kpriv/freebsd-ports
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
freebsd-ports/security/vuxml/vuln-2006.xml
Baptiste Daroussin e14ed8232d Rework vuxml a bit to make them validable again 
modify tidy.xsl to make it generates manually the xml declaration
xsl is not able to generate a list of entity otherwise.

Remove copyright form included files, they are redudundant anyway and
in the end only the vuln.xml file is distribued with entities expanded

Rework a bit the entity declaration in order for the document to look
great after expansion (as it did before we introduced the expansion
mechanism)

All validation are now processed direcly on the flattened file.

This is based on a patch from mfechner here

Submitted by:		mfechner
Differential Revision:	https://reviews.freebsd.org/D28299
2021-01-25 17:16:21 +00:00

8745 lines
307 KiB
XML
Raw Blame History

<vuln vid="f4ff7434-9505-11db-9ddc-0011098b2f36">
<topic>plone -- user can masquerade as a group</topic>
<affects>
<package>
<name>plone</name>
<range><gt>2.5</gt><lt>2.5.1_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Plone.org reports:</p>
<blockquote cite="http://plone.org/products/plone-hotfix/releases/20061031">
<p>PlonePAS-using Plone releases (Plone 2.5 and Plone 2.5.1) has a
potential vulnerability that allows a user to masquerade as a group.
Please update your sites.</p>
</blockquote>
</body>
</description>
<references>
<bid>21460</bid>
<cvename>CVE-2006-4249</cvename>
<url>http://plone.org/products/plone-hotfix/releases/20061031</url>
</references>
<dates>
<discovery>2006-11-02</discovery>
<entry>2006-12-27</entry>
</dates>
</vuln>
<vuln vid="3f851b22-89fb-11db-a937-003048116330">
<topic>proftpd -- remote code execution vulnerabilities</topic>
<affects>
<package>
<name>proftpd</name>
<name>proftpd-mysql</name>
<range><lt>1.3.0_5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The proftpd development team reports that several
remote buffer overflows had been found in the
proftpd server.</p>
</body>
</description>
<references>
<cvename>CVE-2006-5815</cvename>
<cvename>CVE-2006-6170</cvename>
</references>
<dates>
<discovery>2006-11-10</discovery>
<entry>2006-12-21</entry>
</dates>
</vuln>
<vuln vid="11a84092-8f9f-11db-ab33-000e0c2e438a">
<topic>gzip -- multiple vulnerabilities</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>6.1</ge><lt>6.1_7</lt></range>
<range><ge>6.0</ge><lt>6.0_12</lt></range>
<range><ge>5.5</ge><lt>5.5_5</lt></range>
<range><ge>5.4</ge><lt>5.4_19</lt></range>
<range><ge>5.3</ge><lt>5.3_34</lt></range>
<range><lt>4.11_22</lt></range>
</package>
<package>
<name>gzip</name>
<range><lt>1.3.12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description</h1>
<p>Multiple programming errors have been found in gzip which
can be triggered when gzip is decompressing files. These
errors include insufficient bounds checks in buffer use, a
NULL pointer dereference, and a potential infinite loop.</p>
<h1>Impact</h1>
<p>The insufficient bounds checks in buffer use can cause gzip
to crash, and may permit the execution of arbitrary code.
The NULL pointer deference can cause gzip to crash. The
infinite loop can cause a Denial-of-Service situation where
gzip uses all available CPU time.</p>
<h1>Workaround</h1>
<p>No workaround is available.</p>
</body>
</description>
<references>
<cvename>CVE-2006-4334</cvename>
<cvename>CVE-2006-4335</cvename>
<cvename>CVE-2006-4336</cvename>
<cvename>CVE-2006-4337</cvename>
<cvename>CVE-2006-4338</cvename>
<freebsdsa>SA-06:21.gzip</freebsdsa>
</references>
<dates>
<discovery>2006-09-19</discovery>
<entry>2006-12-19</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="ef3306fc-8f9b-11db-ab33-000e0c2e438a">
<topic>bind9 -- Denial of Service in named(8)</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>6.1</ge><lt>6.1_6</lt></range>
<range><ge>6.0</ge><lt>6.0_11</lt></range>
<range><ge>5.5</ge><lt>5.5_4</lt></range>
<range><ge>5.4</ge><lt>5.4_18</lt></range>
<range><ge>5.0</ge><lt>5.3_33</lt></range>
</package>
<package>
<name>bind9</name>
<range><ge>9.0</ge><lt>9.3.2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description</h1>
<p>For a recursive DNS server, a remote attacker sending enough
recursive queries for the replies to arrive after all the
interested clients have left the recursion queue will trigger
an INSIST failure in the named(8) daemon. Also for a
recursive DNS server, an assertion failure can occur when
processing a query whose reply will contain more than one
SIG(covered) RRset.</p>
<p>For an authoritative DNS server serving a RFC 2535 DNSSEC
zone which is queried for the SIG records where there are
multiple SIG(covered) RRsets (e.g. a zone apex), named(8)
will trigger an assertion failure when it tries to construct
the response.</p>
<h1>Impact</h1>
<p>An attacker who can perform recursive lookups on a DNS server
and is able to send a sufficiently large number of recursive
queries, or is able to get the DNS server to return more than
one SIG(covered) RRsets can stop the functionality of the DNS
service.</p>
<p>An attacker querying an authoritative DNS server serving a
RFC 2535 DNSSEC zone may be able to crash the DNS server.</p>
<h1>Workaround</h1>
<p>A possible workaround is to only allow trusted clients to
perform recursive queries.</p>
</body>
</description>
<references>
<cvename>CVE-2006-4095</cvename>
<cvename>CVE-2006-4096</cvename>
<freebsdsa>SA-06:20.bind</freebsdsa>
</references>
<dates>
<discovery>2006-09-06</discovery>
<entry>2006-12-19</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="077c2dca-8f9a-11db-ab33-000e0c2e438a">
<topic>openssl -- Incorrect PKCS#1 v1.5 padding validation in crypto(3)</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>6.1</ge><lt>6.1_6</lt></range>
<range><ge>6.0</ge><lt>6.0_11</lt></range>
<range><ge>5.5</ge><lt>5.5_4</lt></range>
<range><ge>5.4</ge><lt>5.4_18</lt></range>
<range><ge>5.3</ge><lt>5.3_33</lt></range>
<range><lt>4.11_21</lt></range>
</package>
<package>
<name>openssl</name>
<range><gt>0.9.8</gt><lt>0.9.8c_9</lt></range>
<range><lt>0.9.7k_0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description</h1>
<p>When verifying a PKCS#1 v1.5 signature, OpenSSL ignores any
bytes which follow the cryptographic hash being signed. In
a valid signature there will be no such bytes.</p>
<h1>Impact</h1>
<p>OpenSSL will incorrectly report some invalid signatures as
valid. When an RSA public exponent of 3 is used, or more
generally when a small public exponent is used with a
relatively large modulus (e.g., a public exponent of 17 with
a 4096-bit modulus), an attacker can construct a signature
which OpenSSL will accept as a valid PKCS#1 v1.5 signature.</p>
<h1>Workaround</h1>
<p>No workaround is available.</p>
</body>
</description>
<references>
<cvename>CVE-2006-4339</cvename>
<freebsdsa>SA-06:19.openssl</freebsdsa>
</references>
<dates>
<discovery>2006-09-06</discovery>
<entry>2006-12-19</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="0679deeb-8eaf-11db-abc9-0003476f14d3">
<topic>sql-ledger -- multiple vulnerabilities</topic>
<affects>
<package>
<name>sql-ledger</name>
<range><lt>2.6.22</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Debian security Team reports:</p>
<blockquote cite="http://www.us.debian.org/security/2006/dsa-1239">
<p>Several remote vulnerabilities have been discovered in SQL
Ledger, a web based double-entry accounting program, which may
lead to the execution of arbitrary code. The Common
Vulnerabilities and Exposures project identifies the following
problems:</p>
<p>Chris Travers discovered that the session management can be
tricked into hijacking existing sessions.</p>
<p>Chris Travers discovered that directory traversal
vulnerabilities can be exploited to execute arbitrary Perl
code.</p>
<p>It was discovered that missing input sanitising allows
execution of arbitrary Perl code.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-4244</cvename>
<cvename>CVE-2006-4731</cvename>
<cvename>CVE-2006-5872</cvename>
<url>http://www.us.debian.org/security/2006/dsa-1239</url>
</references>
<dates>
<discovery>2006-12-17</discovery>
<entry>2006-12-18</entry>
</dates>
</vuln>
<vuln vid="5b47b70d-8ba9-11db-81d5-00123ffe8333">
<topic>dbus -- match_rule_equal() Weakness</topic>
<affects>
<package>
<name>dbus</name>
<range><lt>1.0.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/23373/">
<p>D-Bus have a weakness, which can be exploited by malicious, local
users to cause a DoS (Denial of Service).</p>
<p>An error within the "match_rule_equal()" function can be
exploited to disable the ability of other processes to receive
messages by removing their matches from D-Bus.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-6107</cvename>
<url>http://www.freedesktop.org/wiki/Software/dbus</url>
<url>https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=218055</url>
<url>http://secunia.com/advisories/23373/</url>
</references>
<dates>
<discovery>2006-12-12</discovery>
<entry>2006-12-14</entry>
</dates>
</vuln>
<vuln vid="779a2d55-8ba8-11db-81d5-00123ffe8333">
<topic>evince -- Buffer Overflow Vulnerability</topic>
<affects>
<package>
<name>evince</name>
<range><lt>0.6.1_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/23111/">
<p>A vulnerability has been discovered in Evince, which can be
exploited by malicious people to compromise a user's system.</p>
<p>The vulnerability is caused due to a boundary error within the
"get_next_text()" function in ps/ps.c. This can be exploited to
cause a buffer overflow by e.g. tricking a user into opening a
specially crafted PostScript file.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-5864</cvename>
<url>http://secunia.com/advisories/23111/</url>
</references>
<dates>
<discovery>2006-11-27</discovery>
<entry>2006-12-14</entry>
</dates>
</vuln>
<vuln vid="fefd93d8-8af5-11db-9d01-0016179b2dd5">
<topic>tdiary -- injection vulnerability</topic>
<affects>
<package>
<name>ja-tdiary</name>
<name>tdiary</name>
<range><le>2.0.3</le></range>
</package>
<package>
<name>ja-tdiary-devel</name>
<name>tdiary-devel</name>
<range><gt>2.1</gt><lt>2.1.4_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>An undisclosed eRuby injection vulnerability had been discovered in
tDiary.</p>
</body>
</description>
<references>
<url>http://sourceforge.net/forum/forum.php?forum_id=642685</url>
</references>
<dates>
<discovery>2006-12-10</discovery>
<entry>2006-12-13</entry>
<modified>2007-03-16</modified>
</dates>
</vuln>
<vuln vid="d29dc506-8aa6-11db-bd0d-00123ffe8333">
<topic>wv -- Multiple Integer Overflow Vulnerabilities</topic>
<affects>
<package>
<name>wv</name>
<range><lt>1.2.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/22595/">
<p>Some vulnerabilities have been reported in wvWare, which can be
exploited by malicious people to cause a DoS (Denial of Service)
and potentially compromise an application using the library.</p>
<p>The vulnerabilities are caused due to integer overflows within
the "wvGetLFO_records()" and "wvGetLFO_PLF()" functions. These can
be exploited to cause heap-based buffer overflows by e.g. tricking
a user to open a specially crafted Microsoft Word document with an
application using the library.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-4513</cvename>
<url>http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=433</url>
<url>http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=434</url>
<url>http://secunia.com/advisories/22595/</url>
</references>
<dates>
<discovery>2006-10-26</discovery>
<entry>2006-12-13</entry>
</dates>
</vuln>
<vuln vid="b9044cc2-8aa5-11db-bd0d-00123ffe8333">
<topic>wv2 -- Integer Overflow Vulnerability</topic>
<affects>
<package>
<name>wv2</name>
<range><lt>0.2.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/20665/">
<p>A vulnerability has been reported in wvWare wv2 Library, which
potentially can be exploited by malicious people to compromise an
application using the library.</p>
<p>The vulnerability is caused due to an integer overflow error in
"word_helper.h" when handling a Word document. This can be
exploited to cause a buffer overflow and may allow arbitrary code
execution via a specially crafted Word document.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-2197</cvename>
<url>http://secunia.com/advisories/20665/</url>
</references>
<dates>
<discovery>2006-06-12</discovery>
<entry>2006-12-13</entry>
</dates>
</vuln>
<vuln vid="e969e6cb-8911-11db-9d01-0016179b2dd5">
<topic>tnftpd -- Remote root Exploit</topic>
<affects>
<package>
<name>tnftpd</name>
<range><lt>20040810</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The tnftpd port suffer from a remote stack overrun,
which can lead to a root compromise.</p>
</body>
</description>
<references>
<cvename>CVE-2006-6652</cvename>
<url>http://lists.grok.org.uk/pipermail/full-disclosure/2006-December/051009.html</url>
</references>
<dates>
<discovery>2006-12-01</discovery>
<entry>2006-12-11</entry>
<modified>2010-05-12</modified>
</dates>
</vuln>
<vuln vid="eb5124a4-8a20-11db-b033-00123ffe8333">
<topic>clamav -- Multipart Nestings Denial of Service</topic>
<affects>
<package>
<name>clamav</name>
<range><lt>0.88.7</lt></range>
</package>
<package>
<name>clamav-devel</name>
<range><le>20061029</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/23347/">
<p>Clam AntiVirus have a vulnerability, which can be exploited by
malicious people to cause a DoS (Denial of Service).</p>
<p>The vulnerability is caused due to a stack overflow when scanning
messages with deeply nested multipart content. This can be
exploited to crash the service by sending specially crafted emails
to a vulnerable system.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-6481</cvename>
<url>http://secunia.com/advisories/23347/</url>
<url>http://www.quantenblog.net/security/virus-scanner-bypass</url>
</references>
<dates>
<discovery>2006-12-06</discovery>
<entry>2006-12-12</entry>
<modified>2013-06-19</modified>
</dates>
</vuln>
<vuln vid="1b043693-8617-11db-93b2-000e35248ad7">
<topic>libxine -- multiple buffer overflow vulnerabilities</topic>
<affects>
<package>
<name>libxine</name>
<range><lt>1.1.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The libxine development team reports that several
vulnerabilities had been found in the libxine library. The
first vulnerability is caused by improper checking of the
src/input/libreal/real.c "real_parse_sdp()" function.
A remote attacker could exploit this by tricking an user to
connect to a preparated server potentially causing a buffer
overflow. Another buffer overflow had been found in the
libmms library, potentially allowing a remote attacker to
cause a denial of service vulnerability, and possible remote
code execution through the following functions: send_command,
string_utf16, get_data and get_media_packets. Other functions
might be affected as well.</p>
</body>
</description>
<references>
<bid>18608</bid>
<bid>21435</bid>
<cvename>CVE-2006-2200</cvename>
<cvename>CVE-2006-6172</cvename>
<url>http://sourceforge.net/project/shownotes.php?release_id=468432</url>
</references>
<dates>
<discovery>2006-05-04</discovery>
<entry>2006-12-07</entry>
<modified>2006-12-09</modified>
</dates>
</vuln>
<vuln vid="4db1669c-8589-11db-ac4f-02e081235dab">
<topic>gnupg -- remotely controllable function pointer</topic>
<affects>
<package>
<name>gnupg</name>
<range><lt>1.4.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Werner Koch reports:</p>
<blockquote cite="http://lists.gnupg.org/pipermail/gnupg-announce/2006q4/000491.html">
<p>GnuPG uses data structures called filters to process
OpenPGP messages. These filters are used in a similar
way as a pipelines in the shell. For communication
between these filters context structures are used. These
are usually allocated on the stack and passed to the
filter functions. At most places the OpenPGP data stream
fed into these filters is closed before the context
structure gets deallocated. While decrypting encrypted
packets, this may not happen in all cases and the filter
may use a void contest structure filled with garbage. An
attacker may control this garbage. The filter context
includes another context used by the low-level decryption
to access the decryption algorithm. This is done using a
function pointer. By carefully crafting an OpenPGP
message, an attacker may control this function pointer and
call an arbitrary function of the process. Obviously an
exploit needs to prepared for a specific version,
compiler, libc, etc to be successful - but it is
definitely doable.</p>
<p>Fixing this is obvious: We need to allocate the context on
the heap and use a reference count to keep it valid as
long as either the controlling code or the filter code
needs it.</p>
<p>We have checked all other usages of such a stack based
filter contexts but fortunately found no other vulnerable
places. This allows to release a relatively small patch.
However, for reasons of code cleanness and easier audits
we will soon start to change all these stack based filter
contexts to heap based ones.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-6235</cvename>
<url>http://lists.gnupg.org/pipermail/gnupg-announce/2006q4/000246.html</url>
<url>http://secunia.com/advisories/23245/</url>
</references>
<dates>
<discovery>2006-12-04</discovery>
<entry>2006-12-07</entry>
<modified>2006-12-15</modified>
</dates>
</vuln>
<vuln vid="a8674c14-83d7-11db-88d5-0012f06707f0">
<topic>ruby -- cgi.rb library Denial of Service</topic>
<affects>
<package>
<name>ruby</name>
<name>ruby+pthreads</name>
<name>ruby+pthreads+oniguruma</name>
<name>ruby+oniguruma</name>
<range><ge>1.8.*,1</ge><lt>1.8.5_5,1</lt></range>
</package>
<package>
<name>ruby_static</name>
<range><ge>1.8.*,1</ge></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The official ruby site reports:</p>
<blockquote cite="http://www.ruby-lang.org/en/news/2006/12/04/another-dos-vulnerability-in-cgi-library/">
<p>Another vulnerability has been discovered in the CGI library
(cgi.rb) that ships with Ruby which could be used by a malicious
user to create a denial of service attack (DoS).</p>
<p>A specific HTTP request for any web application using cgi.rb
causes CPU consumption on the machine on which the web application
is running. Many such requests result in a denial of service.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-6303</cvename>
<url>http://www.ruby-lang.org/en/news/2006/12/04/another-dos-vulnerability-in-cgi-library/</url>
</references>
<dates>
<discovery>2006-12-04</discovery>
<entry>2006-12-04</entry>
<modified>2010-05-12</modified>
</dates>
</vuln>
<vuln vid="ed124f8c-82a2-11db-b46b-0012f06707f0">
<topic>libmusicbrainz -- multiple buffer overflow vulnerabilities</topic>
<affects>
<package>
<name>libmusicbrainz</name>
<range><lt>2.1.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SecurityFocus reports about libmusicbrainz:</p>
<blockquote cite="http://www.securityfocus.com/bid/19508/discuss">
<p>The libmusicbrainz library is prone to multiple buffer-overflow
vulnerabilities because the application fails to check the size of
the data before copying it into a finite-sized internal memory
buffer.</p>
<p>An attacker can exploit these issues to execute arbitrary code
within the context of the application or to cause a
denial-of-service condition.</p>
</blockquote>
</body>
</description>
<references>
<bid>19508</bid>
<cvename>CVE-2006-4197</cvename>
<url>http://www.securityfocus.com/bid/21185/discuss</url>
</references>
<dates>
<discovery>2006-08-17</discovery>
<entry>2006-12-02</entry>
</dates>
</vuln>
<vuln vid="666b8c9e-8212-11db-851e-0016179b2dd5">
<topic>tdiary -- cross site scripting vulnerability</topic>
<affects>
<package>
<name>ja-tdiary</name>
<name>tdiary</name>
<range><le>2.0.2</le></range>
</package>
<package>
<name>ja-tdiary-devel</name>
<name>tdiary-devel</name>
<range><gt>2.1</gt><lt>2.1.4_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>tDiary was vulnerable to an unspecified Cross-Site
Scripting vulnerability</p>
</body>
</description>
<references>
<cvename>CVE-2006-6174</cvename>
<url>http://sourceforge.net/forum/forum.php?forum_id=638868</url>
</references>
<dates>
<discovery>2006-11-26</discovery>
<entry>2006-12-02</entry>
<modified>2010-05-12</modified>
</dates>
</vuln>
<vuln vid="18e3a5be-81f9-11db-95a2-0012f06707f0">
<topic>ImageMagick -- SGI Image File heap overflow vulnerability</topic>
<affects>
<package>
<name>ImageMagick</name>
<name>ImageMagick-nox11</name>
<range><ge>6.0.0</ge><lt>6.2.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SecurityFocus reports about ImageMagick:</p>
<blockquote cite="http://www.securityfocus.com/bid/21185/info">
<p>ImageMagick is prone to a remote heap-based buffer-overflow
vulnerability because the application fails to properly
bounds-check user-supplied input before copying it to an
insufficiently sized memory buffer.</p>
<p>Exploiting this issue allows attackers to execute arbitrary
machine code in the context of applications that use the
ImageMagick library.</p>
</blockquote>
</body>
</description>
<references>
<bid>21185</bid>
<cvename>CVE-2006-5868</cvename>
<url>http://www.securityfocus.com/bid/21185/discuss</url>
</references>
<dates>
<discovery>2006-11-14</discovery>
<entry>2006-12-02</entry>
</dates>
</vuln>
<vuln vid="3dd7eb58-80ae-11db-b4ec-000854d03344">
<topic>gtar -- GNUTYPE_NAMES directory traversal vulnerability</topic>
<affects>
<package>
<name>gtar</name>
<range><lt>1.16_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Teemu Salmela reports:</p>
<blockquote cite="http://archives.neohapsis.com/archives/fulldisclosure/2006-11/0344.html">
<p>There is a tar record type, called GNUTYPE_NAMES (an
obsolete GNU extension), that allows the creation of
symbolic links pointing to arbitrary locations in the
filesystem, which makes it possible to create/overwrite
arbitrary files.</p>
</blockquote>
</body>
</description>
<references>
<bid>21235</bid>
<cvename>CVE-2006-6097</cvename>
<url>http://archives.neohapsis.com/archives/fulldisclosure/2006-11/0344.html</url>
</references>
<dates>
<discovery>2006-11-21</discovery>
<entry>2006-11-30</entry>
</dates>
</vuln>
<vuln vid="a8af7d70-8007-11db-b280-0008743bf21a">
<topic>kronolith -- arbitrary local file inclusion vulnerability</topic>
<affects>
<package>
<name>kronolith</name>
<range><lt>2.1.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>iDefense Labs reports:</p>
<blockquote cite="http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=445">
<p>Remote exploitation of a design error in Horde's Kronolith
could allow an authenticated web mail user to execute
arbitrary PHP code under the security context of the running
web server.</p>
<p>The vulnerability specifically exists due to a design error in the
way it includes certain files. Specifically, the 'lib/FBView.php'
file contains a function 'Kronolith_FreeBusy_View::factory' which
will include local files that are supplied via the 'view' HTTP GET
request parameter.</p>
</blockquote>
</body>
</description>
<references>
<url>http://lists.horde.org/archives/announce/2006/000307.html</url>
</references>
<dates>
<discovery>2006-11-29</discovery>
<entry>2006-11-30</entry>
</dates>
</vuln>
<vuln vid="34c93ae8-7e6f-11db-bf00-02e081235dab">
<topic>gnupg -- buffer overflow</topic>
<affects>
<package>
<name>gnupg</name>
<range><lt>1.4.5_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Werner Koch reports:</p>
<blockquote cite="http://lists.gnupg.org/pipermail/gnupg-announce/2006q4/000241.html">
<p>When running GnuPG interactively, special crafted
messages may be used to crash gpg or gpg2. Running gpg in
batch mode, as done by all software using gpg as a backend
(e.g. mailers), is not affected by this bug.</p>
<p>Exploiting this overflow seems to be possible.</p>
<p>gpg-agent, gpgsm, gpgv or other tools from the GnuPG
suite are not affected.</p>
</blockquote>
</body>
</description>
<references>
<url>http://lists.gnupg.org/pipermail/gnupg-announce/2006q4/000241.html</url>
</references>
<dates>
<discovery>2006-11-27</discovery>
<entry>2006-11-27</entry>
</dates>
</vuln>
<vuln vid="cca97f5f-7435-11db-91de-0008743bf21a">
<topic>proftpd -- Remote Code Execution Vulnerability</topic>
<affects>
<package>
<name>proftpd</name>
<name>proftpd-mysql</name>
<range><le>1.3.0_2</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>FrSIRT reports:</p>
<blockquote cite="http://www.frsirt.com/english/advisories/2006/4451">
<p>A vulnerability has been identified in ProFTPD, which could be
exploited by attackers to cause a denial of service or execute
arbitrary commands. This flaw is due to a buffer overflow error
in the "main.c" file where the "cmd_buf_size" size of the buffer
used to handle FTP commands sent by clients is not properly set
to the size configured via the "CommandBufferSize" directive,
which could be exploited by attackers to compromise a vulnerable
server via a specially crafted FTP command.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.frsirt.com/english/advisories/2006/4451</url>
</references>
<dates>
<discovery>2006-11-10</discovery>
<entry>2006-11-14</entry>
<modified>2006-11-15</modified>
</dates>
</vuln>
<vuln vid="5a945904-73b1-11db-91d2-0002a5c2f4ef">
<topic>unzoo -- Directory Traversal Vulnerability</topic>
<affects>
<package>
<name>unzoo</name>
<range><lt>4.4_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/12857/">
<p>Doubles has discovered a vulnerability in Unzoo, which
potentially can be exploited by malicious people to
compromise a user's system.</p>
<p>The vulnerability is caused due to an input validation error
when unpacking archives. This can be exploited via a
directory traversal attack to overwrite files outside the
directory, where the files are extracted to, if a user is
tricked into extracting a malicious archive using Unzoo.</p>
</blockquote>
</body>
</description>
<references>
<bid>11417</bid>
<url>http://secunia.com/advisories/12857/</url>
<url>http://securitytracker.com/alerts/2004/Oct/1011673.html</url>
</references>
<dates>
<discovery>2004-10-18</discovery>
<entry>2006-11-14</entry>
<modified>2006-12-15</modified>
</dates>
</vuln>
<vuln vid="6d68618a-7199-11db-a2ad-000c6ec775d9">
<topic>bugzilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>bugzilla</name>
<name>ja-bugzilla</name>
<range><gt>2.*</gt><lt>2.22.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Bugzilla Security Advisory reports:</p>
<blockquote cite="http://www.bugzilla.org/security/2.18.5/">
<ul>
<li>Sometimes the information put into the &lt;h1&gt; and
&lt;h2&gt; tags in Bugzilla was not properly escaped,
leading to a possible XSS vulnerability.</li>
<li>Bugzilla administrators were allowed to put raw,
unfiltered HTML into many fields in Bugzilla, leading to
a possible XSS vulnerability. Now, the HTML allowed in
those fields is limited.</li>
<li>attachment.cgi could leak the names of private
attachments</li>
<li>The "deadline" field was visible in the XML format of
a bug, even to users who were not a member of the
"timetrackinggroup."</li>
<li>A malicious user could pass a URL to an admin, and
make the admin delete or change something that he had
not intended to delete or change.</li>
<li>It is possible to inject arbitrary HTML into the
showdependencygraph.cgi page, allowing for a cross-site
scripting attack.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-5453</cvename>
<cvename>CVE-2006-5454</cvename>
<cvename>CVE-2006-5455</cvename>
<url>http://www.bugzilla.org/security/2.18.5/</url>
</references>
<dates>
<discovery>2006-10-15</discovery>
<entry>2006-11-11</entry>
</dates>
</vuln>
<vuln vid="92442c4b-6f4a-11db-bd28-0012f06707f0">
<topic>Imlib2 -- multiple image file processing vulnerabilities</topic>
<affects>
<package>
<name>imlib2</name>
<range><lt>20060926_1,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/22732/">
<p>Some vulnerabilities have been reported in imlib2, which can be
exploited by malicious people to cause a DoS (Denial of Service)
or potentially compromise an application using the library.</p>
<p>The vulnerabilities are caused due to unspecified errors within
the processing of JPG, ARGB, PNG, LBM, PNM, TIFF, and TGA images.
This may be exploited to execute arbitrary code by e.g. tricking a
user into opening a specially crafted image file with an
application using imlib2.</p>
</blockquote>
</body>
</description>
<references>
<bid>20903</bid>
<cvename>CVE-2006-4806</cvename>
<cvename>CVE-2006-4807</cvename>
<cvename>CVE-2006-4808</cvename>
<cvename>CVE-2006-4809</cvename>
</references>
<dates>
<discovery>2006-11-03</discovery>
<entry>2006-11-08</entry>
</dates>
</vuln>
<vuln vid="ab8dbe98-6be4-11db-ae91-0012f06707f0">
<topic>ruby -- cgi.rb library Denial of Service</topic>
<affects>
<package>
<name>ruby</name>
<name>ruby+pthreads</name>
<name>ruby+pthreads+oniguruma</name>
<name>ruby+oniguruma</name>
<range><ge>1.8.*,1</ge><lt>1.8.5_4,1</lt></range>
</package>
<package>
<name>ruby_static</name>
<range><ge>1.8.*,1</ge></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Official ruby site reports:</p>
<blockquote cite="http://www.ruby-lang.org/en/news/2006/11/03/CVE-2006-5467/">
<p>A vulnerability has been discovered in the CGI library (cgi.rb)
that ships with Ruby which could be used by a malicious user to
create a denial of service attack (DoS). The problem is triggered
by sending the library an HTTP request that uses multipart MIME
encoding and as an invalid boundary specifier that begins with
"-" instead of "--". Once triggered it will
exhaust all available memory resources effectively creating a DoS
condition.</p>
</blockquote>
</body>
</description>
<references>
<bid>20777</bid>
<cvename>CVE-2006-5467</cvename>
<url>http://rubyforge.org/pipermail/mongrel-users/2006-October/001946.html</url>
</references>
<dates>
<discovery>2006-10-25</discovery>
<entry>2006-11-04</entry>
<modified>2006-12-15</modified>
</dates>
</vuln>
<vuln vid="b318dc8c-6756-11db-83c3-000c6ec775d9">
<topic>screen -- combined UTF-8 characters vulnerability</topic>
<affects>
<package>
<name>screen</name>
<range><lt>4.0.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A vulnerability in the handling of combined UTF-8
characters in screen may allow an user-assisted attacker to
crash screen or potentially allow code execution as the user
running screen. To exploit this issue the user running
scren must in some way interact with the attacker.</p>
</body>
</description>
<references>
<bid>20727</bid>
<cvename>CVE-2006-4573</cvename>
<mlist>http://lists.gnu.org/archive/html/screen-users/2006-10/msg00028.html</mlist>
<url>https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=212056</url>
</references>
<dates>
<discovery>2006-10-23</discovery>
<entry>2006-10-29</entry>
</dates>
</vuln>
<vuln vid="a9c51caf-6603-11db-ab90-000e35fd8194">
<topic>mysql -- database suid privilege escalation</topic>
<affects>
<package>
<name>mysql-server</name>
<range><ge>5.1</ge><lt>5.1.12</lt></range>
<range><ge>5.0</ge><lt>5.0.25</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Dmitri Lenev reports a privilege escalation in
MySQL. MySQL evaluates arguments of suid routines in the
security context of the routine's definer instead of the
routine's caller, which allows remote and local
authenticated users to gain privileges through a routine
that has been made available using GRANT EXECUTE.</p>
</body>
</description>
<references>
<cvename>CVE-2006-4227</cvename>
<url>http://bugs.mysql.com/bug.php?id=18630</url>
</references>
<dates>
<discovery>2006-03-29</discovery>
<entry>2006-10-29</entry>
<modified>2006-10-30</modified>
</dates>
</vuln>
<vuln vid="a0e92718-6603-11db-ab90-000e35fd8194">
<topic>mysql -- database "case-sensitive" privilege escalation</topic>
<affects>
<package>
<name>mysql-server</name>
<range><ge>5.1</ge><lt>5.1.12</lt></range>
<range><ge>5.0</ge><lt>5.0.25</lt></range>
<range><lt>4.1.21</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Michal Prokopiuk reports a privilege escalation in MySQL.
The vulnerability causes MySQL, when run on case-sensitive
filesystems, to allow remote and local authenticated users
to create or access a database when the database name
differs only in case from a database for which they have
permissions.</p>
</body>
</description>
<references>
<bid>19559</bid>
<cvename>CVE-2006-4226</cvename>
<url>http://bugs.mysql.com/bug.php?id=17647</url>
</references>
<dates>
<discovery>2006-08-09</discovery>
<entry>2006-10-29</entry>
</dates>
</vuln>
<vuln vid="96ed277b-60e0-11db-ad2d-0016179b2dd5">
<topic>Serendipity -- XSS Vulnerabilities</topic>
<affects>
<package>
<name>serendipity</name>
<range><lt>1.0.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Serendipity Team reports:</p>
<blockquote cite="http://blog.s9y.org/archives/147-Serendipity-1.0.2-and-1.1-beta5-released.html">
<p>Serendipity failed to correctly sanitize user input on the
media manager administration page. The content of GET variables
were written into JavaScript strings. By using standard string
evasion techniques it was possible to execute arbitrary
JavaScript.</p>
<p>Additionally Serendipity dynamically created a HTML form on
the media manager administration page that contained all
variables found in the URL as hidden fields. While the variable
values were correctly escaped it was possible to break out
by specifying strange variable names.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.hardened-php.net/advisory_112006.136.htmlSerendipity</url>
<url>http://secunia.com/advisories/22501/</url>
</references>
<dates>
<discovery>2006-10-19</discovery>
<entry>2006-10-21</entry>
</dates>
</vuln>
<vuln vid="d8fbf13a-6215-11db-a59e-0211d85f11fb">
<topic>kdelibs -- integer overflow in khtml</topic>
<affects>
<package>
<name>kdelibs</name>
<name>kdelibs-nocups</name>
<range><lt>3.5.4_4</lt></range>
</package>
<package>
<name>qt</name>
<name>qt-copy</name>
<range><lt>3.3.6_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Red Hat reports:</p>
<blockquote cite="http://rhn.redhat.com/errata/RHSA-2006-0720.html">
<p>An integer overflow flaw was found in the way Qt handled pixmap
images. The KDE khtml library uses Qt in such a way that untrusted
parameters could be passed to Qt, triggering the overflow.
