to execution of
	  arbitrary code.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-0989</cvename>
      <bid>11526</bid>
      <mlist msgid="20041025205132.1f1620a8.infamous41md@hotpop.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=109880813013482</mlist>
      <url>http://www.debian.org/security/2004/dsa-582</url>
    </references>
    <dates>
      <discovery>2004-10-26</discovery>
      <entry>2004-11-09</entry>
      <modified>2004-11-10</modified>
    </dates>
  </vuln>

   <vuln vid="a5742055-300a-11d9-a9e7-0001020eed82">
    <topic>p5-Archive-Zip -- virus detection evasion</topic>
    <affects>
      <package>
	<name>p5-Archive-Zip</name>
	<range><lt>1.14</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>An AMaViS Security Announcement reports that a
	  vulnerability exist in the Archive::Zip Perl module which
	  may lead to bypass of malicious code in anti-virus programs
	  by creating specially crafted ZIP files.</p>
      </body>
    </description>
    <references>
      <url>http://www.idefense.com/application/poi/display?id=153&amp;type=vulnerabilities</url>
      <url>http://www.amavis.org/security/asa-2004-6.txt</url>
      <url>http://rt.cpan.org/NoAuth/Bug.html?id=8077</url>
    </references>
    <dates>
      <discovery>2004-10-18</discovery>
      <entry>2004-11-08</entry>
    </dates>
  </vuln>

  <vuln vid="6e6a6b8a-2fde-11d9-b3a2-0050fc56d258">
    <topic>apache mod_include buffer overflow vulnerability</topic>
    <affects>
      <package>
	<name>apache</name>
	<range><lt>1.3.33</lt></range>
      </package>
      <package>
	<name>apache+mod_ssl</name>
	<range><lt>1.3.32+2.8.21_1</lt></range>
      </package>
      <package>
	<name>apache+mod_ssl+ipv6</name>
	<range><lt>1.3.32+2.8.21_1</lt></range>
      </package>
      <package>
	<name>apache+mod_perl</name>
	<range><le>1.3.31</le></range>
      </package>
      <package>
        <name>apache+ipv6</name>
        <range><lt>1.3.33</lt></range>
      </package>
      <package>
	<name>apache+ssl</name>
	<range><le>1.3.29.1.55</le></range>
      </package>
      <package>
        <name>ru-apache</name>
	<range><lt>1.3.33+30.21</lt></range>
      </package>
      <package>
	<name>ru-apache+mod_ssl</name>
	<range><lt>1.3.33+30.21+2.8.22</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>There is a buffer overflow in a function used by mod_include
	  that may enable a local user to gain privileges of a httpd
	  child.  Only users that are able to create SSI documents can
	  take advantage of that vulnerability.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-0940</cvename>
      <url>http://www.securitylab.ru/48807.html</url>
    </references>
    <dates>
      <discovery>2004-10-22</discovery>
      <entry>2004-11-06</entry>
    </dates>
  </vuln>

  <vuln vid="6a164d84-2f7f-11d9-a9e7-0001020eed82">
    <topic>postgresql-contrib -- insecure temporary file
      creation</topic>
    <affects>
      <package>
	<name>postgresql-contrib</name>
	<range><lt>7.2.6</lt></range>
	<range><gt>7.3.*</gt><lt>7.3.8</lt></range>
	<range><gt>7.4.*</gt><lt>7.4.6</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The make_oidjoins_check script in the PostgreSQL RDBMS has
	  insecure handling of temporary files, which could lead to an
	  attacker overwriting arbitrary files with the credentials of
	  the user running the make_oidjoins_check script.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-0977</cvename>
      <bid>11295</bid>
      <url>http://www.postgresql.org/news/234.html</url>
      <url>http://www.trustix.net/errata/2004/0050/</url>
    </references>
    <dates>
      <discovery>2004-09-10</discovery>
      <entry>2004-11-06</entry>
    </dates>
  </vuln>

  <vuln vid="62239968-2f2a-11d9-a9e7-0001020eed82">
    <topic>gd -- integer overflow</topic>
    <affects>
      <package>
	<name>gd</name>
	<name>uk-gd</name>
	<name>ja-gd</name>
	<range><lt>2.0.29,1</lt></range>
	<range><gt>1.*,2</gt><lt>2.*,2</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>infamous41md reports about the GD Graphics Library:</p>
	<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=109882489302099">
	  <p>There is an integer overflow when allocating memory in
            the routine that handles loading PNG image files.  This
            later leads to heap data structures being overwritten.  If
            an attacker tricked a user into loading a malicious PNG
            image, they could leverage this into executing arbitrary
            code in the context of the user opening image.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <bid>11523</bid>
      <cvename>CAN-2004-0990</cvename>
      <mlist msgid="20041025204303.4341d907.infamous41md@hotpop.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=109882489302099</mlist>
      <url>http://www.boutell.com/gd/manual2.0.29.html#whatsnew2.0.29</url>
    </references>
    <dates>
      <discovery>2004-10-26</discovery>
      <entry>2004-11-05</entry>
    </dates>
  </vuln>

  <vuln vid="19518d22-2d05-11d9-8943-0050fc56d258">
    <topic>putty -- buffer overflow vulnerability in ssh2 support</topic>
    <affects>
      <package>
	<name>putty</name>
	<range><lt>0.56</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>There is a bug in SSH2 support that allows a server to execute
	  malicious code on a connecting PuTTY client.
	  This attack can be performed before host key verification happens,
	  so a different machine -- man in the middle attack -- could fake
	  the machine you are connecting to.</p>
      </body>
    </description>
      <references>
	<mlist msgid="1CE07882ECEE894CA2D5A89B8DEBC4010A2DD2@porgy.admin.idefense.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=109890310929207</mlist>
	<url>http://www.gentoo.org/security/en/glsa/glsa-200410-29.xml</url>
	<url>http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-ssh2-debug.html</url>
      </references>
      <dates>
	<discovery>2004-10-26</discovery>
	<entry>2004-11-04</entry>
	<modified>2005-01-19</modified>
      </dates>
  </vuln>

  <vuln vid="e0070221-2dd8-11d9-a9e7-0001020eed82">
    <topic>wzdftpd -- remote DoS</topic>
    <affects>
      <package>
	<name>wzdftpd</name>
	<range><lt>0.4.3</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>wzdftpd contains a potential remote Denial-of-Service.</p>
      </body>
    </description>
    <references>
      <url>http://sourceforge.net/project/shownotes.php?release_id=263573</url>
    </references>
    <dates>
      <discovery>2004-10-28</discovery>
      <entry>2004-11-03</entry>
    </dates>
  </vuln>

  <vuln vid="1f826757-26be-11d9-ad2d-0050fc56d258">
    <topic>rssh -- format string vulnerability</topic>
    <affects>
      <package>
	<name>rssh</name>
	<range><le>2.2.1</le></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>There is a format string bug in rssh that enables an attacker
	  to execute arbitrary code from an account configured to use
	  rssh.  On FreeBSD it is only possible to compromise the rssh
	  running account, not root.</p>
      </body>
    </description>
    <references>
      <url>http://www.pizzashack.org/rssh/security.shtml</url>
      <mlist msgid="20041023084829.GA16819@sophic.org">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=109855982425122</mlist>
    </references>
      <dates>
	<discovery>2004-10-23</discovery>
	<entry>2004-10-25</entry>
      </dates>
  </vuln>

  <vuln vid="ed1d404d-2784-11d9-b954-000bdb1444a4">
    <topic>horde -- cross-site scripting vulnerability in help
      window</topic>
    <affects>
      <package>
        <name>horde</name>
	<name>horde-devel</name>
        <range><lt>2.2.7</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A Horde Team announcement states that a potential cross-site
	  scripting vulnerability in the help window has been
	  corrected.  The vulnerability appears to involve the handling
	  of the <code>topic</code> and <code>module</code> parameters
	  of the help window template.</p>
      </body>
    </description>
    <references>
      <mlist msgid="20041026115303.10FBEC046E@neo.wg.de">http://marc.theaimsgroup.com/?l=horde-announce&amp;m=109879164718625</mlist>
    </references>
    <dates>
      <discovery>2004-10-06</discovery>
      <entry>2004-10-27</entry>
    </dates>
  </vuln>

  <vuln vid="f4428842-a583-4a4c-89b7-297c3459a1c3">
    <topic>bogofilter -- RFC 2047 decoder denial-of-service vulnerability</topic>
    <affects>
      <package>
	<name>bogofilter</name>
	<name>bogofilter-qdbm</name>
	<name>bogofilter-tdb</name>
	<name>ru-bogofilter</name>
	<range><ge>0.17.4</ge><lt>0.92.8</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The bogofilter team has been provided with a test case of a
	   malformatted (non-conformant) RFC-2047 encoded word that can cause
	   bogofilter versions 0.92.7 and prior to try to write a NUL byte into
	   a memory location that is either one byte past the end of a flex
	   buffer or to a location that is the negative of the encoded word's
	   start of payload data, causing a segmentation fault.</p>
      </body>
    </description>
    <references>
      <freebsdpr>73144</freebsdpr>
      <cvename>CAN-2004-1007</cvename>
      <mlist msgid="20041008143604.GA14934@scowler.net">http://article.gmane.org/gmane.mail.bogofilter.devel/3308</mlist>
      <mlist msgid="m3r7o892vj.fsf@merlin.emma.line.org">http://article.gmane.org/gmane.mail.bogofilter.devel/3317</mlist>
      <url>http://bugs.debian.org/275373</url>
      <url>http://bogofilter.sourceforge.net/security/bogofilter-SA-2004-01</url>
    </references>
    <dates>
      <discovery>2004-10-09</discovery>
      <entry>2004-10-26</entry>
      <modified>2004-11-03</modified>
    </dates>
  </vuln>

  <vuln vid="ad2f3337-26bf-11d9-9289-000c41e2cdad">
    <topic>xpdf -- integer overflow vulnerabilities</topic>
    <affects>
      <package>
	<name>gpdf</name>
	<name>cups-base</name>
	<range><lt>1.1.22.0</lt></range>
      </package>
      <package>
	<name>xpdf</name>
	<range><lt>3.00_4</lt></range>
      </package>
      <package>
	<name>kdegraphics</name>
	<range><lt>3.3.0_1</lt></range>
      </package>
      <package>
	<name>koffice</name>
	<range><lt>1.3.2_1,1</lt></range>
      </package>
      <package>
	<name>teTeX-base</name>
	<range><lt>2.0.2_4</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Chris Evans discovered several integer arithmetic overflows
	  in the xpdf 2 and xpdf 3 code bases.  The flaws have impacts
	  ranging from denial-of-service to arbitrary code execution.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-0888</cvename>
      <cvename>CAN-2004-0889</cvename>
      <url>http://scary.beasts.org/security/CESA-2004-002.txt</url>
      <url>http://scary.beasts.org/security/CESA-2004-007.txt</url>
      <url>http://www.kde.org/info/security/advisory-20041021-1.txt</url>
    </references>
    <dates>
      <discovery>2004-10-21</discovery>
      <entry>2004-10-25</entry>
    </dates>
  </vuln>

  <vuln vid="f2d6a5e1-26b9-11d9-9289-000c41e2cdad">
    <topic>gaim -- MSN denial-of-service vulnerabilities</topic>
    <affects>
      <package>
	<name>gaim</name>
	<name>ja-gaim</name>
	<name>ko-gaim</name>
	<name>ru-gaim</name>
	<range><lt>1.0.2</lt></range>
      </package>
      <package>
	<name>gaim</name>
	<range><gt>20030000</gt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Gaim team discovered denial-of-service vulnerabilities in
	  the MSN protocol handler:</p>
	<blockquote cite="http://gaim.sourceforge.net/security/?id=7">
	  <p>After accepting a file transfer request, Gaim will attempt
	    to allocate a buffer of a size equal to the entire filesize,
	    this allocation attempt will cause Gaim to crash if the size
	    exceeds the amount of available memory.</p>
	</blockquote>
	<blockquote cite="http://gaim.sourceforge.net/security/?id=8">
	  <p>Gaim allocates a buffer for the payload of each message
	    received based on the size field in the header of the
	    message. A malicious peer could specify an invalid size that
	    exceeds the amount of available memory.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <url>http://gaim.sourceforge.net/security/?id=7</url>
      <url>http://gaim.sourceforge.net/security/?id=8</url>
    </references>
    <dates>
      <discovery>2004-10-19</discovery>
      <entry>2004-10-25</entry>
    </dates>
  </vuln>

  <vuln vid="ad61657d-26b9-11d9-9289-000c41e2cdad">
    <topic>gaim -- Content-Length header denial-of-service vulnerability</topic>
    <affects>
      <package>
	<name>gaim</name>
	<name>ja-gaim</name>
	<name>ko-gaim</name>
	<name>ru-gaim</name>
	<range><lt>0.82</lt></range>
      </package>
      <package>
	<name>gaim</name>
	<range><gt>20030000</gt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Sean <q>infamous42md</q> reports:</p>
	<blockquote cite="http://gaim.sourceforge.net/security/?id=6">
	  <p>When a remote server provides a large "content-length"
	    header value, Gaim will attempt to allocate a buffer to
	    store the content, however this allocation attempt will
	    cause Gaim to crash if the length exceeds the amount of
	    possible memory. This happens when reading profile
	    information on some protocols. It also happens when smiley
	    themes are installed via drag and drop.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <url>http://gaim.sourceforge.net/security/?id=6</url>
    </references>
    <dates>
      <discovery>2004-08-26</discovery>
      <entry>2004-10-25</entry>
    </dates>
  </vuln>

  <vuln vid="4260eacb-26b8-11d9-9289-000c41e2cdad">
    <topic>gaim -- multiple buffer overflows</topic>
    <affects>
      <package>
	<name>gaim</name>
	<name>ja-gaim</name>
	<name>ko-gaim</name>
	<name>ru-gaim</name>
	<range><lt>0.82</lt></range>
      </package>
      <package>
	<name>gaim</name>
	<range><gt>20030000</gt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Sean <q>infamous42md</q> reports several situations in gaim
	  that may result in exploitable buffer overflows:</p>
	<ul>
	  <li>Rich Text Format (RTF) messages in Novell GroupWise
	    protocol</li>
	  <li>Unsafe use of gethostbyname in zephyr protocol</li>
	  <li>URLs which are over 2048 bytes long once decoded</li>
	</ul>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-0785</cvename>
      <url>http://gaim.sourceforge.net/security/?id=3</url>
      <url>http://gaim.sourceforge.net/security/?id=4</url>
      <url>http://gaim.sourceforge.net/security/?id=5</url>
    </references>
    <dates>
      <discovery>2004-08-26</discovery>
      <entry>2004-10-25</entry>
    </dates>
  </vuln>

  <vuln vid="e16293f0-26b7-11d9-9289-000c41e2cdad">
    <topic>gaim -- heap overflow exploitable by malicious GroupWise
      server</topic>
    <affects>
      <package>
	<name>gaim</name>
	<name>ja-gaim</name>
	<name>ko-gaim</name>
	<name>ru-gaim</name>
	<range><lt>0.82</lt></range>
      </package>
      <package>
	<name>gaim</name>
	<range><gt>20030000</gt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
        <p>Sean <q>infamous42md</q> reports that a malicous GroupWise
          messaging server may be able to exploit a heap buffer
          overflow in gaim, leading to arbitrary code execution.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-0754</cvename>
      <url>http://gaim.sourceforge.net/security/?id=2</url>
    </references>
    <dates>
      <discovery>2004-08-26</discovery>
      <entry>2004-10-25</entry>
    </dates>
  </vuln>

  <vuln vid="635bf5f4-26b7-11d9-9289-000c41e2cdad">
    <topic>gaim -- malicious smiley themes</topic>
    <affects>
      <package>
	<name>gaim</name>
	<name>ja-gaim</name>
	<name>ko-gaim</name>
	<name>ru-gaim</name>
	<range><lt>0.82</lt></range>
      </package>
      <package>
	<name>gaim</name>
	<range><gt>20030000</gt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Gaim Security Issues page documents a problem with
	  installing smiley themes from an untrusted source:</p>
	<blockquote cite="http://gaim.sourceforge.net/security/?id=1">
	  <p>To install a new smiley theme, a user can drag a tarball
	    from a graphical file manager, or a hypertext link to one
	    from a web browser. When a tarball is dragged, Gaim executes
	    a shell command to untar it. However, it does not escape the
	    filename before sending it to the shell. Thus, a specially
	    crafted filename could execute arbitrary commands if the
	    user could be convinced to drag a file into the smiley theme
	    selector.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-0784</cvename>
      <url>http://gaim.sourceforge.net/security/?id=1</url>
    </references>
    <dates>
      <discovery>2004-08-22</discovery>
      <entry>2004-10-25</entry>
    </dates>
  </vuln>

  <vuln vid="1e6c4008-245f-11d9-b584-0050fc56d258">
    <topic>gaim -- buffer overflow in MSN protocol support</topic>
    <affects>
      <package>
	<name>gaim</name>
	<name>ja-gaim</name>
	<name>ru-gaim</name>
	<range><ge>0.79</ge><le>1.0.1</le></range>
      </package>
      <package>
	<name>gaim</name>
	<range><gt>20030000</gt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Due to a buffer overflow in the MSN protocol support for
	  gaim 0.79 to 1.0.1, it is possible for remote clients to do a
	  denial-of-service attack on the application.
	  This is caused by an unbounded copy operation, which writes
	  to the wrong buffer.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-0891</cvename>
      <url>http://gaim.sourceforge.net/security/?id=9</url>
    </references>
    <dates>
      <discovery>2004-10-19</discovery>
      <entry>2004-10-25</entry>
    </dates>
  </vuln>

  <vuln vid="4238151d-207a-11d9-bfe2-0090962cff2a">
    <topic>mod_ssl -- SSLCipherSuite bypass</topic>
    <affects>
      <package>
	<name>ru-apache+mod_ssl</name>
	<range><le>1.3.31+30.20+2.8.18</le></range>
      </package>
      <package>
	<name>apache+mod_ssl</name>
	<range><lt>1.3.31+2.8.20</lt></range>
      </package>
      <package>
	<name>apache+mod_ssl+ipv6</name>
	<range><le>1.3.31+2.8.18_4</le></range>
      </package>
      <package>
	<name>apache2</name>
	<range><le>2.0.52_1</le></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>It is possible for clients to use any cipher suite configured by
	  the virtual host, whether or not a certain cipher suite is selected
	  for a specific directory.  This might result in clients using a
	  weaker encryption than originally configured.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-0885</cvename>
      <mlist msgid="20041008152510.GE8385@redhat.com">http://marc.theaimsgroup.com/?l=apache-modssl&amp;m=109724918128044</mlist>
      <url>http://issues.apache.org/bugzilla/show_bug.cgi?id=31505</url>
    </references>
    <dates>
      <discovery>2004-10-01</discovery>
      <entry>2004-10-23</entry>
    </dates>
  </vuln>


  <vuln vid="20d16518-2477-11d9-814e-0001020eed82">
    <topic>mpg123 -- buffer overflow in URL handling</topic>
    <affects>
      <package>
	<name>mpg123</name>
	<name>mpg123-nas</name>
	<name>mpg123-esound</name>
	<range><lt>0.59r_15</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Carlos Barros reports that mpg123 contains two buffer
	  overflows.  These vulnerabilities can potentially lead to
	  execution of arbitrary code.</p>
	<p>The first buffer overflow can occur when mpg123 parses a
	  URL with a user-name/password field that is more than 256
	  characters long.  This problem can be triggered either
	  locally or remotely via a specially crafted play list.  The
	  second potential buffer overflow may be triggered locally by
	  a specially crafted symlink to the mpg123 binary.  This
	  problem is not as serious, since mpg123 is not installed
	  setuid by default.</p>
      </body>
    </description>
    <references>
      <bid>11468</bid>
      <cvename>CAN-2004-0982</cvename>
      <mlist msgid="200410200119.42801.barros@barrossecurity.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=109834486312407</mlist>
    </references>
    <dates>
      <discovery>2004-10-02</discovery>
      <entry>2004-10-23</entry>
      <modified>2004-12-30</modified>
    </dates>
  </vuln>

  <vuln vid="7b81fc47-239f-11d9-814e-0001020eed82">
    <topic>apache2 -- SSL remote DoS</topic>
    <affects>
      <package>
	<name>apache</name>
	<range><gt>2.0</gt><lt>2.0.51</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Apache HTTP Server 2.0.51 release notes report that the
	  following issues have been fixed:</p>
	<blockquote cite="http://marc.theaimsgroup.com/?l=apache-httpd-announce&amp;m=109527608022322">
	  <p>A segfault in mod_ssl which can be triggered by a
            malicious remote server, if proxying to SSL servers has
            been configured.  [CAN-2004-0751]</p>
	  <p>A potential infinite loop in mod_ssl which could be
            triggered given particular timing of a connection
            abort.  [CAN-2004-0748]</p>
	</blockquote>
      </body>
    </description>
    <references>
      <bid>11094</bid>
      <bid>11154</bid>
      <cvename>CAN-2004-0748</cvename>
      <cvename>CAN-2004-0751</cvename>
      <mlist msgid="029f01c49b54$dec30f20$1500a8c0@Cougar">http://marc.theaimsgroup.com/?l=apache-httpd-announce&amp;m=109527608022322</mlist>
      <url>http://nagoya.apache.org/bugzilla/show_bug.cgi?id=29964</url>
      <url>http://nagoya.apache.org/bugzilla/show_bug.cgi?id=30134</url>
    </references>
    <dates>
      <discovery>2004-07-07</discovery>
      <entry>2004-10-21</entry>
    </dates>
  </vuln>

  <vuln vid="fc07c9ca-22ce-11d9-814e-0001020eed82">
    <topic>phpmyadmin -- remote command execution
      vulnerability</topic>
    <affects>
      <package>
	<name>phpMyAdmin</name>
	<name>phpmyadmin</name>
	<range><lt>2.6.0.2</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>From the phpMyAdmin 2.6.0p2 release notes:</p>
	<blockquote cite="http://sourceforge.net/project/shownotes.php?release_id=274709">
	  <p>If PHP is not running in safe mode, a problem in the
	    MIME-based transformation system (with an "external"
	    transformation) allows to execute any command with the
	    privileges of the web server's user.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <bid>11391</bid>
      <url>http://sourceforge.net/project/shownotes.php?release_id=274709</url>
      <url>http://sourceforge.net/tracker/index.php?func=detail&amp;aid=1044864&amp;group_id=23067&amp;atid=377408</url>
    </references>
    <dates>
      <discovery>2004-10-11</discovery>
      <entry>2004-10-20</entry>
    </dates>
  </vuln>

  <vuln vid="61480a9a-22b2-11d9-814e-0001020eed82">
    <topic>cabextract -- insecure directory handling</topic>
    <affects>
      <package>
	<name>cabextract</name>
	<range><lt>1.1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>cabextract has insufficient checks for file names that
	  contain <q>../</q>.  This can cause files to be extracted to
	  the parent directory.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-0916</cvename>
      <url>http://www.kyz.uklinux.net/cabextract.php#changes</url>
    </references>
    <dates>
      <discovery>2004-10-18</discovery>
      <entry>2004-10-20</entry>
      <modified>2004-10-22</modified>
    </dates>
  </vuln>

  <vuln vid="8091fcea-f35e-11d8-81b0-000347a4fa7d">
    <topic>a2ps -- insecure command line argument handling</topic>
    <affects>
      <package>
	<name>a2ps-a4</name>
	<range><lt>4.13b_2</lt></range>
      </package>
      <package>
	<name>a2ps-letter</name>
	<range><lt>4.13b_2</lt></range>
      </package>
      <package>
	<name>a2ps-letterdj</name>
	<range><lt>4.13b_2</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Rudolf Polzer reports:</p>
	<blockquote cite="http://www.freebsd.org/cgi/query-pr.cgi?pr=ports/70618">
	  <p>a2ps builds a command line for file() containing an
	    unescaped version of the file name, thus might call
	    external programs described by the file name.  Running a
	    cronjob over a public writable directory a2ps-ing all
	    files in it - or simply typing "a2ps *.txt" in /tmp - is
	    therefore dangerous.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-1170</cvename>
      <freebsdpr>ports/70618</freebsdpr>
      <bid>11025</bid>
      <url>http://www.osvdb.org/9176</url>
      <mlist msgid="e5312d6a040824040119840c7c@mail.gmail.com">http://marc.theaimsgroup.com/?l=full-disclosure&amp;m=109334851517137</mlist>
    </references>
    <dates>
      <discovery>2004-08-18</discovery>
      <entry>2004-10-20</entry>
      <modified>2004-12-30</modified>
    </dates>
  </vuln>

  <vuln vid="746ca1ac-21ec-11d9-9289-000c41e2cdad">
    <topic>ifmail -- unsafe set-user-ID application</topic>
    <affects>
      <package>
	<name>ifmail</name>
	<range><le>ifmail-2.15_4</le></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Niels Heinen reports that ifmail allows one to specify
	  a configuration file.  Since ifmail runs set-user-ID `news',
	  this may allow a local attacker to write to arbitrary files
	  or execute arbitrary commands as the `news' user.</p>
      </body>
    </description>
    <references>
      <url>http://cvsweb.freebsd.org/ports/news/ifmail</url>
    </references>
    <dates>
      <discovery>2004-08-23</discovery>
      <entry>2004-10-19</entry>
    </dates>
  </vuln>

  <vuln vid="e31d44a2-21e3-11d9-9289-000c41e2cdad">
    <topic>imwheel -- insecure handling of PID file</topic>
    <affects>
      <package>
	<name>imwheel</name>
	<range><lt>1.0.0.p12</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A Computer Academic Underground advisory describes the
	  consequences of imwheel's handling of the process ID file (PID
	  file):</p>
	<blockquote
	  cite="http://www.caughq.org/advisories/CAU-2004-0002.txt">
          <p>imwheel exclusively uses a predictably named PID file for
            management of multiple imwheel processes. A race condition
            exists when the -k command-line option is used to kill
            existing imwheel processes. This race condition may be
            used by a local user to Denial of Service another user
            using imwheel, lead to resource exhaustion of the host
            system, or append data to arbitrary files.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <url>http://www.caughq.org/advisories/CAU-2004-0002.txt</url>
      <url>http://imwheel.sourceforge.net/files/DEVELOPMENT.txt</url>
    </references>
    <dates>
      <discovery>2004-08-20</discovery>
      <entry>2004-10-19</entry>
    </dates>
  </vuln>

  <vuln vid="064225c5-1f53-11d9-836a-0090962cff2a">
    <topic>squid -- NTLM authentication denial-of-service vulnerability</topic>
      <affects>
	<package>
	  <name>squid</name>
	  <range><lt>2.5.7</lt></range>
	</package>
      </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A remote attacker is able to cause a denial-of-service
	  situation, when NTLM authentication is enabled in squid.
	  NTLM authentication uses two functions which lack correct
	  offset checking.</p>
    </body>
    </description>
      <references>
	<cvename>CAN-2004-0832</cvename>
	<url>http://www.squid-cache.org/bugs/show_bug.cgi?id=1045</url>
      </references>
    <dates>
      <discovery>2004-08-18</discovery>
      <entry>2004-08-16</entry>
    </dates>
  </vuln>

  <vuln vid="ca543e06-207a-11d9-814e-0001020eed82">
    <topic>cacti -- SQL injection</topic>
    <affects>
      <package>
	<name>cacti</name>
	<range><lt>0.8.6</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Fernando Quintero reports that Cacti 0.8.5a suffers from a
	  SQL injection attack where an attacker can change the
	  password for any Cacti user.	This attack is not possible if
	  the PHP option magic_quotes_gpc is set to On, which is the
	  default for PHP in FreeBSD.</p>
      </body>
    </description>
    <references>
      <mlist msgid="1092686621.818.8.camel@mitnick.nadied.org">http://marc.theaimsgroup.com/?l=full-disclosure&amp;m=109269427427368</mlist>
    </references>
    <dates>
      <discovery>2004-08-16</discovery>
      <entry>2004-10-17</entry>
    </dates>
  </vuln>

  <vuln vid="18974c8a-1fbd-11d9-814e-0001020eed82">
    <topic>apache13-modssl -- format string vulnerability in
      proxy support</topic>
    <affects>
      <package>
	<name>apache+mod_ssl</name>
	<range><lt>1.3.31+2.8.19</lt></range>
      </package>
      <package>
	<name>apache+mod_ssl+ipv6</name>
	<range><lt>1.3.31+2.8.19</lt></range>
      </package>
      <package>
	<name>ru-apache+mod_ssl</name>
	<range><lt>1.3.31+30.20+2.8.19</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A OpenPKG Security Advisory reports:</p>
	<blockquote cite="http://www.openpkg.org/security/OpenPKG-SA-2004.032-apache.html">
	  <p>Triggered by a report to Packet Storm from Virulent, a
	    format string vulnerability was found in mod_ssl, the
	    Apache SSL/TLS interface to OpenSSL, version (up to and
	    including) 2.8.18 for Apache 1.3.  The mod_ssl in Apache
	    2.x is not affected.  The vulnerability could be
	    exploitable if Apache is used as a proxy for HTTPS URLs
	    and the attacker established a own specially prepared DNS
	    and origin server environment.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <bid>10736</bid>
      <certvu>303448</certvu>
      <cvename>CAN-2004-0700</cvename>
      <url>http://www.openpkg.org/security/OpenPKG-SA-2004.032-apache.html</url>
      <url>http://packetstormsecurity.org/0407-advisories/modsslFormat.txt</url>
      <mlist msgid="20040716204207.GA45678@engelschall.com">http://marc.theaimsgroup.com/?l=apache-modssl&amp;m=109001100906749</mlist>
    </references>
    <dates>
      <discovery>2004-07-16</discovery>
      <entry>2004-10-17</entry>
    </dates>
  </vuln>

  <vuln vid="8e2e6ad8-1720-11d9-9fb9-00902788733b">
    <topic>tor -- remote DoS and loss of anonymity</topic>
    <affects>
      <package>
	<name>tor</name>
	<range><lt>0.0.8.1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Tor has various remote crashes which could lead to a remote
	  denial-of-service and be used to defeat clients anonymity.
	  It is not expected that these vulnerabilities are
	  exploitable for arbitrary code execution.</p>
      </body>
    </description>
    <references>
      <mlist>http://archives.seul.org/or/announce/Aug-2004/msg00001.html</mlist>
      <mlist>http://archives.seul.org/or/announce/Oct-2004/msg00000.html</mlist>
    </references>
    <dates>
      <discovery>2004-08-25</discovery>
      <entry>2004-10-15</entry>
    </dates>
  </vuln>

  <vuln vid="b2cfb400-1df0-11d9-a859-0050fc56d258">
    <topic>icecast -- Cross-Site Scripting Vulnerability</topic>
    <affects>
      <package>
	<name>icecast</name>
	<range><lt>1.3.12_2</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Caused by improper filtering of HTML code in the
	  status display, it is possible for a remote user
	  to execute scripting code in the target user's
	  browser.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-0781</cvename>
      <url>http://www.securitytracker.com/alerts/2004/Aug/1011047.html</url>
    </references>
    <dates>
      <discovery>2004-08-24</discovery>
      <entry>2004-10-13</entry>
    </dates>
  </vuln>

  <vuln vid="741c3957-1d69-11d9-a804-0050fc56d258">
    <topic>icecast -- HTTP header overflow</topic>
    <affects>
      <package>
        <name>icecast2</name>
	<range><lt>2.0.2,1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>It is possible to execute remote code simply using
	HTTP request plus 31 headers followed by a shellcode that will be
	executed directly.</p>
      </body>
    </description>
    <references>
      <mlist msgid="20040928184943.0a82b6f6.aluigi@autistici.org">http://marc.theaimsgroup.com/?l=full-disclosure&amp;m=109646043512722</mlist>
    </references>
    <dates>
      <discovery>2004-09-29</discovery>
      <entry>2004-10-13</entry>
    </dates>
  </vuln>

  <vuln vid="20dfd134-1d39-11d9-9be9-000c6e8f12ef">
    <topic>freeradius -- denial-of-service vulnerability</topic>
    <affects>
      <package>
	<name>freeradius</name>
	<range><ge>0.8.0</ge><lt>1.0.1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A remote attacker may be able to crash the freeRADIUS Server
	  due to three independant bugs in the function which does
	  improper checking values while processing RADIUS
	  attributes.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-0938</cvename>
      <cvename>CAN-2004-0960</cvename>
      <cvename>CAN-2004-0961</cvename>
      <url>http://www.securitytracker.com/alerts/2004/Sep/1011364.html</url>
      <certvu>541574</certvu>
      <bid>11222</bid>
    </references>
    <dates>
      <discovery>2004-09-20</discovery>
      <entry>2004-10-13</entry>
      <modified>2004-10-19</modified>
    </dates>
  </vuln>

  <vuln vid="76301302-1d59-11d9-814e-0001020eed82">
    <topic>xerces-c2 -- Attribute blowup denial-of-service</topic>
    <affects>
      <package>
	<name>xerces-c2</name>
        <range><lt>2.6.0</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
        <p>Amit Klein reports about Xerces-C++:</p>
        <blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=109674050017645">
          <p>An attacker can craft a malicious XML document, which
            uses XML attributes in a way that inflicts a denial of
            service condition on the target machine (XML parser).  The
            result of this attack is that the XML parser consumes all
            the CPU.</p>
        </blockquote>
      </body>
    </description>
    <references>
      <bid>11312</bid>
      <mlist msgid="415F00A8.13029.1FAADB7@localhost">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=109674050017645</mlist>
    </references>
    <dates>
      <discovery>2004-10-02</discovery>
      <entry>2004-10-13</entry>
      <modified>2004-10-14</modified>
    </dates>
  </vuln>

