<vuln vid="cf484358-b5d6-11dc-8de0-001c2514716c">
<topic>dovecot -- Specific LDAP + auth cache configuration may mix up user logins</topic>
<affects>
<package>
<name>dovecot</name>
<range><lt>1.0.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Dovecot reports:</p>
<blockquote cite="http://www.dovecot.org/list/dovecot-news/2007-December/000057.html">
<p>If two users with the same password and same pass_filter
variables log in within auth_cache_ttl seconds (1h by default),
the second user may get logged in with the first user's cached
pass_attrs. For example if pass_attrs contained the user's
home/mail directory, this would mean that the second user will
be accessing the first user's mails.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.dovecot.org/list/dovecot-news/2007-December/000057.html</url>
</references>
<dates>
<discovery>2007-12-21</discovery>
<entry>2007-12-29</entry>
</dates>
</vuln>
<vuln vid="4aab7bcd-b294-11dc-a6f0-00a0cce0781e">
<topic>gallery2 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>gallery2</name>
<range><lt>2.2.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Gallery team reports:</p>
<blockquote cite="http://gallery.menalto.com/gallery_2.2.4_released">
<p>Gallery 2.2.4 addresses the following security
vulnerabilities:</p>
<ul>
<li>Publish XP module - Fixed unauthorized album creation
and file uploads.</li>
<li>URL rewrite module - Fixed local file inclusion
vulnerability in unsecured admin controller and
information disclosure in hotlink protection.</li>
<li>Core / add-item modules - Fixed Cross Site Scripting
(XSS) vulnerabilities through malicious file names.</li>
<li>Installation (Gallery application) - Update
web-accessibility protection of the storage folder for
Apache 2.2.</li>
<li>Core (Gallery application) / MIME module - Fixed
vulnerability in checks for disallowed file extensions
in file uploads.</li>
<li>Gallery Remote module - Added missing permissions
checks for some GR commands.</li>
<li>WebDAV module - Fixed Cross Site Scripting (XSS)
vulnerability through HTTP PROPPATCH.</li>
<li>WebDAV module - Fixed information (item data)
disclosure in a WebDAV view.</li>
<li>Comment module - Fixed information (item data)
disclosure in comment views.</li>
<li>Core module (Gallery application) - Improved
resilience against item information disclosure
attacks.</li>
<li>Slideshow module - Fixed information (item data)
disclosure in the slideshow.</li>
<li>Print modules - Fixed information (item data)
disclosure in several print modules.</li>
<li>Core / print modules - Fixed arbitrary URL redirection
(phishing attacks) in the core module and several print
modules.</li>
<li>WebCam module - Fixed proxied request weakness.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-6685</cvename>
<cvename>CVE-2007-6686</cvename>
<cvename>CVE-2007-6687</cvename>
<cvename>CVE-2007-6689</cvename>
<cvename>CVE-2007-6690</cvename>
<cvename>CVE-2007-6692</cvename>
<url>http://gallery.menalto.com/gallery_2.2.4_released</url>
</references>
<dates>
<discovery>2007-12-24</discovery>
<entry>2007-12-25</entry>
<modified>2010-05-12</modified>
</dates>
</vuln>
<vuln vid="299e3f81-aee7-11dc-b781-0016179b2dd5">
<topic>e2fsprogs -- heap buffer overflow</topic>
<affects>
<package>
<name>e2fsprogs</name>
<range><lt>1.40.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Theodore Y. Ts'o reports:</p>
<blockquote cite="http://sourceforge.net/project/shownotes.php?group_id=2406&release_id=560230">
<p>Fix a potential security vulnerability where an untrusted
filesystem can be corrupted in such a way that a program using
libext2fs will allocate a buffer which is far too small. This
can lead to either a crash or potentially a heap-based buffer
overflow crash. No known exploits exist, but main concern is
where an untrusted user who possesses privileged access in a
guest Xen environment could corrupt a filesystem which is then
accessed by thus allowing the untrusted user to gain privileged
access in the host OS. Thanks to the McAfee AVERT Research group
for reporting this issue.</p>
</blockquote>
</body>
</description>
<references>
<bid>26772</bid>
<cvename>CVE-2007-5497</cvename>
<url>http://secunia.com/advisories/27889/</url>
<url>http://sourceforge.net/project/shownotes.php?group_id=2406&release_id=560230</url>
</references>
<dates>
<discovery>2007-12-07</discovery>
<entry>2007-12-20</entry>
</dates>
</vuln>
<vuln vid="8a835235-ae84-11dc-a5f9-001a4d49522b">
<topic>wireshark -- multiple vulnerabilities</topic>
<affects>
<package>
<name>wireshark</name>
<name>wireshark-lite</name>
<name>ethereal</name>
<name>ethereal-lite</name>
<name>tethereal</name>
<name>tethereal-lite</name>
<range><ge>0.8.16</ge><lt>0.99.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Wireshark team reports of multiple vulnerabilities:</p>
<blockquote cite="http://www.wireshark.org/security/wnpa-sec-2007-03.html">
<ul>
<li>Wireshark could crash when reading an MP3 file.</li>
<li>Beyond Security discovered that Wireshark could loop
excessively while reading a malformed DNP packet.</li>
<li>Stefan Esser discovered a buffer overflow in the SSL
dissector.</li>
<li>The ANSI MAP dissector could be susceptible to a
buffer overflow on some platforms.</li>
<li>The Firebird/Interbase dissector could go into an
infinite loop or crash.</li>
<li>The NCP dissector could cause a crash.</li>
<li>The HTTP dissector could crash on some systems while
decoding chunked messages.</li>
<li>The MEGACO dissector could enter a large loop and
consume system resources.</li>
<li>The DCP ETSI dissector could enter a large loop and
consume system resources.</li>
<li>Fabiodds discovered a buffer overflow in the iSeries
(OS/400) Communication trace file parser.</li>
<li>The PPP dissector could overflow a buffer.</li>
<li>The Bluetooth SDP dissector could go into an infinite
loop.</li>
<li>A malformed RPC Portmap packet could cause a
crash.</li>
<li>The IPv6 dissector could loop excessively.</li>
<li>The USB dissector could loop excessively or crash.</li>
<li>The SMB dissector could crash.</li>
<li>The RPL dissector could go into an infinite loop.</li>
<li>The WiMAX dissector could crash due to unaligned
access on some platforms.</li>
<li>The CIP dissector could attempt to allocate a huge
amount of memory and crash.</li>
</ul>
<h2>Impact</h2>
<p>It may be possible to make Wireshark or Ethereal crash or
use up available memory by injecting a purposefully
malformed packet onto the wire or by convincing someone to
read a malformed packet trace file.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-6112</cvename>
<cvename>CVE-2007-6113</cvename>
<cvename>CVE-2007-6114</cvename>
<cvename>CVE-2007-6115</cvename>
<cvename>CVE-2007-6117</cvename>
<cvename>CVE-2007-6118</cvename>
<cvename>CVE-2007-6120</cvename>
<cvename>CVE-2007-6121</cvename>
<cvename>CVE-2007-6438</cvename>
<cvename>CVE-2007-6439</cvename>
<cvename>CVE-2007-6441</cvename>
<cvename>CVE-2007-6450</cvename>
<cvename>CVE-2007-6451</cvename>
<url>http://www.wireshark.org/security/wnpa-sec-2007-03.html</url>
</references>
<dates>
<discovery>2007-12-19</discovery>
<entry>2007-12-19</entry>
<modified>2007-12-22</modified>
</dates>
</vuln>
<vuln vid="31b045e7-ae75-11dc-a5f9-001a4d49522b">
<topic>opera -- multiple vulnerabilities</topic>
<affects>
<package>
<name>opera</name>
<name>opera-devel</name>
<name>linux-opera</name>
<range><lt>9.25</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Opera Software ASA reports about multiple security
fixes:</p>
<blockquote cite="http://www.opera.com/docs/changelogs/freebsd/925/">
<ul>
<li>Fixed an issue where plug-ins could be used to allow
cross domain scripting, as reported by David
Bloom. Details will be disclosed at a later date.</li>
<li>Fixed an issue with TLS certificates that could be
used to execute arbitrary code, as reported by Alexander
Klink (Cynops GmbH). Details will be disclosed at a
later date.</li>
<li>Rich text editing can no longer be used to allow cross
domain scripting, as reported by David Bloom. See our
advisory.</li>
<li>Prevented bitmaps from revealing random data from
memory, as reported by Gynvael Coldwind. Details will be
disclosed at a later date.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-6520</cvename>
<cvename>CVE-2007-6521</cvename>
<cvename>CVE-2007-6522</cvename>
<cvename>CVE-2007-6524</cvename>
<url>http://www.opera.com/docs/changelogs/freebsd/925/</url>
<url>http://www.opera.com/support/search/view/875/</url>
</references>
<dates>
<discovery>2007-12-19</discovery>
<entry>2007-12-19</entry>
<modified>2007-12-29</modified>
</dates>
</vuln>
<vuln vid="31435fbc-ae73-11dc-a5f9-001a4d49522b">
<topic>peercast -- buffer overflow vulnerability</topic>
<affects>
<package>
<name>peercast</name>
<range><lt>0.1218</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Luigi Auriemma reports that peercast is vulnerable to a
buffer overflow which could lead to a DoS or potentially
remote code execution:</p>
<blockquote cite="http://aluigi.altervista.org/adv/peercasthof-adv.txt">
<p>The handshakeHTTP function which handles all the requests
received by the other clients is vulnerable to a heap
overflow which allows an attacker to fill the
loginPassword and loginMount buffers located in the
Servent class with how much data he wants.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-6454</cvename>
<url>http://aluigi.altervista.org/adv/peercasthof-adv.txt</url>
<url>http://secunia.com/advisories/28120/</url>
</references>
<dates>
<discovery>2007-12-17</discovery>
<entry>2007-12-19</entry>
<modified>2010-05-12</modified>
</dates>
</vuln>
<vuln vid="fee7e059-acec-11dc-807f-001b246e4fdf">
<topic>ganglia-webfrontend -- XSS vulnerabilities</topic>
<affects>
<package>
<name>ganglia-webfrontend</name>
<range><lt>3.0.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Ganglia project reports:</p>
<blockquote cite="http://ganglia.info/?p=60">
<p>The Ganglia development team is pleased to release Ganglia
3.0.6 (Foss) which is available[...]. This release includes a
security fix for web frontend cross-scripting vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<url>http://sourceforge.net/mailarchive/message.php?msg_name=d4c731da0712101044l7245cba9l34974008879f47a3%40mail.gmail.com</url>
<url>http://sourceforge.net/mailarchive/forum.php?thread_name=d4c731da0712101044l7245cba9l34974008879f47a3%40mail.gmail.com&forum_name=ganglia-developers</url>
</references>
<dates>
<discovery>2007-12-10</discovery>
<entry>2007-12-17</entry>
<modified>2007-12-18</modified>
</dates>
</vuln>
<vuln vid="30f5ca1d-a90b-11dc-bf13-0211060005df">
<topic>qemu -- Translation Block Local Denial of Service Vulnerability</topic>
<affects>
<package>
<name>qemu</name>
<name>qemu-devel</name>
<range><lt>0.9.0_4</lt></range>
<range><ge>0.9.0s.20070101*</ge><lt>0.9.0s.20070802_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SecurityFocus reports:</p>
<blockquote cite="http://www.securityfocus.com/bid/26666/discuss">
<p>QEMU is prone to a local denial-of-service vulnerability
because it fails to perform adequate boundary checks when
handling user-supplied input.</p>
<p>Attackers can exploit this issue to cause denial-of-service
conditions. Given the nature of the issue, attackers may also be
able to execute arbitrary code, but this has not been confirmed.</p>
</blockquote>
</body>
</description>
<references>
<bid>26666</bid>
<cvename>CVE-2007-6227</cvename>
<url>http://www.securityfocus.com/archive/1/484429</url>
</references>
<dates>
<discovery>2007-11-30</discovery>
<entry>2007-12-12</entry>
<modified>2007-12-14</modified>
</dates>
</vuln>
<vuln vid="fa708908-a8c7-11dc-b41d-000fb5066b20">
<topic>drupal -- SQL injection vulnerability</topic>
<affects>
<package>
<name>drupal5</name>
<range><lt>5.4</lt></range>
</package>
<package>
<name>drupal4</name>
<range><lt>4.7.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Drupal Project reports:</p>
<blockquote cite="http://drupal.org/node/198162">
<p>The function taxonomy_select_nodes() directly injects variables
into SQL queries instead of using placeholders. While taxonomy
module itself validates the input passed to
taxonomy_select_nodes(), this is a weakness in Drupal core.
Several contributed modules, such as taxonomy_menu, ajaxLoader,
and ubrowser, directly pass user input to taxonomy_select_nodes(),
enabling SQL injection attacks by anonymous users.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-6299</cvename>
<url>http://drupal.org/node/198162</url>
<url>http://secunia.com/advisories/27932/</url>
</references>
<dates>
<discovery>2007-12-05</discovery>
<entry>2007-12-12</entry>
</dates>
</vuln>
<vuln vid="ffcbd42d-a8c5-11dc-bec2-02e0185f8d72">
<topic>samba -- buffer overflow vulnerability</topic>
<affects>
<package>
<name>samba</name>
<name>samba3</name>
<name>ja-samba</name>
<range><lt>3.0.28</lt></range>
<range><gt>*,1</gt><lt>3.0.28,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secuna Research reports:</p>
<blockquote cite="http://secunia.com/advisories/27760/">
<p>Secunia Research has discovered a vulnerability in Samba, which
can be exploited by malicious people to compromise a vulnerable
system. The vulnerability is caused due to a boundary error within
the "send_mailslot()" function. This can be exploited to cause a
stack-based buffer overflow with zero bytes via a specially crafted
"SAMLOGON" domain logon packet containing a username string placed
at an odd offset followed by an overly long GETDC string.
Successful exploitation allows execution of arbitrary code, but
requires that the "domain logons" option is enabled.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-6015</cvename>
<url>http://secunia.com/advisories/27760/</url>
</references>
<dates>
<discovery>2007-12-10</discovery>
<entry>2007-12-12</entry>
<modified>2008-09-26</modified>
</dates>
</vuln>
<vuln vid="b2571f88-a867-11dc-a6f0-00a0cce0781e">
<topic>smbftpd -- format string vulnerability</topic>
<affects>
<package>
<name>smbftpd</name>
<range><lt>0.96</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/27014/">
<p>Format string vulnerability in the SMBDirList function in dirlist.c
in SmbFTPD 0.96 allows remote attackers to execute arbitrary code
via format string specifiers in a directory name.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-5184</cvename>
<url>http://secunia.com/advisories/27014/</url>
<url>http://sourceforge.net/project/shownotes.php?release_id=543077</url>
</references>
<dates>
<discovery>2007-10-01</discovery>
<entry>2007-12-12</entry>
</dates>
</vuln>
<vuln vid="6ae7cef2-a6ae-11dc-95e6-000c29c5647f">
<topic>jetty -- multiple vulnerabilities</topic>
<affects>
<package>
<name>jetty</name>
<range><lt>6.1.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<blockquote cite="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-5613">
<p>Cross-site scripting (XSS) vulnerability in Dump Servlet in
Mortbay Jetty before 6.1.6rc1 allows remote attackers to inject
arbitrary web script or HTML via unspecified parameters and
cookies.</p>
</blockquote>
<blockquote cite="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-5614">
<p>Mortbay Jetty before 6.1.6rc1 does not properly handle "certain
quote sequences" in HTML cookie parameters, which allows remote
attackers to hijack browser sessions via unspecified vectors.</p>
</blockquote>
<blockquote cite="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-5615">
<p>CRLF injection vulnerability in Mortbay Jetty before 6.1.6rc0
allows remote attackers to inject arbitrary HTTP headers and
conduct HTTP response splitting attacks via unspecified vectors.
</p>
</blockquote>
</body>
</description>
<references>
<certvu>237888</certvu>
<certvu>212984</certvu>
<certvu>438616</certvu>
<cvename>CVE-2007-5613</cvename>
<cvename>CVE-2007-5614</cvename>
<cvename>CVE-2007-5615</cvename>
<url>http://svn.codehaus.org/jetty/jetty/trunk/VERSION.txt</url>
</references>
<dates>
<discovery>2007-12-05</discovery>
<entry>2007-12-10</entry>
</dates>
</vuln>
<vuln vid="821afaa2-9e9a-11dc-a7e3-0016360406fa">
<topic>liveMedia -- DoS vulnerability</topic>
<affects>
<package>
<name>liveMedia</name>
<range><lt>2007.11.18,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The live555 development team reports:</p>
<blockquote cite="http://www.live555.com/liveMedia/public/changelog.txt">
<p>Fixed a bounds-checking error in "parseRTSPRequestString()"
caused by an int vs. unsigned problem.</p>
</blockquote>
<blockquote cite="http://aluigi.altervista.org/adv/live555x-adv.txt">
<p>The function which handles the incoming queries from the
clients is affected by a vulnerability which allows an attacker
to crash the server remotely using the smallest RTSP query
possible to use.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-6036</cvename>
<url>http://aluigi.altervista.org/adv/live555x-adv.txt</url>
<url>http://www.live555.com/liveMedia/public/changelog.txt</url>
</references>
<dates>
<discovery>2007-11-20</discovery>
<entry>2007-12-08</entry>
<modified>2007-12-09</modified>
</dates>
</vuln>
<vuln vid="610bc692-a2ad-11dc-900c-000bcdc1757a">
<topic>GNU finger vulnerability</topic>
<affects>
<package>
<name>gnu-finger</name>
<range><le>1.37_1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>GNU security announcement:</p>
<blockquote cite="http://www.gnu.org/software/finger/">
<p>GNU Finger unfortunately has not been updated in
many years, and has known security vulnerabilities.
Please do not use it in production environments.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-1999-1165</cvename>
<url>http://www.gnu.org/software/finger/</url>
</references>
<dates>
<discovery>1999-07-21</discovery>
<entry>2007-12-05</entry>
</dates>
</vuln>
<vuln vid="6eb580d7-a29c-11dc-8919-001c2514716c">
<topic>Squid -- Denial of Service Vulnerability</topic>
<affects>
<package>
<name>squid</name>
<range><ge>2.0</ge><lt>2.6.16_1</lt></range>
<range><ge>3.*</ge><lt>3.0.r1.20071001_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Squid secuirty advisory reports:</p>
<blockquote cite="http://www.squid-cache.org/Advisories/SQUID-2007_2.txt">
<p>Due to incorrect bounds checking Squid is vulnerable
to a denial of service check during some cache update
reply processing.</p>
<p>This problem allows any client trusted to use the
service to perform a denial of service attack on the
Squid service.</p>
</blockquote>
</body>
</description>
<references>
<bid>26687</bid>
<cvename>CVE-2007-6239</cvename>
</references>
<dates>
<discovery>2007-11-28</discovery>
<entry>2007-12-04</entry>
<modified>2007-12-07</modified>
</dates>
</vuln>
<vuln vid="30acb8ae-9d46-11dc-9114-001c2514716c">
<topic>rubygem-rails -- session-fixation vulnerability</topic>
<affects>
<package>
<name>rubygem-rails</name>
<range><lt>1.2.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Rails core team reports:</p>
<blockquote cite="http://weblog.rubyonrails.com/2007/11/24/ruby-on-rails-1-2-6-security-and-maintenance-release">
<p>The rails core team has released ruby on rails 1.2.6 to
address a bug in the fix for session fixation attacks
(CVE-2007-5380). The CVE Identifier for this new issue
is CVE-2007-6077.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-6077</cvename>
</references>
<dates>
<discovery>2007-11-24</discovery>
<entry>2007-11-27</entry>
</dates>
</vuln>
<vuln vid="44fb0302-9d38-11dc-9114-001c2514716c">
<topic>rubygem-rails -- JSON XSS vulnerability</topic>
<affects>
<package>
<name>rubygem-rails</name>
<range><lt>1.2.5</lt></range>
</package>
<package>
<name>rubygem-activesupport</name>
<range><lt>1.4.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Rails core team reports:</p>
<blockquote cite="http://weblog.rubyonrails.org/2007/10/12/rails-1-2-5-maintenance-release">
<p>All users of Rails 1.2.4 or earlier are advised to upgrade
to 1.2.5, though it isn't strictly necessary if you
aren't working with JSON. For more information the JSON
vulnerability, see CVE-2007-3227.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-3227</cvename>
</references>
<dates>
<discovery>2007-10-12</discovery>
<entry>2007-11-28</entry>
<modified>2007-12-01</modified>
</dates>
</vuln>
<vuln vid="31d9fbb4-9d09-11dc-a29d-0016d325a0ed">
<topic>ikiwiki -- improper symlink verification vulnerability</topic>
<affects>
<package>
<name>ikiwiki</name>
<range><lt>2.14</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The ikiwiki development team reports:</p>
<blockquote cite="http://ikiwiki.info/security/#index29h2">
<p>Ikiwiki did not check if path to the srcdir to contained a
symlink. If an attacker had commit access to the directories in
the path, they could change it to a symlink, causing ikiwiki to
read and publish files that were not intended to be
published. (But not write to them due to other checks.)</p>
</blockquote>
</body>
</description>
<references>
<url>http://ikiwiki.info/security/#index29h2</url>
</references>
<dates>
<discovery>2007-11-26</discovery>
<entry>2007-11-27</entry>
</dates>
</vuln>
<vuln vid="f1f6f6da-9d2f-11dc-9114-001c2514716c">
<topic>firefox -- multiple remote unspecified memory corruption vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>2.0.0.10,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>2.0.0.10</lt></range>
</package>
<package>
<name>seamonkey</name>
<name>linux-seamonkey</name>
<range><lt>1.1.7</lt></range>
</package>
<package>
<name>flock</name>
<name>linux-flock</name>
<range><lt>1.0.2</lt></range>
</package>
<package>
<name>linux-firefox-devel</name>
<range><lt>3.0.a2007.12.12</lt></range>
</package>
<package>
<name>linux-seamonkey-devel</name>
<range><lt>2.0.a2007.12.12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="http://www.mozilla.org/security/announce/2007/mfsa2007-38.html">
<p>The Firefox 2.0.0.10 update contains fixes for three bugs that
improve the stability of the product. These crashes showed some
evidence of memory corruption under certain circumstances and we
presume that with enough effort at least some of these could be
exploited to run arbitrary code.</p>
</blockquote>
</body>
</description>
<references>
<bid>26593</bid>
<cvename>CVE-2007-5959</cvename>
</references>
<dates>
<discovery>2007-11-26</discovery>
<entry>2007-11-27</entry>
<modified>2007-12-14</modified>
</dates>
</vuln>
<vuln vid="15485ae8-9848-11dc-9e48-0016179b2dd5">
<topic>phpmyadmin -- Cross Site Scripting</topic>
<affects>
<package>
<name>phpmyadmin</name>
<range><lt>2.11.2.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>phpMyAdmin security announcement:</p>
<blockquote cite="http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2007-8">
<p>The login page auth_type cookie was vulnerable to XSS via
the convcharset parameter. An attacker could use this to
execute malicious code on the visitors computer</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-6100</cvename>
<url>http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2007-8</url>
<url>http://www.nth-dimension.org.uk/downloads.php?id=38</url>
</references>
<dates>
<discovery>2007-11-20</discovery>
<entry>2007-11-21</entry>
<modified>2010-05-12</modified>
</dates>
</vuln>
<vuln vid="a63b15f9-97ff-11dc-9e48-0016179b2dd5">
<topic>samba -- multiple vulnerabilities</topic>
<affects>
<package>
<name>samba</name>
<name>samba3</name>
<name>ja-samba</name>
<range><lt>3.0.26a</lt></range>
<range><gt>*,1</gt><lt>3.0.26a_2,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Samba Team reports:</p>
<blockquote cite="http://us1.samba.org/samba/security/CVE-2007-5398.html">
<p>Secunia Research reported a vulnerability that allows for
the execution of arbitrary code in nmbd. This defect may
only be exploited when the "wins support" parameter has
been enabled in smb.conf.</p>
</blockquote>
<blockquote cite="http://us1.samba.org/samba/security/CVE-2007-4572.html">
<p>Samba developers have discovered what is believed to be
a non-exploitable buffer over in nmbd during the processing
of GETDC logon server requests. This code is only used
when the Samba server is configured as a Primary or Backup
Domain Controller.</p>
</blockquote>
</body>
</description>
<references>
<bid>26454</bid>
<cvename>CVE-2007-4572</cvename>
<cvename>CVE-2007-5398</cvename>
<url>http://secunia.com/advisories/27450/</url>
<url>http://us1.samba.org/samba/security/CVE-2007-4572.html</url>
<url>http://us1.samba.org/samba/security/CVE-2007-5398.html</url>
</references>
<dates>
<discovery>2007-11-15</discovery>
<entry>2007-11-21</entry>
<modified>2008-09-26</modified>
</dates>
</vuln>
<vuln vid="392b5b1d-9471-11dc-9db7-001c2514716c">
<topic>php -- multiple security vulnerabilities</topic>
<affects>
<package>
<name>php5</name>
<range><lt>5.2.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PHP project reports:</p>
<blockquote cite="http://www.php.net/releases/5_2_5.php">
<p>Security Enhancements and Fixes in PHP 5.2.5:</p>
<ul>
<li>Fixed dl() to only accept filenames. Reported by Laurent
Gaffie.</li>
<li>Fixed dl() to limit argument size to MAXPATHLEN (CVE-2007-4887).
