Race condition in the page fault handler (fault.c) for Linux kernel 2.2.x to 2.2.7, 2.4 to 2.4.29, and 2.6 to 2.6.10, when running on multiprocessor machines, allows local users to execute arbitrary code via concurrent threads that share the same virtual memory space and simultaneously request stack expansion.FLSA:2336linux-fault-handler-gain-privileges(18849)2005-000112244RHSA-2005:092RHSA-2005:043RHSA-2005:017RHSA-2005:016DSA-1082DSA-1070DSA-1069DSA-1067101286220338202022016313822oval:org.mitre.oval:def:1032220050114 [USN-60-0] Linux kernel vulnerabilities20050112 Linux kernel i386 SMP page fault handler privilege escalation20050112 Linux kernel i386 SMP page fault handler privilege escalationhttp://isec.pl/vulnerabilities/isec-0022-pagefault.txtCLA-2005:930MDKSA-2005:022poppassd_pam 1.0 and earlier, when changing a user password, does not verify that the user entered the old password correctly, which allows remote attackers to change passwords for arbitrary users.GLSA-200501-22101284013865The 64 bit ELF support in Linux kernel 2.6 before 2.6.10, on 64-bit architectures, does not properly check for overlapping VMA (virtual memory address) allocations, which allows local users to cause a denial of service (system crash) or execute arbitrary code via a crafted ELF or a.out file.12261RHSA-2005:043linux-vma-gain-privileges(18886)2005-0001RHSA-2005:017SUSE-SA:2005:018DSA-1082DSA-1070DSA-1069DSA-10671012885203382020220163oval:org.mitre.oval:def:9512http://linux.bkbits.net:8080/linux-2.6/cset@41a6721cce-LoPqkzKXudYby_3TUmghttp://linux.bkbits.net:8080/linux-2.4/cset@41c36fb6q1Z68WUzKQFjJR-40Ev3twMDKSA-2005:022The mysqlaccess script in MySQL 4.0.23 and earlier, 4.1.x before 4.1.10, 5.0.x before 5.0.3, and other versions including 3.x, allows local users to overwrite arbitrary files or read temporary files via a symlink attack on temporary files.12277DSA-64713867mysql-mysqlaccess-symlink(18922)http://mysql.osuosl.org/doc/mysql/en/News-4.1.10.html20050118 [USN-63-1] MySQL client vulnerabilityhttp://lists.mysql.com/internals/20600CLA-2005:947MDKSA-2005:036101864Heap-based buffer overflow in psd.c for ImageMagick 6.1.0, 6.1.7, and possibly earlier versions allows remote attackers to execute arbitrary code via a .PSD image file with a large number of layers.RHSA-2005:071DSA-64620050117 Multiple Vendor ImageMagick .psd Image File Decode Heap Overflow VulnerabilityGLSA-200501-37oval:org.mitre.oval:def:992520050118 [USN-62-1] imagemagick vulnerabilityRHSA-2005:070The COPS dissector in Ethereal 0.10.6 through 0.10.8 allows remote attackers to cause a denial of service (infinite loop).http://www.ethereal.com/appnotes/enpa-sa-00017.html13946ethereal-cops-dos(18999)RHSA-2005:037GLSA-200501-27P-106oval:org.mitre.oval:def:1080112326RHSA-2005:011FLSA-2006:152922MDKSA-2005:013Unknown vulnerability in the DLSw dissector in Ethereal 0.10.6 through 0.10.8 allows remote attackers to cause a denial of service (application crash from assertion).ethereal-dlsw-dos(19000)13946RHSA-2005:037GLSA-200501-27http://www.ethereal.com/appnotes/enpa-sa-00017.htmlP-106oval:org.mitre.oval:def:1138112326RHSA-2005:011FLSA-2006:152922MDKSA-2005:013Unknown vulnerability in the DNP dissector in Ethereal 0.10.5 through 0.10.8 allows remote attackers to cause "memory corruption."http://www.ethereal.com/appnotes/enpa-sa-00017.htmlethereal-dnp-memory-corruption(19001)RHSA-2005:037GLSA-200501-27P-10613946oval:org.mitre.oval:def:1068912326RHSA-2005:011FLSA-2006:152922MDKSA-2005:013Unknown vulnerability in the Gnutella dissector in Ethereal 0.10.6 through 0.10.8 allows remote attackers to cause a denial of service (application crash).GLSA-200501-2713946ethereal-gnutella-dos(19002)RHSA-2005:037http://www.ethereal.com/appnotes/enpa-sa-00017.htmlP-106oval:org.mitre.oval:def:1062312326RHSA-2005:011FLSA-2006:152922MDKSA-2005:013Unknown vulnerability in the MMSE dissector in Ethereal 0.10.4 through 0.10.8 allows remote attackers to cause a denial of service by triggering a free of statically allocated memory.ethereal-mmse-free-memory(19003)13946RHSA-2005:037GLSA-200501-27http://www.ethereal.com/appnotes/enpa-sa-00017.htmlP-106oval:org.mitre.oval:def:952112326RHSA-2005:011FLSA-2006:152922MDKSA-2005:013Multiple vulnerabilities in fliccd, when installed setuid root as part of the kdeedu Kstars support for Instrument Neutral Distributed Interface (INDI) in KDE 3.3 to 3.3.2, allow local users and remote attackers to execute arbitrary code via stack-based buffer overflows.http://www.kde.org/info/security/advisory-20050215-1.txt14306FEDORA-2005-148GLSA-200502-23Format string vulnerability in the a_Interface_msg function in Dillo before 0.8.3-r4 allows remote attackers to execute arbitrary code via format string specifiers in a web page.12203dillo-capi-format-string(18807)GLSA-200501-111376013764nwclient.c in ncpfs before 2.2.6 does not drop root privileges before executing utilities using the NetWare client functions, which allows local users to gain privileges.DSA-665GLSA-200501-44ftp://platan.vc.cvut.cz/pub/linux/ncpfs/Changes-2.2.612400FLSA:152904RHSA-2005:37113297MDKSA-2005:0281013019Buffer overflow in ncplogin in ncpfs before 2.2.6 allows remote malicious NetWare servers to execute arbitrary code on the NetWare client.GLSA-200501-44ftp://platan.vc.cvut.cz/pub/linux/ncpfs/Changes-2.2.612400FLSA:15290413298MDKSA-2005:0281013019diatheke.pl in Sword 1.5.7a allows remote attackers to execute arbitrary commands via shell metacharacters in a URL.DSA-650sword-diatheke-command-execution(18997)1012955138971232013941Buffer overflow in the exported_display function in xatitv in gatos before 0.0.5 allows local users to execute arbitrary code.DSA-64013884gatos-xatitv-bo(18930)The f2c translator in the f2c package 3.1 allows local users to read arbitrary files via a symlink attack on temporary files.DSA-661GLSA-200501-43123801013028140671405214041The f2 shell script in the f2c package 3.1 allows local users to read arbitrary files via a symlink attack on temporary files.12380DSA-66110130281405214041Unknown vulnerability in hztty 2.0 and earlier allows local users to execute arbitrary commands.12518DSA-675hztty-command-execution(19297)101315414236Buffer overflow in playmidi before 2.4 allows local users to execute arbitrary code.DSA-641playmidi-bo(18933)1227413049MDKSA-2005:0101012957138981389013828Multiple buffer overflows in Exim before 4.43 may allow attackers to execute arbitrary code via (1) an IPv6 address with more than 8 components, as demonstrated using the -be command line option, which triggers an overflow in the host_aton function, or (2) the -bh command line option or dnsdb PTR lookup, which triggers an overflow in the dns_build_reverse function.VU#132992RHSA-2005:02520050114 Exim dns_buld_reverse() Buffer Overflow Vulnerability20050107 Exim host_aton() Buffer Overflow Vulnerability[exim] 20050104 2 smallish security issuesDSA-637DSA-635GLSA-200501-23oval:org.mitre.oval:def:10347http://ftp6.us.freebsd.org/pub/mail/exim/ChangeLogs/ChangeLog-4.44Buffer overflow in the spa_base64_to_bits function in Exim before 4.43, as originally obtained from Samba code, and as called by the auth_spa_client function, may allow attackers to execute arbitrary code during SPA authentication.RHSA-2005:025[exim] 20050104 2 smallish security issues20050107 Exim auth_spa_server() Buffer Overflow VulnerabilityGLSA-200501-23oval:org.mitre.oval:def:1129320050212 exim auth_spa_server() PoC exploithttp://ftp6.us.freebsd.org/pub/mail/exim/ChangeLogs/ChangeLog-4.4412188gnome-pty-helper in GNOME libzvt2 and libvte4 allows local users to spoof the logon hostname via a modified DISPLAY environment variable. NOTE: the severity of this issue has been disputed.libzvt-gnomeptyhelper-spoof(22496)ADV-2005-1931150041702320051007 gnome-pty-helper writes arbitrary utmp recordshttp://bugzilla.gnome.org/show_bug.cgi?id=317312http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=330907Buffer overflow in the code for recursion and glue fetching in BIND 8.4.4 and 8.4.5 allows remote attackers to cause a denial of service (crash) via queries that trigger the overflow in the q_usedns array that tracks nameservers and addresses.VU#327633http://www.uniras.gov.uk/niscc/docs/al-20050125-00059.htmlhttp://www.isc.org/index.pl?/sw/bind/bind8.phphttp://www.isc.org/index.pl?/sw/bind/bind-security.phpbind-qusedns-bo(19063)1236410129961829114009SCOSA-2006.1An "incorrect assumption" in the authvalidated validator function in BIND 9.3.0, when DNSSEC is enabled, allows remote attackers to cause a denial of service (named server exit) via crafted DNS packets that cause an internal consistency test (self-check) to fail.VU#938617bind-named-dns-dos(19062)http://www.uniras.gov.uk/niscc/docs/al-20050125-00060.htmlhttp://www.isc.org/index.pl?/sw/bind/bind-security.php2005-000312365http://www.isc.org/index.pl?/sw/bind/bind9.php101299514008The Acrobat web control in Adobe Acrobat and Acrobat Reader 7.0 and earlier, when used with Internet Explorer, allows remote attackers to determine the existence of arbitrary files via the LoadFile ActiveX method.ADV-2005-0310http://www.niscc.gov.uk/niscc/docs/re-20050401-00264.pdfhttp://www.hyperdose.com/advisories/H2005-06.txthttp://www.adobe.com/support/techdocs/331465.html129891524214813The DNS implementation in DeleGate 8.10.2 and earlier allows remote attackers to cause a denial of service via a compressed DNS packet with a label length byte with an incorrect offset, which could trigger an infinite loop.http://www.niscc.gov.uk/niscc/docs/re-20050524-00432.pdf?lang=enhttp://www.niscc.gov.uk/niscc/docs/al-20050524-00433.html1372925291The DNS implementation of DNRD before 2.10 allows remote attackers to cause a denial of service via a compressed DNS packet with a label length byte with an incorrect offset, which could trigger an infinite loop.This vulnerability is addressed in the following product release:
dnrd, dnrd, 2.10 http://www.niscc.gov.uk/niscc/docs/al-20050524-00433.html1372925291http://www.niscc.gov.uk/niscc/docs/re-20050524-00432.pdf?lang=enThe DNS implementation of PowerDNS 2.9.16 and earlier allows remote attackers to cause a denial of service via a compressed DNS packet with a label length byte with an incorrect offset, which could trigger an infinite loop.http://www.niscc.gov.uk/niscc/docs/al-20050524-00433.html1372925291http://www.niscc.gov.uk/niscc/docs/re-20050524-00432.pdf?lang=enCertain configurations of IPsec, when using Encapsulating Security Payload (ESP) in tunnel mode, integrity protection at a higher layer, or Authentication Header (AH), allow remote attackers to decrypt IPSec communications by modifying the outer packet in ways that cause plaintext data from the inner packet to be returned in ICMP messages, as demonstrated using bit-flipping attacks and (1) Destination Address Rewriting, (2) a modified header length that causes portions of the packet to be interpreted as IP Options, or (3) a modified protocol field and source address.VU#302220ADV-2005-2806ADV-2005-0507SSRT5957http://www.niscc.gov.uk/niscc/docs/al-20050509-00386.html?lang=en13562HPSBTU0121710153201793820050509 NISCC Vulnerability Advisory IPSEC - 004033Multiple cross-site scripting (XSS) vulnerabilities in DotNetNuke before 3.0.12 allow remote attackers to inject arbitrary web script or HTML via the (1) register a new user page, (2) User-Agent, or (3) Username, which is not properly quoted before sending to the error log.http://www.woany.co.uk/advisories/dotnetnukexss.txt1539720050516 DotNetNuke (Multiple XSS)136471364613644Buffer overflow in Apple iTunes 4.7 allows remote attackers to execute arbitrary code via a long URL in (1) .m3u or (2) .pls playlist files.VU#37736820050113 Apple iTunes Playlist Parsing Buffer Overflow VulnerabilityAPPLE-SA-2005-01-11itunes-m3u-pls-bo(18851)1223812833101283913804The OLE component in Windows 98, 2000, XP, and Server 2003, and Exchange Server 5.0 through 2003, does not properly validate the lengths of messages for certain OLE data, which allows remote attackers to execute arbitrary code, aka the "Input Validation Vulnerability."VU#927889TA05-039AMS05-012win-ole-code-execution(19109)oval:org.mitre.oval:def:4499oval:org.mitre.oval:def:3568oval:org.mitre.oval:def:2917oval:org.mitre.oval:def:1180The Server Message Block (SMB) implementation for Windows NT 4.0, 2000, XP, and Server 2003 does not properly validate certain SMB packets, which allows remote attackers to execute arbitrary code via Transaction responses containing (1) Trans or (2) Trans2 commands, aka the "Server Message Block Vulnerability," and as demonstrated using Trans2 FIND_FIRST2 responses with large file name length fields.TA05-039AVU#652537win-smb-code-execution(19089)MS05-01120050209 EEYE: Windows SMB Client Transaction Response Handling Vulnerability20050309 Update: MS05-011 EEYE: Windows SMB Client Transaction Response Handling Vulnerability20050209 EEYE: Windows SMB Client Transaction Response Handling Vulnerability12484oval:org.mitre.oval:def:4043oval:org.mitre.oval:def:1889oval:org.mitre.oval:def:1847oval:org.mitre.oval:def:1606Windows 2000, XP, and Server 2003 does not properly "validate the use of memory regions" for COM structured storage files, which allows attackers to execute arbitrary code, aka the "COM Structured Storage Vulnerability."TA05-039AVU#597889MS05-012win-com-gain-privileges(19105)http://www.argeniss.com/research/SSExploit.c20050530 [Argeniss] MS05-012 Exploitoval:org.mitre.oval:def:901oval:org.mitre.oval:def:2892oval:org.mitre.oval:def:2351oval:org.mitre.oval:def:1159Microsoft Windows XP SP2 and earlier, 2000 SP3 and SP4, Server 2003, and older operating systems allows remote attackers to cause a denial of service and possibly execute arbitrary code via crafted IP packets with malformed options, aka the "IP Validation Vulnerability."TA05-102AVU#233754MS05-01920050412 Windows IP Options Remote Compromiseoval:org.mitre.oval:def:4549oval:org.mitre.oval:def:3824oval:org.mitre.oval:def:1744Windows SharePoint Services and SharePoint Team Services for Windows Server 2003 does not properly validate an HTTP redirection query, which allows remote attackers to inject arbitrary HTML and web script via a cross-site scripting (XSS) attack, or to spoof the web cache.TA05-039AVU#340409MS05-006win-sharepoint-services-xss(19091)The License Logging service for Windows NT Server, Windows 2000 Server, and Windows Server 2003 does not properly validate the length of messages, which leads to an "unchecked buffer" and allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code, aka the "License Logging Service Vulnerability."TA05-039AVU#130433MS05-010win-license-code-execution(19101)oval:org.mitre.oval:def:644oval:org.mitre.oval:def:4786oval:org.mitre.oval:def:3582oval:org.mitre.oval:def:2568The Server service (srvsvc.dll) in Windows XP SP1 and SP2 allows remote attackers to obtain sensitive information (users who are accessing resources) via an anonymous logon using a named pipe, which is not properly authenticated, aka the "Named Pipe Vulnerability."TA05-039AVU#939074MS05-007win-named-pipe-information-disclosure(19093)12486101311214189oval:org.mitre.oval:def:3055oval:org.mitre.oval:def:2292Internet Explorer 5.01, 5.5, and 6 allows remote attackers to execute arbitrary code via drag and drop events, aka the "Drag-and-Drop Vulnerability."TA05-039AVU#698835ie-dragdrop-gain-privileges(19117)11466MS05-014MS05-008oval:org.mitre.oval:def:4864oval:org.mitre.oval:def:4726oval:org.mitre.oval:def:3006oval:org.mitre.oval:def:2953oval:org.mitre.oval:def:2046oval:org.mitre.oval:def:1334oval:org.mitre.oval:def:1015Internet Explorer 5.01, 5.5, and 6 allows remote attackers to spoof a less restrictive security zone and execute arbitrary code via an HTML page containing URLs that contain hostnames that have been double hex encoded, which are decoded twice to generate a malicious hostname, aka the "URL Decoding Zone Spoofing Vulnerability."TA05-039AVU#580299MS05-01420050209 Internet Explorer zone spoofing with encoded URLsie-file-url-encode(19214)oval:org.mitre.oval:def:3586oval:org.mitre.oval:def:3196oval:org.mitre.oval:def:3060oval:org.mitre.oval:def:1736oval:org.mitre.oval:def:1308Internet Explorer 5.01, 5.5, and 6 does not properly validate buffers when handling certain DHTML methods including the createControlRange Javascript function, which allows remote attackers to execute arbitrary code, aka the "DHTML Method Heap Memory Corruption Vulnerability."TA05-039AVU#843771MS05-014ie-cdf-execute-code(19137)1013125oval:org.mitre.oval:def:710oval:org.mitre.oval:def:3910oval:org.mitre.oval:def:3137oval:org.mitre.oval:def:2692oval:org.mitre.oval:def:1005Internet Explorer 5.01, 5.5, and 6 does not properly validate certain URLs in Channel Definition Format (CDF) files, which allows remote attackers to obtain sensitive information or execute arbitrary code, aka the "Channel Definition Format (CDF) Cross Domain Vulnerability."TA05-039AVU#82397112427MS05-014ie-cdf-execute-code(19137)1013126oval:org.mitre.oval:def:4947oval:org.mitre.oval:def:4085oval:org.mitre.oval:def:3318oval:org.mitre.oval:def:2817oval:org.mitre.oval:def:2385The Hyperlink Object Library for Windows 98, 2000, XP, and Server 2003 allows remote attackers to execute arbitrary code via a crafted link that triggers an "unchecked buffer" in the library, possibly due to a buffer overflow.TA05-039AVU#820427MS05-015win-hyperlink-code-execution(19110)12479101311914195oval:org.mitre.oval:def:713oval:org.mitre.oval:def:3203oval:org.mitre.oval:def:2570Buffer overflow in the Telephony Application Programming Interface (TAPI) for Microsoft Windows 98, Windows 98 SE, Windows ME, Windows 2000, Windows XP, and Windows Server 2003 allows attackers elevate privileges or execute arbitrary code via a crafted message.MS05-04016354145181014639oval:org.mitre.oval:def:1297oval:org.mitre.oval:def:1213oval:org.mitre.oval:def:1075oval:org.mitre.oval:def:100088oval:org.mitre.oval:def:100086oval:org.mitre.oval:def:100085oval:org.mitre.oval:def:100084Buffer overflow in the Message Queuing component of Microsoft Windows 2000 and Windows XP SP1 allows remote attackers to execute arbitrary code via a crafted message.MS05-017oval:org.mitre.oval:def:4988oval:org.mitre.oval:def:4384Buffer overflow in the font processing component of Microsoft Windows 2000, Windows XP SP1 and SP2, and Windows Server 2003 allows local users to gain privileges via a specially-designed application.MS05-018http://www.ngssoftware.com/advisories/ms-01.txt20050413 Windows kernel overflow fixedoval:org.mitre.oval:def:4797oval:org.mitre.oval:def:3941oval:org.mitre.oval:def:2731oval:org.mitre.oval:def:2562The kernel of Microsoft Windows 2000, Windows XP SP1 and SP2, and Windows Server 2003 allows local users to gain privileges via certain access requests.MS05-018oval:org.mitre.oval:def:4593oval:org.mitre.oval:def:3994oval:org.mitre.oval:def:1761oval:org.mitre.oval:def:1656The document processing application used by the Windows Shell in Microsoft Windows 2000, Windows XP, and Windows Server 2003 allows remote attackers to execute arbitrary code by modifying the CLSID stored in a file so that it is processed by HTML Application Host (MSHTA), as demonstrated using a Microsoft Word document.MS05-01620050412 Microsoft MSHTA Script Execution VulnerabilityADV-2005-0335http://www.securiteam.com/exploits/5YP0T0AFFW.html1313220050529 Spam exploiting