  <vuln vid="12b7b4cf-1d53-11d9-814e-0001020eed82">
    <topic>wordpress -- XSS in administration panel</topic>
    <affects>
      <package>
	<name>wordpress</name>
        <range><lt>1.2.1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
        <p>Pages in the administration panel of Wordpress are
          vulnerable for XSS attacks.</p>
      </body>
    </description>
    <references>
      <url>http://wordpress.org/development/2004/10/wp-121/</url>
      <mlist msgid="20040927231608.19365.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=109641484723194</mlist>
    </references>
    <dates>
      <discovery>2004-09-27</discovery>
      <entry>2004-10-13</entry>
    </dates>
  </vuln>

  <vuln vid="3897a2f8-1d57-11d9-bc4a-000c41e2cdad">
    <topic>tiff -- multiple integer overflows</topic>
    <affects>
      <package>
	<name>tiff</name>
	<range><le>3.6.1_2</le></range>
      </package>
      <package>
	<name>linux-tiff</name>
	<range><lt>3.6.1</lt></range>
      </package>
      <package>
	<name>pdflib</name>
	<range><lt>6.0.1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Dmitry V. Levin discovered numerous integer overflow bugs in
	  libtiff.  Most of these bugs are related to memory management,
	  and are believed to be exploitable for arbitrary code
	  execution.</p>
      </body>
    </description>
    <references>
      <certvu>687568</certvu>
      <cvename>CAN-2004-0886</cvename>
      <url>http://www.idefense.com/application/poi/display?id=173&amp;type=vulnerabilities</url>
    </references>
    <dates>
      <discovery>2004-10-13</discovery>
      <entry>2004-10-13</entry>
      <modified>2005-02-28</modified>
    </dates>
  </vuln>

  <vuln vid="30cea6be-1d0c-11d9-814e-0001020eed82">
    <topic>CUPS -- local information disclosure</topic>
    <affects>
      <package>
	<name>cups-base</name>
        <range><lt>1.1.22</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
        <p>Certain methods of authenticated remote printing in CUPS
          can disclose user names and passwords in the log files.</p>
        <p>A workaround for this problem is to set more strict
          access permissions on the CUPS logfiles.</p>
      </body>
    </description>
    <references>
      <url>http://docs.info.apple.com/article.html?artnum=61798</url>
      <url>http://secunia.com/advisories/12690/</url>
      <url>http://www.cups.org/str.php?L920</url>
      <cvename>CAN-2004-0923</cvename>
      <certvu>557062</certvu>
    </references>
    <dates>
      <discovery>2004-09-23</discovery>
      <entry>2004-10-13</entry>
    </dates>
  </vuln>

  <vuln vid="30cf9485-1c2c-11d9-9ecb-000c6e8f12ef">
    <topic>zinf -- potential buffer overflow playlist support</topic>
    <affects>
      <package>
	<name>zinf</name>
	<range><lt>2.2.5</lt></range>
      </package>
      <package>
        <name>freeamp</name>
	<range><gt>0</gt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The audio player Zinf is vulnerable to a buffer-overflow
	  bug in the management of the playlist files.</p>
      </body>
    </description>
    <references>
      <mlist msgid="20040924213102.7fb91138.aluigi@autistici.org">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=109608092609200</mlist>
    </references>
      <dates>
	<discovery>2004-09-24</discovery>
	<entry>2004-10-12</entry>
      </dates>
  </vuln>

  <vuln vid="f6680c03-0bd8-11d9-8a8a-000c41e2cdad">
    <topic>tiff -- RLE decoder heap overflows</topic>
    <affects>
      <package>
	<name>tiff</name>
	<range><le>3.6.1_1</le></range>
      </package>
      <package>
	<name>linux-tiff</name>
	<range><lt>3.6.1</lt></range>
      </package>
      <package>
	<name>pdflib</name>
	<range><lt>6.0.1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
        <p>Chris Evans discovered several heap buffer overflows in
          libtiff's RLE decoder.  These overflows could be triggered
          by a specially-crafted TIFF image file, resulting in an
          application crash and possibly arbitrary code execution.</p>
      </body>
    </description>
    <references>
      <certvu>948752</certvu>
      <cvename>CAN-2004-0803</cvename>
      <url>http://scary.beasts.org/security/CESA-2004-006.txt</url>
    </references>
    <dates>
      <discovery>2004-10-13</discovery>
      <entry>2004-10-13</entry>
      <modified>2005-02-28</modified>
    </dates>
  </vuln>

  <vuln vid="26c9e8c6-1c99-11d9-814e-0001020eed82">
    <topic>sharutils -- buffer overflows</topic>
    <affects>
      <package>
	<name>sharutils</name>
        <range><lt>4.2.1_2</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>From Gentoo advisory GLSA 200410-01:</p>
	<blockquote cite="http://www.gentoo.org/security/en/glsa/glsa-200410-01.xml">
	  <p>sharutils contains two buffer overflows.  Ulf Harnhammar
	    discovered a buffer overflow in shar.c, where the length
	    of data returned by the wc command is not checked.
	    Florian Schilhabel discovered another buffer overflow in
	    unshar.c.</p>
	  <p>An attacker could exploit these vulnerabilities to
	    execute arbitrary code as the user running one of the
	    sharutils programs.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <bid>11298</bid>
      <url>http://www.gentoo.org/security/en/glsa/glsa-200410-01.xml</url>
      <url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=265904</url>
    </references>
    <dates>
      <discovery>2004-08-15</discovery>
      <entry>2004-10-13</entry>
    </dates>
  </vuln>

  <vuln vid="3030ae22-1c7f-11d9-81a4-0050fc56d258">
    <topic>mail-notification -- denial-of-service vulnerability</topic>
    <affects>
      <package>
	<name>mail-notification</name>
	<range><lt>0.7.0</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Caused by an untested return value, and a resulting
	  null pointer dereference, it is possible for an attacker
	  to crash the application.  However, the attacker must first
	  hijack the connection between Mail Notification and the
	  Gmail or IMAP server.</p>
      </body>
    </description>
    <references>
      <url>http://www.nongnu.org/mailnotify/sa/mail-notification-SA-04:2.asc</url>
      <url>http://www.nongnu.org/mailnotify/sa/mail-notification-SA-04:3.asc</url>
    </references>
    <dates>
      <discovery>2004-10-06</discovery>
      <entry>2004-10-12</entry>
    </dates>
  </vuln>

  <vuln vid="65e99f52-1c5f-11d9-bc4a-000c41e2cdad">
    <topic>squid -- SNMP module denial-of-service vulnerability</topic>
    <affects>
      <package>
	<name>squid</name>
	<range><lt>2.5.7</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Squid-2.5 patches page notes:</p>
	<blockquote cite="http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE6-SNMP_core_dump">
	  <p>If a certain malformed SNMP request is received squid
	    restarts with a Segmentation Fault error.</p>
	</blockquote>
	<p>This only affects squid installations where SNMP is
	  explicitly enabled via "make config". As a workaround,
	  SNMP can be disabled by defining "snmp_port 0" in
	  squid.conf.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-0918</cvename>
      <url>http://www.idefense.com/application/poi/display?id=152&amp;type=vulnerabilities</url>
      <url>http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE6-SNMP_core_dump</url>
    </references>
    <dates>
      <discovery>2004-09-29</discovery>
      <entry>2004-10-12</entry>
    </dates>
  </vuln>

  <vuln vid="0c592c4a-1bcc-11d9-a3ec-00061bd2d56f">
    <topic>cyrus-sasl -- potential buffer overflow in DIGEST-MD5 plugin</topic>
    <affects>
      <package>
	<name>cyrus-sasl</name>
	<range><ge>2.*</ge><lt>2.1.19</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
        <p>The Cyrus SASL DIGEST-MD5 plugin contains a potential
          buffer overflow when quoting is required in the output.</p>
      </body>
    </description>
    <references>
      <url>https://bugzilla.andrew.cmu.edu/cgi-bin/cvsweb.cgi/src/sasl/plugins/digestmd5.c#rev1.171</url>
    </references>
    <dates>
      <discovery>2004-07-06</discovery>
      <entry>2004-10-12</entry>
    </dates>
  </vuln>

  <vuln vid="92268205-1947-11d9-bc4a-000c41e2cdad">
    <topic>cyrus-sasl -- dynamic library loading and set-user-ID
      applications</topic>
    <affects>
      <package>
	<name>cyrus-sasl</name>
	<range><le>1.5.28_3</le></range>
	<range><ge>2.*</ge><le>2.1.19</le></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
        <p>The Cyrus SASL library, libsasl, contains functions which
          may load dynamic libraries.  These libraries may be loaded
          from the path specified by the environmental variable
          SASL_PATH, which in some situations may be fully controlled
          by a local attacker.  Thus, if a set-user-ID application
          (such as chsh) utilizes libsasl, it may be possible for a
          local attacker to gain superuser privileges.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-0884</cvename>
      <url>https://bugzilla.andrew.cmu.edu/cgi-bin/cvsweb.cgi/src/sasl/lib/common.c#rev1.104</url>
    </references>
    <dates>
      <discovery>2004-09-22</discovery>
      <entry>2004-10-08</entry>
    </dates>
  </vuln>

  <vuln vid="efc4819b-0b2d-11d9-bfe1-000bdb1444a4">
    <topic>imp3 -- XSS hole in the HTML viewer</topic>
    <affects>
      <package>
        <name>imp</name>
        <range><lt>3.2.6</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
        <p>The script vulnerabilities can only be exposed with
	  certain browsers and allow XSS attacks when viewing
	  HTML messages with the HTML MIME viewer</p>
      </body>
    </description>
    <references>
      <url>http://thread.gmane.org/gmane.comp.horde.imp/15488</url>
      <url>http://cvs.horde.org/diff.php/imp/docs/CHANGES?r1=1.389.2.109&amp;r2=1.389.2.111&amp;ty=h</url>
    </references>
    <dates>
      <discovery>2004-08-20</discovery>
      <entry>2004-10-05</entry>
    </dates>
  </vuln>

  <vuln vid="938f357c-16dd-11d9-bc4a-000c41e2cdad">
    <topic>bmon -- unsafe set-user-ID application</topic>
    <affects>
      <package>
	<name>bmon</name>
	<range><lt>1.2.1_2</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
        <p>Jon Nistor reported that the FreeBSD port of bmon was
         installed set-user-ID root, and executes commands using
         relative paths.  This could allow local user to easily obtain
         root privileges.</p>
      </body>
    </description>
    <references>
      <freebsdpr>ports/67340</freebsdpr>
    </references>
    <dates>
      <discovery>2004-05-29</discovery>
      <entry>2004-10-05</entry>
    </dates>
  </vuln>

  <vuln vid="84ab58cf-e4ac-11d8-9b0a-000347a4fa7d">
    <topic>gnutls -- certificate chain verification DoS</topic>
    <affects>
      <package>
        <name>gnutls</name>
        <range><lt>1.0.17</lt></range>
      </package>
      <package>
        <name>gnutls-devel</name>
        <range><ge>1.1.*</ge><lt>1.1.12</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Patric Hornik reports on a problem in the certificate chain
	  verification procedures of GnuTLS that may result in a
	  denial-of-service vulnerability:</p>
	<blockquote cite="http://www.hornik.sk/SA/SA-20040802.txt">
          <p>The certificate chain should be verified from last root
            certificate to the first certificate.  Otherwise a lot
            of unauthorized CPU processing can be forced to check
            certificate signatures signed with arbitrary RSA/DSA keys
	    chosen by attacker.</p>
          <p>In GnuTLS the signatures are checked from first to last
            certificate, there is no limit on size of keys and no
            limit on length of certificate chain.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <url>http://www.hornik.sk/SA/SA-20040802.txt</url>
      <url>http://secunia.com/advisories/12156</url>
    </references>
    <dates>
      <discovery>2004-08-02</discovery>
      <entry>2004-10-05</entry>
    </dates>
  </vuln>

  <vuln vid="562a3fdf-16d6-11d9-bc4a-000c41e2cdad">
    <topic>php -- vulnerability in RFC 1867 file upload processing</topic>
    <affects>
      <package>
        <name>php4</name>
        <name>php4-cgi</name>
        <range><le>4.3.8_2</le></range>
      </package>
      <package>
        <name>mod_php4</name>
        <range><le>4.3.8_2,1</le></range>
      </package>
      <package>
        <name>php5</name>
        <name>php5-cgi</name>
        <range><le>5.0.1</le></range>
      </package>
      <package>
        <name>mod_php5</name>
        <range><le>5.0.1,1</le></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Stefano Di Paola discovered an issue with PHP that
	  could allow someone to upload a file to any directory
	  writeable by the httpd process. Any sanitizing performed on
	  the prepended directory path is ignored. This bug can only
	  be triggered if the $_FILES element name contains an
	  underscore.</p>
      </body>
    </description>
    <references>
      <mlist msgid="1095268057.2818.20.camel@localhost">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=109534848430404</mlist>
      <mlist msgid="1096478151.3220.6.camel@localhost">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=109648426331965</mlist>
    </references>
    <dates>
      <discovery>2004-09-15</discovery>
      <entry>2004-09-15</entry>
      <modified>2004-10-12</modified>
    </dates>
  </vuln>

  <vuln vid="ad74a1bd-16d2-11d9-bc4a-000c41e2cdad">
    <topic>php -- php_variables memory disclosure</topic>
    <affects>
      <package>
        <name>mod_php4-twig</name>
        <name>php4-cgi</name>
        <name>php4-cli</name>
        <name>php4-dtc</name>
        <name>php4-horde</name>
        <name>php4-nms</name>
        <name>php4</name>
        <range><le>4.3.8_2</le></range>
      </package>
      <package>
        <name>mod_php</name>
        <name>mod_php4</name>
	<range><ge>4</ge><le>4.3.8_2,1</le></range>
      </package>
      <package>
        <name>php5</name>
        <name>php5-cgi</name>
        <name>php5-cli</name>
        <range><le>5.0.1</le></range>
      </package>
      <package>
        <name>mod_php5</name>
        <range><le>5.0.1,1</le></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Stefano Di Paola reports:</p>
	<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=109527531130492">
          <p>Bad array parsing in php_variables.c could lead to show
            arbitrary memory content such as pieces of php code
            and other data.  This affects all GET, POST or COOKIES
            variables.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <mlist msgid="1095267581.2818.13.camel@localhost">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=109527531130492</mlist>
    </references>
    <dates>
      <discovery>2004-09-15</discovery>
      <entry>2004-10-05</entry>
    </dates>
  </vuln>

  <vuln vid="fffacc93-16cb-11d9-bc4a-000c41e2cdad">
    <topic>xv -- exploitable buffer overflows</topic>
    <affects>
      <package>
	<name>xv</name>
	<name>xv-m17n</name>
	<range><lt>3.10a_4</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>In a Bugtraq posting, infamous41md(at)hotpop.com reported:</p>
	<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=109302498125092">
          <p>there are at least 5 exploitable buffer and heap
            overflows in the image handling code. this allows someone
            to craft a malicious image, trick a user into viewing the
            file in xv, and upon viewing that image execute arbitrary
            code under privileges of the user viewing image. note
            the AT LEAST part of the above sentence. there is such a
            plethora of bad code that I just stopped reading after
            a while. there are at least 100 calls to sprintf() and
            strcpy() with no regards for bounds of buffers. 95% of
            these deal with program arguments or filenames, so they
            are of no interest to exploit. however I just got sick of
            reading this code after not too long. so im sure there are
            still other overflows in the image handling code for other
            image types.</p>
	</blockquote>
	<p>The posting also included an exploit.</p>
      </body>
    </description>
    <references>
      <mlist msgid="20040820032605.360e43e3.infamous41md@hotpop.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=109302498125092</mlist>
    </references>
    <dates>
      <discovery>2004-08-20</discovery>
      <entry>2004-10-05</entry>
      <modified>2004-10-12</modified>
    </dates>
  </vuln>

  <vuln vid="8c33b299-163b-11d9-ac1b-000d614f7fad">
    <topic>getmail -- symlink vulnerability during maildir delivery</topic>
      <affects>
        <package>
	  <name>getmail</name>
	  <range><lt>3.2.5</lt></range>
	</package>
      </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
        <p>David Watson reports a symlink vulnerability in getmail.
          If run as root (not the recommended mode of operation), a
          local user may be able to cause getmail to write files in
          arbitrary directories via a symlink attack on subdirectories
          of the maildir.</p>
      </body>
    </description>
    <references>
      <mlist msgid="200409191532.38997.baikie@ehwat.freeserve.co.uk">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=109571883130372</mlist>
      <cvename>CAN-2004-0881</cvename>
      <bid>11224</bid>
    </references>
    <dates>
      <discovery>2004-09-19</discovery>
      <entry>2004-10-04</entry>
    </dates>
  </vuln>

  <vuln vid="67710833-1626-11d9-bc4a-000c41e2cdad">
    <topic>Boundary checking errors in syscons</topic>
    <affects>
      <system>
	<name>FreeBSD</name>
	<range><ge>5.0</ge><lt>5.2.1_11</lt></range>
      </system>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The syscons CONS_SCRSHOT <a
	  href="http://www.freebsd.org/cgi/man.cgi?query=ioctl">ioctl(2)</a>
          does insufficient validation of its input arguments.  In
          particular, negative coordinates or large coordinates may
          cause unexpected behavior.</p>
        <p>It may be possible to cause the CONS_SCRSHOT ioctl to
          return portions of kernel memory.  Such memory might
          contain sensitive information, such as portions of the
          file cache or terminal buffers.  This information might be
          directly useful, or it might be leveraged to obtain elevated
          privileges in some way.  For example, a terminal buffer
          might include a user-entered password.</p>
        <p>This bug may be exploitable by users who have access to the
          physical console or can otherwise open a /dev/ttyv* device
	  node.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-0919</cvename>
      <freebsdsa>SA-04:15.syscons</freebsdsa>
      <url>http://www.freebsd.org/cgi/cvsweb.cgi/src/sys/dev/syscons/syscons.c#rev1.429</url>
    </references>
    <dates>
      <discovery>2004-09-30</discovery>
      <entry>2004-10-04</entry>
    </dates>
  </vuln>

  <vuln vid="2328ADEF-157C-11D9-8402-000D93664D5C">
    <topic>racoon -- improper certificate handling</topic>
    <affects>
      <package>
	<name>racoon</name>
	<range><lt>20040818a</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Thomas Walpuski noted when OpenSSL would detect an error
	  condition for a peer certificate, racoon mistakenly ignored
	  the error. This could allow five invalid certificate states
	  to properly be used for authentication.</p>
      </body>
    </description>
    <references>
      <mlist msgid="20040614185623.GA10290@unproved.org">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=108726102304507</mlist>
      <url>http://www.kame.net/racoon/racoon-ml/msg00517.html</url>
    </references>
    <dates>
      <discovery>2004-01-31</discovery>
      <entry>2004-10-03</entry>
    </dates>
  </vuln>

  <vuln vid="e8d4800f-1547-11d9-90a3-00010327614a">
    <topic>distcc -- incorrect parsing of IP access control rules</topic>
    <affects>
      <package>
        <name>distcc</name>
	<range><lt>2.16</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<blockquote cite="http://distcc.samba.org/ftp/distcc/distcc-2.16.NEWS">
	  <p>Fix bug that might cause IP-based access control rules not to
	    be interpreted correctly on 64-bit platforms.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-0601</cvename>
      <url>http://distcc.samba.org/ftp/distcc/distcc-2.16.NEWS</url>
    </references>
    <dates>
      <discovery>2004-06-23</discovery>
      <entry>2004-10-03</entry>
    </dates>
  </vuln>

 <vuln vid="b2e6d1d6-1339-11d9-bc4a-000c41e2cdad">
    <topic>mozilla -- scripting vulnerabilities</topic>
    <affects>
      <package>
        <name>thunderbird</name>
	<range><lt>0.8</lt></range>
      </package>
      <package>
        <name>de-linux-mozillafirebird</name>
	<name>el-linux-mozillafirebird</name>
        <name>firefox</name>
        <name>ja-linux-mozillafirebird-gtk1</name>
        <name>ja-mozillafirebird-gtk2</name>
        <name>linux-mozillafirebird</name>
        <name>ru-linux-mozillafirebird</name>
        <name>zhCN-linux-mozillafirebird</name>
        <name>zhTW-linux-mozillafirebird</name>
	<range><lt>1.p</lt></range>
      </package>
      <package>
        <name>de-netscape7</name>
        <name>fr-netscape7</name>
        <name>ja-netscape7</name>
        <name>netscape7</name>
        <name>pt_BR-netscape7</name>
	<range><le>7.2</le></range>
      </package>
      <package>
        <name>mozilla-gtk1</name>
        <name>linux-mozilla</name>
        <name>linux-mozilla-devel</name>
        <range><lt>1.7.3</lt></range>
      </package>
      <package>
	<name>mozilla</name>
	<range><lt>1.7.3,2</lt></range>
      </package>
      <package>
	<!-- These package names are obsolete. -->
        <name>de-linux-netscape</name>
        <name>fr-linux-netscape</name>
        <name>ja-linux-netscape</name>
        <name>linux-netscape</name>
        <name>linux-phoenix</name>
        <name>mozilla+ipv6</name>
        <name>mozilla-embedded</name>
        <name>mozilla-firebird</name>
        <name>mozilla-gtk2</name>
        <name>mozilla-gtk</name>
        <name>mozilla-thunderbird</name>
        <name>phoenix</name>
	<range><ge>0</ge></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Several scripting vulnerabilities were discovered and
	  corrected in Mozilla:</p>
	<dl>
	  <dt>CAN-2004-0905</dt>
	  <dd>
	    <blockquote cite="http://www.mozilla.org/projects/security/known-vulnerabilities.html">
	      <p>javascript; links dragged onto another frame or
		page allows an attacker to steal or modify sensitive
		information from other sites. The user could be convinced
		to drag obscurred links in the context of a game or even a
		fake scrollbar. If the user could be convinced to drag two
		links in sequence into a separate window (not frame) the
		attacker would be able to run arbitrary programs.</p>
	    </blockquote>
	  </dd>
	  <dt>CAN-2004-0908</dt>
	  <dd>
	    <blockquote cite="http://www.mozilla.org/projects/security/known-vulnerabilities.html">
              <p>Untrusted javascript code can read and write to the
                clipboard, stealing any sensitive data the user might
                have copied. <strong>Workaround:</strong> disable
                javascript</p>
	    </blockquote>
	  </dd>
	  <dt>CAN-2004-0909</dt>
	  <dd>
	    <blockquote cite="http://www.mozilla.org/projects/security/known-vulnerabilities.html">
              <p>Signed scripts requesting enhanced abilities could
                construct the request in a way that led to a confusing
                grant dialog, possibly fooling the user into thinking
                the privilege requested was inconsequential while
                actually obtaining explicit permission to run and
                install software. <strong>Workaround:</strong> Never
                grant enhanced abilities of any kind to untrusted web
                pages.</p>
	    </blockquote>
	  </dd>
	</dl>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-0905</cvename>
      <cvename>CAN-2004-0908</cvename>
      <cvename>CAN-2004-0909</cvename>
      <url>http://bugzilla.mozilla.org/show_bug.cgi?id=250862</url>
      <url>http://bugzilla.mozilla.org/show_bug.cgi?id=257523</url>
      <url>http://bugzilla.mozilla.org/show_bug.cgi?id=253942</url>
    </references>
    <dates>
      <discovery>2004-09-13</discovery>
      <entry>2004-09-30</entry>
    </dates>
  </vuln>

  <vuln vid="a7e0d783-131b-11d9-bc4a-000c41e2cdad">
    <topic>mozilla -- users may be lured into bypassing security dialogs</topic>
    <affects>
      <package>
        <name>thunderbird</name>
	<range><lt>0.7</lt></range>
      </package>
      <package>
        <name>de-linux-mozillafirebird</name>
	<name>el-linux-mozillafirebird</name>
        <name>firefox</name>
        <name>ja-linux-mozillafirebird-gtk1</name>
        <name>ja-mozillafirebird-gtk2</name>
        <name>linux-mozillafirebird</name>
        <name>ru-linux-mozillafirebird</name>
        <name>zhCN-linux-mozillafirebird</name>
        <name>zhTW-linux-mozillafirebird</name>
	<range><lt>0.9.2</lt></range>
      </package>
      <package>
        <name>de-netscape7</name>
        <name>fr-netscape7</name>
        <name>ja-netscape7</name>
        <name>netscape7</name>
        <name>pt_BR-netscape7</name>
	<range><le>7.2</le></range>
      </package>
      <package>
        <name>mozilla-gtk1</name>
        <name>linux-mozilla</name>
        <name>linux-mozilla-devel</name>
        <range><lt>1.7</lt></range>
      </package>
      <package>
	<name>mozilla</name>
	<range><lt>1.7,2</lt></range>
      </package>
      <package>
	<!-- These package names are obsolete. -->
        <name>de-linux-netscape</name>
        <name>fr-linux-netscape</name>
        <name>ja-linux-netscape</name>
        <name>linux-netscape</name>
        <name>linux-phoenix</name>
        <name>mozilla+ipv6</name>
        <name>mozilla-embedded</name>
        <name>mozilla-firebird</name>
        <name>mozilla-gtk2</name>
        <name>mozilla-gtk</name>
        <name>mozilla-thunderbird</name>
        <name>phoenix</name>
	<range><ge>0</ge></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>According to the Mozilla project:</p>
	<blockquote cite="http://www.mozilla.org/projects/security/known-vulnerabilities.html">
	  <p>An attacker who could lure users into clicking in
	    particular places, or typing specific text, could cause a
	    security permission or software installation dialog to pop
	    up under the user's mouse click, clicking on the grant (or
	    install) button.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-0762</cvename>
      <url>http://bugzilla.mozilla.org/show_bug.cgi?id=162020</url>
    </references>
    <dates>
      <discovery>2004-06-05</discovery>
      <entry>2004-09-30</entry>
    </dates>
  </vuln>

  <vuln vid="5360a659-131c-11d9-bc4a-000c41e2cdad">
    <topic>mozilla -- hostname spoofing bug</topic>
    <affects>
      <package>
        <name>thunderbird</name>
	<range><lt>0.7</lt></range>
      </package>
      <package>
        <name>de-linux-mozillafirebird</name>
	<name>el-linux-mozillafirebird</name>
        <name>firefox</name>
        <name>ja-linux-mozillafirebird-gtk1</name>
        <name>ja-mozillafirebird-gtk2</name>
        <name>linux-mozillafirebird</name>
        <name>ru-linux-mozillafirebird</name>
        <name>zhCN-linux-mozillafirebird</name>
        <name>zhTW-linux-mozillafirebird</name>
	<range><lt>0.9.2</lt></range>
      </package>
      <package>
        <name>de-netscape7</name>
        <name>fr-netscape7</name>
        <name>ja-netscape7</name>
        <name>netscape7</name>
        <name>pt_BR-netscape7</name>
	<range><le>7.2</le></range>
      </package>
      <package>
        <name>mozilla-gtk1</name>
        <name>linux-mozilla</name>
        <name>linux-mozilla-devel</name>
        <range><lt>1.7</lt></range>
      </package>
      <package>
	<name>mozilla</name>
	<range><lt>1.7,2</lt></range>
      </package>
      <package>
	<!-- These package names are obsolete. -->
        <name>de-linux-netscape</name>
        <name>fr-linux-netscape</name>
        <name>ja-linux-netscape</name>
        <name>linux-netscape</name>
        <name>linux-phoenix</name>
        <name>mozilla+ipv6</name>
        <name>mozilla-embedded</name>
        <name>mozilla-firebird</name>
        <name>mozilla-gtk2</name>
        <name>mozilla-gtk</name>
        <name>mozilla-thunderbird</name>
        <name>phoenix</name>
	<range><ge>0</ge></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>When processing URIs that contain an unqualified host name--
	  specifically, a domain name of only one component--
	  Mozilla will perform matching against the first component
	  of the domain name in SSL certificates.  In other words, in
	  some situations, a certificate issued to "www.example.com"
	  will be accepted as matching "www".</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-0765</cvename>
      <url>http://bugzilla.mozilla.org/show_bug.cgi?id=234058</url>
    </references>
    <dates>
      <discovery>2004-02-12</discovery>
      <entry>2004-09-30</entry>
    </dates>
  </vuln>

  <vuln vid="de16b056-132e-11d9-bc4a-000c41e2cdad">
    <topic>samba -- remote file disclosure</topic>
    <affects>
      <package>
	<name>samba</name>
	<range><lt>2.2.12</lt></range>
	<range><ge>3.a</ge><le>3.0.2a_1,1</le></range>
      </package>
      <package>
	<name>ja-samba</name>
	<range><lt>2.2.11.j1.0_1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>According to a Samba Team security notice:</p>
	<blockquote cite="http://www.samba.org/samba/news/#security_2.2.12">
          <p>A security vulnerability has been located in Samba
            2.2.x &lt;= 2.2.11 and Samba 3.0.x &lt;= 3.0.5. A remote
            attacker may be able to gain access to files which exist
            outside of the share's defined path. Such files must still
            be readable by the account used for the connection.</p>
        </blockquote>
	<blockquote cite="http://www.samba.org/samba/news/#errata_05oct">
          <p>The original notice for CAN-2004-0815 indicated that
            Samba 3.0.x &lt;= 3.0.5 was vulnerable to the security
            issue. After further research, Samba developers have
            confirmed that only Samba 3.0.2a and earlier releases
            contain the exploitable code.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-0815</cvename>
      <url>http://www.samba.org/samba/news/#security_2.2.12</url>
    </references>
    <dates>
      <discovery>2004-09-30</discovery>
      <entry>2004-09-30</entry>
      <modified>2004-10-15</modified>
    </dates>
  </vuln>

  <vuln vid="ab9c559e-115a-11d9-bc4a-000c41e2cdad">
    <topic>mozilla -- BMP decoder vulnerabilities</topic>
    <affects>
      <package>
        <name>thunderbird</name>
	<range><lt>0.7.3_1</lt></range>
      </package>
      <package>
        <name>de-linux-mozillafirebird</name>
	<name>el-linux-mozillafirebird</name>
        <name>firefox</name>
        <name>ja-linux-mozillafirebird-gtk1</name>
        <name>ja-mozillafirebird-gtk2</name>
        <name>linux-mozillafirebird</name>
        <name>linux-phoenix</name>
        <name>phoenix</name>
        <name>ru-linux-mozillafirebird</name>
        <name>zhCN-linux-mozillafirebird</name>
        <name>zhTW-linux-mozillafirebird</name>
	<range><lt>0.9.3_1</lt></range>
      </package>
      <package>
        <name>de-netscape7</name>
        <name>fr-netscape7</name>
        <name>ja-netscape7</name>
        <name>netscape7</name>
        <name>pt_BR-netscape7</name>
	<range><le>7.2</le></range>
      </package>
      <package>
        <name>linux-mozilla</name>
        <name>linux-mozilla-devel</name>
        <range><lt>1.7.3</lt></range>
      </package>
      <package>
        <name>mozilla-gtk1</name>
	<range><lt>1.7.2_3</lt></range>
      </package>
      <package>
	<name>mozilla</name>
	<range><lt>1.7.2_2,2</lt></range>
	<range><ge>1.8.a,2</ge><lt>1.8.a3_1,2</lt></range>
      </package>
      <package>
	<!-- These package names are obsolete. -->
        <name>mozilla+ipv6</name>
        <name>mozilla-embedded</name>
        <name>mozilla-firebird</name>
        <name>mozilla-gtk</name>
        <name>mozilla-gtk2</name>
        <name>mozilla-thunderbird</name>
        <name>linux-netscape</name>
        <name>de-linux-netscape</name>
        <name>fr-linux-netscape</name>
        <name>ja-linux-netscape</name>
	<range><ge>0</ge></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Gael Delalleau discovered several integer overflows in
	  Mozilla's BMP decoder that can result in denial-of-service or
	  arbitrary code execution.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-0904</cvename>
      <url>http://bugzilla.mozilla.org/show_bug.cgi?id=255067</url>
      <uscertta>TA04-261A</uscertta>
      <certvu>847200</certvu>
    </references>
    <dates>
      <discovery>2004-09-13</discovery>
      <entry>2004-09-28</entry>
      <modified>2004-09-30</modified>
    </dates>
  </vuln>

  <vuln vid="da690355-1159-11d9-bc4a-000c41e2cdad">
    <topic>mozilla -- vCard stack buffer overflow</topic>
    <affects>
      <package>
	<name>thunderbird</name>
	<range><lt>0.7.3_1</lt></range>
      </package>
      <package>
	<name>mozilla</name>
	<range><lt>1.7.2_2,2</lt></range>
	<range><ge>1.8.a,2</ge><lt>1.8.a3_1,2</lt></range>
      </package>
      <package>
	<name>mozilla-gtk1</name>
	<range><lt>1.7.2_3</lt></range>
      </package>
      <package>
	<name>linux-mozilla</name>
	<range><lt>1.7.3</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
        <p>Georgi Guninski discovered a stack buffer overflow which
          may be triggered when viewing email messages with vCard
          attachments.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-0903</cvename>
      <url>http://bugzilla.mozilla.org/show_bug.cgi?id=257314</url>
      <uscertta>TA04-261A</uscertta>
      <certvu>414240</certvu>
    </references>
    <dates>
      <discovery>2004-09-13</discovery>
      <entry>2004-09-28</entry>
      <modified>2004-09-30</modified>
    </dates>
  </vuln>