Reported by Laurent Gaffie.</li>
<li>Fixed htmlentities/htmlspecialchars not to accept partial
multibyte sequences. Reported by Rasmus Lerdorf</li>
<li>Fixed possible triggering of buffer overflows inside glibc
implementations of the fnmatch(), setlocale() and glob()
functions. Reported by Laurent Gaffie.</li>
<li>Fixed "mail.force_extra_parameters" php.ini directive not to be
modifiable in .htaccess due to the security implications. Reported
by SecurityReason.</li>
<li>Fixed bug #42869 (automatic session id insertion adds sessions
id to non-local forms).</li>
<li>Fixed bug #41561 (Values set with php_admin_* in httpd.conf can
be overwritten with ini_set()).</li>
</ul>
</blockquote>
</body>
</description>
<references>
<bid>26403</bid>
<cvename>CVE-2007-4887</cvename>
</references>
<dates>
<discovery>2007-11-08</discovery>
<entry>2007-11-16</entry>
</dates>
</vuln>
<vuln vid="a7080c30-91a2-11dc-b2eb-00b0d07e6c7e">
<topic>mt-daapd -- denial of service vulnerability</topic>
<affects>
<package>
<name>mt-daapd</name>
<range><lt>0.2.4.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>US-CERT reports:</p>
<blockquote cite="http://www.us-cert.gov/cas/bulletins/SB07-316.html">
<p>webserver.c in mt-dappd in Firefly Media Server 0.2.4 and
earlier allows remote attackers to cause a denial of service
(NULL dereference and daemon crash) via a stats method action
to /xml-rpc with (1) an empty Authorization header line, which
triggers a crash in the ws_decodepassword function; or (2) a
header line without a ':' character, which triggers a crash
in the ws_getheaders function.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-5824</cvename>
</references>
<dates>
<discovery>2007-11-05</discovery>
<entry>2007-11-12</entry>
</dates>
</vuln>
<vuln vid="92f86b93-923f-11dc-a2bf-02e081235dab">
<topic>net-snmp -- denial of service via GETBULK request</topic>
<affects>
<package>
<name>net-snmp</name>
<range><lt>5.3.1_7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>CVE reports:</p>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5846">
<p>The SNMP agent (snmp_agent.c) in net-snmp before 5.4.1
allows remote attackers to cause a denial of service (CPU
and memory consumption) via a GETBULK request with a large
max-repeaters value.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-5846</cvename>
</references>
<dates>
<discovery>2007-11-06</discovery>
<entry>2007-11-13</entry>
<modified>2007-11-14</modified>
</dates>
</vuln>
<vuln vid="ff65eecb-91e4-11dc-bd6c-0016179b2dd5">
<topic>flac -- media file processing integer overflow vulnerabilities</topic>
<affects>
<package>
<name>flac</name>
<range><lt>1.1.2_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>iDefense Laps reports:</p>
<blockquote cite="http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=608">
<p>Remote exploitation of multiple integer overflow vulnerabilities
in libFLAC, as included with various vendor's software
distributions, allows attackers to execute arbitrary code
in the context of the currently logged in user.</p>
<p>These vulnerabilities specifically exist in the handling of
malformed FLAC media files. In each case, an integer overflow can
occur while calculating the amount of memory to allocate. As such,
insufficient memory is allocated for the data that is subsequently
read in from the file, and a heap based buffer overflow occurs.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-4619</cvename>
<url>http://secunia.com/advisories/27210/</url>
<url>http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=608</url>
</references>
<dates>
<discovery>2007-10-11</discovery>
<entry>2007-11-13</entry>
</dates>
</vuln>
<vuln vid="2747fc39-915b-11dc-9239-001c2514716c">
<topic>xpdf -- multiple remote Stream.CC vulnerabilities</topic>
<affects>
<package>
<name>cups-base</name>
<range><lt>1.3.3_2</lt></range>
</package>
<package>
<name>gpdf</name>
<range><gt>0</gt></range>
</package>
<package>
<name>kdegraphics</name>
<range><lt>3.5.8_1</lt></range>
</package>
<package>
<name>koffice</name>
<range><lt>1.6.3_3,2</lt></range>
</package>
<package>
<name>poppler</name>
<range><lt>0.6</lt></range>
</package>
<package>
<name>xpdf</name>
<range><lt>3.02_5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia Research reports:</p>
<blockquote cite="http://www.securityfocus.com/archive/1/483372">
<p>Secunia Research has discovered some vulnerabilities in Xpdf,
which can be exploited by malicious people to compromise a user's
system.</p>
<ul>
<li>An array indexing error within the
"DCTStream::readProgressiveDataUnit()" method in xpdf/Stream.cc
can be exploited to corrupt memory via a specially crafted PDF
file.</li>
<li>An integer overflow error within the "DCTStream::reset()"
method in xpdf/Stream.cc can be exploited to cause a heap-based
buffer overflow via a specially crafted PDF file.</li>
<li>A boundary error within the "CCITTFaxStream::lookChar()" method
in xpdf/Stream.cc can be exploited to cause a heap-based buffer
overflow by tricking a user into opening a PDF file containing a
specially crafted "CCITTFaxDecode" filter.</li>
</ul>
<p>Successful exploitation may allow execution of arbitrary code.</p>
</blockquote>
</body>
</description>
<references>
<bid>26367</bid>
<cvename>CVE-2007-4352</cvename>
<cvename>CVE-2007-5392</cvename>
<cvename>CVE-2007-5393</cvename>
</references>
<dates>
<discovery>2007-11-07</discovery>
<entry>2007-11-12</entry>
<modified>2007-11-14</modified>
</dates>
</vuln>
<vuln vid="ffba6ab0-90b5-11dc-9835-003048705d5a">
<topic>plone -- unsafe data interpreted as pickles</topic>
<affects>
<package>
<name>plone</name>
<range><ge>2.5</ge><lt>2.5.5</lt></range>
<range><ge>3.0</ge><lt>3.0.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Plone projectreports:</p>
<blockquote cite="http://plone.org/about/security/advisories/cve-2007-5741">
<p>This hotfix corrects a vulnerability in the statusmessages
and linkintegrity modules, where unsafe network data was
interpreted as python pickles. This allows an attacker to
run arbitrary python code within the Zope/Plone process.</p>
</blockquote>
</body>
</description>
<references>
<bid>26354</bid>
<cvename>CVE-2007-5741</cvename>
</references>
<dates>
<discovery>2007-11-06</discovery>
<entry>2007-11-12</entry>
</dates>
</vuln>
<vuln vid="2d2dcbb4-906c-11dc-a951-0016179b2dd5">
<topic>phpmyadmin -- cross-site scripting vulnerability</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<range><lt>2.11.2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The DigiTrust Group reports:</p>
<blockquote cite="http://www.digitrustgroup.com/advisories/tdg-advisory071108a.html">
<p>When creating a new database, a malicious user can use a
client-side Web proxy to place malicious code in the db parameter of
the POST request. Since db_create.php does not properly sanitize
user-supplied input, an administrator could face a persistent XSS
attack when the database names are displayed.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-5976</cvename>
<cvename>CVE-2007-5977</cvename>
<url>http://www.digitrustgroup.com/advisories/tdg-advisory071108a.html</url>
<url>http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2007-7</url>
</references>
<dates>
<discovery>2007-11-11</discovery>
<entry>2007-11-11</entry>
<modified>2010-05-12</modified>
</dates>
</vuln>
<vuln vid="9b718b82-8ef5-11dc-8e42-001c2514716c">
<topic>gallery2 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>gallery2</name>
<range><lt>2.2.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gallery project reports:</p>
<blockquote cite="http://gallery.menalto.com/gallery_2.2.3_released">
<p>Gallery 2.2.3 addresses the following security vulnerabilities:</p>
<ul>
<li>Unauthorized renaming of items possible with WebDAV (reported
by Merrick Manalastas)</li>
<li>Unauthorized modification and retrieval of item properties
possible with WebDAV</li>
<li>Unauthorized locking and replacing of items possible with
WebDAV</li>
<li>Unauthorized editing of data file possible via linked items with
Reupload and WebDAV (reported by Nicklous Roberts)</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-4650</cvename>
<bid>25580</bid>
</references>
<dates>
<discovery>2007-08-29</discovery>
<entry>2007-11-09</entry>
</dates>
</vuln>
<vuln vid="20a4eb11-8ea3-11dc-a396-0016179b2dd5">
<topic>tikiwiki -- multiple vulnerabilities</topic>
<affects>
<package>
<name>tikiwik</name>
<range><lt>1.9.8.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/26618/">
<p>Some vulnerabilities have been reported in TikiWiki, which
can be exploited by malicious people to conduct cross-site
scripting and script insertion attacks and disclose potentially
sensitive information.</p>
<p>Input passed to the username parameter in tiki-remind_password.php
(when remind is set to send me my password) is not properly
sanitised before being returned to the user. This can be exploited
to execute arbitrary HTML and script code (for example with meta
refreshes to a javascript: URL) in a user's browser session in
context of an affected site.</p>
<p>Input passed to the local_php and error_handler parameters in
tiki-index.php is not properly verified before being used to include
files. This can be exploited to include arbitrary files from local
resources.</p>
<p>Input passed to the imp_language parameter in
tiki-imexport_languages.php is not properly verified before being
used to include files. This can be exploited to include arbitrary
files from local resources.</p>
<p>Certain img src elements are not properly santised before being
used. This can be exploited to insert arbitrary HTML and script
code, which is executed in a user's browser session in context of an
affected site when the malicious data is viewed.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-4554</cvename>
<cvename>CVE-2007-5683</cvename>
<cvename>CVE-2007-5684</cvename>
<url>http://secunia.com/advisories/26618/</url>
<url>http://tikiwiki.cvs.sourceforge.net/tikiwiki/tiki/changelog.txt?view=markup&pathrev=REL-1-9-8-2</url>
</references>
<dates>
<discovery>2007-08-27</discovery>
<entry>2007-11-09</entry>
<modified>2008-10-03</modified>
</dates>
</vuln>
<vuln vid="8dd9722c-8e97-11dc-b8f6-001c2514716c">
<topic>cups -- off-by-one buffer overflow</topic>
<affects>
<package>
<name>cups-base</name>
<range><lt>1.3.3_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/27233">
<p>Secunia Research has discovered a vulnerability in CUPS, which can
be exploited by malicious people to compromise a vulnerable
system.</p>
<p>The vulnerability is caused due to a boundary error within the
"ippReadIO()" function in cups/ipp.c when processing IPP (Internet
Printing Protocol) tags. This can be exploited to overwrite one
byte on the stack with a zero by sending an IPP request containing
specially crafted "textWithLanguage" or "nameWithLanguage" tags.</p>
<p>Successful exploitation allows execution of arbitrary code.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-4351</cvename>
<url>http://secunia.com/secunia_research/2007-76/</url>
</references>
<dates>
<discovery>2007-11-06</discovery>
<entry>2007-11-09</entry>
<modified>2007-11-12</modified>
</dates>
</vuln>
<vuln vid="5b47c279-8cb5-11dc-8878-0016179b2dd5">
<topic>perl -- regular expressions unicode data buffer overflow</topic>
<affects>
<package>
<name>perl</name>
<name>perl-threaded</name>
<range><gt>5.8.*</gt><lt>5.8.8_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Red Hat reports:</p>
<blockquote cite="https://rhn.redhat.com/errata/RHSA-2007-0966.html">
<p>A flaw was found in Perl's regular expression engine. Specially
crafted input to a regular expression can cause Perl to improperly
allocate memory, possibly resulting in arbitrary code running with
the permissions of the user running Perl.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-5116</cvename>
<url>http://secunia.com/advisories/27546/</url>
</references>
<dates>
<discovery>2007-11-05</discovery>
<entry>2007-11-06</entry>
<modified>2007-11-07</modified>
</dates>
</vuln>
<vuln vid="bfd6eef4-8c94-11dc-8c55-001c2514716c">
<topic>pcre -- arbitrary code execution</topic>
<affects>
<package>
<name>pcre</name>
<name>pcre-utf8</name>
<range><lt>7.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Debian project reports:</p>
<blockquote cite="http://www.debian.org/security/2007/dsa-1399">
<p>Tavis Ormandy of the Google Security Team has discovered
several security issues in PCRE, the Perl-Compatible Regular
Expression library, which potentially allow attackers to
execute arbitrary code by compiling specially crafted regular
expressions.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-1659</cvename>
<cvename>CVE-2007-1660</cvename>
<cvename>CVE-2007-1661</cvename>
<cvename>CVE-2007-1662</cvename>
<cvename>CVE-2007-4766</cvename>
<cvename>CVE-2007-4767</cvename>
<cvename>CVE-2007-4768</cvename>
<url>http://www.pcre.org/changelog.txt</url>
</references>
<dates>
<discovery>2007-11-05</discovery>
<entry>2007-11-06</entry>
</dates>
</vuln>
<vuln vid="617a4021-8bf0-11dc-bffa-0016179b2dd5">
<topic>perdition -- str_vwrite format string vulnerability</topic>
<affects>
<package>
<name>perdition</name>
<range><lt>1.17.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SEC-Consult reports:</p>
<blockquote cite="http://www.sec-consult.com/300.html">
<p>Perdition IMAP is affected by a format string bug in one of its
IMAP output-string formatting functions. The bug allows the
execution of arbitrary code on the affected server.
A successful exploit does not require prior authentication.</p>
</blockquote>
</body>
</description>
<references>
<bid>26270</bid>
<cvename>CVE-2007-5740</cvename>
<url>http://www.sec-consult.com/300.html</url>
<url>http://secunia.com/advisories/27458</url>
</references>
<dates>
<discovery>2007-10-31</discovery>
<entry>2007-11-05</entry>
</dates>
</vuln>
<vuln vid="f8b0f83c-8bb3-11dc-bffa-0016179b2dd5">
<topic>gftp -- multiple vulnerabilities</topic>
<affects>
<package>
<name>gftp</name>
<range><lt>2.0.18_6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gentoo reports:</p>
<blockquote cite="http://www.gentoo.org/security/en/glsa/glsa-200711-01.xml">
<p>Kalle Olavi Niemitalo discovered two boundary errors in fsplib code
included in gFTP when processing overly long directory or file
names.</p>
<p>A remote attacker could trigger these vulnerabilities by enticing
a user to download a file with a specially crafted directory or file
name, possibly resulting in the execution of arbitrary code or a
Denial of Service.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-3961</cvename>
<cvename>CVE-2007-3962</cvename>
<url>http://www.gentoo.org/security/en/glsa/glsa-200711-01.xml</url>
</references>
<dates>
<discovery>2007-11-01</discovery>
<entry>2007-11-05</entry>
<modified>2007-11-11</modified>
</dates>
</vuln>
<vuln vid="a1ef3fc0-8ad0-11dc-9490-0016179b2dd5">
<topic>dircproxy -- remote denial of service</topic>
<affects>
<package>
<name>dircproxy</name>
<range><lt>1.0.5_1</lt></range>
</package>
<package>
<name>dircproxy-devel</name>
<range><lt>1.2.0.b2_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Securiweb reports:</p>
<blockquote cite="http://dircproxy.securiweb.net/ticket/89">
<p>dircproxy allows remote attackers to cause a denial of
service (segmentation fault) via an ACTION command without a
parameter, which triggers a NULL pointer dereference, as
demonstrated using a blank /me message from irssi.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-5226</cvename>
<url>http://dircproxy.securiweb.net/ticket/89</url>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=319301</url>
</references>
<dates>
<discovery>2006-09-06</discovery>
<entry>2007-11-04</entry>
<modified>2008-01-31</modified>
</dates>
</vuln>
<vuln vid="a467d0f9-8875-11dc-b3ba-0016179b2dd5">
<topic>wordpress -- cross-site scripting</topic>
<affects>
<package>
<name>wordpress</name>
<name>de-wordpress</name>
<range><lt>2.3.1</lt></range>
</package>
<package>
<name>zh-wordpress</name>
<range><gt>0</gt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Secunia Advisory report:</p>
<blockquote cite="http://secunia.com/advisories/27407">
<p>Input passed to the "posts_columns" parameter in
wp-admin/edit-post-rows.php is not properly sanitised before
being returned to the user. This can be exploited to execute
arbitrary HTML and script code in a user's browser session in
context of an affected site.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-5710</cvename>
<url>http://secunia.com/advisories/27407</url>
<url>http://wordpress.org/development/2007/10/wordpress-231/</url>
</references>
<dates>
<discovery>2007-10-29</discovery>
<entry>2007-11-01</entry>
</dates>
</vuln>
<vuln vid="db449245-870d-11dc-a3ec-001921ab2fa4">
<topic>openldap -- multiple remote denial of service vulnerabilities</topic>
<affects>
<package>
<name>openldap-server</name>
<range><lt>2.3.39</lt></range>
<range><gt>2.4.0</gt><lt>2.4.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>BugTraq reports:</p>
<blockquote cite="http://www.securityfocus.com/bid/26245/">
<p>OpenLDAP is prone to multiple remote denial-of-service
vulnerabilities because of an incorrect NULL-termination
issue and a double-free issue.</p>
</blockquote>
</body>
</description>
<references>
<bid>26245</bid>
<cvename>CVE-2007-5707</cvename>
<cvename>CVE-2007-5708</cvename>
</references>
<dates>
<discovery>2007-10-29</discovery>
<entry>2007-10-30</entry>
<modified>2007-10-31</modified>
</dates>
</vuln>
<vuln vid="d2c2952d-85a1-11dc-bfff-003048705d5a">
<topic>py-django -- denial of service vulnerability</topic>
<affects>
<package>
<name>py23-django</name>
<name>py24-django</name>
<name>py25-django</name>
<range><lt>0.96.1</lt></range>
</package>
<package>
<name>py23-django-devel</name>
<name>py24-django-devel</name>
<name>py25-django-devel</name>
<range><lt>20071026</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Django project reports:</p>
<blockquote cite="http://www.djangoproject.com/weblog/2007/oct/26/security-fix/">
<p>A per-process cache used by Django's internationalization
("i18n") system to store the results of translation lookups
for particular values of the HTTP Accept-Language header
used the full value of that header as a key. An attacker
could take advantage of this by sending repeated requests
with extremely large strings in the Accept-Language header,
potentially causing a denial of service by filling available
memory.</p>
<p>Due to limitations imposed by Web server software on the
size of HTTP header fields, combined with reasonable limits
on the number of requests which may be handled by a single
server process over its lifetime, this vulnerability may be
difficult to exploit. Additionally, it is only present when
the "USE_I18N" setting in Django is "True" and the i18n
middleware component is enabled*. Nonetheless, all users of
affected versions of Django are encouraged to update.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.djangoproject.com/weblog/2007/oct/26/security-fix/</url>
</references>
<dates>
<discovery>2007-10-26</discovery>
<entry>2007-10-27</entry>
</dates>
</vuln>
<vuln vid="44224e08-8306-11dc-9283-0016179b2dd5">
<topic>opera -- multiple vulnerabilities</topic>
<affects>
<package>
<name>opera</name>
<name>opera-devel</name>
<name>linux-opera</name>
<range><lt>9.24</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>An advisory from Opera reports:</p>
<blockquote cite="http://www.opera.com/support/search/view/866/">
<p>If a user has configured Opera to use an external newsgroup
client or e-mail application, specially crafted Web pages can
cause Opera to run that application incorrectly. In some cases
this can lead to execution of arbitrary code.</p>
</blockquote>
<blockquote cite="http://www.opera.com/support/search/view/867/">
<p>When accesing frames from different Web sites, specially crafted
scripts can bypass the same-origin policy, and overwrite functions
from those frames. If scripts on the page then run those functions,
this can cause the script of the attacker's choice to run in the
context of the target Web site.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-5540</cvename>
<cvename>CVE-2007-5541</cvename>
<url>http://www.opera.com/support/search/view/866/</url>
<url>http://www.opera.com/support/search/view/867/</url>
<url>http://secunia.com/advisories/27277/</url>
</references>
<dates>
<discovery>2007-10-17</discovery>
<entry>2007-10-25</entry>
</dates>
</vuln>
<vuln vid="9c00d446-8208-11dc-9283-0016179b2dd5">
<topic>drupal --- multiple vulnerabilities</topic>
<affects>
<package>
<name>drupal4</name>
<range><lt>4.7.8</lt></range>
</package>
<package>
<name>drupal5</name>
<range><lt>5.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Drupal Project reports:</p>
<blockquote cite="http://drupal.org/node/184315">
<p>In some circumstances Drupal allows user-supplied data to
become part of response headers. As this user-supplied data
is not always properly escaped, this can be exploited by
malicious users to execute HTTP response splitting attacks
which may lead to a variety of issues, among them cache
poisoning, cross-user defacement and injection of arbitrary
code.</p>
</blockquote>
<blockquote cite="http://drupal.org/node/184316">
<p>The Drupal installer allows any visitor to provide credentials
for a database when the site's own database is not reachable. This
allows attackers to run arbitrary code on the site's server.
An immediate workaround is the removal of the file install.php
in the Drupal root directory.</p>
</blockquote>
<blockquote cite="http://drupal.org/node/184320">
<p>The allowed extension list of the core Upload module contains
the extension HTML by default. Such files can be used to execute
arbitrary script code in the context of the affected site when a
user views the file. Revoking upload permissions or removing the
.html extension from the allowed extension list will stop uploads
of malicious files. but will do nothing to protect your site
againstfiles that are already present. Carefully inspect the file
system path for any HTML files. We recommend you remove any HTML
file you did not update yourself. You should look for , CSS
includes, Javascript includes, and onerror="" attributes if
you need to review files individually.</p>
</blockquote>
<blockquote cite="http://drupal.org/node/184348">
<p>The Drupal Forms API protects against cross site request
forgeries (CSRF), where a malicious site can cause a user
to unintentionally submit a form to a site where he is
authenticated. The user deletion form does not follow the
standard Forms API submission model and is therefore not
protected against this type of attack. A CSRF attack may
result in the deletion of users.</p>
</blockquote>
<blockquote cite="http://drupal.org/node/184354">
<p>The publication status of comments is not passed during the
hook_comments API operation, causing various modules that rely
on the publication status (such as Organic groups, or Subscriptions)
to mail out unpublished comments.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-5597</cvename>
<cvename>CVE-2007-5596</cvename>
<cvename>CVE-2007-5595</cvename>
<cvename>CVE-2007-5594</cvename>
<cvename>CVE-2007-5593</cvename>
<url>http://drupal.org/node/184315</url>
<url>http://drupal.org/node/184316</url>
<url>http://drupal.org/node/184348</url>
<url>http://drupal.org/node/184354</url>
<url>http://drupal.org/node/184320</url>
<url>http://secunia.com/advisories/27292</url>
<url>http://secunia.com/advisories/27292</url>
<url>http://secunia.com/advisories/27292</url>
<url>http://secunia.com/advisories/27290</url>
<url>http://secunia.com/advisories/27290</url>
</references>
<dates>
<discovery>2007-10-17</discovery>
<entry>2007-10-24</entry>
</dates>
</vuln>
<vuln vid="3a81017a-8154-11dc-9283-0016179b2dd5">
<topic>ldapscripts -- Command Line User Credentials Disclosure</topic>
<affects>
<package>
<name>ldapscripts</name>
<range><lt>1.7.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ganael Laplanche reports:</p>
<blockquote cite="http://sourceforge.net/project/shownotes.php?group_id=156483&release_id=546600">
<p>Up to now, each ldap* command was called with the -w parameter,
which allows to specify the bind password on the command line.