MS05-016oval:org.mitre.oval:def:587oval:org.mitre.oval:def:573oval:org.mitre.oval:def:4710oval:org.mitre.oval:def:407oval:org.mitre.oval:def:3456oval:org.mitre.oval:def:2184Buffer overflow in the Decrypt::makeFileKey2 function in Decrypt.cc for xpdf 3.00 and earlier allows remote attackers to execute arbitrary code via a PDF file with a large /Encrypt /Length keyLength value.FLSA:2353FLSA:23522005-0003RHSA-2005:066RHSA-2005:059RHSA-2005:057RHSA-2005:053RHSA-2005:03420050118 Multiple Unix/Linux Vendor Xpdf makeFileKey2 Stack OverflowGLSA-200502-10DSA-648DSA-64520050119 [USN-64-1] xpdf, CUPS vulnerabilitiesCLA-2005:921ftp://ftp.foolabs.com/pub/xpdf/xpdf-3.00pl3.patchRHSA-2005:02617277oval:org.mitre.oval:def:11781SCOSA-2005.42MDKSA-2005:021MDKSA-2005:020MDKSA-2005:019MDKSA-2005:018MDKSA-2005:017MDKSA-2005:016The original design of TCP does not check that the TCP sequence number in an ICMP error message is within the range of sequence numbers for data that has been sent but not acknowledged (aka "TCP sequence number checking"), which makes it easier for attackers to forge ICMP error messages for specific TCP connections and cause a denial of service, as demonstrated using (1) blind connection-reset attacks with forged "Destination Unreachable" messages, (2) blind throughput-reduction attacks with forged "Source Quench" messages, or (3) blind throughput-reduction attacks with forged ICMP messages that cause the Path MTU to be reduced. NOTE: CVE-2004-0790, CVE-2004-0791, and CVE-2004-1060 have been SPLIT based on different attacks; CVE-2005-0065, CVE-2005-0066, CVE-2005-0067, and CVE-2005-0068 are related identifiers that are SPLIT based on the underlying vulnerability. While CVE normally SPLITs based on vulnerability, the attack-based identifiers exist due to the variety and number of affected implementations and solutions that address the attacks instead of the underlying vulnerabilities.http://www.gont.com.ar/drafts/icmp-attacks-against-tcp.html13124The original design of TCP does not check that the TCP Acknowledgement number in an ICMP error message generated by an intermediate router is within the range of possible values for data that has already been acknowledged (aka "TCP acknowledgement number checking"), which makes it easier for attackers to forge ICMP error messages for specific TCP connections and cause a denial of service, as demonstrated using (1) blind connection-reset attacks with forged "Destination Unreachable" messages, (2) blind throughput-reduction attacks with forged "Source Quench" messages, or (3) blind throughput-reduction attacks with forged ICMP messages that cause the Path MTU to be reduced. NOTE: CVE-2004-0790, CVE-2004-0791, and CVE-2004-1060 have been SPLIT based on different attacks; CVE-2005-0065, CVE-2005-0066, CVE-2005-0067, and CVE-2005-0068 are related identifiers that are SPLIT based on the underlying vulnerability. While CVE normally SPLITs based on vulnerability, the attack-based identifiers exist due to the variety and number of affected implementations and solutions that address the attacks instead of the underlying vulnerabilities.http://www.gont.com.ar/drafts/icmp-attacks-against-tcp.html13124The original design of TCP does not require that port numbers be assigned randomly (aka "Port randomization"), which makes it easier for attackers to forge ICMP error messages for specific TCP connections and cause a denial of service, as demonstrated using (1) blind connection-reset attacks with forged "Destination Unreachable" messages, (2) blind throughput-reduction attacks with forged "Source Quench" messages, or (3) blind throughput-reduction attacks with forged ICMP messages that cause the Path MTU to be reduced. NOTE: CVE-2004-0790, CVE-2004-0791, and CVE-2004-1060 have been SPLIT based on different attacks; CVE-2005-0065, CVE-2005-0066, CVE-2005-0067, and CVE-2005-0068 are related identifiers that are SPLIT based on the underlying vulnerability. While CVE normally SPLITs based on vulnerability, the attack-based identifiers exist due to the variety and number of affected implementations and solutions that address the attacks instead of the underlying vulnerabilities.http://www.gont.com.ar/drafts/icmp-attacks-against-tcp.html13124The original design of ICMP does not require authentication for host-generated ICMP error messages, which makes it easier for attackers to forge ICMP error messages for specific TCP connections and cause a denial of service, as demonstrated using (1) blind connection-reset attacks with forged "Destination Unreachable" messages, (2) blind throughput-reduction attacks with forged "Source Quench" messages, or (3) blind throughput-reduction attacks with forged ICMP messages that cause the Path MTU to be reduced. NOTE: CVE-2004-0790, CVE-2004-0791, and CVE-2004-1060 have been SPLIT based on different attacks; CVE-2005-0065, CVE-2005-0066, CVE-2005-0067, and CVE-2005-0068 are related identifiers that are SPLIT based on the underlying vulnerability. While CVE normally SPLITs based on vulnerability, the attack-based identifiers exist due to the variety and number of affected implementations and solutions that address the attacks instead of the underlying vulnerabilities.http://www.gont.com.ar/drafts/icmp-attacks-against-tcp.html13124The (1) tcltags or (2) vimspell.sh scripts in vim 6.3 allow local users to overwrite or create arbitrary files via a symlink attack on temporary files.vim-symlink(18870)RHSA-2005:122RHSA-2005:0361384120050118 [USN-61-1] vim vulnerabilitiesFLSA:2343oval:org.mitre.oval:def:94021012938Synaesthesia 2.1 and earlier, and possibly other versions, when installed setuid root, does not drop privileges before processing configuration and mixer files, which allows local users to read arbitrary files.DSA-68112546101320614300vdr before 1.2.6 does not securely create files, which allows attackers to overwrite arbitrary files.vdr-dvdapi-file-overwrite(19066)GLSA-200501-42DSA-65612356140661399513930zhcon before 0.2 does not drop privileges before reading a user configuration file, which allows local users to read arbitrary files.DSA-655zhcon-information-disclosure(19045)12343MDKSA-2005:0121012977139871398213977Buffer overflow in queue.c in a support script for sympa 3.3.3, when running setuid, allows local users to execute arbitrary code.DSA-67710131631422414217Buffer overflow in pcdsvgaview in xpcd 2.08 allows local users to execute arbitrary code.DSA-6761252310131621425014248prefs.php in SquirrelMail before 1.4.4, with register_globals enabled, allows remote attackers to inject local code into the SquirrelMail code via custom preference handlers.http://www.squirrelmail.org/security/issue/2005-01-14RHSA-2005:135RHSA-2005:09913962APPLE-SA-2005-03-21oval:org.mitre.oval:def:958720050129 SquirrelMail Security AdvisoryGLSA-200501-39Multiple buffer overflows in the XView library 3.2 may allow local users to execute arbitrary code via setuid applications that use the library.xview-xvparseone-bo(19271)DSA-672The DBI library (libdbi-perl) for Perl allows local users to overwrite arbitrary files via a symlink attack on a temporary PID file.dbi-library-file-overwrite(19068)RHSA-2005:072GLSA-200501-38DSA-65820050125 [USN-70-1] Perl DBI module vulnerabilityoval:org.mitre.oval:def:1055212360FLSA-2006:178989MDKSA-2005:03010130071405014015The KDE screen saver in KDE before 3.0.5 does not properly check the return value from a certain function call, which allows attackers with physical access to cause a crash and access the desktop session.kdebase-screensaver-security-bypass(19084)RHSA-2005:009DSA-660oval:org.mitre.oval:def:9260Buffer overflow in xtrlock 2.0 allows local users to cause a denial of service (application crash) and hijack the desktop session.DSA-649xtrlock-screen-lock-bypass(18991)1231613938The 55_options_traceback.dpatch patch for mailman 2.1.5 in Ubuntu 4.10 displays a different error message depending on whether the e-mail address is subscribed to a private list, which allows remote attackers to determine the list membership for a given e-mail address.20050110 [USN-59-1] mailman vulnerabilitieshttp://qa.debian.org/bts-security.htmlhttp://bugs.debian.org/cgi-bin/bugreport.cgi?bug=285839MySQL MaxDB 7.5.0.0, and other versions before 7.5.0.21, allows remote attackers to cause a denial of service (crash) via an HTTP request with invalid headers.20050119 MySQL MaxDB Web Agent Multiple Denial of Service VulnerabilitiesThe sapdbwa_GetUserData function in MySQL MaxDB 7.5.0.0, and other versions before 7.5.0.21, allows remote attackers to cause a denial of service (crash) via invalid parameters to the WebDAV handler code, which triggers a null dereference that causes the SAP DB Web Agent to crash.20050119 MySQL MaxDB Web Agent Multiple Denial of Service VulnerabilitiesMySQL MaxDB 7.5.00 for Windows, and possibly earlier versions and other platforms, allows remote attackers to cause a denial of service (application crash) via invalid parameters to the (1) DBMCli_String::ReallocString, (2) DBMCli_String::operator, (3) DBMCli_Buffer::ForceResize, (4) DBMCli_Wizard::InstallDatabase, (5) DBMCli_Devspaces::Complete, (6) DBMWeb_TemplateWizard::askForWriteCountStep5, or (7) DBMWeb_DBMWeb::wizardDB functions, which triggers a null dereference.maxdb-null-pointer-dos(19687)20050314 MySQL MaxDB Web Agent Multiple Denial of Service VulnerabilitiesBuffer overflow in the X11 dissector in Ethereal 0.8.10 through 0.10.8 allows remote attackers to execute arbitrary code via a crafted packet.GLSA-200501-27DSA-65313946ethereal-x11-bo(19004)RHSA-2005:037http://www.ethereal.com/appnotes/enpa-sa-00017.htmlP-106oval:org.mitre.oval:def:914012326FLSA-2006:152922MDKSA-2005:013Cross-site scripting (XSS) vulnerability in ht://dig (htdig) before 3.1.6-r7 allows remote attackers to execute arbitrary web script or HTML via the config parameter, which is not properly sanitized before it is displayed in an error message.12442DSA-680htdig-config-xss(19223)RHSA-2005:073GLSA-200502-161013078oval:org.mitre.oval:def:10878RHSA-2005:090FLSA-2006:152907MDKSA-2005:06317415174141500714795143031427614255SCOSA-2005.46Heap-based buffer overflow in less in Red Hat Enterprise Linux 3 allows attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted file, as demonstrated using the UTF-8 locale.https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=145527FLSA:2404less-file-bo(19131)RHSA-2005:068oval:org.mitre.oval:def:11027The alsa-lib package in Red Hat Linux 4 disables stack protection for the libasound.so library, which makes it easier for attackers to execute arbitrary code if there are other vulnerabilities in the library.RHSA-2005:033oval:org.mitre.oval:def:10355The publisher handler for mod_python 2.7.8 and earlier allows remote attackers to obtain access to restricted objects via a crafted URL.VU#356409DSA-689GLSA-200502-142005-000312519FLSA:152896RHSA-2005:104RHSA-2005:1001013156oval:org.mitre.oval:def:1061720050211 [USN-80-1] mod_python vulnerabilityCLA-2005:926The SimpleXMLRPCServer library module in Python 2.2, 2.3 before 2.3.5, and 2.4, when used by XML-RPC servers that use the register_instance method to register an object without a _dispatch method, allows remote attackers to read or modify globals of the associated module, and possibly execute arbitrary code, via dotted attributes.http://www.python.org/security/PSF-2005-001/DSA-666http://python.org/security/PSF-2005-001/patch-2.2.txt20050203 Python Security Advisory PSF-2005-001 - SimpleXMLRPCServer.pypython-simplexmlrpcserver-bypass(19217)2005-0003RHSA-2005:108oval:org.mitre.oval:def:981112437MDKSA-2005:035101308314128A regression error in the Red Hat Enterprise Linux 4 kernel 4GB/4GB split patch omits an "access check," which allows local users to cause a denial of service (crash).red-hat-regression-dos(20618)12599RHSA-2005:092oval:org.mitre.oval:def:10425Unknown vulnerability in the Red Hat Enterprise Linux 4 kernel 4GB/4GB split patch, when using the hugemem kernel, allows local users to read and write to arbitrary kernel memory and gain privileges via certain syscalls.red-hat-patch-gain-privileges(20619)12599RHSA-2005:092oval:org.mitre.oval:def:11249Unknown vulnerability in the Red Hat Enterprise Linux 4 kernel 4GB/4GB split patch, when running on x86 with the hugemem kernel, allows local users to cause a denial of service (crash).12599RHSA-2005:092red-hat-patch-dos(20620)oval:org.mitre.oval:def:11647** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.Buffer overflow in the gopherToHTML function in the Gopher reply parser for Squid 2.5.STABLE7 and earlier allows remote malicious Gopher servers to cause a denial of service (crash) via crafted responses.RHSA-2005:061RHSA-2005:060DSA-651GLSA-200501-25138252005-0003http://www.squid-cache.org/Versions/v2/2.5/bugs/squid-2.5.STABLE7-gopher_html_parsing.patchhttp://www.squid-cache.org/Advisories/SQUID-2005_1.txtSUSE-SA:2005:006oval:org.mitre.oval:def:11146CLA-2005:92312276MDKSA-2005:014FLSA-2006:152809The WCCP message parsing code in Squid 2.5.STABLE7 and earlier allows remote attackers to cause a denial of service (crash) via malformed WCCP messages with source addresses that are spoofed to reference Squid's home router and invalid WCCP_I_SEE_YOU cache numbers.2005-0003http://www.squid-cache.org/Advisories/SQUID-2005_2.txtRHSA-2005:061RHSA-2005:060SUSE-SA:2005:006DSA-651GLSA-200501-2513825CLA-2005:923http://www.squid-cache.org/Versions/v2/2.5/bugs/squid-2.5.STABLE7-wccp_denial_of_service.patchoval:org.mitre.oval:def:102691227512886MDKSA-2005:0141012882FLSA-2006:152809Memory leak in the NTLM fakeauth_auth helper for Squid 2.5.STABLE7 and earlier allows remote attackers to cause a denial of service (memory consumption).http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-fakeauth_authRHSA-2005:061RHSA-2005:060GLSA-200501-25CLA-2005:9232005-0003SUSE-SA:2005:006oval:org.mitre.oval:def:10233123241012818FLSA-2006:152809The NTLM component in Squid 2.5.STABLE7 and earlier allows remote attackers to cause a denial of service (crash) via a malformed NTLM type 3 message that triggers a NULL dereference.2005-0003http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-fakeauth_authRHSA-2005:061RHSA-2005:060SUSE-SA:2005:006GLSA-200501-2513789oval:org.mitre.oval:def:11646122201012818FLSA-2006:152809Multiple buffer overflows in the SDL port of abuse (abuse-SDL) before 2.00 allow local users to execute arbitrary code via the command line.DSA-69114495The SDL port of abuse (abuse-SDL) before 2.00 does not properly drop privileges before creating certain files, which allows local users to create or overwrite arbitrary files.DSA-6911449514610Format string vulnerability in the movemail utility in (1) Emacs 20.x, 21.3, and possibly other versions, and (2) XEmacs 21.4 and earlier, allows remote malicious POP3 servers to execute arbitrary code via crafted packets.xemacs-movemail-format-string(19246)RHSA-2005:133RHSA-2005:112RHSA-2005:110DSA-685DSA-671DSA-670oval:org.mitre.oval:def:940820050207 [USN-76-1] Emacs vulnerability12462FLSA-2006:152898MDKSA-2005:038Buffer overflow in the socket_getline function in Newspost 2.1.1 and earlier allows remote malicious NNTP servers to execute arbitrary code via a long string without a newline character.GLSA-200502-05newspost-socketgetline-bo(19178)http://www.vuxml.org/freebsd/7f13607b-6948-11d9-8937-00065be4b5b6.html14092http://people.freebsd.org/~niels/issues/newspost-20050114.txt20050202 RE: SECURITEY.NNOV.RU NewsPost buffer overflow [EXPLOIT]12418101305614098Integer overflow in camel-lock-helper in Evolution 2.0.2 and earlier allows local users or remote malicious POP3 servers to execute arbitrary code via a length value of -1, which leads to a zero byte memory allocation and a buffer overflow.evolution-camellockhelper-bo(19031)12354RHSA-2005:397DSA-673GLSA-200501-35CLA-2005:925RHSA-2005:238oval:org.mitre.oval:def:9616USN-69-1MDKSA-2005:024101298113830PHP remote file inclusion vulnerability in webmail.php in SquirrelMail before 1.4.4 allows remote attackers to execute arbitrary PHP code by modifying a URL parameter to reference a URL on a remote web server that contains the code.http://www.squirrelmail.org/security/issue/2005-01-19?PHPSESSID=8af117822fb1ca3aa966a64248b5d223RHSA-2005:135RHSA-2005:09913962APPLE-SA-2005-03-21squirrelmail-frame-file-include(19037)GLSA-200501-39oval:org.mitre.oval:def:1067020050129 SquirrelMail Security AdvisoryCross-site scripting (XSS) vulnerability in webmail.php in SquirrelMail before 1.4.4 allows remote attackers to inject arbitrary web script or HTML via certain integer variables.http://www.squirrelmail.org/security/issue/2005-01-20RHSA-2005:135RHSA-2005:099DSA-662140961396220050129 SquirrelMail Security AdvisoryAPPLE-SA-2005-03-21oval:org.mitre.oval:def:10568squirrelmail-webmailphp-xss(19036)GLSA-200501-39Unknown vulnerability in typespeed 0.4.1 and earlier allows local users to gain privileges.DSA-684SSLeay.pm in libnet-ssleay-perl before 1.25 uses the /tmp/entropy file for entropy if a source is not set in the EGD_PATH variable, which allows local users to reduce the cryptographic strength of certain operations by modifying the file.USN-113-113471MDKSA-2006:02318639bsmtpd 2.3 and earlier does not properly sanitize e-mail addresses, which allows remote attackers to execute arbitrary commands.DSA-690Apache mod_auth_radius 1.5.4 and libpam-radius-auth allow remote malicious RADIUS servers to cause a denial of service (crash) via a RADIUS_REPLY_MESSAGE with a RADIUS attribute length of 1, which leads to a memcpy operation with a -1 length argument.modauthradius-dos(18841)DSA-659http://security.lss.hr/en/index.php?page=details&ID=LSS-2005-01-0220050111 Apache mod_auth_radius remote integer overflow1221710128291404613773Hyper-Threading technology, as used in FreeBSD and other operating systems that are run on Intel Pentium and other processors, allows local users to use a malicious thread to create covert channels, monitor the execution of other threads, and obtain sensitive information such as cryptographic keys, via a timing attack on memory cache misses.VU#911878127241013967ADV-2005-3002ADV-2005-0540RHSA-2005:800RHSA-2005:476http://www.daemonology.net/papers/htt.pdfhttp://www.daemonology.net/hyperthreading-considered-harmful/http://www-1.ibm.com/support/docview.wss?uid=isg1SSRVHMCHMC_C081516_7541017391816515348oval:org.mitre.oval:def:9747[openbsd-misc] 20050304 Re: FreeBSD hiding security stuff[freebsd-security] 20050304 [Fwd: Re: FW:FreeBSD hiding security stuff][freebsd-hackers] 20050304 Re: FW:FreeBSD hiding security stuffSCOSA-2005.24Internet Explorer 6 on Windows XP SP2 allows remote attackers to bypass the file download warning dialog and possibly trick an unknowledgeable user into executing arbitrary code via a web page with a body element containing an onclick tag, as demonstrated using the createElement function.20050114 Internet Explorer (SP2) - Remote File DownloadStack-based buffer overflow in the websql CGI program in MySQL MaxDB 7.5.00 allows remote attackers to execute arbitrary code via a long password parameter.20050113 MySQL MaxDB WebAgent websql logon Buffer Overflow Vulnerability122651012893The web-based administrative interface for 3Com OfficeConnect Wireless 11g Access Point (AP) 1.00.08, and possibly earlier versions before 1.03.07A, allows remote attackers to bypass authentication and obtain sensitive information by directly accessing the (1) config.bin (2) profile.wlp?PN=ggg or (3) event.logs URLs.3com-officeconnect-information-disclosure(18994)1232220050120 3Com OfficeConnect Wireless 11g AP Information Disclosure Vulnerability101295813942inpview in SGI IRIX allows local users to execute arbitrary commands via the SUN_TTSESSION_CMD environment variable, which is executed by inpview without dropping privileges.irix-inpview-gain-privileges(18894)20050113 SGI IRIX inpview Design Error Vulnerability1385812259129151012894vsdatant.sys in Zone Lab ZoneAlarm before 5.5.062.011, ZoneAlarm Wireless before 5.5.080.000, Check Point Integrity Client 4.x before 4.5.122.000 and 5.x before 5.1.556.166 do not properly verify that the ServerPortName argument to the NtConnectPort function is a valid memory address, which allows local users to cause a denial of service (system crash) when ZoneAlarm attempts to dereference an invalid pointer.20050211 ZoneAlarm 5.1 Invalid Pointer Dereference Vulnerabilityhttp://download.zonelabs.com/bin/free/securityAlert/19.html1253114256Stack-based buffer overflow in DataRescue Interactive Disassembler (IDA) Pro 4.7 allows attackers to execute arbitrary code via a PE file with an Import Address Table containing a long import library name.database-ida-portable-executable-bo(19042)http://www.datarescue.com/ubb/ultimatebb.php?