  <vuln vid="93d6162f-1153-11d9-bc4a-000c41e2cdad">
    <topic>mozilla -- multiple heap buffer overflows</topic>
    <affects>
      <package>
	<name>thunderbird</name>
	<range><lt>0.7.3_1</lt></range>
      </package>
      <package>
	<name>firefox</name>
	<range><lt>0.9.3_1</lt></range>
      </package>
      <package>
	<name>mozilla</name>
	<range><lt>1.7.2_2,2</lt></range>
	<range><ge>1.8.a,2</ge><lt>1.8.a3_1,2</lt></range>
      </package>
      <package>
	<name>mozilla-gtk1</name>
	<range><lt>1.7.2_3</lt></range>
      </package>
      <package>
	<name>linux-mozilla</name>
	<range><lt>1.7.3</lt></range>
      </package>
      <package>
	<name>linux-mozillafirebird</name>
	<range><ge>0</ge></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Several heap buffer overflows were discovered and fixed in the
	  most recent versions of Mozilla, Firefox, and Thunderbird.
	  These overflows may occur when:</p>
	<ul>
	  <li>Using the "Send Page" function.</li>
	  <li>Checking mail on a malicious POP3 server.</li>
	  <li>Processing non-ASCII URLs.</li>
	</ul>
	<p>Each of these vulnerabilities may be exploited for remote
	  code execution.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-0902</cvename>
      <url>http://bugzilla.mozilla.org/show_bug.cgi?id=258005</url>
      <url>http://bugzilla.mozilla.org/show_bug.cgi?id=245066</url>
      <url>http://bugzilla.mozilla.org/show_bug.cgi?id=226669</url>
      <url>http://bugzilla.mozilla.org/show_bug.cgi?id=256316</url>
      <uscertta>TA04-261A</uscertta>
    </references>
    <dates>
      <discovery>2004-09-13</discovery>
      <entry>2004-09-28</entry>
    </dates>
  </vuln>

  <vuln vid="edf61c61-0f07-11d9-8393-000103ccf9d6">
    <topic>php -- strip_tags cross-site scripting vulnerability</topic>
    <affects>
      <package>
	<name>mod_php4-twig</name>
	<name>php4</name>
	<name>php4-cgi</name>
	<name>php4-cli</name>
	<name>php4-dtc</name>
	<name>php4-horde</name>
	<name>php4-nms</name>
	<range><le>4.3.7_3</le></range>
      </package>
      <package>
	<name>mod_php4</name>
	<range><le>4.3.7_3,1</le></range>
      </package>
      <package>
	<name>php5</name>
	<name>php5-cgi</name>
	<name>php5-cli</name>
	<range><le>5.0.0.r3_2</le></range>
      </package>
      <package>
	<name>mod_php5</name>
	<range><le>5.0.0.r3_2,1</le></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Stefan Esser of e-matters discovered that PHP's strip_tags()
	  function would ignore certain characters during parsing of tags,
	  allowing these tags to pass through. Select browsers could then
	  parse these tags, possibly allowing cross-site scripting attacks.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-0595</cvename>
      <mlist msgid="20040713225525.GB26865@e-matters.de">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=108981589117423</mlist>
      <url>http://security.e-matters.de/advisories/122004.html</url>
      <bid>10724</bid>
    </references>
    <dates>
      <discovery>2007-07-07</discovery>
      <entry>2004-09-27</entry>
      <modified>2004-10-02</modified>
    </dates>
  </vuln>

  <vuln vid="dd7aa4f1-102f-11d9-8a8a-000c41e2cdad">
    <topic>php -- memory_limit related vulnerability</topic>
    <affects>
      <package>
	<name>mod_php4-twig</name>
	<name>php4</name>
	<name>php4-cgi</name>
	<name>php4-cli</name>
	<name>php4-dtc</name>
	<name>php4-horde</name>
	<name>php4-nms</name>
	<range><le>4.3.7_3</le></range>
      </package>
      <package>
	<name>mod_php4</name>
	<range><le>4.3.7_3,1</le></range>
      </package>
      <package>
	<name>php5</name>
	<name>php5-cgi</name>
	<name>php5-cli</name>
	<range><le>5.0.0.r3_2</le></range>
      </package>
      <package>
	<name>mod_php5</name>
	<range><le>5.0.0.r3_2,1</le></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Stefan Esser of e-matters discovered a condition within PHP
	  that may lead to remote execution of arbitrary code.  The
	  memory_limit facility is used to notify functions when memory
	  contraints have been met. Under certain conditions, the entry
	  into this facility is able to interrupt functions such as
	  zend_hash_init() at locations not suitable for interruption.
	  The result would leave these functions in a vulnerable state.</p>
	<blockquote cite="http://security.e-matters.de/advisories/112004.html">
	  <p>An attacker that is able to trigger the memory_limit abort
	    within zend_hash_init() and is additionally able to control
	    the heap before the HashTable itself is allocated, is able to
	    supply his own HashTable destructor pointer. [...]</p>
	  <p>All mentioned places outside of the extensions are quite easy
	    to exploit, because the memory allocation up to those places
	    is deterministic and quite static throughout different PHP
	    versions. [...]</p>
	  <p>Because the exploit itself consist of supplying an arbitrary
	    destructor pointer this bug is exploitable on any platform.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-0594</cvename>
      <mlist msgid="20040713225329.GA26865@e-matters.de">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=108981780109154</mlist>
      <url>http://security.e-matters.de/advisories/112004.html</url>
      <bid>10725</bid>
    </references>
    <dates>
      <discovery>2007-07-07</discovery>
      <entry>2004-09-27</entry>
      <modified>2004-10-02</modified>
    </dates>
  </vuln>

  <vuln vid="184f5d0b-0fe8-11d9-8a8a-000c41e2cdad">
    <topic>subversion -- WebDAV fails to protect metadata</topic>
    <affects>
      <package>
	<name>subversion</name>
	<name>subversion-perl</name>
	<name>subversion-python</name>
	<range><lt>1.0.8</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>In some situations, subversion metadata may be unexpectedly
	  disclosed via WebDAV.  A subversion advisory states:</p>
	<blockquote cite="http://subversion.tigris.org/security/CAN-2004-0749-advisory.txt">
	  <p>mod_authz_svn, the Apache httpd module which does path-based
	    authorization on Subversion repositories, is not correctly
	    protecting all metadata on unreadable paths.</p>
          <p>This security issue is not about revealing the contents
            of protected files: it only reveals metadata about
            protected areas such as paths and log messages.  This may
            or may not be important to your organization, depending
            on how you're using path-based authorization, and the
            sensitivity of the metadata. </p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-0749</cvename>
      <url>http://subversion.tigris.org/security/CAN-2004-0749-advisory.txt</url>
    </references>
    <dates>
      <discovery>2004-09-15</discovery>
      <entry>2004-09-26</entry>
    </dates>
  </vuln>
  <vuln vid="273cc1a3-0d6b-11d9-8a8a-000c41e2cdad">
    <topic>lha -- numerous vulnerabilities when extracting archives</topic>
    <affects>
      <package>
	<name>lha</name>
	<range><lt>1.14i_6</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Source code reviews of lha by Lukasz Wojtow, Thomas Biege,
	  and others uncovered a number of vulnerabilities affecting
	  lha:</p>
	<ul>
	  <li>Buffer overflows when handling archives and filenames.
	    (CAN-2004-0694)</li>
	  <li>Possible command execution via shell meta-characters when
	    built with NOMKDIR. (CAN-2004-0745)</li>
	  <li>Buffer overflow resulting in arbitrary code execution when
	    handling long pathnames in LHZ archives. (CAN-2004-0769)</li>
	  <li>Buffer overflow in the extract_one. (CAN-2004-0771)</li>
	</ul>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-0694</cvename>
      <cvename>CAN-2004-0745</cvename>
      <cvename>CAN-2004-0769</cvename>
      <cvename>CAN-2004-0771</cvename>
      <mlist msgid="20040515110900.24784.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=108464470103227</mlist>
      <mlist msgid="20040606162856.29866.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=108668791510153</mlist>
      <url>http://bugs.gentoo.org/show_bug.cgi?id=51285</url>
      <url>http://xforce.iss.net/xforce/xfdb/16196</url>
      <bid>10354</bid>
    </references>
    <dates>
      <discovery>2004-05-17</discovery>
      <entry>2004-09-23</entry>
    </dates>
  </vuln>

  <vuln vid="77420ebb-0cf4-11d9-8a8a-000c41e2cdad">
    <topic>mysql -- heap buffer overflow with prepared statements</topic>
    <affects>
      <package>
	<name>mysql-server</name>
	<name>mysql-client</name>
	<range><ge>4.1.0</ge><le>4.1.4</le></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
        <p>There is a buffer overflow in the prepared statements API
          (libmysqlclient) when a statement containing thousands of
          placeholders is executed.</p>
      </body>
    </description>
    <references>
      <url>http://bugs.mysql.com/bug.php?id=5194</url>
      <url>http://dev.mysql.com/doc/mysql/en/News-4.1.5.html</url>
      <url>http://mysql.bkbits.net:8080/mysql-4.1/cset@1.1932.152.4</url>
    </references>
    <dates>
      <discovery>2004-09-08</discovery>
      <entry>2004-09-23</entry>
    </dates>
  </vuln>

  <vuln vid="e9f9d232-0cb2-11d9-8a8a-000c41e2cdad">
    <topic>mozilla -- security icon spoofing</topic>
    <affects>
      <package>
	<name>firefox</name>
	<range><lt>0.9</lt></range>
      </package>
      <package>
        <name>linux-mozilla</name>
        <name>linux-mozilla-devel</name>
        <range><lt>1.7</lt></range>
      </package>
      <package>
	<name>mozilla</name>
	<range><lt>1.7,2</lt></range>
      </package>
      <package>
	<name>mozilla-gtk1</name>
	<range><lt>1.7</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Under certain situations it is possible for the security icon
	  which Mozilla displays when connected to a site using SSL to
	  be spoofed.  This could be used to make so-called "phishing
	  attacks" more difficult to detect.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-0761</cvename>
      <url>https://bugzilla.mozilla.org/show_bug.cgi?id=240053</url>
    </references>
    <dates>
      <discovery>2004-04-08</discovery>
      <entry>2004-09-22</entry>
    </dates>
  </vuln>

  <vuln vid="7c188c55-0cb0-11d9-8a8a-000c41e2cdad">
    <topic>mozilla -- NULL bytes in FTP URLs</topic>
    <affects>
      <package>
	<name>firefox</name>
	<range><lt>0.9.3</lt></range>
      </package>
      <package>
        <name>linux-mozilla</name>
        <name>linux-mozilla-devel</name>
        <range><lt>1.7.2</lt></range>
      </package>
      <package>
	<name>mozilla</name>
	<range><lt>1.7.2,2</lt></range>
	<range><ge>1.8.a,2</ge></range>
      </package>
      <package>
	<name>mozilla-gtk1</name>
	<range><lt>1.7.2</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>When handling FTP URLs containing NULL bytes, Mozilla will
	  interpret the file content as HTML.  This may allow unexpected
	  execution of Javascript when viewing plain text or other file
	  types via FTP.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-0760</cvename>
      <url>http://bugzilla.mozilla.org/show_bug.cgi?id=250906</url>
    </references>
    <dates>
      <discovery>2004-07-11</discovery>
      <entry>2004-09-22</entry>
      <modified>2004-09-24</modified>
    </dates>
  </vuln>

  <vuln vid="6e740881-0cae-11d9-8a8a-000c41e2cdad">
    <topic>mozilla -- automated file upload</topic>
    <affects>
      <package>
	<name>mozilla</name>
	<range><ge>1.7.a,2</ge><lt>1.7,2</lt></range>
	<range><ge>1.8.a,2</ge><lt>1.8.a2,2</lt></range>
      </package>
      <package>
	<name>mozilla-gtk1</name>
	<range><ge>1.7.a</ge><lt>1.7</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
        <p>A malicious web page can cause an automated file upload
          from the victim's machine when viewed with Mozilla with
          Javascript enabled.  This is due to a bug permitting
          default values for type="file" &lt;input&gt; elements in
          certain situations.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-0759</cvename>
      <url>https://bugzilla.mozilla.org/show_bug.cgi?id=241924</url>
    </references>
    <dates>
      <discovery>2004-04-28</discovery>
      <entry>2004-09-22</entry>
      <modified>2004-09-26</modified>
    </dates>
  </vuln>

  <vuln vid="8d823883-0ca9-11d9-8a8a-000c41e2cdad">
    <topic>mozilla -- built-in CA certificates may be overridden</topic>
    <affects>
      <package>
        <name>firefox</name>
        <range><lt>0.9.3</lt></range>
      </package>
      <package>
        <name>linux-mozilla</name>
        <name>linux-mozilla-devel</name>
        <range><lt>1.7.2</lt></range>
      </package>
      <package>
        <name>mozilla</name>
        <range><lt>1.7.2,2</lt></range>
        <range><ge>1.8.a,2</ge></range>
      </package>
      <package>
        <name>mozilla-gtk1</name>
        <range><lt>1.7.2</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
        <p>Under some situations, Mozilla will automatically import
          a certificate from an email message or web site.  This
          behavior can be used as a denial-of-service attack: if the
          certificate has a distinguished name (DN) identical to one
          of the built-in Certificate Authorities (CAs), then Mozilla
          will no longer be able to certify sites with certificates
          issued from that CA.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-0758</cvename>
      <url>https://bugzilla.mozilla.org/show_bug.cgi?id=249004</url>
      <certvu>160360</certvu>
      <url>http://banquo.inf.ethz.ch:8080/</url>
    </references>
    <dates>
      <discovery>2004-06-29</discovery>
      <entry>2004-09-22</entry>
    </dates>
  </vuln>

  <vuln vid="a4815970-c5cc-11d8-8898-000d6111a684">
    <topic>rssh -- file name disclosure bug</topic>
    <affects>
      <package>
	<name>rssh</name>
	<range><lt>2.2.1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
        <p>rssh expands command line paramters before invoking chroot.
          This could result in the disclosure to the client of file
          names outside of the chroot directory.  A posting by the rssh
	  author explains:</p>
	<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=108787373022844">
          <p>The cause of the problem identified by Mr. McCaw is that
            rssh expanded command-line arguments prior to entering
            the chroot jail.  This bug DOES NOT allow a user to
            access any of the files outside the jail, but can allow
            them to discover what files are in a directory which is
            outside the jail, if their credentials on the server would
            normally allow them read/execute access in the specified
            directory.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-0609</cvename>
      <mlist msgid="20040619074141.GG13649@sophic.org">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=108787373022844</mlist>
      <bid>10574</bid>
      <url>http://www.osvdb.org/7239</url>
    </references>
    <dates>
      <discovery>2004-06-19</discovery>
      <entry>2004-09-21</entry>
    </dates>
  </vuln>

  <vuln vid="e6f0edd8-0b40-11d9-8a8a-000c41e2cdad">
    <topic>gnu-radius -- SNMP-related denial-of-service</topic>
    <affects>
      <package>
	<name>gnu-radius</name>
	<range><lt>1.2.94</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>An iDEFENSE security advisory reports:</p>
	<blockquote
	  cite="http://www.idefense.com/application/poi/display?id=141&amp;type=vulnerabilities">
          <p>Remote exploitation of an input validation error in
            version 1.2 of GNU radiusd could allow a denial of
            service.</p>
          <p>The vulnerability specifically exists within
            the asn_decode_string() function defined in
            snmplib/asn1.c. When a very large unsigned number is
            supplied, it is possible that an integer overflow will
            occur in the bounds-checking code. The daemon will then
            attempt to reference unallocated memory, resulting in an
            access violation that causes the process to terminate.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-0849</cvename>
      <url>http://www.idefense.com/application/poi/display?id=141&amp;type=vulnerabilities</url>
    </references>
    <dates>
      <discovery>2004-09-15</discovery>
      <entry>2004-09-20</entry>
      <modified>2005-05-03</modified>
    </dates>
  </vuln>

  <vuln vid="a268ef4a-0b35-11d9-8a8a-000c41e2cdad">
    <topic>sudo -- sudoedit information disclosure</topic>
    <affects>
      <package>
	<name>sudo</name>
	<range><eq>1.6.8</eq></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
        <p>A new feature of sudo 1.6.8 called "sudoedit" (a safe
          editing facility) may allow users to read files to which
          they normally have no access.</p>
      </body>
    </description>
    <references>
      <url>http://www.sudo.ws/sudo/alerts/sudoedit.html</url>
    </references>
    <dates>
      <discovery>2004-09-18</discovery>
      <entry>2004-09-20</entry>
    </dates>
  </vuln>

  <vuln vid="ca6c8f35-0a5f-11d9-ad6f-00061bc2ad93">
    <topic>apache -- heap overflow in mod_proxy</topic>
    <affects>
      <package>
	<name>apache</name>
	<range><lt>1.3.31_1</lt></range>
      </package>
      <package>
	<name>apache13-ssl</name>
	<range><le>1.3.29.1.53_2</le></range>
      </package>
      <package>
	<name>apache13-modssl</name>
	<range><lt>1.3.31+2.8.18_4</lt></range>
      </package>
      <package>
	<name>apache13+ipv6</name>
	<range><le>1.3.29_2</le></range>
      </package>
      <package>
	<name>apache13-modperl</name>
	<range><le>1.3.31</le></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A buffer overflow exists in mod_proxy which may
	  allow an attacker to launch local DoS attacks
	  and possibly execute arbitrary code.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-0492</cvename>
      <url>http://www.guninski.com/modproxy1.html</url>
    </references>
    <dates>
      <discovery>2004-06-10</discovery>
      <entry>2004-09-19</entry>
      <modified>2004-10-05</modified>
    </dates>
  </vuln>

  <vuln vid="d2102505-f03d-11d8-81b0-000347a4fa7d">
    <topic>cvs -- numerous vulnerabilities</topic>
    <affects>
      <package>
	<name>cvs+ipv6</name>
	<range><lt>1.11.17</lt></range>
      </package>
      <system>
	<name>FreeBSD</name>
	<range><ge>5.2</ge><lt>5.2.1_10</lt></range>
	<range><ge>4.10</ge><lt>4.10_3</lt></range>
	<range><ge>4.9</ge><lt>4.9_12</lt></range>
	<range><ge>4.8</ge><lt>4.8_25</lt></range>
      </system>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
        <p>A number of vulnerabilities were discovered in CVS by
	  Stefan Esser, Sebastian Krahmer, and Derek Price.</p>
	<ul>
          <li>Insufficient input validation while processing "Entry"
	    lines.  (CAN-2004-0414)</li>
	  <li>A double-free resulting from erroneous state handling while
	    processing "Argumentx" commands. (CAN-2004-0416)</li>
	  <li>Integer overflow while processing "Max-dotdot" commands.
	    (CAN-2004-0417)</li>
	  <li>Erroneous handling of empty entries handled while processing
	    "Notify" commands. (CAN-2004-0418)</li>
	  <li>A format string bug while processing CVS wrappers.</li>
	  <li>Single-byte buffer underflows while processing configuration files
	    from CVSROOT.</li>
	  <li>Various other integer overflows.</li>
	</ul>
        <p>Additionally, iDEFENSE reports an undocumented command-line
          flag used in debugging does not perform input validation on
          the given path names.</p>
        <p>CVS servers ("cvs server" or :pserver: modes) are
          affected by these vulnerabilities.  They vary in impact
          but include information disclosure (the iDEFENSE-reported
          bug), denial-of-service (CAN-2004-0414, CAN-2004-0416,
          CAN-2004-0417 and other bugs), or possibly arbitrary code
          execution (CAN-2004-0418).  In very special situations where
          the attacker may somehow influence the contents of CVS
          configuration files in CVSROOT, additional attacks may be
          possible.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-0414</cvename>
      <cvename>CAN-2004-0416</cvename>
      <cvename>CAN-2004-0417</cvename>
      <cvename>CAN-2004-0418</cvename>
      <cvename>CAN-2004-0778</cvename>
      <url>http://secunia.com/advisories/11817</url>
      <url>http://secunia.com/advisories/12309</url>
      <url>http://security.e-matters.de/advisories/092004.html</url>
      <url>http://www.idefense.com/application/poi/display?id=130&amp;type=vulnerabilities&amp;flashstatus=false</url>
      <url>https://ccvs.cvshome.org/source/browse/ccvs/NEWS?rev=1.116.2.104</url>
      <url>http://www.osvdb.org/6830</url>
      <url>http://www.osvdb.org/6831</url>
      <url>http://www.osvdb.org/6832</url>
      <url>http://www.osvdb.org/6833</url>
      <url>http://www.osvdb.org/6834</url>
      <url>http://www.osvdb.org/6835</url>
      <url>http://www.osvdb.org/6836</url>
      <bid>10499</bid>
      <freebsdsa>SA-04:14.cvs</freebsdsa>
    </references>
    <dates>
      <discovery>2004-05-20</discovery>
      <entry>2004-08-17</entry>
      <modified>2004-09-19</modified>
    </dates>
  </vuln>

  <vuln vid="3d1e9267-073f-11d9-b45d-000c41e2cdad">
    <topic>gdk-pixbuf -- image decoding vulnerabilities</topic>
    <affects>
      <package>
	<name>linux-gdk-pixbuf</name>
	<range><lt>0.22.0.11.3.5</lt></range>
      </package>
      <package>
	<name>gtk</name>
	<range><ge>2.0</ge><lt>2.4.9_1</lt></range>
      </package>
      <package>
	<name>gdk-pixbuf</name>
	<range><lt>0.22.0_2</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
        <p>Chris Evans discovered several flaws in the gdk-pixbuf
          XPM image decoder:</p>
	<ul>
	  <li>Heap-based overflow in pixbuf_create_from_xpm</li>
	  <li>Stack-based overflow in xpm_extract_color</li>
	  <li>Integer overflows in io-ico.c</li>
	</ul>
	<p>Some of these flaws are believed to be exploitable.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-0782</cvename>
      <cvename>CAN-2004-0783</cvename>
      <cvename>CAN-2004-0788</cvename>
      <url>http://scary.beasts.org/security/CESA-2004-005.txt</url>
    </references>
    <dates>
      <discovery>2004-09-15</discovery>
      <entry>2004-09-15</entry>
      <modified>2004-11-09</modified>
    </dates>
  </vuln>

  <vuln vid="ef253f8b-0727-11d9-b45d-000c41e2cdad">
    <topic>xpm -- image decoding vulnerabilities</topic>
    <affects>
      <package>
	<name>agenda-snow-libs</name>
	<name>linux_base</name>
	<name>open-motif-devel</name>
	<name>mupad</name>
	<name>zh-cle_base</name>
	<range><ge>0</ge></range>
      </package>
      <package>
	<name>libXpm</name>
	<range><lt>3.5.1_1</lt></range>
      </package>
      <package>
	<name>XFree86-libraries</name>
	<range><lt>4.4.0_1</lt></range>
      </package>
      <package>
	<name>xorg-libraries</name>
	<range><lt>6.7.0_2</lt></range>
      </package>
      <package>
	<name>lesstif</name>
	<range><lt>0.93.96,2</lt></range>
      </package>
      <package>
	<name>xpm</name>
	<range><lt>3.4k_1</lt></range>
      </package>
      <package>
	<name>linux-openmotif</name>
	<range><lt>2.2.4</lt></range>
      </package>
      <package>
	<name>open-motif</name>
	<range><lt>2.2.3_1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Chris Evans discovered several vulnerabilities in the libXpm
	  image decoder:</p>
	<ul>
	  <li>A stack-based buffer overflow in xpmParseColors</li>
	  <li>An integer overflow in xpmParseColors</li>
	  <li>A stack-based buffer overflow in ParsePixels and
	    ParseAndPutPixels</li>
	</ul>
	<p>The X11R6.8.1 release announcement reads:</p>
	<blockquote cite="http://freedesktop.org/pipermail/xorg/2004-September/003172.html">
          <p>This version is purely a security release, addressing
            multiple integer and stack overflows in libXpm, the X
            Pixmap library; all known versions of X (both XFree86
            and X.Org) are affected, so all users of X are strongly
            encouraged to upgrade.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-0687</cvename>
      <cvename>CAN-2004-0688</cvename>
      <url>http://freedesktop.org/pipermail/xorg/2004-September/003172.html</url>
      <url>http://scary.beasts.org/security/CESA-2004-003.txt</url>
      <certvu>537878</certvu>
      <certvu>882750</certvu>
    </references>
    <dates>
      <discovery>2004-09-15</discovery>
      <entry>2004-09-15</entry>
      <modified>2005-01-03</modified>
    </dates>
  </vuln>

  <vuln vid="05dcf751-0733-11d9-b45d-000c41e2cdad">
    <topic>cups -- print queue browser denial-of-service</topic>
    <affects>
      <package>
	<name>cups-base</name>
	<range><lt>1.1.21</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>If the CUPS server (cupsd) receives a zero-length UDP
	  message, it will disable its print queue browser service.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-0558</cvename>
      <url>http://www.cups.org/str.php?L863</url>
    </references>
    <dates>
      <discovery>2004-08-23</discovery>
      <entry>2004-09-15</entry>
    </dates>
  </vuln>

  <vuln vid="762d1c6d-0722-11d9-b45d-000c41e2cdad">
    <topic>apache -- apr_uri_parse IPv6 address handling vulnerability</topic>
    <affects>
      <package>
	<name>apache</name>
	<range><ge>2.0</ge><lt>2.0.50_3</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Apache Software Foundation Security Team discovered a
	  programming error in the apr-util library function apr_uri_parse.
	  When parsing IPv6 literal addresses, it is possible that a
	  length is incorrectly calculated to be negative, and this
	  value is passed to memcpy.  This may result in an exploitable
	  vulnerability on some platforms, including FreeBSD.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-0786</cvename>
      <url>http://httpd.apache.org</url>
    </references>
    <dates>
      <discovery>2004-09-15</discovery>
      <entry>2004-09-15</entry>
    </dates>
  </vuln>

  <vuln vid="013fa252-0724-11d9-b45d-000c41e2cdad">
    <topic>mod_dav -- lock related denial-of-service</topic>
    <affects>
      <package>
	<name>apache</name>
	<range><ge>2.0</ge><lt>2.0.50_3</lt></range>
      </package>
      <package>
	<name>mod_dav</name>
	<range><le>1.0.3_1</le></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A malicious user with DAV write privileges can trigger a null
	  pointer dereference in the Apache mod_dav module.  This
	  could cause the server to become unavailable.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-0809</cvename>
      <url>http://nagoya.apache.org/bugzilla/show_bug.cgi?id=31183</url>
    </references>
    <dates>
      <discovery>2004-09-15</discovery>
      <entry>2004-09-15</entry>
    </dates>
  </vuln>

  <vuln vid="4d49f4ba-071f-11d9-b45d-000c41e2cdad">
    <topic>apache -- ap_resolve_env buffer overflow</topic>
    <affects>
      <package>
	<name>apache</name>
	<range><ge>2.0</ge><lt>2.0.50_3</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>SITIC discovered a vulnerability in Apache 2's handling of
	  environmental variable settings in the httpd configuration
	  files (the main `httpd.conf' and `.htaccess' files).
	  According to a SITIC advisory:</p>
	<blockquote cite="http://lists.netsys.com/pipermail/full-disclosure/2004-September/026463.html">
          <p>The buffer overflow occurs when expanding ${ENVVAR}
            constructs in .htaccess or httpd.conf files. The function
            ap_resolve_env() in server/util.c copies data from
            environment variables to the character array tmp with
            strcat(3), leading to a buffer overflow. </p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-0747</cvename>
      <mlist>http://lists.netsys.com/pipermail/full-disclosure/2004-September/026463.html</mlist>
    </references>
    <dates>
      <discovery>2004-09-15</discovery>
      <entry>2004-09-15</entry>
    </dates>
  </vuln>

  <vuln vid="ae7b7f65-05c7-11d9-b45d-000c41e2cdad">
    <topic>webmin -- insecure temporary file creation at installation time</topic>
    <affects>
      <package>
	<name>webmin</name>
	<range><lt>1.150_5</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Webmin developers documented a security issue in the
	  release notes for version 1.160:</p>
	<blockquote cite="http://www.webmin.com/changes-1.160.html">
          <p>Fixed a security hole in the maketemp.pl script, used
            to create the /tmp/.webmin directory at install time. If
            an un-trusted user creates this directory before Webmin
            is installed, he could create in it a symbolic link
            pointing to a critical file on the system, which would be
            overwritten when Webmin writes to the link filename.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-0559</cvename>
      <url>http://www.webmin.com/changes-1.160.html</url>
    </references>
    <dates>
      <discovery>2004-09-05</discovery>
      <entry>2004-09-14</entry>
      <modified>2004-09-15</modified>
    </dates>
  </vuln>

  <vuln vid="a711de5c-05fa-11d9-a9b2-00061bc2ad93">
    <topic>samba3 DoS attack</topic>
    <affects>
      <package>
        <name>samba3</name>
        <range><lt>3.0.7,1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
        <p>Code found in nmbd and smbd may allow a remote attacker
	  to effectively crash the nmbd server or use the smbd
	  server to exhaust the system memory.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-0807</cvename>
      <cvename>CAN-2004-0808</cvename>
      <url>http://www.idefense.com/application/poi/display?id=139&amp;type=vulnerabilities</url>
    </references>
    <dates>
      <discovery>2004-09-02</discovery>
      <entry>2004-09-14</entry>
    </dates>
  </vuln>

  <vuln vid="c1d97a8b-05ed-11d9-b45d-000c41e2cdad">
    <topic>mozilla -- POP client heap overflow</topic>
    <affects>
      <package>
	<name>mozilla</name>
	<range><lt>1.7,2</lt></range>
      </package>
      <package>
	<name>linux-mozilla</name>
	<range><lt>1.7</lt></range>
      </package>
      <package>
	<name>netscape7</name>
	<range><lt>7.2</lt></range>
      </package>
      <package>
	<name>thunderbird</name>
	<range><lt>0.7</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
        <p>zen-parse discovered a heap buffer overflow in Mozilla's
          POP client implementation.  A malicious POP server
          could exploit this vulnerability to cause Mozilla to execute
	  arbitrary code.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-0757</cvename>
      <url>http://bugzilla.mozilla.org/show_bug.cgi?id=229374</url>
      <url>http://bugzilla.mozilla.org/show_bug.cgi?id=157644</url>
    </references>
    <dates>
      <discovery>2004-07-22</discovery>
      <entry>2004-09-14</entry>
    </dates>
  </vuln>

  <vuln vid="a4fd8f53-05eb-11d9-b45d-000c41e2cdad">
    <topic>mozilla -- SOAPParameter integer overflow</topic>
    <affects>
      <package>
	<name>firefox</name>
	<range><lt>0.9</lt></range>
      </package>
      <package>
	<name>linux-mozilla</name>
        <name>linux-mozilla-devel</name>
        <name>mozilla-gtk1</name>
	<range><lt>1.7</lt></range>
      </package>
      <package>
	<name>mozilla</name>
	<range><lt>1.7,2</lt></range>
      </package>
      <package>
	<name>netscape7</name>
	<range><lt>7.2</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
        <p>zen-parse discovered and iDEFENSE reported an exploitable
          integer overflow in a scriptable Mozilla component
          `SOAPParameter':</p>
	<blockquote cite="http://www.idefense.com/application/poi/display?id=117&amp;type=vulnerabilities">
          <p>Improper input validation to the SOAPParameter object
            constructor in Netscape and Mozilla allows execution of
            arbitrary code.  The SOAPParameter object's constructor
            contains an integer overflow which allows controllable
            heap corruption.  A web page can be constructed to
	    leverage this into remote execution of arbitrary code.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-0722</cvename>
      <url>http://bugzilla.mozilla.org/show_bug.cgi?id=236618</url>
    </references>
    <dates>
      <discovery>2004-08-02</discovery>
      <entry>2004-09-14</entry>
      <modified>2004-09-22</modified>
    </dates>
  </vuln>

  <vuln vid="c62dc69f-05c8-11d9-b45d-000c41e2cdad">
    <topic>openoffice -- document disclosure</topic>
    <affects>
      <package>
	<name>openoffice</name>
	<name>ar-openoffice</name>
	<name>ca-openoffice</name>
	<name>cs-openoffice</name>
	<name>de-openoffice</name>
	<name>dk-openoffice</name>
	<name>el-openoffice</name>
	<name>es-openoffice</name>
	<name>et-openoffice</name>
	<name>fi-openoffice</name>
	<name>fr-openoffice</name>
	<name>gr-openoffice</name>
	<name>hu-openoffice</name>
	<name>it-openoffice</name>
	<name>ja-openoffice</name>
	<name>ko-openoffice</name>
	<name>nl-openoffice</name>
	<name>pl-openoffice</name>
	<name>pt-openoffice</name>
	<name>pt_BR-openoffice</name>
	<name>ru-openoffice</name>
	<name>se-openoffice</name>
	<name>sk-openoffice</name>
	<name>sl-openoffice-SI</name>
	<name>tr-openoffice</name>
	<name>zh-openoffice-CN</name>
	<name>zh-openoffice-TW</name>
	<range><lt>1.1.2_1</lt></range>
	<range><ge>2.0</ge></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
        <p>OpenOffice creates a working directory in /tmp on startup,
          and uses this directory to temporarily store document
          content.  However, the permissions of the created directory
          may allow other user on the system to read these files,
          potentially exposing information the user likely assumed was
          inaccessible.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-0752</cvename>
      <url>http://www.openoffice.org/issues/show_bug.cgi?id=33357</url>
      <url>http://securitytracker.com/alerts/2004/Sep/1011205.html</url>
      <mlist msgid="20040910152759.7739.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=109483308421566</mlist>
    </references>
    <dates>
      <discovery>2004-08-24</discovery>
      <entry>2004-09-14</entry>
    </dates>
  </vuln>