An attacker could for example create a malicious web page that when
viewed by a victim in the Konqueror browser would cause Konqueror
to crash or possibly execute arbitrary code with the privileges of
the victim.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-4811</cvename>
<url>http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=210742</url>
<url>http://rhn.redhat.com/errata/RHSA-2006-0720.html</url>
</references>
<dates>
<discovery>2006-10-14</discovery>
<entry>2006-10-22</entry>
</dates>
</vuln>
<vuln vid="4867ae85-608d-11db-8faf-000c6ec775d9">
<topic>opera -- URL parsing heap overflow vulnerability</topic>
<affects>
<package>
<name>opera</name>
<name>opera-devel</name>
<name>linux-opera</name>
<range><gt>9.*</gt><lt>9.02</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>iDefense Labs reports:</p>
<blockquote cite="http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=424">
<p>Remote exploitation of a heap overflow vulnerability
within version 9 of Opera Software's Opera Web browser
could allow an attacker to execute arbitrary code on the
affected host.</p>
<p>A flaw exists within Opera when parsing a tag that
contains a URL. A heap buffer with a constant size of 256
bytes is allocated to store the URL, and the tag's URL is
copied into this buffer without sufficient bounds checking
of its length.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-4819</cvename>
<url>http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=424</url>
<url>http://secunia.com/advisories/22218/</url>
<url>http://www.opera.com/support/search/supsearch.dml?index=848</url>
</references>
<dates>
<discovery>2006-10-17</discovery>
<entry>2006-10-20</entry>
</dates>
</vuln>
<vuln vid="1c0def84-5fb1-11db-b2e9-0008c79fa3d2">
<topic>asterisk -- remote heap overwrite vulnerability</topic>
<affects>
<package>
<name>asterisk</name>
<name>asterisk-bristuff</name>
<range><lt>1.2.13</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adam Boileau of Security-Assessment.com reports:</p>
<blockquote cite="http://www.security-assessment.com/files/advisories/Asterisk_remote_heap_overflow.pdf">
<p>The Asterisk Skinny channel driver for Cisco SCCP phones
(chan_skinny.so) incorrectly validates a length value in
the packet header. An integer wrap-around leads to heap
overwrite, and arbitrary remote code execution as root.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.security-assessment.com/files/advisories/Asterisk_remote_heap_overflow.pdf</url>
<mlist msgid="4536A2F2.2020902@security-assessment.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=116121567530170</mlist>
</references>
<dates>
<discovery>2006-10-17</discovery>
<entry>2006-10-20</entry>
</dates>
</vuln>
<vuln vid="b6c18956-5fa3-11db-ad2d-0016179b2dd5">
<topic>plone -- unprotected MembershipTool methods</topic>
<affects>
<package>
<name>plone</name>
<range><lt>2.1.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Plone Team reports:</p>
<blockquote cite="http://dev.plone.org/plone/ticket/5432">
<p>Plone 2.0.5, 2.1.2, and 2.5-beta1 does not restrict
access to the:</p>
<ul>
<li>changeMemberPortrait</li>
<li>deletePersonalPortrait</li>
<li>testCurrentPassword</li>
</ul>
<p>methods, which allows remote attackers to modify portraits.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-1711</cvename>
<url>http://plone.org/products/plone/releases/2.1.4</url>
<url>https://svn.plone.org/svn/plone/PloneHotfix20060410/trunk/README.txt</url>
</references>
<dates>
<discovery>2006-10-19</discovery>
<entry>2006-10-19</entry>
<modified>2006-10-20</modified>
</dates>
</vuln>
<vuln vid="19207592-5f17-11db-ae08-0008743bf21a">
<topic>drupal -- HTML attribute injection</topic>
<affects>
<package>
<name>drupal</name>
<range><lt>4.6.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Drupal Team reports:</p>
<blockquote cite="http://drupal.org/files/sa-2006-026/advisory.txt">
<p>A malicious user may entice users to visit a specially
crafted URL that may result in the redirection of Drupal
form submission to a third-party site. A user visiting the
user registration page via such a url, for example, will
submit all data, such as his/her e-mail address, but also
possible private profile data, to a third-party site.</p>
</blockquote>
</body>
</description>
<references>
<url>http://drupal.org/files/sa-2006-026/advisory.txt</url>
<url>http://drupal.org/drupal-4.7.4</url>
</references>
<dates>
<discovery>2006-10-18</discovery>
<entry>2006-10-18</entry>
</dates>
</vuln>
<vuln vid="937d5911-5f16-11db-ae08-0008743bf21a">
<topic>drupal -- cross site request forgeries</topic>
<affects>
<package>
<name>drupal</name>
<range><lt>4.6.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Drupal Team reports:</p>
<blockquote cite="http://drupal.org/files/sa-2006-025/advisory.txt">
<p>Visiting a specially crafted page, anywhere on the web, may
allow that page to post forms to a Drupal site in the
context of the visitor's session. To illustrate; suppose
one has an active user 1 session, the most powerful
administrator account for a site, to a Drupal site while
visiting a website created by an attacker. This website
will now be able to submit any form to the Drupal site with
the privileges of user 1, either by enticing the user to
submit a form or by automated means.</p>
<p>An attacker can exploit this vulnerability by changing
passwords, posting PHP code or creating new users, for
example. The attack is only limited by the privileges of
the session it executes in.</p>
</blockquote>
</body>
</description>
<references>
<url>http://drupal.org/files/sa-2006-025/advisory.txt</url>
<url>http://drupal.org/drupal-4.7.4</url>
</references>
<dates>
<discovery>2006-10-18</discovery>
<entry>2006-10-18</entry>
</dates>
</vuln>
<vuln vid="b2383758-5f15-11db-ae08-0008743bf21a">
<topic>drupal -- multiple XSS vulnerabilities</topic>
<affects>
<package>
<name>drupal</name>
<range><lt>4.6.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Drupal Team reports:</p>
<blockquote cite="http://drupal.org/files/sa-2006-024/advisory.txt">
<p>A bug in input validation and lack of output validation
allows HTML and script insertion on several pages.</p>
<p>Drupal's XML parser passes unescaped data to watchdog
under certain circumstances. A malicious user may execute
an XSS attack via a specially crafted RSS feed. This
vulnerability exists on systems that do not use PHP's
mb_string extension (to check if mb_string is being used,
navigate to admin/settings and look under "String
handling"). Disabling the aggregator module provides an
immediate workaround.</p>
<p>The aggregator module, profile module, and forum module do
not properly escape output of certain fields.</p>
<p>Note: XSS attacks may lead to administrator access if
certain conditions are met.</p>
</blockquote>
</body>
</description>
<references>
<url>http://drupal.org/files/sa-2006-024/advisory.txt</url>
<url>http://drupal.org/drupal-4.7.4</url>
</references>
<dates>
<discovery>2006-10-18</discovery>
<entry>2006-10-18</entry>
</dates>
</vuln>
<vuln vid="18a14baa-5ee5-11db-ae08-0008743bf21a">
<topic>ingo -- local arbitrary shell command execution</topic>
<affects>
<package>
<name>ingo</name>
<range><lt>1.1.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Horde team reports a vulnerability within Ingo, the
filter management suite. The vulnerability is caused due to
inadequete escaping, possibly allowing a local user to execute
arbitrary shell commands via procmail.</p>
</body>
</description>
<references>
<cvename>CVE-2006-5449</cvename>
<url>http://bugs.horde.org/ticket/?id=4513</url>
<url>http://cvs.horde.org/diff.php/ingo/docs/CHANGES?r1=1.55.2.49&amp;r2=1.55.2.59&amp;ty=h</url>
<url>http://lists.horde.org/archives/announce/2006/000296.html</url>
</references>
<dates>
<discovery>2006-10-18</discovery>
<entry>2006-10-18</entry>
<modified>2010-05-12</modified>
</dates>
</vuln>
<vuln vid="a6d9da4a-5d5e-11db-8faf-000c6ec775d9">
<topic>NVIDIA UNIX driver -- arbitrary root code execution vulnerability</topic>
<affects>
<package>
<name>nvidia-driver</name>
<range><ge>1.0.8762</ge><lt>1.0.8776</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Rapid7 reports:</p>
<blockquote cite="http://www.rapid7.com/advisories/R7-0025.jsp">
<p>The NVIDIA Binary Graphics Driver for Linux is vulnerable
to a buffer overflow that allows an attacker to run
arbitrary code as root. This bug can be exploited both
locally or remotely (via a remote X client or an X client
which visits a malicious web page). A working
proof-of-concept root exploit is included with this
advisory.</p>
<p>The NVIDIA drivers for Solaris and FreeBSD are also
likely to be vulnerable.</p>
</blockquote>
<p>Disabling Render acceleration in the "nvidia" driver, via
the "RenderAccel" X configuration option, can be used as a
workaround for this issue.</p>
</body>
</description>
<references>
<certvu>147252</certvu>
<cvename>CVE-2006-5379</cvename>
<url>http://nvidia.custhelp.com/cgi-bin/nvidia.cfg/php/enduser/std_adp.php?p_faqid=1971</url>
<url>http://secunia.com/advisories/22419/</url>
<url>http://www.rapid7.com/advisories/R7-0025.jsp</url>
</references>
<dates>
<discovery>2006-10-16</discovery>
<entry>2006-10-16</entry>
<modified>2006-10-21</modified>
</dates>
</vuln>
<vuln vid="8012a79d-5d21-11db-bb8d-00123ffe8333">
<topic>clamav -- CHM unpacker and PE rebuilding vulnerabilities</topic>
<affects>
<package>
<name>clamav</name>
<range><lt>0.88.5</lt></range>
</package>
<package>
<name>clamav-devel</name>
<range><le>20060922</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/22370/">
<p>Two vulnerabilities have been reported in Clam AntiVirus, which
potentially can be exploited by malicious people to cause a DoS
(Denial of Service) or compromise a vulnerable system.</p>
<p>1) An unspecified error in the CHM unpacker in chmunpack.c can be
exploited to cause a DoS.</p>
<p>2) An unspecified error in rebuildpe.c when rebuilding PE files
after unpacking can be exploited to cause a heap-based buffer
overflow.</p>
</blockquote>
</body>
</description>
<references>
<url>http://secunia.com/advisories/22370/</url>
<url>http://lurker.clamav.net/message/20061016.015114.dc6a8930.en.html</url>
<url>http://sourceforge.net/project/shownotes.php?release_id=455799</url>
</references>
<dates>
<discovery>2006-10-15</discovery>
<entry>2006-10-16</entry>
</dates>
</vuln>
<vuln vid="93ba13f8-5c41-11db-a5ae-00508d6a62df">
<topic>tkdiff -- temporary file symlink privilege escalation</topic>
<affects>
<package>
<name>tkdiff</name>
<range><lt>4.1.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Javier Fernández-Sanguino Peña reports a vulnerability in
tkdiff which allows local users to gain priveleges of the
user running tkdiff due to insecure temporary file creation.</p>
</body>
</description>
<references>
<url>http://www.debian.org/security/2005/dsa-927</url>
<cvename>CVE-2005-3343</cvename>
<bid>16064</bid>
<url>http://secunia.com/advisories/18083</url>
</references>
<dates>
<discovery>2005-12-20</discovery>
<entry>2006-10-15</entry>
</dates>
</vuln>
<vuln vid="2c8a84d9-5bee-11db-a5ae-00508d6a62df">
<topic>vtiger -- multiple remote file inclusion vulnerabilities</topic>
<affects>
<package>
<name>vtiger</name>
<range><lt>5.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Dedi Dwianto a.k.a the_day reports:</p>
<blockquote cite="http://www.milw0rm.com/exploits/2508">
<p>Input passed to the "$calpath" parameter in update.php is
not properly verified before being used. This can be
exploited to execute arbitrary PHP code by including files
from local or external resources.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-5289</cvename>
<bid>20435</bid>
<mlist msgid="20061009094328.15530.qmail@securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=116049557032343</mlist>
<url>http://advisories.echo.or.id/adv/adv54-theday-2006.txt</url>
</references>
<dates>
<discovery>2006-10-09</discovery>
<entry>2006-10-15</entry>
</dates>
</vuln>
<vuln vid="5c9a2769-5ade-11db-a5ae-00508d6a62df">
<topic>google-earth -- heap overflow in the KML engine</topic>
<affects>
<package>
<name>google-earth</name>
<range><lt>4.0.2414</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>JAAScois reports:</p>
<p>While processing KML/KMZ data Google Earth fails to verify
its size prior to copying it into a fixed-sized buffer.
This can be exploited as a buffer-overflow vulnerability to
cause the application to crash and/or to execute arbitrary
code.</p>
</body>
</description>
<references>
<bid>20464</bid>
<url>http://www.jaascois.com/exploits/18602024/</url>
</references>
<dates>
<discovery>2006-10-10</discovery>
<entry>2006-10-14</entry>
<modified>2007-04-13</modified>
</dates>
</vuln>
<vuln vid="72f21372-55e4-11db-a5ae-00508d6a62df">
<topic>torrentflux -- User-Agent XSS Vulnerability</topic>
<affects>
<package>
<name>torrentflux</name>
<range><ge>0</ge></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<blockquote cite="http://www.stevenroddis.com.au/2006/10/06/torrentflux-user-agent-xss-vulnerability/">
<p>Steven Roddis reports that User-Agent string is not
properly escaped when handled by torrentflux. This allows
for arbitrary code insertion.</p>
</blockquote>
</body>
</description>
<references>
<bid>20371</bid>
<cvename>CVE-2006-5227</cvename>
<url>http://www.stevenroddis.com.au/2006/10/06/torrentflux-user-agent-xss-vulnerability/</url>
<url>http://secunia.com/advisories/22293/</url>
</references>
<dates>
<discovery>2006-09-30</discovery>
<entry>2006-10-07</entry>
<modified>2006-10-15</modified>
</dates>
</vuln>
<vuln vid="fe83eb5b-55e1-11db-a5ae-00508d6a62df">
<topic>python -- buffer overrun in repr() for unicode strings</topic>
<affects>
<package>
<name>python+ipv6</name>
<range><ge>0</ge></range>
</package>
<package>
<name>python</name>
<range><lt>2.4.3_1</lt></range>
<range><gt>2.5.*</gt><lt>2.5.c2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Benjamin C. Wiley Sittler reports:</p>
<blockquote cite="https://launchpad.net/distros/ubuntu/+source/python2.4/+bug/56633">
<p>I discovered a [buffer overrun in repr() for unicode
strings]. This causes an unpatched non-debug wide
(UTF-32/UCS-4) build of python to abort.</p>
</blockquote>
<p>Ubuntu security team reports:</p>
<blockquote cite="http://www.ubuntu.com/usn/usn-359-1">
<p>If an application uses repr() on arbitrary untrusted data,
this [bug] could be exploited to execute arbitrary code
with the privileges of the python application.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-4980</cvename>
<url>https://launchpad.net/distros/ubuntu/+source/python2.4/+bug/56633</url>
<url>http://www.ubuntu.com/usn/usn-359-1</url>
<url>http://secunia.com/advisories/22276/</url>
</references>
<dates>
<discovery>2006-08-15</discovery>
<entry>2006-10-07</entry>
<modified>2006-10-08</modified>
</dates>
</vuln>
<vuln vid="e329550b-54f7-11db-a5ae-00508d6a62df">
<topic>php -- _ecalloc Integer Overflow Vulnerability</topic>
<affects>
<package>
<name>php5</name>
<range><lt>5.1.6_1</lt></range>
</package>
<package>
<name>php5-cli</name>
<name>php5-cgi</name>
<name>php5-dtc</name>
<name>php5-horde</name>
<name>php5-nms</name>
<name>mod_php5</name>
<range><ge>5</ge><lt>5.1.6_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Stefan Esser reports:</p>
<blockquote cite="http://www.hardened-php.net/advisory_092006.133.html">
<p>The PHP 5 branch of the PHP source code lacks the
protection against possible integer overflows inside
ecalloc() that is present in the PHP 4 branch and also for
several years part of our Hardening-Patch and our new
Suhosin-Patch.</p>
<p>It was discovered that such an integer overflow can be
triggered when user input is passed to the unserialize()
function. Earlier vulnerabilities in PHP's unserialize()
that were also discovered by one of our audits in December
2004 are unrelated to the newly discovered flaw, but they
have shown, that the unserialize() function is exposed to
user-input in many popular PHP applications. Examples for
applications that use the content of COOKIE variables with
unserialize() are phpBB and Serendipity.</p>
<p>The successful exploitation of this integer overflow will
result in arbitrary code execution.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-4812</cvename>
<url>http://www.hardened-php.net/advisory_092006.133.html</url>
<url>http://secunia.com/advisories/22280/</url>
</references>
<dates>
<discovery>2006-09-30</discovery>
<entry>2006-10-06</entry>
<modified>2013-04-01</modified>
</dates>
</vuln>
<vuln vid="8a5770b4-54b5-11db-a5ae-00508d6a62df">
<topic>mambo -- multiple SQL injection vulnerabilities</topic>
<affects>
<package>
<name>mambo</name>
<range><lt>4.6.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>James Bercegay reports:</p>
<blockquote cite="http://www.gulftech.org/?node=research&amp;article_id=00116-10042006">
<p>Mambo is vulnerable to an Authentication Bypass issue that
is due to an SQL Injection in the login function. The SQL
Injection is possible because the $passwd variable is only
sanitized when it is not passed as an argument to the
function.</p>
</blockquote>
<p>Omid reports:</p>
<blockquote cite="http://seclists.org/bugtraq/2006/Aug/0491.html">
<p>There are several sql injections in Mambo 4.6 RC2 &amp;
Joomla 1.0.10 (and maybe other versions):</p>
<ul>
<li>When a user edits a content, the "id" parameter is not
checked properly in /components/com_content/content.php,
which can cause 2 sql injections.</li>
<li>The "limit" parameter in the administration section is
not checked. This affects many pages of administration
section</li>
<li>In the administration section, while editing/creating a
user, the "gid" parameter is not checked properly.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<bid>19719</bid>
<bid>19734</bid>
<url>http://www.gulftech.org/?node=research&amp;article_id=00116-10042006</url>
<url>http://seclists.org/bugtraq/2006/Aug/0491.html</url>
<url>http://www.frsirt.com/english/advisories/2006/3918</url>
<url>http://mamboxchange.com/forum/forum.php?forum_id=7704</url>
<url>http://secunia.com/advisories/21644/</url>
<url>http://secunia.com/advisories/22221/</url>
</references>
<dates>
<discovery>2006-08-26</discovery>
<entry>2006-10-05</entry>
<modified>2011-06-27</modified>
</dates>
</vuln>
<vuln vid="19a92df1-548d-11db-8f1a-000a48049292">
<topic>tin -- buffer overflow vulnerabilities</topic>
<affects>
<package>
<name>tin</name>
<name>zh-tin</name>
<range><lt>1.8.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<blockquote cite="ftp://ftp.tin.org/pub/news/clients/tin/stable/CHANGES">
<p>Urs Janssen and Aleksey Salow report possible buffer
overflows in tin versions 1.8.0 and 1.8.1.</p>
</blockquote>
<blockquote cite="http://www.openpkg.org/security/advisories/OpenPKG-SA-2006.005-tin.html">
<p>OpenPKG project elaborates there is an allocation
off-by-one bug in version 1.8.0 which can lead to a buffer
overflow.</p>
</blockquote>
</body>
</description>
<references>
<url>ftp://ftp.tin.org/pub/news/clients/tin/stable/CHANGES</url>
<url>http://www.openpkg.org/security/advisories/OpenPKG-SA-2006.005-tin.html</url>
</references>
<dates>
<discovery>2006-02-15</discovery>
<entry>2006-10-05</entry>
</dates>
</vuln>
<vuln vid="ae7124ff-547c-11db-8f1a-000a48049292">
<topic>openldap -- slapd acl selfwrite Security Issue</topic>
<affects>
<package>
<name>openldap-server</name>
<name>openldap-sasl-server</name>
<range><lt>2.3.25</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Howard Chu reports:</p>
<blockquote cite="http://www.openldap.org/its/index.cgi/Software%20Bugs?id=4587">
<p>An ACL of the form 'access to dn.subtree="ou=groups,
dc=example,dc=com" attr=member by * selfwrite' is intended
to only allow users to add/delete their own DN to the
target attribute. Currently it allows any DNs to be
modified.</p>
</blockquote>
</body>
</description>
<references>
<bid>19832</bid>
<cvename>CVE-2006-4600</cvename>
<url>http://www.openldap.org/its/index.cgi/Software%20Bugs?id=4587</url>
<url>http://www.openldap.org/lists/openldap-announce/200608/msg00000.html</url>
<url>http://secunia.com/advisories/21721</url>
<url>http://securitytracker.com/alerts/2006/Sep/1016783.html</url>
</references>
<dates>
<discovery>2006-06-14</discovery>
<entry>2006-10-05</entry>
</dates>
</vuln>
<vuln vid="5a39a22e-5478-11db-8f1a-000a48049292">
<topic>mono -- "System.CodeDom.Compiler" Insecure Temporary Creation</topic>
<affects>
<package>
<name>mono</name>
<range><lt>1.1.13.8.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Sebastian Krahmer reports:</p>
<blockquote cite="http://www.ubuntu.com/usn/usn-357-1">
<p>Sebastian Krahmer of the SuSE security team discovered
that the System.CodeDom.Compiler classes used temporary
files in an insecure way. This could allow a symbolic link
attack to create or overwrite arbitrary files with the
privileges of the user invoking the program. Under some
circumstances, a local attacker could also exploit this to
inject arbitrary code into running Mono processes.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-5072</cvename>
<url>http://www.ubuntu.com/usn/usn-357-1</url>
<url>http://secunia.com/advisories/22237/</url>
</references>
<dates>
<discovery>2006-10-04</discovery>
<entry>2006-10-05</entry>
</dates>
</vuln>
<vuln vid="edabe438-542f-11db-a5ae-00508d6a62df">
<topic>php -- open_basedir Race Condition Vulnerability</topic>
<affects>
<package>
<name>php4</name>
<name>php5</name>
<range><lt>4.4.4_1</lt></range>
<range><ge>5</ge><lt>5.1.6_2</lt></range>
</package>
<package>
<name>php-suhosin</name>
<range><lt>0.9.6</lt></range>
</package>
<package>
<name>php4-cli</name>
<name>php5-cli</name>
<name>php4-cgi</name>
<name>php5-cgi</name>
<name>php4-dtc</name>
<name>php5-dtc</name>
<name>php4-horde</name>
<name>php5-horde</name>
<name>php4-nms</name>
<name>php5-nms</name>
<name>mod_php4</name>
<name>mod_php5</name>
<range><ge>4</ge><lt>4.4.4_1</lt></range>
<range><ge>5</ge><lt>5.1.6_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Stefan Esser reports:</p>
<blockquote cite="http://www.hardened-php.net/advisory_082006.132.html">
<p>PHP's open_basedir feature is meant to disallow scripts to
access files outside a set of configured base directories.
The checks for this are placed within PHP functions dealing
with files before the actual open call is performed.</p>
<p>Obviously there is a little span of time between the check
and the actual open call. During this time span the checked
path could have been altered and point to a file that is
forbidden to be accessed due to open_basedir restrictions.</p>
<p>Because the open_basedir restrictions often not call PHP
functions but 3rd party library functions to actually open
the file it is impossible to close this time span in a
general way. It would only be possible to close it when PHP
handles the actual opening on it's own.</p>
<p>While it seems hard to change the path during this little
time span it is very simple with the use of the symlink()
function combined with a little trick. PHP's symlink()
function ensures that source and target of the symlink
operation are allowed by open_basedir restrictions (and
safe_mode). However it is possible to point a symlink to
any file by the use of mkdir(), unlink() and at least two
symlinks.</p>
</blockquote>
</body>
</description>
<references>
<bid>20326</bid>
<cvename>CVE-2006-5178</cvename>
<url>http://www.hardened-php.net/advisory_082006.132.html</url>
<url>http://secunia.com/advisories/22235/</url>
</references>
<dates>
<discovery>2006-10-02</discovery>
<entry>2006-10-05</entry>
<modified>2013-04-01</modified>
</dates>
</vuln>
<vuln vid="86526ba4-53c8-11db-8f1a-000a48049292">
<topic>phpbb -- NULL byte injection vulnerability</topic>
<affects>
<package>
<name>phpbb</name>
<name>zh-phpbb-tw</name>
<range><lt>2.0.22</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/22188/">
<p>ShAnKaR has discovered a vulnerability in phpBB, which can
be exploited by malicious users to compromise a vulnerable
system.</p>
<p>Input passed to the "avatar_path" parameter in
admin/admin_board.php is not properly sanitised before
being used as a configuration variable to store avatar
images. This can be exploited to upload and execute
arbitrary PHP code by changing "avatar_path" to a file with
a trailing NULL byte.</p>
<p>Successful exploitation requires privileges to the
administration section.</p>
</blockquote>
</body>
</description>
<references>
<bid>20347</bid>
<cvename>CVE-2006-4758</cvename>
<url>http://secunia.com/advisories/22188/</url>
<url>http://xforce.iss.net/xforce/xfdb/28884</url>
<url>http://www.security.nnov.ru/Odocument221.html</url>
</references>
<dates>
<discovery>2006-09-12</discovery>
<entry>2006-10-04</entry>
<modified>2006-12-24</modified>
</dates>
</vuln>
<vuln vid="35f2679f-52d7-11db-8f1a-000a48049292">
<topic>postnuke -- admin section SQL injection</topic>
<affects>
<package>
<name>postnuke</name>
<range><lt>0.763</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ISS X-Force reports:</p>
<blockquote cite="http://xforce.iss.net/xforce/xfdb/29271">
<p>PostNuke is vulnerable to SQL injection. A remote attacker
could send specially-crafted SQL statements to the admin
section using the hits parameter, which could allow the
attacker to view, add, modify or delete information in the
back-end database.</p>
</blockquote>
</body>
</description>
<references>
<bid>20317</bid>
<cvename>CVE-2006-5121</cvename>
<url>http://xforce.iss.net/xforce/xfdb/29271</url>
<url>http://www.securityfocus.com/archive/1/archive/1/447361/100/0/threaded</url>
<url>http://secunia.com/advisories/22197/</url>
</references>
<dates>
<discovery>2006-09-29</discovery>
<entry>2006-10-03</entry>
<modified>2007-11-17</modified>
</dates>
</vuln>
<vuln vid="b975763f-5210-11db-8f1a-000a48049292">
<topic>freetype -- LWFN Files Buffer Overflow Vulnerability</topic>
<affects>
<package>
<name>freetype2</name>
<range><lt>2.1.10_5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SecurityTracker reports:</p>
<blockquote cite="http://securitytracker.com/alerts/2006/Jul/1016522.html">
<p>A vulnerability was reported in FreeType. A remote user
can cause arbitrary code to be executed on the target
user's system.</p>
<p>A remote user can create a specially crafted font file
that, when loaded by the target user's system, will trigger
an integer underflow or integer overflow and crash the
application or execute arbitrary code on the target system.</p>
<p>Chris Evans reported these vulnerabilities.</p>
<p>Impact: A remote user can create a file that, when loaded
by the target user, will execute arbitrary code on the
target user's system.</p>
</blockquote>
</body>
</description>
<references>
<bid>18034</bid>
<cvename>CVE-2006-0747</cvename>
<cvename>CVE-2006-1861</cvename>
<cvename>CVE-2006-3467</cvename>
<url>http://securitytracker.com/alerts/2006/Jul/1016522.html</url>
</references>
<dates>
<discovery>2006-07-10</discovery>
<entry>2006-10-02</entry>
</dates>
</vuln>
<vuln vid="74ff10f6-520f-11db-8f1a-000a48049292">
<topic>cscope -- Buffer Overflow Vulnerabilities</topic>
<affects>
<package>
<name>cscope</name>
<range><lt>15.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/21601">
<p>Will Drewry has reported some vulnerabilities in Cscope,
which potentially can be exploited by malicious people to
compromise a vulnerable system.</p>
<p>Various boundary errors within the parsing of file lists
or the expansion of environment variables can be exploited
to cause stack-based buffer overflows when parsing
specially crafted "cscope.lists" files or directories.</p>
<p>A boundary error within the parsing of command line
arguments can be exploited to cause a stack-based buffer
overflow when supplying an overly long "reffile" argument.</p>
<p>Successful exploitation may allow execution of arbitrary
code.</p>
</blockquote>
</body>
</description>
<references>
<bid>19686</bid>
<bid>19687</bid>
<cvename>CVE-2006-4262</cvename>
<url>http://secunia.com/advisories/21601</url>
<url>http://sourceforge.net/mailarchive/forum.php?thread_id=30266760&amp;forum_id=33500</url>
<url>http://sourceforge.net/mailarchive/forum.php?thread_id=30266761&amp;forum_id=33500</url>
</references>
<dates>
<discovery>2006-08-20</discovery>
<entry>2006-10-02</entry>
<modified>2006-10-11</modified>
</dates>
</vuln>
<vuln vid="64bf6234-520d-11db-8f1a-000a48049292">
<topic>gnutls -- RSA Signature Forgery Vulnerability</topic>
<affects>
<package>
<name>gnutls</name>
<name>gnutls-devel</name>
<range><lt>1.4.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/21937">
<p>A vulnerability has been reported in GnuTLS, which can be
exploited by malicious people to bypass certain security
restrictions.</p>
<p>The vulnerability is caused due to an error in the
verification of certain signatures. If a RSA key with
exponent 3 is used, it may be possible to forge PKCS #1
v1.5 signatures signed with that key.</p>
</blockquote>
</body>
</description>
<references>
<bid>20027</bid>
<cvename>CVE-2006-4790</cvename>
<url>http://secunia.com/advisories/21937</url>
<url>http://lists.gnupg.org/pipermail/gnutls-dev/2006-September/001205.html</url>
</references>
<dates>
<discovery>2006-09-08</discovery>
<entry>2006-10-02</entry>
</dates>
</vuln>
<vuln vid="350a5bd9-520b-11db-8f1a-000a48049292">
<topic>MT -- Search Unspecified XSS</topic>
<affects>
<package>
<name>MT</name>
<range><ge>3.3</ge><lt>3.33</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/22109">
<p>Arai has reported a vulnerability in Movable Type and
Movable Type Enterprise, which can be exploited by
malicious people to conduct cross-site scripting attacks.</p>
<p>Some unspecified input passed via the search functionality
isn't properly sanitised before being returned to the user.
This can be exploited to execute arbitrary HTML and script
code in a user's browser session in context of an affected
site.</p>
</blockquote>
</body>
</description>
<references>
<bid>20228</bid>
<cvename>CVE-2006-5080</cvename>
<url>http://secunia.com/advisories/22109</url>
<url>http://www.sixapart.com/movabletype/news/2006/09/mt_333-mte_103_updates.html</url>
</references>
<dates>
<discovery>2006-09-26</discovery>
<entry>2006-10-02</entry>
<modified>2006-10-15</modified>
</dates>
</vuln>
<vuln vid="19b17ab4-51e0-11db-a5ae-00508d6a62df">
<topic>phpmyadmin -- XSRF vulnerabilities</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<range><lt>2.9.0.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>phpMyAdmin team reports:</p>
<blockquote cite="http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-5">
<p>We received a security advisory from Stefan Esser
(sesser@hardened-php.net) and we wish to thank him for his
work.</p>
<p>It was possible to inject arbitrary SQL commands by
forcing an authenticated user to follow a crafted link.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-5116</cvename>
<cvename>CVE-2006-5117</cvename>
<url>http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-5</url>
<url>http://secunia.com/advisories/22126/</url>
<bid>20253</bid>
</references>
<dates>
<discovery>2006-09-28</discovery>
<entry>2006-10-02</entry>
<modified>2006-10-03</modified>
</dates>
</vuln>
<vuln vid="32db37a5-50c3-11db-acf3-000c6ec775d9">
<topic>openssh -- multiple vulnerabilities</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>6.1</ge><lt>6.1_10</lt></range>
<range><ge>6.0</ge><lt>6.0_15</lt></range>
<range><ge>5.5</ge><lt>5.5_8</lt></range>
<range><ge>5.4</ge><lt>5.4_22</lt></range>
<range><ge>5.0</ge><lt>5.3_37</lt></range>
<range><lt>4.11_25</lt></range>
</package>
<package>
<name>openssh</name>
<range><lt>4.4,1</lt></range>
</package>
<package>
<name>openssh-portable</name>
<range><lt>4.4.p1,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description</h1>
<p>The CRC compensation attack detector in the sshd(8) daemon,
upon receipt of duplicate blocks, uses CPU time cubic in the
number of duplicate blocks received. [CVE-2006-4924]</p>
<p>A race condition exists in a signal handler used by the
sshd(8) daemon to handle the LoginGraceTime option, which
can potentially cause some cleanup routines to be executed
multiple times. [CVE-2006-5051]</p>
<h1>Impact</h1>
<p>An attacker sending specially crafted packets to sshd(8)
can cause a Denial of Service by using 100% of CPU time
until a connection timeout occurs. Since this attack can be
performed over multiple connections simultaneously, it is
possible to cause up to MaxStartups (10 by default) sshd
processes to use all the CPU time they can obtain.