Unfortunately, this could make the password appear to anybody
performing a `ps` during the call. This is now avoided by using
the -y parameter and a password file.</p>
</blockquote>
</body>
</description>
<references>
<url>http://sourceforge.net/project/shownotes.php?group_id=156483&release_id=546600</url>
<url>http://secunia.com/advisories/27111</url>
<cvename>CVE-2007-5373</cvename>
</references>
<dates>
<discovery>2007-10-09</discovery>
<entry>2007-10-23</entry>
</dates>
</vuln>
<vuln vid="e24797af-803d-11dc-b787-003048705d5a">
<topic>firefox -- OnUnload Javascript browser entrapment vulnerability</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>2.0.0.8,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>2.0.0.8</lt></range>
</package>
<package>
<name>seamonkey</name>
<name>linux-seamonkey</name>
<range><lt>1.1.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>RedHat reports:</p>
<blockquote cite="https://rhn.redhat.com/errata/RHSA-2007-0979.html">
<p>Several flaws were found in the way in which Firefox
displayed malformed web content. A web page containing
specially-crafted content could potentially trick a user
into surrendering sensitive information. (CVE-2007-1095,
CVE-2007-3844, CVE-2007-3511, CVE-2007-5334)</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-1095</cvename>
</references>
<dates>
<discovery>2007-10-19</discovery>
<entry>2007-10-22</entry>
<modified>2007-10-23</modified>
</dates>
</vuln>
<vuln vid="498a8731-7cfc-11dc-96e6-0012f06707f0">
<topic>phpmyadmin -- cross-site scripting vulnerability</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<range><lt>2.11.1.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The DigiTrust Group discovered serious XSS vulnerability in
the phpMyAdmin server_status.php script. According to their
report</p>
<blockquote cite="http://www.digitrustgroup.com/advisories/TDG-advisory071015a.html">
<p>vulnerability can be exploited to execute arbitrary HTML and
script code in a user's browser session in context of an affected
site.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-5589</cvename>
<url>http://www.digitrustgroup.com/advisories/TDG-advisory071015a.html</url>
<url>http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2007-6</url>
</references>
<dates>
<discovery>2007-10-17</discovery>
<entry>2007-10-17</entry>
<modified>2010-05-12</modified>
</dates>
</vuln>
<vuln vid="51b51d4a-7c0f-11dc-9e47-0011d861d5e2">
<topic>phpmyadmin -- cross-site scripting vulnerability</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<range><lt>2.11.1.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SecurityFocus reports:</p>
<blockquote cite="http://www.securityfocus.com/bid/26020/discuss">
<p>phpMyAdmin is prone to a cross-site scripting vulnerability
because it fails to properly sanitize user-supplied input.</p>
<p>An attacker may leverage this issue to execute arbitrary script
code in the browser of an unsuspecting user in the context of the
affected site. This may help the attacker steal potentially
sensitive information and launch other attacks.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-5386</cvename>
<url>http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2007-5</url>
<url>http://www.digitrustgroup.com/advisories/TDG-advisory071009a</url>
<url>http://secunia.com/advisories/27173</url>
<bid>26020</bid>
</references>
<dates>
<discovery>2007-10-12</discovery>
<entry>2007-10-16</entry>
<modified>2007-10-20</modified>
</dates>
</vuln>
<vuln vid="7453c85d-7830-11dc-b4c8-0016179b2dd5">
<topic>nagios-plugins -- Long Location Header Buffer Overflow Vulnerability</topic>
<affects>
<package>
<name>nagios-plugins</name>
<range><lt>1.4.10,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Secunia Advisory reports:</p>
<blockquote cite="http://secunia.com/advisories/27124/">
<p>The vulnerability is caused due to a boundary error within the
redir() function in check_http.c when processing HTTP Location:
header information. This can be exploited to cause a buffer overflow
by returning an overly long string in the "Location:" header to a
vulnerable system.</p>
</blockquote>
</body>
</description>
<references>
<url>http://sourceforge.net/forum/forum.php?forum_id=740172</url>
<url>http://secunia.com/advisories/27124/</url>
<cvename>CVE-2007-5198</cvename>
</references>
<dates>
<discovery>2007-09-28</discovery>
<entry>2007-10-11</entry>
</dates>
</vuln>
<vuln vid="172acf78-780c-11dc-b3f4-0016179b2dd5">
<topic>png -- multiple vulnerabilities</topic>
<affects>
<package>
<name>png</name>
<range><lt>1.2.22</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Secunia Advisory reports:</p>
<blockquote cite="http://secunia.com/advisories/27093/">
<p>Some vulnerabilities have been reported in libpng, which can be
exploited by malicious people to cause a DoS (Denial of
Service).</p>
<p>Certain errors within libpng, including a logical NOT instead of a
bitwise NOT in pngtrtran.c, an error in the 16bit cheap transparency
extension, and an incorrect use of sizeof() may be exploited to
crash an application using the library.</p>
<p>Various out-of-bounds read errors exist within the functions
png_handle_pCAL(), png_handle_sCAL(), png_push_read_tEXt(),
png_handle_iTXt(), and png_handle_ztXt(), which may be exploited by
exploited to crash an application using the library.</p>
</blockquote>
<blockquote cite="http://secunia.com/advisories/27130/">
<p>The vulnerability is caused due to an off-by-one error within
the ICC profile chunk handling, which potentially can be
exploited to crash an application using the library.</p>
</blockquote>
</body>
</description>
<references>
<url>http://secunia.com/advisories/27093/</url>
<url>http://secunia.com/advisories/27130/</url>
<cvename>CVE-2007-5267</cvename>
<cvename>CVE-2007-5266</cvename>
<cvename>CVE-2007-5268</cvename>
<cvename>CVE-2007-5269</cvename>
</references>
<dates>
<discovery>2007-10-08</discovery>
<entry>2007-10-11</entry>
</dates>
</vuln>
<vuln vid="f5b29ec0-71f9-11dc-8c6a-00304881ac9a">
<topic>ImageMagick -- multiple vulnerabilities</topic>
<affects>
<package>
<name>ImageMagick</name>
<name>ImageMagick-nox11</name>
<range><lt>6.3.5.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Multiple vulnerabilities have been discovered in ImageMagick.</p>
<blockquote cite="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-4985">
<p>ImageMagick before 6.3.5-9 allows context-dependent attackers
to cause a denial of service via a crafted image file that
triggers (1) an infinite loop in the ReadDCMImage function,
related to ReadBlobByte function calls; or (2) an infinite
loop in the ReadXCFImage function, related to ReadBlobMSBLong
function calls.</p>
</blockquote>
<blockquote cite="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-4986">
<p>Multiple integer overflows in ImageMagick before 6.3.5-9
allow context-dependent attackers to execute arbitrary code
via a crafted (1) .dcm, (2) .dib, (3) .xbm, (4) .xcf, or (5)
.xwd image file, which triggers a heap-based buffer overflow.</p>
</blockquote>
<blockquote cite="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-4987">
<p>Off-by-one error in the ReadBlobString function in blob.c in
ImageMagick before 6.3.5-9 allows context-dependent attackers
to execute arbitrary code via a crafted image file, which
triggers the writing of a '\0' character to an out-of-bounds
address.</p>
</blockquote>
<blockquote cite="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-4988">
<p>Sign extension error in the ReadDIBImage function in
ImageMagick before 6.3.5-9 allows context-dependent attackers
to execute arbitrary code via a crafted width value in an
image file, which triggers an integer overflow and a
heap-based buffer overflow.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-4985</cvename>
<cvename>CVE-2007-4986</cvename>
<cvename>CVE-2007-4987</cvename>
<cvename>CVE-2007-4988</cvename>
<url>http://studio.imagemagick.org/pipermail/magick-announce/2007-September/000037.html</url>
</references>
<dates>
<discovery>2007-09-19</discovery>
<entry>2007-10-10</entry>
</dates>
</vuln>
<vuln vid="c93e4d41-75c5-11dc-b903-0016179b2dd5">
<topic>jdk/jre -- Applet Caching May Allow Network Access Restrictions to be Circumvented</topic>
<affects>
<package>
<name>jdk</name>
<range><ge>1.3.0</ge><lt>1.6.0.3p3</lt></range>
<range><ge>1.5.0,1</ge><lt>1.5.0.13p7,1</lt></range>
</package>
<package>
<name>linux-blackdown-jdk</name>
<range><ge>1.3.0</ge></range>
</package>
<package>
<name>linux-sun-jdk</name>
<range><ge>1.3.0</ge><lt>1.3.1.20</lt></range>
<range><ge>1.4.0</ge><lt>1.4.2.16</lt></range>
<range><eq>1.5.0.b1</eq></range>
<range><eq>1.5.0.b1,1</eq></range>
<range><ge>1.5.0,2</ge><lt>1.5.0.13,2</lt></range>
<range><ge>1.6.0</ge><lt>1.6.0.03</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SUN reports:</p>
<blockquote cite="http://sunsolve.sun.com/search/document.do?assetkey=1-26-103079-1">
<p>A vulnerability in the Java Runtime Environment (JRE) with applet
caching may allow an untrusted applet that is downloaded from a
malicious website to make network connections to network services
on machines other than the one that the applet was downloaded from.
This may allow network resources (such as web pages) and
vulnerabilities (that exist on these network services) which are not
otherwise normally accessible to be accessed or exploited.</p>
</blockquote>
</body>
</description>
<references>
<url>http://sunsolve.sun.com/search/document.do?assetkey=1-26-103079-1</url>
<cvename>CVE-2007-5232</cvename>
</references>
<dates>
<discovery>2007-10-03</discovery>
<entry>2007-10-08</entry>
<modified>2007-11-16</modified>
</dates>
</vuln>
<vuln vid="a5f667db-7596-11dc-8b7a-0019b944b34e">
<topic>xfs -- multiple vulnerabilities</topic>
<affects>
<package>
<name>xfs</name>
<range><lt>1.0.5,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Matthieu Herrb reports:</p>
<blockquote cite="http://lists.freedesktop.org/archives/xorg/2007-October/028899.html">
<h1>Problem Description:</h1>
<p>Several vulnerabilities have been identified in xfs, the X font
server. The QueryXBitmaps and QueryXExtents protocol requests
suffer from lack of validation of their 'length' parameters.</p>
<h1>Impact:</h1>
<p>On most modern systems, the font server is accessible only for
local clients and runs with reduced privileges, but on some
systems it may still be accessible from remote clients and
possibly running with root privileges, creating an opportunity
for remote privilege escalation.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-4568</cvename>
<url>http://lists.freedesktop.org/archives/xorg/2007-October/028899.html</url>
</references>
<dates>
<discovery>2007-10-02</discovery>
<entry>2007-10-08</entry>
</dates>
</vuln>
<vuln vid="a058d6fa-7325-11dc-ae10-0016179b2dd5">
<topic>tcl/tk -- buffer overflow in ReadImage function</topic>
<affects>
<package>
<name>tk</name>
<name>tk-threads</name>
<range><gt>8.2.*</gt><lt>8.2.3_11</lt></range>
<range><gt>8.3.*</gt><lt>8.3.5_10</lt></range>
<range><gt>8.4.*,2</gt><lt>8.4.16,2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Buffer overflow in the ReadImage function in generic/tkImgGIF.c
in Tcl/Tk, allows remote attackers to execute arbitrary code via
multi-frame interlaced GIF files in which later frames are smaller
than the first.</p>
</body>
</description>
<references>
<url>http://secunia.com/advisories/26942</url>
<url>http://sourceforge.net/project/shownotes.php?release_id=541207</url>
<cvename>CVE-2007-5137</cvename>
</references>
<dates>
<discovery>2007-09-27</discovery>
<entry>2007-10-05</entry>
<modified>2011-09-04</modified>
</dates>
</vuln>
<vuln vid="91ed69f9-72c7-11dc-981a-001921ab2fa4">
<topic>firebird -- multiple remote buffer overflow vulnerabilities</topic>
<affects>
<package>
<name>firebird-server</name>
<range><ge>1.*</ge><lt>1.5.5</lt></range>
<range><ge>2.0.*</ge><lt>2.0.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>RISE Security reports:</p>
<blockquote cite="http://risesecurity.org/advisory/RISE-2007003/">
<p>There exists multiple vulnerabilities within functions
of Firebird Relational Database, which when properly
exploited can lead to remote compromise of the vulnerable
system.</p>
</blockquote>
</body>
</description>
<references>
<bid>25925</bid>
</references>
<dates>
<discovery>2007-10-03</discovery>
<entry>2007-10-04</entry>
</dates>
</vuln>
<vuln vid="15ec9123-7061-11dc-b372-001921ab2fa4">
<topic>id3lib -- insecure temporary file creation</topic>
<affects>
<package>
<name>id3lib</name>
<range><lt>3.8.3_4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Debian Bug report log reports:</p>
<blockquote cite="http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=438540">
<p>When tagging file $foo, a temporary copy of the file is
created, and for some reason, libid3 doesn't use mkstemp
but just creates $foo.XXXXXX literally, without any checking.</p>
<p>This would silently truncate and overwrite an existing
$foo.XXXXXX.</p>
</blockquote>
</body>
</description>
<references>
<bid>25372</bid>
<cvename>CVE-2007-4460</cvename>
</references>
<dates>
<discovery>2007-08-20</discovery>
<entry>2007-10-01</entry>
<modified>2007-10-01</modified>
</dates>
</vuln>
<vuln vid="c9c14242-6843-11dc-82b6-02e0185f8d72">
<topic>mediawiki -- cross site scripting vulnerability</topic>
<affects>
<package>
<name>mediawiki</name>
<range><gt>1.10.0</gt><lt>1.10.2</lt></range>
<range><gt>1.9.0</gt><lt>1.9.4</lt></range>
<range><gt>1.8.0</gt><lt>1.8.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The MediaWiki development team reports:</p>
<blockquote cite="http://lists.wikimedia.org/pipermail/mediawiki-announce/2007-September/000067.html">
<p>A possible HTML/XSS injection vector in the API
pretty-printing mode has been found and fixed.</p>
<p>The vulnerability may be worked around in an unfixed version
by simply disabling the API interface if it is not in use, by
adding this to LocalSettings.php:</p>
<p>$wgEnableAPI = false;</p>
<p>(This is the default setting in 1.8.x.)</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-4828</cvename>
<url>http://lists.wikimedia.org/pipermail/mediawiki-announce/2007-September/000067.html</url>
</references>
<dates>
<discovery>2007-09-10</discovery>
<entry>2007-09-21</entry>
<modified>2007-10-10</modified>
</dates>
</vuln>
<vuln vid="63347ee7-6841-11dc-82b6-02e0185f8d72">
<topic>wordpress -- remote sql injection vulnerability</topic>
<affects>
<package>
<name>wordpress</name>
<range><lt>2.2.3,1</lt></range>
</package>
<package>
<name>de-wordpress</name>
<name>zh-wordpress</name>
<range><lt>2.2.3</lt></range>
</package>
<package>
<name>wordpress-mu</name>
<range><lt>1.2.4,2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Alexander Concha reports:</p>
<blockquote cite="http://www.buayacorp.com/files/wordpress/wordpress-sql-injection-advisory.html">
<p>While testing WordPress, it has been discovered a SQL
Injection vulnerability that allows an attacker to retrieve
remotely any user credentials from a vulnerable site, this
bug is caused because of early database escaping and the
lack of validation in query string like parameters.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-4894</cvename>
<url>http://www.buayacorp.com/files/wordpress/wordpress-sql-injection-advisory.html</url>
</references>
<dates>
<discovery>2007-09-10</discovery>
<entry>2007-09-21</entry>
</dates>
</vuln>
<vuln vid="2bc96f18-683f-11dc-82b6-02e0185f8d72">
<topic>samba -- nss_info plugin privilege escalation vulnerability</topic>
<affects>
<package>
<name>samba</name>
<range><lt>3.0.26a</lt></range>
<range><gt>*,1</gt><lt>3.0.26a,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Samba development team reports:</p>
<blockquote cite="http://www.samba.org/samba/security/CVE-2007-4138.html">
<p>The idmap_ad.so library provides an nss_info extension to
Winbind for retrieving a user's home directory path, login
shell and primary group id from an Active Directory domain
controller. This functionality is enabled by defining the
"winbind nss info" smb.conf option to either "sfu" or
"rfc2307".</p>
<p>Both the Windows "Identity Management for Unix" and
"Services for Unix" MMC plug-ins allow a user to be assigned
a primary group for Unix clients that differs from the user's
Windows primary group. When the rfc2307 or sfu nss_info plugin
has been enabled, in the absence of either the RFC2307 or SFU
primary group attribute, Winbind will assign a primary group ID
of 0 to the domain user queried using the getpwnam() C library
call.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-4138</cvename>
<url>http://www.samba.org/samba/security/CVE-2007-4138.html</url>
</references>
<dates>
<discovery>2007-09-11</discovery>
<entry>2007-09-21</entry>
<modified>2008-09-26</modified>
</dates>
</vuln>
<vuln vid="75231c63-f6a2-499d-8e27-787773bda284">
<topic>bugzilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>bugzilla</name>
<name>ja-bugzilla</name>
<range><ge>2.20.*</ge><lt>2.22.3</lt></range>
<range><ge>3.*</ge><lt>3.0.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Bugzilla Security Advisory reports:</p>
<blockquote cite="http://www.bugzilla.org/security/2.20.4/">
<p>This advisory covers three security issues that have recently been
fixed in the Bugzilla code:</p>
<ul>
<li>A possible cross-site scripting (XSS) vulnerability when filing
bugs using the guided form.</li>
<li>When using email_in.pl, insufficiently escaped data may be
passed to sendmail.</li>
<li>Users using the WebService interface may access Bugzilla's
time-tracking fields even if they normally cannot see them.</li>
</ul>
<p>We strongly advise that 2.20.x and 2.22.x users should upgrade to
2.20.5 and 2.22.3 respectively. 3.0 users, and users of 2.18.x or
below, should upgrade to 3.0.1.</p>
</blockquote>
</body>
</description>
<references>
<bid>25425</bid>
<cvename>CVE-2007-4538</cvename>
<cvename>CVE-2007-4539</cvename>
<cvename>CVE-2007-4543</cvename>
<url>http://www.bugzilla.org/security/2.20.4/</url>
</references>
<dates>
<discovery>2007-08-23</discovery>
<entry>2007-09-21</entry>
</dates>
</vuln>
<vuln vid="b6f6da57-680a-11dc-b350-001921ab2fa4">
<topic>clamav -- multiple remote Denial of Service vulnerabilities</topic>
<affects>
<package>
<name>clamav</name>
<range><lt>0.91.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>BugTraq reports:</p>
<blockquote cite="http://www.securityfocus.com/bid/25398">
<p>ClamAV is prone to multiple denial-of-service vulnerabilities.</p>
<p>A successful attack may allow an attacker to crash the
application and deny service to users.</p>
</blockquote>
</body>
</description>
<references>
<bid>25398</bid>
<cvename>CVE-2007-4510</cvename>
</references>
<dates>
<discovery>2007-08-21</discovery>
<entry>2007-09-21</entry>
</dates>
</vuln>
<vuln vid="12488805-6773-11dc-8be8-02e0185f8d72">
<topic>coppermine -- multiple vulnerabilities</topic>
<affects>
<package>
<name>coppermine</name>
<range><lt>1.4.13</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The coppermine development team reports two vulnerabilities
with the coppermine application. These vulnerabilities are
caused by improper checking of the log variable in "viewlog.php"
and improper checking of the referer variable in "mode.php".
This could allow local file inclusion, potentially disclosing
valuable information and could lead to an attacker conducting
a cross site scripting attack against the targeted site.</p>
</body>
</description>
<references>
<cvename>CVE-2007-4976</cvename>
<cvename>CVE-2007-4977</cvename>
<url>http://coppermine-gallery.net/forum/index.php?topic=46847.0</url>
</references>
<dates>
<discovery>2007-09-14</discovery>
<entry>2007-09-20</entry>
<modified>2010-05-12</modified>
</dates>
</vuln>
<vuln vid="e595e170-6771-11dc-8be8-02e0185f8d72">
<topic>openoffice -- arbitrary command execution vulnerability</topic>
<affects>
<package>
<name>openoffice</name>
<range><gt>0</gt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>iDefense reports:</p>
<blockquote cite="http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=593">
<p>Remote exploitation of multiple integer overflow
vulnerabilities within OpenOffice, as included in various
vendors' operating system distributions, allows attackers to
execute arbitrary code.</p>
<p>These vulnerabilities exist within the TIFF parsing code of
the OpenOffice suite. When parsing the TIFF directory entries
for certain tags, the parser uses untrusted values from the
file to calculate the amount of memory to allocate. By
providing specially crafted values, an integer overflow occurs
in this calculation. This results in the allocation of a
buffer of insufficient size, which in turn leads to a heap
overflow.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-2834</cvename>
<url>http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=593</url>
</references>
<dates>
<discovery>2007-09-19</discovery>
<entry>2007-09-20</entry>
</dates>
</vuln>
<vuln vid="f8d3689e-6770-11dc-8be8-02e0185f8d72">
<topic>bugzilla -- "createmailregexp" security bypass vulnerability</topic>
<affects>
<package>
<name>bugzilla</name>
<range><ge>3.*</ge><lt>3.0.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Bugzilla development team reports:</p>
<blockquote cite="http://www.bugzilla.org/security/3.0.1/">
<p>Bugzilla::WebService::User::offer_account_by_email does
not check the "createemailregexp" parameter, and thus
allows users to create accounts who would normally be
denied account creation. The "emailregexp" parameter is
still checked. If you do not have the SOAP::Lite Perl
module installed on your Bugzilla system, your system is
not vulnerable (because the Bugzilla WebService will not
be enabled).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-5038</cvename>
<url>http://www.bugzilla.org/security/3.0.1/</url>
</references>
<dates>
<discovery>2007-09-18</discovery>
<entry>2007-09-20</entry>
<modified>2010-05-12</modified>
</dates>
</vuln>
<vuln vid="14ad2a28-66d2-11dc-b25f-02e0185f8d72">
<topic>konquerer -- address bar spoofing</topic>
<affects>
<package>
<name>kdebase</name>
<range><lt>3.5.7_3</lt></range>
</package>
<package>
<name>kdelibs</name>
<range><lt>3.5.7_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The KDE development team reports:</p>
<blockquote cite="http://www.kde.org/info/security/advisory-20070914-1.txt">
<p>The Konqueror address bar is vulnerable to spoofing attacks
that are based on embedding white spaces in the url. In addition
the address bar could be tricked to show an URL which it is
intending to visit for a short amount of time instead of the
current URL.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-3820</cvename>
<cvename>CVE-2007-4224</cvename>
<cvename>CVE-2007-4225</cvename>
<url>http://www.kde.org/info/security/advisory-20070914-1.txt</url>
</references>
<dates>
<discovery>2007-09-14</discovery>
<entry>2007-09-19</entry>
</dates>
</vuln>
<vuln vid="79b616d0-66d1-11dc-b25f-02e0185f8d72">
<topic>kdm -- passwordless login vulnerability</topic>
<affects>
<package>
<name>kdebase3</name>
<range><lt>3.5.7_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The KDE development team reports:</p>
<blockquote cite="http://www.kde.org/info/security/advisory-20070919-1.txt">
<p>KDM can be tricked into performing a password-less login
even for accounts with a password set under certain
circumstances, namely autologin to be configured and
"shutdown with password" enabled.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-4569</cvename>
<url>http://www.kde.org/info/security/advisory-20070919-1.txt</url>
</references>
<dates>
<discovery>2007-09-19</discovery>
<entry>2007-09-19</entry>
</dates>
</vuln>
<vuln vid="209f0d75-4b5c-11dc-a6cd-000fb5066b20">
<topic>flyspray -- authentication bypass</topic>
<affects>
<package>
<name>flyspray</name>
<range><lt>0.9.9.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Flyspray Project reports:</p>
<blockquote cite="http://www.flyspray.org/fsa:1">
<p>Flyspray authentication system can be bypassed by sending a
carefully crafted post request.</p>
<p>To be vulnerable, PHP configuration directive output_buffering
has to be disabled or set to a low value.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-1788</cvename>
<url>http://www.flyspray.org/fsa:1</url>
</references>
<dates>
<discovery>2007-03-13</discovery>
<entry>2007-09-19</entry>
</dates>
</vuln>
<vuln vid="3ce8c7e2-66cf-11dc-b25f-02e0185f8d72">
<topic>mozilla -- code execution via Quicktime media-link files</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>2.0.0.7,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>2.0.0.7</lt></range>
</package>
<!-- Packages which probably will be upgraded -->
<package>
<name>seamonkey</name>
<name>linux-seamonkey</name>
<range><lt>1.1.5</lt></range>
</package>
<package>
<name>linux-firefox-devel</name>
<range><lt>3.0.a2007.12.12</lt></range>
</package>
<package>
<name>linux-seamonkey-devel</name>
<range><lt>2.0.a2007.12.12</lt></range>
</package>
<!-- Deprecated/old names -->
<package>
<name>firefox-ja</name>
<name>linux-mozilla-devel</name>
<name>linux-mozilla</name>
<name>mozilla</name>
<range><gt>0</gt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Foundation reports a vulnerability within the
mozilla browser. This vulnerability also affects various
other browsers like firefox and seamonkey. The vulnerability
is caused by QuickTime Media-Link files that contain a qtnext
attribute. This could allow an attacker to start the browser
with arbitrary command-line options. This could allow the
attacker to install malware, steal local data and possibly
execute and/or do other arbitrary things within the users
context.</p>
</body>
</description>
<references>
<cvename>CVE-2006-4965</cvename>
<url>http://www.mozilla.org/security/announce/2007/mfsa2007-28.html</url>
</references>
<dates>
<discovery>2007-09-18</discovery>
<entry>2007-09-19</entry>
<modified>2007-12-14</modified>
</dates>
</vuln>
<vuln vid="71d903fc-602d-11dc-898c-001921ab2fa4">
<topic>php -- multiple vulnerabilities</topic>
<affects>
<package>
<name>php5</name>
<range><lt>5.2.4</lt></range>
</package>
<package>
<name>php4</name>
<range><lt>4.4.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PHP development team reports:</p>
<blockquote cite="http://www.php.net/releases/5_2_4.php">
<p>Security Enhancements and Fixes in PHP 5.2.4:</p>
<ul>
<li>Fixed a floating point exception inside wordwrap() (Reported
by Mattias Bengtsson)</li>
<li>Fixed several integer overflows inside the GD extension
(Reported by Mattias Bengtsson)</li>
<li>Fixed size calculation in chunk_split() (Reported by Gerhard
Wagner)</li>
<li>Fixed integer overflow in str[c]spn(). (Reported by Mattias
Bengtsson)</li>
<li>Fixed money_format() not to accept multiple %i or %n tokens.