  <vuln vid="15e0e963-02ed-11d9-a209-00061bc2ad93">
    <topic>mpg123 buffer overflow</topic>
    <affects>
      <package>
        <name>mpg123</name>
        <name>mpg123-nas</name>
        <name>mpg123-esound</name>
        <range><le>0.59r</le></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
        <p>The mpg123 software version 0.59r contains a
          buffer overflow vulnerability which may permit
          the execution of arbitrary code as the owner of
          the mpg123 process.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-0805</cvename>
      <url>http://www.alighieri.org/advisories/advisory-mpg123.txt</url>
    </references>
    <dates>
      <discovery>2003-08-16</discovery>
      <entry>2004-09-14</entry>
    </dates>
  </vuln>

  <vuln vid="b6cad7f3-fb59-11d8-9837-000c41e2cdad">
    <topic>ImageMagick -- BMP decoder buffer overflow</topic>
    <affects>
      <package>
	<name>ImageMagick</name>
	<name>ImageMagick-nox11</name>
	<range><lt>6.0.6.2</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Marcus Meissner discovered that ImageMagick's BMP decoder would
	  crash when loading the test BMP file created by Chris Evans
	  for testing the previous Qt vulnerability.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-0827</cvename>
      <url>http://www.imagemagick.org/www/Changelog.html</url>
    </references>
    <dates>
      <discovery>2004-08-25</discovery>
      <entry>2004-08-31</entry>
      <modified>2004-09-14</modified>
    </dates>
  </vuln>

  <vuln vid="641859e8-eca1-11d8-b913-000c41e2cdad">
    <topic>Mutiple browser frame injection vulnerability</topic>
    <affects>
      <package>
	<name>kdelibs</name>
	<range><lt>3.2.3_3</lt></range>
      </package>
      <package>
	<name>kdebase</name>
	<range><lt>3.2.3_1</lt></range>
      </package>
      <package>
	<name>linux-opera</name>
	<name>opera</name>
	<range><ge>7.50</ge><lt>7.52</lt></range>
      </package>
      <package>
        <name>firefox</name>
	<range><lt>0.9</lt></range>
      </package>
      <package>
        <name>linux-mozilla</name>
        <name>linux-mozilla-devel</name>
        <name>mozilla-gtk1</name>
	<range><lt>1.7</lt></range>
      </package>
      <package>
        <name>mozilla</name>
	<range><lt>1.7,2</lt></range>
      </package>
      <package>
	<name>netscape7</name>
	<range><lt>7.2</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A class of bugs affecting many web browsers in the same way
	  was discovered.  A Secunia advisory reports:</p>
	<blockquote cite="http://secunia.com/advisories/11978">
          <p>The problem is that the browsers don't check if a target
            frame belongs to a website containing a malicious link,
            which therefore doesn't prevent one browser window from
	    loading content in a named frame in another window.</p>
	  <p>Successful exploitation allows a malicious website to load
	    arbitrary content in an arbitrary frame in another browser
	    window owned by e.g. a trusted site.</p>
	</blockquote>
	<p>A KDE Security Advisory reports:</p>
	<blockquote cite="http://www.kde.org/info/security/advisory-20040811-3.txt">
          <p>A malicious website could abuse Konqueror to insert
            its own frames into the page of an otherwise trusted
            website. As a result the user may unknowingly send
            confidential information intended for the trusted website
            to the malicious website.</p>
	</blockquote>
	<p>Secunia has provided a demonstration of the vulnerability at <a href="http://secunia.com/multiple_browsers_frame_injection_vulnerability_test/">http://secunia.com/multiple_browsers_frame_injection_vulnerability_test/</a>.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-0717</cvename>
      <cvename>CAN-2004-0718</cvename>
      <cvename>CAN-2004-0721</cvename>
      <url>http://secunia.com/advisories/11978/</url>
      <url>http://bugzilla.mozilla.org/show_bug.cgi?id=246448</url>
      <url>ftp://ftp.kde.org/pub/kde/security_patches/post-3.2.3-kdelibs-htmlframes.patch</url>
      <url>ftp://ftp.kde.org/pub/kde/security_patches/post-3.2.3-kdebase-htmlframes.patch</url>
    </references>
    <dates>
      <discovery>2004-08-11</discovery>
      <entry>2004-08-12</entry>
      <modified>2004-09-14</modified>
    </dates>
  </vuln>

  <vuln vid="b7cb488c-8349-11d8-a41f-0020ed76ef5a">
    <topic>isakmpd payload handling denial-of-service vulnerabilities</topic>
    <affects>
      <package>
	<name>isakmpd</name>
	<range><le>20030903</le></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Numerous errors in isakmpd's input packet validation lead to
	  denial-of-service vulnerabilities.  From the Rapid7 advisory:</p>
	<blockquote cite="http://www.rapid7.com/advisories/R7-0018.html">
	  <p>The ISAKMP packet processing functions in OpenBSD's
	    isakmpd daemon contain multiple payload handling flaws
	    that allow a remote attacker to launch a denial of
	    service attack against the daemon.</p>
	  <p>Carefully crafted ISAKMP packets will cause the isakmpd
	    daemon to attempt out-of-bounds reads, exhaust available
	    memory, or loop endlessly (consuming 100% of the CPU).</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-0218</cvename>
      <cvename>CAN-2004-0219</cvename>
      <cvename>CAN-2004-0220</cvename>
      <cvename>CAN-2004-0221</cvename>
      <cvename>CAN-2004-0222</cvename>
      <url>http://www.rapid7.com/advisories/R7-0018.html</url>
      <url>http://www.openbsd.org/errata34.html</url>
    </references>
    <dates>
      <discovery>2004-03-17</discovery>
      <entry>2004-03-31</entry>
      <modified>2004-09-14</modified>
    </dates>
  </vuln>

  <vuln vid="00644f03-fb58-11d8-9837-000c41e2cdad">
    <topic>imlib -- BMP decoder heap buffer overflow</topic>
    <affects>
      <package>
	<name>imlib</name>
	<range><lt>1.9.14_4</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Marcus Meissner discovered that imlib's BMP decoder would
	  crash when loading the test BMP file created by Chris Evans
	  for testing the previous Qt vulnerability.  It is believed
	  that this bug could be exploited for arbitrary code execution.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-0817</cvename>
      <url>http://bugzilla.gnome.org/show_bug.cgi?id=151034</url>
    </references>
    <dates>
      <discovery>2004-08-25</discovery>
      <entry>2004-08-31</entry>
      <modified>2004-09-02</modified>
    </dates>
  </vuln>

  <vuln vid="86a98b57-fb8e-11d8-9343-000a95bc6fae">
    <topic>krb5 -- double-free vulnerabilities</topic>
    <affects>
      <package>
	<name>krb5</name>
	<range><le>1.3.4_1</le></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>An advisory published by the MIT Kerberos team says:</p>
	<blockquote cite="http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2004-002-dblfree.txt">
	  <p>The MIT Kerberos 5 implementation's Key Distribution Center
	    (KDC) program contains a double-free vulnerability that
	    potentially allows a remote attacker to execute arbitrary code.
	    Compromise of a KDC host compromises the security of the entire
	    authentication realm served by the KDC.  Additionally, double-free
	    vulnerabilities exist in MIT Kerberos 5 library code, making
	    client programs and application servers vulnerable.</p>
	</blockquote>
	<p>Double-free vulnerabilities of this type are not believed to be
	  exploitable for code execution on FreeBSD systems.  However,
	  the potential for other ill effects may exist.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-0642</cvename>
      <cvename>CAN-2004-0643</cvename>
      <cvename>CAN-2004-0772</cvename>
      <certvu>795632</certvu>
      <certvu>866472</certvu>
      <certvu>350792</certvu>
      <url>http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2004-002-dblfree.txt</url>
    </references>
    <dates>
      <discovery>2004-08-31</discovery>
      <entry>2004-08-31</entry>
    </dates>
  </vuln>

  <vuln vid="bd60922b-fb8d-11d8-a13e-000a95bc6fae">
    <topic>krb5 -- ASN.1 decoder denial-of-service vulnerability</topic>
    <affects>
      <package>
	<name>krb5</name>
	<range><ge>1.2.2</ge><le>1.3.4</le></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>An advisory published by the MIT Kerberos team says:</p>
	<blockquote cite="http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2004-003-asn1.txt">
	  <p>The ASN.1 decoder library in the MIT Kerberos 5 distribution
	    is vulnerable to a denial-of-service attack causing an infinite
	    loop in the decoder.  The KDC is vulnerable to this attack.</p>
	  <p>An unauthenticated remote attacker can cause a KDC or application
	    server to hang inside an infinite loop.</p>
	  <p>An attacker impersonating a legitimate KDC or application
	    server may cause a client program to hang inside an infinite
	    loop.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-0644</cvename>
      <certvu>550464</certvu>
      <url>http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2004-003-asn1.txt</url>
    </references>
    <dates>
      <discovery>2004-08-31</discovery>
      <entry>2004-08-31</entry>
    </dates>
  </vuln>

  <vuln vid="ba005226-fb5b-11d8-9837-000c41e2cdad">
    <topic>imlib2 -- BMP decoder buffer overflow</topic>
    <affects>
      <package>
	<name>imlib2</name>
	<range><le>1.1.1</le></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Marcus Meissner discovered that imlib2's BMP decoder would
	  crash when loading the test BMP file created by Chris Evans
	  for testing the previous Qt vulnerability.  There appears to
	  be both a stack-based and a heap-based buffer overflow that
	  are believed to be exploitable for arbitrary code execution.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-0802</cvename>
      <url>http://cvs.sourceforge.net/viewcvs.py/enlightenment/e17/libs/imlib2/ChangeLog?rev=1.20&amp;view=markup</url>
    </references>
    <dates>
      <discovery>2004-08-31</discovery>
      <entry>2004-08-31</entry>
    </dates>
  </vuln>

  <vuln vid="0d3a5148-f512-11d8-9837-000c41e2cdad">
    <topic>SpamAssassin -- denial-of-service in tokenize_headers</topic>
    <affects>
      <package>
	<name>p5-Mail-SpamAssassin</name>
	<range><lt>2.64</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>According to the SpamAssassin 2.64 release announcement:</p>
	<blockquote cite="http://marc.theaimsgroup.com/?l=spamassassin-announce&amp;m=109168121628767">
          <p>Security fix prevents a denial of service attack open
            to certain malformed messages; this DoS affects all
            SpamAssassin 2.5x and 2.6x versions to date.</p>
	</blockquote>
	<p>The issue appears to be triggered by overly long message
	  headers.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-0796</cvename>
      <bid>10957</bid>
      <mlist>http://marc.theaimsgroup.com/?l=spamassassin-announce&amp;m=109168121628767</mlist>
      <url>http://search.cpan.org/src/JMASON/Mail-SpamAssassin-2.64/Changes</url>
    </references>
    <dates>
      <discovery>2004-08-04</discovery>
      <entry>2004-08-23</entry>
      <modified>2004-08-28</modified>
    </dates>
  </vuln>

  <vuln vid="c4b025bb-f05d-11d8-9837-000c41e2cdad">
    <topic>tnftpd -- remotely exploitable vulnerability</topic>
    <affects>
      <package>
	<name>tnftpd</name>
	<range><lt>20040810</lt></range>
      </package>
      <package>
	<name>lukemftpd</name>
	<range><ge>0</ge></range>
      </package>
      <system>
	<name>FreeBSD</name>
	<range><ge>4.7</ge></range>
      </system>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
        <p>lukemftpd(8) is an enhanced BSD FTP server produced
          within the NetBSD project.  The sources for lukemftpd are
          shipped with some versions of FreeBSD, however it is not
          built or installed by default.  The build system option
          WANT_LUKEMFTPD must be set to build and install lukemftpd.
          [<strong>NOTE</strong>: An exception is FreeBSD 4.7-RELEASE,
          wherein lukemftpd was installed, but not enabled, by
	  default.]</p>
        <p>Przemyslaw Frasunek discovered several vulnerabilities
          in lukemftpd arising from races in the out-of-band signal
          handling code used to implement the ABOR command.  As a
          result of these races, the internal state of the FTP server
          may be manipulated in unexpected ways.</p>
        <p>A remote attacker may be able to cause FTP commands to
          be executed with the privileges of the running lukemftpd
          process.  This may be a low-privilege `ftp' user if the `-r'
          command line option is specified, or it may be superuser
          privileges if `-r' is *not* specified.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-0794</cvename>
      <bid>10967</bid>
      <url>http://cvsweb.netbsd.org/bsdweb.cgi/src/libexec/ftpd/ftpd.c#rev1.158</url>
      <url>ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2004-009.txt.asc</url>
      <mlist msgid="412239E7.1070807@freebsd.lublin.pl">http://lists.netsys.com/pipermail/full-disclosure/2004-August/025418.html</mlist>
    </references>
    <dates>
      <discovery>2004-08-17</discovery>
      <entry>2004-08-17</entry>
      <modified>2004-08-28</modified>
    </dates>
  </vuln>

  <vuln vid="e5e2883d-ceb9-11d8-8898-000d6111a684">
    <topic>MySQL authentication bypass / buffer overflow</topic>
    <affects>
      <package>
        <name>mysql-server</name>
        <range><ge>4.1</ge><lt>4.1.3</lt></range>
        <range><ge>5</ge><le>5.0.0_2</le></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
        <p>By submitting a carefully crafted authentication packet, it is possible
          for an attacker to bypass password authentication in MySQL 4.1. Using a
          similar method, a stack buffer used in the authentication mechanism can
          be overflowed.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-0627</cvename>
      <cvename>CAN-2004-0628</cvename>
      <certvu>184030</certvu>
      <certvu>645326</certvu>
      <url>http://www.nextgenss.com/advisories/mysql-authbypass.txt</url>
      <url>http://dev.mysql.com/doc/mysql/en/News-4.1.3.html</url>
      <url>http://secunia.com/advisories/12020</url>
      <url>http://www.osvdb.org/7475</url>
      <url>http://www.osvdb.org/7476</url>
      <mlist msgid="Pine.LNX.4.44.0407080940550.9602-200000@pineapple.shacknet.nu">http://archives.neohapsis.com/archives/vulnwatch/2004-q3/0003.html</mlist>
    </references>
    <dates>
      <discovery>2004-07-01</discovery>
      <entry>2004-07-05</entry>
      <modified>2004-08-28</modified>
    </dates>
  </vuln>

  <vuln vid="e811aaf1-f015-11d8-876f-00902714cc7c">
    <topic>Ruby insecure file permissions in the CGI session management</topic>
    <affects>
      <package>
        <name>ruby</name>
        <range><lt>1.6.8.2004.07.26</lt></range>
        <range><ge>1.7.0</ge><lt>1.8.1.2004.07.23</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>According to a Debian Security Advisory:</p>
	<blockquote cite="http://www.debian.org/security/2004/dsa-537">
          <p>Andres Salomon noticed a problem in the CGI session
            management of Ruby, an object-oriented scripting language.
            CGI::Session's FileStore (and presumably PStore [...])
            implementations store session information insecurely.
            They simply create files, ignoring permission issues.
            This can lead an attacker who has also shell access to the
            webserver to take over a session.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-0755</cvename>
      <url>http://xforce.iss.net/xforce/xfdb/16996</url>
      <url>http://www.debian.org/security/2004/dsa-537</url>
      <mlist>http://marc.theaimsgroup.com/?l=bugtraq&amp;m=109267579822250&amp;w=2</mlist>
    </references>
    <dates>
      <discovery>2004-08-16</discovery>
      <entry>2004-08-16</entry>
      <modified>2004-08-28</modified>
    </dates>
  </vuln>

  <vuln vid="207f8ff3-f697-11d8-81b0-000347a4fa7d">
    <topic>nss -- exploitable buffer overflow in SSLv2 protocol handler</topic>
    <affects>
      <package>
        <name>nss</name>
        <range><lt>3.9.2</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
        <p>ISS X-Force reports that a remotely exploitable buffer
          overflow exists in the Netscape Security Services (NSS)
	  library's implementation of SSLv2.  From their advisory:</p>
	<blockquote cite="http://xforce.iss.net/xforce/alerts/id/180">
          <p>The NSS library contains a flaw in SSLv2 record parsing
            that may lead to remote compromise. When parsing the
            first record in an SSLv2 negotiation, the client hello
            message, the server fails to validate the length of a
            record field. As a result, it is possible for an attacker
            to trigger a heap-based overflow of arbitrary length.</p>
	</blockquote>
	<p>Note that the vulnerable NSS library is also present in
	  Mozilla-based browsers.  However, it is not believed that
	  browsers are affected, as the vulnerability is present only in
	  code used by SSLv2 *servers*.</p>
      </body>
    </description>
    <references>
      <url>http://xforce.iss.net/xforce/alerts/id/180</url>
      <url>http://www.osvdb.org/9116</url>
      <url>http://secunia.com/advisories/12362</url>
      <bid>11015</bid>
    </references>
    <dates>
      <discovery>2004-08-23</discovery>
      <entry>2004-08-27</entry>
    </dates>
  </vuln>

  <vuln vid="85e19dff-e606-11d8-9b0a-000347a4fa7d">
    <topic>ripMIME -- decoding bug allowing content filter bypass</topic>
    <affects>
      <package>
        <name>ripmime</name>
        <range><lt>1.3.2.3</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>ripMIME may prematurely terminate decoding Base64 encoded
	  messages when it encounters multiple blank lines or other
	  non-standard Base64 constructs.  Virus scanning and content
	  filtering tools that use ripMIME may therefore be
	  bypassed.</p>
	<p>The ripMIME CHANGELOG file says:</p>
	<blockquote cite="http://www.pldaniels.com/ripmime/CHANGELOG">
          <p>There's viruses going around exploiting the ability to
            hide the majority of their data in an attachment by using
            blank lines and other tricks to make scanning systems
	    prematurely terminate their base64 decoding.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <bid>10848</bid>
      <url>http://www.osvdb.org/8287</url>
      <url>http://www.pldaniels.com/ripmime/CHANGELOG</url>
      <url>http://secunia.com/advisories/12201</url>
      <url>http://xforce.iss.net/xforce/xfdb/16867</url>
    </references>
    <dates>
      <discovery>2004-07-30</discovery>
      <entry>2004-08-27</entry>
    </dates>
  </vuln>

  <vuln vid="1ecf4ca1-f7ad-11d8-96c9-00061bc2ad93">
    <topic>moinmoin -- ACL group bypass</topic>
    <affects>
      <package>
        <name>moinmoin</name>
        <range><lt>1.2.3</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
        <p>The moinmoin package contains two bugs with ACLs and anonymous
	  users.  Both bugs may permit anonymous users to gain access to
	  administrative functions; for example the delete function.</p>
        <p>There is no known workaround, the vulnerability exists regardless
	  if a site is using ACLs or not.</p>
      </body>
    </description>
    <references>
      <url>http://www.osvdb.org/8194</url>
      <url>http://www.osvdb.org/8195</url>
      <url>http://security.gentoo.org/glsa/glsa-200408-25.xml</url>
      <url>http://secunia.com/advisories/11832</url>
      <bid>10805</bid>
      <bid>10801</bid>
    </references>
    <dates>
      <discovery>2004-07-21</discovery>
      <entry>2004-08-26</entry>
    </dates>
  </vuln>

  <vuln vid="2689f4cb-ec4c-11d8-9440-000347a4fa7d">
    <topic>rsync -- path sanitizing vulnerability</topic>
    <affects>
      <package>
        <name>rsync</name>
        <range><lt>2.6.2_2</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>An rsync security advisory reports:</p>
	<blockquote cite="http://samba.org/rsync/#security_aug04">
	  <p>There is a path-sanitizing bug that affects daemon mode in
	    all recent rsync versions (including 2.6.2) but only if
	    chroot is disabled.</p>
	</blockquote>
	<p>The bug may allow a remote user to access files outside
	  of an rsync module's configured path with the privileges
	  configured for that module.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-0792</cvename>
      <url>http://samba.org/rsync/#security_aug04</url>
      <mlist>http://lists.samba.org/archive/rsync-announce/2004/000017.html</mlist>
      <url>http://secunia.com/advisories/12294</url>
      <url>http://www.osvdb.org/8829</url>
    </references>
    <dates>
      <discovery>2004-08-12</discovery>
      <entry>2004-08-26</entry>
    </dates>
  </vuln>

  <vuln vid="7884d56f-f7a1-11d8-9837-000c41e2cdad">
    <topic>gnomevfs -- unsafe URI handling</topic>
    <affects>
      <package>
	<name>gnomevfs2</name>
	<range><lt>2.6.2_1</lt></range>
      </package>
      <package>
	<name>gnomevfs</name>
	<range><lt>1.0.5_6</lt></range>
      </package>
      <package>
	<name>mc</name>
	<range><le>4.6.0_12</le></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Alexander Larsson reports that some versions of gnome-vfs and
	  MidnightCommander contain a number of `extfs' scripts that do not
	  properly validate user input.  If an attacker can cause her
	  victim to process a specially-crafted URI, arbitrary commands
	  can be executed with the privileges of the victim.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-0494</cvename>
      <bid>10864</bid>
      <url>http://www.ciac.org/ciac/bulletins/o-194.shtml</url>
      <url>http://xforce.iss.net/xforce/xfdb/16897</url>
      <url>https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=127263</url>
    </references>
    <dates>
      <discovery>2004-08-04</discovery>
      <entry>2004-08-26</entry>
    </dates>
  </vuln>

  <vuln vid="3e4ffe76-e0d4-11d8-9b0a-000347a4fa7d">
    <topic>SoX buffer overflows when handling .WAV files</topic>
    <affects>
      <package>
        <name>sox</name>
        <range><gt>12.17.1</gt><le>12.17.4_1</le></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Ulf Härnhammar discovered a pair of buffer overflows in the
	  WAV file handling code of SoX.  If an attacker can cause her
	  victim to process a specially-crafted WAV file with SoX (e.g.
	  through social engineering or through some other program that
	  relies on SoX), arbitrary code can be executed with the
	  privileges of the victim.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-0557</cvename>
      <mlist msgid="1091040793.4107f6193d81a@webmail.uu.se">http://archives.neohapsis.com/archives/vulnwatch/2004-q3/0014.html</mlist>
      <url>http://secunia.com/advisories/12175</url>
      <url>http://www.osvdb.org/8267</url>
    </references>
    <dates>
      <discovery>2004-07-28</discovery>
      <entry>2004-08-26</entry>
    </dates>
  </vuln>

  <vuln vid="2797b27a-f55b-11d8-81b0-000347a4fa7d">
    <topic>kdelibs -- konqueror cross-domain cookie injection</topic>
    <affects>
      <package>
        <name>kdelibs</name>
        <range><lt>3.2.3_3</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>According to a KDE Security Advisory:</p>
	<blockquote cite="http://www.kde.org/info/security/advisory-20040823-1.txt">
          <p>WESTPOINT internet reconnaissance services alerted the
            KDE security team that the KDE web browser Konqueror
            allows websites to set cookies for certain country
            specific secondary top level domains.</p>
          <p>Web sites operating under the affected domains can
           set HTTP cookies in such a way that the Konqueror web
           browser will send them to all other web sites operating
           under the same domain.  A malicious website can use
           this as part of a session fixation attack. See e.g.
           http://www.acros.si/papers/session_fixation.pdf</p>
         <p>Affected are all country specific secondary top level
          domains that use more than 2 characters in the secondary
          part of the domain name and that use a secondary part other
          than com, net, mil, org, gov, edu or int. Examples of
          affected domains are .ltd.uk, .plc.uk and .firm.in</p>
	<p>It should be noted that popular domains such as .co.uk, .co.in
	  and .com are NOT affected.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-0746</cvename>
      <url>http://www.kde.org/info/security/advisory-20040823-1.txt</url>
      <url>http://www.osvdb.org/9117</url>
      <url>http://secunia.com/advisories/12341</url>
      <url>http://www.acros.si/papers/session_fixation.pdf</url>
      <bid>10991</bid>
    </references>
    <dates>
      <discovery>2004-08-23</discovery>
      <entry>2004-08-26</entry>
    </dates>
  </vuln>

  <vuln vid="bef4515b-eaa9-11d8-9440-000347a4fa7d">
    <cancelled superseded="b6939d5b-64a1-11d9-9106-000a95bc6fae" />
  </vuln>

  <vuln vid="3243e839-f489-11d8-9837-000c41e2cdad">
    <topic>fidogate -- write files as `news' user</topic>
    <affects>
      <package>
	<name>fidogate</name>
	<range><lt>4.4.9_3</lt></range>
      </package>
      <package>
	<name>fidogate-ds</name>
	<range><lt>5.1.1_1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Neils Heinen reports that the setuid `news' binaries
	  installed as part of fidogate may be used to create files or
	  append to file with the privileges of the `news' user by
	  setting the LOGFILE environmental variable.</p>
      </body>
    </description>
    <references>
      <url>http://cvs.sourceforge.net/viewcvs.py/fidogate/fidogate/ChangeLog?rev=4.320&amp;view=markup</url>
    </references>
    <dates>
      <discovery>2004-08-21</discovery>
      <entry>2004-08-22</entry>
      <modified>2004-08-23</modified>
    </dates>
  </vuln>

  <vuln vid="65a17a3f-ed6e-11d8-aff1-00061bc2ad93">
    <topic>Arbitrary code execution via a format string vulnerability in jftpgw</topic>
    <affects>
      <package>
        <name>jftpgw</name>
        <range><lt>0.13.5</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
        <p>The log functions in jftpgw may allow
	  remotely authenticated user to execute
	  arbitrary code via the format string
	  specifiers in certain syslog messages.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-0448</cvename>
      <url>http://www.debian.org/security/2004/dsa-510</url>
      <bid>10438</bid>
      <url>http://xforce.iss.net/xforce/xfdb/16271</url>
    </references>
    <dates>
      <discovery>2004-05-30</discovery>
      <entry>2004-08-13</entry>
      <modified>2004-08-23</modified>
    </dates>
  </vuln>

  <vuln vid="ebffe27a-f48c-11d8-9837-000c41e2cdad">
    <topic>qt -- image loader vulnerabilities</topic>
    <affects>
      <package>
	<name>qt</name>
	<range><lt>3.3.3</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
        <p>Qt contains several vulnerabilities related to image
          loading, including possible crashes when loading corrupt
          GIF, BMP, or JPEG images.  Most seriously, Chris Evans
          reports that the BMP crash is actually due to a heap
          buffer overflow.  It is believed that an attacker may be
          able to construct a BMP image that could cause a Qt-using
          application to execute arbitrary code when it is loaded.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-0691</cvename>
      <cvename>CAN-2004-0692</cvename>
      <cvename>CAN-2004-0693</cvename>
      <url>http://www.trolltech.com/developer/changes/changes-3.3.3.html</url>
      <url>http://scary.beasts.org/security/CESA-2004-004.txt</url>
    </references>
    <dates>
      <discovery>2004-08-11</discovery>
      <entry>2004-08-22</entry>
    </dates>
  </vuln>

  <vuln vid="616cf823-f48b-11d8-9837-000c41e2cdad">
    <topic>courier-imap -- format string vulnerability in debug mode</topic>
    <affects>
      <package>
	<name>courier-imap</name>
	<range><lt>3.0.7,1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>An iDEFENSE security advisory describes a format string
	  vulnerability that could be exploited when Courier-IMAP is run
	  in debug mode (DEBUG_LOGIN set).</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-0777</cvename>
      <mlist>http://lists.netsys.com/pipermail/full-disclosure/2004-August/025478.html</mlist>
      <url>http://www.idefense.com/application/poi/display?id=131&amp;type=vulnerabilities&amp;flashstatus=false</url>
      <bid>10976</bid>
    </references>
    <dates>
      <discovery>2004-08-18</discovery>
      <entry>2004-08-22</entry>
    </dates>
  </vuln>

  <vuln vid="0c4d5973-f2ab-11d8-9837-000c41e2cdad">
    <topic>mysql -- mysqlhotcopy insecure temporary file creation</topic>
    <affects>
      <package>
	<name>mysql-scripts</name>
	<range><le>3.23.58</le></range>
	<range><gt>4</gt><le>4.0.20</le></range>
	<range><gt>4.1</gt><le>4.1.3</le></range>
	<range><gt>5</gt><le>5.0.0_1</le></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
        <p>According to Christian Hammers:</p>
	<blockquote cite="http://packages.debian.org/changelogs/pool/main/m/mysql-dfsg/mysql-dfsg_4.0.20-11/changelog">
          <p>[mysqlhotcopy created] temporary files in /tmp which
            had predictable filenames and such could be used for a
            tempfile run attack.</p>
	</blockquote>
	<p>Jeroen van Wolffelaar is credited with discovering the issue.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-0457</cvename>
      <url>http://www.debian.org/security/2004/dsa-540</url>
      <mlist>http://lists.mysql.com/internals/15185</mlist>
    </references>
    <dates>
      <discovery>2004-08-18</discovery>
      <entry>2004-08-22</entry>
    </dates>
  </vuln>

  <vuln vid="2de14f7a-dad9-11d8-b59a-00061bc2ad93">
    <topic>Multiple Potential Buffer Overruns in Samba</topic>
    <affects>
      <package>
	<name>samba</name>
        <range><ge>3</ge><lt>3.0.5,1</lt></range>
	<range><lt>2.2.10</lt></range>
      </package>
      <package>
	<name>ja-samba</name>
	<range><lt>2.2.10.j1.0</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
        <p>Evgeny Demidov discovered that the Samba server has a
          buffer overflow in the Samba Web Administration Tool (SWAT)
          on decoding Base64 data during HTTP Basic Authentication.
          Versions 3.0.2 through 3.0.4 are affected.</p>
        <p>Another buffer overflow bug has been found in the code
          used to support the "mangling method = hash" smb.conf
          option. The default setting for this parameter is "mangling
          method = hash2" and therefore not vulnerable. Versions
          between 2.2.0 through 2.2.9 and 3.0.0 through 3.0.4 are affected.
	  </p>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-0600</cvename>
      <cvename>CAN-2004-0686</cvename>
      <mlist msgid="web-53121174@cgp.agava.net">http://www.securityfocus.com/archive/1/369698</mlist>
      <mlist msgid="200407222031.25086.bugtraq@beyondsecurity.com">http://www.securityfocus.com/archive/1/369706</mlist>
      <url>http://www.samba.org/samba/whatsnew/samba-3.0.5.html</url>
      <url>http://www.samba.org/samba/whatsnew/samba-2.2.10.html</url>
      <url>http://www.osvdb.org/8190</url>
      <url>http://www.osvdb.org/8191</url>
      <url>http://secunia.com/advisories/12130</url>
    </references>
    <dates>
      <discovery>2004-07-14</discovery>
      <entry>2004-07-21</entry>
      <modified>2004-08-15</modified>
    </dates>
  </vuln>

  <vuln vid="730db824-e216-11d8-9b0a-000347a4fa7d">
    <topic>Mozilla / Firefox user interface spoofing vulnerability</topic>
    <affects>
      <package>
        <name>firefox</name>
        <range><le>0.9.1_1</le></range>
      </package>
      <package>
        <name>linux-mozilla</name>
        <range><le>1.7.1</le></range>
      </package>
      <package>
        <name>linux-mozilla-devel</name>
        <range><le>1.7.1</le></range>
      </package>
      <package>
        <name>mozilla</name>
        <range><le>1.7.1,2</le></range>
        <range><ge>1.8.a,2</ge><le>1.8.a2,2</le></range>
      </package>
      <package>
        <name>mozilla-gtk1</name>
        <range><le>1.7.1_1</le></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Mozilla project's family of browsers contain a design
	  flaw that can allow a website to spoof almost perfectly any
	  part of the Mozilla user interface, including spoofing web
	  sites for phishing or internal elements such as the "Master
	  Password" dialog box.  This achieved by manipulating "chrome"
	  through remote XUL content.  Recent versions of Mozilla have
	  been fixed to not allow untrusted documents to utilize
	  "chrome" in this way.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-0764</cvename>
      <url>http://bugzilla.mozilla.org/show_bug.cgi?id=22183</url>
      <url>http://bugzilla.mozilla.org/show_bug.cgi?id=244965</url>
      <url>http://bugzilla.mozilla.org/show_bug.cgi?id=252198</url>
      <url>http://www.nd.edu/~jsmith30/xul/test/spoof.html</url>
      <url>http://secunia.com/advisories/12188</url>
      <bid>10832</bid>
    </references>
    <dates>
      <discovery>2004-07-19</discovery>
      <entry>2004-07-30</entry>
      <modified>2004-08-15</modified>
    </dates>
  </vuln>