[CVE-2006-4924]</p>
<p>The OpenSSH project believe that the race condition can
lead to a Denial of Service or potentially remote code
execution, but the FreeBSD Security Team has been unable to
verify the exact impact. [CVE-2006-5051]</p>
<h1>Workaround</h1>
<p>The attack against the CRC compensation attack detector can
be avoided by disabling SSH Protocol version 1 support in
sshd_config(5).</p>
<p>There is no workaround for the second issue.</p>
</body>
</description>
<references>
<bid>20216</bid>
<cvename>CVE-2006-4924</cvename>
<cvename>CVE-2006-5051</cvename>
<freebsdsa>SA-06:22.openssh</freebsdsa>
<url>http://www.openssh.com/txt/release-4.4</url>
</references>
<dates>
<discovery>2006-09-25</discovery>
<entry>2006-09-30</entry>
</dates>
</vuln>
<vuln vid="fcba5764-506a-11db-a5ae-00508d6a62df">
<topic>dokuwiki -- multiple vulnerabilities</topic>
<affects>
<package>
<name>dokuwiki</name>
<range><lt>20060309c</lt></range>
</package>
<package>
<name>dokuwiki-devel</name>
<range><lt>20060909</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/21819/">
<p>rgod has discovered a vulnerability in DokuWiki, which can
be exploited by malicious people to compromise a vulnerable
system.</p>
<p>Input passed to the "TARGET_FN" parameter in
bin/dwpage.php is not properly sanitised before being used
to copy files. This can be exploited via directory
traversal attacks in combination with DokuWiki's file
upload feature to execute arbitrary PHP code.</p>
</blockquote>
<p>CVE Mitre reports:</p>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4674">
<p>Direct static code injection vulnerability in doku.php in
DokuWiki before 2006-03-09c allows remote attackers to
execute arbitrary PHP code via the X-FORWARDED-FOR HTTP
header, which is stored in config.php.</p>
</blockquote>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4675">
<p>Unrestricted file upload vulnerability in
lib/exe/media.php in DokuWiki before 2006-03-09c allows
remote attackers to upload executable files into the
data/media folder via unspecified vectors.</p>
</blockquote>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4679">
<p>DokuWiki before 2006-03-09c enables the debug feature by
default, which allows remote attackers to obtain sensitive
information by calling doku.php with the X-DOKUWIKI-DO HTTP
header set to "debug".</p>
</blockquote>
</body>
</description>
<references>
<bid>19911</bid>
<cvename>CVE-2006-4674</cvename>
<cvename>CVE-2006-4675</cvename>
<cvename>CVE-2006-4679</cvename>
<url>http://secunia.com/advisories/21819/</url>
<url>http://bugs.splitbrain.org/index.php?do=details&amp;id=906</url>
</references>
<dates>
<discovery>2006-09-08</discovery>
<entry>2006-09-30</entry>
<modified>2006-10-02</modified>
</dates>
</vuln>
<vuln vid="450b76ee-5068-11db-a5ae-00508d6a62df">
<topic>dokuwiki -- multiple vulnerabilities</topic>
<affects>
<package>
<name>dokuwiki</name>
<range><lt>20060309_5</lt></range>
</package>
<package>
<name>dokuwiki-devel</name>
<range><lt>20060609_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/22192/">
<p>Some vulnerabilities have been reported in DokuWiki, which
can be exploited by malicious people to cause a DoS (Denial
of Service) or potentially compromise a vulnerable system.</p>
<p>Input passed to the "w" and "h" parameters in
lib/exec/fetch.php is not properly sanitised before being
passed as resize parameters to the "convert" application.
This can be exploited to cause a DoS due to excessive CPU
and memory consumption by passing very large numbers, or to
inject arbitrary shell commands by passing specially
crafted strings to the "w" and "h" parameter.</p>
<p>Successful exploitation requires that the
"$conf[imconvert]" option is set.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-5098</cvename>
<cvename>CVE-2006-5099</cvename>
<url>http://secunia.com/advisories/22192/</url>
<url>http://secunia.com/advisories/22199/</url>
<url>http://bugs.splitbrain.org/?do=details&amp;id=924</url>
<url>http://bugs.splitbrain.org/?do=details&amp;id=926</url>
</references>
<dates>
<discovery>2006-09-26</discovery>
<entry>2006-09-30</entry>
<modified>2006-10-02</modified>
</dates>
</vuln>
<vuln vid="e4c62abd-5065-11db-a5ae-00508d6a62df">
<topic>tikiwiki -- multiple vulnerabilities</topic>
<affects>
<package>
<name>tikiwiki</name>
<range><lt>1.9.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/21536/">
<p>Thomas Pollet has discovered a vulnerability in TikiWiki,
which can be exploited by malicious people to conduct
cross-site scripting attacks.</p>
<p>Input passed to the "highlight" parameter in
tiki-searchindex.php is not properly sanitised before being
returned to the user. This can be exploited to execute
arbitrary HTML and script code in a user's browser session
in context of an affected site.</p>
</blockquote>
<blockquote cite="http://secunia.com/advisories/21733/">
<p>rgod has discovered a vulnerability in TikiWiki, which can
be exploited by malicious people to compromise a vulnerable
system.</p>
<p>The vulnerability is caused due to the "jhot.php" script
not correctly verifying uploaded files. This can e.g. be
exploited to execute arbitrary PHP code by uploading a
malicious PHP script to the "img/wiki" directory.</p>
</blockquote>
</body>
</description>
<references>
<bid>19654</bid>
<bid>19819</bid>
<cvename>CVE-2006-4299</cvename>
<cvename>CVE-2006-4602</cvename>
<url>http://secunia.com/advisories/21536/</url>
<url>http://secunia.com/advisories/21733/</url>
</references>
<dates>
<discovery>2006-08-21</discovery>
<entry>2006-09-30</entry>
</dates>
</vuln>
<vuln vid="e79876e4-5061-11db-a5ae-00508d6a62df">
<topic>punbb -- NULL byte injection vulnerability</topic>
<affects>
<package>
<name>punbb</name>
<range><lt>1.2.13</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>CVE Mitre reports:</p>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=2006-4759">
<p>PunBB 1.2.12 does not properly handle an avatar directory
pathname ending in %00, which allows remote authenticated
administrative users to upload arbitrary files and execute
code, as demonstrated by a query to admin_options.php with
an avatars_dir parameter ending in %00. NOTE: this issue
was originally disputed by the vendor, but the dispute was
withdrawn on 20060926.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-4759</cvename>
<url>http://forums.punbb.org/viewtopic.php?id=13255</url>
</references>
<dates>
<discovery>2006-09-13</discovery>
<entry>2006-09-30</entry>
</dates>
</vuln>
<vuln vid="2d9ad236-4d26-11db-b48d-00508d6a62df">
<topic>freeciv -- Denial of Service Vulnerabilities</topic>
<affects>
<package>
<name>freeciv</name>
<name>freeciv-gtk</name>
<name>freeciv-gtk2</name>
<name>freeciv-nox11</name>
<range><lt>2.0.8_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/21171/">
<p>Luigi Auriemma has reported a vulnerability in Freeciv,
which can be exploited by malicious people to cause a DoS
(Denial of Service).</p>
<p>An error in the "generic_handle_player_attribute_chunk()"
function in common/packets.c can be exploited to crash the
service via a specially crafted
PACKET_PLAYER_ATTRIBUTE_CHUNK packet sent to the server.</p>
<p>An error in the "handle_unit_orders()" function in
server/unithand.c can be exploited to crash the service
via a specially crafted packet.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-3913</cvename>
<bid>19117</bid>
<url>http://secunia.com/advisories/21171/</url>
<url>http://aluigi.altervista.org/adv/freecivx-adv.txt</url>
</references>
<dates>
<discovery>2006-07-23</discovery>
<entry>2006-09-26</entry>
</dates>
</vuln>
<vuln vid="339fbbc1-4d23-11db-b48d-00508d6a62df">
<topic>freeciv -- Packet Parsing Denial of Service Vulnerability</topic>
<affects>
<package>
<name>freeciv</name>
<name>freeciv-gtk</name>
<name>freeciv-gtk2</name>
<name>freeciv-nox11</name>
<range><lt>2.0.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/19120/">
<p>Luigi Auriemma has reported a vulnerability in Freeciv, which
can be exploited by malicious people to cause a DoS (Denial of
Service).</p>
<p>The vulnerability is caused due to an error within the
handling of the packet length in "common/packets.c". This can
be exploited to crash the Freeciv server via a specially-
crafted packet with the size set to "0xffff".</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-0047</cvename>
<bid>16975</bid>
<url>http://secunia.com/advisories/19120/</url>
<url>http://aluigi.altervista.org/adv/freecivdos-adv.txt</url>
</references>
<dates>
<discovery>2006-03-06</discovery>
<entry>2006-09-26</entry>
</dates>
</vuln>
<vuln vid="1709084d-4d21-11db-b48d-00508d6a62df">
<topic>plans -- multiple vulnerabilities</topic>
<affects>
<package>
<name>plans</name>
<range><lt>6.7.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/15854/">
<p>A vulnerability has been reported in Plans, which can be
exploited by malicious people to conduct SQL injection
attacks.</p>
<p>Input passed to the "evt_id" parameter in "plans.cgi"
isn't properly sanitised before being used in a SQL query.
This can be exploited to manipulate SQL queries by
injecting arbitrary SQL code.</p>
<p>Successful exploitation requires that SQL database
support has been enabled in "plans_config.pl" (the default
setting is flat files).</p>
</blockquote>
<blockquote cite="http://secunia.com/advisories/15167/">
<p>Some vulnerabilities have been reported in Plans, which
can be exploited by malicious people to conduct cross-site
scripting attacks or gain knowledge of sensitive
information.</p>
<p>Input passed to various unspecified parameters is not
properly sanitised before being returned to users. This
can be exploited to execute arbitrary HTML and script code
in a user's browser session in context of a vulnerable
site.</p>
<p>An unspecified error can be exploited to gain knowledge
of the MySQL password.</p>
</blockquote>
</body>
</description>
<references>
<bid>14069</bid>
<url>http://secunia.com/advisories/15167/</url>
<url>http://secunia.com/advisories/15854/</url>
<url>http://planscalendar.com/forum/viewtopic.php?t=660</url>
</references>
<dates>
<discovery>2005-04-28</discovery>
<entry>2006-09-26</entry>
<modified>2006-10-15</modified>
</dates>
</vuln>
<vuln vid="d3527663-4ccb-11db-b48d-00508d6a62df">
<topic>eyeOS -- multiple XSS security bugs</topic>
<affects>
<package>
<name>eyeOS</name>
<range><lt>0.9.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>eyeOS team reports:</p>
<blockquote cite="http://eyeos.blogspot.com/2006/09/eyeos-091-released.html">
<p>[EyeOS 0.9.1] release fixes two XSS security bugs, so we
recommend all users to upgrade to this new version in order
to have the best security. These two bugs were discovered by
Jose Carlos Norte, who is a new eyeOS developer.</p>
</blockquote>
</body>
</description>
<references>
<bid>20213</bid>
<cvename>CVE-2006-5071</cvename>
<url>http://eyeos.blogspot.com/2006/09/eyeos-091-released.html</url>
</references>
<dates>
<discovery>2006-09-25</discovery>
<entry>2006-09-25</entry>
<modified>2006-10-15</modified>
</dates>
</vuln>
<vuln vid="65a8f773-4a37-11db-a4cc-000a48049292">
<topic>zope -- restructuredText "csv_table" Information Disclosure</topic>
<affects>
<package>
<name>zope</name>
<range><ge>2.7.0</ge><lt>2.7.9_1</lt></range>
<range><ge>2.8.0</ge><lt>2.8.8_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/21947/">
<p>A vulnerability has been reported in Zope, which can be
exploited by malicious people to disclose potentially
sensitive information.</p>
<p>The vulnerability is caused due to an error in the use of
the docutils module to parse and render "restructured"
text. This can be exploited to disclose certain information
via the "csv_table" reStructuredText directive.</p>
</blockquote>
</body>
</description>
<references>
<bid>20022</bid>
<cvename>CVE-2006-4684</cvename>
<url>http://secunia.com/advisories/21947/</url>
<url>http://www.zope.org/Products/Zope/Hotfix-2006-08-21/Hotfix-20060821/README.txt</url>
</references>
<dates>
<discovery>2006-08-21</discovery>
<entry>2006-09-22</entry>
<modified>2006-12-27</modified>
</dates>
</vuln>
<vuln vid="f6bff909-4a26-11db-a4cc-000a48049292">
<topic>libmms -- stack-based buffer overflow</topic>
<affects>
<package>
<name>libmms</name>
<range><lt>0.3</lt></range>
</package>
<package>
<name>libxine</name>
<range><lt>1.1.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mitre CVE reports:</p>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2200">
<p>Stack-based buffer overflow in libmms, as used by (a)
MiMMS 0.0.9 and (b) xine-lib 1.1.0 and earlier, allows
remote attackers to cause a denial of service (application
crash) and possibly execute arbitrary code via the (1)
send_command, (2) string_utf16, (3) get_data, and (4)
get_media_packet functions, and possibly other functions.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-2200</cvename>
<bid>18608</bid>
<url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=374577</url>
</references>
<dates>
<discovery>2006-05-04</discovery>
<entry>2006-09-22</entry>
</dates>
</vuln>
<vuln vid="1fe734bf-4a06-11db-b48d-00508d6a62df">
<topic>opera -- RSA Signature Forgery</topic>
<affects>
<package>
<name>opera</name>
<name>opera-devel</name>
<name>linux-opera</name>
<range><lt>9.02</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Opera reports:</p>
<blockquote cite="http://www.opera.com/support/search/supsearch.dml?index=845">
<p>A specially crafted digital certificate can bypass Opera's
certificate signature verification. Forged certificates can
contain any false information the forger chooses, and Opera
will still present it as valid. Opera will not present any
warning dialogs in this case, and the security status will
be the highest possible (3). This defeats the protection
against "man in the middle", the attacks that SSL was
designed to prevent.</p>
<p>There is a flaw in OpenSSL's RSA signature verification
that affects digital certificates using 3 as the public
exponent. Some of the certificate issuers that are on
Opera's list of trusted signers have root certificates with
3 as the public exponent. The forged certificate can appear
to be signed by one of these.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-4339</cvename>
<url>http://secunia.com/advisories/21982/</url>
<url>http://secunia.com/advisories/21709/</url>
<url>http://www.cdc.informatik.tu-darmstadt.de/securebrowser/</url>
<url>http://www.openssl.org/news/secadv_20060905.txt</url>
<url>http://www.mozilla.org/security/announce/2006/mfsa2006-60.html</url>
</references>
<dates>
<discovery>2006-09-18</discovery>
<entry>2006-09-22</entry>
</dates>
</vuln>
<vuln vid="e6296105-449b-11db-ba89-000c6ec775d9">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>1.5.0.7,1</lt></range>
<range><gt>2.*,1</gt><lt>2.0_1,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>1.5.0.7</lt></range>
</package>
<package>
<name>seamonkey</name>
<name>linux-seamonkey</name>
<range><lt>1.0.5</lt></range>
</package>
<package>
<name>thunderbird</name>
<name>linux-thunderbird</name>
<name>mozilla-thunderbird</name>
<range><lt>1.5.0.7</lt></range>
</package>
<package>
<name>linux-firefox-devel</name>
<range><lt>3.0.a2006.09.21</lt></range>
</package>
<package>
<name>linux-seamonkey-devel</name>
<range><lt>1.5.a2006.09.21</lt></range>
</package>
<package>
<name>linux-mozilla-devel</name>
<name>linux-mozilla</name>
<name>mozilla</name>
<range><gt>0</gt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Foundation reports of multiple security issues
in Firefox, Seamonkey, and Thunderbird. Several of these
issues can probably be used to run arbitrary code with the
privilege of the user running the program.</p>
<blockquote cite="http://www.mozilla.org/security/announce/">
<ul>
<li>MFSA 2006-64 Crashes with evidence of memory
corruption (rv:1.8.0.7)</li>
<li>MFSA 2006-63 JavaScript execution in mail via XBL</li>
<li>MFSA 2006-62 Popup-blocker cross-site scripting (XSS)</li>
<li>MFSA 2006-61 Frame spoofing using document.open()</li>
<li>MFSA 2006-60 RSA Signature Forgery</li>
<li>MFSA 2006-59 Concurrency-related vulnerability</li>
<li>MFSA 2006-58 Auto-Update compromise through DNS and
SSL spoofing</li>
<li>MFSA 2006-57 JavaScript Regular Expression Heap
Corruption</li>
</ul>
</blockquote>
</body>
</description>
<references>
<bid>20042</bid>
<cvename>CVE-2006-4253</cvename>
<cvename>CVE-2006-4340</cvename>
<cvename>CVE-2006-4565</cvename>
<cvename>CVE-2006-4566</cvename>
<cvename>CVE-2006-4567</cvename>
<cvename>CVE-2006-4568</cvename>
<cvename>CVE-2006-4569</cvename>
<cvename>CVE-2006-4570</cvename>
<cvename>CVE-2006-4571</cvename>
<url>http://www.mozilla.org/security/announce/2006/mfsa2006-57.html</url>
<url>http://www.mozilla.org/security/announce/2006/mfsa2006-58.html</url>
<url>http://www.mozilla.org/security/announce/2006/mfsa2006-59.html</url>
<url>http://www.mozilla.org/security/announce/2006/mfsa2006-60.html</url>
<url>http://www.mozilla.org/security/announce/2006/mfsa2006-61.html</url>
<url>http://www.mozilla.org/security/announce/2006/mfsa2006-62.html</url>
<url>http://www.mozilla.org/security/announce/2006/mfsa2006-63.html</url>
<url>http://www.mozilla.org/security/announce/2006/mfsa2006-64.html</url>
</references>
<dates>
<discovery>2006-09-14</discovery>
<entry>2006-09-15</entry>
<modified>2006-11-02</modified>
</dates>
</vuln>
<vuln vid="24f6b1eb-43d5-11db-81e1-000e0c2e438a">
<topic>win32-codecs -- multiple vulnerabilities</topic>
<affects>
<package>
<name>win32-codecs</name>
<range><lt>3.1.0.p8_1,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Apple Security Team reports that there are multiple
vulnerabilities within QuickTime (one of the plugins for
win32-codecs). A remote attacker capable of creating a
malicious SGI image, FlashPix, FLC movie, or a QuickTime
movie can possibly lead to execution of arbitrary code or
cause a Denial of Service (application crash).</p>
<p>Users who have QuickTime (/win32-codecs) as a browser plugin
may be vulnerable to remote code execution by visiting a
website containing a malicious SGI image, FlashPix, FLC movie
or a QuickTime movie.</p>
</body>
</description>
<references>
<bid>20138</bid>
<cvename>CVE-2006-4381</cvename>
<cvename>CVE-2006-4382</cvename>
<cvename>CVE-2006-4384</cvename>
<cvename>CVE-2006-4385</cvename>
<cvename>CVE-2006-4386</cvename>
<cvename>CVE-2006-4388</cvename>
<cvename>CVE-2006-4389</cvename>
<url>http://docs.info.apple.com/article.html?artnum=304357</url>
</references>
<dates>
<discovery>2006-09-08</discovery>
<entry>2006-09-14</entry>
<modified>2006-10-17</modified>
</dates>
</vuln>
<vuln vid="ea09c5df-4362-11db-81e1-000e0c2e438a">
<topic>php -- multiple vulnerabilities</topic>
<affects>
<package>
<name>php4</name>
<name>php5</name>
<range><lt>4.4.4</lt></range>
<range><ge>5</ge><lt>5.1.5</lt></range>
</package>
<package>
<name>php4-cli</name>
<name>php5-cli</name>
<name>php4-cgi</name>
<name>php5-cgi</name>
<name>php4-dtc</name>
<name>php5-dtc</name>
<name>php4-horde</name>
<name>php5-horde</name>
<name>php4-nms</name>
<name>php5-nms</name>
<name>mod_php4</name>
<name>mod_php5</name>
<range><lt>4.4.4</lt></range>
<range><ge>5</ge><lt>5.1.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PHP development team reports:</p>
<blockquote cite="http://www.php.net/release_5_1_5.php">
<ul>
<li>Added missing safe_mode/open_basedir checks inside the
error_log(), file_exists(), imap_open() and imap_reopen()
functions.</li>
<li>Fixed overflows inside str_repeat() and wordwrap()
functions on 64bit systems.</li>
<li>Fixed possible open_basedir/safe_mode bypass in cURL
extension and with realpath cache.</li>
<li>Fixed overflow in GD extension on invalid GIF
images.</li>
<li>Fixed a buffer overflow inside sscanf() function.</li>
<li>Fixed an out of bounds read inside stripos()
function.</li>
<li>Fixed memory_limit restriction on 64 bit system.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-4481</cvename>
<cvename>CVE-2006-4482</cvename>
<cvename>CVE-2006-4483</cvename>
<cvename>CVE-2006-4484</cvename>
<cvename>CVE-2006-4485</cvename>
<cvename>CVE-2006-4486</cvename>
<url>http://www.php.net/release_4_4_4.php</url>
<url>http://www.php.net/release_5_1_5.php</url>
</references>
<dates>
<discovery>2006-08-18</discovery>
<entry>2006-09-13</entry>
<modified>2014-03-28</modified>
</dates>
</vuln>
<vuln vid="c0fd7890-4346-11db-89cc-000ae42e9b93">
<topic>drupal-pubcookie -- authentication may be bypassed</topic>
<affects>
<package>
<name>drupal-pubcookie</name>
<range><le>4.6.0_20060210</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Drupal Project reports:</p>
<blockquote cite="http://drupal.org/node/83064">
<p>It is possible for a malicious user to spoof a user's
identity by bypassing the login redirection mechanism in the
pubcookie module. The malicious user may gain the privileges
of the user they are spoofing, including the administrative
user.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-4717</cvename>
<url>http://drupal.org/node/83064</url>
</references>
<dates>
<discovery>2006-09-08</discovery>
<entry>2006-09-13</entry>
<modified>2010-05-12</modified>
</dates>
</vuln>
<vuln vid="7c75d48c-429b-11db-afae-000c6ec775d9">
<topic>linux-flashplugin7 -- arbitrary code execution vulnerabilities</topic>
<affects>
<package>
<name>linux-flashplugin</name>
<range><lt>7.0r68</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="http://www.adobe.com/support/security/bulletins/apsb06-11.html">
<p>Multiple input validation errors have been identified in
Flash Player 8.0.24.0 and earlier versions that could lead
to the potential execution of arbitrary code. These
vulnerabilities could be accessed through content
delivered from a remote location via the user?s web
browser, email client, or other applications that include
or reference the Flash Player. (CVE-2006-3311,
CVE-2006-3587, CVE-2006-3588)</p>
<p>These updates include changes to prevent circumvention of
the "allowScriptAccess" option. (CVE-2006-4640)</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-3311</cvename>
<cvename>CVE-2006-3587</cvename>
<cvename>CVE-2006-3588</cvename>
<cvename>CVE-2006-4640</cvename>
<url>http://www.adobe.com/support/security/bulletins/apsb06-11.html</url>
</references>
<dates>
<discovery>2006-09-12</discovery>
<entry>2006-09-12</entry>
</dates>
</vuln>
<vuln vid="28ce7102-4039-11db-a838-00148584c7dd">
<cancelled/>
</vuln>
<vuln vid="fffa9257-3c17-11db-86ab-00123ffe8333">
<topic>mailman -- Multiple Vulnerabilities</topic>
<affects>
<package>
<name>mailman</name>
<name>ja-mailman</name>
<name>mailman-with-htdig</name>
<range><lt>2.1.9.r1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/21732/">
<p>Mailman can be exploited by malicious people to conduct cross-site
scripting and phishing attacks, and cause a DoS (Denial of
Service).</p>
<p>1) An error in the logging functionality can be exploited to
inject a spoofed log message into the error log via a specially
crafted URL.</p>
<p>Successful exploitation may trick an administrator into visiting
a malicious web site.</p>
<p>2) An error in the processing of malformed headers which does not
follow the RFC 2231 standard can be exploited to cause a DoS
(Denial of Service).</p>
<p>3) Some unspecified input isn't properly sanitised before being
returned to the user. This can be exploited to execute arbitrary
HTML and script code in a user's browser session in context of an
affected site.</p>
</blockquote>
</body>
</description>
<references>
<bid>19831</bid>
<cvename>CVE-2006-2191</cvename>
<cvename>CVE-2006-2941</cvename>
<cvename>CVE-2006-3636</cvename>
<cvename>CVE-2006-4624</cvename>
<url>http://secunia.com/advisories/21732/</url>
<url>http://sourceforge.net/project/shownotes.php?group_id=103&amp;release_id=444295</url>
</references>
<dates>
<discovery>2006-06-09</discovery>
<entry>2006-09-04</entry>
<modified>2006-10-04</modified>
</dates>
</vuln>
<vuln vid="09639ccc-3abb-11db-81e1-000e0c2e438a">
<topic>hlstats -- multiple cross site scripting vulnerabilities</topic>
<affects>
<package>
<name>hlstats</name>
<range><le>1.35</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Kefka reports multiple cross site scripting vulnerabilities
within hlstats. The vulnerabilities are caused due to
improper checking of variables, allowing an attacker to
perform cross site scripting.</p>
</body>
</description>
<references>
<bid>19745</bid>
<cvename>CVE-2006-4454</cvename>
<cvename>CVE-2006-6780</cvename>
<cvename>CVE-2006-6781</cvename>
<cvename>CVE-2007-2812</cvename>
</references>
<dates>
<discovery>2006-08-29</discovery>
<entry>2006-09-02</entry>
<modified>2011-09-03</modified>
</dates>
</vuln>
<vuln vid="0b79743b-3ab7-11db-81e1-000e0c2e438a">
<topic>gtetrinet -- remote code execution</topic>
<affects>
<package>
<name>gtetrinet</name>
<range><lt>0.7.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Debian Security Team reports:</p>
<blockquote cite="http://www.debian.org/security/2006/dsa-1163">
<p>Michael Gehring discovered several potential out-of-bounds
index accesses in gtetrinet, a multiplayer Tetris-like game,
which may allow a remote server to execute arbitrary
code</p>
</blockquote>
</body>
</description>
<references>
<bid>19766</bid>
<cvename>CVE-2006-3125</cvename>
<url>http://www.debian.org/security/2006/dsa-1163</url>
</references>
<dates>
<discovery>2006-08-30</discovery>
<entry>2006-09-02</entry>
<modified>2006-10-01</modified>
</dates>
</vuln>
<vuln vid="0ab423e7-3822-11db-81e1-000e0c2e438a">
<topic>joomla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>joomla</name>
<range><lt>1.0.11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Joomla development team reports multiple vulnerabilities
within the joomla application. Joomla is vulnerable to the
following vulnerabilities:</p>
<ul>
<li>Improper validation of the mosMail function</li>
<li>Improper validation of the JosIsValidEmail function.</li>
<li>Remote code execution in PEAR.php</li>
<li>Zend Hash del key or index vulnerability</li>
</ul>
</body>
</description>
<references>
<url>http://www.joomla.org/content/view/1841/78/</url>
</references>
<dates>
<discovery>2006-08-28</discovery>
<entry>2006-08-30</entry>
<modified>2010-05-12</modified>
</dates>
</vuln>
<vuln vid="c9d2e361-32fb-11db-a6e2-000e0c2e438a">
<topic>sppp -- buffer overflow vulnerability</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><lt>4.11_20</lt></range>
<range><ge>5.3</ge><lt>5.3_32</lt></range>
<range><ge>5.4</ge><lt>5.4_17</lt></range>
<range><ge>5.5</ge><lt>5.5_3</lt></range>
<range><ge>6.0</ge><lt>6.0_10</lt></range>
<range><ge>6.1</ge><lt>6.1_4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description</h1>
<p>While processing Link Control Protocol (LCP) configuration
options received from the remote host, sppp(4) fails to
correctly validate option lengths. This may result in data
being read or written beyond the allocated kernel memory
buffer.</p>
<h1>Impact</h1>
<p>An attacker able to send LCP packets, including the remote
end of a sppp(4) connection, can cause the FreeBSD kernel to
panic. Such an attacker may also be able to obtain
sensitive information or gain elevated privileges.</p>
<h1>Workaround</h1>
<p>No workaround is available, but systems which do not use sppp(4) are
not vulnerable.</p>
</body>
</description>
<references>
<cvename>CVE-2006-4304</cvename>
<freebsdsa>SA-06:18.ppp</freebsdsa>
</references>
<dates>
<discovery>2006-08-23</discovery>
<entry>2006-08-23</entry>
<modified>2006-08-30</modified>
</dates>
</vuln>
<vuln vid="e2e8d374-2e40-11db-b683-0008743bf21a">
<topic>horde -- Phishing and Cross-Site Scripting Vulnerabilities</topic>
<affects>
<package>
<name>horde</name>
<range><le>3.1.2</le></range>
</package>
<package>
<name>imp</name>
<range><le>4.1.2</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/21500/">
<p>Some vulnerabilities have been reported in Horde, which
can be exploited by malicious people to conduct phishing
and cross-site scripting attacks.</p>
<ol>
<li>Input passed to the "url" parameter in index.php isn't
properly verified before it is being used to include an
arbitrary web site in a frameset. This can e.g. be
exploited to trick a user into believing certain
malicious content is served from a trusted web site.</li>
<li>Some unspecified input passed in index.php isn't
properly sanitised before being returned to the user.
This can be exploited to execute arbitrary HTML and
script code in a user's browser session in context of an
affected site.</li>
</ol>
</blockquote>
</body>
</description>
<references>
<bid>19557</bid>
<bid>19544</bid>
<url>http://secunia.com/advisories/21500/</url>
<url>http://lists.horde.org/archives/announce/2006/000292.html</url>
</references>
<dates>
<discovery>2006-08-17</discovery>
<entry>2006-08-17</entry>
</dates>
</vuln>
<vuln vid="5039ae61-2c9f-11db-8401-000ae42e9b93">
<topic>globus -- Multiple tmpfile races</topic>
<affects>
<package>
<name>globus</name>
<range><lt>4.0.2_20060706</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Globus Alliance reports:</p>
<blockquote cite="http://www.globus.org/mail_archive/security-announce/2006/08/msg00000.html">
<p>The proxy generation tool (grid-proxy-init) creates the
file, secures the file to provide access only to owner and
writes proxy to the file. A race condition exists between
the opening of the proxy credentials file, and making sure
it is safe file to write to. The checks to ensure this
file is accessible only to the owner take place using the
filename after the file is opened for writing, but before
any data is written.</p>
</blockquote>
<blockquote cite="http://www.globus.org/mail_archive/security-announce/2006/08/msg00001.html">
<p>Various components of the toolkit use files in shared
directories to store information, some being sensitive
information. For example, the tool to create proxy
certificates, stores the generated proxy certificate by
default in /tmp. Specific vulnerabilities in handling such
files were reported in myproxy-admin-adduser, grid-ca-sign
and grid-security-config.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-4232</cvename>
<cvename>CVE-2006-4233</cvename>
<url>http://www.globus.org/mail_archive/security-announce/2006/08/msg00000.html</url>
<url>http://www.globus.org/mail_archive/security-announce/2006/08/msg00001.html</url>
</references>
<dates>
<discovery>2006-08-08</discovery>
<entry>2006-08-15</entry>
<modified>2010-05-12</modified>
</dates>
</vuln>
<vuln vid="9dda3ff1-2b02-11db-a6e2-000e0c2e438a">
<topic>x11vnc -- authentication bypass vulnerability</topic>
<affects>
<package>
<name>x11vnc</name>
<range><lt>0.8.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ludwig Nussel reports that x11vnc is vulnerable to an
authentication bypass vulnerability. The vulnerability is
caused by an error in auth.c. This could allow a remote
attacker to gain unauthorized and unauthenticated access
to the system.</p>
</body>
</description>
<references>
<bid>18977</bid>
<cvename>CVE-2006-2450</cvename>
<url>http://bugs.debian.org/376824</url>
</references>
<dates>
<discovery>2006-08-08</discovery>
<entry>2006-08-13</entry>
</dates>
</vuln>
<vuln vid="9855ac8e-2aec-11db-a6e2-000e0c2e438a">
<topic>alsaplayer -- multiple vulnerabilities</topic>
<affects>
<package>
<name>alsaplayer</name>
<range><gt>0</gt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Luigi Auriemma reports three vulnerabilities within
alsaplayer:</p>
<blockquote cite="http://aluigi.altervista.org/adv/alsapbof-adv.txt">
<ul>
<li>The function which handles the HTTP connections is
vulnerable to a buffer-overflow that happens when it uses
sscanf for copying the URL in the Location's field
received from the server into the redirect buffer of only
1024 bytes declared in http_open.</li>
<li>A buffer-overflow exists in the functions which add items
to the playlist when the GTK interface is used (so the other
interfaces are not affected by this problem): new_list_item
and CbUpdated in interface/gtk/PlaylistWindow.cpp.</li>
<li>AlsaPlayer automatically queries the CDDB server
specified in its configuration (by default
freedb.freedb.org) when the user choices the CDDA function
for playing audio CDs. The function which queries the
server uses a buffer of 20 bytes and one of 9 for storing
the category and ID strings received from the server while
the buffer which contains this server's response is 32768
bytes long. Naturally for exploiting this bug the attacker
must have control of the freedb server specified in the
AlsaPlayer's configuration.</li>
</ul>
</blockquote>
<p>These vulnerabilities could allow a remote attacker to
execute arbitrary code, possibly gaining access to the
system.</p>
</body>
</description>
<references>
<cvename>CVE-2006-4089</cvename>
<bid>19450</bid>
<url>http://aluigi.altervista.org/adv/alsapbof-adv.txt</url>
</references>
<dates>
<discovery>2006-08-09</discovery>
<entry>2006-08-13</entry>
<modified>2010-05-12</modified>
</dates>
</vuln>
<vuln vid="17f53c1d-2ae9-11db-a6e2-000e0c2e438a">
<topic>postgresql -- encoding based SQL injection</topic>
<affects>
<package>
<name>postgresql</name>
<name>postgresql-server</name>
<name>ja-postgresql</name>
<range><ge>7.3</ge><lt>7.3.15</lt></range>
<range><ge>7.4</ge><lt>7.4.13</lt></range>
<range><ge>8.0.0</ge><lt>8.0.8</lt></range>
<range><ge>8.1.0</ge><lt>8.1.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PostgreSQL development team reports:</p>
<blockquote cite="http://www.postgresql.org/docs/techdocs.50">
<p>An attacker able to submit crafted strings to an
application that will embed those strings in SQL commands
can use invalidly-encoded multibyte characters to bypass
standard string-escaping methods, resulting in possible
injection of hostile SQL commands into the database. The
attacks covered here work in any multibyte encoding.</p>
<p>The widely-used practice of escaping ASCII single quote
"'" by turning it into "\'" is unsafe when operating in
multibyte encodings that allow 0x5c (ASCII code for
backslash) as the trailing byte of a multibyte character;
this includes at least SJIS, BIG5, GBK, GB18030, and UHC.