/topic/2/146.html20050124 DataRescue Interactive Disassembler Pro Buffer Overflow Vulnerability12353101297513980AWStats 6.1, and other versions before 6.3, allows remote attackers to execute arbitrary commands via shell metacharacters in the configdir parameter to aswtats.pl.VU#27229620050117 AWStats Remote Command Execution Vulnerability13893http://awstats.sourceforge.net/docs/awstats_changelog.txt1229813002http://packetstormsecurity.org/0501-exploits/AWStatsVulnAnalysis.pdfBuffer overflow in XShisen before 1.36 allows local users to execute arbitrary code via a long GECOS field.http://www.vuxml.org/freebsd/56971fa6-641c-11d9-a097-000854d03344.htmlhttp://bugs.debian.org/cgi-bin/bugreport.cgi?bug=289784helvis 1.8h2_1 and earlier stores recovery files in world readable directories with world readable permissions, which allows local users to read the recovered files of other users.http://www.vuxml.org/freebsd/bb99f803-5fde-11d9-b721-00065be4b5b6.htmlhelvis 1.8h2_1 and earlier allows local users to recover and read the files of other users via the elvrec setuid program.http://www.vuxml.org/freebsd/bb99f803-5fde-11d9-b721-00065be4b5b6.htmlhelvis 1.8h2_1 and earlier allows local users to delete arbitrary files via the elvprsv setuid program.http://people.freebsd.org/~niels/ports/korean/helvis/issues.txtMultiple buffer overflows in golddig 2.0 and earlier allow local users to execute arbitrary code via (1) a long map name command line argument or (2) a long username as recorded in the USER environment variable.http://www.vuxml.org/freebsd/949c470e-528f-11d9-ac20-00065be4b5b6.htmlgolddig-long-username-bo(19040)golddig-long-mapname-bo(19039)** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2005-0975. Reason: This candidate is a duplicate of CVE-2005-0975. Notes: All CVE users should reference CVE-2005-0975 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.The coda_pioctl function in the coda functionality (pioctl.c) for Linux kernel 2.6.9 and 2.4.x before 2.4.29 may allow local users to cause a denial of service (crash) or execute arbitrary code via negative vi.in_size or vi.out_size values, which may trigger a buffer overflow.ADV-2005-1878[linux-kernel] 20050107 [PATCH 2.6.10-mm2] fs/coda Re: [Coverity] Untrusted user data in kernel[linux-kernel] 20050107 [PATCH 2.4.29-pre3-bk4] fs/coda Re: [Coverity] Untrusted user data in kernel[linux-kernel] 20050105 Re: [Coverity] Untrusted user data in kernel[linux-kernel] 20041216 [Coverity] Untrusted user data in kerneloval:org.mitre.oval:def:1169014967FLSA:157459-1RHSA-2006:0191RHSA-2005:663DSA-1082DSA-1070DSA-1069DSA-1067DSA-10171013018203382020220163193741868417002The "at" commands on Mac OS X 10.3.7 and earlier do not properly drop privileges, which allows local users to (1) delete arbitrary files via atrm, (2) execute arbitrary programs via the -f argument to batch, or (3) read arbitrary files via the -f argument to batch, which generates a job file that is readable by the local user.VU#678150APPLE-SA-2005-01-25macos-at-gain-privileges(18981)http://www.digitalmunition.com/DMA[2005-0127a].txt20050127 DMA[2005-0127a] - 'Apple OSX batch family poor use of setuid'ColorSync on Mac OS X 10.3.7 and 10.3.8 allows attackers to execute arbitrary code via malformed ICC color profiles that modify the heap.VU#980078macos-icc-profile-bo(19083)APPLE-SA-2005-01-25123671013000Mail in Mac OS X 10.3.7, when generating a Message-ID header, generates a GUUID that includes information that identifies the Ethernet hardware being used, which allows remote attackers to link mail messages to a particular machine.VU#464662macos-ethernet-address-disclosure(19085)14005APPLE-SA-2005-01-251013001The Quick Buttons feature in Konversation 0.15 allows remote attackers to execute certain IRC commands via a channel name containing "%" variables, which are recursively expanded by the Server::parseWildcards function when the Part Button is selected.20050119 Multiple vulnerabilities in Konversationkonversation-expansion-execute-code(19025)20050119 Multiple vulnerabilities in Konversation12312http://www.kde.org/info/security/advisory-20050121-1.txtGLSA-200501-3410129721398913919Certain Perl scripts in Konversation 0.15 allow remote attackers to execute arbitrary commands via shell metacharacters in (1) channel names or (2) song names that are not properly quoted when the user runs IRC sripts.20050119 Multiple vulnerabilities in Konversationkonversation-perlscript-execute-code(19008)20050119 Multiple vulnerabilities in Konversation12312http://www.kde.org/info/security/advisory-20050121-1.txtGLSA-200501-3410129721398913919The Quick Connection dialog in Konversation 0.15 inadvertently uses the user-provided password as the nickname instead of the user-provided nickname when connecting to the IRC server, which could leak the password to other users.20050119 Multiple vulnerabilities in Konversationkonversation-nick-password-information-disclosure(19038)20050119 Multiple vulnerabilities in Konversation12312http://www.kde.org/info/security/advisory-20050121-1.txtGLSA-200501-3410129721398913919ClamAV 0.80 and earlier allows remote attackers to cause a denial of service (clamd daemon crash) via a ZIP file with malformed headers.2005-0003GLSA-200501-46http://sourceforge.net/project/shownotes.php?release_id=300116CLA-2005:928MDKSA-2005:025The X server in SCO UnixWare 7.1.1, 7.1.3, and 7.1.4 does not properly create socket directories in /tmp, which could allow attackers to hijack local sockets.SCOSA-2005.8ADV-2005-0077The unw_unwind_to_user function in unwind.c on Itanium (ia64) architectures in Linux kernel 2.6 allows local users to cause a denial of service (system crash).https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=148868RHSA-2005:366RHSA-2005:28415019oval:org.mitre.oval:def:9040http://linux.bkbits.net:8080/linux-2.6/cset@41f2beablXVnAs_6fznhhITh1j5hZg13266RHSA-2005:293DSA-1082DSA-1070DSA-1069DSA-1067203382020220163The Linux kernel before 2.6.11 on the Itanium IA64 platform has certain "ptrace corner cases" that allow local users to cause a denial of service (crash) via crafted syscalls, possibly related to MCA/INIT, a different vulnerability than CVE-2005-1761.https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=155283https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=148862RHSA-2005:663RHSA-2005:420http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.11[linux-ia64] 20040916 Re: [Patch] Per CPU MCA/INIT data save areas17002http://openvz.org/news/updates/kernel-022stab045.1-releasedADV-2005-1878oval:org.mitre.oval:def:11628[kernel-svn-changes] 20050816 r3920 - in branches/dist/sarge-security: . kernel kernel/i386 kernel/source kernel/source/kernel-source-2.6.8-2.6.8/debianLinux kernel 2.6 on Itanium (ia64) architectures allows local users to cause a denial of service via a "missing Itanium syscall table entry."RHSA-2005:293RHSA-2005:284oval:org.mitre.oval:def:11039rpc.mountd in SGI IRIX 6.5.25, 6.5.26, and 6.5.27 does not correctly allow access to anonymous clients that connect from a system whose hostname can not be determined. NOTE: while this issue occurs in a security mechanism, there is no apparent attacker role and probably does not satisfy the CVE definition of a vulnerability.P-214ADV-2005-070215619Unknown vulnerability in rpc.mountd in SGI IRIX 6.5.25, 6.5.26, and 6.5.27 does not sufficiently restrict access rights for read-mostly exports, which allows attackers to conduct unauthorized activities.P-214ADV-2005-070215619Buffer overflow in PeID allows attackers to execute arbitrary code via a PE file with an Import Address Table containing a long import library name.database-ida-portable-executable-bo(19042)20050124 DataRescue Interactive Disassembler Pro Buffer Overflow Vulnerability1235513984Firefox before 1.0 and Mozilla before 1.7.5 allow remote attackers to load local files via links "with a custom getter and toString method" that are middle-clicked by the user to be opened in a new tab.mozilla-firefox-file-upload(19168)RHSA-2005:335RHSA-2005:323https://bugzilla.mozilla.org/show_bug.cgi?id=249332http://www.mozilla.org/security/announce/mfsa2005-01.htmloval:org.mitre.oval:def:1075612407oval:org.mitre.oval:def:100057Firefox 0.9, Thunderbird 0.6 and other versions before 0.9, and Mozilla 1.7 before 1.7.5 save temporary files with world-readable permissions, which