  <vuln vid="f9e3e60b-e650-11d8-9b0a-000347a4fa7d">
    <topic>libpng stack-based buffer overflow and other code concerns</topic>
    <affects>
      <package>
        <name>png</name>
        <range><le>1.2.5_7</le></range>
      </package>
      <package>
        <name>linux-png</name>
        <range><le>1.0.14_3</le></range>
        <range><ge>1.2</ge><le>1.2.2</le></range>
      </package>
      <package>
        <name>firefox</name>
        <range><lt>0.9.3</lt></range>
      </package>
      <package>
        <name>thunderbird</name>
        <range><lt>0.7.3</lt></range>
      </package>
      <package>
        <name>linux-mozilla</name>
        <range><lt>1.7.2</lt></range>
      </package>
      <package>
        <name>linux-mozilla-devel</name>
        <range><lt>1.7.2</lt></range>
      </package>
      <package>
        <name>mozilla</name>
        <range><lt>1.7.2,2</lt></range>
        <range><ge>1.8.a,2</ge><le>1.8.a2,2</le></range>
      </package>
      <package>
        <name>mozilla-gtk1</name>
        <range><lt>1.7.2</lt></range>
      </package>
      <package>
        <name>netscape-communicator</name>
        <name>netscape-navigator</name>
        <range><le>4.78</le></range>
      </package>
      <package>
        <name>linux-netscape-communicator</name>
        <name>linux-netscape-navigator</name>
        <name>ko-netscape-navigator-linux</name>
        <name>ko-netscape-communicator-linux</name>
        <name>ja-netscape-communicator-linux</name>
        <name>ja-netscape-navigator-linux</name>
        <range><le>4.8</le></range>
      </package>
      <package>
        <name>netscape7</name>
        <name>ja-netscape7</name>
        <range><le>7.1</le></range>
      </package>
      <package>
        <name>pt_BR-netscape7</name>
        <name>fr-netscape7</name>
        <name>de-netscape7</name>
        <range><le>7.02</le></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
        <p>Chris Evans has discovered multiple vulnerabilities in libpng,
          which can be exploited by malicious people to compromise a
          vulnerable system or cause a DoS (Denial of Service).</p>
      </body>
    </description>
    <references>
      <mlist msgid="Pine.LNX.4.58.0408041840080.20655@sphinx.mythic-beasts.com">http://www.securityfocus.com/archive/1/370853</mlist>
      <url>http://scary.beasts.org/security/CESA-2004-001.txt</url>
      <url>http://www.osvdb.org/8312</url>
      <url>http://www.osvdb.org/8313</url>
      <url>http://www.osvdb.org/8314</url>
      <url>http://www.osvdb.org/8315</url>
      <url>http://www.osvdb.org/8316</url>
      <cvename>CAN-2004-0597</cvename>
      <cvename>CAN-2004-0598</cvename>
      <cvename>CAN-2004-0599</cvename>
      <certvu>388984</certvu>
      <certvu>236656</certvu>
      <certvu>160448</certvu>
      <certvu>477512</certvu>
      <certvu>817368</certvu>
      <certvu>286464</certvu>
      <url>http://secunia.com/advisories/12219</url>
      <url>http://secunia.com/advisories/12232</url>
      <url>http://bugzilla.mozilla.org/show_bug.cgi?id=251381</url>
      <uscertta>TA04-217A</uscertta>
      <url>http://dl.sourceforge.net/sourceforge/libpng/ADVISORY.txt</url>
    </references>
    <dates>
      <discovery>2004-08-04</discovery>
      <entry>2004-08-04</entry>
      <modified>2004-08-15</modified>
    </dates>
  </vuln>

  <vuln vid="603fe36d-ec9d-11d8-b913-000c41e2cdad">
    <topic>kdelibs insecure temporary file handling</topic>
    <affects>
      <package>
	<name>kdelibs</name>
	<range><le>3.2.3_3</le></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>According to a KDE Security Advisory, KDE may sometimes
	  create temporary files without properly checking the ownership
	  and type of the target path.  This could allow a local
	  attacker to cause KDE applications to overwrite arbitrary
	  files.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-0689</cvename>
      <cvename>CAN-2004-0690</cvename>
      <url>http://www.kde.org/info/security/advisory-20040811-1.txt</url>
      <url>http://www.kde.org/info/security/advisory-20040811-2.txt</url>
      <url>ftp://ftp.kde.org/pub/kde/security_patches/post-3.2.3-kdelibs-kstandarddirs.patch</url>
      <url>ftp://ftp.kde.org/pub/kde/security_patches/post-3.2.3-kdelibs-dcopserver.patch</url>
    </references>
    <dates>
      <discovery>2004-08-11</discovery>
      <entry>2004-08-12</entry>
    </dates>
  </vuln>

  <vuln vid="5b8f9a02-ec93-11d8-b913-000c41e2cdad">
    <topic>gaim remotely exploitable vulnerabilities in MSN component</topic>
    <affects>
      <package>
	<name>gaim</name>
	<name>ja-gaim</name>
	<name>ko-gaim</name>
	<name>ru-gaim</name>
	<range><lt>0.81_1</lt></range>
      </package>
      <package>
	<name>gaim</name>
	<range><ge>20030000</ge></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
        <p>Sebastian Krahmer discovered several remotely exploitable
          buffer overflow vulnerabilities in the MSN component of
          gaim.</p>
	<blockquote cite="http://gaim.sourceforge.net/security/?id=0">
	  <p>In two places in the MSN protocol plugins (object.c and
	    slp.c), strncpy was used incorrectly; the size of the array
	    was not checked before copying to it. Both bugs affect MSN's
	    MSNSLP protocol, which is peer-to-peer, so this could
	    potentially be easy to exploit.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-0500</cvename>
      <url>http://gaim.sourceforge.net/security/?id=0</url>
    </references>
    <dates>
      <discovery>2004-08-12</discovery>
      <entry>2004-08-12</entry>
      <modified>2004-10-25</modified>
    </dates>
  </vuln>

  <vuln vid="78348ea2-ec91-11d8-b913-000c41e2cdad">
    <topic>acroread uudecoder input validation error</topic>
    <affects>
      <package>
	<name>acroread</name>
	<name>acroread4</name>
	<name>acroread5</name>
	<range><lt>5.0.9</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>An iDEFENSE security advisory reports:</p>
	<blockquote cite="www.idefense.com/application/poi/display?id=124&amp;type=vulnerabilities">
          <p>Remote exploitation of an input validation error in the
            uudecoding feature of Adobe Acrobat Reader (Unix) 5.0
            allows an attacker to execute arbitrary code.</p>
          <p>The Unix and Linux versions of Adobe Acrobat Reader 5.0
            automatically attempt to convert uuencoded documents
            back into their original format.  The vulnerability
            specifically exists in the failure of Acrobat Reader to
            check for the backtick shell metacharacter in the filename
            before executing a command with a shell. This allows a
            maliciously constructed filename to execute arbitrary
            programs.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-0630</cvename>
      <url>http://www.idefense.com/application/poi/display?id=124&amp;type=vulnerabilities</url>
    </references>
    <dates>
      <discovery>2004-08-12</discovery>
      <entry>2004-08-12</entry>
      <modified>2005-01-06</modified>
    </dates>
  </vuln>

  <vuln vid="12c7b7ae-ec90-11d8-b913-000c41e2cdad">
    <topic>popfile file disclosure</topic>
    <affects>
      <package>
	<name>popfile</name>
	<range><le>0.21.1_2</le></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>John Graham-Cumming reports that certain configurations of
	  POPFile may allow the retrieval of any files with the
	  extensions .gif, .png, .ico, .css, as well as some files with
	  the extension .html.</p>
      </body>
    </description>
    <references>
      <mlist>http://sourceforge.net/mailarchive/forum.php?thread_id=5248725&amp;forum_id=12356</mlist>
    </references>
    <dates>
      <discovery>2004-08-02</discovery>
      <entry>2004-08-12</entry>
    </dates>
  </vuln>

  <vuln vid="7a9d5dfe-c507-11d8-8898-000d6111a684">
    <topic>isc-dhcp3-server buffer overflow in logging mechanism</topic>
    <affects>
      <package>
	<name>isc-dhcp3-relay</name>
	<name>isc-dhcp3-server</name>
	<range><ge>3.0.1.r12</ge><lt>3.0.1.r14</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A buffer overflow exists in the logging functionality
	  of the DHCP daemon which could lead to Denial of Service
	  attacks and has the potential to allow attackers to
	  execute arbitrary code.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-0460</cvename>
      <url>http://www.osvdb.org/7237</url>
      <uscertta>TA04-174A</uscertta>
      <certvu>317350</certvu>
      <mlist msgid="BAY13-F94UHMuEEkHMz0005c4f7@hotmail.com">http://www.securityfocus.com/archive/1/366801</mlist>
      <mlist msgid="40DFAB69.1060909@sympatico.ca">http://www.securityfocus.com/archive/1/367286</mlist>
    </references>
    <dates>
      <discovery>2004-06-22</discovery>
      <entry>2004-06-25</entry>
      <modified>2004-08-12</modified>
    </dates>
  </vuln>

  <vuln vid="3a408f6f-9c52-11d8-9366-0020ed76ef5a">
    <topic>libpng denial-of-service</topic>
    <affects>
      <package>
	<name>linux-png</name>
	<range><le>1.0.14_3</le></range>
	<range><ge>1.2</ge><le>1.2.2</le></range>
      </package>
      <package>
	<name>png</name>
	<range><lt>1.2.5_4</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Steve Grubb reports a buffer read overrun in
	  libpng's png_format_buffer function.  A specially
	  constructed PNG image processed by an application using
	  libpng may trigger the buffer read overrun and possibly
	  result in an application crash.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-0421</cvename>
      <url>http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=120508</url>
      <url>http://rhn.redhat.com/errata/RHSA-2004-181.html</url>
      <url>http://secunia.com/advisories/11505</url>
      <url>http://www.osvdb.org/5726</url>
      <bid>10244</bid>
    </references>
    <dates>
      <discovery>2004-04-29</discovery>
      <entry>2004-05-02</entry>
      <modified>2004-08-12</modified>
    </dates>
  </vuln>

  <vuln vid="4764cfd6-d630-11d8-b479-02e0185c0b53">
    <cancelled superseded="dd7aa4f1-102f-11d9-8a8a-000c41e2cdad" />
  </vuln>

  <vuln vid="abe47a5a-e23c-11d8-9b0a-000347a4fa7d">
    <topic>Mozilla certificate spoofing</topic>
    <affects>
      <package>
        <name>firefox</name>
        <range><ge>0.9.1</ge><le>0.9.2</le></range>
      </package>
      <package>
        <name>linux-mozilla</name>
        <range><lt>1.7.2</lt></range>
      </package>
      <package>
        <name>linux-mozilla-devel</name>
        <range><lt>1.7.2</lt></range>
      </package>
      <package>
        <name>mozilla</name>
        <range><lt>1.7.2,2</lt></range>
        <range><ge>1.8,2</ge><le>1.8.a2,2</le></range>
      </package>
      <package>
        <name>mozilla-gtk1</name>
        <range><lt>1.7.2</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
        <p>Mozilla and Mozilla Firefox contains a flaw that may
          allow a malicious user to spoof SSL certification.</p>
      </body>
    </description>
    <references>
      <mlist msgid="003a01c472ba$b2060900$6501a8c0@sec">http://www.securityfocus.com/archive/1/369953</mlist>
      <url>http://www.cipher.org.uk/index.php?p=advisories/Certificate_Spoofing_Mozilla_FireFox_25-07-2004.advisory</url>
      <url>http://secunia.com/advisories/12160</url>
      <url>http://bugzilla.mozilla.org/show_bug.cgi?id=253121</url>
      <url>http://www.osvdb.org/8238</url>
      <bid>10796</bid>
      <cvename>CAN-2004-0763</cvename>
    </references>
    <dates>
      <discovery>2004-07-25</discovery>
      <entry>2004-07-30</entry>
      <modified>2004-08-12</modified>
    </dates>
  </vuln>

  <vuln vid="a713c0f9-ec54-11d8-9440-000347a4fa7d">
    <topic>ImageMagick png vulnerability fix</topic>
    <affects>
      <package>
        <name>ImageMagick</name>
        <name>ImageMagick-nox11</name>
        <range><lt>6.0.4.2</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
        <p>Glenn Randers-Pehrson has contributed a fix for the png
          vulnerabilities discovered by Chris Evans.</p>
      </body>
    </description>
    <references>
      <url>http://studio.imagemagick.org/pipermail/magick-users/2004-August/013218.html</url>
      <url>http://freshmeat.net/releases/169228</url>
      <url>http://secunia.com/advisories/12236</url>
      <url>http://www.freebsd.org/ports/portaudit/f9e3e60b-e650-11d8-9b0a-000347a4fa7d.html</url>
    </references>
    <dates>
      <discovery>2004-08-04</discovery>
      <entry>2004-08-04</entry>
      <modified>2004-08-12</modified>
    </dates>
  </vuln>

  <vuln vid="98bd69c3-834b-11d8-a41f-0020ed76ef5a">
    <topic>Courier mail services: remotely exploitable buffer overflows</topic>
    <affects>
      <package>
	<name>courier</name>
	<range><lt>0.45</lt></range>
      </package>
      <package>
	<name>courier-imap</name>
	<range><lt>3.0,1</lt></range>
      </package>
      <package>
	<name>sqwebmail</name>
	<range><lt>4.0</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Courier set of mail services use a common Unicode
	  library.  This library contains buffer overflows in the
	  converters for two popular Japanese character encodings.
	  These overflows may be remotely exploitable, triggered by
	  a maliciously formatted email message that is later processed
	  by one of the Courier mail services.
	  From the release notes for the corrected versions of the
	  Courier set of mail services:</p>
	<blockquote>
	  <p>iso2022jp.c: Converters became (upper-)compatible with
	    ISO-2022-JP (RFC1468 / JIS X 0208:1997 Annex 2) and
	    ISO-2022-JP-1 (RFC2237).  Buffer overflow vulnerability
	    (when Unicode character is out of BMP range) has been
	    closed.  Convert error handling was implemented.</p>
	  <p>shiftjis.c: Broken SHIFT_JIS converters has been fixed
	    and became (upper-)compatible with Shifted Encoding Method
	    (JIS X 0208:1997 Annex 1). Buffer overflow vulnerability
	    (when Unicode character is out of BMP range) has been
	    closed.  Convert error handling was implemented.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-0224</cvename>
      <url>http://cvs.sourceforge.net/viewcvs.py/courier/libs/unicode/iso2022jp.c?rev=1.10&amp;view=markup</url>
      <url>http://cvs.sourceforge.net/viewcvs.py/courier/libs/unicode/shiftjis.c?rev=1.6&amp;view=markup</url>
      <bid>9845</bid>
      <url>http://secunia.com/advisories/11087</url>
      <url>http://www.osvdb.org/4194</url>
      <url>http://www.osvdb.org/6927</url>
    </references>
    <dates>
      <discovery>2004-02-01</discovery>
      <entry>2004-03-31</entry>
      <modified>2004-07-16</modified>
    </dates>
  </vuln>

  <vuln vid="cdf18ed9-7f4a-11d8-9645-0020ed76ef5a">
    <topic>multiple vulnerabilities in ethereal</topic>
    <affects>
      <package>
	<name>ethereal</name>
	<name>tethereal</name>
	<range><lt>0.10.3</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Stefan Esser of e-matters Security discovered a baker's dozen
	  of buffer overflows in Ethereal's decoders, including:</p>
	<ul>
	  <li>NetFlow</li>
	  <li>IGAP</li>
	  <li>EIGRP</li>
	  <li>PGM</li>
	  <li>IRDA</li>
	  <li>BGP</li>
	  <li>ISUP</li>
	  <li>TCAP</li>
	  <li>UCP</li>
	</ul>
	<p>In addition, a vulnerability in the RADIUS decoder was found
	  by Jonathan Heusser.</p>
	<p>Finally, there is one uncredited vulnerability described by the
	   Ethereal team as:</p>
	<blockquote cite="http://www.ethereal.com/appnotes/enpa-sa-00013.html">
	    <p>A zero-length Presentation protocol selector could make
	    Ethereal crash.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <url>http://www.ethereal.com/appnotes/enpa-sa-00013.html</url>
      <cvename>CAN-2004-0176</cvename>
      <cvename>CAN-2004-0365</cvename>
      <cvename>CAN-2004-0367</cvename>
      <certvu>119876</certvu>
      <certvu>124454</certvu>
      <certvu>125156</certvu>
      <certvu>433596</certvu>
      <certvu>591820</certvu>
      <certvu>644886</certvu>
      <certvu>659140</certvu>
      <certvu>695486</certvu>
      <certvu>740188</certvu>
      <certvu>792286</certvu>
      <certvu>864884</certvu>
      <certvu>931588</certvu>
      <url>http://security.e-matters.de/advisories/032004.html</url>
      <url>http://secunia.com/advisories/11185</url>
      <bid>9952</bid>
      <url>http://www.osvdb.org/4462</url>
      <url>http://www.osvdb.org/4463</url>
      <url>http://www.osvdb.org/4464</url>
    </references>
    <dates>
      <discovery>2004-03-23</discovery>
      <entry>2004-03-26</entry>
      <modified>2004-07-11</modified>
    </dates>
  </vuln>

  <vuln vid="74d06b67-d2cf-11d8-b479-02e0185c0b53">
    <topic>multiple vulnerabilities in ethereal</topic>
    <affects>
      <package>
	<name>ethereal</name>
	<name>ethereal-lite</name>
	<name>tethereal</name>
	<name>tethereal-lite</name>
	<range><lt>0.10.4</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Issues have been discovered in multiple protocol dissectors.</p>
      </body>
    </description>
    <references>
      <url>http://www.ethereal.com/appnotes/enpa-sa-00014.html</url>
      <cvename>CAN-2004-0504</cvename>
      <cvename>CAN-2004-0505</cvename>
      <cvename>CAN-2004-0506</cvename>
      <cvename>CAN-2004-0507</cvename>
      <url>http://secunia.com/advisories/11608</url>
      <bid>10347</bid>
      <url>http://www.osvdb.org/6131</url>
      <url>http://www.osvdb.org/6132</url>
      <url>http://www.osvdb.org/6133</url>
      <url>http://www.osvdb.org/6134</url>
    </references>
    <dates>
      <discovery>2004-05-13</discovery>
      <entry>2004-07-11</entry>
    </dates>
  </vuln>

  <vuln vid="265c8b00-d2d0-11d8-b479-02e0185c0b53">
    <topic>multiple vulnerabilities in ethereal</topic>
    <affects>
      <package>
	<name>ethereal</name>
	<name>ethereal-lite</name>
	<name>tethereal</name>
	<name>tethereal-lite</name>
	<range><lt>0.10.5</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Issues have been discovered in multiple protocol dissectors.</p>
      </body>
    </description>
    <references>
      <url>http://www.ethereal.com/appnotes/enpa-sa-00015.html</url>
      <cvename>CAN-2004-0633</cvename>
      <cvename>CAN-2004-0634</cvename>
      <cvename>CAN-2004-0635</cvename>
      <url>http://secunia.com/advisories/12024</url>
      <bid>10672</bid>
      <url>http://www.osvdb.org/7536</url>
      <url>http://www.osvdb.org/7537</url>
      <url>http://www.osvdb.org/7538</url>
    </references>
    <dates>
      <discovery>2004-07-06</discovery>
      <entry>2004-07-11</entry>
    </dates>
  </vuln>

  <vuln vid="4aec9d58-ce7b-11d8-858d-000d610a3b12">
    <topic>Format string vulnerability in SSLtelnet</topic>
    <affects>
      <package>
	<name>SSLtelnet</name>
	<range><le>0.13_1</le></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>SSLtelnet contains a format string vulnerability that could
	  allow remote code execution and privilege escalation.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-0640</cvename>
      <url>http://www.idefense.com/application/poi/display?id=114&amp;type=vulnerabilities</url>
    </references>
    <dates>
      <discovery>2003-04-03</discovery>
      <entry>2004-07-05</entry>
    </dates>
  </vuln>

  <vuln vid="c5519420-cec2-11d8-8898-000d6111a684">
    <topic>"Content-Type" XSS vulnerability affecting other webmail systems</topic>
    <affects>
      <package>
        <name>openwebmail</name>
        <range><le>2.32</le></range>
      </package>
      <package>
        <name>ilohamail</name>
        <range><lt>0.8.13</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
        <p>Roman Medina-Heigl Hernandez did a survey which other webmail systems
          where vulnerable to a bug he discovered in SquirrelMail. This advisory
          summarizes the results.</p>
      </body>
    </description>
    <references>
      <url>http://www.rs-labs.com/adv/RS-Labs-Advisory-2004-2.txt</url>
      <url>http://www.freebsd.org/ports/portaudit/89a0de27-bf66-11d8-a252-02e0185c0b53.html</url>
      <url>http://www.freebsd.org/ports/portaudit/911f1b19-bd20-11d8-84f9-000bdb1444a4.html</url>
      <url>http://www.freebsd.org/ports/portaudit/c3e56efa-c42f-11d8-864c-02e0185c0b53.html</url>
      <cvename>CAN-2004-0519</cvename>
    </references>
    <dates>
      <discovery>2004-05-29</discovery>
      <entry>2004-07-05</entry>
    </dates>
  </vuln>

  <vuln vid="76904dce-ccf3-11d8-babb-000854d03344">
    <topic>Pavuk HTTP Location header overflow</topic>
    <affects>
      <package>
	<name>pavuk</name>
	<range><lt>0.9.28_5</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>When pavuk sends a request to a web server and the server
	  sends back the HTTP status code 305 (Use Proxy), pavuk
	  copies data from the HTTP Location header in an unsafe
	  manner. This leads to a stack-based buffer overflow with
	  control over EIP.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-0456</cvename>
      <mlist>http://lists.netsys.com/pipermail/full-disclosure/2004-July/023322.html</mlist>
      <url>http://www.osvdb.org/7319</url>
    </references>
    <dates>
      <discovery>2004-06-30</discovery>
      <entry>2004-07-03</entry>
    </dates>
  </vuln>

  <vuln vid="33ab4a47-bfc1-11d8-b00e-000347a4fa7d">
    <topic>Several vulnerabilities found in PHPNuke</topic>
    <affects>
      <package>
	<name>phpnuke</name>
	<range><lt>7.3</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Janek Vind "waraxe" reports that several issues in the
	  PHPNuke software may be exploited via carefully crafted
	  URL requests.  These URLs will permit the injection of
	  SQL code, cookie theft, and the readability of the
	  PHPNuke administrator account.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2003-0279</cvename>
      <cvename>CAN-2003-0318</cvename>
      <cvename>CAN-2004-0266</cvename>
      <cvename>CAN-2004-0269</cvename>
      <url>http://www.waraxe.us/index.php?modname=sa&amp;id=27</url>
      <url>http://secunia.com/advisories/11920</url>
    </references>
    <dates>
      <discovery>2004-05-05</discovery>
      <entry>2004-07-03</entry>
      <modified>2004-09-28</modified>
    </dates>
  </vuln>

  <vuln vid="0d4c31ac-cb91-11d8-8898-000d6111a684">
    <topic>Remote code injection in phpMyAdmin</topic>
    <affects>
      <package>
	<name>phpMyAdmin</name>
	<range><lt>2.5.7.1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>This vulnerability would allow remote user to inject PHP code
	  to be executed by eval() function.  This vulnerability is only
	  exploitable if variable $cfg['LeftFrameLight'] is set to FALSE (in
	  file config.inc.php).</p>
      </body>
    </description>
    <references>
      <url>http://sf.net/forum/forum.php?forum_id=387635</url>
      <mlist msgid="20040629025752.976.qmail@www.securityfocus.com">http://www.securityfocus.com/archive/1/367486</mlist>
      <url>http://secunia.com/advisories/11974</url>
      <url>http://eagle.kecapi.com/sec/fd/phpMyAdmin.html</url>
    </references>
    <dates>
      <discovery>2004-06-29</discovery>
      <entry>2004-07-02</entry>
      <modified>2004-09-28</modified>
    </dates>
  </vuln>

  <vuln vid="4d837296-cc28-11d8-a54c-02e0185c0b53">
    <topic>GNATS local privilege elevation</topic>
    <affects>
      <package>
	<name>gnats</name>
	<range><le>3.113.1_9</le></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>GNATS 3.113.1 contains multiple buffer overflows, through which a
	  local attacker could gain elevated privileges on the system.</p>
      </body>
    </description>
    <references>
      <freebsdpr>ports/56006</freebsdpr>
      <mlist msgid="20040625164231.7437.qmail@www.securityfocus.com">http://www.securityfocus.com/archive/1/326337</mlist>
      <url>http://www.securiteam.com/unixfocus/5CP0N0UAAA.html</url>
      <url>http://secunia.com/advisories/9096</url>
      <url>http://x82.inetcop.org/h0me/adv1sor1es/INCSA.2003-0x82-018-GNATS-bt.txt</url>
      <url>http://www.gnu.org/software/gnats/gnats.html</url>
      <url>http://www.osvdb.org/2190</url>
      <url>http://www.osvdb.org/4600</url>
      <url>http://www.osvdb.org/4601</url>
      <url>http://www.osvdb.org/4607</url>
    </references>
    <dates>
      <discovery>2003-06-21</discovery>
      <entry>2004-07-02</entry>
    </dates>
  </vuln>

  <vuln vid="8ecaaca2-cc07-11d8-858d-000d610a3b12">
    <topic>Linux binary compatibility mode input validation error</topic>
    <affects>
      <system>
	<name>FreeBSD</name>
	<range><ge>4.9</ge><lt>4.9_10</lt></range>
	<range><ge>4.8</ge><lt>4.8_23</lt></range>
      </system>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A programming error in the handling of some Linux system
	  calls may result in memory locations being accessed without
	  proper validation.</p>
	<p>It may be possible for a local attacker to read and/or
	  overwrite portions of kernel memory, resulting in disclosure
	  of sensitive information or potential privilege escalation.
	  A local attacker can cause a system panic.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-0602</cvename>
      <freebsdsa>SA-04:13.linux</freebsdsa>
    </references>
    <dates>
      <discovery>2004-06-18</discovery>
      <entry>2004-06-30</entry>
    </dates>
  </vuln>

  <vuln vid="1f738bda-c6ac-11d8-8898-000d6111a684">
    <topic>Remote Denial of Service of HTTP server and client</topic>
    <affects>
      <package>
	<name>giFT-FastTrack</name>
	<range><lt>0.8.7</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>giFT-FastTrack is susceptible to a remote
	  Denial of Service attack which could allow
	  a remote attacker to render HTTP services
	  unusable.  According to the developers, no
	  code execution is possible; however, they
	  recommend an immediate upgrade.</p>
      </body>
    </description>
    <references>
      <url>http://developer.berlios.de/forum/forum.php?forum_id=5814</url>
      <url>http://www.osvdb.org/7266</url>
      <url>http://secunia.com/advisories/11941</url>
      <bid>10604</bid>
    </references>
    <dates>
      <discovery>2004-06-19</discovery>
      <entry>2004-06-25</entry>
      <modified>2004-06-29</modified>
    </dates>
  </vuln>

  <vuln vid="ff00f2ce-c54c-11d8-b708-00061bc2ad93">
    <topic>XFree86 opens a chooserFd TCP socket even when DisplayManager.requestPort is 0</topic>
    <affects>
      <package>
	<name>xorg-clients</name>
	<range><eq>6.7.0</eq></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>When the IPv6 code was added to xdm a critical
	  test to disable xdmcp was accidentally removed.  This
	  caused xdm to create the chooser socket regardless if
	  DisplayManager.requestPort was disabled in xdm-config
	  or not.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-0419</cvename>
      <url>http://bugs.xfree86.org/show_bug.cgi?id=1376</url>
      <url>https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=124900</url>
    </references>
    <dates>
      <discovery>2004-05-19</discovery>
      <entry>2004-06-28</entry>
      <modified>2004-06-28</modified>
    </dates>
  </vuln>

  <vuln vid="da9e6438-bfc0-11d8-b00e-000347a4fa7d">
    <topic>MoinMoin administrative group name privilege escalation vulnerability</topic>
    <affects>
      <package>
	<name>moinmoin</name>
	<range><lt>1.2.2</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A serious flaw exists in the MoinMoin software
	  which may allow a malicious user to gain access to
	  unauthorized privileges.</p>
      </body>
    </description>
    <references>
      <url>http://www.osvdb.org/6704</url>
      <cvename>CAN-2004-0708</cvename>
      <bid>10568</bid>
      <url>http://secunia.com/advisories/11807</url>
    </references>
    <dates>
      <discovery>2004-05-04</discovery>
      <entry>2004-06-28</entry>
    </dates>
  </vuln>

  <vuln vid="35f6fdf8-a425-11d8-9c6d-0020ed76ef5a">
    <topic>Cyrus IMAP pre-authentication heap overflow vulnerability</topic>
    <affects>
      <package>
	<name>cyrus</name>
	<range><lt>2.0.17</lt></range>
	<range><ge>2.1</ge><lt>2.1.11</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>In December 2002, Timo Sirainen reported:</p>
	<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=103886607825605">
	  <p>Cyrus IMAP server has a a remotely exploitable pre-login
	    buffer overflow. [...] Note that you don't have to log in
	    before exploiting this, and since Cyrus
	    runs everything under one UID, it's possible to read every
	    user's mail in the system.</p>
	</blockquote>
	<p>It is unknown whether this vulnerability is exploitable for code
	  execution on FreeBSD systems.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2002-1580</cvename>
      <bid>6298</bid>
      <certvu>740169</certvu>
      <mlist msgid="20021202175606.GA26254@irccrew.org">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=103886607825605</mlist>
      <mlist>http://asg.web.cmu.edu/archive/message.php?mailbox=archive.info-cyrus&amp;msg=19349</mlist>
    </references>
    <dates>
      <discovery>2002-12-02</discovery>
      <entry>2004-05-12</entry>
      <modified>2004-06-27</modified>
    </dates>
  </vuln>

  <vuln vid="700d43b4-a42a-11d8-9c6d-0020ed76ef5a">
    <topic>Cyrus IMSPd multiple vulnerabilities</topic>
    <affects>
      <package>
	<name>cyrus-imspd</name>
	<range><lt>1.6a5</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Cyrus team reported multiple vulnerabilities in older
	  versions of Cyrus IMSPd:</p>
	<blockquote cite="http://asg.web.cmu.edu/archive/message.php?mailbox=archive.cyrus-announce&amp;msg=25">
	  <p>These releases correct a recently discovered buffer
	    overflow vulnerability, as well as clean up a significant
	    amount of buffer handling throughout the code.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <mlist>http://asg.web.cmu.edu/archive/message.php?mailbox=archive.cyrus-announce&amp;msg=25</mlist>
    </references>
    <dates>
      <discovery>2004-12-12</discovery>
      <entry>2004-05-12</entry>
      <modified>2004-06-27</modified>
    </dates>
  </vuln>

  <vuln vid="5e7f58c3-b3f8-4258-aeb8-795e5e940ff8">
    <topic>mplayer heap overflow in http requests</topic>
    <affects>
      <package>
	<name>mplayer</name>
	<name>mplayer-gtk</name>
	<name>mplayer-esound</name>
	<name>mplayer-gtk-esound</name>
	<range><lt>0.92.1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A remotely exploitable heap buffer overflow vulnerability was
	  found in MPlayer's URL decoding code.  If an attacker can
	  cause MPlayer to visit a specially crafted URL, arbitrary code
	  execution with the privileges of the user running MPlayer may
	  occur.  A `visit' might be caused by social engineering, or a
	  malicious web server could use HTTP redirects which MPlayer
	  would then process.</p>
      </body>
    </description>
    <references>
      <url>http://www.mplayerhq.hu/homepage/design6/news.html</url>
      <mlist>http://marc.theaimsgroup.com/?l=bugtraq&amp;m=108066964709058</mlist>
      <freebsdpr>ports/64974</freebsdpr>
    </references>
    <dates>
      <discovery>2004-03-30</discovery>
      <entry>2004-03-31</entry>
      <modified>2004-06-27</modified>
    </dates>
  </vuln>

  <vuln vid="3e9be8c4-8192-11d8-9645-0020ed76ef5a">
    <topic>ecartis buffer overflows and input validation bugs</topic>
    <affects>
      <package>
	<name>ecartis</name>
	<range><lt>1.0.0.s20030814,1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Timo Sirainen reports multiple buffer overflows that may be
	  triggered while parsing messages, as well as input validation
	  errors that could result in disclosure of mailing list
	  passwords.</p>
	<p>These bugs were resolved in the August 2003 snapshot of
	  ecartis.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2003-0781</cvename>
      <cvename>CAN-2003-0782</cvename>
      <url>http://www.securiteam.com/unixfocus/5YP0H2AAUY.html</url>
      <freebsdpr>ports/57082</freebsdpr>
    </references>
    <dates>
      <discovery>2003-08-14</discovery>
      <entry>2004-03-29</entry>
      <modified>2004-06-27</modified>
    </dates>
  </vuln>

  <vuln vid="c2e10368-77ab-11d8-b9e8-00e04ccb0a62">
    <topic>ModSecurity for Apache 2.x remote off-by-one overflow</topic>
    <affects>
      <package>
	<name>mod_security</name>
	<range><lt>1.7.5</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>When the directive "SecFilterScanPost" is enabled,
	  the Apache 2.x version of ModSecurity is vulnerable
	  to an off-by-one overflow</p>
      </body>
    </description>
    <references>
      <url>http://www.s-quadra.com/advisories/Adv-20040315.txt</url>
      <bid>9885</bid>
      <url>http://secunia.com/advisories/11138</url>
      <certvu>779438</certvu>
    </references>
    <dates>
      <discovery>2004-02-09</discovery>
      <entry>2004-03-17</entry>
      <modified>2004-06-27</modified>
    </dates>
  </vuln>

  <vuln vid="74a9541d-5d6c-11d8-80e3-0020ed76ef5a">
    <topic>clamav remote denial-of-service</topic>
    <affects>
      <package>
	<name>clamav</name>
	<range><lt>0.65_7</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>clamav will exit when a programming
	  assertion is not met.  A malformed uuencoded message can
	  trigger this assertion, allowing an attacker to trivially
	  crash clamd or other components of clamav.</p>
      </body>
    </description>
    <references>
      <freebsdpr>ports/62586</freebsdpr>
      <mlist msgid="40279811.9050407@fillmore-labs.com">http://www.securityfocus.com/archive/1/353186</mlist>
      <url>http://www.osvdb.org/3894</url>
      <bid>9610</bid>
      <url>http://secunia.com/advisories/10826</url>
      <cvename>CAN-2004-0270</cvename>
      <url>http://xforce.iss.net/xforce/xfdb/15077</url>
    </references>
    <dates>
      <discovery>2004-02-09</discovery>
      <entry>2004-02-12</entry>
      <modified>2004-06-27</modified>
    </dates>
  </vuln>