An application that uses this conversion while embedding
untrusted strings in SQL commands is vulnerable to
SQL-injection attacks if it communicates with the server in
one of these encodings. While the standard client libraries
used with PostgreSQL have escaped "'" in the safe,
SQL-standard way of "''" for some time, the older practice
remains common.</p>
</blockquote>
</body>
</description>
<references>
<bid>18092</bid>
<cvename>CVE-2006-2313</cvename>
<cvename>CVE-2006-2314</cvename>
<url>http://www.postgresql.org/docs/techdocs.50</url>
</references>
<dates>
<discovery>2006-05-11</discovery>
<entry>2006-08-13</entry>
</dates>
</vuln>
<vuln vid="65c8ecf9-2adb-11db-a6e2-000e0c2e438a">
<topic>postgresql -- multiple vulnerabilities</topic>
<affects>
<package>
<name>postgresql</name>
<name>postgresql-server</name>
<name>ja-postgresql</name>
<range><ge>7.2</ge><lt>7.2.7</lt></range>
<range><ge>7.3</ge><lt>7.3.9</lt></range>
<range><ge>7.4</ge><lt>7.4.7</lt></range>
<range><ge>8.0.0</ge><lt>8.0.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Multiple vulnerabilities had been reported in various
versions of PostgreSQL:</p>
<ul>
<li>The EXECUTE restrictions can be bypassed by using the
AGGREGATE function, which is missing a permissions check.</li>
<li>A buffer overflow exists in gram.y which could allow an
attacker to execute arbitrary code by sending a large
number of arguments to a refcursor function, found in
gram.y</li>
<li>The intagg contributed module allows an attacker to crash
the server (Denial of Service) by constructing a malicious
crafted array.</li>
</ul>
</body>
</description>
<references>
<cvename>CVE-2005-0244</cvename>
<cvename>CVE-2005-0245</cvename>
<cvename>CVE-2005-0246</cvename>
<url>http://secunia.com/advisories/12948</url>
</references>
<dates>
<discovery>2005-02-01</discovery>
<entry>2006-08-13</entry>
</dates>
</vuln>
<vuln vid="fcb90eb0-2ace-11db-a6e2-000e0c2e438a">
<topic>mysql -- format string vulnerability</topic>
<affects>
<package>
<name>mysql-server</name>
<range><ge>5.1</ge><lt>5.1.6</lt></range>
<range><ge>5.0</ge><lt>5.0.19</lt></range>
<range><ge>4.1</ge><lt>4.1.18</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jean-David Maillefer reports a Denial of Service vulnerability
within MySQL. The vulnerability is caused by improper checking
of the data_format routine, which cause the MySQL server to
crash. The crash is triggered by the following code:<br/>
<code>"SELECT date_format('%d%s', 1);</code></p>
</body>
</description>
<references>
<bid>19032</bid>
<cvename>CVE-2006-3469</cvename>
<url>http://bugs.mysql.com/bug.php?id=20729</url>
</references>
<dates>
<discovery>2006-06-27</discovery>
<entry>2006-08-13</entry>
</dates>
</vuln>
<vuln vid="21b7c550-2a22-11db-a6e2-000e0c2e438a">
<topic>squirrelmail -- random variable overwrite vulnerability</topic>
<affects>
<package>
<name>ja-squirrelmail</name>
<range><ge>1.4.0</ge><lt>1.4.8,2</lt></range>
</package>
<package>
<name>squirrelmail</name>
<range><ge>1.4.0</ge><lt>1.4.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The SquirrelMail developers report:</p>
<blockquote cite="http://www.squirrelmail.org/security/issue/2006-08-11">
<p>A logged in user could overwrite random variables in
compose.php, which might make it possible to read/write
other users' preferences or attachments.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-4019</cvename>
<url>http://www.squirrelmail.org/security/issue/2006-08-11</url>
</references>
<dates>
<discovery>2006-08-11</discovery>
<entry>2006-08-12</entry>
</dates>
</vuln>
<vuln vid="90064567-28b1-11db-844d-000c6ec775d9">
<topic>rubygem-rails -- evaluation of ruby code</topic>
<affects>
<package>
<name>rubygem-rails</name>
<range><ge>1.1.0</ge><lt>1.1.3</lt></range>
<range><ge>1.1.4</ge><lt>1.1.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Ruby on Rails blog reports:</p>
<blockquote cite="http://weblog.rubyonrails.org/2006/8/10/rails-1-1-6-backports-and-full-disclosure">
<p>With Rails 1.1.0 through 1.1.5 (minus the short-lived 1.1.3),
you can trigger the evaluation of Ruby code through the URL
because of a bug in the routing code of Rails. This means that
you can essentially take down a Rails process by starting
something like /script/profiler, as the code will run for a
long time and that process will be hung while it happens.
Other URLs can even cause data loss.</p>
</blockquote>
</body>
</description>
<references>
<url>http://weblog.rubyonrails.org/2006/8/10/rails-1-1-6-backports-and-full-disclosure</url>
</references>
<dates>
<discovery>2006-08-09</discovery>
<entry>2006-08-10</entry>
</dates>
</vuln>
<vuln vid="342d2e48-26db-11db-9275-000475abc56f">
<topic>clamav -- heap overflow vulnerability</topic>
<affects>
<package>
<name>clamav</name>
<range><ge>0.88.1</ge><lt>0.88.4</lt></range>
</package>
<package>
<name>clamav-devel</name>
<range><lt>20060808</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Clamav team reports:</p>
<blockquote cite="http://www.clamav.net/security/0.88.4.html">
<p>A heap overflow vulnerability was discovered in libclamav
which could cause a denial of service or allow the
execution of arbitrary code.</p>
<p>The problem is specifically located in the PE file rebuild
function used by the UPX unpacker.</p>
<p>Relevant code from libclamav/upx.c:</p>
<p>
memcpy(dst, newbuf, foffset);
*dsize = foffset;
free(newbuf);
cli_dbgmsg("UPX: PE structure rebuilt from compressed file\n");
return 1;</p>
<p>Due to improper validation it is possible to overflow the above
memcpy() beyond the allocated memory block.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-4018</cvename>
<url>http://www.clamav.net/security/0.88.4.html</url>
</references>
<dates>
<discovery>2006-08-07</discovery>
<entry>2006-08-08</entry>
</dates>
</vuln>
<vuln vid="c905298c-2274-11db-896e-000ae42e9b93">
<topic>drupal -- XSS vulnerability</topic>
<affects>
<package>
<name>drupal</name>
<range><lt>4.6.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Drupal project reports:</p>
<blockquote cite="http://drupal.org/files/sa-2006-011/advisory.txt">
<p>A malicious user can execute a cross site scripting attack
by enticing someone to visit a Drupal site via a specially
crafted link.</p>
</blockquote>
</body>
</description>
<references>
<url>http://drupal.org/files/sa-2006-011/advisory.txt</url>
</references>
<dates>
<discovery>2006-08-02</discovery>
<entry>2006-08-02</entry>
<modified>2006-08-08</modified>
</dates>
</vuln>
<vuln vid="ed529baa-21c6-11db-b625-02e081235dab">
<topic>gnupg -- 2 more possible memory allocation attacks</topic>
<affects>
<package>
<name>gnupg</name>
<range><lt>1.4.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Author reports:</p>
<blockquote cite="http://lists.gnupg.org/pipermail/gnupg-announce/2006q3/000229.html">
<p>Fixed 2 more possible memory allocation attacks. They are
similar to the problem we fixed with 1.4.4. This bug can easily
be exploted for a DoS; remote code execution is not entirely
impossible.</p>
</blockquote>
</body>
</description>
<references>
<url>http://lists.gnupg.org/pipermail/gnupg-announce/2006q3/000229.html</url>
</references>
<dates>
<discovery>2006-08-01</discovery>
<entry>2006-08-02</entry>
</dates>
</vuln>
<vuln vid="76562594-1f19-11db-b7d4-0008743bf21a">
<topic>ruby -- multiple vulnerabilities</topic>
<affects>
<package>
<name>ruby</name>
<name>ruby_static</name>
<range><gt>1.6.*</gt><lt>1.8.*</lt></range>
<range><gt>1.8.*</gt><lt>1.8.4_9,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/21009/">
<p>Two vulnerabilities have been reported in Ruby, which can
be exploited by malicious people to bypass certain security
restrictions.</p>
<ol>
<li>An error in the handling of the "alias" functionality
can be exploited to bypass the safe level protection and
replace methods called in the trusted level.</li>
<li>An error caused due to directory operations not being
properly checked can be exploited to bypass the safe
level protection and close untainted directory streams.</li>
</ol>
</blockquote>
</body>
</description>
<references>
<bid>18944</bid>
<cvename>CVE-2006-3694</cvename>
<url>http://secunia.com/advisories/21009/</url>
<url>http://jvn.jp/jp/JVN%2383768862/index.html</url>
<url>http://jvn.jp/jp/JVN%2313947696/index.html</url>
</references>
<dates>
<discovery>2006-07-12</discovery>
<entry>2006-07-29</entry>
<modified>2006-07-30</modified>
</dates>
</vuln>
<vuln vid="dc8c08c7-1e7c-11db-88cf-000c6ec775d9">
<topic>apache -- mod_rewrite buffer overflow vulnerability</topic>
<affects>
<package>
<name>apache</name>
<range><ge>1.3.28</ge><lt>1.3.36_1</lt></range>
<range><ge>2.0.46</ge><lt>2.0.58_2</lt></range>
<range><ge>2.2.0</ge><lt>2.2.2_1</lt></range>
</package>
<package>
<name>apache+mod_perl</name>
<range><ge>1.3.28</ge><lt>1.3.36_1</lt></range>
</package>
<package>
<name>apache+ipv6</name>
<range><ge>1.3.28</ge><lt>1.3.37</lt></range>
</package>
<package>
<name>apache_fp</name>
<range><ge>0</ge></range>
</package>
<package>
<name>ru-apache</name>
<range><ge>1.3.28</ge><lt>1.3.37+30.23</lt></range>
</package>
<package>
<name>ru-apache+mod_ssl</name>
<range><ge>1.3.28</ge><lt>1.3.34.1.57_2</lt></range>
</package>
<package>
<name>apache+ssl</name>
<range><ge>1.3.28</ge><lt>1.3.34.1.57_2</lt></range>
</package>
<package>
<name>apache+mod_ssl</name>
<name>apache+mod_ssl+ipv6</name>
<name>apache+mod_ssl+mod_accel</name>
<name>apache+mod_ssl+mod_accel+ipv6</name>
<name>apache+mod_ssl+mod_accel+mod_deflate</name>
<name>apache+mod_ssl+mod_accel+mod_deflate+ipv6</name>
<name>apache+mod_ssl+mod_deflate</name>
<name>apache+mod_ssl+mod_deflate+ipv6</name>
<name>apache+mod_ssl+mod_snmp</name>
<name>apache+mod_ssl+mod_snmp+mod_accel</name>
<name>apache+mod_ssl+mod_snmp+mod_accel+ipv6</name>
<name>apache+mod_ssl+mod_snmp+mod_deflate</name>
<name>apache+mod_ssl+mod_snmp+mod_deflate+ipv6</name>
<name>apache+mod_ssl+mod_snmp+mod_accel+mod_deflate+ipv6</name>
<range><ge>1.3.28</ge><lt>1.3.36+2.8.27_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Apache Software Foundation and The Apache HTTP Server
Project reports:</p>
<blockquote cite="http://marc.theaimsgroup.com/?l=apache-httpd-announce&amp;m=115409818602955">
<p>An off-by-one flaw exists in the Rewrite module,
mod_rewrite, as shipped with Apache 1.3 since 1.3.28, 2.0
since 2.0.46, and 2.2 since 2.2.0.</p>
<p>Depending on the manner in which Apache HTTP Server was
compiled, this software defect may result in a
vulnerability which, in combination with certain types of
Rewrite rules in the web server configuration files, could
be triggered remotely. For vulnerable builds, the nature
of the vulnerability can be denial of service (crashing of
web server processes) or potentially allow arbitrary code
execution. This issue has been rated as having important
security impact by the Apache HTTP Server Security Team.</p>
<p>This flaw does not affect a default installation of
Apache HTTP Server. Users who do not use, or have not
enabled, the Rewrite module mod_rewrite are not affected
by this issue. This issue only affects installations using
a Rewrite rule with the following characteristics:</p>
<ul>
<li>The RewriteRule allows the attacker to control the
initial part of the rewritten URL (for example if the
substitution URL starts with $1)</li>
<li>The RewriteRule flags do NOT include any of the
following flags: Forbidden (F), Gone (G), or NoEscape
(NE).</li>
</ul>
<p>Please note that ability to exploit this issue is
dependent on the stack layout for a particular compiled
version of mod_rewrite. If the compiler used to compile
Apache HTTP Server has added padding to the stack
immediately after the buffer being overwritten, it will
not be possible to exploit this issue, and Apache HTTP
Server will continue operating normally.</p>
<p>The Apache HTTP Server project thanks Mark Dowd of McAfee
Avert Labs for the responsible reporting of this
vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<certvu>395412</certvu>
<cvename>CVE-2006-3747</cvename>
<mlist msgid="44CA22D9.6020200@apache.org">http://marc.theaimsgroup.com/?l=apache-httpd-announce&amp;m=115409818602955</mlist>
</references>
<dates>
<discovery>2006-07-27</discovery>
<entry>2006-07-28</entry>
<modified>2006-11-01</modified>
</dates>
</vuln>
<vuln vid="e2a92664-1d60-11db-88cf-000c6ec775d9">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>1.5.0.5,1</lt></range>
<range><gt>2.*,1</gt><lt>2.0_1,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>1.5.0.5</lt></range>
</package>
<package>
<name>linux-firefox-devel</name>
<range><lt>3.0.a2006.07.26</lt></range>
</package>
<package>
<name>seamonkey</name>
<name>linux-seamonkey</name>
<range><lt>1.0.3</lt></range>
</package>
<package>
<name>thunderbird</name>
<name>linux-thunderbird</name>
<name>mozilla-thunderbird</name>
<range><lt>1.5.0.5</lt></range>
</package>
<package>
<name>mozilla</name>
<name>linux-mozilla</name>
<name>linux-mozilla-devel</name>
<range><gt>0</gt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Mozilla Foundation Security Advisory reports of multiple
issues. Several of which can be used to run arbitrary code
with the privilege of the user running the program.</p>
<blockquote cite="http://www.mozilla.org/projects/security/known-vulnerabilities.html#seamonkey1.0.3">
<ul>
<li>MFSA 2006-56 chrome: scheme loading remote content</li>
<li>MFSA 2006-55 Crashes with evidence of memory corruption
(rv:1.8.0.5)</li>
<li>MFSA 2006-54 XSS with
XPCNativeWrapper(window).Function(...)</li>
<li>MFSA 2006-53 UniversalBrowserRead privilege escalation</li>
<li>MFSA 2006-52 PAC privilege escalation using
Function.prototype.call</li>
<li>MFSA 2006-51 Privilege escalation using named-functions
and redefined "new Object()"</li>
<li>MFSA 2006-50 JavaScript engine vulnerabilities</li>
<li>MFSA 2006-49 Heap buffer overwrite on malformed VCard</li>
<li>MFSA 2006-48 JavaScript new Function race condition</li>
<li>MFSA 2006-47 Native DOM methods can be hijacked across
domains</li>
<li>MFSA 2006-46 Memory corruption with simultaneous events</li>
<li>MFSA 2006-45 Javascript navigator Object Vulnerability</li>
<li>MFSA 2006-44 Code execution through deleted frame
reference</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-3113</cvename>
<cvename>CVE-2006-3677</cvename>
<cvename>CVE-2006-3801</cvename>
<cvename>CVE-2006-3802</cvename>
<cvename>CVE-2006-3803</cvename>
<cvename>CVE-2006-3804</cvename>
<cvename>CVE-2006-3805</cvename>
<cvename>CVE-2006-3806</cvename>
<cvename>CVE-2006-3807</cvename>
<cvename>CVE-2006-3808</cvename>
<cvename>CVE-2006-3809</cvename>
<cvename>CVE-2006-3810</cvename>
<cvename>CVE-2006-3811</cvename>
<cvename>CVE-2006-3812</cvename>
<url>http://www.mozilla.org/projects/security/known-vulnerabilities.html#seamonkey1.0.3</url>
<url>http://www.mozilla.org/security/announce/2006/mfsa2006-44.html</url>
<url>http://www.mozilla.org/security/announce/2006/mfsa2006-45.html</url>
<url>http://www.mozilla.org/security/announce/2006/mfsa2006-46.html</url>
<url>http://www.mozilla.org/security/announce/2006/mfsa2006-47.html</url>
<url>http://www.mozilla.org/security/announce/2006/mfsa2006-48.html</url>
<url>http://www.mozilla.org/security/announce/2006/mfsa2006-49.html</url>
<url>http://www.mozilla.org/security/announce/2006/mfsa2006-50.html</url>
<url>http://www.mozilla.org/security/announce/2006/mfsa2006-51.html</url>
<url>http://www.mozilla.org/security/announce/2006/mfsa2006-52.html</url>
<url>http://www.mozilla.org/security/announce/2006/mfsa2006-53.html</url>
<url>http://www.mozilla.org/security/announce/2006/mfsa2006-54.html</url>
<url>http://www.mozilla.org/security/announce/2006/mfsa2006-55.html</url>
<url>http://www.mozilla.org/security/announce/2006/mfsa2006-56.html</url>
</references>
<dates>
<discovery>2006-07-25</discovery>
<entry>2006-07-27</entry>
<modified>2006-11-02</modified>
</dates>
</vuln>
<vuln vid="5f2a0c40-1322-11db-bd23-000475abc56f">
<topic>zope -- information disclosure vulnerability</topic>
<affects>
<package>
<name>zope</name>
<range><ge>2.7.0</ge><lt>2.7.9</lt></range>
<range><ge>2.8.0</ge><lt>2.8.7</lt></range>
<range><ge>2.9.0</ge><lt>2.9.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Zope team reports:</p>
<blockquote cite="http://www.zope.org/Products/Zope/Hotfix-2006-07-05/Hotfix-2006-07-05/view">
<p>Unspecified vulnerability in (Zope2) allows local users
to obtain sensitive information via unknown attack vectors
related to the docutils module and "restructured text".</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-3458</cvename>
<url>http://www.zope.org/Products/Zope/Hotfix-2006-07-05/Hotfix-2006-07-05/view</url>
</references>
<dates>
<discovery>2006-07-05</discovery>
<entry>2006-07-14</entry>
</dates>
</vuln>
<vuln vid="6da7344b-128a-11db-b25f-00e00c69a70d">
<topic>drupal -- multiple vulnerabilities</topic>
<affects>
<package>
<name>drupal</name>
<range><lt>4.6.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Drupal team reports:</p>
<blockquote cite="http://drupal.org/node/66767">
<p>Vulnerability: XSS Vulnerability in taxonomy module</p>
<p>It is possible for a malicious user to insert and execute
XSS into terms, due to lack of validation on output of the
page title. The fix wraps the display of terms in
check_plain().</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-2833</cvename>
<url>http://drupal.org/node/66767</url>
</references>
<dates>
<discovery>2006-05-18</discovery>
<entry>2006-07-13</entry>
<modified>2006-07-14</modified>
</dates>
</vuln>
<vuln vid="67dbe99f-0f09-11db-94f8-00e029485e38">
<topic>shoutcast -- cross-site scripting, information exposure</topic>
<affects>
<package>
<name>shoutcast</name>
<name>linux-shoutcast</name>
<range><lt>1.9.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Goober's advisory reports reports that shoutcast is vulnerable to an
arbitrary file reading vulnerability:</p>
<blockquote cite="http://people.ksp.sk/~goober/advisory/001-shoutcast.html">
<p>Impact of the vulnerability depends on the way the product was
installed. In general, the vulnerability allows the attacker to read
any file which can be read by the Shoutcast server process.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-3007</cvename>
<url>http://secunia.com/advisories/20524/</url>
<url>http://people.ksp.sk/~goober/advisory/001-shoutcast.html</url>
</references>
<dates>
<discovery>2006-06-09</discovery>
<entry>2006-07-11</entry>
</dates>
</vuln>
<vuln vid="b168ddea-105a-11db-ac96-000c6ec775d9">
<topic>samba -- memory exhaustion DoS in smbd</topic>
<affects>
<package>
<name>samba</name>
<name>ja-samba</name>
<range><ge>3.0.1,1</ge><lt>3.0.23,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Samba Team reports:</p>
<blockquote cite="http://www.samba.org/samba/security/CAN-2006-3403.html">
<p>The smbd daemon maintains internal data structures used
track active connections to file and printer shares. In
certain circumstances an attacker may be able to
continually increase the memory usage of an smbd process
by issuing a large number of share connection requests.
This defect affects all Samba configurations.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-3403</cvename>
<url>http://www.samba.org/samba/security/CAN-2006-3403.html</url>
</references>
<dates>
<discovery>2006-07-10</discovery>
<entry>2006-07-10</entry>
</dates>
</vuln>
<vuln vid="a876df84-0fef-11db-ac96-000c6ec775d9">
<topic>twiki -- multiple file extensions file upload vulnerability</topic>
<affects>
<package>
<name>twiki</name>
<range><lt>4.0.4,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A TWiki Security Alert reports:</p>
<blockquote cite="http://twiki.org/cgi-bin/view/Codev/SecurityAlertSecureFileUploads">
<p>The TWiki upload filter already prevents executable
scripts such as .php, .php1, .phps, .pl from potentially
getting executed by appending a .txt suffix to the
uploaded filename. However, PHP and some other types
allows additional file suffixes, such as .php.en, .php.1,
and .php.2. TWiki does not check for these suffixes,
e.g. it is possible to upload php scripts with such
suffixes without the .txt filename padding.</p>
</blockquote>
<p>This issue can also be worked around with a restrictive web
server configuration. See the
<a href="http://twiki.org/cgi-bin/view/Codev/SecurityAlertSecureFileUploads">
TWiki Security Alert</a> for more information about how to do
this.</p>
</body>
</description>
<references>
<bid>18854</bid>
<cvename>CVE-2006-3336</cvename>
<url>http://secunia.com/advisories/20992/</url>
<url>http://twiki.org/cgi-bin/view/Codev/SecurityAlertSecureFileUploads</url>
</references>
<dates>
<discovery>2006-07-05</discovery>
<entry>2006-07-10</entry>
</dates>
</vuln>
<vuln vid="b0d61f73-0e11-11db-a47b-000c2957fdf1">
<topic>trac -- reStructuredText breach of privacy and denial of service vulnerability</topic>
<affects>
<package>
<name>trac</name>
<name>ja-trac</name>
<range><lt>0.9.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Trac 0.9.6 Release Notes reports:</p>
<blockquote cite="http://lists.edgewall.com/archive/trac-announce/2006-July/000013.html">
<p>Fixed reStructuredText breach of privacy and denial of
service vulnerability found by Felix Wiemann.</p>
<p>The discovered vulnerability requires docutils to be
installed and enabled. Systems that do not have docutils
installed or enabled are not vulnerable. As of this
version version 0.3.9 or greater of docutils is required
for using reStructuredText markup in Trac.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2005-3980</cvename>
<cvename>CVE-2005-4305</cvename>
<cvename>CVE-2005-4065</cvename>
<url>http://projects.edgewall.com/trac/wiki/ChangeLog</url>
<mlist>http://lists.edgewall.com/archive/trac-announce/2006-July/000013.html</mlist>
</references>
<dates>
<discovery>2006-07-06</discovery>
<entry>2006-07-07</entry>
<modified>2010-05-12</modified>
</dates>
</vuln>
<vuln vid="e94cb43d-0c4a-11db-9016-0050bf27ba24">
<topic>horde -- various problems in dereferrer</topic>
<affects>
<package>
<name>horde</name>
<name>horde-php5</name>
<range><lt>3.1.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Horde 3.1.2 release announcement:</p>
<blockquote cite="http://lists.horde.org/archives/announce/2006/000288.html">
<p>Security Fixes:</p>
<ul>
<li>Closed XSS problems in dereferrer (IE only), help viewer
and problem reporting screen.</li>
<li>Removed unused image proxy code from dereferrer.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-3548</cvename>
<url>http://lists.horde.org/archives/announce/2006/000288.html</url>
</references>
<dates>
<discovery>2006-06-28</discovery>
<entry>2006-07-05</entry>
<modified>2010-05-12</modified>
</dates>
</vuln>
<vuln vid="f70d09cb-0c46-11db-aac7-000c6ec775d9">
<topic>mambo -- SQL injection vulnerabilities</topic>
<affects>
<package>
<name>mambo</name>
<range><lt>4.5.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Team Mambo reports that two SQL injection
vulnerabilities have been found in Mambo. The
vulnerabilities exists due to missing sanitation of the
<code>title</code> and <code>catid</code> parameters in the
<code>weblinks.php</code> page and can lead to execution of
arbitrary SQL code.</p>
</body>
</description>
<references>
<bid>16775</bid>
<cvename>CVE-2006-0871</cvename>
<cvename>CVE-2006-1794</cvename>
<cvename>CVE-2006-3262</cvename>
<cvename>CVE-2006-3263</cvename>
<mlist msgid="20060617123242.1684.qmail@securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=115056811230529</mlist>
<url>http://secunia.com/advisories/18935/</url>
<url>http://secunia.com/advisories/20745/</url>
<url>http://www.mamboserver.com/?option=com_content&amp;task=view&amp;id=207</url>
<url>http://www.gulftech.org/?node=research&amp;article_id=00104-02242006</url>
</references>
<dates>
<discovery>2006-06-19</discovery>
<entry>2006-07-05</entry>
<modified>2006-10-05</modified>
</dates>
</vuln>
<vuln vid="229577a8-0936-11db-bf72-00046151137e">
<topic>phpmyadmin -- cross site scripting vulnerability</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<range><lt>2.8.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>phpmyadmin Site reports:</p>
<blockquote cite="http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-4">
<p>It was possible to craft a request that contains XSS by attacking
the "table" parameter.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-4</url>
<url>http://securitynews.ir/advisories/phpmyadmin281.txt</url>
</references>
<dates>
<discovery>2006-06-30</discovery>
<entry>2006-07-03</entry>
<modified>2007-10-16</modified>
</dates>
</vuln>
<vuln vid="227475c2-09cb-11db-9156-000e0c2e438a">
<topic>webmin, usermin -- arbitrary file disclosure vulnerability</topic>
<affects>
<package>
<name>webmin</name>
<range><lt>1.290</lt></range>
</package>
<package>
<name>usermin</name>
<range><lt>1.220</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The webmin development team reports:</p>
<blockquote cite="http://www.webmin.com/security.html">
<p>An attacker without a login to Webmin can read the
contents of any file on the server using a specially
crafted URL. All users should upgrade to version
1.290 as soon as possible, or setup IP access control
in Webmin.</p>
</blockquote>
</body>
</description>
<references>
<bid>18744</bid>
<url>http://www.webmin.com/security.html</url>
</references>
<dates>
<discovery>2006-06-30</discovery>
<entry>2006-07-02</entry>
</dates>
</vuln>
<vuln vid="d2a43243-087b-11db-bc36-0008743bf21a">
<topic>mutt -- Remote Buffer Overflow Vulnerability</topic>
<affects>
<package>
<name>mutt</name>
<name>mutt-lite</name>
<range><le>1.4.2.1_2</le></range>
</package>
<package>
<name>mutt-devel</name>
<name>mutt-devel-lite</name>
<range><le>1.5.11_2</le></range>
</package>
<package>
<name>ja-mutt</name>
<range><le>1.4.2.1.j1</le></range>
</package>
<package>
<name>zh-mutt-devel</name>
<range><le>1.5.11_20040617</le></range>
</package>
<package>
<name>ja-mutt-devel</name>
<range><le>1.5.6.j1_2</le></range>
</package>
<package>
<name>mutt-ng</name>
<range><le>20060501</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SecurityFocus reports:</p>
<blockquote cite="http://www.securityfocus.com/bid/18642">
<p>Mutt is prone to a remote buffer-overflow vulnerability.
This issue is due to the application's failure to properly
bounds-check user-supplied input before copying it to an
insufficiently sized memory buffer.</p>
<p>This issue may allow remote attackers to execute arbitrary
machine code in the context of the affected application.
Failed exploit attempts will likely crash the application,
denying further service to legitimate users.</p>
</blockquote>
</body>
</description>
<references>
<bid>18642</bid>
<url>http://dev.mutt.org/cgi-bin/gitweb.cgi?p=mutt/.git;a=commit;h=dc0272b749f0e2b102973b7ac43dbd3908507540</url>
</references>
<dates>
<discovery>2006-06-26</discovery>
<entry>2006-06-30</entry>
</dates>
</vuln>
<vuln vid="1f935f61-075d-11db-822b-728b50d539a3">
<topic>Joomla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>joomla</name>
<range><lt>1.0.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Joomla Site reports:</p>
<blockquote cite="http://www.joomla.org/content/view/1510/74/">
<ul>
<li>Secured "Remember Me" functionality against SQL injection
attacks</li>
<li>Secured "Related Items" module against SQL injection
attacks</li>
<li>Secured "Weblinks" submission against SQL injection
attacks</li>
<li>Secured SEF from XSS vulnerability</li>
<li>Hardened frontend submission forms against spoofing</li>
<li>Secured mosmsg from misuse</li>
<li>Hardened mosgetparam by setting variable type to integer if
default value is detected as numeric</li>
<li>Secured com_messages from XSS vulnerability</li>
<li>Secured getUserStateFromRequest() from XSS vulnerability</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>http://secunia.com/advisories/20746/</url>
<url>http://www.joomla.org/content/view/1510/74/</url>
</references>
<dates>
<discovery>2006-06-26</discovery>
<entry>2006-06-30</entry>
</dates>
</vuln>
<vuln vid="2be7c122-0614-11db-9156-000e0c2e438a">
<topic>hashcash -- heap overflow vulnerability</topic>
<affects>
<package>
<name>hashcash</name>
<range><lt>1.22</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Andreas Seltenreich reports that hashcash is prone to a heap
overflow vulnerability. This vulnerability is caused by
improper checking of memory allocations within the
"array_push()" function. An attacker could trigger this
vulnerability by passing a lot of "-r" or "-j" flags from
the command line, this only applies when the application is
configured to allow command line options, or by passing a lot
of resource names when the application was started with the
"-m" flag set. This could lead to a Denial or Service or
could allow remote access to the targeted system.</p>
</body>
</description>
<references>
<url>http://secunia.com/advisories/20800/</url>
<url>http://www.hashcash.org/source/CHANGELOG</url>
</references>
<dates>
<discovery>2006-06-27</discovery>
<entry>2006-06-27</entry>
</dates>
</vuln>
<vuln vid="f900bda8-0472-11db-bbf7-000c6ec775d9">
<topic>gnupg -- user id integer overflow vulnerability</topic>
<affects>
<package>
<name>gnupg</name>
<range><lt>1.4.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>If GnuPG processes a userid with a very long packet length,
GnuPG can crash due to insufficient bounds check. This can
result in a denial-of-service condition or potentially
execution of arbitrary code with the privileges of the user
running GnuPG.</p>
</body>
</description>
<references>
<bid>18554</bid>
<cvename>CVE-2006-3082</cvename>
<mlist msgid="87psgxic5e.fsf@wheatstone.g10code.de">http://marc.theaimsgroup.com/?l=gnupg-users&amp;m=115124706210430</mlist>
<mlist msgid="20060531115548.A2E4923E4B6@dzeta.agava.net">http://marc.theaimsgroup.com/?l=full-disclosure&amp;m=114907659313360</mlist>
<url>http://cvs.gnupg.org/cgi-bin/viewcvs.cgi/trunk/g10/parse-packet.c?rev=4157&amp;r1=4141&amp;r2=4157</url>
</references>
<dates>
<discovery>2006-05-31</discovery>
<entry>2006-06-25</entry>
</dates>
</vuln>
<vuln vid="0a4cd819-0291-11db-bbf7-000c6ec775d9">
<cancelled/>
</vuln>
<vuln vid="09429f7c-fd6e-11da-b1cd-0050bf27ba24">
<topic>horde -- multiple parameter cross site scripting vulnerabilities</topic>
<affects>
<package>
<name>horde</name>
<name>horde-php5</name>
<range><le>3.1.1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>FrSIRT advisory ADV-2006-2356 reports:</p>
<blockquote cite="http://www.frsirt.com/english/advisories/2006/2356">
<p>Multiple vulnerabilities have been identified in Horde
Application Framework, which may be exploited by attackers
to execute arbitrary scripting code. These flaws are due
to input validation errors in the "test.php" and
"templates/problem/problem.inc" scripts that do not
validate the "url", "name", "email", "subject" and
"message" parameters, which could be exploited by
attackers to cause arbitrary scripting code to be executed
by the user's browser in the security context of an
affected Web site.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-2195</cvename>
<url>http://www.frsirt.com/english/advisories/2006/2356</url>
<url>http://cvs.horde.org/diff.php?f=horde%2Ftest.php&amp;r1=1.145&amp;r2=1.146</url>
<url>http://cvs.horde.org/diff.php?f=horde%2Ftemplates%2Fproblem%2Fproblem.inc&amp;r1=2.25&amp;r2=2.26</url>
</references>
<dates>
<discovery>2006-06-10</discovery>
<entry>2006-06-17</entry>
</dates>
</vuln>
<vuln vid="09c92f3a-fd49-11da-995c-605724cdf281">
<topic>WebCalendar -- information disclosure vulnerability</topic>
<affects>
<package>
<name>WebCalendar</name>
<range><lt>1.0.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/20367/">
<p>socsam has discovered a vulnerability in WebCalendar,
which can be exploited by malicious people to bypass
certain security restrictions and disclose sensitive
information.</p>
<p>Input passed to the "includedir" parameter isn't properly
verified, before it is used in an "fopen()" call. This can
be exploited to load an arbitrary setting file from an
external web site.</p>
<p>This can further be exploited to disclose the content of
arbitrary files by defining the "user_inc" variable in a
malicious setting file.</p>
<p>Successful exploitation requires that "register_globals"
is enabled.</p>
</blockquote>
</body>
</description>
<references>
<bid>18175</bid>
<cvename>CVE-2006-2762</cvename>
<url>http://www.securityfocus.com/archive/1/435379</url>
<url>http://www.securityfocus.com/archive/1/436263</url>
</references>
<dates>
<discovery>2006-05-30</discovery>
<entry>2006-06-16</entry>
<modified>2006-06-17</modified>
</dates>
</vuln>
<vuln vid="c611be81-fbc2-11da-9156-000e0c2e438a">
<topic>sendmail -- Incorrect multipart message handling</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>4.11</ge><lt>4.11_19</lt></range>
<range><ge>5.3</ge><lt>5.3_31</lt></range>
<range><ge>5.4</ge><lt>5.4_16</lt></range>
<range><ge>5.5</ge><lt>5.5_2</lt></range>
<range><ge>6.0</ge><lt>6.0_9</lt></range>
<range><ge>6.1</ge><lt>6.1_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description</h1>
<p>A suitably malformed multipart MIME message can cause
sendmail to exceed predefined limits on its stack usage.</p>
<h1>Impact</h1>
<p>An attacker able to send mail to, or via, a server can cause
queued messages on the system to not be delivered, by causing
the sendmail process which handles queued messages to crash.