allows local users to read certain web content or attachments that belong to other users, e.g. content that is managed by helper applications such as PDF.mozilla-world-readable(17832)RHSA-2005:335https://bugzilla.mozilla.org/show_bug.cgi?id=251297SUSE-SA:2006:004http://www.mozilla.org/security/announce/mfsa2005-02.htmloval:org.mitre.oval:def:9543RHSA-2005:384SUSE-SA:2006:02219823oval:org.mitre.oval:def:100056Firefox before 1.0 and Mozilla before 1.7.5 display the SSL lock icon when an insecure page loads a binary file from a trusted site, which could facilitate phishing attacks.https://bugzilla.mozilla.org/show_bug.cgi?id=257308mozilla-ssl-spoofing(19166)RHSA-2005:335http://www.mozilla.org/security/announce/mfsa2005-03.htmloval:org.mitre.oval:def:1129712407RHSA-2005:384oval:org.mitre.oval:def:100055Firefox before 1.0 and Mozilla before 1.7.5 display the secure site lock icon when a view-source: URL references a secure SSL site while an insecure page is being loaded, which could facilitate phishing attacks.mozilla-ssl-view-source-spoofing(19169)RHSA-2005:335RHSA-2005:323https://bugzilla.mozilla.org/show_bug.cgi?id=262689http://www.mozilla.org/security/announce/mfsa2005-04.htmloval:org.mitre.oval:def:1101612407oval:org.mitre.oval:def:100054Firefox before 1.0 does not properly distinguish between user-generated and synthetic click events, which allows remote attackers to use Javascript to bypass the file download prompt when the user uses the Alt-click feature.https://bugzilla.mozilla.org/show_bug.cgi?id=265176mozilla-script-click-event-bypass(19170)http://www.mozilla.org/security/announce/mfsa2005-07.html12407oval:org.mitre.oval:def:100051Firefox before 1.0 and Mozilla before 1.7.5 allow remote attackers to obtain sensitive data from the clipboard via Javascript that generates a middle-click event on systems for which a middle-click performs a paste operation.RHSA-2005:335https://bugzilla.mozilla.org/show_bug.cgi?id=265728mozilla-middle-click-information-disclosure(19171)http://www.mozilla.org/security/announce/mfsa2005-08.htmloval:org.mitre.oval:def:1036212407RHSA-2005:384Firefox before 1.0 and Mozilla before 1.7.5, when configured to use a proxy, respond to 407 proxy auth requests from arbitrary servers, which allows remote attackers to steal NTLM or SPNEGO credentials.mozilla-407-proxy-obtain-information(19174)RHSA-2005:323https://bugzilla.mozilla.org/show_bug.cgi?id=267263http://www.mozilla.org/security/announce/mfsa2005-09.htmloval:org.mitre.oval:def:957812407oval:org.mitre.oval:def:100049Thunderbird before 0.9, when running on Windows systems, uses the default handler when processing javascript: links, which invokes Internet Explorer and may expose the Thunderbird user to vulnerabilities in the version of Internet Explorer that is installed on the user's system. NOTE: since the invocation between multiple products is a common practice, and the vulnerabilities inherent in multi-product interactions are not easily enumerable, this issue might be REJECTED in the future.thunderbird-javascript-handler-launch(19173)https://bugzilla.mozilla.org/show_bug.cgi?id=263546http://www.mozilla.org/security/announce/mfsa2005-10.html12407oval:org.mitre.oval:def:100048Thunderbird 0.6 through 0.9 and Mozilla 1.7 through 1.7.3 does not obey the network.cookie.disableCookieForMailNews preference, which could allow remote attackers bypass the user's intended privacy and security policy by using cookies in e-mail messages.https://bugzilla.mozilla.org/show_bug.cgi?id=268107mozilla-cookie-policy-bypass(19172)RHSA-2005:335RHSA-2005:323RHSA-2005:094http://www.mozilla.org/security/announce/mfsa2005-11.htmlSUSE-SA:2006:004oval:org.mitre.oval:def:1140712407SUSE-SA:2006:00419823oval:org.mitre.oval:def:100047Firefox before 1.0 allows the user to store a (1) javascript: or (2) data: URLs as a Livefeed bookmark, then executes it in the security context of the currently loaded page when the user later accesses the bookmark, which could allow remote attackers to execute arbitrary code.https://bugzilla.mozilla.org/show_bug.cgi?id=265668mozilla-firefox-livefeed-xss(19187)http://www.mozilla.org/security/announce/mfsa2005-12.html12407oval:org.mitre.oval:def:100046Unknown vulnerability in the installation of Adobe License Management Service, as used in Adobe Photoshop CS, Adobe Creative Suite 1.0, and Adobe Premiere Pro 1.5, allows attackers to gain administrator privileges.http://www.adobe.com/support/techdocs/331688.html101417010141691014168PHP remote file inclusion vulnerability in Squirrelmail 1.2.6 allows remote attackers to execute arbitrary code via "URL manipulation."VU#203214DSA-66214096The PerlIO implementation in Perl 5.8.0, when installed with setuid support (sperl), allows local users to create arbitrary files via the PERLIO_DEBUG variable.perl-perliodebug-file-overwrite(19207)2005-000312426RHSA-2005:105RHSA-2005:103GLSA-200502-1320050207 DMA[2005-0131a] - 'Setuid Perl PERLIO_DEBUG root owned file creation'20050202 [USN-72-1] Perl vulnerabilitieshttp://www.digitalmunition.com/DMA[2005-0131a].txtoval:org.mitre.oval:def:10404MDKSA-2005:031http://support.avaya.com/elmodocs2/security/ASA-2006-163.htm2164614120FLSA-2006:152845CLSA-2006:1056Buffer overflow in the PerlIO implementation in Perl 5.8.0, when installed with setuid support (sperl), allows local users to execute arbitrary code by setting the PERLIO_DEBUG variable and executing a Perl script whose full pathname contains a long directory tree.perl-perliodebug-bo(19208)2005-000312426RHSA-2005:105RHSA-2005:103GLSA-200502-13http://www.digitalmunition.com/DMA[2005-0131b].txtoval:org.mitre.oval:def:1080320050207 DMA[2005-0131b] - 'Setuid Perl PERLIO_DEBUG20050202 [USN-72-1] Perl vulnerabilitiesMDKSA-2005:03114120FLSA-2006:152845CLSA-2006:1056The confirm add-on in SmartList 3.15 and earlier allows attackers to subscribe arbitrary e-mail addresses by using a valid cookie that specifies an address other than the address for which the cookie was assigned.DSA-720Format string vulnerability in bidwatcher before 1.3.17 allows remote malicious web servers from eBay, or a spoofed eBay server, to cause a denial of service and possibly execute arbitrary code via certain responses.GLSA-200503-06DSA-687The tpkg-* scripts in the toolchain-source 3.0.4 package on Debian GNU/Linux 3.0 allow local users to overwrite arbitrary files via a symlink attack on temporary files.12540DSA-679toolchain-source-symlink(19317)14277Multiple buffer overflows in unace 1.2b allow attackers to execute arbitrary code via (1) 2 overflows in ACE archives, (2) a long command line argument, or (3) certain "Ready for next volume" messages.VU#215006SUSE-SR:2005:0161435920050222 unace-1.2b multiple buffer overflows and directory traversal bugs12630Multiple directory traversal vulnerabilities in unace 1.2b allow attackers to overwrite arbitrary files via an ACE archive containing (1) ../ sequences or (2) absolute pathnames.SUSE-SR:2005:0161435920050222 unace-1.2b multiple buffer overflows and directory traversal bugs12628Stack-based buffer overflow in the get_internal_addresses function in the pluto application for Openswan 1.x before 1.0.9, and Openswan 2.x before 2.3.0, when compiled with XAUTH and PAM enabled, allows remote authenticated attackers to execute arbitrary code.openswan-xauth-pam-bo(19078)http://www.openswan.org/support/vuln/IDEF0785/20050126 Openswan XAUTH/PAM Buffer Overflow Vulnerability12377FEDORA-2005-0821319510130141406214038squid_ldap_auth in Squid 2.5 and earlier allows remote authenticated users to bypass username-based Access Control Lists (ACLs) via a username with a space at the beginning or end, which is ignored by the LDAP server.VU#924198http://www.squid-cache.org/Versions/v2/2.5/bugs/squid-2.5.STABLE7-ldap_spaces.patchhttp://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-ldap_spacesRHSA-2005:061RHSA-2005:060SUSE-SA:2005:006DSA-66720050207 [USN-77-1] Squid vulnerabilitiesCLA-2005:923http://www.squid-cache.org/bugs/show_bug.cgi?id=1187oval:org.mitre.oval:def:1025112431MDKSA-2005:034FLSA-2006:152809Squid 2.5 up to 2.5.STABLE7 allows remote attackers to poison the cache or conduct certain attacks via headers that do not follow the HTTP specification, including (1) multiple Content-Length headers, (2) carriage return (CR) characters that are not part of a CRLF pair, and (3) header names containing whitespace characters.VU#768702RHSA-2005:061RHSA-2005:060http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-header_parsingFEDORA-2005-373SUSE-SA:2005:006oval:org.mitre.oval:def:1065620050207 [USN-77-1] Squid vulnerabilitiesCLA-2005:93112412MDKSA-2005:034FLSA-2006:152809Squid 2.5 up to 2.5.STABLE7 allows remote attackers to poison the cache via an HTTP response splitting attack.VU#625878RHSA-2005:061RHSA-2005:060SUSE-SA:2005:006DSA-66720050207 [USN-77-1] Squid vulnerabilitiesCLA-2005:931http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-response_splittinghttp://www.squid-cache.org/Advisories/SQUID-2005_5.txtFEDORA-2005-373oval:org.mitre.oval:def:1160512433MDKSA-2005:034FLSA-2006:152809The shmctl function in Linux 2.6.9 and earlier allows local users to unlock the memory of other processes, which could cause sensitive memory to be swapped to disk, which could allow it to be read by other users once it has been released.RHSA-2005:092oval:org.mitre.oval:def:877820050215 [USN-82-1] Linux kernel vulnerabilitiesCLA-2005:93012598RHSA-2005:4721960720060402-01-Uoval:org.mitre.oval:def:1225nls_ascii.c in Linux before 2.6.8.1 uses an incorrect table size, which allows attackers to cause a denial of service (kernel crash) via a buffer overflow.RHSA-2005:092http://linux.bkbits.net:8080/linux-2.6/cset@41e2bfbeOiXFga62XrBhzm7Kv9QDmQCLA-2005:93012598oval:org.mitre.oval:def:1029820050215 [USN-82-1] Linux kernel vulnerabilitiesRace condition in the setsid function in Linux before 2.6.8.1 allows local users to cause a denial of service (crash) and possibly access portions of kernel memory, related to TTY changes, locking, and semaphores.RHSA-2005:092http://linux.bkbits.net:8080/linux-2.6/cset@41ddda70CWJb5nNL71T4MOlG2sMG8A12598oval:org.mitre.oval:def:1064720050215 [USN-82-1] Linux kernel vulnerabilitiesCLA-2005:930Linux kernel 2.4.x and 2.6.x allows local users to cause a denial of service (CPU and memory consumption) and bypass RLIM_MEMLOCK limits via the mlockall call.RHSA-2005:092ADV-2005-1878oval:org.mitre.oval:def:989020050107 grsecurity 2.1.0 release / 5 Linux kernel advisoriesCLA-2005:930RHSA-2005:66317002Multiple integer signedness errors in the sg_scsi_ioctl function in scsi_ioctl.c for Linux 2.6.x allow local users to read or modify kernel memory via negative integers in arguments to the scsi ioctl, which bypass a maximum length check before calling the copy_from_user and copy_to_user functions.RHSA-2005:092MDKSA-2005:219oval:org.mitre.oval:def:1066720050107 grsecurity 2.1.0 release / 5 Linux kernel advisoriesCLA-2005:9301219820050107 grsecurity 2.1.0 release / 5 Linux kernel advisoriesMDKSA-2005:219MDKSA-2005:21817826The mod_dosevasive module 1.9 and earlier for Apache creates temporary files with predictable filenames, which could allow remote attackers to overwrite arbitrary files via a symlink attack.moddosevasive-symlink(18765)12181http://security.lss.hr/index.php?page=details&ID=LSS-2005-01-0120050111 Mod_dosevasive symlink and race vulnerability13725ftpfile in the Vacation plugin 0.15 and earlier for Squirrelmail allows local users to execute arbitrary commands via shell metacharacters in a command line argument.vacation-ftpfile-command-execution(18855)http://security.lss.hr/en/index.php?page=details&ID=LSS-2005-01-0320050111 Squirrelmail vacation v0.15 local root exploithttp://www.squirrelmail.org/plugin_view.php?id=5112222101286613791Directory traversal vulnerability in ftpfile in the Vacation plugin 0.15 and earlier for Squirrelmail allows local users to read arbitrary files via a .. (dot dot) in a get request.vacation-ftpfile-directory-traversal(18856)http://security.lss.hr/en/index.php?page=details&ID=LSS-2005-01-0320050111 Squirrelmail vacation v0.15 local root exploithttp://www.squirrelmail.org/plugin_view.php?id=5112222101286613791Stack-based buffer overflow in NodeManager Professional 2.00 allows remote attackers to execute arbitrary commands via a LinkDown-Trap packet that contains a long OCTET-STRING in the Trap variable-bindings field.nodemanager-linkdown-bo(18937)http://www.security.org.sg/vuln/nodemanager200.html1388120050117 [SIG^2 G-TEC] NodeManager Professional V2.00 Buffer Overflow Vulnerability122831012915Cisco IOS 12.1YD, 12.2T, 12.3 and 12.3T, when configured for the IOS Telephony Service (ITS), CallManager Express (CME) or Survivable Remote Site Telephony (SRST), allows remote attackers to cause a denial of service (device reboot) via a malformed packet to the SCCP port.cisco-ios-sccp-dos(18956)20050119 Vulnerability in Cisco IOS Embedded Call Processing Solutionsoval:org.mitre.oval:def:4849101294513913Stack-based buffer overflow in the SetSkin function in AtHoc toolbar allows remote attackers to execute arbitrary code via a long skin name.athoc-toolbar-bo(17627)11341http://www.ngssoftware.com/advisories/athoc-01full.txt20050119 Multiple vulnerabilities in the AtHoc Toolbar (#NISR19012005c)20041006 Patch available for high risk flaws in the AtHoc ToolbarFormat string vulnerability in the SetBaseURL function in AtHoc toolbar allows remote attackers to execute arbitrary code via format string specifiers in an invalid URL that is recorded in the debug log.athoc-toolbar-format-string(17628)11341http://www.ngssoftware.com/advisories/athoc-01full.txt20050119 Multiple vulnerabilities in the AtHoc Toolbar (#NISR19012005c)20041006 Patch available for high risk flaws in the AtHoc ToolbarStack-based buffer overflow in the HandleAction function in RealPlayer 10.5 (6.0.12.1040) and earlier allows remote attackers to execute arbitrary code via a long ShowPreferences argument.VU#69839012311http://service.real.com/help/faq/security/040928_player/EN/20050119 RealPlayer 'ShowPreferences' Buffer Overflow Vulnerability (#NISR19012005e)20050119 RealPlayer 'ShowPreferences' Buffer Overflow Vulnerability (#NISR19012005e)20041006 Patch available for multiple high risk vulnerabilities in RealPlayerDirectory traversal vulnerability in RealPlayer 10.5 (6.0.12.1040) and earlier allows remote attackers to delete arbitrary files via a Real Metadata Packages (RMP) file with a FILENAME tag containing .. (dot dot) sequences in a filename that ends with a ? (question mark) and an allowed file extension (e.g. .mp3), which bypasses the check for the file extension.realplayer-media-file-deletion(17551)11308http://www.ngssoftware.com/advisories/real-02full.txthttp://service.real.com/help/faq/security/040928_player/EN/1267220050119 RealPlayer Arbitrary File Deletion Vulnerability (#NISR19012005f)20041006 Patch available for multiple high risk vulnerabilities in RealPlayerOff-by-one buffer overflow in the processing of tags in Real Metadata Package (RMP) files in RealPlayer 10.5 (6.0.12.1040) and earlier could allow remote attackers to execute arbitrary code via a long tag.realplayer-long-filename-offbyone-bo(18982)http://www.ngssoftware.com/advisories/real-03full.txthttp://service.real.com/help/faq/security/040928_player/EN/20050119 RealPlayer Miscellaneous Vulnerabilities (#NISR19012005g)20041006 Patch available for multiple high risk vulnerabilities in RealPlayerDirectory traversal vulnerability in the parsing of Skin file names in RealPlayer 10.5 (6.0.12.1040) and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in an RJS filename.realplayer-rjs-filenane-directory-traversal(18984)http://www.ngssoftware.com/advisories/real-03full.txthttp://service.real.com/help/faq/security/040928_player/EN/20050119 RealPlayer Miscellaneous Vulnerabilities (#NISR19012005g)20041006 Patch available for multiple high risk vulnerabilities in RealPlayerBuffer overflow in the (1) -v and (2) -a switches in mRouter in iSync 1.5 in Mac OS X 10.3.7 and earlier allows local users to execute arbitrary code.isync-mrouter-bo(19011)20050122 Mac OS X 10.3 iSync Privilege EscalationAPPLE-SA-2005-04-1912334101297413965Squid 2.5, when processing the configuration file, parses empty Access Control Lists (ACLs), including proxy_auth ACLs without defined auth schemes, in a way that effectively removes arguments, which could allow remote attackers to bypass intended ACLs if the administrator ignores the parser warnings.VU#260421http://www.squid-cache.org/Versions/v2/2.5/bugs/squid-2.5.STABLE7-empty_acls.patchhttp://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-empty_aclsDSA-66720050221 [USN-84-1] Squid vulnerabilitiesCLA-2005:923http://www.squid-cache.org/bugs/show_bug.cgi?id=1166FLSA-2006:152809Cisco IOS 12.0S through 12.3YH allows remote attackers to cause a denial of service (device restart) via a crafted IPv6 packet.TA05-026AVU#472582cisco-ios-ipv6-dos(19072)20050126 Multiple Crafted IPv6 Packets Cause Reloadoval:org.mitre.oval:def:5813Cisco IOS 12.0 through 12.3YL, with BGP enabled and running the bgp log-neighbor-changes command, allows remote attackers to cause a denial of service (device reload) via a malformed BGP packet.TA05-026AVU#689326cisco-ios-bgp-packetdos(19074)20050126 Cisco IOS Misformed BGP Packet Causes Reloadoval:org.mitre.oval:def:5652101301314034Cisco IOS 12.1T, 12.2, 12.2T, 12.3 and 12.3T, with Multi Protocol Label Switching (MPLS) installed but disabled, allows remote attackers to cause a denial of service (device reload) via a crafted packet sent to the disabled interface.TA05-026AVU#583638cisco-ios-mpls-dos(19071)20050126 Crafted Packet Causes Reload on Cisco Routers12369101301514031oval:org.mitre.oval:def:5662A logic error in the CRAM-MD5 code for the University of Washington IMAP (UW-IMAP) server, when Challenge-Response Authentication Mechanism with MD5 (CRAM-MD5) is enabled, does not properly enforce all the required conditions for successful authentication, which allows remote attackers to authenticate as arbitrary users.http://www.kb.cert.org/vuls/id/CRDY-68QSL5VU#702777RHSA-2005:128GLSA-200502-02oval:org.mitre.oval:def:1130612391MDKSA-2005:02610130371409714057Integer underflow in the Lists_MakeMask() function in lists.c in ngIRCd before 0.8.2 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a long MODE line that causes an incorrect length calculation, which leads to a buffer overflow.ngircd-listmakemask-bo(19143)12397GLSA-200501-40[ngIRCd-ML] 20050126 ngIRCd 0.8.2http://bugs.gentoo.org/show_bug.cgi?id=7970510130471405914056TikiWiki before 1.8.5 does not properly validate files that have been uploaded to the temp directory, which could allow remote attackers to upload and execute arbitrary PHP scripts, a different vulnerability than CVE-2004-1386.GLSA-200501-41http://tikiwiki.org/art10213948D-BUS (dbus) before 0.22 does not properly restrict access to a socket, if the socket address is known, which allows local users to listen or send arbitrary messages on another user's per-user session bus via that socket.RHSA-2005:102MDKSA-2005:105USN-144-1ESB-2005.0435oval:org.mitre.oval:def:1097312435101307515844158331563814119Directory traversal vulnerability in the true_path function in private.py for Mailman 2.1.5 and earlier allows remote attackers to read arbitrary files via ".../....