(Reported by Stanislav Malyshev)</li>
<li>Fixed zend_alter_ini_entry() memory_limit interruption
vulnerability. (Reported by Stefan Esser)</li>
<li>Fixed INFILE LOCAL option handling with MySQL extensions not
to be allowed when open_basedir or safe_mode is active. (Reported
by Mattias Bengtsson)</li>
<li>Fixed session.save_path and error_log values to be checked
against open_basedir and safe_mode (CVE-2007-3378) (Reported by
Maksymilian Arciemowicz)</li>
<li>Fixed a possible invalid read in glob() win32 implementation
(CVE-2007-3806) (Reported by shinnai)</li>
<li>Fixed a possible buffer overflow in php_openssl_make_REQ
(Reported by zatanzlatan at hotbrev dot com)</li>
<li>Fixed an open_basedir bypass inside glob() function (Reported
by dr at peytz dot dk)</li>
<li>Fixed a possible open_basedir bypass inside session extension
when the session file is a symlink (Reported by c dot i dot morris
at durham dot ac dot uk)</li>
<li>Improved fix for MOPB-03-2007.</li>
<li>Corrected fix for CVE-2007-2872.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-2872</cvename>
<cvename>CVE-2007-3378</cvename>
<cvename>CVE-2007-3806</cvename>
<cvename>CVE-2007-3996</cvename>
<cvename>CVE-2007-3997</cvename>
<cvename>CVE-2007-3998</cvename>
<cvename>CVE-2007-4652</cvename>
<cvename>CVE-2007-4657</cvename>
<cvename>CVE-2007-4658</cvename>
<cvename>CVE-2007-4659</cvename>
<cvename>CVE-2007-4660</cvename>
<cvename>CVE-2007-4661</cvename>
<cvename>CVE-2007-4662</cvename>
<cvename>CVE-2007-4663</cvename>
<cvename>CVE-2007-4670</cvename>
<url>http://www.php.net/releases/4_4_8.php</url>
<url>http://www.php.net/releases/5_2_4.php</url>
<url>http://secunia.com/advisories/26642</url>
</references>
<dates>
<discovery>2007-08-30</discovery>
<entry>2007-09-11</entry>
<modified>2008-01-14</modified>
</dates>
</vuln>
<vuln vid="c115271d-602b-11dc-898c-001921ab2fa4">
<topic>apache -- multiple vulnerabilities</topic>
<affects>
<package>
<name>apache</name>
<range><gt>2.2.0</gt><lt>2.2.6</lt></range>
<range><gt>2.0.0</gt><lt>2.0.61</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Apache HTTP server project reports:</p>
<blockquote cite="http://www.apache.org/dist/httpd/Announcement2.2.html">
<p>The following potential security flaws are addressed:</p>
<ul>
<li>CVE-2007-3847: mod_proxy: Prevent reading past the end of a
buffer when parsing date-related headers.</li>
<li>CVE-2007-1863: mod_cache: Prevent a segmentation fault if
attributes are listed in a Cache-Control header without any
value.</li>
<li>CVE-2007-3304: prefork, worker, event MPMs: Ensure that the
parent process cannot be forced to kill processes outside its
process group.</li>
<li>CVE-2006-5752: mod_status: Fix a possible XSS attack against
a site with a public server-status page and ExtendedStatus
enabled, for browsers which perform charset "detection".
Reported by Stefan Esser.</li>
<li>CVE-2006-1862: mod_mem_cache: Copy headers into longer lived
storage; header names and values could previously point to
cleaned up storage.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-3847</cvename>
<cvename>CVE-2007-1863</cvename>
<cvename>CVE-2006-5752</cvename>
<cvename>CVE-2007-3304</cvename>
</references>
<dates>
<discovery>2007-09-07</discovery>
<entry>2007-09-11</entry>
</dates>
</vuln>
<vuln vid="4b673ae7-5f9a-11dc-84dd-000102cc8983">
<topic>lighttpd -- FastCGI header overrun in mod_fastcgi</topic>
<affects>
<package>
<name>lighttpd</name>
<range><lt>1.4.18</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>lighttpd maintainer reports:</p>
<blockquote cite="http://www.lighttpd.net/assets/2007/9/9/lighttpd_sa_2007_12.txt">
<p>Lighttpd is prone to a header overflow when using the mod_fastcgi
extension, this can lead to arbitrary code execution in the fastcgi
application. For a detailed description of the bug see the external
reference.</p>
<p>This bug was found by Mattias Bengtsson and Philip Olausson</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.lighttpd.net/assets/2007/9/9/lighttpd_sa_2007_12.txt</url>
<url>http://secweb.se/en/advisories/lighttpd-fastcgi-remote-vulnerability/</url>
<cvename>CVE-2007-4727</cvename>
</references>
<dates>
<discovery>2007-09-09</discovery>
<entry>2007-09-10</entry>
</dates>
</vuln>
<vuln vid="f14ad681-5b88-11dc-812d-0011098b2f36">
<topic>rkhunter -- insecure temporary file creation</topic>
<affects>
<package>
<name>rkhunter</name>
<range><lt>1.2.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gentoo reports:</p>
<blockquote cite="http://www.gentoo.org/security/en/glsa/glsa-200504-25.xml">
<p>Sune Kloppenborg Jeppesen and Tavis Ormandy of the Gentoo Linux
Security Team have reported that the check_update.sh script and
the main rkhunter script insecurely creates several temporary
files with predictable filenames.</p>
<p>A local attacker could create symbolic links in the temporary
files directory, pointing to a valid file somewhere on the
filesystem. When rkhunter or the check_update.sh script runs,
this would result in the file being overwritten with the rights of
the user running the utility, which could be the root user.</p>
</blockquote>
</body>
</description>
<references>
<bid>13399</bid>
<cvename>CVE-2005-1270</cvename>
<url>http://www.gentoo.org/security/en/glsa/glsa-200504-25.xml</url>
</references>
<dates>
<discovery>2005-04-26</discovery>
<entry>2007-09-05</entry>
</dates>
</vuln>
<vuln vid="72cdf2ab-5b87-11dc-812d-0011098b2f36">
<topic>lsh -- multiple vulnerabilities</topic>
<affects>
<package>
<name>lsh</name>
<range><lt>2.0.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/14609">
<p>A vulnerability has been reported in LSH, which potentially
can be exploited by malicious people to cause a DoS (Denial
of Service).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2003-0826</cvename>
<cvename>CVE-2005-0814</cvename>
<url>http://secunia.com/advisories/14609</url>
</references>
<dates>
<discovery>2005-03-17</discovery>
<entry>2007-09-05</entry>
<modified>2008-01-07</modified>
</dates>
</vuln>
<vuln vid="45500f74-5947-11dc-87c1-000e2e5785ad">
<topic>fetchmail -- denial of service on reject of local warning message</topic>
<affects>
<package>
<name>fetchmail</name>
<range><ge>4.6.8</ge><lt>6.3.8_4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Matthias Andree reports:</p>
<blockquote cite="http://www.fetchmail.info/fetchmail-SA-2007-02.txt">
<p>fetchmail will generate warning messages in certain
circumstances (for instance, when leaving oversized messages
on the server or login to the upstream fails) and send them
to the local postmaster or the user running it.</p>
<p>If this warning message is then refused by the SMTP listener
that fetchmail is forwarding the message to, fetchmail
crashes and does not collect further messages until it is
restarted.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-4565</cvename>
<url>http://www.fetchmail.info/fetchmail-SA-2007-02.txt</url>
</references>
<dates>
<discovery>2007-07-29</discovery>
<entry>2007-09-02</entry>
</dates>
</vuln>
<vuln vid="d944719e-42f4-4864-89ed-f045b541919f">
<topic>gtar -- Directory traversal vulnerability</topic>
<affects>
<package>
<name>gtar</name>
<range><lt>1.18_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Red Hat reports:</p>
<blockquote cite="http://rhn.redhat.com/errata/RHSA-2007-0860.html">
<p>A path traversal flaw was discovered in the way GNU
tar extracted archives. A malicious user could create a
tar archive that could write to arbitrary files to which
the user running GNU tar had write access.</p>
</blockquote>
<p>Red Hat credits Dmitry V. Levin for reporting the issue.</p>
</body>
</description>
<references>
<bid>25417</bid>
<cvename>CVE-2007-4131</cvename>
<url>http://rhn.redhat.com/errata/RHSA-2007-0860.html</url>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=251921</url>
</references>
<dates>
<discovery>2007-08-23</discovery>
<entry>2007-09-01</entry>
</dates>
</vuln>
<vuln vid="d9867f50-54d0-11dc-b80b-0016179b2dd5">
<topic>claws-mail -- POP3 Format String Vulnerability</topic>
<affects>
<package>
<name>claws-mail</name>
<name>sylpheed-claws</name>
<range><lt>2.10.0_3</lt></range>
</package>
<package>
<name>sylpheed2</name>
<range><lt>2.4.4_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Secunia Advisory reports:</p>
<blockquote cite="http://secunia.com/advisories/26550/">
<p>A format string error in the "inc_put_error()" function in
src/inc.c when displaying a POP3 server's error response can
be exploited via specially crafted POP3 server replies containing
format specifiers.</p>
<p>Successful exploitation may allow execution of arbitrary code,
but requires that the user is tricked into connecting to a malicious
POP3 server.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-2958</cvename>
<url>http://secunia.com/advisories/26550/</url>
<url>http://secunia.com/secunia_research/2007-70/advisory/</url>
</references>
<dates>
<discovery>2007-08-24</discovery>
<entry>2007-08-27</entry>
<modified>2010-05-12</modified>
</dates>
</vuln>
<vuln vid="af8e3a0c-5009-11dc-8a43-003048705d5a">
<topic>rsync -- off by one stack overflow</topic>
<affects>
<package>
<name>rsync</name>
<range><lt>2.6.9_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>BugTraq reports:</p>
<blockquote cite="http://www.securityfocus.com/bid/25336/discuss">
<p>The rsync utility is prone to an off-by-one buffer-overflow
vulnerability. This issue is due to a failure of the application
to properly bounds-check user-supplied input.</p>
<p>Successfully exploiting this issue may allow arbitrary
code-execution in the context of the affected utility.</p>
</blockquote>
</body>
</description>
<references>
<bid>25336</bid>
<cvename>CVE-2007-4091</cvename>
</references>
<dates>
<discovery>2007-08-15</discovery>
<entry>2007-08-21</entry>
<modified>2007-08-23</modified>
</dates>
</vuln>
<vuln vid="df4a7d21-4b17-11dc-9fc2-001372ae3ab9">
<topic>opera -- Vulnerability in javascript handling</topic>
<affects>
<package>
<name>opera</name>
<name>opera-devel</name>
<name>linux-opera</name>
<range><lt>9.23.20070809</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>An advisory from Opera reports:</p>
<blockquote cite="http://www.opera.com/support/search/view/865/">
<p>A specially crafted JavaScript can make Opera execute
arbitrary code.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.opera.com/support/search/view/865/</url>
</references>
<dates>
<discovery>2007-08-03</discovery>
<entry>2007-08-15</entry>
<modified>2007-08-25</modified>
</dates>
</vuln>
<vuln vid="4a338d17-412d-11dc-bdb0-0016179b2dd5">
<topic>fsplib -- multiple vulnerabilities</topic>
<affects>
<package>
<name>fsplib</name>
<range><lt>0.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Secunia Advisory reports:</p>
<blockquote cite="http://secunia.com/advisories/26184/">
<p>fsplib can be exploited to compromise an application using
the library.</p>
<p>A boundary error exists in the processing of file names in
fsp_readdir_native, which can be exploited to cause a stack-based
buffer overflow if the defined MAXNAMLEN is bigger than 256.</p>
<p>A boundary error exists in the processing of directory entries in
fsp_readdir, which can be exploited to cause a stack-based buffer
overflow on systems with an insufficient size allocated for the
d_name field of directory entries.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-3961</cvename>
<cvename>CVE-2007-3962</cvename>
<url>http://secunia.com/advisories/26184/</url>
</references>
<dates>
<discovery>2007-07-24</discovery>
<entry>2007-08-02</entry>
</dates>
</vuln>
<vuln vid="4872d9a7-4128-11dc-bdb0-0016179b2dd5">
<topic>joomla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>joomla</name>
<range><lt>1.0.13</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Secunia Advisory reports:</p>
<p>joomla can be exploited to conduct session fixation
attacks, cross-site scripting attacks or HTTP response
splitting attacks.</p>
<p>Certain unspecified input passed in com_search, com_content and
mod_login is not properly sanitised before being returned to a
user. This can be exploited to execute arbitrary HTML and script
code in a user's browser session in context of an affected
site.</p>
<p>Input passed to the url parameter is not properly sanitised
before being returned to the user. This can be exploited to insert
arbitrary HTTP headers, which will be included in a response sent
to the user, allowing for execution of arbitrary HTML and script
code in a user's browser session in context of an affected
site.</p>
<p>An error exists in the handling of sessions and can be exploited
to hijack another user's session by tricking the user into logging
in after following a specially crafted link.</p>
</body>
</description>
<references>
<cvename>CVE-2007-4188</cvename>
<cvename>CVE-2007-4189</cvename>
<cvename>CVE-2007-4190</cvename>
<cvename>CVE-2007-5577</cvename>
<url>http://www.joomla.org/content/view/3677/1/</url>
<url>http://secunia.com/advisories/26239/</url>
</references>
<dates>
<discovery>2007-07-30</discovery>
<entry>2007-08-02</entry>
<modified>2010-05-12</modified>
</dates>
</vuln>
<vuln vid="2dc764fa-40c0-11dc-aeac-02e0185f8d72">
<topic>FreeBSD -- Buffer overflow in tcpdump(1)</topic>
<affects>
<package>
<name>tcpdump</name>
<range><lt>3.9.6</lt></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>6.2</ge><lt>6.2_7</lt></range>
<range><ge>6.1</ge><lt>6.1_19</lt></range>
<range><ge>5.5</ge><lt>5.5_15</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>An un-checked return value in the BGP dissector code can
result in an integer overflow. This value is used in
subsequent buffer management operations, resulting in a stack
based buffer overflow under certain circumstances.</p>
<h1>Impact:</h1>
<p>By crafting malicious BGP packets, an attacker could exploit
this vulnerability to execute code or crash the tcpdump
process on the target system. This code would be executed in
the context of the user running tcpdump(1). It should be
noted that tcpdump(1) requires privileges in order to open live
network interfaces.</p>
<h1>Workaround:</h1>
<p>No workaround is available.</p>
</body>
</description>
<references>
<cvename>CVE-2007-3798</cvename>
<freebsdsa>SA-07:06.tcpdump</freebsdsa>
</references>
<dates>
<discovery>2007-08-01</discovery>
<entry>2007-08-02</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="3de342fb-40be-11dc-aeac-02e0185f8d72">
<topic>FreeBSD -- Predictable query ids in named(8)</topic>
<affects>
<package>
<name>named</name>
<range><ge>9.4</ge><lt>9.4.1.1</lt></range>
<range><ge>9.3</ge><lt>9.3.4.1</lt></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>6.2</ge><lt>6.2_7</lt></range>
<range><ge>6.1</ge><lt>6.1_19</lt></range>
<range><ge>5.5</ge><lt>5.5_15</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>When named(8) is operating as a recursive DNS server or
sending NOTIFY requests to slave DNS servers, named(8)
uses a predictable query id.</p>
<h1>Impact:</h1>
<p>An attacker who can see the query id for some request(s)
sent by named(8) is likely to be able to perform DNS cache
poisoning by predicting the query id for other request(s).</p>
<h1>Workaround:</h1>
<p>No workaround is available.</p>
</body>
</description>
<references>
<cvename>CVE-2007-2926</cvename>
<freebsdsa>SA-07:07.bind</freebsdsa>
</references>
<dates>
<discovery>2007-07-24</discovery>
<entry>2007-08-02</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="0e43a14d-3f3f-11dc-a79a-0016179b2dd5">
<topic>xpdf -- stack based buffer overflow</topic>
<affects>
<package>
<name>xpdf</name>
<range><lt>3.02_2</lt></range>
</package>
<package>
<name>kdegraphics</name>
<range><lt>3.5.7_1</lt></range>
</package>
<package>
<name>cups-base</name>
<range><lt>1.2.11_3</lt></range>
</package>
<package>
<name>gpdf</name>
<range><gt>0</gt></range>
</package>
<package>
<name>pdftohtml</name>
<range><lt>0.39_3</lt></range>
</package>
<package>
<name>poppler</name>
<range><lt>0.5.9_4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The KDE Team reports:</p>
<blockquote cite="http://www.kde.org/info/security/advisory-20070730-1.txt">
<p>kpdf, the KDE pdf viewer, shares code with xpdf. xpdf contains
a vulnerability that can cause a stack based buffer overflow
via a PDF file that exploits an integer overflow in
StreamPredictor::StreamPredictor(). Remotely supplied
pdf files can be used to disrupt the kpdf viewer on
the client machine and possibly execute arbitrary code.</p>
</blockquote>
</body>
</description>
<references>
<bid>25124</bid>
<cvename>CVE-2007-3387</cvename>
<url>http://www.kde.org/info/security/advisory-20070730-1.txt</url>
</references>
<dates>
<discovery>2007-07-30</discovery>
<entry>2007-07-31</entry>
<modified>2009-04-29</modified>
</dates>
</vuln>
<vuln vid="ff284bf0-3f32-11dc-a79a-0016179b2dd5">
<cancelled superseded="2dc764fa-40c0-11dc-aeac-02e0185f8d72"/>
</vuln>
<vuln vid="863f95d3-3df1-11dc-b3d3-0016179b2dd5">
<topic>mutt -- buffer overflow vulnerability</topic>
<affects>
<package>
<name>mutt</name>
<name>mutt-lite</name>
<name>ja-mutt</name>
<name>zh-mutt</name>
<range><lt>1.4.2.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Securityfocus reports:</p>
<blockquote cite="http://www.securityfocus.com/bid/24192/">
<p>Mutt is prone to a local buffer-overflow vulnerability
because it fails to properly bounds-check user-supplied
input before using it in a memory copy operation.