Note that this will not stop new messages from entering the
queue (either from local processes, or incoming via SMTP).</p>
<h1>Workaround</h1>
<p>No workaround is available, but systems which do not receive
email from untrusted sources are not vulnerable.</p>
</body>
</description>
<references>
<cvename>CVE-2006-1173</cvename>
<freebsdsa>SA-06:17.sendmail</freebsdsa>
</references>
<dates>
<discovery>2006-06-14</discovery>
<entry>2006-06-14</entry>
</dates>
</vuln>
<vuln vid="23573650-f99a-11da-994e-00142a5f241c">
<topic>dokuwiki -- multiple vulnerabilities</topic>
<affects>
<package>
<name>dokuwiki</name>
<range><lt>20060309_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Multiple vulnerabilities have been reported within dokuwiki.
dokuwiki is proven vulnerable to:</p>
<ul>
<li>arbitrary PHP code insertion via spellcheck module,</li>
<li>XSS attack via "Update your account profile,"</li>
<li>bypassing of ACL controls when enabled.</li>
</ul>
</body>
</description>
<references>
<url>http://bugs.splitbrain.org/index.php?do=details&amp;id=820</url>
<url>http://bugs.splitbrain.org/index.php?do=details&amp;id=823</url>
<url>http://bugs.splitbrain.org/index.php?do=details&amp;id=825</url>
</references>
<dates>
<discovery>2006-05-31</discovery>
<entry>2006-06-11</entry>
<modified>2006-06-12</modified>
</dates>
</vuln>
<vuln vid="107e2ee5-f941-11da-b1fa-020039488e34">
<topic>libxine -- buffer overflow vulnerability</topic>
<affects>
<package>
<name>libxine</name>
<range><lt>1.1.1_6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Secunia Advisory reports:</p>
<blockquote cite="http://secunia.com/advisories/20369">
<p>Federico L. Bossi Bonin has discovered a weakness in xine-lib,
which can be exploited by malicious people to crash certain
applications on a user's system.</p>
<p>The weakness is cause due to a heap corruption within the
"xineplug_inp_http.so" plugin when handling an overly large
reply from the HTTP server. This can be exploited to crash
an application that uses the plugin (e.g. gxine).</p>
</blockquote>
</body>
</description>
<references>
<url>http://secunia.com/advisories/20369</url>
<cvename>CVE-2006-2802</cvename>
<bid>18187</bid>
</references>
<dates>
<discovery>2006-05-31</discovery>
<entry>2006-06-11</entry>
</dates>
</vuln>
<vuln vid="cf3b9a96-f7bb-11da-9156-000e0c2e438a">
<topic>smbfs -- chroot escape</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>4.10</ge><lt>4.10_24</lt></range>
<range><ge>4.11</ge><lt>4.11_18</lt></range>
<range><ge>5.3</ge><lt>5.3_30</lt></range>
<range><ge>5.4</ge><lt>5.4_15</lt></range>
<range><ge>5.5</ge><lt>5.5_1</lt></range>
<range><ge>6.0</ge><lt>6.0_8</lt></range>
<range><ge>6.1</ge><lt>6.1_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description</h1>
<p>smbfs does not properly sanitize paths containing a backslash
character; in particular the directory name '..\' is
interpreted as the parent directory by the SMB/CIFS server,
but smbfs handles it in the same manner as any other
directory.</p>
<h1>Impact</h1>
<p>When inside a chroot environment which resides on a smbfs
mounted file-system it is possible for an attacker to escape
out of this chroot to any other directory on the smbfs
mounted file-system.</p>
<h1>Workaround</h1>
<p>Mount the smbfs file-systems which need to be used with
chroot on top, in a way so the chroot directory is exactly on
the mount point and not a sub directory</p>
</body>
</description>
<references>
<cvename>CVE-2006-2654</cvename>
<freebsdsa>SA-06:16.smbfs</freebsdsa>
</references>
<dates>
<discovery>2006-05-31</discovery>
<entry>2006-06-09</entry>
</dates>
</vuln>
<vuln vid="0ac1aace-f7b9-11da-9156-000e0c2e438a">
<topic>ypserv -- Inoperative access controls in ypserv</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>5.3</ge><lt>5.3_30</lt></range>
<range><ge>5.4</ge><lt>5.4_15</lt></range>
<range><ge>5.5</ge><lt>5.5_1</lt></range>
<range><ge>6.0</ge><lt>6.0_8</lt></range>
<range><ge>6.1</ge><lt>6.1_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description</h1>
<p>There are two documented methods of restricting access to
NIS maps through ypserv(8): through the use of the
/var/yp/securenets file, and through the /etc/hosts.allow file.
While both mechanisms are implemented in the server, a change
in the build process caused the "securenets" access restrictions
to be inadvertantly disabled.</p>
<h1>Impact</h1>
<p>ypserv(8) will not load or process any of the networks or
hosts specified in the /var/yp/securenets file, rendering
those access controls ineffective.</p>
<h1>Workaround</h1>
<p>One possible workaround is to use /etc/hosts.allow for access
control, as shown by examples in that file.</p>
<p>Another workaround is to use a firewall (e.g., ipfw(4),
ipf(4), or pf(4)) to limit access to RPC functions from
untrusted systems or networks, but due to the complexities of
RPC, it might be difficult to create a set of firewall rules
which accomplish this without blocking all access to the
machine in question.</p>
</body>
</description>
<references>
<cvename>CVE-2006-2655</cvename>
<freebsdsa>SA-06:15.ypserv</freebsdsa>
</references>
<dates>
<discovery>2006-05-31</discovery>
<entry>2006-06-09</entry>
</dates>
</vuln>
<vuln vid="ec2f2ff5-f710-11da-9156-000e0c2e438a">
<topic>freeradius -- multiple vulnerabilities</topic>
<affects>
<package>
<name>freeradius</name>
<range><ge>1.0.0</ge><le>1.0.4</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The freeradious development team reports:</p>
<blockquote cite="http://www.freeradius.org/security.html">
<p>Multiple issues exist with version 1.0.4, and all prior
versions of the server. Externally exploitable
vulnerabilities exist only for sites that use the
rlm_sqlcounter module. Those sites may be vulnerable to
SQL injection attacks, similar to the issues noted below.
All sites that have not deployed the rlm_sqlcounter module
are not vulnerable to external exploits.</p>
<p>The issues are:<br/>
SQL Injection attack in the rlm_sqlcounter module.<br/>
Buffer overflow in the rlm_sqlcounter module, that may cause
a server crash. <br/>
Buffer overflow while expanding %t, that may cause a server
crash.</p>
</blockquote>
</body>
</description>
<references>
<bid>17171</bid>
<cvename>CVE-2005-4744</cvename>
</references>
<dates>
<discovery>2005-09-09</discovery>
<entry>2006-06-08</entry>
</dates>
</vuln>
<vuln vid="1a216dfd-f710-11da-9156-000e0c2e438a">
<topic>freeradius -- authentication bypass vulnerability</topic>
<affects>
<package>
<name>freeradius</name>
<range><gt>1.0.0</gt><le>1.1.0</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The freeradius development team reports:</p>
<blockquote cite="http://www.freeradius.org/security.html">
<p>A validation issue exists with the EAP-MSCHAPv2 module
in all versions from 1.0.0 (where the module first
appeared) to 1.1.0. Insufficient input validation was being
done in the EAP-MSCHAPv2 state machine. A malicious
attacker could manipulate their EAP-MSCHAPv2 client state
machine to potentially convince the server to bypass
authentication checks. This bypassing could also result
in the server crashing</p>
</blockquote>
</body>
</description>
<references>
<bid>17293</bid>
<cvename>CVE-2006-1354</cvename>
</references>
<dates>
<discovery>2006-06-03</discovery>
<entry>2006-06-08</entry>
</dates>
</vuln>
<vuln vid="00784d6e-f4ce-11da-87a1-000c6ec775d9">
<topic>squirrelmail -- plugin.php local file inclusion vulnerability</topic>
<affects>
<package>
<name>squirrelmail</name>
<range><lt>1.4.6_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The SquirrelMail Project Team reports:</p>
<blockquote cite="http://www.squirrelmail.org/security/issue/2006-06-01">
<p>A security issue has been uncovered in
functions/plugin.php that could allow a remote user to
access local files on the server without requiring
login. This issue manifests itself if register_globals is
enabled, and magic_quotes_gpc is disabled.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.squirrelmail.org/security/issue/2006-06-01</url>
<url>http://secunia.com/advisories/20406/</url>
</references>
<dates>
<discovery>2006-06-01</discovery>
<entry>2006-06-05</entry>
<modified>2006-06-06</modified>
</dates>
</vuln>
<vuln vid="af8dba15-f4cc-11da-87a1-000c6ec775d9">
<topic>dokuwiki -- spellchecker remote PHP code execution</topic>
<affects>
<package>
<name>dokuwiki</name>
<range><lt>20060309_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Stefan Esser reports:</p>
<blockquote cite="http://www.hardened-php.net/advisory_042006.119.html">
<p>During the evaluation of DokuWiki for a german/korean
wiki of mine a flaw in DokuWiki's spellchecker was
discovered, that allows injecting arbitrary PHP commands,
by requesting a spellcheck on PHP commands in 'complex
curly syntax'.</p>
<p>Because the spellchecker is written as part of the AJAX
functionality of DokuWiki, it can be directly called by
any website visitor, without the need for a wiki
account.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.hardened-php.net/advisory_042006.119.html</url>
<url>http://bugs.splitbrain.org/index.php?do=details&amp;id=823</url>
<url>http://secunia.com/advisories/20429/</url>
</references>
<dates>
<discovery>2006-06-05</discovery>
<entry>2006-06-05</entry>
</dates>
</vuln>
<vuln vid="40a0185f-ec32-11da-be02-000c6ec775d9">
<topic>drupal -- multiple vulnerabilities</topic>
<affects>
<package>
<name>drupal</name>
<range><lt>4.6.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Drupal team reports:</p>
<blockquote cite="http://drupal.org/node/65357">
<p>Vulnerability: SQL injection</p>
<p>A security vulnerability in the database layer allowed
certain queries to be submitted to the database without
going through Drupal's query sanitizer.</p>
</blockquote>
<blockquote cite="http://drupal.org/node/65409">
<p>Vulnerability: Execution of arbitrary files</p>
<p>Certain -- alas, typical -- configurations of Apache
allows execution of carefully named arbitrary scripts in
the files directory. Drupal now will attempt to
automatically create a .htaccess file in your "files"
directory to protect you.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-2742</cvename>
<cvename>CVE-2006-2743</cvename>
<url>http://drupal.org/node/65357</url>
<url>http://drupal.org/node/65409</url>
</references>
<dates>
<discovery>2006-05-18</discovery>
<entry>2006-06-05</entry>
</dates>
</vuln>
<vuln vid="7f8cecea-f199-11da-8422-00123ffe8333">
<topic>MySQL -- SQL-injection security vulnerability</topic>
<affects>
<package>
<name>mysql-server</name>
<range><ge>5.1</ge><le>5.1.9</le></range>
<range><ge>5.0</ge><lt>5.0.22</lt></range>
<range><ge>4.1</ge><lt>4.1.20</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MySQL reports:</p>
<blockquote cite="http://lists.mysql.com/announce/364">
<p>An SQL-injection security hole has been found in multibyte
encoding processing. An SQL-injection security hole can include a
situation whereby when inserting user supplied data into a
database, the user might inject his own SQL statements that the
server will execute. With regards to this vulnerability discovered,
when character set unaware escaping is used (e.g., addslashes() in
PHP), it is possible to bypass it in some multibyte character sets
(e.g., SJIS, BIG5 and GBK). As a result, a function like
addslashes() is not able to prevent SQL injection attacks. It is
impossible to fix this on the server side. The best solution is for
applications to use character set aware escaping offered in a
function like mysql_real_escape().</p>
<p>Workarounds:</p>
<p>One can use NO_BACKSLASH_ESCAPES mode as a workaround for a bug
in mysql_real_escape_string(), if you cannot upgrade your server
for some reason. It will enable SQL standard compatibility mode,
where backslash is not considered a special character.</p>
</blockquote>
</body>
</description>
<references>
<url>http://lists.mysql.com/announce/364</url>
<url>http://lists.mysql.com/announce/365</url>
</references>
<dates>
<discovery>2006-05-31</discovery>
<entry>2006-06-01</entry>
</dates>
</vuln>
<vuln vid="4913886c-e875-11da-b9f4-00123ffe8333">
<topic>MySQL -- Information Disclosure and Buffer Overflow Vulnerabilities</topic>
<affects>
<package>
<name>mysql-server</name>
<range><gt>4.0</gt><lt>4.0.27</lt></range>
<range><gt>4.1</gt><lt>4.1.19</lt></range>
<range><gt>5.1</gt><le>5.1.9</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/19929/">
<p>MySQL have some vulnerabilities, which can be exploited by
malicious users to disclose potentially sensitive information
and compromise a vulnerable system.</p>
<p>1) An error within the code that generates an error response
to an invalid COM_TABLE_DUMP packet can be exploited by an
authenticated client to disclosure certain memory content of the
server process.</p>
<p>2) A boundary error within the handling of specially crafted
invalid COM_TABLE_DUMP packets can be exploited by an authenticated
client to cause a buffer overflow and allows arbitrary code
execution.</p>
<p>3) An error within the handling of malformed login packets can be
exploited to disclosure certain memory content of the server
process in the error messages.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-1516</cvename>
<cvename>CVE-2006-1517</cvename>
<cvename>CVE-2006-1518</cvename>
<certvu>602457</certvu>
<url>http://www.wisec.it/vulns.php?page=7</url>
<url>http://www.wisec.it/vulns.php?page=8</url>
<url>http://dev.mysql.com/doc/refman/4.1/en/news-4-0-27.html</url>
<url>http://dev.mysql.com/doc/refman/4.1/en/news-4-1-19.html</url>
<url>http://dev.mysql.com/doc/refman/5.1/en/news-5-1-10.html</url>
<url>http://secunia.com/advisories/19929/</url>
<url>http://www.vuxml.org/freebsd/a8d8713e-dc83-11da-a22b-000c6ec775d9.html</url>
</references>
<dates>
<discovery>2006-05-02</discovery>
<entry>2006-06-01</entry>
</dates>
</vuln>
<vuln vid="c0171f59-ea8a-11da-be02-000c6ec775d9">
<topic>frontpage -- cross site scripting vulnerability</topic>
<affects>
<package>
<name>frontpage</name>
<name>mod_frontpage13</name>
<name>mod_frontpage20</name>
<name>mod_frontpage21</name>
<name>mod_frontpage22</name>
<range><lt>5.0.2.4803</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Esteban Martinez Fayo reports:</p>
<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=114487846329000">
<p>The FrontPage Server Extensions 2002 (included in Windows
Sever 2003 IIS 6.0 and available as a separate download
for Windows 2000 and XP) has a web page
/_vti_bin/_vti_adm/fpadmdll.dll that is used for
administrative purposes. This web page is vulnerable to
cross site scripting attacks allowing an attacker to run
client-side script on behalf of an FPSE user. If the
victim is an administrator, the attacker could take
complete control of a Front Page Server Extensions 2002
server.</p>
<p>To exploit the vulnerability an attacker can send a
specially crafted e-mail message to a FPSE user and then
persuade the user to click a link in the e-mail
message.</p>
<p>In addition, this vulnerability can be exploited if an
attacker hosts a malicious website and persuade the user
to visit it.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-0015</cvename>
<mlist msgid="0e3f01c65e78$93c00800$de00a8c0@rigel">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=114487846329000</mlist>
<url>http://www.microsoft.com/technet/security/bulletin/MS06-017.mspx</url>
<url>http://www.rtr.com/fpsupport/fpse_release_may_2_2006.htm</url>
</references>
<dates>
<discovery>2006-04-12</discovery>
<entry>2006-05-23</entry>
</dates>
</vuln>
<vuln vid="72d8df84-ea6d-11da-8a53-00123ffe8333">
<topic>cscope -- buffer overflow vulnerabilities</topic>
<affects>
<package>
<name>cscope</name>
<range><lt>15.5_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jason Duell reports:</p>
<blockquote cite="http://sourceforge.net/tracker/index.php?func=detail&amp;aid=1064875&amp;group_id=4664&amp;atid=104664">
<p>Cscope contains an alarming number of buffer overflow
vulnerabilities. By a rough count, there are at least 48 places
where we blindly sprintf() a file name into a fixed-length buffer
of size PATHLEN without checking to see if the file's name
is &lt;= PATHLEN. We do similar things with environment variable
values.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2004-2541</cvename>
<url>http://sourceforge.net/tracker/index.php?func=detail&amp;aid=1064875&amp;group_id=4664&amp;atid=104664</url>
<url>http://secunia.com/advisories/13237</url>
</references>
<dates>
<discovery>2004-11-11</discovery>
<entry>2006-05-23</entry>
</dates>
</vuln>
<vuln vid="0b628470-e9a6-11da-b9f4-00123ffe8333">
<topic>coppermine -- Multiple File Extensions Vulnerability</topic>
<affects>
<package>
<name>coppermine</name>
<range><lt>1.4.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/20211/">
<p>Coppermine Photo Gallery have a vulnerability, which can be
exploited by malicious users to compromise a vulnerable system.</p>
<p>The vulnerability is caused due to an error in the handling of
file uploads where a filename has multiple file extensions. This
can be exploited to upload malicious script files inside the web
root (e.g. a PHP script).</p>
<p>Successful exploitation may allow execution of script code
depending on the HTTP server configuration (it requires e.g. an
Apache server with the "mod_mime" module installed).</p>
</blockquote>
</body>
</description>
<references>
<url>http://sourceforge.net/project/shownotes.php?group_id=89658&amp;release_id=418266</url>
<url>http://secunia.com/advisories/20211/</url>
</references>
<dates>
<discovery>2006-05-22</discovery>
<entry>2006-05-22</entry>
</dates>
</vuln>
<vuln vid="6738977b-e9a5-11da-b9f4-00123ffe8333">
<topic>coppermine -- "file" Local File Inclusion Vulnerability</topic>
<affects>
<package>
<name>coppermine</name>
<range><lt>1.4.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/19665/">
<p>Coppermine Photo Gallery have a vulnerability, which can be
exploited by malicious people to disclose sensitive
information.</p>
<p>Input passed to the "file" parameter in "index.php" isn't properly
verified, before it is used to include files. This can be exploited
to include arbitrary files from local resources.</p>
<p>Example:
http://[host]/index.php?file=.//././/././/././/./[file]%00</p>
<p>Successful exploitation requires that "magic_quotes_gpc" is
disabled.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-1909</cvename>
<url>http://coppermine-gallery.net/forum/index.php?topic=30655.0</url>
<url>http://myimei.com/security/2006-04-14/copperminephotogallery144-plugininclusionsystemindexphp-remotefileinclusion-attack.html</url>
<url>http://secunia.com/advisories/19665/</url>
</references>
<dates>
<discovery>2006-04-19</discovery>
<entry>2006-05-22</entry>
</dates>
</vuln>
<vuln vid="77cceaef-e9a4-11da-b9f4-00123ffe8333">
<topic>coppermine -- File Inclusion Vulnerabilities</topic>
<affects>
<package>
<name>coppermine</name>
<range><lt>1.4.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/18941/">
<p>Coppermine Photo Gallery have a vulnerability, which can be
exploited by malicious people and by malicious users to compromise
a vulnerable system.</p>
<p>1) Input passed to the "lang" parameter in include/init.inc.php
isn't properly verified, before it is used to include files. This
can be exploited to include arbitrary files from local resources.
The vulnerability can be further exploited by users who are allowed
to upload image files to execute arbitrary PHP code.</p>
<p>2) Input passed to the "f" parameter in docs/showdoc.php isn't
properly verified, before it is used to include files. This can be
exploited to include arbitrary files from local resources on the
Windows platform, and remote files from Windows shared folders.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-0872</cvename>
<cvename>CVE-2006-0873</cvename>
<url>http://retrogod.altervista.org/cpg_143_adv.html</url>
<url>http://secunia.com/advisories/18941/</url>
</references>
<dates>
<discovery>2006-02-20</discovery>
<entry>2006-05-22</entry>
</dates>
</vuln>
<vuln vid="2ecd02e2-e864-11da-b9f4-00123ffe8333">
<topic>phpmyadmin -- XSRF vulnerabilities</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<range><lt>2.8.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>phpMyAdmin security team reports:</p>
<blockquote cite="http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-3">
<p>It was possible to inject arbitrary SQL commands by forcing an
authenticated user to follow a crafted link.</p>
<p>Such issue is quite common in many PHP applications and users
should take care what links they follow. We consider these
vulnerabilities to be quite dangerous.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-1804</cvename>
<url>http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-3</url>
<url>http://secunia.com/advisories/19659</url>
</references>
<dates>
<discovery>2006-05-20</discovery>
<entry>2006-05-21</entry>
</dates>
</vuln>
<vuln vid="4645b98c-e46e-11da-9ae7-00123fcc6e5c">
<topic>vnc -- authentication bypass vulnerability</topic>
<affects>
<package>
<name>vnc</name>
<range><eq>4.1.1</eq></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>RealVNC is susceptible to an authentication-bypass vulnerability.
A malicious VNC client can cause a VNC server to allow it to connect
without any authentication regardless of the authentication settings
configured in the server. Exploiting this issue allows attackers to
gain unauthenticated, remote access to the VNC servers.</p>
</body>
</description>
<references>
<bid>17978</bid>
<mlist>http://www.securityfocus.com/archive/1/433994/30/0/threaded</mlist>
</references>
<dates>
<discovery>2006-05-15</discovery>
<entry>2006-05-18</entry>
</dates>
</vuln>
<vuln vid="6d78202e-e2f9-11da-8674-00123ffe8333">
<topic>phpldapadmin -- Cross-Site Scripting and Script Insertion vulnerabilities</topic>
<affects>
<package>
<name>phpldapadmin098</name>
<range><lt>0.9.8.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/19747/">
<p>phpLDAPadmin have some vulnerabilities, which can be exploited by
malicious users to conduct script insertion attacks and by
malicious people to conduct cross-site scripting attacks.</p>
<p>1) Some input isn't properly sanitised before being returned to
the user. This can be exploited to execute arbitrary HTML and
script code in a user's browser session in context of an affected
site.</p>
<p>2) Input passed to the "Container DN", "Machine Name", and "UID
Number" parameters in "template_engine.php" isn't properly
sanitised before being used. This can be exploited to inject
arbitrary HTML and script code, which will be executed in a user's
browser session in context of an affected site when the malicious
user data is viewed.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-2016</cvename>
<url>http://pridels.blogspot.com/2006/04/phpldapadmin-multiple-vuln.html</url>
<url>http://www.frsirt.com/english/advisories/2006/1450</url>
<url>http://secunia.com/advisories/19747/</url>
</references>
<dates>
<discovery>2006-04-21</discovery>
<entry>2006-05-14</entry>
</dates>
</vuln>
<vuln vid="a86f30e7-dce7-11da-bf3f-02e081235dab">
<topic>fswiki -- XSS vulnerability</topic>
<affects>
<package>
<name>fswiki</name>
<range><lt>3.5.11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>JVN reports:</p>
<blockquote cite="http://jvn.jp/jp/JVN%2335274905/">
<p>FreeStyleWiki has XSS vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<url>http://jvn.jp/jp/JVN%2335274905/</url>
</references>
<dates>
<discovery>2006-04-18</discovery>
<entry>2006-05-06</entry>
</dates>
</vuln>
<vuln vid="a8d8713e-dc83-11da-a22b-000c6ec775d9">
<topic>mysql50-server -- COM_TABLE_DUMP arbitrary code execution</topic>
<affects>
<package>
<name>mysql-server</name>
<range><gt>5.0</gt><lt>5.0.21</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Stefano Di Paola reports:</p>
<blockquote cite="http://www.wisec.it/vulns.php?page=8">
<p>An authenticated user could remotely execute arbitrary
commands by taking advantage of a stack overflow.</p>
<p>To take advantage of these flaws an attacker should have
direct access to MySQL server communication layer (port
3306 or unix socket). But if used in conjuction with some
web application flaws (i.e. php code injection) an
attacker could use socket programming (i.e. php sockets)
to gain access to that layer.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-1518</cvename>
<url>http://www.wisec.it/vulns.php?page=8</url>
<mlist msgid="1146577257.5679.217.camel@first">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=114659633220473</mlist>
<url>http://dev.mysql.com/doc/refman/5.0/en/news-5-0-21.html</url>
</references>
<dates>
<discovery>2006-05-02</discovery>
<entry>2006-05-06</entry>
</dates>
</vuln>
<vuln vid="2df297a2-dc74-11da-a22b-000c6ec775d9">
<topic>awstats -- arbitrary command execution vulnerability</topic>
<affects>
<package>
<name>awstats</name>
<range><lt>6.5_2,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>OS Reviews reports:</p>
<blockquote cite="http://www.osreviews.net/reviews/comm/awstats">
<p>If the update of the stats via web front-end is allowed,
a remote attacker can execute arbitrary code on the server
using a specially crafted request involving the migrate
parameter. Input starting with a pipe character ("|")
leads to an insecure call to Perl's open function and the
rest of the input being executed in a shell. The code is
run in the context of the process running the AWStats
CGI.</p>
<p>Arbitrary code can be executed by uploading a specially
crafted configuration file if an attacker can put a file
on the server with chosen file name and content (e.g. by
using an FTP account on a shared hosting server). In this
configuration file, the LogFile directive can be used to
execute shell code following a pipe character. As above,
an open call on unsanitized input is the source of this
vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<url>http://awstats.sourceforge.net/awstats_security_news.php</url>
<url>http://secunia.com/advisories/19969/</url>
<url>http://www.osreviews.net/reviews/comm/awstats</url>
</references>
<dates>
<discovery>2006-05-03</discovery>
<entry>2006-05-05</entry>
<modified>2006-11-15</modified>
</dates>
</vuln>
<vuln vid="d9dc2697-dadf-11da-912f-00123ffe8333">
<topic>phpwebftp -- "language" Local File Inclusion</topic>
<affects>
<package>
<name>phpwebftp</name>
<range><lt>3.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/19706/">
<p>phpWebFTP have a vulnerability, which can be exploited by
malicious people to disclose sensitive information.</p>
<p>Input passed to the "language" parameter in index.php isn't
properly verified, before it is used to include files. This can be
exploited to include arbitrary files from local resources.</p>
<p>Successful exploitation requires that "magic_quotes_gpc" is
disabled.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-1812</cvename>
<cvename>CVE-2006-1813</cvename>
<url>https://sourceforge.net/forum/forum.php?forum_id=566199</url>
<url>http://secunia.com/advisories/19706/</url>
</references>
<dates>
<discovery>2006-04-18</discovery>
<entry>2006-05-03</entry>
</dates>
</vuln>
<vuln vid="e2476979-da74-11da-a67b-0013d4a4a40e">
<topic>firefox -- denial of service vulnerability</topic>
<affects>
<package>
<name>firefox</name>
<range><gt>1.5.*,1</gt><lt>1.5.0.3,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>1.5.0.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Mozilla Foundation Security Advisory reports for
deleted object reference when designMode="on"</p>
<blockquote cite="http://www.mozilla.org/security/announce/2006/mfsa2006-30.html">
<p>Martijn Wargers and Nick Mott each described crashes that
were discovered to ultimately stem from the same root cause:
attempting to use a deleted controller context when designMode
was turned on. This generally results in crashing the browser,
but in theory references to deleted objects can be abused to
run malicious code.</p>
<p>"splices" reported the same crash at the fan site MozillaZine and
on Bugtraq, incorrectly describing it as a buffer overflow.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-1993</cvename>
<url>http://www.mozilla.org/security/announce/2006/mfsa2006-30.html</url>
</references>
<dates>
<discovery>2006-05-02</discovery>
<entry>2006-05-03</entry>
<modified>2006-05-05</modified>
</dates>
</vuln>
<vuln vid="400d9d22-d6c5-11da-a14b-00123ffe8333">
<topic>trac -- Wiki Macro Script Insertion Vulnerability</topic>
<affects>
<package>
<name>trac</name>
<name>ja-trac</name>
<range><lt>0.9.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/19870/">
<p>A vulnerability has been reported, which can be exploited by
malicious people to conduct script insertion attacks.</p>
<p>Input passed using the wiki macro isn't properly sanitised before
being used. This can be exploited to inject arbitrary HTML and
script code, which will be executed in a user's browser session in
context of an affected site when the malicious user data is
viewed.</p>
</blockquote>
</body>
</description>
<references>
<url>http://projects.edgewall.com/trac/wiki/ChangeLog</url>
<url>http://jvn.jp/jp/JVN%2384091359/index.html</url>
<url>http://secunia.com/advisories/19870/</url>
</references>
<dates>
<discovery>2006-04-28</discovery>
<entry>2006-05-02</entry>
</dates>
</vuln>
<vuln vid="af2a60ed-da3e-11da-93e0-00123ffe8333">
<cancelled/>
</vuln>
<vuln vid="b088bf48-da3b-11da-93e0-00123ffe8333">
<topic>clamav -- Freshclam HTTP Header Buffer Overflow Vulnerability</topic>
<affects>
<package>
<name>clamav</name>
<range><ge>0.80</ge><lt>0.88.2</lt></range>
</package>
<package>
<name>clamav-devel</name>
<range><ge>20040826</ge><lt>20060502</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/19880/">
<p>A vulnerability has been reported in ClamAV, which can be
exploited by malicious people to cause a DoS (Denial of Service)
and potentially to compromise a vulnerable system.</p>
<p>The vulnerability is caused due to a boundary error within the
HTTP client in the Freshclam command line utility. This can be
exploited to cause a stack-based buffer overflow when the HTTP
headers received from a web server exceeds 8KB.</p>
<p>Successful exploitation requires that Freshclam is used to
download virus signature updates from a malicious mirror web
server e.g. via DNS poisoning.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-1989</cvename>
<url>http://www.clamav.net/security/0.88.2.html</url>
<url>http://secunia.com/advisories/19880/</url>
</references>
<dates>
<discovery>2006-05-01</discovery>
<entry>2006-05-03</entry>
</dates>
</vuln>
<vuln vid="f4af098d-d921-11da-ad4a-00123ffe8333">
<topic>jabberd -- SASL Negotiation Denial of Service Vulnerability</topic>
<affects>
<package>
<name>jabberd</name>
<range><lt>2.0.11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/19281/">
<p>A vulnerability has been reported in jabberd, which can be
exploited by malicious people to cause a DoS (Denial of
Service).</p>
<p>The vulnerability is caused due to an error within the handling
of SASL negotiation. This can be exploited to cause a crash by
sending a "response" stanza before an "auth" stanza.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-1329</cvename>
<url>http://article.gmane.org/gmane.network.jabber.admin/27372</url>
<url>http://jabberstudio.org/projects/jabberd2/releases/view.php?id=826</url>
<url>http://secunia.com/advisories/19281/</url>
</references>
<dates>
<discovery>2006-03-20</discovery>
<entry>2006-05-01</entry>
</dates>
</vuln>
<vuln vid="79c1154d-d5a5-11da-8098-00123ffe8333">
<topic>cacti -- ADOdb "server.php" Insecure Test Script Security Issue</topic>
<affects>
<package>