  <vuln vid="8d075001-a9ce-11d8-9c6d-0020ed76ef5a">
    <topic>neon date parsing vulnerability</topic>
    <affects>
      <package>
	<name>neon</name>
	<range><lt>0.24.5_1</lt></range>
      </package>
      <package>
	<name>sitecopy</name>
	<range><le>0.13.4_1</le></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Stefan Esser reports:</p>
	<blockquote cite="http://security.e-matters.de/advisories/062004.html">
	  <p>A vulnerability within a libneon date parsing function
	    could cause a heap overflow which could lead to remote
	    code execution, depending on the application using
	    libneon.</p>
	</blockquote>
	<p>The vulnerability is in the function ne_rfc1036_parse,
	  which is in turn used by the function ne_httpdate_parse.
	  Applications using either of these neon functions may be
	  vulnerable.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-0398</cvename>
      <url>http://security.e-matters.de/advisories/062004.html</url>
      <url>http://secunia.com/advisories/11785</url>
    </references>
    <dates>
      <discovery>2004-05-19</discovery>
      <entry>2004-05-19</entry>
      <modified>2004-06-25</modified>
    </dates>
  </vuln>

  <vuln vid="84237895-8f39-11d8-8b29-0020ed76ef5a">
    <topic>neon format string vulnerabilities</topic>
    <affects>
      <package>
	<name>neon</name>
	<range><lt>0.24.5</lt></range>
      </package>
      <package>
	<name>tla</name>
	<range><lt>1.2_1</lt></range>
      </package>
      <package>
	<name>sitecopy</name>
	<range><le>0.13.4_1</le></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Greuff reports that the neon WebDAV client library contains
	  several format string bugs within error reporting code.  A
	  malicious server may exploit these bugs by sending specially
	  crafted PROPFIND or PROPPATCH responses.</p>
	<p>Although several applications include neon, such as cadaver and
	  subversion, the FreeBSD Ports of these applications are not
	  impacted.  They are specifically configured to NOT use the
	  included neon.  Only packages listed as affected in this
	  notice are believed to be impacted.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-0179</cvename>
      <url>http://www.webdav.org/neon/</url>
      <url>http://secunia.com/advisories/11785</url>
    </references>
    <dates>
      <discovery>2004-04-14</discovery>
      <entry>2004-04-15</entry>
      <modified>2004-06-25</modified>
    </dates>
  </vuln>

  <vuln vid="253ea131-bd12-11d8-b071-00e08110b673">
    <topic>Gallery 1.4.3 and ealier user authentication bypass</topic>
    <affects>
      <package>
	<name>gallery</name>
	<range><lt>1.4.3.2</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A flaw exists in Gallery versions previous to
	  1.4.3-pl1 and post 1.2 which may give an attacker
	  the potential to log in under the "admin" account.
	  Data outside of the gallery is unaffected and the
	  attacker cannot modify any data other than the
	  photos or photo albums.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-0522</cvename>
      <url>http://gallery.menalto.com/modules.php?op=modload&amp;name=News&amp;file=article&amp;sid=123</url>
      <url>http://secunia.com/advisories/11752</url>
    </references>
    <dates>
      <discovery>2004-06-01</discovery>
      <entry>2004-06-24</entry>
    </dates>
  </vuln>

  <vuln vid="0c6f3fde-9c51-11d8-9366-0020ed76ef5a">
    <topic>Midnight Commander buffer overflows, format string bugs, and insecure temporary file handling</topic>
    <affects>
      <package>
	<name>mc</name>
	<range><lt>4.6.0_10</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Jakub Jelinek reports several security related bugs in
	  Midnight Commander, including:</p>
	<ul>
	  <li>Multiple buffer overflows (CAN-2004-0226)</li>
	  <li>Insecure temporary file handling (CAN-2004-0231)</li>
	  <li>Format string bug (CAN-2004-0232)</li>
	</ul>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-0226</cvename>
      <cvename>CAN-2004-0231</cvename>
      <cvename>CAN-2004-0232</cvename>
    </references>
    <dates>
      <discovery>2004-04-29</discovery>
      <entry>2004-05-02</entry>
      <modified>2004-06-14</modified>
    </dates>
  </vuln>

  <vuln vid="6f955451-ba54-11d8-b88c-000d610a3b12">
    <topic>Buffer overflow in Squid NTLM authentication helper</topic>
    <affects>
      <package>
	<name>squid</name>
	<range><lt>2.5.5_9</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Remote exploitation of a buffer overflow vulnerability in
	  the NTLM authentication helper routine of the Squid Web
	  Proxy Cache could allow a remote attacker to execute
	  arbitrary code.  A remote attacker can compromise a target
	  system if the Squid Proxy is configured to use the NTLM
	  authentication helper.  The attacker can send an overly long
	  password to overflow the buffer and execute arbitrary
	  code.</p>
      </body>
    </description>
    <references>
      <url>http://www.idefense.com/application/poi/display?id=107&amp;type=vulnerabilities&amp;flashstatus=false</url>
      <cvename>CAN-2004-0541</cvename>
      <url>http://www.osvdb.org/6791</url>
      <url>http://secunia.com/advisories/11804</url>
      <bid>10500</bid>
      <url>http://www.squid-cache.org/bugs/show_bug.cgi?id=998</url>
    </references>
    <dates>
      <discovery>2004-05-20</discovery>
      <entry>2004-06-09</entry>
    </dates>
  </vuln>

  <vuln vid="27c331d5-64c7-11d8-80e3-0020ed76ef5a">
    <topic>Vulnerabilities in H.323 implementations</topic>
    <affects>
      <package>
	<name>pwlib</name>
	<range><lt>1.5.0_5</lt></range>
      </package>
      <package>
	<name>asterisk</name>
	<range><le>0.7.2</le></range>
      </package>
      <package>
	<name>openh323</name>
	<range><lt>1.12.0_4</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The <a href="http://www.niscc.gov.uk/">NISCC</a> and the <a href="http://www.ee.oulu.fi/research/ouspg/">OUSPG</a>
	  developed a test suite for the H.323 protocol.  This test
	  suite has uncovered vulnerabilities in several H.323
	  implementations with impacts ranging from denial-of-service
	  to arbitrary code execution.</p>
	<p>In the FreeBSD Ports Collection, `pwlib' is directly
	  affected.  Other applications such as `asterisk' and
	  `openh323' incorporate `pwlib' statically and so are also
	  independently affected.</p>
      </body>
    </description>
    <references>
      <!-- General references -->
      <url>http://www.uniras.gov.uk/vuls/2004/006489/h323.htm</url>
      <url>http://www.ee.oulu.fi/research/ouspg/protos/testing/c07/h2250v4/index.html</url>
      <certsa>CA-2004-01</certsa>
      <certvu>749342</certvu>
      <!-- pwlib and pwlib-using applications -->
      <cvename>CAN-2004-0097</cvename>
      <url>http://www.southeren.com/blog/archives/000055.html</url>
    </references>
    <dates>
      <discovery>2004-01-13</discovery>
      <entry>2004-02-22</entry>
      <modified>2004-06-08</modified>
    </dates>
  </vuln>

  <vuln vid="fb5e227e-b8c6-11d8-b88c-000d610a3b12">
    <topic>jailed processes can manipulate host routing tables</topic>
    <affects>
      <system>
	<name>FreeBSD</name>
	<range><ge>4.9</ge><lt>4.9_10</lt></range>
	<range><ge>4.8</ge><lt>4.8_23</lt></range>
      </system>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A programming error resulting in a failure to verify that
	  an attempt to manipulate routing tables originated from a
	  non-jailed process.</p>

	<p>Jailed processes running with superuser privileges could
	  modify host routing tables.  This could result in a variety
	  of consequences including packets being sent via an
	  incorrect network interface and packets being discarded
	  entirely.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-0125</cvename>
      <freebsdsa>SA-04:12.jailroute</freebsdsa>
    </references>
    <dates>
      <discovery>2004-02-03</discovery>
      <entry>2004-06-07</entry>
    </dates>
  </vuln>

  <vuln vid="1db1ed59-af07-11d8-acb9-000d610a3b12">
    <topic>buffer cache invalidation implementation issues</topic>
    <affects>
      <system>
	<name>FreeBSD</name>
	<range><ge>5.0</ge><lt>5.2_8</lt></range>
	<range><ge>4.9</ge><lt>4.9_9</lt></range>
	<range><ge>4.0</ge><lt>4.8_22</lt></range>
      </system>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Programming errors in the implementation of the msync(2)
	  system call involving the MS_INVALIDATE operation lead to
	  cache consistency problems between the virtual memory system
	  and on-disk contents.</p>

	<p>In some situations, a user with read access to a file may
	  be able to prevent changes to that file from being committed
	  to disk.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-0435</cvename>
      <freebsdsa>SA-04:11.msync</freebsdsa>
    </references>
    <dates>
      <discovery>2004-04-24</discovery>
      <entry>2004-05-26</entry>
    </dates>
  </vuln>

  <vuln vid="f7a3b18c-624c-4703-9756-b6b27429e5b0">
    <topic>leafnode denial-of-service triggered by article request</topic>
    <affects>
      <package>
	<name>leafnode</name>
	<range><ge>1.9.20</ge><lt>1.9.30</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The leafnode NNTP server may go into an unterminated loop with 100%
	  CPU use when an article is requested by Message-ID that has been
	  crossposted to several news groups when one of the group names is the
	  prefix of another group name that the article was cross-posted
	  to. Found by Jan Knutar.</p>
      </body>
    </description>
    <references>
      <url>http://leafnode.sourceforge.net/leafnode-SA-2002-01.txt</url>
      <cvename>CAN-2002-1661</cvename>
      <mlist msgid="20021229205023.GA5216@merlin.emma.line.org">http://sourceforge.net/mailarchive/message.php?msg_id=2796226</mlist>
      <mlist msgid="20021229205023.GA5216@merlin.emma.line.org">http://article.gmane.org/gmane.network.leafnode.announce/8</mlist>
      <bid>6490</bid>
      <freebsdpr>ports/46613</freebsdpr>
    </references>
    <dates>
      <discovery>2002-11-06</discovery>
      <entry>2004-05-21</entry>
      <modified>2005-05-13</modified>
    </dates>
  </vuln>

  <vuln vid="7b0208ff-3f65-4e16-8d4d-48fd9851f085">
    <topic>leafnode fetchnews denial-of-service triggered by missing header</topic>
    <affects>
      <package>
	<name>leafnode</name>
	<range><ge>1.9.3</ge><le>1.9.41</le></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Fetchnews could hang when a news article to be downloaded lacked one
	  of the mandatory headers. Found by Joshua Crawford.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2003-0744</cvename>
      <url>http://leafnode.sourceforge.net/leafnode-SA-2003-01.txt</url>
      <mlist msgid="20030904011904.GB12350@merlin.emma.line.org">http://sourceforge.net/mailarchive/message.php?msg_id=5975563</mlist>
      <mlist msgid="20030904011904.GB12350@merlin.emma.line.org">http://article.gmane.org/gmane.network.leafnode.announce/21</mlist>
      <bid>8541</bid>
      <freebsdpr>ports/53838</freebsdpr>
    </references>
    <dates>
      <discovery>2003-06-20</discovery>
      <entry>2004-05-21</entry>
      <modified>2005-05-13</modified>
    </dates>
  </vuln>

  <vuln vid="a051a4ec-3aa1-4dd1-9bdc-a61eb5700153">
    <topic>leafnode fetchnews denial-of-service triggered by truncated transmission</topic>
    <affects>
      <package>
	<name>leafnode</name>
	<range><le>1.9.47</le></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>When a downloaded news article ends prematurely, i. e. when the
	  server sends [CR]LF.[CR]LF before sending a blank line, fetchnews may
	  wait indefinitely for data that never arrives. Workaround: configure
	  "minlines=1" (or use a bigger value) in the configuration file. Found
	  by Toni Viemerö.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-2068</cvename>
      <url>http://leafnode.sourceforge.net/leafnode-SA-2004-01.txt</url>
      <url>http://sourceforge.net/tracker/index.php?func=detail&amp;aid=873149&amp;group_id=57767&amp;atid=485349</url>
      <mlist msgid="20040109015625.GA12319@merlin.emma.line.org">http://article.gmane.org/gmane.network.leafnode.announce/32</mlist>
      <mlist msgid="20040109015625.GA12319@merlin.emma.line.org">http://sourceforge.net/mailarchive/message.php?msg_id=6922570</mlist>
      <freebsdpr>ports/61105</freebsdpr>
    </references>
    <dates>
      <discovery>2004-01-08</discovery>
      <entry>2004-05-21</entry>
      <modified>2005-05-13</modified>
    </dates>
  </vuln>

  <vuln vid="2e129846-8fbb-11d8-8b29-0020ed76ef5a">
    <topic>MySQL insecure temporary file creation (mysqlbug)</topic>
    <affects>
      <package>
	<name>mysql-client</name>
	<range><ge>4.0</ge><lt>4.0.20</lt></range>
	<range><ge>4.1</ge><lt>4.1.1_2</lt></range>
	<range><ge>5.0</ge><lt>5.0.0_2</lt></range>
      </package>
    </affects>
    <description>
       <body xmlns="http://www.w3.org/1999/xhtml">
	 <p>Shaun Colley reports that the script `mysqlbug' included
	   with MySQL sometimes creates temporary files in an unsafe
	   manner.  As a result, an attacker may create a symlink in
	   /tmp so that if another user invokes `mysqlbug' and <em>quits
	   without making <strong>any</strong> changes</em>, an
	   arbitrary file may be overwritten with the bug report
	   template.</p>
       </body>
    </description>
    <references>
      <mlist>http://marc.theaimsgroup.com/?l=bugtraq&amp;m=108023246916294&amp;w=2</mlist>
      <url>http://bugs.mysql.com/bug.php?id=3284</url>
      <bid>9976</bid>
      <cvename>CAN-2004-0381</cvename>
    </references>
    <dates>
      <discovery>2004-03-25</discovery>
      <entry>2004-04-16</entry>
      <modified>2004-05-21</modified>
    </dates>
  </vuln>

  <vuln vid="5d36ef32-a9cf-11d8-9c6d-0020ed76ef5a">
    <topic>subversion date parsing vulnerability</topic>
    <affects>
      <package>
	<name>subversion</name>
	<range><lt>1.0.2_1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Stefan Esser reports:</p>
	<blockquote cite="http://security.e-matters.de/advisories/082004.html">
	  <p>Subversion versions up to 1.0.2 are vulnerable to a date
	    parsing vulnerability which can be abused to allow remote
	    code execution on Subversion servers and therefore could
	    lead to a repository compromise.</p>
	</blockquote>
	<p><em>NOTE:</em> This vulnerability is similar to the date
	  parsing issue that affected neon.  However, it is a different
	  and distinct bug.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-0397</cvename>
      <url>http://security.e-matters.de/advisories/082004.html</url>
    </references>
    <dates>
      <discovery>2004-05-19</discovery>
      <entry>2004-05-19</entry>
    </dates>
  </vuln>

  <vuln vid="f93be979-a992-11d8-aecc-000d610a3b12">
    <topic>cvs pserver remote heap buffer overflow</topic>
    <affects>
      <system>
	<name>FreeBSD</name>
	<range><ge>5.2</ge><lt>5.2_7</lt></range>
	<range><ge>5.1</ge><lt>5.1_17</lt></range>
	<range><ge>5.0</ge><lt>5.0_21</lt></range>
	<range><ge>4.9</ge><lt>4.9_8</lt></range>
	<range><ge>4.8</ge><lt>4.8_21</lt></range>
	<range><ge>4.0</ge><lt>4.7_27</lt></range>
      </system>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Due to a programming error in code used to parse data
	  received from the client, malformed data can cause a heap
	  buffer to overflow, allowing the client to overwrite
	  arbitrary portions of the server's memory.</p>
	<p>A malicious CVS client can exploit this to run arbitrary
	  code on the server at the privilege level of the CVS server
	  software.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-0396</cvename>
      <freebsdsa>SA-04:10.cvs</freebsdsa>
    </references>
    <dates>
      <discovery>2004-05-02</discovery>
      <entry>2004-05-19</entry>
    </dates>
  </vuln>

  <vuln vid="492f8896-70fa-11d8-873f-0020ed76ef5a">
    <topic>Apache 2 mod_ssl denial-of-service</topic>
    <affects>
      <package>
	<name>apache</name>
	<range><ge>2.0</ge><le>2.0.48_3</le></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Joe Orton reports a memory leak in Apache 2's mod_ssl.
	  A remote attacker may issue HTTP requests on an HTTPS
	  port, causing an error.  Due to a bug in processing this
	  condition, memory associated with the connection is
	  not freed.  Repeated requests can result in consuming
	  all available memory resources, probably resulting in
	  termination of the Apache process.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-0113</cvename>
      <url>http://www.apacheweek.com/features/security-20</url>
      <url>http://cvs.apache.org/viewcvs.cgi/httpd-2.0/modules/ssl/ssl_engine_io.c?r1=1.100.2.11&amp;r2=1.100.2.12</url>
      <mlist>http://marc.theaimsgroup.com/?l=apache-cvs&amp;m=107869699329638</mlist>
      <url>http://nagoya.apache.org/bugzilla/show_bug.cgi?id=27106</url>
      <bid>9826</bid>
    </references>
    <dates>
      <discovery>2004-02-20</discovery>
      <entry>2004-03-08</entry>
      <modified>2004-05-19</modified>
    </dates>
  </vuln>

  <vuln vid="df333ede-a8ce-11d8-9c6d-0020ed76ef5a">
    <topic>URI handler vulnerabilities in several browsers</topic>
    <affects>
      <package>
	<name>linux-opera</name>
	<name>opera</name>
	<range><lt>7.50</lt></range>
      </package>
      <package>
	<name>kdelibs</name>
	<range><lt>3.2.2_3</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Karol Wiesek and Greg MacManus reported via iDEFENSE that the
	  Opera web browser contains a flaw in the handling of
	  certain URIs.  When presented with these URIs, Opera would
	  invoke external commands to process them after some
	  validation.  However, if the hostname component of a URI
	  begins with a `-', it may be treated as an option by an external
	  command.  This could have undesirable side-effects, from
	  denial-of-service to code execution.  The impact is very
	  dependent on local configuration.</p>
	<p>After the iDEFENSE advisory was published, the KDE team
	  discovered similar problems in KDE's URI handlers.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-0411</cvename>
      <url>http://www.idefense.com/application/poi/display?id=104&amp;type=vulnerabilities</url>
      <url>http://www.kde.org/info/security/advisory-20040517-1.txt</url>
      <url>http://freebsd.kde.org/index.php#n20040517</url>
    </references>
    <dates>
      <discovery>2004-05-12</discovery>
      <entry>2004-05-18</entry>
    </dates>
  </vuln>

  <vuln vid="20be2982-4aae-11d8-96f2-0020ed76ef5a">
    <topic>fsp buffer overflow and directory traversal vulnerabilities</topic>
    <affects>
      <package>
	<name>fspd</name>
	<range><lt>2.8.1.19</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The <a href="http://www.debian.org/security">Debian
	security team</a> reported a pair of vulnerabilities in
	fsp:</p>
	<blockquote cite="http://www.debian.org/security/2004/dsa-416">
	  <p>A vulnerability was discovered in fsp, client utilities
	  for File Service Protocol (FSP), whereby a remote user could
	  both escape from the FSP root directory (CAN-2003-1022), and
	  also overflow a fixed-length buffer to execute arbitrary
	  code (CAN-2004-0011).</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CAN-2003-1022</cvename>
      <cvename>CAN-2004-0011</cvename>
      <url>http://www.debian.org/security/2004/dsa-416</url>
    </references>
    <dates>
      <discovery>2004-01-06</discovery>
      <entry>2004-01-19</entry>
      <modified>2004-05-17</modified>
    </dates>
  </vuln>

  <vuln vid="cb6c6c29-9c4f-11d8-9366-0020ed76ef5a">
    <topic>proftpd IP address access control list breakage</topic>
    <affects>
      <package>
	<name>proftpd</name>
	<range><ge>1.2.9</ge><lt>1.2.10.r1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Jindrich Makovicka reports a regression in proftpd's
	  handling of IP address access control lists (IP ACLs).  Due
	  to this regression, some IP ACLs are treated as ``allow
	  all''.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-0432</cvename>
      <url>http://bugs.proftpd.org/show_bug.cgi?id=2267</url>
    </references>
    <dates>
      <discovery>2003-11-04</discovery>
      <entry>2004-05-02</entry>
      <modified>2004-05-15</modified>
    </dates>
  </vuln>

  <vuln vid="fde53204-7ea6-11d8-9645-0020ed76ef5a">
    <topic>insecure temporary file creation in xine-check, xine-bugreport</topic>
    <affects>
      <package>
	<name>xine</name>
	<range><lt>0.9.23_3</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Some scripts installed with xine create temporary files
	  insecurely.  It is recommended that these scripts (xine-check,
	  xine-bugreport) not be used.  They are not needed for normal
	  operation.</p>
      </body>
    </description>
    <references>
      <mlist>http://marc.theaimsgroup.com/?l=bugtraq&amp;m=107997911025558</mlist>
      <bid>9939</bid>
    </references>
    <dates>
      <discovery>2004-03-20</discovery>
      <entry>2004-03-26</entry>
      <modified>2004-05-09</modified>
    </dates>
  </vuln>

  <vuln vid="5f29c2e4-9f6a-11d8-abbc-00e08110b673">
    <topic>exim buffer overflow when verify = header_syntax is used</topic>
    <affects>
      <package>
	<name>exim</name>
	<name>exim-ldap2</name>
	<name>exim-mysql</name>
	<name>exim-postgresql</name>
	<range><lt>4.33+20_1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A remote exploitable buffer overflow has been discovered
	  in exim when verify = header_syntax is used in the
	  configuration file. This does not affect the default
	  configuration.</p>
      </body>
    </description>
    <references>
      <url>http://www.guninski.com/exim1.html</url>
      <cvename>CAN-2004-0400</cvename>
    </references>
    <dates>
      <discovery>2004-05-06</discovery>
      <entry>2004-05-06</entry>
    </dates>
  </vuln>

  <vuln vid="a56a72bb-9f72-11d8-9585-0020ed76ef5a">
    <topic>phpBB session table exhaustion</topic>
    <affects>
      <package>
	<name>phpbb</name>
	<range><le>2.0.8_2</le></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The includes/sessions.php unnecessarily adds session item into
	  session table and therefore vulnerable to a denial-of-service
	  attack.</p>
	</body>
    </description>
    <references>
      <mlist msgid="20040421011055.GA1448@frontfree.net">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=108256462710010</mlist>
    </references>
    <dates>
      <discovery>2004-03-05</discovery>
      <entry>2004-05-06</entry>
    </dates>
  </vuln>

  <vuln vid="446dbecb-9edc-11d8-9366-0020ed76ef5a">
    <topic>heimdal kadmind remote heap buffer overflow</topic>
    <affects>
      <package>
	<name>heimdal</name>
	<range><lt>0.6.1_1</lt></range>
      </package>
      <system>
	<name>FreeBSD</name>
	<range><ge>4.9</ge><lt>4.9_7</lt></range>
	<range><ge>4.0</ge><lt>4.8_20</lt></range>
      </system>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>An input validation error was discovered in the kadmind
	  code that handles the framing of Kerberos 4 compatibility
	  administration requests.  The code assumed that the length
	  given in the framing was always two or more bytes.  Smaller
	  lengths will cause kadmind to read an arbitrary amount of
	  data into a minimally-sized buffer on the heap.</p>
	<p>A remote attacker may send a specially formatted message
	  to kadmind, causing it to crash or possibly resulting in
	  arbitrary code execution.</p>
	<p>The kadmind daemon is part of Kerberos 5 support.  However,
	  this bug will only be present if kadmind was built with
	  additional Kerberos 4 support.  Thus, only systems that have
	  *both* Heimdal Kerberos 5 and Kerberos 4 installed might
	  be affected.</p>
	<p><em>NOTE:</em> On FreeBSD 4 systems, `kadmind' may be
	  installed as `k5admind'.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-0434</cvename>
      <freebsdsa>SA-04:09.kadmind</freebsdsa>
    </references>
    <dates>
      <discovery>2004-05-05</discovery>
      <entry>2004-05-05</entry>
    </dates>
  </vuln>

  <vuln vid="0792e7a7-8e37-11d8-90d1-0020ed76ef5a">
    <topic>CVS path validation errors</topic>
    <affects>
      <package>
	<name>cvs+ipv6</name>
	<range><le>1.11.5_1</le></range>
      </package>
      <system>
	<name>FreeBSD</name>
	<range><ge>5.2</ge><lt>5.2.1_5</lt></range>
	<range><ge>4.9</ge><lt>4.9_5</lt></range>
	<range><ge>4.8</ge><lt>4.8_18</lt></range>
      </system>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Two programming errors were discovered in which path names
	  handled by CVS were not properly validated.  In one case,
	  the CVS client accepts absolute path names from the server
	  when determining which files to update.  In another case,
	  the CVS server accepts relative path names from the client
	  when determining which files to transmit, including those
	  containing references to parent directories (`../').</p>
	<p>These programming errors generally only have a security
	  impact when dealing with remote CVS repositories.</p>
	<p>A malicious CVS server may cause a CVS client to overwrite
	  arbitrary files on the client's system.</p>
	<p>A CVS client may request RCS files from a remote system
	  other than those in the repository specified by $CVSROOT.
	  These RCS files need not be part of any CVS repository
	  themselves.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-0180</cvename>
      <cvename>CAN-2004-0405</cvename>
      <url>http://ccvs.cvshome.org/servlets/NewsItemView?newsID=102</url>
      <freebsdsa>SA-04:07.cvs</freebsdsa>
    </references>
    <dates>
      <discovery>2004-04-14</discovery>
      <entry>2004-04-14</entry>
      <modified>2004-05-05</modified>
    </dates>
  </vuln>

  <vuln vid="7229d900-88af-11d8-90d1-0020ed76ef5a">
    <topic>mksnap_ffs clears file system options</topic>
    <affects>
      <system>
	<name>FreeBSD</name>
	<range><ge>5.2</ge><lt>5.2_1</lt></range>
	<range><ge>5.1</ge><lt>5.1_12</lt></range>
      </system>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The kernel interface for creating a snapshot of a
	  filesystem is the same as that for changing the flags on
	  that filesystem.  Due to an oversight, the <a href="http://www.freebsd.org/cgi/man.cgi?query=mksnap_ffs">mksnap_ffs(8)</a>
	  command called that interface with only the snapshot flag
	  set, causing all other flags to be reset to the default
	  value.</p>
	<p>A regularly scheduled backup of a live filesystem, or
	  any other process that uses the mksnap_ffs command
	  (for instance, to provide a rough undelete functionality
	  on a file server), will clear any flags in effect on the
	  filesystem being snapshot.  Possible consequences depend
	  on local usage, but can include disabling extended access
	  control lists or enabling the use of setuid executables
	  stored on an untrusted filesystem.</p>
	<p>The mksnap_ffs command is normally only available to
	  the superuser and members of the `operator' group.  There
	  is therefore no risk of a user gaining elevated privileges
	  directly through use of the mksnap_ffs command unless
	  it has been intentionally made available to unprivileged
	  users.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-0099</cvename>
      <freebsdsa>SA-04:01.mksnap_ffs</freebsdsa>
    </references>
    <dates>
      <discovery>2004-01-30</discovery>
      <entry>2004-04-07</entry>
      <modified>2004-05-05</modified>
    </dates>
  </vuln>

  <vuln vid="f95a9005-88ae-11d8-90d1-0020ed76ef5a">
    <topic>shmat reference counting bug</topic>
    <affects>
      <system>
	<name>FreeBSD</name>
	<range><ge>5.2</ge><lt>5.2_2</lt></range>
	<range><ge>5.1</ge><lt>5.1_14</lt></range>
	<range><ge>5.0</ge><lt>5.0_20</lt></range>
	<range><ge>4.9</ge><lt>4.9_2</lt></range>
	<range><ge>4.8</ge><lt>4.8_15</lt></range>
	<range><lt>4.7_25</lt></range>
      </system>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A programming error in the <a href="http://www.freebsd.org/cgi/man.cgi?query=shmat">shmat(2)</a> system call can result
	  in a shared memory segment's reference count being erroneously
	  incremented.</p>
	<p>It may be possible to cause a shared memory segment to
	  reference unallocated kernel memory, but remain valid.
	  This could allow a local attacker to gain read or write
	  access to a portion of kernel memory, resulting in sensitive
	  information disclosure, bypass of access control mechanisms,
	  or privilege escalation. </p>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-0114</cvename>
      <freebsdsa>SA-04:02.shmat</freebsdsa>
      <url>http://www.pine.nl/press/pine-cert-20040201.txt</url>
    </references>
    <dates>
      <discovery>2004-02-01</discovery>
      <entry>2004-04-07</entry>
      <modified>2004-05-05</modified>
    </dates>
  </vuln>

  <vuln vid="9082a85a-88ae-11d8-90d1-0020ed76ef5a">
    <topic>jailed processes can attach to other jails</topic>
    <affects>
      <system>
	<name>FreeBSD</name>
	<range><ge>5.1</ge><lt>5.1_14</lt></range>
	<range><ge>5.2</ge><lt>5.2.1</lt></range>
      </system>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A programming error has been found in the <a href="http://www.freebsd.org/cgi/man.cgi?query=jail_attach">jail_attach(2)</a>
	  system call which affects the way that system call verifies
	  the privilege level of the calling process.  Instead of
	  failing immediately if the calling process was already
	  jailed, the jail_attach system call would fail only after
	  changing the calling process's root directory.</p>
	<p>A process with superuser privileges inside a jail could
	  change its root directory to that of a different jail,
	  and thus gain full read and write access to files and
	  directories within the target jail. </p>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-0126</cvename>
      <freebsdsa>SA-04:03.jail</freebsdsa>
    </references>
    <dates>
      <discovery>2004-02-19</discovery>
      <entry>2004-04-07</entry>
      <modified>2004-05-05</modified>
    </dates>
  </vuln>

  <vuln vid="e289f7fd-88ac-11d8-90d1-0020ed76ef5a">
    <topic>many out-of-sequence TCP packets denial-of-service</topic>
    <affects>
      <system>
	<name>FreeBSD</name>
	<range><ge>5.2</ge><lt>5.2.1_2</lt></range>
	<range><ge>5.0</ge><lt>5.1_15</lt></range>
	<range><ge>4.9</ge><lt>4.9_3</lt></range>
	<range><ge>4.8</ge><lt>4.8_16</lt></range>
	<range><lt>4.7_26</lt></range>
      </system>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>FreeBSD does not limit the number of TCP segments that
	may be held in a reassembly queue.  A remote attacker may
	conduct a low-bandwidth denial-of-service attack against
	a machine providing services based on TCP (there are many
	such services, including HTTP, SMTP, and FTP).  By sending
	many out-of-sequence TCP segments, the attacker can cause
	the target machine to consume all available memory buffers
	(``mbufs''), likely leading to a system crash. </p>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-0171</cvename>
      <freebsdsa>SA-04:04.tcp</freebsdsa>
      <url>http://www.idefense.com/application/poi/display?id=78&amp;type=vulnerabilities</url>
    </references>
    <dates>
      <discovery>2004-02-18</discovery>
      <entry>2004-04-07</entry>
      <modified>2004-05-05</modified>
    </dates>
  </vuln>

  <vuln vid="2c6acefd-8194-11d8-9645-0020ed76ef5a">
    <topic>setsockopt(2) IPv6 sockets input validation error</topic>
    <affects>
      <system>
	<name>FreeBSD</name>
	<range><ge>5.2</ge><lt>5.2.1_4</lt></range>
      </system>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>From the FreeBSD Security Advisory:</p>
	<blockquote>
	  <p>A programming error in the handling of some IPv6 socket
	    options within the <a href="http://www.freebsd.org/cgi/man.cgi?query=setsockopt">setsockopt(2)</a> system call may result
	    in memory locations being accessed without proper
	    validation.</p>
	  <p>It may be possible for a local attacker to read portions
	    of kernel memory, resulting in disclosure of sensitive
	    information.  A local attacker can cause a system
	    panic.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-0370</cvename>
      <freebsdsa>SA-04:06.ipv6</freebsdsa>
    </references>
    <dates>
      <discovery>2004-03-29</discovery>
      <entry>2004-03-29</entry>
      <modified>2004-05-05</modified>
    </dates>
  </vuln>

  <vuln vid="68233cba-7774-11d8-89ed-0020ed76ef5a">
    <topic>OpenSSL ChangeCipherSpec denial-of-service vulnerability</topic>
    <affects>
      <package>
	<name>openssl</name>
	<name>openssl-beta</name>
	<range><lt>0.9.7d</lt></range>
      </package>
      <system>
	<name>FreeBSD</name>
	<range><ge>4.0</ge><lt>4.8_17</lt></range>
	<range><ge>4.9</ge><lt>4.9_4</lt></range>
	<range><ge>5.0</ge><lt>5.1_16</lt></range>
	<range><ge>5.2</ge><lt>5.2.1_3</lt></range>
      </system>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A remote attacker could cause an application using OpenSSL to
	  crash by performing a specially crafted SSL/TLS handshake.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-0079</cvename>
      <url>http://www.openssl.org/news/secadv_20040317.txt</url>
      <freebsdsa>SA-04:05.openssl</freebsdsa>
      <certvu>288574</certvu>
      <bid>9899</bid>
    </references>
    <dates>
      <discovery>2004-03-17</discovery>
      <entry>2004-03-17</entry>
      <modified>2004-05-05</modified>
    </dates>
  </vuln>