An attacker can exploit this issue to execute arbitrary
code with the with the privileges of the victim. Failed
exploit attempts will result in a denial of service.</p>
</blockquote>
</body>
</description>
<references>
<bid>24192</bid>
<cvename>CVE-2007-2683</cvename>
<url>http://www.redhat.com/support/errata/RHSA-2007-0386.html</url>
</references>
<dates>
<discovery>2007-05-28</discovery>
<entry>2007-07-29</entry>
</dates>
</vuln>
<vuln vid="d2b8a963-3d59-11dc-b3d3-0016179b2dd5">
<topic>p5-Net-DNS -- multiple Vulnerabilities</topic>
<affects>
<package>
<name>p5-Net-DNS</name>
<range><lt>0.60</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Secunia Advisory reports:</p>
<blockquote cite="http://secunia.com/advisories/25829/">
<p>An error exists in the handling of DNS queries where IDs are
incremented with a fixed value and are additionally used for
child processes in a forking server. This can be exploited to
poison the DNS cache of an application using the module if a
valid ID is guessed.</p>
<p>An error in the PP implementation within the "dn_expand()"
function can be exploited to cause a stack overflow due to an
endless loop via a specially crafted DNS packet.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-3377</cvename>
<cvename>CVE-2007-3409</cvename>
<url>http://secunia.com/advisories/25829/</url>
</references>
<dates>
<discovery>2007-06-27</discovery>
<entry>2007-07-28</entry>
</dates>
</vuln>
<vuln vid="88260dfe-3d21-11dc-b3d3-0016179b2dd5">
<topic>phpsysinfo -- url Cross-Site Scripting</topic>
<affects>
<package>
<name>phpSysInfo</name>
<range><lt>2.5.3_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Doz reports:</p>
<blockquote cite="http://secunia.com/advisories/26248/">
<p>A Input passed in the URL to index.php is not properly
sanitised before being returned to the user. This can be
exploited to execute arbitrary HTML and script code in a
user's browser session in context of an affected site.</p>
</blockquote>
</body>
</description>
<references>
<url>http://secunia.com/advisories/26248/</url>
</references>
<dates>
<discovery>2007-07-27</discovery>
<entry>2007-07-28</entry>
<modified>2007-08-01</modified>
</dates>
</vuln>
<vuln vid="98dd7788-3d13-11dc-b3d3-0016179b2dd5">
<topic>drupal -- Cross site request forgeries</topic>
<affects>
<package>
<name>drupal5</name>
<range><lt>5.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Drupal Project reports:</p>
<blockquote cite="http://drupal.org/node/162360">
<p>Several parts in Drupal core are not protected against cross
site request forgeries due to inproper use of the Forms API,
or by taking action solely on GET requests. Malicious users are
able to delete comments and content revisions and disable menu
items by enticing a privileged users to visit certain URLs while
the victim is logged-in to the targeted site.</p>
</blockquote>
</body>
</description>
<references>
<url>http://drupal.org/node/162360</url>
<url>http://secunia.com/advisories/26224/</url>
</references>
<dates>
<discovery>2007-07-26</discovery>
<entry>2007-07-28</entry>
</dates>
</vuln>
<vuln vid="1f5b711b-3d0e-11dc-b3d3-0016179b2dd5">
<topic>drupal -- Multiple cross-site scripting vulnerabilities</topic>
<affects>
<package>
<name>drupal4</name>
<range><lt>4.7.7</lt></range>
</package>
<package>
<name>drupal5</name>
<range><lt>5.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Drupal Project reports:</p>
<blockquote cite="http://drupal.org/node/162361">
<p>Some server variables are not escaped consistently. When
a malicious user is able to entice a victim to visit a specially
crafted link or webpage, arbitrary HTML and script code can be
injected and executed in the context of the victim's session on
the targeted website.</p>
<p>Custom content type names are not escaped consistently. A
malicious user with the 'administer content types' permission
would be able to inject and execute arbitrary HTML and script
code on the website. Revoking the 'administer content types'
permission provides an immediate workaround.</p>
</blockquote>
</body>
</description>
<references>
<url>http://drupal.org/node/162361</url>
<url>http://secunia.com/advisories/26224/</url>
</references>
<dates>
<discovery>2007-07-26</discovery>
<entry>2007-07-28</entry>
</dates>
</vuln>
<vuln vid="1ed03222-3c65-11dc-b3d3-0016179b2dd5">
<topic>vim -- Command Format String Vulnerability</topic>
<affects>
<package>
<name>vim</name>
<name>vim-console</name>
<name>vim-lite</name>
<name>vim-ruby</name>
<name>vim6</name>
<name>vim6-ruby</name>
<range><lt>7.1.39</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Secunia Advisory reports:</p>
<blockquote cite="http://secunia.com/advisories/25941/">
<p>A format string error in the "helptags_one()" function in
src/ex_cmds.c when running the "helptags" command can be exploited
to execute arbitrary code via specially crafted help files.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-2953</cvename>
<url>http://secunia.com/advisories/25941/</url>
</references>
<dates>
<discovery>2007-07-27</discovery>
<entry>2007-07-27</entry>
</dates>
</vuln>
<vuln vid="b73335a5-3bbe-11dc-8e83-0016179b2dd5">
<topic>libvorbis -- Multiple memory corruption flaws</topic>
<affects>
<package>
<name>libvorbis</name>
<range><lt>1.2.0,3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>isecpartners reports:</p>
<blockquote cite="http://www.isecpartners.com/advisories/2007-003-libvorbis.txt">
<p>libvorbis contains several vulnerabilities
allowing heap overwrite, read violations and a function
pointer overwrite. These bugs cause a at least a denial
of service, and potentially code execution.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.isecpartners.com/advisories/2007-003-libvorbis.txt</url>
<cvename>CVE-2007-3106</cvename>
</references>
<dates>
<discovery>2007-06-05</discovery>
<entry>2007-07-26</entry>
</dates>
</vuln>
<vuln vid="ab2575d6-39f0-11dc-b8cc-000fea449b8a">
<topic>tomcat -- XSS vulnerability in sample applications</topic>
<affects>
<package>
<name>apache-tomcat</name>
<range><gt>6.0.0</gt><lt>6.0.11</lt></range>
</package>
<package>
<name>tomcat</name>
<range><gt>5.0.0</gt><lt>5.5.24</lt></range>
</package>
<package>
<name>jakarta-tomcat</name>
<range><gt>5.0.0</gt><lt>5.5.24</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Apache Project reports:</p>
<blockquote cite="http://tomcat.apache.org/security-5.html">
<p>The JSP and Servlet included in the sample application within
the Tomcat documentation webapp did not escape user provided
data before including it in the output. This enabled a XSS
attack. These pages have been simplified not to use any user
provided data in the output.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-1355</cvename>
<bid>24058</bid>
</references>
<dates>
<discovery>2007-05-19</discovery>
<entry>2007-07-24</entry>
</dates>
</vuln>
<vuln vid="872623af-39ec-11dc-b8cc-000fea449b8a">
<topic>tomcat -- multiple vulnerabilities</topic>
<affects>
<package>
<name>apache-tomcat</name>
<range><ge>4.1.0</ge><lt>4.1.36</lt></range>
<range><gt>6.0.0</gt><lt>6.0.11</lt></range>
</package>
<package>
<name>tomcat</name>
<range><gt>5.0.0</gt><lt>5.5.23</lt></range>
</package>
<package>
<name>jakarta-tomcat</name>
<range><ge>4.0.0</ge><lt>4.1.0</lt></range>
<range><gt>5.0.0</gt><lt>5.5.23</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Apache Project reports:</p>
<blockquote cite="http://www.mail-archive.com/dev@tomcat.apache.org/msg16385.html">
<p>The Apache Tomcat team is proud to announce the immediate
availability of Tomcat 4.1.36 stable. This build contains
numerous library updates, A small number of bug fixes and
two important security fixes.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2005-2090</cvename>
<cvename>CVE-2007-0450</cvename>
<cvename>CVE-2007-1358</cvename>
</references>
<dates>
<discovery>2007-04-27</discovery>
<entry>2007-07-24</entry>
</dates>
</vuln>
<vuln vid="cddde37a-39b5-11dc-b3da-001921ab2fa4">
<topic>dokuwiki -- XSS vulnerability in spellchecker backend</topic>
<affects>
<package>
<name>dokuwiki</name>
<range><lt>20070626_1</lt></range>
</package>
<package>
<name>dokuwiki-devel</name>
<range><lt>20070524_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>DokuWiki reports:</p>
<blockquote cite="http://bugs.splitbrain.org/index.php?do=details&task_id=1195">
<p>The spellchecker tests the UTF-8 capabilities of the used browser
by sending an UTF-8 string to the backend, which will send it back
unfiltered. By comparing string length the spellchecker can work
around broken implementations. An attacker could construct a form to
let users send JavaScript to the spellchecker backend, resulting in
malicious JavaScript being executed in their browser.</p>
<p>Affected are all versions up to and including 2007-06-26 even when
the spell checker is disabled.</p>
</blockquote>
</body>
</description>
<references>
<url>http://xforce.iss.net/xforce/xfdb/35501</url>
<cvename>CVE-2007-3930</cvename>
</references>
<dates>
<discovery>2007-06-26</discovery>
<entry>2007-07-24</entry>
</dates>
</vuln>
<vuln vid="fc9c217e-3791-11dc-bb1a-000fea449b8a">
<topic>lighttpd -- multiple vulnerabilities</topic>
<affects>
<package>
<name>lighttpd</name>
<range><lt>1.4.15_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia Advisory reports:</p>
<blockquote cite="http://secunia.com/advisories/26130/">
<p>Some vulnerabilities have been reported in lighttpd,
which can be exploited by malicious people to bypass
certain security restrictions or cause a DoS (Denial
of Service).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-3947</cvename>
<cvename>CVE-2007-3948</cvename>
<cvename>CVE-2007-3949</cvename>
<cvename>CVE-2007-3950</cvename>
<url>http://trac.lighttpd.net/trac/ticket/1216</url>
<url>http://trac.lighttpd.net/trac/ticket/1232</url>
<url>http://trac.lighttpd.net/trac/ticket/1230</url>
<url>http://trac.lighttpd.net/trac/ticket/1263</url>
</references>
<dates>
<discovery>2007-07-20</discovery>
<entry>2007-07-21</entry>
<modified>2010-05-12</modified>
</dates>
</vuln>
<vuln vid="12d266b6-363f-11dc-b6c9-000c6ec775d9">
<topic>opera -- multiple vulnerabilities</topic>
<affects>
<package>
<name>opera</name>
<name>opera-devel</name>
<name>linux-opera</name>
<range><lt>9.22</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Opera Software ASA reports of multiple security fixes in
Opera, including an arbitrary code execute
vulnerability:</p>
<blockquote cite="http://www.opera.com/support/search/view/861/">
<p>Opera for Linux, FreeBSD, and Solaris has a flaw in the
createPattern function that leaves old data that was in
the memory before Opera allocated it in the new
pattern. The pattern can be read and analyzed by
JavaScript, so an attacker can get random samples of the
user's memory, which may contain data.</p>
</blockquote>
<blockquote cite="http://www.opera.com/support/search/view/862/">
<p>Removing a specially crafted torrent from the download
manager can crash Opera. The crash is caused by an
erroneous memory access.</p>
<p>An attacker needs to entice the user to accept the
malicious BitTorrent download, and later remove it from
Opera's download manager. To inject code, additional means
will have to be employed.</p>
<p>Users clicking a BitTorrent link and rejecting the
download are not affected.</p>
</blockquote>
<blockquote cite="http://www.opera.com/support/search/view/863/">
<p>data: URLs embed data inside them, instead of linking to
an external resource. Opera can mistakenly display the end
of a data URL instead of the beginning. This allows an
attacker to spoof the URL of a trusted site.</p>
</blockquote>
<blockquote cite="http://www.opera.com/support/search/view/864/">
<p>Opera's HTTP authentication dialog is displayed when the
user enters a Web page that requires a login name and a
password. To inform the user which server it was that
asked for login credentials, the dialog displays the
server name.</p>
<p>The user has to see the entire server name. A truncated
name can be misleading. Opera's authentication dialog cuts
off the long server names at the right hand side, adding
an ellipsis (...) to indicate that it has been cut off.</p>
<p>The dialog has a predictable size, allowing an attacker
to create a server name which will look almost like a
trusted site, because the real domain name has been cut
off. The three dots at the end will not be obvious to all
users.</p>
<p>This flaw can be exploited by phishers who can set up
custom sub-domains, for example by hosting their own
public DNS.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-3929</cvename>
<cvename>CVE-2007-4944</cvename>
<url>http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=564</url>
<url>http://www.opera.com/support/search/view/861/</url>
<url>http://www.opera.com/support/search/view/862/</url>
<url>http://www.opera.com/support/search/view/863/</url>
<url>http://www.opera.com/support/search/view/864/</url>
<url>http://www.opera.com/docs/changelogs/freebsd/922/</url>
</references>
<dates>
<discovery>2007-07-19</discovery>
<entry>2007-07-19</entry>
<modified>2010-05-12</modified>
</dates>
</vuln>
<vuln vid="e190ca65-3636-11dc-a697-000c6ec775d9">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>2.0.0.5,1</lt></range>
<range><gt>3.*,1</gt><lt>3.0.a2_3,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<name>linux-thunderbird</name>
<name>mozilla-thunderbird</name>
<name>thunderbird</name>
<range><lt>2.0.0.5</lt></range>
</package>
<!-- Packages which probably will be upgraded -->
<package>
<name>seamonkey</name>
<name>linux-seamonkey</name>
<range><lt>1.1.3</lt></range>
</package>
<package>
<name>linux-firefox-devel</name>
<range><lt>3.0.a2007.12.12</lt></range>
</package>
<package>
<name>linux-seamonkey-devel</name>
<range><lt>2.0.a2007.12.12</lt></range>
</package>
<!-- Deprecated/old names -->
<package>
<name>firefox-ja</name>
<name>linux-mozilla-devel</name>
<name>linux-mozilla</name>
<name>mozilla</name>
<range><gt>0</gt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Foundation reports of multiple security issues
in Firefox, Seamonkey, and Thunderbird. Several of these
issues can probably be used to run arbitrary code with the
privilege of the user running the program.</p>
<blockquote cite="http://www.mozilla.org/projects/security/known-vulnerabilities.html#firefox2.0.0.5">
<ul>
<li>MFSA 2007-25 XPCNativeWrapper pollution</li>
<li>MFSA 2007-24 Unauthorized access to wyciwyg:// documents</li>
<li>MFSA 2007-21 Privilege escalation using an event
handler attached to an element not in the document</li>
<li>MFSA 2007-20 Frame spoofing while window is loading</li>
<li>MFSA 2007-19 XSS using addEventListener and setTimeout</li>
<li>MFSA 2007-18 Crashes with evidence of memory corruption</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-3089</cvename>
<cvename>CVE-2007-3734</cvename>
<cvename>CVE-2007-3735</cvename>
<cvename>CVE-2007-3737</cvename>
<cvename>CVE-2007-3738</cvename>
<url>http://www.mozilla.org/projects/security/known-vulnerabilities.html#firefox2.0.0.5</url>
<url>http://www.mozilla.org/security/announce/2007/mfsa2007-18.html</url>
<url>http://www.mozilla.org/security/announce/2007/mfsa2007-19.html</url>
<url>http://www.mozilla.org/security/announce/2007/mfsa2007-20.html</url>
<url>http://www.mozilla.org/security/announce/2007/mfsa2007-21.html</url>
<url>http://www.mozilla.org/security/announce/2007/mfsa2007-24.html</url>
<url>http://www.mozilla.org/security/announce/2007/mfsa2007-25.html</url>
<uscertta>TA07-199A</uscertta>
</references>
<dates>
<discovery>2007-07-17</discovery>
<entry>2007-07-19</entry>
<modified>2008-06-21</modified>
</dates>
</vuln>
<vuln vid="b42e8c32-34f6-11dc-9bc9-001921ab2fa4">
<topic>linux-flashplugin -- critical vulnerabilities</topic>
<affects>
<package>
<name>linux-flashplugin</name>
<range><gt>9.0</gt><le>9.0r45</le></range>
<range><gt>8.0</gt><le>8.0r34</le></range>
<range><le>7.0r69</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="http://www.adobe.com/support/security/bulletins/apsb07-12.html">
<p>Critical vulnerabilities have been identified in
Adobe Flash Player that could allow an attacker who
successfully exploits these potential vulnerabilities
to take control of the affected system. A malicious
SWF must be loaded in Flash Player by the user for
an attacker to exploit these potential vulnerabilities.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-2022</cvename>
<cvename>CVE-2007-3456</cvename>
<cvename>CVE-2007-3457</cvename>
</references>
<dates>
<discovery>2007-07-10</discovery>
<entry>2007-07-18</entry>
</dates>
</vuln>
<vuln vid="7fadc049-2ba0-11dc-9377-0016179b2dd5">
<topic>wireshark -- Multiple problems</topic>
<affects>
<package>
<name>wireshark</name>
<name>wireshark-lite</name>
<name>ethereal</name>
<name>ethereal-lite</name>
<name>tethereal</name>
<name>tethereal-lite</name>
<range><ge>0.8.20</ge><lt>0.99.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>wireshark Team reports:</p>
<blockquote cite="http://www.wireshark.org/security/wnpa-sec-2007-02.html">
<p>It may be possible to make Wireshark or Ethereal crash or use up
available memory by injecting a purposefully malformed packet onto
the wire or by convincing someone to read a malformed packet trace
file.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-3389</cvename>
<cvename>CVE-2007-3390</cvename>
<cvename>CVE-2007-3391</cvename>
<cvename>CVE-2007-3392</cvename>
<cvename>CVE-2007-3393</cvename>
<url>http://secunia.com/advisories/25833/</url>
<url>http://www.wireshark.org/security/wnpa-sec-2007-02.html</url>
</references>
<dates>
<discovery>2007-06-29</discovery>
<entry>2007-07-06</entry>
<modified>2010-05-12</modified>
</dates>
</vuln>
<vuln vid="2c4f4688-298b-11dc-a197-0011098b2f36">
<topic>typespeed -- arbitrary code execution</topic>
<affects>
<package>
<name>typespeed</name>
<range><le>0.4.1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Debian reports:</p>
<blockquote cite="http://www.debian.org/security/2005/dsa-684">
<p>Ulf Härnhammar from the Debian Security Audit Project
discovered a problem in typespeed, a touch-typist trainer
disguised as game. This could lead to a local attacker
executing arbitrary code.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2005-0105</cvename>
<url>http://www.debian.org/security/2005/dsa-684</url>
</references>
<dates>
<discovery>2005-02-16</discovery>
<entry>2007-07-03</entry>
<modified>2007-07-09</modified>
</dates>
</vuln>
<vuln vid="7128fb45-2633-11dc-94da-0016179b2dd5">
<topic>vlc -- format string vulnerability and integer overflow</topic>
<affects>
<package>
<name>vlc</name>
<range><lt>0.8.6c</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>isecpartners reports:</p>
<blockquote cite="http://www.isecpartners.com/advisories/2007-001-vlc.txt">
<p>VLC is vulnerable to a format string attack in the parsing
of Vorbis comments in Ogg Vorbis and Ogg Theora files, CDDA
data or SAP/SDP service discovery messages. Additionally,
there are two errors in the handling of wav files, one a
denial of service due to an uninitialized variable, and one
integer overflow in sampling frequency calculations.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-3316</cvename>
<cvename>CVE-2007-3468</cvename>
<cvename>CVE-2007-3467</cvename>
<url>http://www.isecpartners.com/advisories/2007-001-vlc.txt</url>
</references>
<dates>
<discovery>2007-06-05</discovery>
<entry>2007-06-18</entry>
<modified>2010-05-12</modified>
</dates>
</vuln>
<vuln vid="32d38cbb-2632-11dc-94da-0016179b2dd5">
<topic>flac123 -- stack overflow in comment parsing</topic>
<affects>
<package>
<name>flac123</name>
<range><lt>0.0.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>isecpartners reports:</p>
<blockquote cite="http://www.isecpartners.com/advisories/2007-002-flactools.txt">
<p>flac123, also known as flac-tools, is vulnerable
to a buffer overflow in vorbis comment parsing.
This allows for the execution of arbitrary code.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-3507</cvename>
<url>http://sourceforge.net/forum/forum.php?forum_id=710314</url>
<url>http://www.isecpartners.com/advisories/2007-002-flactools.txt</url>
</references>
<dates>
<discovery>2007-06-05</discovery>
<entry>2007-06-28</entry>
<modified>2007-08-10</modified>
</dates>
</vuln>
<vuln vid="6e099997-25d8-11dc-878b-000c29c5647f">
<topic>gd -- multiple vulnerabilities</topic>
<affects>
<package>
<name>gd</name>
<range><lt>2.0.35,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>gd had been reported vulnerable to several
vulnerabilities:</p>
<ul>
<li>CVE-2007-3472: Integer overflow in gdImageCreateTrueColor
function in the GD Graphics Library (libgd) before 2.0.35
allows user-assisted remote attackers has unspecified attack
vectors and impact.</li>
<li>CVE-2007-3473: The gdImageCreateXbm function in the GD
Graphics Library (libgd) before 2.0.35 allows user-assisted
remote attackers to cause a denial of service (crash) via
unspecified vectors involving a gdImageCreate failure.</li>
<li>CVE-2007-3474: Multiple unspecified vulnerabilities in the GIF
reader in the GD Graphics Library (libgd) before 2.0.35 allow
user-assisted remote attackers to have unspecified attack vectors
and impact.</li>
<li>CVE-2007-3475: The GD Graphics Library (libgd) before 2.0.35
allows user-assisted remote attackers to cause a denial of service
(crash) via a GIF image that has no global color map.</li>
<li>CVE-2007-3476: Array index error in gd_gif_in.c in the GD Graphics
Library (libgd) before 2.0.35 allows user-assisted remote attackers
to cause a denial of service (crash and heap corruption) via large
color index values in crafted image data, which results in a
segmentation fault.</li>
<li>CVE-2007-3477: The (a) imagearc and (b) imagefilledarc functions
in GD Graphics Library (libgd) before 2.0.35 allows attackers to
cause a denial of service (CPU consumption) via a large (1) start or
(2) end angle degree value.</li>
<li>CVE-2007-3478: Race condition in gdImageStringFTEx
(gdft_draw_bitmap) in gdft.c in the GD Graphics Library (libgd)
before 2.0.35 allows user-assisted remote attackers to cause a
denial of service (crash) via unspecified vectors, possibly
involving truetype font (TTF) support.</li>
</ul>
</body>
</description>
<references>
<cvename>CVE-2007-3472</cvename>
<cvename>CVE-2007-3473</cvename>
<cvename>CVE-2007-3474</cvename>
<cvename>CVE-2007-3475</cvename>
<cvename>CVE-2007-3476</cvename>
<cvename>CVE-2007-3477</cvename>
<cvename>CVE-2007-3478</cvename>
<url>http://www.libgd.org/ReleaseNote020035</url>
<url>http://www.frsirt.com/english/advisories/2007/2336</url>
<url>http://bugs.libgd.org/?do=details&task_id=89</url>
<url>http://bugs.libgd.org/?do=details&task_id=94</url>
<url>http://bugs.libgd.org/?do=details&task_id=70</url>
<url>http://bugs.libgd.org/?do=details&task_id=87</url>
<url>http://bugs.libgd.org/?do=details&task_id=92</url>
<url>http://bugs.libgd.org/?do=details&task_id=74</url>
<url>http://bugs.libgd.org/?do=details&task_id=48</url>
<url>http://bugs.php.net/bug.php?id=40578</url>
</references>
<dates>
<discovery>2007-06-21</discovery>
<entry>2007-06-29</entry>
</dates>
</vuln>
<vuln vid="b1b5c125-2308-11dc-b91a-001921ab2fa4">
<topic>evolution-data-server -- remote execution of arbitrary code vulnerability</topic>
<affects>
<package>
<name>evolution-data-server</name>
<range><lt>1.10.2_1</lt></range>
<range><gt>1.11.*</gt><lt>1.11.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Debian project reports:</p>
<blockquote cite="http://lists.debian.org/debian-security-announce/debian-security-announce-2007/msg00082.html">
<p>It was discovered that the IMAP code in the Evolution
Data Server performs insufficient sanitising of a value
later used an array index, which can lead to the execution
of arbitrary code.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-3257</cvename>
<url>http://secunia.com/advisories/25766/</url>
<url>http://bugzilla.gnome.org/show_bug.cgi?id=447414</url>
</references>
<dates>
<discovery>2007-06-23</discovery>
<entry>2007-06-25</entry>
<modified>2007-06-28</modified>
</dates>
</vuln>
<vuln vid="d337b206-200f-11dc-a197-0011098b2f36">
<topic>xpcd -- buffer overflow</topic>
<affects>
<package>
<name>xpcd</name>
<range><gt>0</gt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Debian Project reports:</p>
<blockquote cite="http://www.debian.org/security/2005/dsa-676">
<p>Erik Sjolund discovered a buffer overflow in pcdsvgaview,
an SVGA PhotoCD viewer. xpcd-svga is part of xpcd and uses
svgalib to display graphics on the Linux console for which
root permissions are required. A malicious user could
overflow a fixed-size buffer and may cause the program to
execute arbitrary code with elevated privileges.</p>
</blockquote>
</body>
</description>
<references>
<bid>12523</bid>
<cvename>CVE-2005-0074</cvename>
<url>http://www.debian.org/security/2005/dsa-676</url>
</references>
<dates>
<discovery>2005-02-11</discovery>
<entry>2007-06-21</entry>
</dates>
</vuln>
<vuln vid="903654bd-1927-11dc-b8a0-02e0185f8d72">
<topic>clamav -- multiple vulnerabilities</topic>
<affects>
<package>
<name>clamav</name>
<range><lt>0.90.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Clamav had been found vulnerable to multiple vulnerabilities:</p>
<ul>
<li>Improper checking for the end of an buffer causing an
unspecified attack vector.</li>
<li>Insecure temporary file handling, which could be exploited
to read sensitive information.</li>
<li>A flaw in the parser engine which could allow a remote
attacker to bypass the scanning of RAR files.</li>
<li>A flaw in libclamav/unrar.c which could cause a remote
Denial of Service (DoS) by sending a specially crafted
RAR file with a modified vm_codesize.</li>
<li>A flaw in the OLE2 parser which could cause a remote
Denial of Service (DoS).</li>
</ul>
</body>
</description>
<references>
<cvename>CVE-2007-2650</cvename>
<cvename>CVE-2007-3023</cvename>
<cvename>CVE-2007-3024</cvename>
<cvename>CVE-2007-3122</cvename>
<cvename>CVE-2007-3123</cvename>
<url>http://news.gmane.org/gmane.comp.security.virus.clamav.devel/cutoff=2853</url>
</references>
<dates>
<discovery>2007-04-18</discovery>
<entry>2007-06-19</entry>
</dates>
</vuln>
<vuln vid="8092b820-1d6f-11dc-a0b2-001921ab2fa4">
<topic>p5-Mail-SpamAssassin -- local user symlink-attack DoS vulnerability</topic>
<affects>
<package>
<name>p5-Mail-SpamAssassin</name>
<range><lt>3.2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SpamAssassin website reports:</p>
<blockquote cite="http://spamassassin.apache.org/advisories/cve-2007-2873.txt">
<p>A local user symlink-attack DoS vulnerability in
SpamAssassin has been found, affecting versions 3.1.x,
3.2.0, and SVN trunk.</p>
</blockquote>
</body>
</description>
<references>
<url>http://spamassassin.apache.org/advisories/cve-2007-2873.txt</url>
<cvename>CVE-2007-2873</cvename>
</references>
<dates>
<discovery>2007-06-11</discovery>
<entry>2007-06-18</entry>
</dates>
</vuln>
<vuln vid="39988ee8-1918-11dc-b6bd-0016179b2dd5">
<topic>cups -- Incomplete SSL Negotiation Denial of Service</topic>
<affects>
<package>
<name>cups-base</name>
<range><lt>1.2.11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/24517/">
<p>CUPS is not using multiple workers to handle connections.