<name>cacti</name>
<range><lt>0.8.6h</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/18276/">
<p>Cacti have a security issue, which can be exploited by malicious
people to execute arbitrary SQL code and potentially compromise a
vulnerable system.</p>
<p>The problem is caused due to the presence of the insecure
"server.php" test script.</p>
</blockquote>
</body>
</description>
<references>
<url>http://secunia.com/advisories/18276/</url>
<url>http://secunia.com/advisories/17418/</url>
</references>
<dates>
<discovery>2006-01-09</discovery>
<entry>2006-04-27</entry>
</dates>
</vuln>
<vuln vid="dc930435-d59f-11da-8098-00123ffe8333">
<topic>amaya -- Attribute Value Buffer Overflow Vulnerabilities</topic>
<affects>
<package>
<name>amaya</name>
<range><lt>9.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/19670/">
<p>Amaya have two vulnerabilities, which can be exploited by
malicious people to compromise a user's system.</p>
<p>The vulnerabilities are caused due to boundary errors within the
parsing of various attribute values. This can be exploited to cause
stack-based buffer overflows when a user opens a specially crafted
HTML document containing certain tags with overly long attribute
values.</p>
<p>Successful exploitation allows execution of arbitrary code.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-1900</cvename>
<url>http://morph3us.org/advisories/20060412-amaya-94.txt</url>
<url>http://morph3us.org/advisories/20060412-amaya-94-2.txt</url>
<url>http://secunia.com/advisories/19670/</url>
</references>
<dates>
<discovery>2006-04-14</discovery>
<entry>2006-04-27</entry>
</dates>
</vuln>
<vuln vid="116b0820-d59c-11da-8098-00123ffe8333">
<topic>lifetype -- ADOdb "server.php" Insecure Test Script Security Issue</topic>
<affects>
<package>
<name>lifetype</name>
<range><lt>1.0.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/19699/">
<p>A security issue has been discovered in LifeType, which can be
exploited by malicious people to execute arbitrary SQL code and
potentially compromise a vulnerable system.</p>
<p>The problem is caused due to the presence of the insecure
"server.php" test script.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-0146</cvename>
<url>http://secunia.com/advisories/19699/</url>
<url>http://secunia.com/advisories/17418/</url>
</references>
<dates>
<discovery>2006-04-19</discovery>
<entry>2006-04-27</entry>
</dates>
</vuln>
<vuln vid="21c223f2-d596-11da-8098-00123ffe8333">
<topic>ethereal -- Multiple Protocol Dissector Vulnerabilities</topic>
<affects>
<package>
<name>ethereal</name>
<name>ethereal-lite</name>
<name>tethereal</name>
<name>tethereal-lite</name>
<range><ge>0.8.5</ge><lt>0.99.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/19769/">
<p>Multiple vulnerabilities have been reported in Ethereal, which
can be exploited by malicious people to cause a DoS (Denial of
Service) or compromise a vulnerable system.</p>
<p>The vulnerabilities are caused due to various types of errors
including boundary errors, an off-by-one error, an infinite loop
error, and several unspecified errors in a multitude of protocol
dissectors.</p>
<p>Successful exploitation causes Ethereal to stop responding,
consume a large amount of system resources, crash, or execute
arbitrary code.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-1932</cvename>
<cvename>CVE-2006-1933</cvename>
<cvename>CVE-2006-1934</cvename>
<cvename>CVE-2006-1935</cvename>
<cvename>CVE-2006-1936</cvename>
<cvename>CVE-2006-1937</cvename>
<cvename>CVE-2006-1938</cvename>
<cvename>CVE-2006-1939</cvename>
<cvename>CVE-2006-1940</cvename>
<url>http://www.ethereal.com/appnotes/enpa-sa-00023.html</url>
<url>http://secunia.com/advisories/19769/</url>
</references>
<dates>
<discovery>2006-04-25</discovery>
<entry>2006-04-27</entry>
</dates>
</vuln>
<vuln vid="8b683bea-d49c-11da-a672-000e0c2e438a">
<topic>asterisk -- denial of service vulnerability, local system access</topic>
<affects>
<package>
<name>asterisk</name>
<range><lt>1.2.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Emmanouel Kellenis reports a denial of service vulnerability
within asterisk. The vulnerability is caused by a buffer
overflow in "format_jpeg.c". A large JPEG image could
trigger this bug, potentially allowing a local attacker to
execute arbitrary code.</p>
</body>
</description>
<references>
<bid>17561</bid>
<cvename>CVE-2006-1827</cvename>
<url>http://www.cipher.org.uk/index.php?p=advisories/Asterisk_Codec_Integer_Overflow_07-04-2006.advisory</url>
</references>
<dates>
<discovery>2006-04-07</discovery>
<entry>2006-04-25</entry>
</dates>
</vuln>
<vuln vid="a813a219-d2d4-11da-a672-000e0c2e438a">
<topic>zgv, xzgv -- heap overflow vulnerability</topic>
<affects>
<package>
<name>zgv</name>
<range><lt>5.9_1</lt></range>
</package>
<package>
<name>xzgv</name>
<range><lt>0.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gentoo reports:</p>
<blockquote cite="http://www.gentoo.org/security/en/glsa/glsa-200604-10.xml">
<p>Andrea Barisani of Gentoo Linux discovered xzgv and zgv
allocate insufficient memory when rendering images with
more than 3 output components, such as images using the
YCCK or CMYK colour space. When xzgv or zgv attempt to
render the image, data from the image overruns a heap
allocated buffer.</p>
<p>An attacker may be able to construct a malicious image that
executes arbitrary code with the permissions of the xzgv or
zgv user when attempting to render the image.</p>
</blockquote>
</body>
</description>
<references>
<bid>17409</bid>
<cvename>CVE-2006-1060</cvename>
<url>http://www.gentoo.org/security/en/glsa/glsa-200604-10.xml</url>
</references>
<dates>
<discovery>2006-04-21</discovery>
<entry>2006-04-23</entry>
<modified>2010-03-22</modified>
</dates>
</vuln>
<vuln vid="86cc5c6f-d2b4-11da-a672-000e0c2e438a">
<topic>crossfire-server -- denial of service and remote code execution vulnerability</topic>
<affects>
<package>
<name>crossfire-server</name>
<range><lt>1.9.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>FRSIRT reports:</p>
<blockquote cite="http://www.frsirt.com/english/advisories/2006/0760">
<p>A vulnerability has been identified in CrossFire, which
could be exploited by remote attackers to execute arbitrary
commands or cause a denial of service. This flaw is due to
a buffer overflow error in the "oldsocketmode" module that
fails to properly handle overly large requests, which could
be exploited by a malicious client to crash or compromise a
vulnerable system.</p>
</blockquote>
</body>
</description>
<references>
<bid>16883</bid>
<cvename>CVE-2006-1010</cvename>
<url>http://www.frsirt.com/english/advisories/2006/0760</url>
</references>
<dates>
<discovery>2006-02-28</discovery>
<entry>2006-04-23</entry>
</dates>
</vuln>
<vuln vid="8cfb6f42-d2b0-11da-a672-000e0c2e438a">
<topic>p5-DBI -- insecure temporary file creation vulnerability</topic>
<affects>
<package>
<name>p5-DBI-137</name>
<range><ge>0</ge></range>
</package>
<package>
<name>p5-DBI</name>
<range><lt>1.37_1</lt></range>
<range><ge>1.38</ge><lt>1.48</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Javier Fernández-Sanguino Peña reports:</p>
<blockquote cite="http://www.debian.org/security/2005/dsa-658">
<p>The DBI library, the Perl5 database interface, creates a
temporary PID file in an insecure manner. This can be
exploited by a malicious user to overwrite arbitrary files
owned by the person executing the parts of the library.</p>
</blockquote>
</body>
</description>
<references>
<bid>12360</bid>
<cvename>CAN-2005-0077</cvename>
<url>http://www.debian.org/security/2005/dsa-658</url>
</references>
<dates>
<discovery>2005-01-25</discovery>
<entry>2006-04-23</entry>
<modified>2006-05-11</modified>
</dates>
</vuln>
<vuln vid="e0b342a1-d2ae-11da-a672-000e0c2e438a">
<topic>wordpress -- full path disclosure</topic>
<affects>
<package>
<name>wordpress</name>
<range><lt>1.5.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Dedi Dwianto reports:</p>
<blockquote cite="http://echo.or.id/adv/adv24-theday-2005.txt">
<p>A remote user can access the file directly to cause the
system to display an error message that indicates the
installation path. The resulting error message will
disclose potentially sensitive installation path
information to the remote attacker.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2005-4463</cvename>
<url>http://echo.or.id/adv/adv24-theday-2005.txt</url>
</references>
<dates>
<discovery>2005-12-20</discovery>
<entry>2006-04-23</entry>
</dates>
</vuln>
<vuln vid="8d4ae57d-d2ab-11da-a672-000e0c2e438a">
<topic>xine -- multiple remote string vulnerabilities</topic>
<affects>
<package>
<name>xine</name>
<range><lt>0.99.4_4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>c0ntexb reports:</p>
<blockquote cite="http://www.open-security.org/advisories/16">
<p>There are 2 format string bugs in the latest version of
Xine that could be exploited by a malicious person to
execute code on the system of a remote user running the
media player against a malicious playlist file. By passing
a format specifier in the path of a file that is embedded
in a remote playlist, it is possible to trigger this bug.</p>
</blockquote>
</body>
</description>
<references>
<bid>17579</bid>
<cvename>CVE-2006-1905</cvename>
<url>http://www.open-security.org/advisories/16</url>
</references>
<dates>
<discovery>2006-04-18</discovery>
<entry>2006-04-23</entry>
</dates>
</vuln>
<vuln vid="408f6ebf-d152-11da-962f-000b972eb521">
<topic>cyrus-sasl -- DIGEST-MD5 Pre-Authentication Denial of Service</topic>
<affects>
<package>
<name>cyrus-sasl</name>
<range><ge>2.*</ge><lt>2.1.21</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Unspecified vulnerability in the CMU Cyrus Simple
Authentication and Security Layer (SASL) library, has unknown
impact and remote unauthenticated attack vectors, related to
DIGEST-MD5 negotiation.</p>
</body>
</description>
<references>
<cvename>CVE-2006-1721</cvename>
</references>
<dates>
<discovery>2006-04-11</discovery>
<entry>2006-04-22</entry>
</dates>
</vuln>
<vuln vid="1fa4c9f1-cfca-11da-a672-000e0c2e438a">
<topic>FreeBSD -- FPU information disclosure</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>6.0</ge><lt>6.0_7</lt></range>
<range><ge>5.4</ge><lt>5.4_14</lt></range>
<range><ge>5.3</ge><lt>5.3_29</lt></range>
<range><ge>5</ge><lt>5.3</lt></range>
<range><ge>4.11</ge><lt>4.11_17</lt></range>
<range><ge>4.10</ge><lt>4.10_23</lt></range>
<range><lt>4.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description</h1>
<p>On "7th generation" and "8th generation" processors
manufactured by AMD, including the AMD Athlon, Duron, Athlon
MP, Athlon XP, Athlon64, Athlon64 FX, Opteron, Turion, and
Sempron, the fxsave and fxrstor instructions do not save and
restore the FOP, FIP, and FDP registers unless the exception
summary bit (ES) in the x87 status word is set to 1,
indicating that an unmasked x87 exception has occurred.</p>
<p>This behaviour is consistent with documentation provided by
AMD, but is different from processors from other vendors,
which save and restore the FOP, FIP, and FDP registers
regardless of the value of the ES bit. As a result of this
discrepancy remaining unnoticed until now, the FreeBSD kernel
does not restore the contents of the FOP, FIP, and FDP
registers between context switches.</p>
<h1>Impact</h1>
<p>On affected processors, a local attacker can monitor the
execution path of a process which uses floating-point
operations. This may allow an attacker to steal
cryptographic keys or other sensitive information.</p>
<h1>Workaround</h1>
<p>No workaround is available, but systems which do not use AMD
Athlon, Duron, Athlon MP, Athlon XP, Athlon64, Athlon64 FX,
Opteron, Turion, or Sempron processors are not vulnerable.</p>
</body>
</description>
<references>
<cvename>CVE-2006-1056</cvename>
<freebsdsa>SA-06:14.fpu</freebsdsa>
</references>
<dates>
<discovery>2006-04-19</discovery>
<entry>2006-04-19</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="22c6b826-cee0-11da-8578-00123ffe8333">
<topic>plone -- "member_id" Parameter Portrait Manipulation Vulnerability</topic>
<affects>
<package>
<name>plone</name>
<range><lt>2.1.2_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/19633/">
<p>The vulnerability is caused due to missing security declarations
in "changeMemberPortrait" and "deletePersonalPortrait". This can
be exploited to manipulate or delete another user's portrait via
the "member_id" parameter.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-1711</cvename>
<url>http://dev.plone.org/plone/ticket/5432</url>
<url>http://www.debian.org/security/2006/dsa-1032</url>
<url>http://secunia.com/advisories/19633/</url>
</references>
<dates>
<discovery>2006-04-13</discovery>
<entry>2006-04-18</entry>
</dates>
</vuln>
<vuln vid="84630f4a-cd8c-11da-b7b9-000c6ec775d9">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>1.0.8,1</lt></range>
<range><gt>1.5.*,1</gt><lt>1.5.0.2,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>1.5.0.2</lt></range>
</package>
<package>
<name>mozilla</name>
<range><lt>1.7.13,2</lt></range>
<range><ge>1.8.*,2</ge></range>
</package>
<package>
<name>linux-mozilla</name>
<range><lt>1.7.13</lt></range>
</package>
<package>
<name>linux-mozilla-devel</name>
<range><gt>0</gt></range>
</package>
<package>
<name>seamonkey</name>
<name>linux-seamonkey</name>
<range><lt>1.0.1</lt></range>
</package>
<package>
<name>thunderbird</name>
<name>mozilla-thunderbird</name>
<range><lt>1.5.0.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Mozilla Foundation Security Advisory reports of multiple
issues. Several of which can be used to run arbitrary code
with the privilege of the user running the program.</p>
<blockquote cite="http://www.mozilla.org/security/announce/">
<ul>
<li>MFSA 2006-29 Spoofing with translucent windows</li>
<li>MFSA 2006-28 Security check of js_ValueToFunctionObject() can be circumvented</li>
<li>MFSA 2006-26 Mail Multiple Information Disclosure</li>
<li>MFSA 2006-25 Privilege escalation through Print Preview</li>
<li>MFSA 2006-24 Privilege escalation using crypto.generateCRMFRequest</li>
<li>MFSA 2006-23 File stealing by changing input type</li>
<li>MFSA 2006-22 CSS Letter-Spacing Heap Overflow Vulnerability</li>
<li>MFSA 2006-20 Crashes with evidence of memory corruption (rv:1.8.0.2)</li>
<li>MFSA 2006-19 Cross-site scripting using .valueOf.call()</li>
<li>MFSA 2006-18 Mozilla Firefox Tag Order Vulnerability</li>
<li>MFSA 2006-17 cross-site scripting through window.controllers</li>
<li>MFSA 2006-16 Accessing XBL compilation scope via valueOf.call()</li>
<li>MFSA 2006-15 Privilege escalation using a JavaScript function's cloned parent</li>
<li>MFSA 2006-14 Privilege escalation via XBL.method.eval</li>
<li>MFSA 2006-13 Downloading executables with "Save Image As..."</li>
<li>MFSA 2006-12 Secure-site spoof (requires security warning dialog)</li>
<li>MFSA 2006-11 Crashes with evidence of memory corruption (rv:1.8)</li>
<li>MFSA 2006-10 JavaScript garbage-collection hazard audit</li>
<li>MFSA 2006-09 Cross-site JavaScript injection using event handlers</li>
</ul>
</blockquote>
</body>
</description>
<references>
<certvu>179014</certvu>
<certvu>252324</certvu>
<certvu>329500</certvu>
<certvu>350262</certvu>
<certvu>488774</certvu>
<certvu>736934</certvu>
<certvu>813230</certvu>
<certvu>842094</certvu>
<certvu>932734</certvu>
<certvu>935556</certvu>
<certvu>968814</certvu>
<cvename>CVE-2006-0749</cvename>
<cvename>CVE-2006-1045</cvename>
<cvename>CVE-2006-1529</cvename>
<cvename>CVE-2006-1530</cvename>
<cvename>CVE-2006-1531</cvename>
<cvename>CVE-2006-1723</cvename>
<cvename>CVE-2006-1724</cvename>
<cvename>CVE-2006-1725</cvename>
<cvename>CVE-2006-1726</cvename>
<cvename>CVE-2006-1727</cvename>
<cvename>CVE-2006-1728</cvename>
<cvename>CVE-2006-1729</cvename>
<cvename>CVE-2006-1730</cvename>
<cvename>CVE-2006-1731</cvename>
<cvename>CVE-2006-1732</cvename>
<cvename>CVE-2006-1733</cvename>
<cvename>CVE-2006-1734</cvename>
<cvename>CVE-2006-1735</cvename>
<cvename>CVE-2006-1736</cvename>
<cvename>CVE-2006-1737</cvename>
<cvename>CVE-2006-1738</cvename>
<cvename>CVE-2006-1739</cvename>
<cvename>CVE-2006-1740</cvename>
<cvename>CVE-2006-1741</cvename>
<cvename>CVE-2006-1742</cvename>
<cvename>CVE-2006-1790</cvename>
<url>http://www.mozilla.org/security/announce/2006/mfsa2006-09.html</url>
<url>http://www.mozilla.org/security/announce/2006/mfsa2006-10.html</url>
<url>http://www.mozilla.org/security/announce/2006/mfsa2006-11.html</url>
<url>http://www.mozilla.org/security/announce/2006/mfsa2006-12.html</url>
<url>http://www.mozilla.org/security/announce/2006/mfsa2006-13.html</url>
<url>http://www.mozilla.org/security/announce/2006/mfsa2006-14.html</url>
<url>http://www.mozilla.org/security/announce/2006/mfsa2006-15.html</url>
<url>http://www.mozilla.org/security/announce/2006/mfsa2006-16.html</url>
<url>http://www.mozilla.org/security/announce/2006/mfsa2006-17.html</url>
<url>http://www.mozilla.org/security/announce/2006/mfsa2006-18.html</url>
<url>http://www.mozilla.org/security/announce/2006/mfsa2006-19.html</url>
<url>http://www.mozilla.org/security/announce/2006/mfsa2006-20.html</url>
<url>http://www.mozilla.org/security/announce/2006/mfsa2006-22.html</url>
<url>http://www.mozilla.org/security/announce/2006/mfsa2006-23.html</url>
<url>http://www.mozilla.org/security/announce/2006/mfsa2006-25.html</url>
<url>http://www.mozilla.org/security/announce/2006/mfsa2006-26.html</url>
<url>http://www.mozilla.org/security/announce/2006/mfsa2006-28.html</url>
<url>http://www.mozilla.org/security/announce/2006/mfsa2006-29.html</url>
<url>http://www.zerodayinitiative.com/advisories/ZDI-06-010.html</url>
<uscertta>TA06-107A</uscertta>
</references>
<dates>
<discovery>2006-04-13</discovery>
<entry>2006-04-16</entry>
<modified>2006-04-27</modified>
</dates>
</vuln>
<vuln vid="8be2e304-cce6-11da-a3b1-00123ffe8333">
<topic>mailman -- Private Archive Script Cross-Site Scripting</topic>
<affects>
<package>
<name>mailman</name>
<name>ja-mailman</name>
<name>mailman-with-htdig</name>
<range><lt>2.1.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/19558/">
<p>A vulnerability has been reported in Mailman, which can be
exploited by malicious people to conduct cross-site scripting
attacks.</p>
<p>Unspecified input passed to the private archive script is not
properly sanitised before being returned to users. This can be
exploited to execute arbitrary HTML and script code in a user's
browser session in context of a vulnerable site.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-1712</cvename>
<mlist>http://mail.python.org/pipermail/mailman-announce/2006-April/000084.html</mlist>
<url>http://secunia.com/advisories/19558/</url>
</references>
<dates>
<discovery>2006-04-07</discovery>
<entry>2006-04-16</entry>
</dates>
</vuln>
<vuln vid="43cb40b3-c8c2-11da-a672-000e0c2e438a">
<topic>f2c -- insecure temporary files</topic>
<affects>
<package>
<name>f2c</name>
<range><lt>20060506</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Javier Fernández-Sanguino Peña reports two temporary file
vulnerability within f2c. The vulnerabilities are caused
due to weak temporary file handling. An attacker could
create an symbolic link, causing a local user running f2c
to overwrite the symlinked file. This could give the
attacker elevated privileges.</p>
</body>
</description>
<references>
<bid>1280</bid>
<cvename>CAN-2005-0017</cvename>
</references>
<dates>
<discovery>2005-01-27</discovery>
<entry>2006-04-10</entry>
<modified>2006-08-15</modified>
</dates>
</vuln>
<vuln vid="c7526a14-c4dc-11da-9699-00123ffe8333">
<topic>mplayer -- Multiple integer overflows</topic>
<affects>
<package>
<name>mplayer</name>
<name>mplayer-esound</name>
<name>mplayer-gtk</name>
<name>mplayer-gtk2</name>
<name>mplayer-gtk-esound</name>
<name>mplayer-gtk2-esound</name>
<range><lt>0.99.7_12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/19418/">
<p>The vulnerabilities are caused due to integer overflow errors
in "libmpdemux/asfheader.c" within the handling of an ASF file,
and in "libmpdemux/aviheader.c" when parsing the "indx" chunk in
an AVI file. This can be exploited to cause heap-based buffer
overflows via a malicious ASF file, or via a AVI file with
specially-crafted "wLongsPerEntry" and "nEntriesInUse" values in
the "indx" chunk.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-1502</cvename>
<url>http://www.xfocus.org/advisories/200603/11.html</url>
<url>http://secunia.com/advisories/19418/</url>
</references>
<dates>
<discovery>2006-03-29</discovery>
<entry>2006-04-07</entry>
</dates>
</vuln>
<vuln vid="4bfcd857-c628-11da-b2fb-000e0c2e438a">
<topic>kaffeine -- buffer overflow vulnerability</topic>
<affects>
<package>
<name>kaffeine</name>
<range><ge>0.4.2</ge><lt>0.8.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The KDE team reports:</p>
<blockquote cite="http://www.kde.org/info/security/advisory-20060404-1.txt">
<p>Kaffeine can produce a buffer overflow in http_peek() while
creating HTTP request headers for fetching remote playlists,
which under certain circumstances could be used to crash the
application and/or execute arbitrary code.</p>
</blockquote>
</body>
</description>
<references>
<bid>17372</bid>
<cvename>CVE-2006-0051</cvename>
<url>http://www.kde.org/info/security/advisory-20060404-1.txt</url>
</references>
<dates>
<discovery>2006-04-04</discovery>
<entry>2006-04-07</entry>
</dates>
</vuln>
<vuln vid="61349f77-c620-11da-b2fb-000e0c2e438a">
<topic>thunderbird -- javascript execution</topic>
<affects>
<package>
<name>thunderbird</name>
<name>mozilla-thunderbird</name>
<range><le>1.0.7</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Renaud Lifchitz reports a vulnerability within thunderbird.
The vulnerability is caused by improper checking of javascript
scripts. This could lead to javascript code execution which
can lead to information disclosure or a denial of service
(application crash). This vulnerability is present even if
javascript had been disabled in the preferences.</p>
</body>
</description>
<references>
<bid>16770</bid>
<cvename>CAN-2006-0884</cvename>
</references>
<dates>
<discovery>2006-02-22</discovery>
<entry>2006-04-07</entry>
</dates>
</vuln>
<vuln vid="fba75b43-c588-11da-9110-00123ffe8333">
<topic>phpmyadmin -- XSS vulnerabilities</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<range><lt>2.8.0.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>phpMyAdmin security announcement:</p>
<blockquote cite="http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-1">
<p>It was possible to conduct an XSS attack with a direct call
to some scripts under the themes directory.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-1</url>
<url>http://secunia.com/advisories/19556/</url>
</references>
<dates>
<discovery>2006-04-06</discovery>
<entry>2006-04-06</entry>
<modified>2006-04-07</modified>
</dates>
</vuln>
<vuln vid="7b55f5c2-c58b-11da-9110-00123ffe8333">
<topic>phpmyadmin -- 'set_theme' Cross-Site Scripting</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<range><lt>2.8.0.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/19277">
<p>A vulnerability has been reported in phpMyAdmin, which can be
exploited by malicious people to conduct cross-site scripting
attacks.</p>
<p>Input passed to the "set_theme" parameter isn't properly
sanitised before being returned to the user. This can be exploited
to execute arbitrary HTML and script code in a user's browser
session in context of an affected site.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-1258</cvename>
<url>http://secunia.com/advisories/19277</url>
</references>
<dates>
<discovery>2006-03-17</discovery>
<entry>2006-04-06</entry>
</dates>
</vuln>
<vuln vid="6a5174bd-c580-11da-9110-00123ffe8333">
<topic>clamav -- Multiple Vulnerabilities</topic>
<affects>
<package>
<name>clamav</name>
<range><lt>0.88.1</lt></range>
</package>
<package>
<name>clamav-devel</name>
<range><le>20051104_1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/19534/">
<p>Some vulnerabilities have been reported in ClamAV, which
potentially can be exploited by malicious people to cause a
DoS (Denial of Service) and compromise a vulnerable system.</p>
<p>An unspecified integer overflow error exists in the PE header
parser in "libclamav/pe.c". Successful exploitation requires that
the ArchiveMaxFileSize option is disabled.</p>
<p>Some format string errors in the logging handling in
"shared/output.c" may be exploited to execute arbitrary code.</p>
<p>An out-of-bounds memory access error in the "cli_bitset_test()"
function in "ibclamav/others.c" may be exploited to cause a
crash.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-1614</cvename>
<cvename>CVE-2006-1615</cvename>
<cvename>CVE-2006-1630</cvename>
<url>http://secunia.com/advisories/19534/</url>
<url>http://www.us.debian.org/security/2006/dsa-1024</url>
</references>
<dates>
<discovery>2006-04-06</discovery>
<entry>2006-04-06</entry>
</dates>
</vuln>
<vuln vid="99015cf5-c4dd-11da-b2fb-000e0c2e438a">
<topic>mediawiki -- hardcoded placeholder string security bypass vulnerability</topic>
<affects>
<package>
<name>mediawiki</name>
<range><lt>1.5.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The mediawiki development team reports a vulnerability
within the mediawiki application. The vulnerability is
caused by improper checking of inline style attributes. This
could result in the execution of arbitrary javascript code in
Microsoft Internet Explorer. It appears that other browsers
are not affected by this vulnerability.</p>
</body>
</description>
<references>
<bid>16032</bid>
<cvename>CAN-2005-4501</cvename>
<url>http://sourceforge.net/project/shownotes.php?release_id=379951</url>
</references>
<dates>
<discovery>2005-12-22</discovery>
<entry>2006-04-05</entry>
</dates>
</vuln>
<vuln vid="ae9fb0d7-c4dc-11da-b2fb-000e0c2e438a">
<topic>netpbm -- buffer overflow in pnmtopng</topic>
<affects>
<package>
<name>netpbm</name>
<range><lt>10.26</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ubuntu reports:</p>
<blockquote cite="http://www.ubuntulinux.org/support/documentation/usn/usn-210-1">
<p>A buffer overflow was found in the "pnmtopng" conversion
program. By tricking an user (or automated system) to
process a specially crafted PNM image with pnmtopng, this
could be exploited to execute arbitrary code with the
privileges of the user running pnmtopng.</p>
</blockquote>
</body>
</description>
<references>
<bid>15128</bid>
<cvename>CAN-2005-2978</cvename>
<url>http://www.ubuntulinux.org/support/documentation/usn/usn-210-1</url>
</references>
<dates>
<discovery>2005-10-18</discovery>
<entry>2006-04-05</entry>
</dates>
</vuln>
<vuln vid="d9307a41-c4d7-11da-b2fb-000e0c2e438a">
<topic>zoo -- stack based buffer overflow</topic>
<affects>
<package>
<name>zoo</name>
<range><lt>2.10.1_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jean-Sébastien Guay-Leroux report a vulnerability
within the zoo archiver. The vulnerability which is present
in the fullpath() function (from the misc.c file) is caused by
improper checking of user supplied data. The data returned
to the buffer can be up to 512 bytes, while the buffer is
created to hold 256 bytes. This could result in a buffer
overflow which could allow remote code execution.</p>
</body>
</description>
<references>
<bid>16790</bid>
<cvename>CVE-2006-0855</cvename>
<url>http://www.guay-leroux.com/projects/zoo-advisory.txt</url>
</references>
<dates>
<discovery>2006-02-22</discovery>
<entry>2006-04-05</entry>
<modified>2006-04-06</modified>
</dates>
</vuln>
<vuln vid="74b7403c-c4d5-11da-b2fb-000e0c2e438a">
<topic>mediawiki -- cross site scripting vulnerability</topic>
<affects>
<package>
<name>mediawiki</name>
<range><ge>1.4</ge><lt>1.4.14</lt></range>
<range><ge>1.5</ge><lt>1.5.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The mediawiki development team reports that there is an
site scripting vulnerability within mediawiki. The
vulnerability is caused by improper checking of encoded
links which could allow the injection of html in the output
generated by mediawiki. This could lead to cross site
scripting attacks against mediawiki installations.</p>
</body>
</description>
<references>
<bid>17269</bid>
<cvename>CVE-2006-1498</cvename>
<url>http://mail.wikipedia.org/pipermail/mediawiki-announce/2006-March/000040.html</url>
</references>
<dates>
<discovery>2006-03-27</discovery>
<entry>2006-04-05</entry>
</dates>
</vuln>
<vuln vid="b5fc63ad-c4c3-11da-9699-00123ffe8333">
<topic>dia -- XFig Import Plugin Buffer Overflow</topic>
<affects>
<package>
<name>dia</name>
<name>dia-gnome</name>
<range><gt>0.86_1</gt><lt>0.94_6,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/19469/">
<p>Some vulnerabilities have been reported in Dia, which
potentially can be exploited by malicious people to
compromise a user's system.</p>
<p>The vulnerabilities are caused due to boundary errors
within the XFig import plugin. This can be exploited to
cause buffer overflows and may allow arbitrary code
execution when a specially-crafted FIG file is imported.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-1550</cvename>
<url>http://secunia.com/advisories/19469/</url>
<mlist msgid="1143662924.6460.60.camel@linux.site">http://mail.gnome.org/archives/dia-list/2006-March/msg00149.html</mlist>
</references>
<dates>
<discovery>2006-03-31</discovery>
<entry>2006-04-05</entry>
</dates>
</vuln>
<vuln vid="be4ccb7b-c48b-11da-ae12-0002b3b60e4c">
<topic>openvpn -- LD_PRELOAD code execution on client through malicious or compromised server</topic>
<affects>
<package>
<name>openvpn</name>
<range><ge>2.0</ge><lt>2.0.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Hendrik Weimer reports:</p>
<blockquote cite="http://www.osreviews.net/reviews/security/openvpn-print">
<p>OpenVPN clients are a bit too generous when accepting
configuration options from a server. It is possible to transmit
environment variables to client-side shell scripts. There are some
filters in place to prevent obvious nonsense, however they don't
catch the good old LD_PRELOAD trick. All we need is to put a file
onto the client under a known location (e.g. by returning a
specially crafted document upon web access) and we have a remote
root exploit. But since the attack may only come from authenticated
servers, this threat is greatly reduced.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-1629</cvename>
<url>http://www.osreviews.net/reviews/security/openvpn-print</url>
<url>http://openvpn.net/changelog.html</url>
<mlist msgid="4431F7C4.4030804@yonan.net">http://sourceforge.net/mailarchive/message.php?msg_id=15298074</mlist>
</references>
<dates>
<discovery>2006-04-03</discovery>
<entry>2006-04-05</entry>
<modified>2006-04-06</modified>
</dates>
</vuln>
<vuln vid="92fd40eb-c458-11da-9c79-00123ffe8333">
<topic>samba -- Exposure of machine account credentials in winbind log files</topic>
<affects>
<package>
<name>samba</name>
<range><ge>3.0.21a,1</ge><lt>3.0.22,1</lt></range>
</package>
<package>
<name>ja-samba</name>
<range><ge>3.0.21a,1</ge><lt>3.0.22,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Samba Security Advisory:</p>
<blockquote cite="http://us1.samba.org/samba/security/CAN-2006-1059.html">
<p>The machine trust account password is the secret
shared between a domain controller and a specific
member server. Access to the member server machine
credentials allows an attacker to impersonate the
server in the domain and gain access to additional
information regarding domain users and groups.</p>
<p>The winbindd daemon writes the clear text of server's
machine credentials to its log file at level 5.