  <vuln vid="f04cc5cb-2d0b-11d8-beaf-000a95c4d922">
    <topic>bind8 negative cache poison attack</topic>
    <affects>
      <package>
	<name>bind</name>
	<range><ge>8.3</ge><lt>8.3.7</lt></range>
	<range><ge>8.4</ge><lt>8.4.3</lt></range>
      </package>
      <system>
	<name>FreeBSD</name>
	<range><ge>5.1</ge><lt>5.1_11</lt></range>
	<range><ge>5.0</ge><lt>5.0_19</lt></range>
	<range><ge>4.9</ge><lt>4.9_1</lt></range>
	<range><ge>4.8</ge><lt>4.8_14</lt></range>
	<range><ge>4.7</ge><lt>4.7_24</lt></range>
	<range><ge>4.6</ge><lt>4.6.2_27</lt></range>
	<range><ge>4.5</ge><lt>4.5_37</lt></range>
	<range><lt>4.4_47</lt></range>
      </system>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A programming error in BIND 8 named can result in a DNS
	message being incorrectly cached as a negative response.  As
	a result, an attacker may arrange for malicious DNS messages
	to be delivered to a target name server, and cause that name
	server to cache a negative response for some target domain
	name.  The name server would thereafter respond negatively
	to legitimate queries for that domain name, resulting in a
	denial-of-service for applications that require DNS.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2003-0914</cvename>
      <freebsdsa>SA-03:19.bind</freebsdsa>
      <certvu>734644</certvu>
    </references>
    <dates>
      <discovery>2003-11-28</discovery>
      <entry>2003-12-12</entry>
      <modified>2004-05-05</modified>
    </dates>
  </vuln>

  <vuln vid="bfb36941-84fa-11d8-a41f-0020ed76ef5a">
    <topic>Incorrect cross-realm trust handling in Heimdal</topic>
    <affects>
      <package>
	<name>heimdal</name>
	<range><lt>0.6.1</lt></range>
      </package>
      <system>
	<name>FreeBSD</name>
	<range><ge>5.0</ge><lt>5.2_6</lt></range>
	<range><ge>4.9</ge><lt>4.9_6</lt></range>
	<range><ge>4.0</ge><lt>4.8_19</lt></range>
      </system>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Heimdal does not correctly validate the `transited' field of
	  Kerberos tickets when computing the authentication path.  This
	  could allow a rogue KDC with which cross-realm relationships
	  have been established to impersonate any KDC in the
	  authentication path.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-0371</cvename>
      <freebsdsa>SA-04:08.heimdal</freebsdsa>
      <url>http://www.pdc.kth.se/heimdal/advisory/2004-04-01/</url>
    </references>
    <dates>
      <discovery>2004-04-01</discovery>
      <entry>2004-04-02</entry>
      <modified>2004-05-05</modified>
    </dates>
  </vuln>

  <vuln vid="a2ffb627-9c53-11d8-9366-0020ed76ef5a">
    <topic>lha buffer overflows and path traversal issues</topic>
    <affects>
      <package>
	<name>lha</name>
	<range><lt>1.14i_4</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Ulf Härnhammar discovered several vulnerabilities in
	  LHa for UNIX's path name handling code.  Specially constructed
	  archive files may cause LHa to overwrite files or
	  execute arbitrary code with the privileges of the user
	  invoking LHa.  This could be particularly harmful for
	  automated systems that might handle archives such as
	  virus scanning processes.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-0234</cvename>
      <cvename>CAN-2004-0235</cvename>
    </references>
    <dates>
      <discovery>2004-04-29</discovery>
      <entry>2004-05-02</entry>
      <modified>2004-05-03</modified>
    </dates>
  </vuln>

  <vuln vid="8338a20f-9573-11d8-9366-0020ed76ef5a">
    <topic>xchat remotely exploitable buffer overflow (Socks5)</topic>
    <affects>
      <package>
	<name>xchat2</name>
	<range><ge>1.8</ge><lt>2.0.8_2</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A straightforward stack buffer overflow exists in XChat's
	  Socks5 proxy support.</p>
	<p>The XChat developers report that `tsifra' discovered this
	  issue.</p>
	<p>NOTE: XChat Socks5 support is disabled by support in the
	  FreeBSD Ports Collection.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-0409</cvename>
      <url>http://xchat.org/files/source/2.0/patches/xc208-fixsocks5.diff</url>
      <mlist msgid="20040405171305.04f19c44.zed@xchat.org">http://marc.theaimsgroup.com/?l=xchat-announce&amp;m=108114935507357</mlist>
    </references>
    <dates>
      <discovery>2004-04-05</discovery>
      <entry>2004-04-23</entry>
      <modified>2004-05-03</modified>
    </dates>
  </vuln>

  <vuln vid="73ea0706-9c57-11d8-9366-0020ed76ef5a">
    <topic>rsync path traversal issue</topic>
    <affects>
      <package>
	<name>rsync</name>
	<range><lt>2.6.1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>When running rsync in daemon mode, no checks were made
	  to prevent clients from writing outside of a module's
	`path' setting.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-0426</cvename>
      <url>http://rsync.samba.org/#security_apr04</url>
    </references>
    <dates>
      <discovery>2004-04-26</discovery>
      <entry>2004-05-02</entry>
    </dates>
  </vuln>

  <vuln vid="e50b04e8-9c55-11d8-9366-0020ed76ef5a">
    <topic>xine-lib arbitrary file overwrite</topic>
    <affects>
      <package>
	<name>libxine</name>
	<range><gt>0.9</gt><lt>1.0.r3_5</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>From the xinehq advisory:</p>
	<blockquote cite="http://www.xinehq.de/index.php/security/XSA-2004-1">
	  <p>By opening a malicious MRL in any xine-lib based media
	    player, an attacker can write arbitrary content to an
	    arbitrary file, only restricted by the permissions of the
	    user running the application.</p>
	</blockquote>
	<p>The flaw is a result of a feature that allows MRLs (media
	  resource locator URIs) to specify arbitrary configuration
	  options.</p>
      </body>
    </description>
    <references>
      <bid>10193</bid>
      <url>http://www.xinehq.de/index.php/security/XSA-2004-1</url>
    </references>
    <dates>
      <discovery>2004-04-20</discovery>
      <entry>2004-05-02</entry>
    </dates>
  </vuln>

  <vuln vid="fb521119-9bc4-11d8-9366-0020ed76ef5a">
    <topic>pound remotely exploitable vulnerability</topic>
    <affects>
      <package>
	<name>pound</name>
	<range><lt>1.6</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>An unknown remotely exploitable vulnerability was disclosed.
	  Robert Segall writes:</p>
	<blockquote cite="http://www.apsis.ch/pound/pound_list/archive/2003/2003-12/1070234315000">
	  <p>a security vulnerability was brought to my attention
	    (many thanks to Akira Higuchi).  Everyone running any
	    previous version should upgrade to 1.6 immediately - the
	    vulnerability may allow a remote exploit. No exploits are
	    currently known and none have been observed in the wild
	    till now. The danger is minimised if you run Pound in a
	    root jail and/or you run Pound as non-root user.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <mlist>http://www.apsis.ch/pound/pound_list/archive/2003/2003-12/1070234315000</mlist>
    </references>
    <dates>
      <discovery>2003-12-01</discovery>
      <entry>2004-05-02</entry>
    </dates>
  </vuln>

  <vuln vid="cfe17ca6-6858-4805-ba1d-a60a61ec9b4d">
    <topic>phpBB IP address spoofing</topic>
    <affects>
      <package>
	<name>phpbb</name>
	<range><le>2.0.8_2</le></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The common.php script always trusts the `X-Forwarded-For'
	header in the client's HTTP request.  A remote user could
	forge this header in order to bypass any IP address access
	control lists (ACLs).</p>
      </body>
    </description>
    <references>
      <mlist msgid="20040419000129.28917.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=108239864203144</mlist>
    </references>
    <dates>
      <discovery>2004-04-18</discovery>
      <entry>2004-04-23</entry>
    </dates>
  </vuln>

  <vuln vid="c7705712-92e6-11d8-8b29-0020ed76ef5a">
    <topic>TCP denial-of-service attacks against long lived connections</topic>
    <affects>
      <system>
	<name>FreeBSD</name>
	<range><ge>0</ge></range>
      </system>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p><a href="http://www.niscc.gov.uk/">NISCC</a> /
	  <a href="http://www.uniras.gov.uk/">UNIRAS</a> has published
	  an advisory that re-visits the long discussed spoofed TCP RST
	  denial-of-service vulnerability.  This new look emphasizes
	  the fact that for some applications such attacks are
	  practically feasible.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-0230</cvename>
      <url>http://www.uniras.gov.uk/vuls/2004/236929/index.htm</url>
    </references>
    <dates>
      <discovery>1995-06-01</discovery>
      <entry>2004-04-23</entry>
    </dates>
  </vuln>

  <vuln vid="99230277-8fb4-11d8-8b29-0020ed76ef5a">
    <topic>ident2 double byte buffer overflow</topic>
    <affects>
      <package>
	<name>ident2</name>
	<range><le>1.04</le></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Jack of RaptureSecurity reported a double byte buffer
	  overflow in ident2. The bug may allow a remote attacker to
	  execute arbitrary code within the context of the ident2
	  daemon.  The daemon typically runs as user-ID `nobody', but
	  with group-ID `wheel'.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-0408</cvename>
      <url>http://cvsweb.freebsd.org/ports/security/ident2/files/patch-common.c</url>
    </references>
    <dates>
      <discovery>2004-04-15</discovery>
      <entry>2004-04-23</entry>
    </dates>
  </vuln>

  <vuln vid="da6f265b-8f3d-11d8-8b29-0020ed76ef5a">
    <topic>kdepim exploitable buffer overflow in VCF reader</topic>
    <affects>
      <package>
	<name>kdepim</name>
	<range><ge>3.1.0</ge><lt>3.1.4_1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A buffer overflow is present in some versions of the KDE
	  personal information manager (kdepim) which may be triggered
	  when processing a specially crafted VCF file.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2003-0988</cvename>
      <url>http://www.kde.org/info/security/advisory-20040114-1.txt</url>
    </references>
    <dates>
      <discovery>2004-01-14</discovery>
      <entry>2004-04-15</entry>
    </dates>
  </vuln>

  <vuln vid="ccd698df-8e20-11d8-90d1-0020ed76ef5a">
    <topic>racoon remote denial of service vulnerability (ISAKMP header length field)</topic>
    <affects>
      <package>
	<name>racoon</name>
	<range><lt>20040408a</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>When racoon receives an ISAKMP header, it will attempt to
	  allocate sufficient memory for the entire ISAKMP message
	  according to the header's length field.  If an attacker
	  crafts an ISAKMP header with a ridiculously large value
	  in the length field, racoon may exceed operating system
	  resource limits and be terminated, resulting in a denial of
	  service.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-0403</cvename>
      <url>http://www.kame.net/dev/cvsweb2.cgi/kame/kame/kame/racoon/isakmp.c.diff?r1=1.180&amp;r2=1.181</url>
    </references>
    <dates>
      <discovery>2004-03-31</discovery>
      <entry>2004-04-14</entry>
    </dates>
  </vuln>

  <vuln vid="40fcf20f-8891-11d8-90d1-0020ed76ef5a">
    <topic>racoon remote denial of service vulnerability (IKE Generic Payload Header)</topic>
    <affects>
      <package>
	<name>racoon</name>
	<range><lt>20040407b</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>When racoon receives an IKE message with an incorrectly
	  constructed Generic Payload Header, it may behave erratically,
	  going into a tight loop and dropping connections.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-0392</cvename>
      <url>http://orange.kame.net/dev/query-pr.cgi?pr=555</url>
    </references>
    <dates>
      <discovery>2003-12-03</discovery>
      <entry>2004-04-07</entry>
      <modified>2004-04-14</modified>
    </dates>
  </vuln>

  <vuln vid="f8551668-de09-4d7b-9720-f1360929df07">
    <topic>tcpdump ISAKMP payload handling remote denial-of-service</topic>
    <affects>
      <package>
	<name>tcpdump</name>
	<range><lt>3.8.3</lt></range>
      </package>
      <package>
	<name>racoon</name>
	<range><lt>20040408a</lt></range>
      </package>
      <system>
	<name>FreeBSD</name>
	<range><ge>0</ge></range>
      </system>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Chad Loder has discovered vulnerabilities in tcpdump's
	  ISAKMP protocol handler.  During an audit to repair these
	  issues, Bill Fenner discovered some related problems.</p>
	<p>These vulnerabilities may be used by an attacker to crash a
	  running `tcpdump' process.  They can only be triggered if
	  the `-v' command line option is being used.</p>
	<p>NOTE: the racoon ISAKMP/IKE daemon incorporates the ISAKMP
	  protocol handler from tcpdump, and so is also affected by
	  this issue.</p>
      </body>
    </description>
    <references>
      <mlist>http://marc.theaimsgroup.com/?l=bugtraq&amp;m=108067265931525</mlist>
      <url>http://www.rapid7.com/advisories/R7-0017.html</url>
      <cvename>CAN-2004-0183</cvename>
      <cvename>CAN-2004-0184</cvename>
    </references>
    <dates>
      <discovery>2004-03-12</discovery>
      <entry>2004-03-31</entry>
      <modified>2004-04-14</modified>
    </dates>
  </vuln>

  <vuln vid="322d4ff6-85c3-11d8-a41f-0020ed76ef5a">
    <topic>Midnight Commander buffer overflow during symlink resolution</topic>
    <affects>
      <package>
	<name>mc</name>
	<range><lt>4.6.0_9</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Midnight Commander uses a fixed sized stack buffer while
	  resolving symbolic links within file archives (tar or cpio).
	  If an attacker can cause a user to process a specially
	  crafted file archive with Midnight Commander,
	  the attacker may be able to obtain the privileges of the
	  target user.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2003-1023</cvename>
      <mlist msgid="E1A0LbX-000NPk-00.alienhard-mail-ru@f9.mail.ru">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=106399528518704</mlist>
      <bid>8658</bid>
    </references>
    <dates>
      <discovery>2003-09-19</discovery>
      <entry>2004-04-03</entry>
      <modified>2004-04-13</modified>
    </dates>
  </vuln>

  <vuln vid="d8769838-8814-11d8-90d1-0020ed76ef5a">
    <topic>racoon fails to verify signature during Phase 1</topic>
    <affects>
      <package>
	<name>racoon</name>
	<range><lt>20040407b</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Ralf Spenneberg discovered a serious flaw in racoon.
	  When using Phase 1 main or aggressive mode, racoon does
	  not verify the client's RSA signature.  Any installations
	  using <em>X.509 authentication</em> are <strong>strongly
	  urged</strong> to upgrade.</p>
	<p>Installations using <em>pre-shared keys</em> are believed
	  to be unaffected.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-0155</cvename>
      <url>http://www.kame.net/dev/cvsweb2.cgi/kame/kame/kame/racoon/crypto_openssl.c?rev=1.84&amp;content-type=text/x-cvsweb-markup</url>
    </references>
    <dates>
      <discovery>2004-04-05</discovery>
      <entry>2004-04-07</entry>
    </dates>
  </vuln>

  <vuln vid="6fd02439-5d70-11d8-80e3-0020ed76ef5a">
    <topic>Several remotely exploitable buffer overflows in gaim</topic>
    <affects>
      <package>
	<name>gaim</name>
	<name>ja-gaim</name>
	<name>ko-gaim</name>
	<name>ru-gaim</name>
	<range><lt>0.75_3</lt></range>
	<range><eq>0.75_5</eq></range>
	<range><eq>0.76</eq></range>
      </package>
      <package>
	<name>gaim</name>
	<range><ge>20030000</ge></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Stefan Esser of e-matters found almost a dozen remotely
	  exploitable vulnerabilities in Gaim.  From the e-matters
	  advisory:</p>
	<blockquote cite="http://security.e-matters.de/advisories/012004.txt">
	  <p>While developing a custom add-on, an integer overflow
	  in the handling of AIM DirectIM packets was revealed that
	  could lead to a remote compromise of the IM client. After
	  disclosing this bug to the vendor, they had to make a
	  hurried release because of a change in the Yahoo connection
	  procedure that rendered GAIM useless. Unfourtunately at the
	  same time a closer look onto the sourcecode revealed 11 more
	  vulnerabilities.</p>

	  <p>The 12 identified problems range from simple standard
	  stack overflows, over heap overflows to an integer overflow
	  that can be abused to cause a heap overflow. Due to the
	  nature of instant messaging many of these bugs require
	  man-in-the-middle attacks between client and server. But the
	  underlying protocols are easy to implement and MIM attacks
	  on ordinary TCP sessions is a fairly simple task.</p>

	  <p>In combination with the latest kernel vulnerabilities or
	  the habit of users to work as root/administrator these bugs
	  can result in remote root compromises.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <url>http://security.e-matters.de/advisories/012004.txt</url>
      <cvename>CAN-2004-0005</cvename>
      <cvename>CAN-2004-0006</cvename>
      <cvename>CAN-2004-0007</cvename>
      <cvename>CAN-2004-0008</cvename>
    </references>
    <dates>
      <discovery>2004-01-26</discovery>
      <entry>2004-02-12</entry>
      <modified>2004-10-25</modified>
    </dates>
  </vuln>

  <vuln vid="290d81b9-80f1-11d8-9645-0020ed76ef5a">
    <topic>oftpd denial-of-service vulnerability (PORT command)</topic>
    <affects>
      <package>
	<name>oftpd</name>
	<range><lt>0.3.7</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Philippe Oechslin reported a denial-of-service vulnerability
	  in oftpd.  The oftpd server can be crashed by sending a PORT
	  command containing an integer over 8 bits long (over 255).</p>
      </body>
    </description>
    <references>
      <url>http://www.time-travellers.org/oftpd/oftpd-dos.html</url>
      <bid>9980</bid>
      <cvename>CAN-2004-0376</cvename>
    </references>
    <dates>
      <discovery>2004-03-04</discovery>
      <entry>2004-03-28</entry>
      <modified>2004-04-05</modified>
    </dates>
  </vuln>

  <vuln vid="705e003a-7f36-11d8-9645-0020ed76ef5a">
    <topic>squid ACL bypass due to URL decoding bug</topic>
    <affects>
      <package>
	<name>squid</name>
	<range><lt>squid-2.5.5</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>From the Squid advisory:</p>
	<blockquote cite="http://www.squid-cache.org/Advisories/SQUID-2004_1.txt">
	  <p>Squid versions 2.5.STABLE4 and earlier contain a bug
	  in the "%xx" URL decoding function.  It may insert a NUL
	  character into decoded URLs, which may allow users to bypass
	  url_regex ACLs.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <url>http://www.squid-cache.org/Advisories/SQUID-2004_1.txt</url>
      <cvename>CAN-2004-0189</cvename>
    </references>
    <dates>
      <discovery>2004-02-29</discovery>
      <entry>2004-03-26</entry>
      <modified>2004-03-30</modified>
    </dates>
  </vuln>

  <vuln vid="cad045c0-81a5-11d8-9645-0020ed76ef5a">
    <topic>zebra/quagga denial of service vulnerability</topic>
    <affects>
      <package>
	<name>zebra</name>
	<range><lt>0.93b_7</lt></range>
      </package>
      <package>
	<name>quagga</name>
	<range><lt>0.96.4</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A remote attacker could cause zebra/quagga to crash by
	  sending a malformed telnet command to their management
	  port.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2003-0858</cvename>
      <url>http://rhn.redhat.com/errata/RHSA-2003-305.html</url>
      <url>http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=107140</url>
      <mlist>http://lists.quagga.net/pipermail/quagga-users/2003-November/000906.html</mlist>
    </references>
    <dates>
      <discovery>2003-11-20</discovery>
      <entry>2004-03-29</entry>
    </dates>
  </vuln>

  <vuln vid="c551ae17-7f00-11d8-868e-000347dd607f">
    <topic>multiple vulnerabilities in phpBB</topic>
    <affects>
      <package>
	<name>phpbb</name>
	<range><lt>2.0.8</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Users with admin rights can severly damage an phpBB installation,
	  potentially triggered by viewing a page with a malicious link sent
	  by an attacker.</p>
      </body>
    </description>
    <references>
      <url>http://www.gulftech.org/03202004.php</url>
      <url>http://www.phpbb.com/phpBB/viewtopic.php?t=183982</url>
      <bid>9942</bid>
    </references>
    <dates>
      <discovery>2004-03-20</discovery>
      <entry>2004-03-26</entry>
      <modified>2004-03-29</modified>
    </dates>
  </vuln>

  <vuln vid="c480eb5e-7f00-11d8-868e-000347dd607f">
    <topic>ezbounce remote format string vulnerability</topic>
    <affects>
      <package>
	<name>ezbounce</name>
	<range><lt>1.04.a_1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A security hole exists that can be used to crash the proxy and
	  execute arbitrary code. An exploit is circulating that takes
	  advantage of this, and in some cases succeeds in obtaining a login
	  shell on the machine.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2003-0510</cvename>
      <url>http://ezbounce.dc-team.com/</url>
      <bid>8071</bid>
    </references>
    <dates>
      <discovery>2003-07-01</discovery>
      <entry>2004-03-26</entry>
      <modified>2004-03-29</modified>
    </dates>
  </vuln>

  <vuln vid="739bb51d-7e82-11d8-9645-0020ed76ef5a">
    <topic>racoon security association deletion vulnerability</topic>
    <affects>
      <package>
	<name>racoon</name>
	<range><lt>20040116a</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A remote attacker may use specially crafted IKE/ISAKMP
	  messages to cause racoon to delete security associations.
	  This could result in denial-of-service or possibly cause
	  sensitive traffic to be transmitted in plaintext, depending
	  upon configuration.</p>
      </body>
    </description>
    <references>
      <mlist msgid="20040113213940.GA1727@hzeroseven.org">http://www.securityfocus.com/archive/1/349756</mlist>
      <bid>9416</bid>
      <bid>9417</bid>
      <cvename>CAN-2004-0164</cvename>
    </references>
    <dates>
      <discovery>2004-01-13</discovery>
      <entry>2004-03-25</entry>
      <modified>2004-03-29</modified>
    </dates>
  </vuln>

  <vuln vid="3b7c7f6c-7102-11d8-873f-0020ed76ef5a">
    <topic>wu-ftpd ftpaccess `restricted-uid'/`restricted-gid' directive may be bypassed</topic>
    <affects>
      <package>
	<name>wu-ftpd</name>
	<range><le>2.6.2_3</le></range>
      </package>
      <package>
	<name>wu-ftpd+ipv6</name>
	<range><le>2.6.2_5</le></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Glenn Stewart reports a bug in wu-ftpd's ftpaccess
	  `restricted-uid'/`restricted-gid' directives:</p>
	<blockquote>
	  <p>Users can get around the restriction to their home
	    directory by issuing a simple chmod command on their home
	    directory. On the next ftp log in, the user will have '/'
	    as their root directory.</p>
	</blockquote>
	<p>Matt Zimmerman discovered that the cause of the bug was a
	  missing check for a restricted user within a code path that
	  is executed only when a certain error is encountered.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-0148</cvename>
      <bid>9832</bid>
    </references>
    <dates>
      <discovery>2004-02-17</discovery>
      <entry>2004-03-08</entry>
      <modified>2004-03-29</modified>
    </dates>
  </vuln>

  <vuln vid="8471bb85-6fb0-11d8-873f-0020ed76ef5a">
    <topic>GNU Anubis buffer overflows and format string vulnerabilities</topic>
    <affects>
      <package>
	<name>anubis</name>
	<range><le>3.6.2_1</le></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Ulf Härnhammar discovered several vulnerabilities in GNU
	  Anubis.</p>
	<ul>
	  <li>Unsafe uses of `sscanf'.  The `%s' format specifier is
	    used, which allows a classical buffer overflow.  (auth.c)</li>
	  <li>Format string bugs invoking `syslog'.  (log.c, errs.c,
	    ssl.c)</li>
	</ul>
	<p>Ulf notes that these vulnerabilities can be exploited by a
	  malicious IDENT server as a denial-of-service attack.</p>
      </body>
    </description>
    <references>
      <mlist>http://lists.netsys.com/pipermail/full-disclosure/2004-March/018290.html</mlist>
      <bid>9772</bid>
      <cvename>CAN-2004-0353</cvename>
      <cvename>CAN-2004-0354</cvename>
    </references>
    <dates>
      <discovery>2004-03-04</discovery>
      <entry>2004-03-06</entry>
      <modified>2004-03-29</modified>
    </dates>
  </vuln>

  <vuln vid="3837f462-5d6b-11d8-80e3-0020ed76ef5a">
    <topic>Buffer overflows in XFree86 servers</topic>
    <affects>
      <package>
	<name>XFree86-Server</name>
	<range><le>4.3.0_13</le></range>
	<range><ge>4.3.99</ge><le>4.3.99.15_1</le></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A number of buffer overflows were recently discovered in
	  XFree86, prompted by initial discoveries by iDEFENSE.  These
	  buffer overflows are present in the font alias handling.  An
	  attacker with authenticated access to a running X server may
	  exploit these vulnerabilities to obtain root privileges on
	  the machine running the X server.</p>
      </body>
    </description>
    <references>
      <url>http://www.idefense.com/application/poi/display?id=72</url>
      <url>http://www.idefense.com/application/poi/display?id=73</url>
      <cvename>CAN-2004-0083</cvename>
      <cvename>CAN-2004-0084</cvename>
      <cvename>CAN-2004-0106</cvename>
      <bid>9636</bid>
      <bid>9652</bid>
      <bid>9655</bid>
    </references>
    <dates>
      <discovery>2004-02-10</discovery>
      <entry>2004-02-12</entry>
      <modified>2004-03-29</modified>
    </dates>
  </vuln>

  <vuln vid="e25566d5-6d3f-11d8-83a4-000a95bc6fae">
    <topic>multiple buffer overflows in xboing</topic>
    <affects>
      <package>
	<name>xboing</name>
	<range><lt>2.4_2</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Steve Kemp reports (in a Debian bug submission):</p>
	<blockquote cite="http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=174924">
	  <p>Due to improper bounds checking it is possible for a
	    malicious user to gain a shell with membership group
	    'games'.  (The binary is installed setgid games).</p>
	  <p>Environmental variables are used without being bounds-checked
	    in any way, from the source code:</p>
<pre>
highscore.c:
   /* Use the environment variable if it exists */
   if ((str = getenv("XBOING_SCORE_FILE")) != NULL)
	strcpy(filename, str);
   else
	strcpy(filename, HIGH_SCORE_FILE);

misc.c:
    if ((ptr = getenv("HOME")) != NULL)
	(void) strcpy(dest, ptr);
</pre>
	<p>Neither of these checks are boundschecked, and will allow
	  arbitary shell code to be run.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-0149</cvename>
      <url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=174924</url>
      <bid>9764</bid>
    </references>
    <dates>
      <discovery>2003-01-01</discovery>
      <entry>2004-03-05</entry>
      <modified>2004-03-29</modified>
    </dates>
  </vuln>

  <vuln vid="a20082c3-6255-11d8-80e3-0020ed76ef5a">
    <topic>metamail format string bugs and buffer overflows</topic>
    <affects>
      <package>
	<name>metamail</name>
	<range><lt>2.7_2</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Ulf Härnhammar reported four bugs in metamail: two are format
	  string bugs and two are buffer overflows.  The bugs are in
	  SaveSquirrelFile(), PrintHeader(), and ShareThisHeader().</p>
	<p>These vulnerabilities could be triggered by a maliciously
	  formatted email message if `metamail' or `splitmail' is used
	  to process it, possibly resulting in arbitrary code execution
	  with the privileges of the user reading mail.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-0104</cvename>
      <cvename>CAN-2004-0105</cvename>
      <bid>9692</bid>
    </references>
    <dates>
      <discovery>2004-02-18</discovery>
      <entry>2004-02-18</entry>
      <modified>2004-03-29</modified>
    </dates>
  </vuln>

  <vuln vid="ce46b93a-80f2-11d8-9645-0020ed76ef5a">
    <topic>Buffer overflows and format string bugs in Emil</topic>
    <affects>
      <package>
	<name>emil</name>
	<range><le>2.1b9</le></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Ulf Härnhammar reports multiple buffer overflows in
	  Emil, some of which are triggered during the parsing
	  of attachment filenames.  In addition, some format string bugs
	  are present in the error reporting code.</p>
	<p>Depending upon local configuration, these vulnerabilities
	  may be exploited using specially crafted messages in order
	  to execute arbitrary code running with the privileges of
	  the user invoking Emil.</p>
      </body>
    </description>
    <references>
      <mlist>http://lists.netsys.com/pipermail/full-disclosure/2004-March/019325.html</mlist>
      <url>http://www.debian.org/security/2004/dsa-468</url>
      <cvename>CAN-2004-0152</cvename>
      <cvename>CAN-2004-0153</cvename>
    </references>
    <dates>
      <discovery>2004-03-24</discovery>
      <entry>2004-03-28</entry>
    </dates>
  </vuln>

  <vuln vid="70f5b3c6-80f0-11d8-9645-0020ed76ef5a">
    <topic>Critical SQL injection in phpBB</topic>
    <affects>
      <package>
	<name>phpbb</name>
	<range><le>2.0.8</le></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Anyone can get admin's username and password's md5 hash via a
	  single web request.
	  A working example is provided in the advisory.</p>
      </body>
    </description>
    <references>
      <mlist>http://marc.theaimsgroup.com/?l=bugtraq&amp;m=108032454818873</mlist>
      <bid>9984</bid>
    </references>
    <dates>
      <discovery>2004-03-26</discovery>
      <entry>2004-03-28</entry>
    </dates>
  </vuln>

  <vuln vid="6c7661ff-7912-11d8-9645-0020ed76ef5a">
    <topic>uudeview buffer overflows</topic>
    <affects>
      <package>
	<name>uulib</name>
	<name>uudeview</name>
	<name>xdeview</name>
	<range><lt>0.5.20</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The authors of UUDeview report repairing two buffer
	  overflows in their software.</p>
      </body>
    </description>
    <references>
      <url>http://www.fpx.de/fp/Software/UUDeview/HISTORY.txt</url>
    </references>
    <dates>
      <discovery>2004-03-01</discovery>
      <entry>2004-03-18</entry>
      <modified>2004-03-25</modified>
    </dates>
  </vuln>

  <vuln vid="09d418db-70fd-11d8-873f-0020ed76ef5a">
    <topic>Apache 1.3 IP address access control failure on some 64-bit platforms</topic>
    <affects>
      <package>
	<name>apache</name>
	<range><lt>1.3.29_2</lt></range>
      </package>
      <package>
	<name>apache+mod_ssl</name>
	<range><lt>1.3.29+2.8.16_1</lt></range>
      </package>
      <package>
	<name>apache+ssl</name>
	<range><lt>1.3.29.1.53_1</lt></range>
      </package>
      <package>
	<name>ru-apache</name>
	<range><lt>1.3.29+30.19_1</lt></range>
      </package>
      <package>
	<name>ru-apache+mod_ssl</name>
	<range><lt>1.3.29+30.19+2.8.16_1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Henning Brauer discovered a programming error in Apache
	  1.3's mod_access that results in the netmasks in IP address
	  access control rules being interpreted incorrectly on
	  64-bit, big-endian platforms.  In some cases, this could
	  cause a `deny from' IP address access control rule including
	  a netmask to fail.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2003-0993</cvename>
      <url>http://cvs.apache.org/viewcvs.cgi/apache-1.3/src/modules/standard/mod_access.c?r1=1.46&amp;r2=1.47</url>
      <url>http://www.apacheweek.com/features/security-13</url>
      <url>http://nagoya.apache.org/bugzilla/show_bug.cgi?id=23850</url>
      <mlist>http://marc.theaimsgroup.com/?l=apache-cvs&amp;m=107869603013722</mlist>
      <bid>9829</bid>
    </references>
    <dates>
      <discovery>2004-03-07</discovery>
      <entry>2004-03-08</entry>
      <modified>2004-03-12</modified>
    </dates>
  </vuln>

  <vuln vid="1a448eb7-6988-11d8-873f-0020ed76ef5a">
    <topic>mod_python denial-of-service vulnerability in parse_qs</topic>
    <affects>
      <package>
	<name>mod_python</name>
	<range><ge>2.7</ge><lt>2.7.10</lt></range>
	<range><ge>3.0</ge><lt>3.0.4</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>An attacker may cause Apache with mod_python to crash
	  by using a specially constructed query string.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2003-0973</cvename>
      <bid>9129</bid>
      <url>http://www.modpython.org/pipermail/mod_python/2003-November/014532.html</url>
      <url>http://www.modpython.org/pipermail/mod_python/2004-January/014879.html</url>
    </references>
    <dates>
      <discovery>2003-11-28</discovery>
      <entry>2004-03-03</entry>
      <modified>2004-03-11</modified>
    </dates>
  </vuln>

  <vuln vid="9fccad5a-7096-11d8-873f-0020ed76ef5a">
    <topic>mpg123 vulnerabilities</topic>
    <affects>
      <package>
	<name>mpg123</name>
	<name>mpg123-nas</name>
	<name>mpg123-esound</name>
	<range><le>0.59r_12</le></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>In 2003, two vulnerabilities were discovered in mpg123
	  that could result in remote code execution when using
	  untrusted input or streaming from an untrusted server.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2003-0577</cvename>
      <cvename>CAN-2003-0865</cvename>
      <bid>6629</bid>
      <bid>8680</bid>
    </references>
    <dates>
      <discovery>2003-01-16</discovery>
      <entry>2004-03-07</entry>
    </dates>
  </vuln>