This can be exploited to stop CUPS from accepting new connections
by starting but never completing an SSL negotiation.</p>
</blockquote>
</body>
</description>
<references>
<url>http://secunia.com/advisories/24517/</url>
<url>http://security.gentoo.org/glsa/glsa-200703-28.xml</url>
<cvename>CVE-2007-0720</cvename>
</references>
<dates>
<discovery>2007-05-05</discovery>
<entry>2007-06-12</entry>
</dates>
</vuln>
<vuln vid="70ae62b0-16b0-11dc-b803-0016179b2dd5">
<topic>c-ares -- DNS Cache Poisoning Vulnerability</topic>
<affects>
<package>
<name>c-ares</name>
<range><lt>1.4.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/25579/">
<p>The vulnerability is caused due to predictable
DNS "Transaction ID" field in DNS queries and can
be exploited to poison the DNS cache of an application
using the library if a valid ID is guessed.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-3152</cvename>
<cvename>CVE-2007-3153</cvename>
<url>http://secunia.com/advisories/25579/</url>
<url>http://cool.haxx.se/cvs.cgi/curl/ares/CHANGES?rev=HEAD&content-type=text/vnd.viewcvs-markup</url>
</references>
<dates>
<discovery>2007-06-08</discovery>
<entry>2007-06-09</entry>
<modified>2010-05-12</modified>
</dates>
</vuln>
<vuln vid="0838733d-1698-11dc-a197-0011098b2f36">
<topic>wordpress -- XMLRPC SQL Injection</topic>
<affects>
<package>
<name>wordpress</name>
<name>de-wordpress</name>
<name>zh-wordpress</name>
<range><lt>2.2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/25552/">
<p>Slappter has discovered a vulnerability in WordPress, which can
be exploited by malicious users to conduct SQL injection
attacks.</p>
<p>Input passed to the "wp.suggestCategories" method in xmlrpc.php
is not properly sanitised before being used in SQL queries. This
can be exploited to manipulate SQL queries by injecting arbitrary
SQL code.</p>
<p>Successful exploitation allows e.g. retrieving usernames and
password hashes, but requires valid user credentials and knowledge
of the database table prefix.</p>
</blockquote>
</body>
</description>
<references>
<bid>24344</bid>
<url>http://secunia.com/advisories/25552/</url>
</references>
<dates>
<discovery>2007-06-06</discovery>
<entry>2007-06-09</entry>
<modified>2007-06-24</modified>
</dates>
</vuln>
<vuln vid="6a31cbe3-1695-11dc-a197-0011098b2f36">
<topic>wordpress -- unmoderated comments disclosure</topic>
<affects>
<package>
<name>wordpress</name>
<name>de-wordpress</name>
<name>zh-wordpress</name>
<range><lt>2.2.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Blogsecurity reports:</p>
<blockquote cite="http://blogsecurity.net/news/news-310507/">
<p>An attacker can read comments on posts that have not been
moderated. This can be a real security risk if blog admins
are using unmoderated comments (comments that have not been
made public) to hide sensitive notes regarding posts, future
work, passwords etc. So please be careful if you are one of
these blog admins.</p>
</blockquote>
</body>
</description>
<references>
<url>http://blogsecurity.net/news/news-310507/</url>
</references>
<dates>
<discovery>2007-06-01</discovery>
<entry>2007-06-09</entry>
<modified>2007-08-16</modified>
</dates>
</vuln>
<vuln vid="12b7286f-16a2-11dc-b803-0016179b2dd5">
<topic>webmin -- cross site scripting vulnerability</topic>
<affects>
<package>
<name>webmin</name>
<range><lt>1.350</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/25580/">
<p>Input passed to unspecified parameters in pam_login.cgi
is not properly sanitised before being returned to the
user. This can be exploited to execute arbitrary HTML and
script code in a user's browser session in context of an
affected site.</p>
</blockquote>
</body>
</description>
<references>
<bid>24381</bid>
<cvename>CVE-2007-3156</cvename>
<url>http://secunia.com/advisories/25580/</url>
<url>http://www.webmin.com/changes-1.350.html</url>
</references>
<dates>
<discovery>2007-06-01</discovery>
<entry>2007-06-09</entry>
<modified>2010-05-12</modified>
</dates>
</vuln>
<vuln vid="3ac80dd2-14df-11dc-bcfc-0016179b2dd5">
<topic>mplayer -- cddb stack overflow</topic>
<affects>
<package>
<name>mplayer</name>
<name>mplayer-esound</name>
<name>mplayer-gtk</name>
<name>mplayer-gtk2</name>
<name>mplayer-gtk-esound</name>
<name>mplayer-gtk2-esound</name>
<range><lt>0.99.10_10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mplayer Team reports:</p>
<blockquote cite="http://www.mplayerhq.hu/design7/news.html">
<p>A stack overflow was found in the code used to handle
cddb queries. When copying the album title and category,
no checking was performed on the size of the strings
before storing them in a fixed-size array. A malicious
entry in the database could trigger a stack overflow in
the program, leading to arbitrary code execution with the
uid of the user running MPlayer.</p>
</blockquote>
</body>
</description>
<references>
<bid>24302</bid>
<cvename>CVE-2007-2948</cvename>
</references>
<dates>
<discovery>2007-06-06</discovery>
<entry>2007-06-07</entry>
</dates>
</vuln>
<vuln vid="d9405748-1342-11dc-a35c-001485ab073e">
<topic>mod_jk -- information disclosure</topic>
<affects>
<package>
<name>mod_jk</name>
<range><lt>1.2.23,1</lt></range>
</package>
<package>
<name>mod_jk-ap2</name>
<range><lt>1.2.23</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Kazu Nambo reports:</p>
<blockquote cite="http://tomcat.apache.org/security-jk.html">
<p>URL decoding the the Apache webserver prior to
decoding in the Tomcat server could pypass access
control rules and give access to pages on a different
AJP by sending a crafted URL.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-1860</cvename>
<url>http://secunia.com/advisories/25383/</url>
<url>http://tomcat.apache.org/connectors-doc/news/20070301.html#20070518.1</url>
<url>http://tomcat.apache.org/security-jk.html</url>
</references>
<dates>
<discovery>2007-05-18</discovery>
<entry>2007-06-05</entry>
<modified>2007-10-31</modified>
</dates>
</vuln>
<vuln vid="62b8f253-12d9-11dc-a35c-001485ab073e">
<topic>typo3 -- email header injection</topic>
<affects>
<package>
<name>typo3</name>
<range><gt>3.0</gt><lt>4.0.5</lt></range>
<range><gt>4.1</gt><lt>4.1.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Olivier Dobberkau, Andreas Otto, and Thorsten Kahler report:</p>
<blockquote cite="http://typo3.org/teams/security/security-bulletins/typo3-20070221-1/">
<p>An unspecified error in the internal form engine can be used for
sending arbitrary mail headers, using it for purposes which it
is not meant for, e.g. sending spam messages.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-1081</cvename>
<url>http://secunia.com/advisories/24207/</url>
<url>http://typo3.org/teams/security/security-bulletins/typo3-20070221-1/</url>
</references>
<dates>
<discovery>2007-02-21</discovery>
<entry>2007-06-04</entry>
</dates>
</vuln>
<vuln vid="3d0e724e-129b-11dc-9f79-0016179b2dd5">
<topic>phppgadmin -- cross site scripting vulnerability</topic>
<affects>
<package>
<name>phppgadmin</name>
<range><lt>4.1.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SecurityFocus reports about phppgadmin:</p>
<blockquote cite="http://www.securityfocus.com/bid/24115/info">
<p>Exploiting this vulnerability may allow an attacker to perform
cross-site scripting attacks on unsuspecting users in the context
of the affected website. As a result, the attacker may be able to
steal cookie-based authentication credentials and to launch other
attacks.</p>
</blockquote>
</body>
</description>
<references>
<bid>24115</bid>
<cvename>CVE-2007-5728</cvename>
<url>http://lists.grok.org.uk/pipermail/full-disclosure/2007-May/063617.html</url>
<url>http://secunia.com/advisories/25446/</url>
</references>
<dates>
<discovery>2007-05-27</discovery>
<entry>2007-06-04</entry>
<modified>2010-05-12</modified>
</dates>
</vuln>
<vuln vid="7ca2a709-103b-11dc-8e82-00001cd613f9">
<topic>findutils -- GNU locate heap buffer overrun</topic>
<affects>
<package>
<name>findutils</name>
<range><lt>4.2.31</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>James Youngman reports:</p>
<blockquote cite="http://lists.gnu.org/archive/html/bug-findutils/2007-06/msg00000.html">
<p>When GNU locate reads filenames from an old-format locate database,
they are read into a fixed-length buffer allocated on the heap.
Filenames longer than the 1026-byte buffer can cause a buffer
overrun. The overrunning data can be chosen by any person able to
control the names of filenames created on the local system. This
will normally include all local users, but in many cases also remote
users (for example in the case of FTP servers allowing uploads).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-2452</cvename>
<mlist>http://lists.gnu.org/archive/html/bug-findutils/2007-06/msg00000.html</mlist>
</references>
<dates>
<discovery>2007-05-30</discovery>
<entry>2007-06-01</entry>
</dates>
</vuln>
<vuln vid="de2fab2d-0a37-11dc-aae2-00304881ac9a">
<topic>FreeType 2 -- Heap overflow vulnerability</topic>
<affects>
<package>
<name>freetype2</name>
<range><lt>2.2.1_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<blockquote cite="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-2754">
<p>Integer signedness error in truetype/ttgload.c in Freetype 2.3.4 and
earlier might allow remote attackers to execute arbitrary code via a
crafted TTF image with a negative n_points value, which leads to an
integer overflow and heap-based buffer overflow.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-2754</cvename>
<mlist>http://lists.gnu.org/archive/html/freetype-devel/2007-04/msg00041.html</mlist>
<url>http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-2754</url>
<url>https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=240200</url>
<freebsdpr>ports/112769</freebsdpr>
</references>
<dates>
<discovery>2007-04-27</discovery>
<entry>2007-05-24</entry>
</dates>
</vuln>
<vuln vid="8e01ab5b-0949-11dc-8163-000e0c2e438a">
<topic>FreeBSD -- heap overflow in file(1)</topic>
<affects>
<package>
<name>file</name>
<range><lt>4.21</lt></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>6.2</ge><lt>6.2_5</lt></range>
<range><ge>6.1</ge><lt>6.1_17</lt></range>
<range><ge>5.5</ge><lt>5.5_13</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>When writing data into a buffer in the file_printf function,
the length of the unused portion of the buffer is not
correctly tracked, resulting in a buffer overflow when
processing certain files.</p>
<h1>Impact:</h1>
<p>An attacker who can cause file(1) to be run on a maliciously
constructed input can cause file(1) to crash. It may be
possible for such an attacker to execute arbitrary code with
the privileges of the user running file(1).</p>
<p>The above also applies to any other applications using the
libmagic(3) library.</p>
<h1>Workaround:</h1>
<p>No workaround is available, but systems where file(1) and
other libmagic(3)-using applications are never run on
untrusted input are not vulnerable.</p>
</body>
</description>
<references>
<cvename>CVE-2007-1536</cvename>
<freebsdsa>SA-07:04.file</freebsdsa>
</references>
<dates>
<discovery>2007-05-23</discovery>
<entry>2007-05-23</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="0e575ed3-0764-11dc-a80b-0016179b2dd5">
<topic>squirrelmail -- Cross site scripting in HTML filter</topic>
<affects>
<package>
<name>squirrelmail</name>
<range><ge>1.4.0</ge><lt>1.4.9a</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The SquirrelMail developers report:</p>
<blockquote cite="http://www.squirrelmail.org/security/issue/2007-05-09">
<p>Multiple cross-site scripting (XSS) vulnerabilities in the HTML
filter in SquirrelMail 1.4.0 through 1.4.9a allow remote attackers
to inject arbitrary web script or HTML via the (1) data: URI in an
HTML e-mail attachment or (2) various non-ASCII character sets that
are not properly filtered when viewed with Microsoft Internet
Explorer.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-1262</cvename>
<url>http://www.squirrelmail.org/security/issue/2007-05-09</url>
</references>
<dates>
<discovery>2007-05-09</discovery>
<entry>2007-05-21</entry>
</dates>
</vuln>
<vuln vid="4cb9c513-03ef-11dc-a51d-0019b95d4f14">
<topic>png -- DoS crash vulnerability</topic>
<affects>
<package>
<name>png</name>
<range><lt>1.2.17</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A Libpng Security Advisory reports:</p>
<blockquote cite="http://www.mirrorservice.org/sites/download.sourceforge.net/pub/sourceforge/l/li/libpng/libpng-1.2.17-ADVISORY.txt">
<p>A grayscale PNG image with a malformed (bad CRC) tRNS
chunk will crash some libpng applications.</p>
<p>This vulnerability could be used to crash a browser when
a user tries to view such a malformed PNG file. It is not
known whether the vulnerability could be exploited
otherwise.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-2445</cvename>
<certvu>684664</certvu>
<url>http://www.mirrorservice.org/sites/download.sourceforge.net/pub/sourceforge/l/li/libpng/libpng-1.2.17-ADVISORY.txt</url>
</references>
<dates>
<discovery>2007-05-15</discovery>
<entry>2007-05-16</entry>
</dates>
</vuln>
<vuln vid="3546a833-03ea-11dc-a51d-0019b95d4f14">
<topic>samba -- multiple vulnerabilities</topic>
<affects>
<package>
<name>samba</name>
<name>ja-samba</name>
<range><gt>3.*</gt><lt>3.0.25</lt></range>
<range><gt>3.*,1</gt><lt>3.0.25,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Samba Team reports:</p>
<blockquote cite="http://de5.samba.org/samba/security/CVE-2007-2444.html">
<p>A bug in the local SID/Name translation routines may
potentially result in a user being able to issue SMB/CIFS
protocol operations as root.</p>
<p>When translating SIDs to/from names using Samba local
list of user and group accounts, a logic error in the smbd
daemon's internal security stack may result in a
transition to the root user id rather than the non-root
user. The user is then able to temporarily issue SMB/CIFS
protocol operations as the root user. This window of
opportunity may allow the attacker to establish additional
means of gaining root access to the server.</p>
</blockquote>
<blockquote cite="http://de5.samba.org/samba/security/CVE-2007-2446.html">
<p>Various bugs in Samba's NDR parsing can allow a user to
send specially crafted MS-RPC requests that will overwrite
the heap space with user defined data.</p>
</blockquote>
<blockquote cite="http://de5.samba.org/samba/security/CVE-2007-2447.html">
<p>Unescaped user input parameters are passed as arguments
to /bin/sh allowing for remote command execution.</p>
<p>This bug was originally reported against the anonymous
calls to the SamrChangePassword() MS-RPC function in
combination with the "username map script" smb.conf option
(which is not enabled by default).</p>
<p>After further investigation by Samba developers, it was
determined that the problem was much broader and impacts
remote printer and file share management as well. The
root cause is passing unfiltered user input provided via
MS-RPC calls to /bin/sh when invoking externals scripts
defined in smb.conf. However, unlike the "username map
script" vulnerability, the remote file and printer
management scripts require an authenticated user
session.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-2444</cvename>
<cvename>CVE-2007-2446</cvename>
<cvename>CVE-2007-2447</cvename>
<url>http://de5.samba.org/samba/security/CVE-2007-2444.html</url>
<url>http://de5.samba.org/samba/security/CVE-2007-2446.html</url>
<url>http://de5.samba.org/samba/security/CVE-2007-2447.html</url>
</references>
<dates>
<discovery>2007-05-14</discovery>
<entry>2007-05-16</entry>
<modified>2008-09-26</modified>
</dates>
</vuln>
<vuln vid="f5e52bf5-fc77-11db-8163-000e0c2e438a">
<topic>php -- multiple vulnerabilities</topic>
<affects>
<package>
<name>php5-imap</name>
<name>php5-odbc</name>
<name>php5-session</name>
<name>php5-shmop</name>
<name>php5-sqlite</name>
<name>php5-wddx</name>
<name>php5</name>
<range><lt>5.2.2</lt></range>
</package>
<package>
<name>php4-odbc</name>
<name>php4-session</name>
<name>php4-shmop</name>
<name>php4-wddx</name>
<name>php4</name>
<range><lt>4.4.7</lt></range>
</package>
<package>
<name>mod_php4-twig</name>
<name>mod_php4</name>
<name>mod_php5</name>
<name>mod_php</name>
<name>php4-cgi</name>
<name>php4-cli</name>
<name>php4-dtc</name>
<name>php4-horde</name>
<name>php4-nms</name>
<name>php5-cgi</name>
<name>php5-cli</name>
<name>php5-dtc</name>
<name>php5-horde</name>
<name>php5-nms</name>
<range><ge>4</ge><lt>4.4.7</lt></range>
<range><ge>5</ge><lt>5.2.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PHP development team reports:</p>
<blockquote cite="http://www.php.net/releases/5_2_2.php">
<p>Security Enhancements and Fixes in PHP 5.2.2 and PHP
4.4.7:</p>
<ul>
<li>Fixed CVE-2007-1001, GD wbmp used with invalid image
size</li>
<li>Fixed asciiz byte truncation inside mail()</li>
<li>Fixed a bug in mb_parse_str() that can be used to
activate register_globals</li>
<li>Fixed unallocated memory access/double free in in
array_user_key_compare()</li>
<li>Fixed a double free inside session_regenerate_id()</li>
<li>Added missing open_basedir & safe_mode checks to zip://
and bzip:// wrappers.</li>
<li>Limit nesting level of input variables with
max_input_nesting_level as fix for.</li>
<li>Fixed CRLF injection inside ftp_putcmd().</li>
<li>Fixed a possible super-global overwrite inside
import_request_variables().</li>
<li>Fixed a remotely trigger-able buffer overflow inside
bundled libxmlrpc library.</li>
</ul>
<p>Security Enhancements and Fixes in PHP 5.2.2 only:</p>
<ul>
<li>Fixed a header injection via Subject and To parameters
to the mail() function</li>
<li>Fixed wrong length calculation in unserialize S
type.</li>
<li>Fixed substr_compare and substr_count information
leak.</li>
<li>Fixed a remotely trigger-able buffer overflow inside
make_http_soap_request().</li>
<li>Fixed a buffer overflow inside
user_filter_factory_create().</li>
</ul>
<p>Security Enhancements and Fixes in PHP 4.4.7 only:</p>
<ul>
<li>XSS in phpinfo()</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-1001</cvename>
<url>http://www.php.net/releases/4_4_7.php</url>
<url>http://www.php.net/releases/5_2_2.php</url>
</references>
<dates>
<discovery>2007-05-03</discovery>
<entry>2007-05-07</entry>
<modified>2014-04-01</modified>
</dates>
</vuln>
<vuln vid="0ac89b39-f829-11db-b55c-000e0c6d38a9">
<topic>qemu -- several vulnerabilities</topic>
<affects>
<package>
<name>qemu</name>
<name>qemu-devel</name>
<range><lt>0.9.0_1</lt></range>
<range><ge>0.9.0s.20070101*</ge><lt>0.9.0s.20070405_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Debian Security Team reports:</p>
<blockquote cite="http://lists.debian.org/debian-security-announce/debian-security-announce-2007/msg00040.html">
<p>Several vulnerabilities have been discovered in the QEMU processor
emulator, which may lead to the execution of arbitrary code or
denial of service. The Common Vulnerabilities and Exposures project
identifies the following problems:</p>
<p>CVE-2007-1320<br/>Tavis Ormandy discovered that a memory management
routine of the Cirrus video driver performs insufficient bounds
checking, which might allow the execution of arbitrary code through
a heap overflow.</p>
<p>CVE-2007-1321<br/>Tavis Ormandy discovered that the NE2000 network
driver and the socket code perform insufficient input validation,
which might allow the execution of arbitrary code through a heap
overflow.</p>
<p>CVE-2007-1322<br/>Tavis Ormandy discovered that the "icebp"
instruction can be abused to terminate the emulation, resulting in
denial of service.</p>
<p>CVE-2007-1323<br/>Tavis Ormandy discovered that the NE2000 network
driver and the socket code perform insufficient input validation,
which might allow the execution of arbitrary code through a heap
overflow.</p>
<p>CVE-2007-1366<br/>Tavis Ormandy discovered that the "aam"
instruction can be abused to crash qemu through a division by zero,
resulting in denial of service.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-1320</cvename>
<cvename>CVE-2007-1321</cvename>
<cvename>CVE-2007-1322</cvename>
<cvename>CVE-2007-1323</cvename>
<cvename>CVE-2007-1366</cvename>
<mlist msgid="20070501100313.GA4074@galadriel.inutil.org">http://lists.debian.org/debian-security-announce/debian-security-announce-2007/msg00040.html</mlist>
</references>
<dates>
<discovery>2007-05-01</discovery>
<entry>2007-05-01</entry>
<modified>2007-05-02</modified>
</dates>
</vuln>
<vuln vid="632c98be-aad2-4af2-849f-41a6862afd6a">
<topic>p5-Imager -- possibly exploitable buffer overflow</topic>
<affects>
<package>
<name>p5-Imager</name>
<range><lt>0.57</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Imager 0.56 and all earlier versions with BMP support have
a security issue when reading compressed 8-bit per pixel BMP
files where either a compressed run of data or a literal run
of data overflows the scan-line.</p>
<p>Such an overflow causes a buffer overflow in a malloc()
allocated memory buffer, possibly corrupting the memory arena
headers.</p>
<p>The effect depends on your system memory allocator, with glibc
this typically results in an abort, but with other memory
allocators it may be possible to cause local code execution.</p>
</body>
</description>
<references>
<cvename>CVE-2007-1942</cvename>
<cvename>CVE-2007-1943</cvename>
<cvename>CVE-2007-1946</cvename>
<cvename>CVE-2007-1948</cvename>
<url>https://rt.cpan.org/Public/Bug/Display.html?id=26811</url>
<url>http://ifsec.blogspot.com/2007/04/several-windows-image-viewers.html</url>
</references>
<dates>
<discovery>2007-04-04</discovery>
<entry>2007-04-30</entry>
<modified>2010-05-12</modified>
</dates>
</vuln>
<vuln vid="275b845e-f56c-11db-8163-000e0c2e438a">
<topic>FreeBSD -- IPv6 Routing Header 0 is dangerous</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>6.2</ge><lt>6.2_4</lt></range>
<range><ge>6.1</ge><lt>6.1_16</lt></range>
<range><ge>5.5</ge><lt>5.5_12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description</h1>
<p>There is no mechanism for preventing IPv6 routing headers
from being used to route packets over the same link(s) many
times.</p>
<h1>Impact</h1>
<p>An attacker can "amplify" a denial of service attack against
a link between two vulnerable hosts; that is, by sending a
small volume of traffic the attacker can consume a much larger
amount of bandwidth between the two vulnerable hosts.</p>
<p>An attacker can use vulnerable hosts to "concentrate" a
denial of service attack against a victim host or network;
that is, a set of packets sent over a period of 30 seconds
or more could be constructed such that they all arrive at
the victim within a period of 1 second or less over a
period of 30 seconds or more could be constructed such that
they all arrive at the victim within a period of 1 second or
less.</p>
<p>Other attacks may also be possible.</p>
<h1>Workaround</h1>
<p>No workaround is available.</p>
</body>
</description>
<references>
<cvename>CVE-2007-2242</cvename>
<freebsdsa>SA-07:03.ipv6</freebsdsa>
</references>
<dates>
<discovery>2007-04-26</discovery>
<entry>2007-04-28</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="ef2ffb03-f2b0-11db-ad25-0010b5a0a860">
<topic>mod_perl -- remote DoS in PATH_INFO parsing</topic>
<affects>
<package>
<name>mod_perl</name>
<range><lt>1.30</lt></range>
</package>
<package>
<name>mod_perl2</name>
<range><lt>2.0.3_2,3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mandriva reports:</p>
<blockquote cite="http://www.mandriva.com/security/advisories?name=MDKSA-2007:083">
<p>PerlRun.pm in Apache mod_perl 1.29 and earlier, and
RegistryCooker.pm in mod_perl 2.x, does not properly escape
PATH_INFO before use in a regular expression, which allows remote
attackers to cause a denial of service (resource consumption) via a
crafted URI.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-1349</cvename>
<url>http://www.mandriva.com/security/advisories?name=MDKSA-2007:083</url>
<url>http://secunia.com/advisories/24839</url>
</references>
<dates>
<discovery>2007-03-29</discovery>
<entry>2007-04-24</entry>
<modified>2007-06-27</modified>
</dates>
</vuln>
<vuln vid="c389d06d-ee57-11db-bd51-0016179b2dd5">
<topic>claws-mail -- APOP vulnerability</topic>
<affects>
<package>
<name>claws-mail</name>
<range><lt>2.9.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>CVE reports:</p>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1558">
<p>The APOP protocol allows remote attackers to guess the first 3
characters of a password via man-in-the-middle (MITM) attacks
that use crafted message IDs and MD5 collisions.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-1558</cvename>
<url>http://www.claws-mail.org/news.php</url>
</references>
<dates>
<discovery>2007-04-02</discovery>
<entry>2007-04-19</entry>
</dates>
</vuln>
<vuln vid="5678da43-ea99-11db-a802-000fea2763ce">
<topic>lighttpd -- DOS when access files with mtime 0</topic>
<affects>
<package>
<name>lighttpd</name>
<range><lt>1.4.15</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Lighttpd SA:</p>
<blockquote cite="http://www.lighttpd.net/assets/2007/4/13/lighttpd_sa2007_02.txt">
<p>Lighttpd caches the rendered string for mtime. The cache key has
as a default value 0. At that point the pointer to the string are
still NULL. If a file with an mtime of 0 is requested it tries to
access the pointer and crashes.</p>
<p>The bug requires that a malicious user can either upload files or
manipulate the mtime of the files.</p>
<p>The bug was reported by cubiq and fixed by Marcus Rueckert.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-1870</cvename>
<url>http://www.lighttpd.net/assets/2007/4/13/lighttpd_sa2007_02.txt</url>
</references>
<dates>
<discovery>2007-01-14</discovery>
<entry>2007-04-14</entry>
</dates>
</vuln>
<vuln vid="d2b48d30-ea97-11db-a802-000fea2763ce">
<topic>lighttpd -- Remote DOS in CRLF parsing</topic>
<affects>
<package>
<name>lighttpd</name>
<range><gt>1.4.11</gt><lt>1.4.13_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Lighttpd SA:</p>
<blockquote cite="http://www.lighttpd.net/assets/2007/4/13/lighttpd_sa2007_01.txt">
<p>If the connection aborts during parsing "\r\n\r\n" the server
might get into a infinite loop and use 100% of the CPU time.