The winbindd log files are world readable by default
and often log files are requested on open mailing
lists as tools used to debug server misconfigurations.</p>
<p>This affects servers configured to use domain or
ads security and possibly Samba domain controllers
as well (if configured to use winbindd).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-1059</cvename>
<url>http://us1.samba.org/samba/security/CAN-2006-1059.html</url>
<url>http://secunia.com/advisories/19455/</url>
</references>
<dates>
<discovery>2006-03-30</discovery>
<entry>2006-04-05</entry>
</dates>
</vuln>
<vuln vid="91afa94c-c452-11da-8bff-000ae42e9b93">
<topic>mod_pubcookie -- cross site scripting vulnerability</topic>
<affects>
<package>
<name>mod_pubcookie</name>
<range><lt>3.3.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Nathan Dors of the Pubcookie Project reports:</p>
<blockquote cite="http://www.pubcookie.org/news/20060306-apps-secadv.html">
<p>Non-persistent XSS vulnerabilities were found in the
Pubcookie Apache module (mod_pubcookie) and ISAPI
filter. These components mishandle untrusted data when
printing responses to the browser. This makes them
vulnerable to carefully crafted requests containing script
or HTML. If an attacker can lure an unsuspecting user to
visit carefully staged content, the attacker can use it to
redirect the user to a vulnerable Pubcookie application
server and attempt to exploit the XSS vulnerabilities.</p>
<p>These vulnerabilities are classified as *high* due to the
nature and purpose of Pubcookie application servers for user
authentication and Web Single Sign-on (SSO). An attacker
who injects malicious script through the vulnerabilities
might steal private Pubcookie data including a user's
authentication assertion ("granting") cookies and
application session cookies.</p>
</blockquote>
</body>
</description>
<references>
<certvu>314540</certvu>
</references>
<dates>
<discovery>2006-03-06</discovery>
<entry>2006-04-05</entry>
</dates>
</vuln>
<vuln vid="855cd9fa-c452-11da-8bff-000ae42e9b93">
<topic>pubcookie-login-server -- cross site scripting vulnerability</topic>
<affects>
<package>
<name>pubcookie-login-server</name>
<range><lt>3.3.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Nathan Dors of the Pubcookie Project reports:</p>
<blockquote cite="">
<p> Multiple non-persistent XSS vulnerabilities were found
in the Pubcookie login server's compiled binary "index.cgi"
CGI program. The CGI program mishandles untrusted data when
printing responses to the browser. This makes the program
vulnerable to carefully crafted requests containing script
or HTML. If an attacker can lure an unsuspecting user to
visit carefully staged content, the attacker can use it to
redirect the user to his or her local Pubcookie login page
and attempt to exploit the XSS vulnerabilities.</p>
<p> These vulnerabilities are classified as *critical* due
to the nature and purpose of the Pubcookie login server for
user authentication and Web Single Sign-on (SSO). Specific
threats include:</p>
<ul>
<li>An attacker who injects malicious script through the
vulnerabilities might steal senstive user data including
a user's authentication credentials (usernames and
passwords);</li>
<li>An attacker who injects malicious script through the
vulnerabilities might steal private Pubcookie data
including a user's authentication assertion ("granting")
cookies and SSO ("login") session cookies;</li>
<li>An attacker who injects HTML tags through the
vulnerabilities might deface a site's Pubcookie login page
for a single visit by a single user (i.e. a non-persistent
defacement).</li>
</ul>
<p>At the heart of these threats lies a violation of the
user's trust in the Pubcookie login server.</p>
</blockquote>
</body>
</description>
<references>
<certvu>337585</certvu>
</references>
<dates>
<discovery>2006-03-06</discovery>
<entry>2006-04-05</entry>
</dates>
</vuln>
<vuln vid="37a5c10f-bf56-11da-b0e9-00123ffe8333">
<topic>freeradius -- EAP-MSCHAPv2 Authentication Bypass</topic>
<affects>
<package>
<name>freeradius</name>
<range><ge>1.0.0</ge><lt>1.1.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Freeradius Security Contact reports:</p>
<blockquote cite="http://www.freeradius.org/security.html#1.1.0">
<p>Insufficient input validation was being done in the
EAP-MSCHAPv2 state machine. A malicious attacker could
manipulate their EAP-MSCHAPv2 client state machine to
potentially convince the server to bypass authentication
checks. This bypassing could also result in the server
crashing.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-1354</cvename>
<url>http://www.freeradius.org/security.html#1.1.0</url>
<url>http://secunia.com/advisories/19300/</url>
</references>
<dates>
<discovery>2006-03-21</discovery>
<entry>2006-03-29</entry>
</dates>
</vuln>
<vuln vid="2db97aa6-be81-11da-9b82-0050bf27ba24">
<topic>horde -- remote code execution vulnerability in the help viewer</topic>
<affects>
<package>
<name>horde</name>
<name>horde-php5</name>
<range><lt>3.1.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Horde 3.1.1 release announcement:</p>
<blockquote cite="http://lists.horde.org/archives/announce/2006/000271.html">
<p>Major changes compared to Horde 3.1 are:</p>
<ul>
<li>Fix for remote code execution vulnerability in the
help viewer, discovered by Jan Schneider from the Horde
team.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<bid>17292</bid>
<cvename>CVE-2006-1491</cvename>
<url>http://lists.horde.org/archives/announce/2006/000271.html</url>
</references>
<dates>
<discovery>2006-03-28</discovery>
<entry>2006-03-28</entry>
<modified>2006-03-30</modified>
</dates>
</vuln>
<vuln vid="25858c37-bdab-11da-b7d4-00123ffe8333">
<topic>linux-realplayer -- buffer overrun</topic>
<affects>
<package>
<name>linux-realplayer</name>
<range><ge>10.0.1</ge><lt>10.0.7.785.20060201</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia Advisories Reports:</p>
<blockquote cite="http://secunia.com/advisories/19358/">
<p>A boundary error when processing SWF files can be exploited to
cause a buffer overflow. This may allow execution of arbitrary
code on the user's system.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-0323</cvename>
<url>http://service.real.com/realplayer/security/03162006_player/en/</url>
<url>http://secunia.com/advisories/19358/</url>
</references>
<dates>
<discovery>2006-03-23</discovery>
<entry>2006-03-27</entry>
</dates>
</vuln>
<vuln vid="fe4c84fc-bdb5-11da-b7d4-00123ffe8333">
<topic>linux-realplayer -- heap overflow</topic>
<affects>
<package>
<name>linux-realplayer</name>
<range><ge>10.0.1</ge><lt>10.0.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>iDefense Reports:</p>
<blockquote cite="http://www.idefense.com/intelligence/vulnerabilities/display.php?id=404">
<p>Remote exploitation of a heap-based buffer overflow in
RealNetwork Inc's RealPlayer could allow the execution of
arbitrary code in the context of the currently logged in
user.</p>
<p>In order to exploit this vulnerability, an attacker would
need to entice a user to follow a link to a malicious server.
Once the user visits a website under the control of an
attacker, it is possible in a default install of RealPlayer
to force a web-browser to use RealPlayer to connect to an
arbitrary server, even when it is not the default application
for handling those types, by the use of embedded object tags
in a webpage. This may allow automated exploitation when the
page is viewed.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2005-2922</cvename>
<url>http://service.real.com/realplayer/security/03162006_player/en/</url>
<url>http://www.idefense.com/intelligence/vulnerabilities/display.php?id=404</url>
<url>http://secunia.com/advisories/19358/</url>
</references>
<dates>
<discovery>2006-03-23</discovery>
<entry>2006-03-27</entry>
</dates>
</vuln>
<vuln vid="08ac7b8b-bb30-11da-b2fb-000e0c2e438a">
<topic>sendmail -- race condition vulnerability</topic>
<affects>
<package>
<name>sendmail</name>
<range><gt>8.13</gt><lt>8.13.6</lt></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>6.0</ge><lt>6.0_6</lt></range>
<range><ge>5.4</ge><lt>5.4_13</lt></range>
<range><ge>5.3</ge><lt>5.3_28</lt></range>
<range><ge>4.11</ge><lt>4.11_16</lt></range>
<range><ge>4.10</ge><lt>4.10_22</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description</h1>
<p>A race condition has been reported to exist in the handling
by sendmail of asynchronous signals.</p>
<h1>Impact</h1>
<p>A remote attacker may be able to execute arbitrary code with
the privileges of the user running sendmail, typically
root.</p>
<h1>Workaround</h1>
<p>There is no known workaround other than disabling
sendmail.</p>
</body>
</description>
<references>
<cvename>CVE-2006-0058</cvename>
<freebsdsa>SA-06:13.sendmail</freebsdsa>
</references>
<dates>
<discovery>2006-03-22</discovery>
<entry>2006-03-24</entry>
<modified>2006-06-09</modified>
</dates>
</vuln>
<vuln vid="e93bc5b0-bb2e-11da-b2fb-000e0c2e438a">
<topic>OPIE -- arbitrary password change</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>6.0</ge><lt>6.0_6</lt></range>
<range><ge>5.4</ge><lt>5.4_13</lt></range>
<range><ge>5.3</ge><lt>5.3_28</lt></range>
<range><ge>4.11</ge><lt>4.11_16</lt></range>
<range><ge>4.10</ge><lt>4.10_22</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description</h1>
<p>The opiepasswd(1) program uses getlogin(2) to identify the
user calling opiepasswd(1). In some circumstances
getlogin(2) will return "root" even when running as an
unprivileged user. This causes opiepasswd(1) to allow an
unpriviled user to configure OPIE authentication for the root
user.</p>
<h1>Impact</h1>
<p>In certain cases an attacker able to run commands as a non
privileged users which have not explicitly logged in, for
example CGI scripts run by a web server, is able to configure
OPIE access for the root user. If the attacker is able to
authenticate as root using OPIE authentication, for example if
"PermitRootLogin" is set to "yes" in sshd_config or the
attacker has access to a local user in the "wheel" group, the
attacker can gain root privileges.</p>
<h1>Workaround</h1>
<p>Disable OPIE authentication in PAM:</p>
<pre># sed -i "" -e /opie/s/^/#/ /etc/pam.d/*</pre>
<p>or</p>
<p>Remove the setuid bit from opiepasswd:</p>
<pre># chflags noschg /usr/bin/opiepasswd</pre>
<pre># chmod 555 /usr/bin/opiepasswd</pre>
<pre># chflags schg /usr/bin/opiepasswd</pre>
</body>
</description>
<references>
<cvename>CVE-2006-1283</cvename>
<freebsdsa>SA-06:12.opie</freebsdsa>
</references>
<dates>
<discovery>2006-03-22</discovery>
<entry>2006-03-24</entry>
<modified>2006-06-09</modified>
</dates>
</vuln>
<vuln vid="e50a7476-bb2d-11da-b2fb-000e0c2e438a">
<topic>ipsec -- reply attack vulnerability</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>6.0</ge><lt>6.0_6</lt></range>
<range><ge>5.4</ge><lt>5.4_13</lt></range>
<range><ge>5.3</ge><lt>5.3_28</lt></range>
<range><ge>4.11</ge><lt>4.11_16</lt></range>
<range><ge>4.10</ge><lt>4.10_22</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description</h1>
<p>IPsec provides an anti-replay service which when enabled
prevents an attacker from successfully executing a replay
attack. This is done through the verification of sequence
numbers. A programming error in the fast_ipsec(4)
implementation results in the sequence number associated with
a Security Association not being updated, allowing packets to
unconditionally pass sequence number verification checks.</p>
<h1>Impact</h1>
<p>An attacker able to intercept IPSec packets can replay
them. If higher level protocols which do not provide any
protection against packet replays (e.g., UDP) are used, this
may have a variety of effects.</p>
<h1>Workaround</h1>
<p>No workaround is available.</p>
</body>
</description>
<references>
<cvename>CVE-2006-0905</cvename>
<freebsdsa>SA-06:11.ipsec</freebsdsa>
</references>
<dates>
<discovery>2006-03-22</discovery>
<entry>2006-03-24</entry>
<modified>2006-06-09</modified>
</dates>
</vuln>
<vuln vid="61534682-b8f4-11da-8e62-000e0c33c2dc">
<topic>xorg-server -- privilege escalation</topic>
<affects>
<package>
<name>xorg-server</name>
<range><eq>6.9.0</eq></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Daniel Stone of X.Org reports:</p>
<blockquote cite="http://lists.freedesktop.org/archives/xorg/2006-March/013992.html">
<p>During the analysis of results from the Coverity code review
of X.Org, we discovered a flaw in the server that allows local
users to execute arbitrary code with root privileges, or cause
a denial of service by overwriting files on the system, again
with root privileges.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-0745</cvename>
<url>https://bugs.freedesktop.org/show_bug.cgi?id=6213</url>
</references>
<dates>
<discovery>2006-03-20</discovery>
<entry>2006-03-21</entry>
</dates>
</vuln>
<vuln vid="b62c80c2-b81a-11da-bec5-00123ffe8333">
<topic>heimdal -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>heimdal</name>
<range><lt>0.6.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Project heimdal Security Advisory reports:</p>
<blockquote cite="http://www.pdc.kth.se/heimdal/advisory/2005-04-20/">
<p>The telnet client program in Heimdal has buffer overflows
in the functions slc_add_reply() and env_opt_add(), which
may lead to remote code execution.</p>
</blockquote>
<blockquote cite="http://www.pdc.kth.se/heimdal/advisory/2005-06-20/">
<p>The telnetd server program in Heimdal has buffer overflows
in the function getterminaltype, which may lead to remote code
execution.</p>
</blockquote>
<blockquote cite="http://www.pdc.kth.se/heimdal/advisory/2006-02-06/">
<p>The rshd server in Heimdal has a privilege escalation bug
when storing forwarded credentials. The code allowes a user
to overwrite a file with its credential cache, and get ownership
of the file.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2005-0469</cvename>
<cvename>CVE-2005-2040</cvename>
<cvename>CVE-2006-0582</cvename>
<cvename>CVE-2006-0677</cvename>
<url>http://www.pdc.kth.se/heimdal/advisory/2005-04-20</url>
<url>http://www.pdc.kth.se/heimdal/advisory/2005-06-20</url>
<url>http://www.pdc.kth.se/heimdal/advisory/2006-02-06</url>
</references>
<dates>
<discovery>2006-02-06</discovery>
<entry>2006-03-20</entry>
</dates>
</vuln>
<vuln vid="b8e361b8-b7ff-11da-8414-0013d4a4a40e">
<topic>curl -- TFTP packet buffer overflow vulnerability</topic>
<affects>
<package>
<name>curl</name>
<name>linux-curl</name>
<range><gt>7.14.1</gt><lt>7.15.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Project cURL Security Advisory reports:</p>
<blockquote cite="http://curl.haxx.se/docs/adv_20060320.html">
<p>libcurl uses the given file part of a TFTP URL in a manner that
allows a malicious user to overflow a heap-based memory buffer due
to the lack of boundary check.</p>
<p>This overflow happens if you pass in a URL with a TFTP
protocol prefix ("tftp://"), using a valid host and a path
part that is longer than 512 bytes.</p>
<p>The affected flaw can be triggered by a redirect, if
curl/libcurl is told to follow redirects and an HTTP
server points the client to a tftp URL with the
characteristics described above.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-1061</cvename>
<url>http://curl.haxx.se/docs/adv_20060320.html</url>
</references>
<dates>
<discovery>2006-03-20</discovery>
<entry>2006-03-20</entry>
<modified>2006-10-05</modified>
</dates>
</vuln>
<vuln vid="6779e82f-b60b-11da-913d-000ae42e9b93">
<topic>drupal -- multiple vulnerabilities</topic>
<affects>
<package>
<name>drupal</name>
<range><lt>3.6.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Drupal reports:</p>
<blockquote cite="http://drupal.org/node/53806">
<p>Mail header injection vulnerability.</p>
<p>Linefeeds and carriage returns were not being stripped from
email headers, raising the possibility of bogus headers
being inserted into outgoing email.</p>
<p>This could lead to Drupal sites being used to send unwanted
email.</p>
</blockquote>
<blockquote cite="http://drupal.org/node/53805">
<p>Session fixation vulnerability.</p>
<p>If someone creates a clever enough URL and convinces you to
click on it, and you later log in but you do not log off
then the attacker may be able to impersonate you.</p>
</blockquote>
<blockquote cite="http://drupal.org/node/53803">
<p>XSS vulnerabilities.</p>
<p>Some user input sanity checking was missing. This could
lead to possible cross-site scripting (XSS) attacks.</p>
<p>XSS can lead to user tracking and theft of accounts and
services.</p>
</blockquote>
<blockquote cite="http://drupal.org/node/53796">
<p>Security bypass in menu.module.</p>
<p>If you use menu.module to create a menu item, the page you
point to will be accessible to all, even if it is an admin
page.</p>
</blockquote>
</body>
</description>
<references>
<url>http://drupal.org/node/53806</url>
<url>http://drupal.org/node/53805</url>
<url>http://drupal.org/node/53803</url>
<url>http://drupal.org/node/53796</url>
</references>
<dates>
<discovery>2006-03-13</discovery>
<entry>2006-03-17</entry>
</dates>
</vuln>
<vuln vid="c7c09579-b466-11da-82d0-0050bf27ba24">
<topic>horde -- "url" disclosure of sensitive information vulnerability</topic>
<affects>
<package>
<name>horde</name>
<name>horde-php5</name>
<range><lt>3.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p> Secunia advisory SA19246:</p>
<blockquote cite="http://secunia.com/advisories/19246/">
<p>Paul Craig has discovered a vulnerability in Horde, which
can be exploited by malicious people to disclose sensitive
information.
Input passed to the "url" parameter in "services/go.php"
isn't properly verified, before it is used in a
"readfile()" call. This can be exploited to disclose the
content of arbitrary files via e.g. the "php://" protocol
wrapper.</p>
<p>The vulnerability has been confirmed in version 3.0.9 and
has also been reported in prior versions.</p>
<p>Provided and/or discovered by:
Paul Craig, Security-Assessment.com.</p>
</blockquote>
</body>
</description>
<references>
<url>http://secunia.com/advisories/19246/</url>
</references>
<dates>
<discovery>2006-03-15</discovery>
<entry>2006-03-15</entry>
</dates>
</vuln>
<vuln vid="83421018-b3ef-11da-a32d-000c6ec775d9">
<topic>linux-flashplugin -- arbitrary code execution vulnerability</topic>
<affects>
<package>
<name>linux-flashplugin</name>
<range><lt>7.0r63</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="http://www.macromedia.com/devnet/security/security_zone/apsb06-03.html">
<p>Critical vulnerabilities have been identified in Flash
Player that could allow an attacker who successfully
exploits these vulnerabilities to take control of the
affected system. A malicious SWF must be loaded in Flash
Player by the user for an attacker to exploit these
vulnerabilities.</p>
<p>Flash Player 8 update (8.0.24.0), and Flash Player 7
update (7.0.63.0) address security vulnerabilities in
previous versions of Flash Player, which could lead to the
potential execution of arbitrary code. These
vulnerabilities could be accessed through content
delivered from a remote location via the users web
browser, email client, or other applications that include
or reference the Flash Player.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-0024</cvename>
<url>http://www.macromedia.com/devnet/security/security_zone/apsb06-03.html</url>
</references>
<dates>
<discovery>2006-03-14</discovery>
<entry>2006-03-15</entry>
</dates>
</vuln>
<vuln vid="6111ecb8-b20d-11da-b2fb-000e0c2e438a">
<topic>nfs -- remote denial of service</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>6.0</ge><lt>6.0_5</lt></range>
<range><ge>5.4</ge><lt>5.4_12</lt></range>
<range><ge>5.3</ge><lt>5.3_27</lt></range>
<range><ge>4.11</ge><lt>4.11_15</lt></range>
<range><ge>4.10</ge><lt>4.10_21</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem description:</h1>
<p>A part of the NFS server code charged with handling incoming
RPC messages via TCP had an error which, when the server
received a message with a zero-length payload, would cause a
NULL pointer dereference which results in a kernel panic. The
kernel will only process the RPC messages if a userland nfsd
daemon is running.</p>
<h1>Impact:</h1>
<p>The NULL pointer deference allows a remote attacker capable
of sending RPC messages to an affected FreeBSD system to crash
the FreeBSD system.</p>
<h1>Workaround:</h1>
<ol>
<li>
<p>Disable the NFS server: set the nfs_server_enable
variable to "NO" in /etc/rc.conf, and reboot.</p>
<p>Alternatively, if there are no active NFS clients (as
listed by the showmount(8) utility), simply killing the
mountd and nfsd processes should suffice.</p>
</li>
<li>
<p>Add firewall rules to block RPC traffic to the NFS server
from untrusted hosts.</p>
</li>
</ol>
</body>
</description>
<references>
<cvename>CVE-2006-0900</cvename>
<freebsdsa>SA-06:10.nfs</freebsdsa>
</references>
<dates>
<discovery>2006-03-01</discovery>
<entry>2006-03-12</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="6a308e8e-b1b4-11da-b2fb-000e0c2e438a">
<topic>openssh -- remote denial of service</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>5.4</ge><lt>5.4_12</lt></range>
<range><ge>5.3</ge><lt>5.3_27</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem description:</h1>
<p>Because OpenSSH and OpenPAM have conflicting designs (one is event-
driven while the other is callback-driven), it is necessary for
OpenSSH to fork a child process to handle calls to the PAM framework.
However, if the unprivileged child terminates while PAM authentication
is under way, the parent process incorrectly believes that the PAM
child also terminated. The parent process then terminates, and the
PAM child is left behind.</p>
<p>Due to the way OpenSSH performs internal accounting, these orphaned
PAM children are counted as pending connections by the master OpenSSH
server process. Once a certain number of orphans has accumulated, the
master decides that it is overloaded and stops accepting client
connections.</p>
<h1>Impact:</h1>
<p>By repeatedly connecting to a vulnerable server, waiting for
a password prompt, and closing the connection, an attacker can
cause OpenSSH to stop accepting client connections until the
system restarts or an administrator manually kills the orphaned
PAM processes.</p>
<h1>Workaround:</h1>
<p>The following command will show a list of orphaned PAM
processes:</p>
<pre># pgrep -lf 'sshd.*\[pam\]'</pre>
<p>The following command will kill orphaned PAM processes:</p>
<pre># pkill -f 'sshd.*\[pam\]'</pre>
<p>To prevent OpenSSH from leaving orphaned PAM processes behind,
perform one of the following:</p>
<ol>
<li>
<p>Disable PAM authentication in OpenSSH. Users will still
be able to log in using their Unix password, OPIE or SSH
keys.</p>
<p>To do this, execute the following commands as root:</p>
<pre># echo 'UsePAM no' &gt;&gt;/etc/ssh/sshd_config</pre>
<pre># echo 'PasswordAuthentication yes' &gt;&gt;/etc/ssh/sshd_config</pre>
<pre># /etc/rc.d/sshd restart</pre>
</li>
<li>
<p>If disabling PAM is not an option - if, for instance, you use
RADIUS authentication, or store user passwords in an SQL database
- you may instead disable privilege separation. However, this may
leave OpenSSH vulnerable to hitherto unknown bugs, and should be
considered a last resort.</p>
<p>To do this, execute the following commands as root:</p>
<pre># echo 'UsePrivilegeSeparation no' &gt;&gt;/etc/ssh/sshd_config</pre>
<pre># /etc/rc.d/sshd restart</pre>
</li>
</ol>
</body>
</description>
<references>
<cvename>CVE-2006-0883</cvename>
<freebsdsa>SA-06:09.openssh</freebsdsa>
</references>
<dates>
<discovery>2006-03-01</discovery>
<entry>2006-03-12</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="948921ad-afbc-11da-bad9-02e081235dab">
<topic>GnuPG does not detect injection of unsigned data</topic>
<affects>
<package>
<name>gnupg</name>
<range><lt>1.4.2.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Werner Koch reports:</p>
<blockquote cite="http://lists.gnupg.org/pipermail/gnupg-announce/2006q1/000216.html">
<p>In the aftermath of the false positive signature
verfication bug (announced 2006-02-15) more thorough testing
of the fix has been done and another vulnerability has been
detected. This new problem affects the use of *gpg* for
verification of signatures which are _not_ detached
signatures. The problem also affects verification of
signatures embedded in encrypted messages; i.e. standard use
of gpg for mails.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-0049</cvename>
<mlist msgid="87d5gvh2kr.fsf@wheatstone.g10code.de">http://lists.gnupg.org/pipermail/gnupg-announce/2006q1/000216.html</mlist>
</references>
<dates>
<discovery>2006-03-09</discovery>
<entry>2006-03-10</entry>
<modified>2006-03-11</modified>
</dates>
</vuln>
<vuln vid="104beb63-af4d-11da-8414-0013d4a4a40e">
<topic>mplayer -- heap overflow in the ASF demuxer</topic>
<affects>
<package>
<name>mplayer</name>
<name>mplayer-gtk</name>
<name>mplayer-esound</name>
<name>mplayer-gtk-esound</name>
<range><lt>0.99.7_11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mplayer team reports:</p>
<blockquote cite="http://www.mplayerhq.hu/design7/news.html#vuln13">
<p>A potential buffer overflow was found in the ASF demuxer.
Arbitrary remote code execution is possible (under the user ID
running the player) when streaming an ASF file from a malicious
server or local code execution (under the user ID running the
player) if a malicious ASF file is played locally.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-0579</cvename>
<url>http://www.mplayerhq.hu/design7/news.html#vuln13</url>
<url>http://secunia.com/advisories/18718</url>
<url>http://bugs.gentoo.org/show_bug.cgi?id=122029</url>
</references>
<dates>
<discovery>2006-02-15</discovery>
<entry>2006-03-09</entry>
</dates>
</vuln>
<vuln vid="594ad3c5-a39b-11da-926c-0800209adf0e">
<topic>SSH.COM SFTP server -- format string vulnerability</topic>
<affects>
<package>
<name>ssh2</name>
<name>ssh2-nox11</name>
<range><lt>3.2.9.1_5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SSH Communications Security Corp reports a format string
vulnerability in their SFTP server. This vulnerability could
cause a user with SCP/SFTP access only to get permission to
execute also other commands. It could also allow user A to
create a special file that when accessed by user B allows
user A to execute commands as user B.</p>
</body>
</description>
<references>
<cvename>CVE-2006-0705</cvename>
<bid>16640</bid>
<url>http://www.ssh.com/company/newsroom/article/715/</url>
<url>http://www.frsirt.com/english/advisories/2006/0554</url>
<url>http://securitytracker.com/id?1015619</url>
<url>http://secunia.com/advisories/18828</url>
<url>http://xforce.iss.net/xforce/xfdb/24651</url>
</references>
<dates>
<discovery>2006-02-13</discovery>
<entry>2006-03-04</entry>
<modified>2006-03-06</modified>
</dates>
</vuln>
<vuln vid="6107efb9-aae3-11da-aea1-000854d03344">
<topic>gtar -- invalid headers buffer overflow</topic>
<affects>
<package>
<name>gtar</name>
<range><lt>1.15.1_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>GNU tar is vulnerable to a buffer overflow, caused by
improper bounds checking of the PAX extended headers. By
tricking an user into processing a specially crafted tar
archive, this could be exploited to execute arbitrary
code with the privileges of the user.</p>
</body>
</description>
<references>
<bid>16764</bid>
<cvename>CVE-2006-0300</cvename>
</references>
<dates>
<discovery>2006-02-22</discovery>
<entry>2006-03-03</entry>
</dates>
</vuln>
<vuln vid="46f7b598-a781-11da-906a-fde5cdde365e">
<topic>bugzilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>bugzilla</name>
<name>ja-bugzilla</name>
<range><ge>2.17.1</ge><lt>2.20.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Some vulnerabilities have been reported in Bugzilla,
which can be exploited by malicious users to conduct SQL injection
attacks, and by malicious people to disclose sensitive information
and conduct script insertion attacks.</p>
</body>
</description>
<references>
<cvename>CVE-2006-2420</cvename>
<cvename>CVE-2006-0916</cvename>
<cvename>CVE-2006-0915</cvename>
<cvename>CVE-2006-0914</cvename>
<cvename>CVE-2006-0913</cvename>
<url>http://www.bugzilla.org/security/2.18.4/</url>
</references>
<dates>
<discovery>2006-02-20</discovery>
<entry>2006-02-27</entry>
<modified>2006-11-11</modified>
</dates>
</vuln>
<vuln vid="af9018b6-a4f5-11da-bb41-0011433a9404">
<topic>squirrelmail -- multiple vulnerabilities</topic>
<affects>
<package>
<name>squirrelmail</name>
<range><lt>1.4.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Multiple vulnerabilities has been discovered since 1.4.5,
including IMAP injection as well as some XSS issues.</p>
</body>
</description>
<references>
<cvename>CVE-2006-0377</cvename>
<cvename>CVE-2006-0195</cvename>
<cvename>CVE-2006-0188</cvename>
</references>
<dates>
<discovery>2006-02-23</discovery>
<entry>2006-02-24</entry>
</dates>
</vuln>
<vuln vid="e319da0b-a228-11da-b410-000e0c2e438a">
<topic>gedit -- format string vulnerability</topic>
<affects>
<package>
<name>gedit</name>
<range><lt>2.10.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Yan Feng reports a format string vulnerability in gedit.
This vulnerability could cause a denial of service with a
binary file that contains format string characters within
the filename. It had been reported that web browsers
and email clients can be configured to provide a filename as
an argument to gedit.:</p>
</body>
</description>
<references>
<cvename>CAN-2005-1686</cvename>
<mlist msgid="20050520202628.12260.qmail@www.securityfocus.com">:http://marc.theaimsgroup.com/?l=bugtraq&amp;m=111661117701398</mlist>
</references>
<dates>
<discovery>2005-05-20</discovery>
<entry>2006-02-20</entry>
</dates>
</vuln>
<vuln vid="07ead557-a220-11da-b410-000e0c2e438a">
<topic>WebCalendar -- unauthorized access vulnerability</topic>
<affects>
<package>
<name>WebCalendar</name>
<range><lt>1.0.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SecurityFocus reports that WebCalendar is affected by
an unauthorized access vulnerability. The vulnerability
is caused by improper checking of the authentication
mechanism before access is being permitted to the
"assistant_edit.php" file.</p>
</body>
</description>
<references>
<bid>14072</bid>
<cvename>CAN-2005-2320</cvename>
</references>
<dates>
<discovery>2005-06-27</discovery>
<entry>2006-02-20</entry>
</dates>
</vuln>
<vuln vid="9cd52bc6-a213-11da-b410-000e0c2e438a">
<topic>abiword, koffice -- stack based buffer overflow vulnerabilities</topic>
<affects>
<package>
<name>koffice</name>
<range><gt>1.2.0</gt><lt>1.4.1_1,1</lt></range>
</package>
<package>
<name>abiword</name>
<range><lt>2.2.11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chris Evans reports that AbiWord is vulnerable to multiple
stack-based buffer overflow vulnerabilities. This
is caused by improper checking of the user-supplied data
before it is being copied to an too small buffer. The
vulnerability is triggered when someone is importing RTF
files.</p>
</body>
</description>
<references>
<bid>15096</bid>
<cvename>CAN-2005-2972</cvename>
<url>http://scary.beasts.org/security/CESA-2005-006.txt</url>
<url>http://www.abisource.com/changelogs/2.2.11.phtml</url>
<url>http://www.kde.org/info/security/advisory-20051011-1.txt</url>
</references>
<dates>
<discovery>2005-10-14</discovery>
<entry>2006-02-20</entry>
<modified>2006-02-20</modified>
</dates>
</vuln>
<vuln vid="0b2b4b4d-a07c-11da-be0a-000c6ec775d9">
<topic>postgresql81-server -- SET ROLE privilege escalation</topic>
<affects>
<package>
<name>postgresql-server</name>
<range><ge>8.1.0</ge><lt>8.1.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PostgreSQL team reports:</p>
<blockquote cite="http://www.postgresql.org/docs/8.1/static/release.html#RELEASE-8-1-3">
<p>Due to inadequate validity checking, a user could exploit
the special case that SET ROLE normally uses to restore
the previous role setting after an error. This allowed
ordinary users to acquire superuser status, for
example.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-0553</cvename>
<url>http://www.postgresql.org/docs/8.1/static/release.html#RELEASE-8-1-3</url>
</references>
<dates>
<discovery>2006-02-14</discovery>
<entry>2006-02-18</entry>
<modified>2006-08-13</modified>
</dates>
</vuln>
<vuln vid="63fe4189-9f97-11da-ac32-0001020eed82">
<topic>gnupg -- false positive signature verification</topic>
<affects>
<package>
<name>gnupg</name>
<range><lt>1.4.2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Werner Koch reports:</p>
<blockquote cite="http://marc.theaimsgroup.com/?l=gnupg-devel&amp;m=113999098729114">
<p>The Gentoo project identified a security related bug in
GnuPG. When using any current version of GnuPG for
unattended signature verification (e.g. by scripts and
mail programs), false positive signature verification of
detached signatures may occur.</p>
<p>This problem affects the tool *gpgv*, as well as using
"gpg --verify" to imitate gpgv, if only the exit code of
the process is used to decide whether a detached signature
is valid. This is a plausible mode of operation for
gpgv.</p>
<p>If, as suggested, the --status-fd generated output is
used to decide whether a signature is valid, no problem
exists. In particular applications making use of the
GPGME library[2] are not affected.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-0455</cvename>
<mlist msgid="87u0b1xdru.fsf@wheatstone.g10code.de">http://marc.theaimsgroup.com/?l=gnupg-devel&amp;m=113999098729114</mlist>
</references>
<dates>
<discovery>2006-02-15</discovery>
<entry>2006-02-17</entry>
</dates>
</vuln>
<vuln vid="e34d0c2e-9efb-11da-b410-000e0c2e438a">
<topic>rssh -- privilege escalation vulnerability</topic>
<affects>
<package>
<name>rssh</name>
<range><lt>2.3.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Pizzashack reports:</p>
<blockquote cite="http://www.pizzashack.org/rssh/security.shtml">
<p>Max Vozeler has reported a problem whereby rssh can
allow users who have shell access to systems where rssh
is installed (and rssh_chroot_helper is installed SUID)
to gain root access to the system, due to the ability to
chroot to arbitrary locations. There are a lot of
potentially mitigating factors, but to be safe you should
upgrade immediately.</p>
</blockquote>
</body>
</description>
<references>
<bid>16050</bid>
<cvename>CVE-2005-3345</cvename>
<url>http://www.pizzashack.org/rssh/security.shtml</url>
</references>
<dates>
<discovery>2005-12-18</discovery>
<entry>2006-02-16</entry>
</dates>
</vuln>
<vuln vid="d38e1810-9ef7-11da-b410-000e0c2e438a">
<topic>tor -- malicious tor server can locate a hidden service</topic>
<affects>
<package>
<name>tor</name>
<range><lt>0.1.0.12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Roger Dingledine reports:</p>
<blockquote cite="http://archives.seul.org/or/announce/Jan-2006/msg00001.html">
<p>If you offer a Tor hidden service, an adversary who can
run a fast Tor server and who knows some basic statistics
can find the location of your hidden service in a matter of
minutes to hours.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-0414</cvename>
<url>http://archives.seul.org/or/announce/Jan-2006/msg00001.html</url>
</references>
<dates>
<discovery>2006-01-12</discovery>
<entry>2006-02-16</entry>
</dates>
</vuln>
<vuln vid="1b725079-9ef6-11da-b410-000e0c2e438a">
<topic>sudo -- arbitrary command execution</topic>
<affects>
<package>
<name>sudo</name>
<range><lt>1.6.8.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Tavis Ormandy reports:</p>
<blockquote cite="http://www.courtesan.com/sudo/alerts/bash_env.html">
<p>The bash shell uses the value of the PS4 environment
variable (after expansion) as a prefix for commands run
in execution trace mode. Execution trace mode (xtrace) is
normally set via bash's -x command line option or
interactively by running "set -o xtrace". However, it may
also be enabled by placing the string "xtrace" in the
SHELLOPTS environment variable before bash is started.</p>
<p>A malicious user with sudo access to a shell script that
uses bash can use this feature to run arbitrary commands
for each line of the script.</p>
</blockquote>
</body>
</description>
<references>
<bid>15191</bid>
<cvename>CVE-2005-2959</cvename>
<url>http://www.courtesan.com/sudo/alerts/bash_env.html</url>
</references>
<dates>
<discovery>2005-10-25</discovery>
<entry>2006-02-16</entry>
</dates>
</vuln>
<vuln vid="a78299e7-9ef3-11da-b410-000e0c2e438a">
<topic>libtomcrypt -- weak signature scheme with ECC keys</topic>
<affects>
<package>
<name>libtomcrypt</name>
<range><le>1.02</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Secure Science Corporation reports that libtomcrypt is
vulnerable to a weak signature scheme. This allows an
attacker to create a valid random signature and use that to
sign arbitrary messages without requiring the private key.</p>
</body>
</description>
<references>
<mlist msgid="4276CC31.9000307@securescience.net">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=111540819703204</mlist>
</references>
<dates>
<discovery>2005-05-01</discovery>
<entry>2006-02-16</entry>
</dates>
</vuln>
<vuln vid="592815da-9eed-11da-b410-000e0c2e438a">
<topic>mantis -- "view_filters_page.php" cross site scripting vulnerability</topic>
<affects>
<package>
<name>mantis</name>
<range><lt>1.0.0a4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>r0t reports:</p>
<blockquote cite="http://pridels.blogspot.com/2005/12/mantis-bugtracking-system-xss-vuln.html">
<p>Mantis contains a flaw that allows a remote cross site
scripting attack. This flaw exists because input passed to
"target_field" parameter in "view_filters_page.php" is not
properly sanitised before being returned to the user. This
could allow a user to create a specially crafted URL that
would execute arbitrary code in a user's browser within the
trust relationship between the browser and the server,
leading to a loss of integrity.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CAN-2005-4238</cvename>
<url>http://pridels.blogspot.com/2005/12/mantis-bugtracking-system-xss-vuln.html</url>
</references>
<dates>
<discovery>2005-12-13</discovery>
<entry>2006-02-16</entry>
</dates>
</vuln>
<vuln vid="28c9243a-72ed-11da-8c1d-000e0c2e438a">
<topic>phpbb -- multiple vulnerabilities</topic>
<affects>
<package>
<name>phpbb</name>
<name>zh-phpbb-tw</name>
<range><lt>2.0.18</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Multiple vulnerabilities have been reported within phpbb.