  <vuln vid="ac4b9d18-67a9-11d8-80e3-0020ed76ef5a">
    <topic>fetchmail denial-of-service vulnerability</topic>
    <affects>
      <package>
	<name>fetchmail</name>
	<range><lt>6.2.5</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Dave Jones discovered a denial-of-service vulnerability
	  in fetchmail. An email message containing a very long line
	  could cause fetchmail to segfault due to missing NUL
	  termination in transact.c.</p>
	<p>Eric Raymond decided not to mention this issue in the
	  release notes for fetchmail 6.2.5, but it was fixed
	  there.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2003-0792</cvename>
      <bid>8843</bid>
      <url>http://xforce.iss.net/xforce/xfdb/13450</url>
      <url>http://www.openbsd.org/cgi-bin/cvsweb/ports/mail/fetchmail/patches/Attic/patch-rfc822_c?rev=1.1</url>
    </references>
    <dates>
      <discovery>2003-10-16</discovery>
      <entry>2004-02-25</entry>
      <modified>2004-03-05</modified>
    </dates>
  </vuln>

  <vuln vid="b0e76877-67a8-11d8-80e3-0020ed76ef5a">
    <topic>mailman denial-of-service vulnerability in MailCommandHandler</topic>
    <affects>
      <package>
	<name>mailman</name>
	<range><lt>2.1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A malformed message could cause mailman to crash.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2003-0991</cvename>
      <url>http://umn.dl.sourceforge.net/sourceforge/mailman/mailman-2.0.13-2.0.14-diff.txt</url>
    </references>
    <dates>
      <discovery>2003-11-18</discovery>
      <entry>2004-02-25</entry>
    </dates>
  </vuln>

  <vuln vid="3cb88bb2-67a6-11d8-80e3-0020ed76ef5a">
    <topic>mailman XSS in admin script</topic>
    <affects>
      <package>
	<name>mailman</name>
	<range><lt>2.1.4</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Dirk Mueller reports:</p>
	  <blockquote><p>I've found a cross-site scripting
	   vulnerability in the admin interface of mailman 2.1.3 that
	   allows, under certain circumstances, for anyone to retrieve
	   the (valid) session cookie.</p></blockquote>
      </body>
    </description>
    <references>
      <cvename>CAN-2003-0965</cvename>
      <url>http://mail.python.org/pipermail/mailman-announce/2003-December/000066.html</url>
      <url>http://xforce.iss.net/xforce/xfdb/14121</url>
    </references>
    <dates>
      <discovery>2003-12-31</discovery>
      <entry>2004-02-25</entry>
    </dates>
  </vuln>

  <vuln vid="429249d2-67a7-11d8-80e3-0020ed76ef5a">
    <topic>mailman XSS in create script</topic>
    <affects>
      <package>
	<name>mailman</name>
	<range><lt>2.1.3</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>From the 2.1.3 release notes:</p>
	<blockquote><p>Closed a cross-site scripting exploit in the
	create cgi script.</p></blockquote>
      </body>
    </description>
    <references>
      <cvename>CAN-2003-0992</cvename>
      <url>http://mail.python.org/pipermail/mailman-announce/2003-September/000061.html</url>
    </references>
    <dates>
      <discovery>2003-09-28</discovery>
      <entry>2004-02-25</entry>
    </dates>
  </vuln>

  <vuln vid="00263aa3-67a8-11d8-80e3-0020ed76ef5a">
    <topic>mailman XSS in user options page</topic>
    <affects>
      <package>
	<name>mailman</name>
	<range><lt>2.1.1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>From the 2.1.1 release notes:</p>
	<blockquote><p>Closed a cross-site scripting vulnerability in
	the user options page.</p></blockquote>
      </body>
    </description>
    <references>
      <cvename>CAN-2003-0038</cvename>
      <url>http://mail.python.org/pipermail/mailman-announce/2003-February/000056.html</url>
    </references>
    <dates>
      <discovery>2003-02-08</discovery>
      <entry>2004-02-25</entry>
    </dates>
  </vuln>

  <vuln vid="75770425-67a2-11d8-80e3-0020ed76ef5a">
    <topic>SQL injection vulnerability in phpnuke</topic>
    <affects>
      <package>
	<name>phpnuke</name>
	<range><le>6.9</le></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Multiple researchers have discovered multiple SQL injection
	  vulnerabilities in some versions of Php-Nuke.  These
	  vulnerabilities may lead to information disclosure, compromise
	  of the Php-Nuke site, or compromise of the back-end
	  database.</p>
      </body>
    </description>
    <references>
      <url>http://security.nnov.ru/search/document.asp?docid=5748</url>
      <mlist>http://www.securityfocus.com/archive/1/348375</mlist>
      <url>http://www.security-corporation.com/advisories-027.html</url>
      <mlist>http://www.securityfocus.com/archive/1/353201</mlist>
    </references>
    <dates>
      <discovery>2003-12-12</discovery>
      <entry>2004-02-25</entry>
    </dates>
  </vuln>

  <vuln vid="ad4f6ca4-6720-11d8-9fb5-000a95bc6fae">
    <topic>lbreakout2 vulnerability in environment variable handling</topic>
    <affects>
      <package>
	<name>lbreakout2</name>
	<range><le>2.2.2_1</le></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Ulf Härnhammar discovered an exploitable vulnerability in
	  lbreakout2's environmental variable handling.  In several
	  instances, the contents of the HOME environmental variable
	  are copied to a stack or global buffer without range
	  checking.  A local attacker may use this vulnerability to
	  acquire group-ID `games' privileges.</p>
	<p>An exploit for this vulnerability has been published by
	  ``Li0n7 voila fr''.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-0158</cvename>
      <url>http://www.debian.org/security/2004/dsa-445</url>
      <mlist>http://www.securityfocus.com/archive/1/354760</mlist>
    </references>
    <dates>
      <discovery>2004-02-21</discovery>
      <entry>2004-02-25</entry>
    </dates>
  </vuln>

  <vuln vid="316e1c9b-671c-11d8-9aad-000a95bc6fae">
    <topic>hsftp format string vulnerabilities</topic>
    <affects>
      <package>
	<name>hsftp</name>
	<range><lt>1.14</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Ulf Härnhammar discovered a format string bug in hsftp's file
	  listing code may allow a malicious server to cause arbitrary
	  code execution by the client.</p>
      </body>
    </description>
    <references>
      <mlist>http://lists.debian.org/debian-security-announce/debian-security-announce-2004/msg00044.html</mlist>
    </references>
    <dates>
      <discovery>2004-02-22</discovery>
      <entry>2004-02-25</entry>
    </dates>
  </vuln>

  <vuln vid="c7cad0f0-671a-11d8-bdeb-000a95bc6fae">
    <topic>Darwin Streaming Server denial-of-service vulnerability</topic>
    <affects>
      <package>
	<name>DarwinStreamingServer</name>
	<range><le>4.1.3g</le></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>An attacker can cause an assertion to trigger by sending
	  a long User-Agent field in a request.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-0169</cvename>
      <url>http://www.idefense.com/application/poi/display?id=75</url>
    </references>
    <dates>
      <discovery>2004-02-23</discovery>
      <entry>2004-02-25</entry>
    </dates>
  </vuln>

  <vuln vid="847ade05-6717-11d8-b321-000a95bc6fae">
    <topic>libxml2 stack buffer overflow in URI parsing</topic>
    <affects>
      <package>
	<name>libxml2</name>
	<range><lt>2.6.6</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Yuuichi Teranishi reported a crash in libxml2's URI handling
	  when a long URL is supplied.  The implementation in nanohttp.c
	  and nanoftp.c uses a 4K stack buffer, and longer URLs will
	  overwrite the stack.  This could result in denial-of-service
	  or arbitrary code execution in applications using libxml2
	  to parse documents.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-0110</cvename>
      <url>http://www.xmlsoft.org/news.html</url>
      <url>http://mail.gnome.org/archives/xml/2004-February/msg00070.html</url>
    </references>
    <dates>
      <discovery>2004-02-08</discovery>
      <entry>2004-02-25</entry>
    </dates>
  </vuln>

  <vuln vid="cc0fb686-6550-11d8-80e3-0020ed76ef5a">
    <topic>file disclosure in phpMyAdmin</topic>
    <affects>
      <package>
	<name>phpMyAdmin</name>
	<range><le>2.5.4</le></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Lack of proper input validation in phpMyAdmin may allow an
	  attacker to obtain the contents of any file on the target
	  system that is readable by the web server.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-0129</cvename>
      <mlist>http://marc.theaimsgroup.com/?l=bugtraq&amp;m=107582619125932&amp;w=2</mlist>
      <url>http://cvs.sourceforge.net/viewcvs.py/phpmyadmin/phpMyAdmin/export.php#rev2.3.2.1</url>
    </references>
    <dates>
      <discovery>2004-02-17</discovery>
      <entry>2004-02-22</entry>
    </dates>
  </vuln>

  <vuln vid="87cc48fd-5fdd-11d8-80e3-0020ed76ef5a">
    <topic>mnGoSearch buffer overflow in UdmDocToTextBuf()</topic>
    <affects>
      <package>
	<name>mnogosearch</name>
	<range><ge>3.2</ge></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Jedi/Sector One &lt;j@pureftpd.org&gt; reported the following
	  on the full-disclosure list:</p>
	<blockquote>
	  <p>Every document is stored in multiple parts according to
	    its sections (description, body, etc) in databases. And
	    when the content has to be sent to the client,
	    UdmDocToTextBuf() concatenates those parts together and
	    skips metadata.</p>
	  <p>Unfortunately, that function lacks bounds checking and
	    a buffer overflow can be triggered by indexing a large
	    enough document.</p>
	  <p>'len' is fixed to 10K [in UdmDocToTextBuf] in searchd.c
	    . S-&gt;val length depends on the length of the original
	    document and on the indexer settings (the sample
	    configuration file has low limits that work around the
	    bug, though).</p>
	  <p>Exploitation should be easy, moreover textbuf points to
	  the stack.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <mlist>http://lists.netsys.com/pipermail/full-disclosure/2004-February/017366.html</mlist>
    </references>
    <dates>
      <discovery>2004-02-15</discovery>
      <entry>2004-02-15</entry>
    </dates>
  </vuln>

  <vuln vid="cacaffbc-5e64-11d8-80e3-0020ed76ef5a">
    <topic>GNU libtool insecure temporary file handling</topic>
    <affects>
      <package>
	<name>libtool</name>
	<range><ge>1.3</ge><lt>1.3.5_2</lt></range>
	<range><ge>1.4</ge><lt>1.4.3_3</lt></range>
	<range><ge>1.5</ge><lt>1.5.2</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>libtool attempts to create a temporary directory in
	  which to write scratch files needed during processing.  A
	  malicious user may create a symlink and then manipulate
	  the directory so as to write to files to which she normally
	  has no permissions.</p>
	<p>This has been reported as a ``symlink vulnerability'',
	  although I do not think that is an accurate description.</p>
	<p>This vulnerability could possibly be used on a multi-user
	  system to gain elevated privileges, e.g. root builds some
	  packages, and another user successfully exploits this
	  vulnerability to write to a system file.</p>
      </body>
    </description>
    <references>
      <mlist>http://www.geocrawler.com/mail/msg.php3?msg_id=3438808&amp;list=405</mlist>
      <mlist>http://www.securityfocus.com/archive/1/352333</mlist>
    </references>
    <dates>
      <discovery>2004-01-30</discovery>
      <entry>2004-02-13</entry>
    </dates>
  </vuln>

  <vuln vid="0e154a9c-5d7a-11d8-80e3-0020ed76ef5a">
    <topic>seti@home remotely exploitable buffer overflow</topic>
    <affects>
      <package>
	<name>setiathome</name>
	<range><lt>3.0.8</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The seti@home client contains a buffer overflow in the HTTP
	  response handler.  A malicious, spoofed seti@home server can
	  exploit this buffer overflow to cause remote code execution
	  on the client.  Exploit programs are widely available.</p>
      </body>
    </description>
    <references>
      <url>http://setiathome.berkeley.edu/version308.html</url>
      <url>http://web.archive.org/web/20030609204812/http://spoor12.edup.tudelft.nl/</url>
    </references>
    <dates>
      <discovery>2003-04-08</discovery>
      <entry>2004-02-12</entry>
    </dates>
  </vuln>

  <vuln vid="5e92e8a2-5d7b-11d8-80e3-0020ed76ef5a">
    <topic>icecast 1.x multiple vulnerabilities</topic>
    <affects>
      <package>
	<name>icecast</name>
	<range><lt>1.3.12</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>icecast 1.3.11 and earlier contained numerous security
	  vulnerabilities, the most severe allowing a remote attacker
	  to execute arbitrary code as root.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2002-0177</cvename>
      <cvename>CAN-2001-1230</cvename>
      <cvename>CAN-2001-1229</cvename>
      <cvename>CAN-2001-1083</cvename>
      <cvename>CAN-2001-0784</cvename>
      <bid>4415</bid>
      <bid>2933</bid>
    </references>
    <dates>
      <discovery>2002-04-28</discovery>
      <entry>2004-02-12</entry>
    </dates>
  </vuln>

  <vuln vid="83119e27-5d7c-11d8-80e3-0020ed76ef5a">
    <topic>nap allows arbitrary file access</topic>
    <affects>
      <package>
	<name>nap</name>
	<range><lt>1.4.5</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>According to the author:</p>
	<blockquote>
	  <p>Fixed security loophole which allowed remote
	    clients to access arbitrary files on our
	    system.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <url>http://quasar.mathstat.uottawa.ca/~selinger/nap/NEWS</url>
    </references>
    <dates>
      <discovery>2001-04-12</discovery>
      <entry>2004-02-12</entry>
    </dates>
  </vuln>

  <vuln vid="a736deab-5d7d-11d8-80e3-0020ed76ef5a">
    <topic>CCE contains exploitable buffer overflows</topic>
    <affects>
      <package>
	<name>zh-cce</name>
	<range><lt>0.40</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Chinese Console Environment contains exploitable buffer
	  overflows.</p>
      </body>
    </description>
    <references>
      <url>http://programmer.lib.sjtu.edu.cn/cce/cce.html</url>
    </references>
    <dates>
      <discovery>2000-06-22</discovery>
      <entry>2004-02-12</entry>
    </dates>
  </vuln>

  <vuln vid="49ad1bf8-5d7e-11d8-80e3-0020ed76ef5a">
    <topic>ChiTeX/ChiLaTeX unsafe set-user-id root</topic>
    <affects>
      <package>
	<name>zh-chitex</name>
	<range><gt>0</gt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Niels Heinen reports that ChiTeX installs set-user-id root
	  executables that invoked system(3) without setting up the
	  environment, trivially allowing local root compromise.</p>
      </body>
    </description>
    <references>
      <url>http://cvsweb.freebsd.org/ports/chinese/chitex/Attic/Makefile?rev=1.5&amp;content-type=text/x-cvsweb-markup</url>
    </references>
    <dates>
      <discovery>2003-04-25</discovery>
      <entry>2004-02-12</entry>
    </dates>
  </vuln>

  <vuln vid="5789a92e-5d7f-11d8-80e3-0020ed76ef5a">
    <topic>pine remotely exploitable buffer overflow in newmail.c</topic>
    <affects>
      <package>
	<name>zh-pine</name>
	<name>iw-pine</name>
	<name>pine</name>
	<name>pine4-ssl</name>
	<range><le>4.21</le></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Kris Kennaway reports a remotely exploitable buffer overflow
	  in newmail.c.  Mike Silbersack submitted the fix.</p>
      </body>
    </description>
    <references>
      <url>http://www.freebsd.org/cgi/cvsweb.cgi/ports/mail/pine4/Makefile?rev=1.43&amp;content-type=text/x-cvsweb-markup</url>
    </references>
    <dates>
      <discovery>2000-09-29</discovery>
      <entry>2004-02-12</entry>
    </dates>
  </vuln>

  <vuln vid="34134fd4-5d81-11d8-80e3-0020ed76ef5a">
    <topic>pine insecure URL handling</topic>
    <affects>
      <package>
	<name>pine</name>
	<name>zh-pine</name>
	<name>iw-pine</name>
	<range><lt>4.44</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>An attacker may send an email message containing a specially
	  constructed URL that will execute arbitrary commands when
	  viewed.</p>
      </body>
    </description>
    <references>
      <freebsdsa>SA-02:05.pine</freebsdsa>
    </references>
    <dates>
      <discovery>2002-01-04</discovery>
      <entry>2004-02-12</entry>
    </dates>
  </vuln>

  <vuln vid="5abfee2d-5d82-11d8-80e3-0020ed76ef5a">
    <topic>pine remote denial-of-service attack</topic>
    <affects>
      <package>
	<name>pine</name>
	<name>zh-pine</name>
	<name>iw-pine</name>
	<range><lt>4.50</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>An attacker may send a specially-formatted email message
	  that will cause pine to crash.</p>
      </body>
    </description>
    <references>
      <mlist>http://marc.theaimsgroup.com/?l=bugtraq&amp;m=103668430620531&amp;w=2</mlist>
      <cvename>CAN-2002-1320</cvename>
    </references>
    <dates>
      <discovery>2002-10-23</discovery>
      <entry>2004-02-12</entry>
    </dates>
  </vuln>

  <vuln vid="39bd57e6-5d83-11d8-80e3-0020ed76ef5a">
    <topic>pine remotely exploitable vulnerabilities</topic>
    <affects>
      <package>
	<name>pine</name>
	<name>zh-pine</name>
	<name>iw-pine</name>
	<range><lt>4.58</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Pine versions prior to 4.58 are affected by two
	  vulnerabilities discovered by iDEFENSE, a buffer overflow
	  in mailview.c and an integer overflow in strings.c.  Both
	  vulnerabilities can result in arbitrary code execution
	  when processing a malicious message.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2003-0720</cvename>
      <cvename>CAN-2003-0721</cvename>
      <url>http://www.idefense.com/application/poi/display?id=5</url>
    </references>
    <dates>
      <discovery>2003-09-10</discovery>
      <entry>2004-02-12</entry>
    </dates>
  </vuln>

  <vuln vid="5729b8ed-5d75-11d8-80e3-0020ed76ef5a">
    <topic>rsync buffer overflow in server mode</topic>
    <affects>
      <package>
	<name>rsync</name>
	<range><lt>2.5.7</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>When rsync is run in server mode, a buffer overflow could
	  allow a remote attacker to execute arbitrary code with the
	  privileges of the rsync server.  Anonymous rsync servers are
	  at the highest risk.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2003-0962</cvename>
      <mlist>http://lists.samba.org/archive/rsync-announce/2003/000011.html</mlist>
      <url>http://rsync.samba.org/#security</url>
    </references>
    <dates>
      <discovery>2003-12-04</discovery>
      <entry>2004-02-12</entry>
    </dates>
  </vuln>

  <vuln vid="3388eff9-5d6e-11d8-80e3-0020ed76ef5a">
    <topic>Samba 3.0.x password initialization bug</topic>
    <affects>
      <package>
	<name>samba</name>
	<range><ge>3.0,1</ge><lt>3.0.1_2,1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>From the Samba 3.0.2 release notes:</p>
	<blockquote cite="http://www.samba.org/samba/whatsnew/samba-3.0.2.html">
	  <p>Security Announcement: It has been confirmed that
	  previous versions of Samba 3.0 are susceptible to a password
	  initialization bug that could grant an attacker unauthorized
	  access to a user account created by the mksmbpasswd.sh shell
	  script.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <url>http://www.samba.org/samba/whatsnew/samba-3.0.2.html</url>
      <cvename>CAN-2004-0082</cvename>
    </references>
    <dates>
      <discovery>2004-02-09</discovery>
      <entry>2004-02-12</entry>
    </dates>
  </vuln>

  <vuln vid="67c05283-5d62-11d8-80e3-0020ed76ef5a">
    <topic>Buffer overflow in Mutt 1.4</topic>
    <affects>
      <package>
	<name>mutt</name>
	<name>ja-mutt</name>
	<range><ge>1.4</ge><lt>1.4.2</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Mutt 1.4 contains a buffer overflow that could be exploited
	  with a specially formed message, causing Mutt to crash or
	  possibly execute arbitrary code.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-0078</cvename>
      <url>http://www.mutt.org/news.html</url>
    </references>
    <dates>
      <discovery>2004-02-11</discovery>
      <entry>2004-02-12</entry>
    </dates>
  </vuln>

  <vuln vid="7557a2b1-5d63-11d8-80e3-0020ed76ef5a">
    <topic>Apache-SSL optional client certificate vulnerability</topic>
    <affects>
      <package>
	<name>apache+ssl</name>
	<range><lt>1.3.29.1.53</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>From the Apache-SSL security advisory:</p>
	<blockquote>
	  <p>If configured with SSLVerifyClient set to 1 or 3 (client
	  certificates optional) and SSLFakeBasicAuth, Apache-SSL
	  1.3.28+1.52 and all earlier versions would permit a
	  client to use real basic authentication to forge a client
	  certificate.</p>

	  <p>All the attacker needed is the "one-line DN" of a valid
	  user, as used by faked basic auth in Apache-SSL, and the
	  fixed password ("password" by default).</p>
	</blockquote>
      </body>
    </description>
    <references>
      <url>http://www.apache-ssl.org/advisory-20040206.txt</url>
    </references>
    <dates>
      <discovery>2004-02-06</discovery>
      <entry>2004-02-10</entry>
    </dates>
  </vuln>

  <vuln vid="96ba2dae-4ab0-11d8-96f2-0020ed76ef5a">
    <topic>L2TP, ISAKMP, and RADIUS parsing vulnerabilities in tcpdump</topic>
    <affects>
      <package>
	<name>tcpdump</name>
	<range><lt>3.8.1_351</lt></range>
      </package>
      <system>
	<name>FreeBSD</name>
	<range><lt>5.2.1</lt></range>
      </system>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Jonathan Heusser discovered vulnerabilities in tcpdump's
	L2TP, ISAKMP, and RADIUS protocol handlers.  These
	vulnerabilities may be used by an attacker to crash a running
	`tcpdump' process.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2003-0989</cvename>
      <cvename>CAN-2003-1029</cvename>
      <cvename>CAN-2004-0057</cvename>
      <mlist>http://www.tcpdump.org/lists/workers/2003/12/msg00083.html</mlist>
      <mlist>http://marc.theaimsgroup.com/?l=tcpdump-workers&amp;m=107325073018070&amp;w=2</mlist>
    </references>
    <dates>
      <discovery>2003-12-24</discovery>
      <entry>2004-01-19</entry>
    </dates>
  </vuln>

  <vuln vid="fd376b8b-41e1-11d8-b096-0020ed76ef5a">
    <topic>Buffer overflow in INN control message handling</topic>
    <affects>
      <package>
	<name>inn</name>
	<range><ge>2.4.*</ge><lt>2.4.1</lt></range>
      </package>
      <package>
	<name>inn-stable</name>
	<range><lt>20031022_1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A small, fixed-size stack buffer is used to construct a
	  filename based on a received control message.  This could
	  result in a stack buffer overflow.</p>
      </body>
    </description>
    <references>
      <mlist msgid="87d69v7222.fsf@windlord.stanford.edu">http://marc.theaimsgroup.com/?l=inn-workers&amp;m=107351974008605</mlist>
    </references>
    <dates>
      <discovery>2004-01-07</discovery>
      <entry>2004-01-08</entry>
      <modified>2004-10-21</modified>
    </dates>
  </vuln>

  <vuln vid="cf0fb426-3f96-11d8-b096-0020ed76ef5a">
    <topic>ProFTPD ASCII translation bug resulting in remote root compromise</topic>
    <affects>
      <package>
	<name>proftpd</name>
	<range><lt>1.2.8_1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A buffer overflow exists in the ProFTPD code that handles
	  translation of newline characters during ASCII-mode file
	  uploads.  An attacker may exploit this buffer overflow by
	  uploading a specially crafted file, resulting in code
	  execution and ultimately a remote root compromise.</p>
      </body>
    </description>
    <references>
      <url>http://xforce.iss.net/xforce/alerts/id/154</url>
      <cvename>CAN-2003-0831</cvename>
    </references>
    <dates>
      <discovery>2003-09-23</discovery>
      <entry>2004-01-05</entry>
    </dates>
  </vuln>

  <vuln vid="81313647-2d03-11d8-9355-0020ed76ef5a">
    <topic>ElGamal sign+encrypt keys created by GnuPG can be compromised</topic>
    <affects>
      <package>
	<name>gnupg</name>
	<range><ge>1.0.2</ge><lt>1.2.3_4</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Any ElGamal sign+encrypt keys created by GnuPG contain a
	  cryptographic weakness that may allow someone to obtain
	  the private key. <strong>These keys should be considered
	  unusable and should be revoked.</strong></p>
	<p>The following summary was written by Werner Koch, GnuPG
	  author:</p>
	<blockquote cite="http://lists.gnupg.org/pipermail/gnupg-devel/2003-November/020570.html">
	  <p>Phong Nguyen identified a severe bug in the way GnuPG
	    creates and uses ElGamal keys for signing.  This is
	    a significant security failure which can lead to a
	    compromise of almost all ElGamal keys used for signing.
	    Note that this is a real world vulnerability which will
	    reveal your private key within a few seconds.</p>
	  <p>...</p>
	  <p>Please <em>take immediate action and revoke your ElGamal
	    signing keys</em>.  Furthermore you should take whatever
	    measures necessary to limit the damage done for signed or
	    encrypted documents using that key.</p>
	  <p>Note that the standard keys as generated by GnuPG (DSA
	    and ElGamal encryption) as well as RSA keys are NOT
	    vulnerable.  Note also that ElGamal signing keys cannot
	    be generated without the use of a special flag to enable
	    hidden options and even then overriding a warning message
	    about this key type.  See below for details on how to
	    identify vulnerable keys.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CAN-2003-0971</cvename>
      <mlist>http://lists.gnupg.org/pipermail/gnupg-devel/2003-November/020570.html</mlist>
    </references>
    <dates>
      <discovery>2003-11-27</discovery>
      <entry>2003-12-12</entry>
    </dates>
  </vuln>

  <vuln vid="96fdbf5b-2cfd-11d8-9355-0020ed76ef5a">
    <topic>Mathopd buffer overflow</topic>
    <affects>
      <package>
	<name>mathopd</name>
	<range><lt>1.4p2</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Mathopd contains a buffer overflow in the prepare_reply()
	  function that may be remotely exploitable.</p>
      </body>
    </description>
    <references>
      <url>http://www.mail-archive.com/mathopd%40mathopd.org/msg00136.html</url>
    </references>
    <dates>
      <discovery>2003-12-04</discovery>
      <entry>2003-12-12</entry>
    </dates>
  </vuln>

  <vuln vid="d7af61c8-2cc0-11d8-9355-0020ed76ef5a">
    <topic>lftp HTML parsing vulnerability</topic>
    <affects>
      <package>
	<name>lftp</name>
	<range><le>2.6.10</le></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A buffer overflow exists in lftp which may be triggered when
	  requesting a directory listing from a malicious server over
	  HTTP.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2003-0963</cvename>
      <url>http://lftp.yar.ru/news.html#2.6.10</url>
    </references>
    <dates>
      <discovery>2003-12-11</discovery>
      <entry>2003-12-12</entry>
    </dates>
  </vuln>

  <vuln vid="ebdf65c7-2ca6-11d8-9355-0020ed76ef5a">
    <topic>qpopper format string vulnerability</topic>
    <affects>
      <package>
	<name>qpopper</name>
	<range><lt>2.53_1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>An authenticated user may trigger a format string
	  vulnerability present in qpopper's UIDL code, resulting
	  in arbitrary code execution with group ID `mail'
	  privileges.</p>
      </body>
    </description>
    <references>
      <bid>1241</bid>
      <cvename>CVE-2000-0442</cvename>
      <url>http://www.netsys.com/suse-linux-security/2000-May/att-0137/01-b0f5-Qpopper.txt</url>
    </references>
    <dates>
      <discovery>2000-05-23</discovery>
      <entry>2003-12-12</entry>
    </dates>
  </vuln>

  <vuln vid="af0296be-2455-11d8-82e5-0020ed76ef5a">
    <topic>Fetchmail address parsing vulnerability</topic>
    <affects>
      <package>
	<name>fetchmail</name>
	<range><le>6.2.0</le></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Fetchmail can be crashed by a malicious email message.</p>
      </body>
    </description>
    <references>
      <url>http://security.e-matters.de/advisories/052002.html</url>
    </references>
    <dates>
      <discovery>2003-10-25</discovery>
      <entry>2003-10-25</entry>
    </dates>
  </vuln>

  <vuln vid="2bcd2d24-24ca-11d8-82e5-0020ed76ef5a">
    <topic>Buffer overflow in pam_smb password handling</topic>
    <affects>
      <package>
	<name>pam_smb</name>
	<range><lt>1.9.9_3</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Applications utilizing pam_smb can be compromised by
	  any user who can enter a password.  In many cases,
	  this is a remote root compromise.</p>
      </body>
    </description>
    <references>
      <url>http://www.skynet.ie/~airlied/pam_smb/</url>
      <cvename>CAN-2003-0686</cvename>
    </references>
    <dates>
      <discovery>2003-10-25</discovery>
      <entry>2003-10-25</entry>
      <modified>2003-10-25</modified>
    </dates>
  </vuln>

  <vuln vid="c4b7badf-24ca-11d8-82e5-0020ed76ef5a">
    <topic>Buffer overflows in libmcrypt</topic>
    <affects>
      <package>
	<name>libmcrypt</name>
	<range><lt>2.5.6</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>libmcrypt does incomplete input validation, leading to
	  several buffer overflows.  Additionally,
	  a memory leak is present.  Both of these problems may be
	  exploited in a denial-of-service attack.</p>
      </body>
    </description>
    <references>
      <mlist>http://marc.theaimsgroup.com/?l=bugtraq&amp;m=104162752401212&amp;w=2</mlist>
      <cvename>CAN-2003-0031</cvename>
      <cvename>CAN-2003-0032</cvename>
    </references>
    <dates>
      <discovery>2003-10-25</discovery>
      <entry>2003-10-25</entry>
      <modified>2003-10-25</modified>
    </dates>
  </vuln>

  <vuln vid="6fd9a1e9-efd3-11d8-9837-000c41e2cdad">
    <cancelled/>
  </vuln>

  <vuln vid="3362f2c1-8344-11d8-a41f-0020ed76ef5a">
    <cancelled/>
  </vuln>

  <vuln vid="e3cf89f0-53da-11d9-92b7-ceadd4ac2edd">
    <topic>phpbb -- arbitrary command execution and other vulnerabilities</topic>
    <affects>
      <package>
	<name>phpbb</name>
	<range><lt>2.0.11</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The ChangeLog for phpBB 2.0.11 states:</p>
	<blockquote cite="http://www.phpbb.com/support/documents.php?mode=changelog">
	  <p>Changes since 2.0.10</p>
	  <ul>
	    <li>Fixed vulnerability in highlighting code (<strong>very
	      high severity, please update your installation as soon
	      as possible</strong>)</li>
	    <li>Fixed unsetting global vars - <strong>Matt
	      Kavanagh</strong></li>
	    <li>Fixed XSS vulnerability in username handling
	      - <strong>AnthraX101</strong></li>
	    <li>Fixed not confirmed sql injection in username handling
	      - <strong>warmth</strong></li>
	    <li>Added check for empty topic id in topic_review
	      function</li>
	    <li>Added visual confirmation mod to code base</li>
	  </ul>
	</blockquote>
	<p>Additionally, a US-CERT Technical Cyber Security Alert reports:</p>
	<blockquote
          cite="http://www.us-cert.gov/cas/techalerts/TA04-356A.html">
          <p>phpBB contains an user input validation problem with
	    regard to the parsing of the URL. An intruder can deface a
	    phpBB website, execute arbitrary commands, or gain
	    administrative privileges on a compromised bulletin
	    board.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CAN-2004-1315</cvename>
      <freebsdpr>ports/74106</freebsdpr>
      <uscertta>TA04-356A</uscertta>
      <certvu>497400</certvu>
      <url>http://www.phpbb.com/support/documents.php?mode=changelog</url>
      <mlist msgid="20041113030542.11396.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110029415208724</mlist>
      <mlist msgid="20041118123055.28647.qmail@mail.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110079436714518</mlist>
      <url>http://www.phpbb.com/phpBB/viewtopic.php?f=14&amp;t=240636</url>
    </references>
    <dates>
      <discovery>2004-11-18</discovery>
      <entry>2004-12-22</entry>
      <modified>2005-01-24</modified>
    </dates>
  </vuln>

  <vuln vid="a395397c-c7c8-11d9-9e1e-c296ac722cb3">
    <topic>squid -- possible abuse of cachemgr.cgi</topic>
    <affects>
      <package>
	<name>squid</name>
	<range><lt>2.5.10</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The squid patches page notes:</p>
	<blockquote cite="http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE9-cachemgr_conf">
	  <p>This patch adds access controls to the cachemgr.cgi script,
	    preventing it from being abused to reach other servers than
	    allowed in a local configuration file.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-1999-0710</cvename>
      <url>http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE9-cachemgr_conf</url>
      <url>http://www.squid-cache.org/bugs/show_bug.cgi?id=1094</url>
    </references>
    <dates>
      <discovery>1999-07-29</discovery>
      <entry>2005-05-19</entry>
    </dates>
  </vuln>

  <vuln vid="7e97b288-c7ca-11d9-9e1e-c296ac722cb3">
    <topic>squid -- DNS lookup spoofing vulnerability</topic>
    <affects>
      <package>
	<name>squid</name>
	<range><lt>2.5.10</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The squid patches page notes:</p>
	<blockquote cite="http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE9-dns_query">
	  <p>Malicious users may spoof DNS lookups if the DNS client UDP port
	    (random, assigned by OS as startup) is unfiltered and your network
	    is not protected from IP spoofing.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CAN-2005-1519</cvename>
      <url>http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE9-dns_reply</url>
      <url>http://secunia.com/advisories/15294</url>
    </references>
    <dates>
      <discovery>2005-05-11</discovery>
      <entry>2005-05-19</entry>
    </dates>
  </vuln>
</vuxml>