lighttpd still responses to other requests. This can be repeated
until either the server limit for concurrent connections or file
descriptors is reached.</p>
<p>The bug was reported and fixed by Robert Jakabosky.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-1869</cvename>
<url>http://www.lighttpd.net/assets/2007/4/13/lighttpd_sa2007_01.txt</url>
</references>
<dates>
<discovery>2006-12-15</discovery>
<entry>2007-04-14</entry>
</dates>
</vuln>
<vuln vid="c110eda2-e995-11db-a944-0012f06707f0">
<topic>freeradius -- EAP-TTLS Tunnel Memory Leak Remote DOS Vulnerability</topic>
<affects>
<package>
<name>freeradius</name>
<name>freeradius-mysql</name>
<range><le>1.1.5</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The freeradius development team reports:</p>
<blockquote cite="http://www.freeradius.org/security.html">
<p>A malicious 802.1x supplicant could send malformed Diameter format
attributes inside of an EAP-TTLS tunnel. The server would reject
the authentication request, but would leak one VALUE_PAIR data
structure, of approximately 300 bytes. If an attacker performed
the attack many times (e.g. thousands or more over a period of
minutes to hours), the server could leak megabytes of memory,
potentially leading to an "out of memory" condition, and early
process exit.</p>
</blockquote>
</body>
</description>
<references>
<bid>23466</bid>
<cvename>CVE-2005-1455</cvename>
<cvename>CVE-2005-1454</cvename>
<cvename>CVE-2007-2028</cvename>
<cvename>CVE-2005-4745</cvename>
<url>http://www.freeradius.org/security.html</url>
</references>
<dates>
<discovery>2007-04-10</discovery>
<entry>2007-04-13</entry>
<modified>2010-05-12</modified>
</dates>
</vuln>
<vuln vid="f1c4d133-e6d3-11db-99ea-0060084a00e5">
<topic>fetchmail -- insecure APOP authentication</topic>
<affects>
<package>
<name>fetchmail</name>
<range><lt>6.3.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Matthias Andree reports:</p>
<blockquote cite="http://www.fetchmail.info/fetchmail-SA-2007-01.txt">
<p>The POP3 standard, currently RFC-1939, has specified an optional,
MD5-based authentication scheme called "APOP" which no longer
should be considered secure.</p>
<p>Additionally, fetchmail's POP3 client implementation has been
validating the APOP challenge too lightly and accepted random
garbage as a POP3 server's APOP challenge. This made it easier
than necessary for man-in-the-middle attackers to retrieve by
several probing and guessing the first three characters of the
APOP secret, bringing brute forcing the remaining characters well
within reach.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-1558</cvename>
<url>http://www.fetchmail.info/fetchmail-SA-2007-01.txt</url>
</references>
<dates>
<discovery>2007-04-06</discovery>
<entry>2007-04-09</entry>
</dates>
</vuln>
<vuln vid="84d3fbb2-e607-11db-8a32-000c76189c4c">
<topic>mcweject -- exploitable buffer overflow</topic>
<affects>
<package>
<name>mcweject</name>
<range><le>0.9</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>CVE reports:</p>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1719">
<p>Buffer overflow in eject.c in Jason W. Bacon mcweject 0.9 on
FreeBSD, and possibly other versions, allows local users to execute
arbitrary code via a long command line argument, possibly involving
the device name.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-1719</cvename>
<freebsdpr>ports/111365</freebsdpr>
<url>http://www.milw0rm.com/exploits/3578</url>
</references>
<dates>
<discovery>2007-03-27</discovery>
<entry>2007-04-08</entry>
</dates>
</vuln>
<vuln vid="72999d57-d6f6-11db-961b-005056847b26">
<topic>WebCalendar -- "noSet" variable overwrite vulnerability</topic>
<affects>
<package>
<name>WebCalendar</name>
<range><lt>1.0.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/24403/">
<p>A vulnerability has been discovered in WebCalendar,
which can be exploited by malicious people to compromise
a vulnerable system.</p>
<p>Input passed to unspecified parameters is not properly
verified before being used with the "noSet" parameter set.
This can be exploited to overwrite certain variables, and
allows e.g. the inclusion of arbitrary PHP files from internal
or external resources.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-1343</cvename>
<bid>22834</bid>
<url>http://sourceforge.net/project/shownotes.php?release_id=491130</url>
<url>http://xforce.iss.net/xforce/xfdb/32832</url>
</references>
<dates>
<discovery>2007-03-04</discovery>
<entry>2007-04-08</entry>
</dates>
</vuln>
<vuln vid="34414a1e-e377-11db-b8ab-000c76189c4c">
<topic>zope -- cross-site scripting vulnerability</topic>
<affects>
<package>
<name>zope</name>
<range><lt>2.7.9_2</lt></range>
<range><ge>2.8.0</ge><le>2.8.8</le></range>
<range><ge>2.9.0</ge><le>2.9.6</le></range>
<range><ge>2.10.0</ge><le>2.10.2</le></range>
</package>
<package>
<name>plone</name>
<range><lt>2.5.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Zope Team reports:</p>
<blockquote cite="http://www.zope.org/Products/Zope/Hotfix-2007-03-20/announcement/view">
<p>A vulnerability has been discovered in Zope, where by certain types
of misuse of HTTP GET, an attacker could gain elevated privileges.
All Zope versions up to and including 2.10.2 are affected.</p>
</blockquote>
</body>
</description>
<references>
<bid>23084</bid>
<cvename>CVE-2007-0240</cvename>
<freebsdpr>ports/111119</freebsdpr>
<url>http://www.zope.org/Products/Zope/Hotfix-2007-03-20/announcement/view</url>
<url>http://plone.org/products/plone/releases/2.5.3</url>
</references>
<dates>
<discovery>2007-01-16</discovery>
<entry>2007-04-05</entry>
<modified>2009-03-22</modified>
</dates>
</vuln>
<vuln vid="c27bc173-d7aa-11db-b141-0016179b2dd5">
<topic>Squid -- TRACE method handling denial of service</topic>
<affects>
<package>
<name>squid</name>
<range><ge>2.6.*</ge><lt>2.6.12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Squid advisory 2007:1 notes:</p>
<blockquote cite="http://www.squid-cache.org/Advisories/SQUID-2007_1.txt">
<p>Due to an internal error Squid-2.6 is vulnerable to a denial of
service attack when processing the TRACE request method.</p>
<p>Workarounds:</p>
<p>To work around the problem deny access to using the TRACE method by
inserting the following two lines before your first http_access
rule.</p>
<p>acl TRACE method TRACE</p>
<p>http_access deny TRACE</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-1560</cvename>
<url>http://www.squid-cache.org/Advisories/SQUID-2007_1.txt</url>
</references>
<dates>
<discovery>2007-03-20</discovery>
<entry>2007-03-21</entry>
<modified>2010-05-12</modified>
</dates>
</vuln>
<vuln vid="8e02441d-d39c-11db-a6da-0003476f14d3">
<topic>sql-ledger -- security bypass vulnerability</topic>
<affects>
<package>
<name>sql-ledger</name>
<range><lt>2.6.26</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chris Travers reports:</p>
<blockquote cite="http://www.securityfocus.com/archive/1/462375">
<p>George Theall of Tenable Security notified the LedgerSMB
core team today of an authentication bypass vulnerability
allowing full access to the administrator interface of
LedgerSMB 1.1 and SQL-Ledger 2.x. The problem is caused
by the password checking routine failing to enforce a
password check under certain circumstances. The user
can then create accounts or effect denial of service
attacks.</p>
<p>This is not related to any previous CVE.</p>
<p>We have coordinated with the SQL-Ledger vendor and
today both of us released security patches correcting
the problem. SQL-Ledger users who can upgrade to 2.6.26
should do so, and LedgerSMB 1.1 or 1.0 users should
upgrade to 1.1.9. Users who cannot upgrade should
configure their web servers to use http authentication
for the admin.pl script in the main root directory.</p>
</blockquote>
</body>
</description>
<references>
<freebsdpr>ports/110350</freebsdpr>
<url>http://www.securityfocus.com/archive/1/462375</url>
</references>
<dates>
<discovery>2007-03-09</discovery>
<entry>2007-03-16</entry>
</dates>
</vuln>
<vuln vid="f235fe7a-b9ca-11db-bf0f-0013720b182d">
<topic>samba -- potential Denial of Service bug in smbd</topic>
<affects>
<package>
<name>samba</name>
<name>ja-samba</name>
<range><ge>3.0.6,1</ge><lt>3.0.24,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Samba Team reports:</p>
<blockquote cite="http://www.samba.org/samba/security/CVE-2007-0452.html">
<p>Internally Samba's file server daemon, smbd, implements
support for deferred file open calls in an attempt to serve
client requests that would otherwise fail due to a share mode
violation. When renaming a file under certain circumstances
it is possible that the request is never removed from the deferred
open queue. smbd will then become stuck is a loop trying to
service the open request.</p>
<p>This bug may allow an authenticated user to exhaust resources
such as memory and CPU on the server by opening multiple CIFS
sessions, each of which will normally spawn a new smbd process,
and sending each connection into an infinite loop.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-0452</cvename>
<url>http://www.samba.org/samba/security/CVE-2007-0452.html</url>
</references>
<dates>
<discovery>2007-02-05</discovery>
<entry>2007-03-16</entry>
</dates>
</vuln>
<vuln vid="57ae52f7-b9cc-11db-bf0f-0013720b182d">
<topic>samba -- format string bug in afsacl.so VFS plugin</topic>
<affects>
<package>
<name>samba</name>
<name>ja-samba</name>
<range><ge>3.0.6,1</ge><lt>3.0.24,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Samba Team reports:</p>
<blockquote cite="http://www.samba.org/samba/security/CVE-2007-0454.html">
<p>NOTE: This security advisory only impacts Samba servers
that share AFS file systems to CIFS clients and which have
been explicitly instructed in smb.conf to load the afsacl.so
VFS module.</p>
<p>The source defect results in the name of a file stored on
disk being used as the format string in a call to snprintf().
This bug becomes exploitable only when a user is able
to write to a share which utilizes Samba's afsacl.so library
for setting Windows NT access control lists on files residing
on an AFS file system.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-0454</cvename>
<url>http://www.samba.org/samba/security/CVE-2007-0454.html</url>
</references>
<dates>
<discovery>2007-02-05</discovery>
<entry>2007-03-16</entry>
</dates>
</vuln>
<vuln vid="73f53712-d028-11db-8c07-0211d85f11fb">
<topic>ktorrent -- multiple vulnerabilities</topic>
<affects>
<package>
<name>ktorrent</name>
<range><lt>2.1.2</lt></range>
</package>
<package>
<name>ktorrent-devel</name>
<range><lt>20070311</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Two problems have been found in KTorrent:</p>
<ul>
<li>KTorrent does not properly sanitize file names to filter
out ".." components, so it's possible for an attacker to create
a malicious torrent in order to overwrite arbitrary files within
the filesystem.</li>
<li>Messages with invalid chunk indexes aren't rejected.</li>
</ul>
</body>
</description>
<references>
<cvename>CVE-2007-1384</cvename>
<cvename>CVE-2007-1385</cvename>
<url>http://ktorrent.org/forum/viewtopic.php?t=1401</url>
</references>
<dates>
<discovery>2007-03-09</discovery>
<entry>2007-03-11</entry>
<modified>2007-03-14</modified>
</dates>
</vuln>
<vuln vid="abeb9b64-ce50-11db-bc24-0016179b2dd5">
<topic>mplayer -- DMO File Parsing Buffer Overflow Vulnerability</topic>
<affects>
<package>
<name>mplayer</name>
<name>mplayer-esound</name>
<name>mplayer-gtk</name>
<name>mplayer-gtk2</name>
<name>mplayer-gtk-esound</name>
<name>mplayer-gtk2-esound</name>
<range><lt>0.99.10_5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>"Moritz Jodeit reports:</p>
<blockquote cite="http://lists.grok.org.uk/pipermail/full-disclosure/2007-March/052738.html">
<p>There's an exploitable buffer overflow in the current version
of MPlayer (v1.0rc1) which can be exploited with a maliciously
crafted video file. It is hidden in the DMO_VideoDecoder()
function of `loader/dmo/DMO_VideoDecoder.c' file.</p>
</blockquote>
</body>
</description>
<references>
<bid>22771</bid>
<cvename>CVE-2007-1246</cvename>
</references>
<dates>
<discovery>2007-02-11</discovery>
<entry>2007-03-09</entry>
</dates>
</vuln>
<vuln vid="e546c7ce-ce46-11db-bc24-0016179b2dd5">
<topic>trac -- cross site scripting vulnerability</topic>
<affects>
<package>
<name>trac</name>
<range><lt>0.10.3</lt></range>
</package>
<package>
<name>ja-trac</name>
<range><lt>0.10.3_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/24470/">
<p>The vulnerability is caused due to an error within the
"download wiki page as text" function, which can be exploited
to execute arbitrary HTML and script code in a user's browser
session in context of an affected site.</p>
<p>Successful exploitation may require that the victim uses IE.</p>
</blockquote>
</body>
</description>
<references>
<url>http://secunia.com/advisories/24470</url>
<url>http://trac.edgewall.org/wiki/ChangeLog#a0.10.3.1</url>
</references>
<dates>
<discovery>2007-03-09</discovery>
<entry>2007-03-09</entry>
</dates>
</vuln>
<vuln vid="cf86c644-cb6c-11db-8e9d-000c6ec775d9">
<topic>mod_jk -- long URL stack overflow vulnerability</topic>
<affects>
<package>
<name>mod_jk-ap2</name>
<name>mod_jk</name>
<range><ge>1.2.19</ge><lt>1.2.21</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>TippingPoint and The Zero Day Initiative reports:</p>
<blockquote cite="http://www.zerodayinitiative.com/advisories/ZDI-07-008.html">
<p>This vulnerability allows remote attackers to execute
arbitrary code on vulnerable installations of Apache
Tomcat JK Web Server Connector. Authentication is not
required to exploit this vulnerability.</p>
<p>The specific flaw exists in the URI handler for the
mod_jk.so library, map_uri_to_worker(), defined in
native/common/jk_uri_worker_map.c. When parsing a long URL
request, the URI worker map routine performs an unsafe
memory copy. This results in a stack overflow condition
which can be leveraged to execute arbitrary code.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-0774</cvename>
<url>http://tomcat.apache.org/security-jk.html</url>
<url>http://www.zerodayinitiative.com/advisories/ZDI-07-008.html</url>
</references>
<dates>
<discovery>2007-03-02</discovery>
<entry>2007-03-05</entry>
<modified>2007-03-06</modified>
</dates>
</vuln>
<vuln vid="3cb6f059-c69d-11db-9f82-000e0c2e438a">
<topic>bind -- Multiple Denial of Service vulnerabilities</topic>
<affects>
<package>
<name>named</name>
<range><lt>9.3.4</lt></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>6.2</ge><lt>6.2_1</lt></range>
<range><ge>6.1</ge><lt>6.1_13</lt></range>
<range><ge>5.5</ge><lt>5.5_11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>A type * (ANY) query response containing multiple RRsets can
trigger an assertion failure.</p>
<p>Certain recursive queries can cause the nameserver to crash
by using memory which has already been freed.</p>
<h1>Impact:</h1>
<p>A remote attacker sending a type * (ANY) query to an
authoritative DNS server for a DNSSEC signed zone can cause
the named(8) daemon to exit, resulting in a Denial of
Service.</p>
<p>A remote attacker sending recursive queries can cause the
nameserver to crash, resulting in a Denial of Service.</p>
<h1>Workaround:</h1>
<p>There is no workaround available, but systems which are not
authoritative servers for DNSSEC signed zones are not
affected by the first issue; and systems which do not permit
untrusted users to perform recursive DNS resolution are not
affected by the second issue. Note that the default
configuration for named(8) in FreeBSD allows local access
only (which on many systems is equivalent to refusing access
to untrusted users).</p>
</body>
</description>
<references>
<cvename>CVE-2007-0493</cvename>
<cvename>CVE-2007-0494</cvename>
<freebsdsa>SA-07:02.bind</freebsdsa>
</references>
<dates>
<discovery>2007-02-09</discovery>
<entry>2007-02-27</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="46b922a8-c69c-11db-9f82-000e0c2e438a">
<topic>FreeBSD -- Jail rc.d script privilege escalation</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>6.1</ge><lt>6.1_12</lt></range>
<range><ge>6.0</ge><lt>6.0_17</lt></range>
<range><ge>5.5</ge><lt>5.5_15</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>In multiple situations the host's jail rc.d(8) script does
not check if a path inside the jail file system structure is
a symbolic link before using the path. In particular this is
the case when writing the output from the jail start-up to
/var/log/console.log and when mounting and unmounting file
systems inside the jail directory structure.</p>
<h1>Impact:</h1>
<p>Due to the lack of handling of potential symbolic links the
host's jail rc.d(8) script is vulnerable to "symlink
attacks". By replacing /var/log/console.log inside the jail
with a symbolic link it is possible for the superuser (root)
inside the jail to overwrite files on the host system outside
the jail with arbitrary content. This in turn can be used to
execute arbitrary commands with non-jailed superuser
privileges.</p>
<p>Similarly, by changing directory mount points inside the
jail file system structure into symbolic links, it may be
possible for a jailed attacker to mount file systems which
were meant to be mounted inside the jail at arbitrary points
in the host file system structure, or to unmount arbitrary
file systems on the host system.</p>
<p>NOTE WELL: The above vulnerabilities occur only when a jail
is being started or stopped using the host's jail rc.d(8)
script; once started (and until stopped), running jails
cannot exploit this.</p>
<h1>Workaround:</h1>
<p>If the sysctl(8) variable security.jail.chflags_allowed is
set to 0 (the default), setting the "sunlnk" system flag on
/var, /var/log, /var/log/console.log, and all file system
mount points and their parent directories inside the jail(s)
will ensure that the console log file and mount points are
not replaced by symbolic links. If this is done while jails
are running, the administrator must check that an attacker
has not replaced any directories with symlinks after setting
the "sunlnk" flag.</p>
</body>
</description>
<references>
<cvename>CVE-2007-0166</cvename>
<freebsdsa>SA-07:01.jail</freebsdsa>
</references>
<dates>
<discovery>2007-01-11</discovery>
<entry>2007-02-27</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="44449bf7-c69b-11db-9f82-000e0c2e438a">
<topic>gtar -- name mangling symlink vulnerability</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>5.5</ge><lt>5.5_9</lt></range>
<range><ge>4.11</ge><lt>4.11_26</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>Symlinks created using the "GNUTYPE_NAMES" tar extension can
be absolute due to lack of proper sanity checks.</p>
<h1>Impact:</h1>
<p>If an attacker can get a user to extract a specially crafted
tar archive the attacker can overwrite arbitrary files with
the permissions of the user running gtar. If file system
permissions allow it, this may allow the attacker to overwrite
important system file (if gtar is being run as root), or
important user configuration files such as .tcshrc or .bashrc,
which would allow the attacker to run arbitrary commands.</p>
<h1>Workaround:</h1>
<p>Use "bsdtar", which is the default tar implementation in
FreeBSD 5.3 and higher. For FreeBSD 4.x, bsdtar is available
in the FreeBSD Ports Collection as
ports/archivers/libarchive.</p>
</body>
</description>
<references>
<cvename>CVE-2006-6097</cvename>
<freebsdsa>SA-06:26.gtar</freebsdsa>
</references>
<dates>
<discovery>2006-12-06</discovery>
<entry>2007-02-27</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="5c554c0f-c69a-11db-9f82-000e0c2e438a">
<topic>FreeBSD -- Kernel memory disclosure in firewire(4)</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>6.1</ge><lt>6.1_11</lt></range>
<range><ge>6.0</ge><lt>6.2_16</lt></range>
<range><ge>5.5</ge><lt>5.5_9</lt></range>
<range><ge>4.11</ge><lt>4.11_26</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>In the FW_GCROM ioctl, a signed integer comparison is used
instead of an unsigned integer comparison when computing the
length of a buffer to be copied from the kernel into the
calling application.</p>
<h1>Impact:</h1>
<p>A user in the "operator" group can read the contents of
kernel memory. Such memory might contain sensitive
information, such as portions of the file cache or terminal
buffers. This information might be directly useful, or it
might be leveraged to obtain elevated privileges in some way;
for example, a terminal buffer might include a user-entered
password.</p>
<h1>Workaround:</h1>
<p>No workaround is available, but systems without IEEE 1394
("FireWire") interfaces are not vulnerable. (Note that
systems with IEEE 1394 interfaces are affected regardless of
whether any devices are attached.)</p>
<p>Note also that FreeBSD does not have any non-root users in
the "operator" group by default; systems on which no users
have been added to this group are therefore also not
vulnerable.</p>
</body>
</description>
<references>
<cvename>CVE-2006-6013</cvename>
<freebsdsa>SA-06:25.kmem</freebsdsa>
</references>
<dates>
<discovery>2006-12-06</discovery>
<entry>2007-02-27</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="792bc222-c5d7-11db-9f82-000e0c2e438a">
<topic>libarchive -- Infinite loop in corrupt archives handling in libarchive</topic>
<affects>
<package>
<name>libarchive</name>
<range><lt>1.3.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>If the end of an archive is reached while attempting to
"skip" past a region of an archive, libarchive will enter an
infinite loop wherein it repeatedly attempts (and fails) to
read further data.</p>
<h1>Impact:</h1>
<p>An attacker able to cause a system to extract (via "tar -x"
or another application which uses libarchive) or list the
contents (via "tar -t" or another libarchive-using
application) of an archive provided by the attacker can cause
libarchive to enter an infinite loop and use all available
CPU time.</p>
<h1>Workaround:</h1>
<p>No workaround is available.</p>
</body>
</description>
<references>
<cvename>CVE-2006-5680</cvename>
<freebsdsa>SA-06:24.libarchive</freebsdsa>
</references>
<dates>
<discovery>2006-11-08</discovery>
<entry>2007-02-26</entry>