phpbb is proven vulnerable to:</p>
<ul>
<li>script insertion,</li>
<li>bypassing of protetion mechanisms,</li>
<li>multiple cross site scripting vulnerabilities,</li>
<li>SQL injection,</li>
<li>arbitrary code execution</li>
</ul>
</body>
</description>
<references>
<bid>15170</bid>
<bid>15243</bid>
<cvename>CVE-2005-3310</cvename>
<cvename>CVE-2005-3415</cvename>
<cvename>CVE-2005-3416</cvename>
<cvename>CVE-2005-3417</cvename>
<cvename>CVE-2005-3418</cvename>
<cvename>CVE-2005-3419</cvename>
<cvename>CVE-2005-3420</cvename>
<cvename>CVE-2005-3536</cvename>
<cvename>CVE-2005-3537</cvename>
<mlist msgid="20051022132217.10390.qmail@securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=113017003617987</mlist>
<url>http://www.hardened-php.net/advisory_172005.75.html</url>
</references>
<dates>
<discovery>2005-10-24</discovery>
<entry>2006-02-16</entry>
</dates>
</vuln>
<vuln vid="486aff57-9ecd-11da-b410-000e0c2e438a">
<topic>postgresql -- character conversion and tsearch2 vulnerabilities</topic>
<affects>
<package>
<name>postgresql</name>
<range><ge>7.2.0</ge><lt>7.2.8</lt></range>
<range><ge>7.3.0</ge><lt>7.3.10</lt></range>
<range><ge>7.4.0</ge><lt>7.4.8</lt></range>
<range><ge>8.0.0</ge><lt>8.0.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The postgresql development team reports:</p>
<blockquote cite="http://www.postgresql.org/about/news.315">
<p>The more severe of the two errors is that the functions
that support client-to-server character set conversion
can be called from SQL commands by unprivileged users,
but these functions are not designed to be safe against
malicious choices of argument values. This problem exists
in PostgreSQL 7.3.* through 8.0.*. The recommended fix is
to disable public EXECUTE access for these functions. This
does not affect normal usage of the functions for character
set conversion, but it will prevent misuse.</p>
<p>The other error is that the contrib/tsearch2 module
misdeclares several functions as returning type "internal"
when they do not have any "internal" argument. This breaks
the type safety of "internal" by allowing users to
construct SQL commands that invoke other functions accepting
"internal" arguments. The consequences of this have not been
investigated in detail, but it is certainly at least possible
to crash the backend.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CAN-2005-1409</cvename>
<cvename>CAN-2005-1410</cvename>
<url>http://www.postgresql.org/about/news.315</url>
</references>
<dates>
<discovery>2005-05-02</discovery>
<entry>2006-02-16</entry>
</dates>
</vuln>
<vuln vid="f6447303-9ec9-11da-b410-000e0c2e438a">
<topic>heartbeat -- insecure temporary file creation vulnerability</topic>
<affects>
<package>
<name>heartbeat</name>
<range><lt>1.2.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Eric Romang reports a temporary file creation vulnerability
within heartbeat. The vulnerability is caused by hardcoded
temporary file usage. This can cause an attacker to create
an arbitrary symlink causing the application to overwrite the
symlinked file with the permissions of the user executing the
application.</p>
</body>
</description>
<references>
<cvename>CAN-2005-2231</cvename>
<url>http://www.zataz.net/adviso/heartbeat-06272005.txt</url>
</references>
<dates>
<discovery>2005-07-12</discovery>
<entry>2006-02-16</entry>
<modified>2006-04-16</modified>
</dates>
</vuln>
<vuln vid="432bf98d-9e25-11da-b410-000e0c2e438a">
<topic>kpdf -- heap based buffer overflow</topic>
<affects>
<package>
<name>kdegraphics</name>
<range><lt>3.5.1_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The KDE team reports:</p>
<blockquote cite="http://www.kde.org/info/security/advisory-20060202-1.txt">
<p>kpdf, the KDE pdf viewer, shares code with xpdf. xpdf
contains a heap based buffer overflow in the splash
rasterizer engine that can crash kpdf or even execute
arbitrary code.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-0301</cvename>
<url>http://www.kde.org/info/security/advisory-20060202-1.txt</url>
</references>
<dates>
<discovery>2006-02-02</discovery>
<entry>2006-02-15</entry>
</dates>
</vuln>
<vuln vid="bb33981a-7ac6-11da-bf72-00123f589060">
<topic>perl, webmin, usermin -- perl format string integer wrap vulnerability</topic>
<affects>
<package>
<name>perl</name>
<range><ge>5.6.0</ge><lt>5.6.2</lt></range>
<range><ge>5.8.0</ge><lt>5.8.7_1</lt></range>
</package>
<package>
<name>webmin</name>
<range><lt>1.250</lt></range>
</package>
<package>
<name>usermin</name>
<range><lt>1.180</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Perl Development page reports:</p>
<blockquote cite="http://dev.perl.org/perl5/news/2005/perl_patches_fix_sprintf_buffer.html">
<p>Dyad Security recently released a security advisory explaining how
in certain cases, a carefully crafted format string passed to
sprintf can cause a buffer overflow. This buffer overflow can then
be used by an attacker to execute code on the machine. This was
discovered in the context of a design problem with the Webmin
administration package that allowed a malicious user to pass
unchecked data into sprintf.</p>
</blockquote>
</body>
</description>
<references>
<bid>15629</bid>
<cvename>CVE-2005-3912</cvename>
<cvename>CVE-2005-3962</cvename>
<url>http://dev.perl.org/perl5/news/2005/perl_patches_fix_sprintf_buffer.html</url>
<url>http://www.dyadsecurity.com/perl-0002.html</url>
<url>http://www.dyadsecurity.com/webmin-0001.html</url>
<url>http://www.webmin.com/security.html</url>
</references>
<dates>
<discovery>2005-09-23</discovery>
<entry>2006-02-15</entry>
</dates>
</vuln>
<vuln vid="12f9d9e9-9e1e-11da-b410-000e0c2e438a">
<topic>phpicalendar -- cross site scripting vulnerability</topic>
<affects>
<package>
<name>phpicalendar</name>
<range><lt>2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Francesco Ongaro reports that phpicalendar is vulnerable for
a cross site scripting attack. The vulnerability is caused by
improper validation of the index.php file allowing attackers
to include an arbitrary file with the .php extension</p>
</body>
</description>
<references>
<bid>15193</bid>
<cvename>CVE-2005-3366</cvename>
<url>http://www.ush.it/2005/10/25/php-icalendar-css/</url>
</references>
<dates>
<discovery>2005-10-25</discovery>
<entry>2006-02-15</entry>
</dates>
</vuln>
<vuln vid="f1f163ce-9e09-11da-b410-000e0c2e438a">
<topic>phpicalendar -- file disclosure vulnerability</topic>
<affects>
<package>
<name>phpicalendar</name>
<range><lt>2.21</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpicalendar team reports that there is an
unspecified vulnerability within phpicalendar. This
seems to be a file disclosure vulnerability caused by
improper checking of the template parsing function.
This would allow an attacker to disclose any file
readable by the user under which the webserver runs.</p>
</body>
</description>
<references>
<url>http://phpicalendar.net/forums/viewtopic.php?t=396</url>
</references>
<dates>
<discovery>2006-02-08</discovery>
<entry>2006-02-15</entry>
</dates>
</vuln>
<vuln vid="dfb71c00-9d44-11da-8c1d-000e0c2e438a">
<topic>FreeBSD -- Infinite loop in SACK handling</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>5.4</ge><lt>5.4_11</lt></range>
<range><ge>5.3</ge><lt>5.3_26</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Problem description:</p>
<p>When insufficient memory is available to handle an
incoming selective acknowledgement, the TCP/IP stack may
enter an infinite loop.</p>
<p>Impact:</p>
<p>By opening a TCP connection and sending a carefully crafted
series of packets, an attacker may be able to cause a denial
of service.</p>
<p>Workaround:</p>
<p>On FreeBSD 5.4, the net.inet.tcp.sack.enable sysctl can be used to
disable the use of SACK:</p>
<p># sysctl net.inet.tcp.sack.enable=0</p>
<p>No workaround is available for FreeBSD 5.3.</p>
</body>
</description>
<references>
<cvename>CVE-2006-0433</cvename>
<freebsdsa>SA-06:08.sack</freebsdsa>
</references>
<dates>
<discovery>2006-02-01</discovery>
<entry>2006-02-14</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="52ba7713-9d42-11da-8c1d-000e0c2e438a">
<topic>pf -- IP fragment handling panic</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>6.0</ge><lt>6.0_4</lt></range>
<range><ge>5.4</ge><lt>5.4_10</lt></range>
<range><ge>5.3</ge><lt>5.3_25</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Problem description:</p>
<p>A logic bug in pf's IP fragment cache may result in a packet
fragment being inserted twice, violating a kernel
invariant.</p>
<p>Impact:</p>
<p>By sending carefully crafted sequence of IP packet fragments,
a remote attacker can cause a system running pf with a ruleset
containing a 'scrub fragment crop' or 'scrub fragment
drop-ovl' rule to crash.</p>
<p>Workaround:</p>
<p>Do not use 'scrub fragment crop' or 'scrub fragment drop-ovl'
rules on systems running pf. In most cases, such rules can be
replaced by 'scrub fragment reassemble' rules; see the
pf.conf(5) manual page for more details.</p>
<p>Systems which do not use pf, or use pf but do not use the
aforementioned rules, are not affected by this issue.</p>
</body>
</description>
<references>
<cvename>CVE-2006-0381</cvename>
<freebsdsa>SA-06:07.pf</freebsdsa>
</references>
<dates>
<discovery>2006-01-25</discovery>
<entry>2006-02-14</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="7a4f2aca-9d40-11da-8c1d-000e0c2e438a">
<topic>FreeBSD -- Local kernel memory disclosure</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>6.0</ge><lt>6.0_4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Problem description:</p>
<p>A buffer allocated from the kernel stack may not be completely
initialized before being copied to userland. [CVE-2006-0379]</p>
<p>A logic error in computing a buffer length may allow too much
data to be copied into userland. [CVE-2006-0380]</p>
<p>Impact:</p>
<p>Portions of kernel memory may be disclosed to local users.
Such memory might contain sensitive information, such as
portions of the file cache or terminal buffers. This
information might be directly useful, or it might be
leveraged to obtain elevated privileges in some way. For
example, a terminal buffer might include a user-entered
password.</p>
<p>Workaround:</p>
<p>No workaround is available.</p>
</body>
</description>
<references>
<cvename>CVE-2006-0379</cvename>
<cvename>CVE-2006-0380</cvename>
<freebsdsa>SA-06:06.kmem</freebsdsa>
</references>
<dates>
<discovery>2006-01-25</discovery>
<entry>2006-02-14</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="dade3316-9d31-11da-8c1d-000e0c2e438a">
<topic>IEEE 802.11 -- buffer overflow</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>6.0</ge><lt>6.0_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Problem description:</p>
<p>An integer overflow in the handling of corrupt IEEE 802.11
beacon or probe response frames when scanning for existing
wireless networks can result in the frame overflowing a
buffer.</p>
<p>Impact:</p>
<p>An attacker able broadcast a carefully crafted beacon or
probe response frame may be able to execute arbitrary code
within the context of the FreeBSD kernel on any system
scanning for wireless networks.</p>
<p>Workaround:</p>
<p>No workaround is available, but systems without IEEE 802.11
hardware or drivers loaded are not vulnerable.</p>
</body>
</description>
<references>
<cvename>CVE-2006-0226</cvename>
<freebsdsa>SA-06:05.80211</freebsdsa>
</references>
<dates>
<discovery>2006-01-18</discovery>
<entry>2006-02-14</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="d7c1d00d-9d2e-11da-8c1d-000e0c2e438a">
<topic>ipfw -- IP fragment denial of service</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>6.0</ge><lt>6.0_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Problem description:</p>
<p>The firewall maintains a pointer to layer 4 header
information in the event that it needs to send a TCP reset
or ICMP error message to discard packets. Due to incorrect
handling of IP fragments, this pointer fails to get
initialized.</p>
<p>Impact:</p>
<p>An attacker can cause the firewall to crash by sending ICMP
IP fragments to or through firewalls which match any reset,
reject or unreach actions.</p>
<p>Workaround:</p>
<p>Change any reset, reject or unreach actions to deny. It
should be noted that this will result in packets being
silently discarded.</p>
</body>
</description>
<references>
<cvename>CVE-2006-0054</cvename>
<freebsdsa>SA-06:04.ipfw</freebsdsa>
</references>
<dates>
<discovery>2006-01-11</discovery>
<entry>2006-02-14</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="1613db79-8e52-11da-8426-000fea0a9611">
<topic>kpopup -- local root exploit and local denial of service</topic>
<affects>
<package>
<name>kpopup</name>
<range><ge>0.9.1</ge><le>0.9.5</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mitre CVE reports:</p>
<blockquote cite="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-1170">
<p>Format string vulnerability in main.cpp in kpopup
0.9.1-0.9.5pre2 allows local users to cause a denial of
service (segmentation fault) and possibly execute
arbitrary code via format string specifiers in command
line arguments.</p>
</blockquote>
<blockquote cite="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-1167">
<p>misc.cpp in KPopup 0.9.1 trusts the PATH variable when
executing killall, which allows local users to elevate
their privileges by modifying the PATH variable to
reference a malicious killall program.</p>
</blockquote>
<p>SecurityFocus credits "b0f" b0fnet@yahoo.com</p>
</body>
</description>
<references>
<cvename>CVE-2003-1170</cvename>
<bid>8918</bid>
<cvename>CVE-2003-1167</cvename>
<bid>8915</bid>
<url>http://www.securityfocus.com/archive/1/342736</url>
<url>http://www.henschelsoft.de/kpopup_en.html</url>
</references>
<dates>
<discovery>2003-10-28</discovery>
<entry>2006-02-07</entry>
</dates>
</vuln>
<vuln vid="6b0215ae-8f26-11da-8c1d-000e0c2e438a">
<topic>cpio -- multiple vulnerabilities</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>6.0</ge><lt>6.0_2</lt></range>
<range><ge>5.4</ge><lt>5.4_9</lt></range>
<range><ge>5.3</ge><lt>5.3_24</lt></range>
<range><ge>4.11</ge><lt>4.11_14</lt></range>
<range><ge>4.10</ge><lt>4.10_20</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Problem description:</p>
<p>A number of issues has been discovered in cpio:</p>
<p>When creating a new file, cpio closes the file before setting
its permissions. (CVE-2005-1111)</p>
<p>When extracting files cpio does not properly sanitize file
names to filter out ".." components, even if the
--no-absolute-filenames option is used. (CVE-2005-1229)</p>
<p>When adding large files (larger than 4 GB) to a cpio archive
on 64-bit platforms an internal buffer might overflow.
(CVE-2005-4268)</p>
<p>Impact</p>
<p>The first problem can allow a local attacker to change the
permissions of files owned by the user executing cpio providing
that they have write access to the directory in which the file
is being extracted. (CVE-2005-1111)</p>
<p>The lack of proper file name sanitation can allow an attacker
to overwrite arbitrary local files when extracting files from
a cpio archive. (CVE-2005-1229)</p>
<p>The buffer-overflow on 64-bit platforms could lead cpio to a
Denial-of-Service situation (crash) or possibly execute
arbitrary code with the permissions of the user running
cpio. (CVE-2005-4268)</p>
<p>Workaround</p>
<p>Use a different utility to create and extract cpio archives,
for example pax(1) or (on FreeBSD 5.3 or later) tar(1). If
this is not possible, do not extract untrusted archives and
when running on 64-bit platforms do not add untrusted files
to cpio archives.</p>
</body>
</description>
<references>
<cvename>CVE-2005-1111</cvename>
<cvename>CVE-2005-1229</cvename>
<cvename>CVE-2005-4268</cvename>
<freebsdsa>SA-06:03.cpio</freebsdsa>
</references>
<dates>
<discovery>2006-01-11</discovery>
<entry>2006-01-27</entry>
</dates>
</vuln>
<vuln vid="726dd9bd-8f25-11da-8c1d-000e0c2e438a">
<topic>ee -- temporary file privilege escalation</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>6.0</ge><lt>6.0_2</lt></range>
<range><ge>5.4</ge><lt>5.4_9</lt></range>
<range><ge>5.3</ge><lt>5.3_24</lt></range>
<range><ge>4.11</ge><lt>4.11_14</lt></range>
<range><ge>4.10</ge><lt>4.10_20</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Problem description</p>
<p>The ispell_op function used by ee(1) while executing spell
check operations employs an insecure method of temporary file
generation. This method produces predictable file names based
on the process ID and fails to confirm which path will be over
written with the user.<br/>
It should be noted that ispell does not have to be installed
in order for this to be exploited. The option simply needs to
be selected.</p>
<p>Impact</p>
<p>These predictable temporary file names are problematic
because they allow an attacker to take advantage of a race
condition in order to execute a symlink attack, which could
allow them to overwrite files on the system in the context of
the user running the ee(1) editor.</p>
<p>Workaround</p>
<p>Instead of invoking ispell through ee(1), invoke it directly.</p>
</body>
</description>
<references>
<bid>16207</bid>
<cvename>CVE-2006-0055</cvename>
<freebsdsa>SA-06:02.ee</freebsdsa>
</references>
<dates>
<discovery>2006-01-11</discovery>
<entry>2006-01-27</entry>
</dates>
</vuln>
<vuln vid="c01a25f5-8f20-11da-8c1d-000e0c2e438a">
<topic>texindex -- temporary file privilege escalation</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>6.0</ge><lt>6.0_2</lt></range>
<range><ge>5.4</ge><lt>5.4_9</lt></range>
<range><ge>5.3</ge><lt>5.3_24</lt></range>
<range><ge>4.11</ge><lt>4.11_14</lt></range>
<range><ge>4.10</ge><lt>4.10_20</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Problem description</p>
<p>The "sort_offline" function used by texindex(1) employs the
"maketempname" function, which produces predictable file names
and fails to validate that the paths do not exist.</p>
<p>Impact</p>
<p>These predictable temporary file names are problematic because
they allow an attacker to take advantage of a race condition in
order to execute a symlink attack, which could enable them to
overwrite files on the system in the context of the user running
the texindex(1) utility.</p>
<p>Workaround</p>
<p>No workaround is available, but the problematic code is only
executed if the input file being processed is 500kB or more in
length; as a result, users working with documents of less than
several hundred pages are very unlikely to be affected.</p>
</body>
</description>
<references>
<bid>14854</bid>
<cvename>CAN-2005-3011</cvename>
<freebsdsa>SA-06:01.texindex</freebsdsa>
</references>
<dates>
<discovery>2006-01-11</discovery>
<entry>2006-01-27</entry>
</dates>
</vuln>
<vuln vid="c5c17ead-8f23-11da-8c1d-000e0c2e438a">
<topic>cvsbug -- race condition</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>5.4</ge><lt>5.4_7</lt></range>
<range><ge>5.3</ge><lt>5.3_22</lt></range>
<range><ge>4.11</ge><lt>4.11_12</lt></range>
<range><ge>4.10</ge><lt>4.10_18</lt></range>
</package>
<package>
<name>cvs+ipv6</name>
<range><lt>1.11.17_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Problem description</p>
<p>A temporary file is created, used, deleted, and then
re-created with the same name. This creates a window during
which an attacker could replace the file with a link to
another file. While cvsbug(1) is based on the send-pr(1)
utility, this problem does not exist in the version of
send-pr(1) distributed with FreeBSD.<br/>
In FreeBSD 4.10 and 5.3, some additional problems exist
concerning temporary file usage in both cvsbug(1) and
send-pr(1).</p>
<p>Impact</p>
<p>A local attacker could cause data to be written to any file
to which the user running cvsbug(1) (or send-pr(1) in FreeBSD
4.10 and 5.3) has write access. This may cause damage in
itself (e.g., by destroying important system files or
documents) or may be used to obtain elevated privileges.</p>
<p>Workaround</p>
<p>Do not use the cvsbug(1) utility on any system with untrusted
users.<br/>
Do not use the send-pr(1) utility on a FreeBSD 4.10 or 5.3
system with untrusted users.</p>
</body>
</description>
<references>
<cvename>CAN-2005-2693</cvename>
<freebsdsa>SA-05:20.cvsbug</freebsdsa>
</references>
<dates>
<discovery>2005-09-07</discovery>
<entry>2006-01-27</entry>
<modified>2006-11-08</modified>
</dates>
</vuln>
<vuln vid="57a0242d-8c4e-11da-8ddf-000ae42e9b93">
<topic>sge -- local root exploit in bundled rsh executable</topic>
<affects>
<package>
<name>sge</name>
<name>sgeee</name>
<range><lt>5.3.6.20040330_1</lt></range>
<range><gt>6.*</gt><lt>6.0.7.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Sun Microsystems reports:</p>
<blockquote cite="http://gridengine.sunsource.net/project/gridengine/news/SGE60u7_1-announce.html">
<p>The SGE 6.0u7_1 release fixes a security bug which can
allow malicious users to gain root access.</p>
</blockquote>
</body>
</description>
<references>
<url>http://gridengine.sunsource.net/project/gridengine/news/SGE60u7_1-announce.html</url>
</references>
<dates>
<discovery>2005-12-23</discovery>
<entry>2006-01-23</entry>
</dates>
</vuln>
<vuln vid="f11d3b22-88c6-11da-a7b2-0060084a00e5">
<topic>fetchmail -- crash when bouncing a message</topic>
<affects>
<package>
<name>fetchmail</name>
<range><ge>6.3.0</ge><lt>6.3.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Matthias Andree reports:</p>
<blockquote cite="http://www.fetchmail.info/fetchmail-SA-2006-01.txt">
<p>Fetchmail contains a bug that causes itself to crash when
bouncing a message to the originator or to the local
postmaster. The crash happens after the bounce message has
been sent, when fetchmail tries to free the dynamic array
of failed addresses, and calls the free() function with an
invalid pointer.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-0321</cvename>
<url>http://www.fetchmail.info/fetchmail-SA-2006-01.txt</url>
<url>http://bugs.debian.org/348747</url>
</references>
<dates>
<discovery>2006-01-22</discovery>
<entry>2006-01-23</entry>
</dates>
</vuln>
<vuln vid="612a34ec-81dc-11da-a043-0002a5c3d308">
<topic>clamav -- possible heap overflow in the UPX code</topic>
<affects>
<package>
<name>clamav</name>
<range><lt>0.88</lt></range>
</package>
<package>
<name>clamav-devel</name>
<range><lt>20060110</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Zero Day Initiative reports:</p>
<blockquote cite="http://www.zerodayinitiative.com/advisories/ZDI-06-001.html">
<p>This vulnerability allows remote attackers to execute
arbitrary code on vulnerable Clam AntiVirus
installations. Authentication is not required to exploit
this vulnerability.</p>
<p>This specific flaw exists within libclamav/upx.c during
the unpacking of executable files compressed with UPX. Due
to an invalid size calculation during a data copy from the
user-controlled file to heap allocated memory, an
exploitable memory corruption condition is created.</p>
</blockquote>
</body>
</description>
<references>
<bid>16191</bid>
<cvename>CVE-2006-0162</cvename>
<mlist>http://lurker.clamav.net/message/20060109.213247.a16ae8db.en.html</mlist>
<url>http://www.zerodayinitiative.com/advisories/ZDI-06-001.html</url>
<url>http://secunia.com/advisories/18379/</url>
</references>
<dates>
<discovery>2006-01-09</discovery>
<entry>2006-01-10</entry>
<modified>2006-01-15</modified>
</dates>
</vuln>
<vuln vid="6d9a28f8-8152-11da-817c-0001020eed82">
<topic>milter-bogom -- headerless message crash</topic>
<affects>
<package>
<name>milter-bogom</name>
<range><lt>1.8.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Juan J. Marítnez reports:</p>
<blockquote cite="http://www.usebox.net/jjm/bogom/errata/bogom-errata-2006-1.txt">
<p>The milter crashes while processing a headerless
message</p>
<p>Impact: bogom crashes and sendmail moves it to error
state</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.usebox.net/jjm/bogom/errata/bogom-errata-2006-1.txt</url>
<mlist>http://alf.dyndns.ws/pipermail/milter/2006-January/000076.html</mlist>
</references>
<dates>
<discovery>2006-01-05</discovery>
<entry>2006-01-09</entry>
</dates>
</vuln>
<vuln vid="b747b2a9-7be0-11da-8ec4-0002b3b60e4c">
<topic>bogofilter -- heap corruption through excessively long words</topic>
<affects>
<package>
<name>bogofilter</name>
<range><ge>0.96.2</ge><lt>0.96.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Matthias Andree reports:</p>
<blockquote cite="http://bogofilter.sourceforge.net/security/bogofilter-SA-2005-02">
<p>Bogofilter's/bogolexer's input handling in version 0.96.2 was not
keeping track of its output buffers properly and could overrun a
heap buffer if the input contained words whose length exceeded
16,384 bytes, the size of flex's input buffer. A "word" here refers
to a contiguous run of input octets that was not '_' and did not
match at least one of ispunct(), iscntrl() or isspace().</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2005-4592</cvename>
<url>http://bogofilter.sourceforge.net/security/bogofilter-SA-2005-02</url>
</references>
<dates>
<discovery>2005-10-23</discovery>
<entry>2006-01-07</entry>
</dates>
</vuln>
<vuln vid="92140bc9-7bde-11da-8ec4-0002b3b60e4c">
<topic>bogofilter -- heap corruption through malformed input</topic>
<affects>
<package>
<name>bogofilter</name>
<range><ge>0.93.5</ge><lt>0.96.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Matthias Andree reports:</p>
<blockquote cite="http://bogofilter.sourceforge.net/security/bogofilter-SA-2005-01">
<p>When using Unicode databases (default in more recent bogofilter
installations), upon encountering invalid input sequences,
bogofilter or bogolexer could overrun a malloc()'d buffer,
corrupting the heap, while converting character sets. Bogofilter
would usually be processing untrusted data received from the
network at that time.</p>
<p>This problem was aggravated by an unrelated bug that made
bogofilter process binary attachments as though they were text, and
attempt charset conversion on them. Given the MIME default
character set, US-ASCII, all input octets in the range 0x80...0xff
were considered invalid input sequences and could trigger the heap
corruption.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2005-4591</cvename>
<url>http://bogofilter.sourceforge.net/security/bogofilter-SA-2005-01</url>
</references>
<dates>
<discovery>2005-10-22</discovery>
<entry>2006-01-07</entry>
</dates>
</vuln>
<vuln vid="c2fdb3bc-7d72-11da-b96e-000fb586ba73">
<topic>rxvt-unicode -- restore permissions on tty devices</topic>
<affects>
<package>
<name>rxvt-unicode</name>
<range><lt>6.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A rxvt-unicode changelog reports:</p>
<blockquote cite="http://dist.schmorp.de/rxvt-unicode/Changes">
<p>SECURITY FIX: on systems using openpty, permissions were
not correctly updated on the tty device and were left as
world-readable and world-writable (likely in original rxvt,
too), and were not restored properly. Affected are only
systems where non-unix ptys were used (such as most BSDs).
Found, patched and debugged by Ryan Beasley.</p>
</blockquote>
</body>
</description>
<references>
<url>http://dist.schmorp.de/rxvt-unicode/Changes</url>
</references>
<dates>
<discovery>2005-12-31</discovery>
<entry>2006-01-04</entry>
</dates>
</vuln>
<vuln vid="9fff8dc8-7aa7-11da-bf72-00123f589060">
<topic>apache -- mod_imap cross-site scripting flaw</topic>
<affects>
<package>
<name>apache</name>
<range><ge>1.3</ge><lt>1.3.34_3</lt></range>
<range><ge>2.0.35</ge><lt>2.0.55_2</lt></range>
<range><ge>2.1</ge><lt>2.1.9_3</lt></range>
<range><ge>2.2</ge><lt>2.2.0_3</lt></range>
</package>
<package>
<name>apache+mod_perl</name>
<range><lt>1.3.34_1</lt></range>
</package>
<package>
<name>apache_fp</name>
<range><ge>0</ge></range>
</package>
<package>
<name>apache+ipv6</name>
<range><lt>1.3.37</lt></range>
</package>
<package>
<name>ru-apache</name>
<range><lt>1.3.34+30.22_1</lt></range>
</package>
<package>
<name>ru-apache+mod_ssl</name>
<range><lt>1.3.34+30.22+2.8.25_1</lt></range>
</package>
<package>
<name>apache+ssl</name>
<range><ge>1.3.0</ge><lt>1.3.33.1.55_2</lt></range>
</package>
<package>
<name>apache+mod_ssl</name>
<name>apache+mod_ssl+ipv6</name>
<name>apache+mod_ssl+mod_accel</name>
<name>apache+mod_ssl+mod_accel+ipv6</name>
<name>apache+mod_ssl+mod_accel+mod_deflate</name>
<name>apache+mod_ssl+mod_accel+mod_deflate+ipv6</name>
<name>apache+mod_ssl+mod_deflate</name>
<name>apache+mod_ssl+mod_deflate+ipv6</name>
<name>apache+mod_ssl+mod_snmp</name>
<name>apache+mod_ssl+mod_snmp+mod_accel</name>
<name>apache+mod_ssl+mod_snmp+mod_accel+ipv6</name>
<name>apache+mod_ssl+mod_snmp+mod_deflate</name>
<name>apache+mod_ssl+mod_snmp+mod_deflate+ipv6</name>
<name>apache+mod_ssl+mod_snmp+mod_accel+mod_deflate+ipv6</name>
<range><lt>1.3.34+2.8.25_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Apache HTTP Server Project reports:</p>
<blockquote cite="http://httpd.apache.org/security/vulnerabilities_13.html">
<p>A flaw in mod_imap when using the Referer directive with
image maps. In certain site configurations a remote
attacker could perform a cross-site scripting attack if a
victim can be forced to visit a malicious URL using
certain web browsers.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2005-3352</cvename>
<bid>15834</bid>
<url>http://www.apacheweek.com/features/security-13</url>
<url>http://www.apacheweek.com/features/security-20</url>
</references>
<dates>
<discovery>2005-11-01</discovery>
<entry>2006-01-01</entry>
<modified>2009-01-23</modified>
</dates>
</vuln>
Reference in a new issue View git blame Copy permalink