</dates>
</vuln>
<vuln vid="0f37d765-c5d4-11db-9f82-000e0c2e438a">
<topic>OpenSSL -- Multiple problems in crypto(3)</topic>
<affects>
<package>
<name>openssl</name>
<range><lt>0.9.7l_0</lt></range>
<range><ge>0.9.8</ge><lt>0.9.8d_0</lt></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>6.1</ge><lt>6.1_9</lt></range>
<range><ge>6.0</ge><lt>6.0_14</lt></range>
<range><ge>5.5</ge><lt>5.5_7</lt></range>
<range><ge>5.4</ge><lt>5.4_21</lt></range>
<range><ge>5.3</ge><lt>5.3_36</lt></range>
<range><ge>4.11</ge><lt>4.11_24</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>Several problems have been found in OpenSSL:</p>
<ul>
<li>During the parsing of certain invalid ASN1 structures an
error condition is mishandled, possibly resulting in an
infinite loop.</li>
<li>A buffer overflow exists in the SSL_get_shared_ciphers
function.</li>
<li>A NULL pointer may be dereferenced in the SSL version 2
client code.</li>
</ul>
<p>In addition, many applications using OpenSSL do not perform
any validation of the lengths of public keys being used.</p>
<h1>Impact:</h1>
<p>Servers which parse ASN1 data from untrusted sources may be
vulnerable to a denial of service attack.</p>
<p>An attacker accessing a server which uses SSL version 2 may
be able to execute arbitrary code with the privileges of that
server.</p>
<p>A malicious SSL server can cause clients connecting using
SSL version 2 to crash.</p>
<p>Applications which perform public key operations using
untrusted keys may be vulnerable to a denial of service
attack.</p>
<h1>Workaround:</h1>
<p>No workaround is available, but not all of the
vulnerabilities mentioned affect all applications.</p>
</body>
</description>
<references>
<cvename>CVE-2006-2937</cvename>
<cvename>CVE-2006-2938</cvename>
<cvename>CVE-2006-2940</cvename>
<cvename>CVE-2006-3738</cvename>
<cvename>CVE-2006-4343</cvename>
<freebsdsa>SA-06:23.openssl</freebsdsa>
</references>
<dates>
<discovery>2006-09-28</discovery>
<entry>2007-02-26</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="12bd6ecf-c430-11db-95c5-000c6ec775d9">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>1.5.0.10,1</lt></range>
<range><gt>2.*,1</gt><lt>2.0.0.2,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>1.5.0.10</lt></range>
</package>
<package>
<name>lightning</name>
<range><lt>0.3.1</lt></range>
</package>
<package>
<name>seamonkey</name>
<name>linux-seamonkey</name>
<range><lt>1.0.8</lt></range>
<range><ge>1.1</ge><lt>1.1.1</lt></range>
</package>
<package>
<name>thunderbird</name>
<name>linux-thunderbird</name>
<name>mozilla-thunderbird</name>
<range><lt>1.5.0.10</lt></range>
</package>
<package>
<name>linux-firefox-devel</name>
<range><lt>3.0.a2007.04.18</lt></range>
</package>
<package>
<name>linux-seamonkey-devel</name>
<range><lt>1.5.a2007.04.18</lt></range>
</package>
<package>
<name>firefox-ja</name>
<name>linux-mozilla-devel</name>
<name>linux-mozilla</name>
<name>mozilla</name>
<range><gt>0</gt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Foundation reports of multiple security issues
in Firefox, Seamonkey, and Thunderbird. Several of these
issues can probably be used to run arbitrary code with the
privilege of the user running the program.</p>
<blockquote cite="http://www.mozilla.org/projects/security/known-vulnerabilities.html#firefox2.0.0.2">
<ul>
<li>MFSA 2007-08 onUnload + document.write() memory corruption</li>
<li>MFSA 2007-07 Embedded nulls in location.hostname confuse same-domain checks</li>
<li>MFSA 2007-06 Mozilla Network Security Services (NSS) SSLv2 buffer overflow</li>
<li>MFSA 2007-05 XSS and local file access by opening blocked popups</li>
<li>MFSA 2007-04 Spoofing using custom cursor and CSS3 hotspot</li>
<li>MFSA 2007-03 Information disclosure through cache collisions</li>
<li>MFSA 2007-02 Improvements to help protect against Cross-Site Scripting attacks</li>
<li>MFSA 2007-01 Crashes with evidence of memory corruption (rv:1.8.0.10/1.8.1.2)</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-6077</cvename>
<cvename>CVE-2007-0008</cvename>
<cvename>CVE-2007-0009</cvename>
<cvename>CVE-2007-0775</cvename>
<cvename>CVE-2007-0776</cvename>
<cvename>CVE-2007-0777</cvename>
<cvename>CVE-2007-0778</cvename>
<cvename>CVE-2007-0779</cvename>
<cvename>CVE-2007-0780</cvename>
<cvename>CVE-2007-0800</cvename>
<cvename>CVE-2007-0981</cvename>
<cvename>CVE-2007-0995</cvename>
<cvename>CVE-2007-1092</cvename>
<url>http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=482</url>
<url>http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=483</url>
<url>http://www.mozilla.org/security/announce/2007/mfsa2007-01.html</url>
<url>http://www.mozilla.org/security/announce/2007/mfsa2007-02.html</url>
<url>http://www.mozilla.org/security/announce/2007/mfsa2007-03.html</url>
<url>http://www.mozilla.org/security/announce/2007/mfsa2007-04.html</url>
<url>http://www.mozilla.org/security/announce/2007/mfsa2007-05.html</url>
<url>http://www.mozilla.org/security/announce/2007/mfsa2007-06.html</url>
<url>http://www.mozilla.org/security/announce/2007/mfsa2007-07.html</url>
<url>http://www.mozilla.org/security/announce/2007/mfsa2007-08.html</url>
</references>
<dates>
<discovery>2007-02-23</discovery>
<entry>2007-02-24</entry>
<modified>2007-04-19</modified>
</dates>
</vuln>
<vuln vid="afdf500f-c1f6-11db-95c5-000c6ec775d9">
<topic>snort -- DCE/RPC preprocessor vulnerability</topic>
<affects>
<package>
<name>snort</name>
<range><ge>2.6.1</ge><lt>2.6.1.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A IBM Internet Security Systems Protection Advisory
reports:</p>
<blockquote cite="http://iss.net/threats/257.html">
<p>Snort is vulnerable to a stack-based buffer overflow as a
result of DCE/RPC reassembly. This vulnerability is in a
dynamic-preprocessor enabled in the default configuration,
and the configuration for this preprocessor allows for
auto-recognition of SMB traffic to perform reassembly
on. No checks are performed to see if the traffic is part
of a valid TCP session, and multiple Write AndX requests
can be chained in the same TCP segment. As a result, an
attacker can exploit this overflow with a single TCP PDU
sent across a network monitored by Snort or Sourcefire.</p>
<p>Snort users who cannot upgrade immediately are advised to
disable the DCE/RPC preprocessor by removing the DCE/RPC
preprocessor directives from snort.conf and restarting
Snort. However, be advised that disabling the DCE/RPC
preprocessor reduces detection capabilities for attacks in
DCE/RPC traffic. After upgrading, customers should
re-enable the DCE/RPC preprocessor.</p>
</blockquote>
</body>
</description>
<references>
<certvu>196240</certvu>
<cvename>CVE-2006-5276</cvename>
<url>http://xforce.iss.net/xforce/xfdb/31275</url>
<url>http://www.snort.org/docs/advisory-2007-02-19.html</url>
</references>
<dates>
<discovery>2007-02-19</discovery>
<entry>2007-02-21</entry>
</dates>
</vuln>
<vuln vid="94234e00-be8a-11db-b2ec-000c6ec775d9">
<topic>rar -- password prompt buffer overflow vulnerability</topic>
<affects>
<package>
<name>rar</name>
<range><lt>3.70.b1,1</lt></range>
</package>
<package>
<name>unrar</name>
<name>zh-unrar</name>
<range><lt>3.70.b1,4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>iDefense reports:</p>
<blockquote cite="http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=472">
<p>Remote exploitation of a stack based buffer overflow
vulnerability in RARLabs Unrar may allow an attacker to
execute arbitrary code with the privileges of the user
opening the archive.</p>
<p>Unrar is prone to a stack based buffer overflow when
processing specially crafted password protected
archives.</p>
<p>If users are using the vulnerable command line based
unrar, they still need to interact with the program in
order to trigger the vulnerability. They must respond to
the prompt asking for the password, after which the
vulnerability will be triggered. They do not need to enter
a correct password, but they must at least push the enter
key.</p>
</blockquote>
</body>
</description>
<references>
<bid>22447</bid>
<cvename>CVE-2007-0855</cvename>
<url>http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=472</url>
<url>http://www.rarsoft.com/rarnew.htm</url>
</references>
<dates>
<discovery>2007-02-07</discovery>
<entry>2007-02-17</entry>
</dates>
</vuln>
<vuln vid="7fcf1727-be71-11db-b2ec-000c6ec775d9">
<topic>php -- multiple vulnerabilities</topic>
<affects>
<package>
<name>php5-imap</name>
<name>php5-odbc</name>
<name>php5-session</name>
<name>php5-shmop</name>
<name>php5-sqlite</name>
<name>php5-wddx</name>
<name>php5</name>
<range><lt>5.2.1_2</lt></range>
</package>
<package>
<name>php4-odbc</name>
<name>php4-session</name>
<name>php4-shmop</name>
<name>php4-wddx</name>
<name>php4</name>
<range><lt>4.4.5</lt></range>
</package>
<package>
<name>mod_php4-twig</name>
<name>mod_php4</name>
<name>mod_php5</name>
<name>mod_php</name>
<name>php4-cgi</name>
<name>php4-cli</name>
<name>php4-dtc</name>
<name>php4-horde</name>
<name>php4-nms</name>
<name>php5-cgi</name>
<name>php5-cli</name>
<name>php5-dtc</name>
<name>php5-horde</name>
<name>php5-nms</name>
<range><ge>4</ge><lt>4.4.5</lt></range>
<range><ge>5</ge><lt>5.2.1_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Multiple vulnerabilities have been found in PHP, including:
buffer overflows, stack overflows, format string, and
information disclosure vulnerabilities.</p>
<p>The session extension contained <code>safe_mode</code> and
<code>open_basedir</code> bypasses, but the FreeBSD Security
Officer does not consider these real security
vulnerabilities, since <code>safe_mode</code> and
<code>open_basedir</code> are insecure by design and should
not be relied upon.</p>
</body>
</description>
<references>
<cvename>CVE-2007-0905</cvename>
<cvename>CVE-2007-0906</cvename>
<cvename>CVE-2007-0907</cvename>
<cvename>CVE-2007-0908</cvename>
<cvename>CVE-2007-0909</cvename>
<cvename>CVE-2007-0910</cvename>
<cvename>CVE-2007-0988</cvename>
<url>http://secunia.com/advisories/24089/</url>
<url>http://www.php.net/releases/4_4_5.php</url>
<url>http://www.php.net/releases/5_2_1.php</url>
</references>
<dates>
<discovery>2007-02-09</discovery>
<entry>2007-02-17</entry>
<modified>2013-04-01</modified>
</dates>
</vuln>
<vuln vid="7bb127c1-a5aa-11db-9ddc-0011098b2f36">
<topic>joomla -- multiple remote vulnerabilities</topic>
<affects>
<package>
<name>joomla</name>
<range><lt>1.0.12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/23563/">
<p>Some vulnerabilities have been reported in Joomla!, where some
have unknown impacts and one can be exploited by malicious people
to conduct cross-site scripting attacks.</p>
<ol>
<li>Input passed to an unspecified parameter is not properly
sanitised before being returned to the user. This can be
exploited to execute arbitrary HTML and script code in a
user's browser session in context of an affected site.</li>
<li>The vulnerabilities are caused due to unspecified errors
in Joomla!. The vendor describes them as "several low level
security issues". No further information is currently
available.</li>
</ol>
</blockquote>
</body>
</description>
<references>
<bid>21810</bid>
<cvename>CVE-2006-6832</cvename>
<cvename>CVE-2006-6833</cvename>
<cvename>CVE-2006-6834</cvename>
<url>http://secunia.com/advisories/23563/</url>
</references>
<dates>
<discovery>2006-12-29</discovery>
<entry>2007-01-17</entry>
</dates>
</vuln>
<vuln vid="1374b96c-a1c2-11db-9ddc-0011098b2f36">
<topic>sircd -- remote reverse DNS buffer overflow</topic>
<affects>
<package>
<name>sircd</name>
<range><le>0.4.0</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/8153/">
<p>A vulnerability in sircd can be exploited by a malicious person
to compromise a vulnerable system. The vulnerability is caused
by a boundary error in the code handling reverse DNS lookups,
when a user connects to the service. If the FQDN (Fully Qualified
Domain Name) returned is excessively long, the allocated buffer
is overflowed making it possible to execute arbitrary code on the
system with the privileges of the sircd daemon.</p>
</blockquote>
</body>
</description>
<references>
<bid>6924</bid>
<url>http://secunia.com/advisories/8153</url>
</references>
<dates>
<discovery>2003-02-24</discovery>
<entry>2007-01-15</entry>
</dates>
</vuln>
<vuln vid="e92d8f6b-a1c0-11db-9ddc-0011098b2f36">
<topic>sircd -- remote operator privilege escalation vulnerability</topic>
<affects>
<package>
<name>sircd</name>
<range><ge>0</ge></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/10274/">
<p>A vulnerability has been reported in sircd, which can be
exploited by malicious users to gain operator privileges.
The problem is that any user reportedly can set their usermode
to operator. The vulnerability has been reported in
versions 0.5.2 and 0.5.3. Other versions may also be affected.</p>
</blockquote>
</body>
</description>
<references>
<bid>9097</bid>
<url>http://secunia.com/advisories/10274/</url>
</references>
<dates>
<discovery>2003-11-20</discovery>
<entry>2007-01-15</entry>
</dates>
</vuln>
<vuln vid="41da2ba4-a24e-11db-bd24-000f3dcc6a5d">
<topic>cacti -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>cacti</name>
<range><lt>0.8.6i.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/23528/">
<p>rgod has discovered four vulnerabilities in Cacti,
which can be exploited by malicious people to bypass
certain security restrictions, manipulate data
and compromise vulnerable systems.</p>
</blockquote>
</body>
</description>
<references>
<url>http://secunia.com/advisories/23528/</url>
<url>http://forums.cacti.net/about18846-0-asc-0.html</url>
</references>
<dates>
<discovery>2006-12-28</discovery>
<entry>2007-01-12</entry>
</dates>
</vuln>
<vuln vid="b2ff68b2-9f29-11db-a4e4-0211d87675b7">
<topic>mplayer -- buffer overflow in the code for RealMedia RTSP streams.</topic>
<affects>
<package>
<name>mplayer</name>
<name>mplayer-esound</name>
<name>mplayer-gtk</name>
<name>mplayer-gtk2</name>
<name>mplayer-gtk-esound</name>
<name>mplayer-gtk2-esound</name>
<range><lt>0.99.10_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<blockquote cite="http://www.mplayerhq.hu/design7/news.html">
<p>A potential buffer overflow was found in the code used to handle
RealMedia RTSP streams. When checking for matching asm rules, the code
stores the results in a fixed-size array, but no boundary checks are
performed. This may lead to a buffer overflow if the user is tricked
into connecting to a malicious server. Since the attacker cannot write
arbitrary data into the buffer, creating an exploit is very hard; but a
DoS attack is easily made.
A fix for this problem was committed to SVN on Sun Dec 31 13:27:53 2006
UTC as r21799. The fix involves three files: stream/realrtsp/asmrp.c,
stream/realrtsp/asmrp.h and stream/realrtsp/real.c.</p>
</blockquote>
</body>
</description>
<references>
<freebsdpr>ports/107217</freebsdpr>
<cvename>CVE-2006-6172</cvename>
<url>http://www.mplayerhq.hu/design7/news.html</url>
</references>
<dates>
<discovery>2006-12-31</discovery>
<entry>2007-01-08</entry>
</dates>
</vuln>
<vuln vid="37e30313-9d8c-11db-858b-0060084a00e5">
<topic>fetchmail -- crashes when refusing a message bound for an MDA</topic>
<affects>
<package>
<name>fetchmail</name>
<range><ge>6.3.5</ge><lt>6.3.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Matthias Andree reports:</p>
<blockquote cite="http://www.fetchmail.info/fetchmail-SA-2006-03.txt">
<p>When delivering messages to a message delivery agent by means
of the "mda" option, fetchmail can crash (by passing
a NULL pointer to ferror() and fflush()) when refusing a message.
SMTP and LMTP delivery modes aren't affected.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-5974</cvename>
<url>http://www.fetchmail.info/fetchmail-SA-2006-03.txt</url>
</references>
<dates>
<discovery>2007-01-04</discovery>
<entry>2007-01-06</entry>
</dates>
</vuln>
<vuln vid="5238ac45-9d8c-11db-858b-0060084a00e5">
<topic>fetchmail -- TLS enforcement problem/MITM attack/password exposure</topic>
<affects>
<package>
<name>fetchmail</name>
<range><lt>6.3.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Matthias Andree reports:</p>
<blockquote cite="http://www.fetchmail.info/fetchmail-SA-2006-02.txt">
<p>Fetchmail has had several longstanding password disclosure
vulnerabilities.</p>
<ul>
<li>sslcertck/sslfingerprint options should have implied
"sslproto tls1" in order to enforce TLS negotiation,
but did not.</li>
<li>Even with "sslproto tls1" in the config, fetches
would go ahead in plain text if STLS/STARTTLS wasn't available
(not advertised, or advertised but rejected).</li>
<li>POP3 fetches could completely ignore all TLS options
whether available or not because it didn't reliably issue
CAPA before checking for STLS support - but CAPA is a
requisite for STLS. Whether or not CAPAbilities were probed,
depended on the "auth" option. (Fetchmail only
tried CAPA if the auth option was not set at all, was set
to gssapi, kerberos, kerberos_v4, otp, or cram-md5.)</li>
<li>POP3 could fall back to using plain text passwords, even
if strong authentication had been configured.</li>
<li>POP2 would not complain if strong authentication or TLS
had been requested.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2006-5867</cvename>
<url>http://www.fetchmail.info/fetchmail-SA-2006-02.txt</url>
</references>
<dates>
<discovery>2007-01-04</discovery>
<entry>2007-01-06</entry>
</dates>
</vuln>
<vuln vid="78ad2525-9d0c-11db-a5f6-000c6ec775d9">
<topic>opera -- multiple vulnerabilities</topic>
<affects>
<package>
<name>opera</name>
<name>opera-devel</name>
<name>linux-opera</name>
<range><lt>9.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>iDefense reports:</p>
<blockquote cite="http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=457">
<p>The vulnerability specifically exists due to Opera
improperly processing a JPEG DHT marker. The DHT marker is
used to define a Huffman Table which is used for decoding
the image data. An invalid number of index bytes in the
DHT marker will trigger a heap overflow with partially
user controlled data.</p>
<p>Exploitation of this vulnerability would allow an
attacker to execute arbitrary code on the affected
host. The attacker would first need to construct a website
containing the malicious image and trick the vulnerable
user into visiting the site. This would trigger the
vulnerability and allow the code to execute with the
privileges of the local user.</p>
</blockquote>
<blockquote cite="http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=458">
<p>A flaw exists within Opera's Javascript SVG
implementation. When processing a
createSVGTransformFromMatrix request Opera does not
properly validate the type of object passed to the
function. Passing an incorrect object to this function can
result in it using a pointer that is user controlled when
it attempts to make the virtual function call.</p>
<p>Exploitation of this vulnerability would allow an
attacker to execute arbitrary code on the affected
host. The attacker would first need to construct a website
containing the malicious JavaScript and trick the
vulnerable user into visiting the site. This would trigger
the vulnerability and allow the code to execute with the
privileges of the local user.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-0126</cvename>
<cvename>CVE-2007-0127</cvename>
<url>http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=457</url>
<url>http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=458</url>
<url>http://www.opera.com/support/search/supsearch.dml?index=851</url>
<url>http://www.opera.com/support/search/supsearch.dml?index=852</url>
</references>
<dates>
<discovery>2007-01-05</discovery>
<entry>2007-01-05</entry>
<modified>2010-05-12</modified>
</dates>
</vuln>
<vuln vid="3d8d3548-9d02-11db-a541-000ae42e9b93">
<topic>drupal -- multiple vulnerabilities</topic>
<affects>
<package>
<name>drupal</name>
<range><gt>4.7</gt><lt>4.7.5</lt></range>
<range><lt>4.6.11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Drupal security team reports:</p>
<blockquote cite="http://drupal.org/files/sa-2007-001/advisory.txt">
<p>A few arguments passed via URLs are not properly sanitized
before display. When an attacker is able to entice an
administrator to follow a specially crafted link, arbitrary
HTML and script code can be injected and executed in the
victim's session. Such an attack may lead to administrator
access if certain conditions are met.</p>
</blockquote>
<blockquote cite="http://drupal.org/files/sa-2007-002/advisory.txt">
<p>The way page caching was implemented allows a denial of
service attack. An attacker has to have the ability to post
content on the site. He or she would then be able to poison
the page cache, so that it returns cached 404 page not found
errors for existing pages.</p>
<p>If the page cache is not enabled, your site is not vulnerable.
The vulnerability only affects sites running on top of MySQL.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2007-0136</cvename>
<url>http://drupal.org/files/sa-2007-001/advisory.txt</url>
<url>http://drupal.org/files/sa-2007-002/advisory.txt</url>
</references>
<dates>
<discovery>2007-01-05</discovery>
<entry>2007-01-05</entry>
<modified>2010-05-12</modified>
</dates>
</vuln>
<vuln vid="9347d82d-9a66-11db-b271-000e35248ad7">
<topic>w3m -- format string vulnerability</topic>
<affects>
<package>
<name>w3m</name>
<name>w3m-img</name>
<name>w3m-m17n</name>
<name>w3m-m17n-img</name>
<name>ja-w3m</name>
<name>ja-w3m-img</name>
<range><lt>0.5.1_6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>An anonymous person reports:</p>
<blockquote cite="http://sourceforge.net/tracker/index.php?func=detail&aid=1612792&group_id=39518&atid=425439">
<p>w3m-0.5.1 crashes when using the -dump or -backend options to
open a HTTPS URL with a SSL certificate where the CN contains
"%n%n%n%n%n%n".</p>
</blockquote>
</body>
</description>
<references>
<bid>21735</bid>
<cvename>CVE-2006-6772</cvename>
<url>http://sourceforge.net/tracker/index.php?func=detail&aid=1612792&group_id=39518&atid=425439</url>
<url>http://secunia.com/advisories/23492/</url>
</references>
<dates>
<discovery>2006-12-10</discovery>
<entry>2007-01-03</entry>
</dates>
</vuln>