///" sequences, which are not properly cleansed by regular expressions that are intended to remove "../" and "./" sequences.RHSA-2005:137RHSA-2005:136GLSA-200502-1120050209 [USN-78-1] Mailman vulnerabilityAPPLE-SA-2005-03-21DSA-674oval:org.mitre.oval:def:1065720050209 Administrivia: List Compromised due to Mailman VulnerabilitySUSE-SA:2005:007MDKSA-2005:037101314514211** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate has been revoked by its Candidate Numbering Authority (CNA) because it was initially assigned to a problem that was not a security issue. Notes: none.Linux kernel before 2.6.9, when running on the AMD64 and Intel EM64T architectures, allows local users to write to privileged IO ports via the OUTS instruction.RHSA-2005:0922006-000612598RHSA-2005:29318784oval:org.mitre.oval:def:10320KPPP 2.1.2 in KDE 3.1.5 and earlier, when setuid root without certain wrappers, does not properly close a privileged file descriptor for a domain socket, which allows local users to read and write to /etc/hosts and /etc/resolv.conf and gain control over DNS name resolution by opening a number of file descriptors before executing kppp.RHSA-2005:175http://www.kde.org/info/security/advisory-20050228-1.txt20050228 KPPP Privileged File Descriptor Leak VulnerabilityDSA-692CLA-2005:934oval:org.mitre.oval:def:9596The patch for integer overflow vulnerabilities in Xpdf 2.0 and 3.0 (CVE-2004-0888) is incomplete for 64-bit architectures on certain Linux distributions such as Red Hat, which could leave Xpdf users exposed to the original vulnerabilities.11501RHSA-2005:213xpdf-pdf-bo(17818)RHSA-2005:132RHSA-2005:057RHSA-2005:053RHSA-2005:034oval:org.mitre.oval:def:11107MDKSA-2005:056MDKSA-2005:052MDKSA-2005:044MDKSA-2005:043MDKSA-2005:042MDKSA-2005:041Unknown vulnerability in Linux kernel 2.4.x, 2.5.x, and 2.6.x allows NFS clients to cause a denial of service via O_DIRECT.12330SUSE-SA:2005:003CLA-2005:930oval:org.mitre.oval:def:11001RHSA-2005:366The HTML parsing functions in Gaim before 1.1.4 allow remote attackers to cause a denial of service (application crash) via malformed HTML that causes "an invalid memory access," a different vulnerability than CVE-2005-0473.VU#795812RHSA-2005:215GLSA-200503-031438620050225 [USN-85-1] Gaim vulnerabilitiesCLA-2005:933oval:org.mitre.oval:def:10477http://gaim.sourceforge.net/security/?id=1212660FLSA:158543SUSE-SA:2005:036MDKSA-2005:049Netfilter in Linux kernel 2.6.8.1 allows remote attackers to cause a denial of service (kernel crash) via crafted IP packet fragments.SUSE-SA:2005:01820050315 [USN-95-1] Linux kernel vulnerabilitiesCLA-2005:94512598RHSA-2005:420RHSA-2005:366oval:org.mitre.oval:def:11855Netfilter in the Linux kernel 2.6.8.1 allows local users to cause a denial of service (memory consumption) via certain packet fragments that are reassembled twice, which causes a data structure to be allocated twice.SUSE-SA:2005:01820050315 [USN-95-1] Linux kernel vulnerabilitiesCLA-2005:945ADV-2005-18781281614966MDKSA-2005:219MDKSA-2005:219MDKSA-2005:218178261700214295RHSA-2005:663RHSA-2005:366oval:org.mitre.oval:def:10275Buffer overflow in wccp.c in Squid 2.5 before 2.5.STABLE7 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long WCCP packet, which is processed by a recvfrom function call that uses an incorrect length parameter.VU#886006http://www.squid-cache.org/Versions/v2/2.5/bugs/squid-2.5.STABLE7-wccp_buffer_overflow.patchhttp://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-wccp_buffer_overflowRHSA-2005:061RHSA-2005:060SUSE-SA:2005:006DSA-66720050207 [USN-77-1] Squid vulnerabilitiesoval:org.mitre.oval:def:95731243213319MDKSA-2005:034101304514076FLSA-2006:152809The Amp II engine as used by Gore: Ultimate Soldier 1.50 and earlier allows remote attackers to cause a denial of service (infinite loop) via a zero byte UDP packet.amp-3d-socket-dos(18789)12192http://aluigi.altervista.org/adv/amp2zero-adv.txt1375420050106 Socket unreacheable in Amp II engineDirectory traversal vulnerability in WinHKI 1.4d allows remote attackers to overwrite arbitrary files via a .. (dot dot) in a zip file.winhki-zip-directory-traversal(18798)1217620050106 WinAc AND WinHKI ZIP File Directory Transversal 101279813738Directory traversal vulnerability in Simple PHP Blog (SPHPBlog) 0.3.7c allows remote attackers to read or create arbitrary files via a .. (dot dot) in the entry parameter.12193sphp-dotdot-directory-traversal(18802)20050107 Simple PHP Blog directory traversal vulnerability 20050107 Simple PHP Blog directory traversal vulnerability Mozilla 1.6 and possibly other versions allows remote attackers to cause a denial of service (application crash) via a XBM (X BitMap) file with a large (1) height or (2) width value.20050107 Mozilla XBM Image Vulnerabilitymozilla-xbm-dos(18803)Cross-site scripting (XSS) vulnerability in formmail.php in Woltlab Burning Board Lite 1.0.0, 1.0.1e, and possibly other versions, allows remote attackers to inject arbitrary web sript and HTML via the userid parameter.wbb-formmail-userid-xss(18814)1219920050108 Security Advisory: Woltlab Burning Board Lite formmail.php XSS 13782SQL injection vulnerability in index.php in Invision Community Blog allows remote attackers to execute arbitrary SQL commands via the eid parameter.icb-sql-injection(18815)1220520050109 SQL Injection Vulnerability in Invision Community Blog12817101283113783ClamAV 0.80 and earlier allows remote attackers to bypass virus scanning via a base64 encoded image in a data: (RFC 2397) URL.GLSA-200501-46http://sourceforge.net/project/shownotes.php?release_id=30011613900MDKSA-2005:025Multiple cross-site scripting (XSS) vulnerabilities in Gallery 1.3.4-pl1 allow remote attackers to inject arbitrary web script or HTML via (1) the index field in add_comment.php, (2) set_albumName, (3) slide_index, (4) slide_full, (5) slide_loop, (6) slide_pause, (7) slide_dir fields in slideshow_low.php, or (8) username field in search.php.http://gallery.menalto.com/modules.php?op=modload&name=News&file=article&sid=147gallery-multiple-xss(18938)20050117 Gallery v1.3.4-pl1, v1.4.4-pl2, 2.0 Alpha Cross Site Scripting Vulnerability20050117 Gallery v1.3.4-pl1, v1.4.4-pl2, 2.0 Alpha Cross Site Scripting Vulnerabilitygallery-multiple-scripts-xss(43473)Cross-site scripting vulnerability in login.php in Gallery 1.4.4-pl2 allows remote attackers to inject arbitrary web script or HTML via the username field.13887http://gallery.menalto.com/modules.php?op=modload&name=News&file=article&sid=147gallery-multiple-xss(18938)GLSA-200501-4520050117 Gallery v1.3.4-pl1, v1.4.4-pl2, 2.0 Alpha Cross Site Scripting VulnerabilityCross-site scripting (XSS) vulnerability in login.php in Gallery 2.0 Alpha allows remote attackers to inject arbitrary web script or HTML via the g2_form[subject] field.gallery-multiple-xss(18938)http://gallery.menalto.com/modules.php?op=modload&name=News&file=article&sid=147http://theinsider.deep-ice.com/texts/advisory69.txt20050117 Gallery v1.3.4-pl1, v1.4.4-pl2, 2.0 Alpha Cross Site Scripting Vulnerability20050117 [VulnWatch] Gallery v1.3.4-pl1, v1.4.4-pl2, 2.0 Alpha Cross Site Scripting Vulnerabilitygallery-g2formsubject-xss(43472)main.php in Gallery 2.0 Alpha allows remote attackers to gain sensitive information by changing the value of g2_subView parameter, which reveals the path in an error message.gallery-mainphp-obtain-information(18940)http://theinsider.deep-ice.com/texts/advisory69.txt20050117 Gallery v1.3.4-pl1, v1.4.4-pl2, 2.0 Alpha Cross Site Scripting Vulnerabilityhttp://gallery.menalto.com/modules.php?op=modload&name=News&file=article&sid=14720050117 [VulnWatch] Gallery v1.3.4-pl1, v1.4.4-pl2, 2.0 Alpha Cross Site Scripting VulnerabilityThe Software Development Kit (SDK) and Run Time Environment (RTE) 1.4.1 and 1.4.2 for Tru64 UNIX allows remote attackers to cause a denial of service (Java Virtual Machine hang) via object deserialization.SSRT4875Unknown vulnerability in HP-UX B.11.04 running Virtualvault 4.5 through 4.7, when running the TGA daemon, allows remote attackers to cause a denial of service via certain network traffic.14082SSRT5900firehol.sh in FireHOL before 1.224 creates temporary files with predictable file names, which could allow local users to overwrite arbitrary files via a symlink attack.GLSA-200502-01http://cvs.sourceforge.net/viewcvs.py/firehol/firehol/firehol.shfirehol-symlink(19032)123361313710129691410213970Format string vulnerability in the Log_Resolver function in log.c for ngIRCd 0.8.2 and earlier, when compiled with IDENT, logging to SYSLOG, and with DEBUG enabled, allows remote attackers to execute arbitrary code.http://www.nosystem.com.ar/advisories/advisory-11.txt1411420050203 ngIRCd <= v0.8.2 Format String Vulnerability12434PostgreSQL (pgsql) 7.4.x, 7.2.x, and other versions allows local users to load arbitrary shared libraries and execute code via the LOAD extension.2005-0003RHSA-2005:150RHSA-2005:138DSA-668200502-081294820050201 [USN-71-1] PostgreSQL vulnerability[pgsql-announce] 20050201 PostgreSQL Security Release12411SUSE-SA:2005:036MDKSA-2005:040oval:org.mitre.oval:def:10234[pgsql-bugs] 20050121 Privilege escalation via LOAD** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2004-1388. Reason: This candidate is a duplicate of CVE-2004-1388. Notes: All CVE users should reference CVE-2004-1388 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.CitrusDB 0.3.5 and earlier stores the newfile.txt temporary data file under the web root, which allows remote attackers to steal credit card information via a direct request to newfile.txt.1240220050212 Credit Card data disclosure in CitrusDBcitrus-information-disclosure(19145)http://www.redteam-pentesting.de/advisories/rt-sa-2005-001.txthttp://www.citrusdb.org/forums/viewtopic.php?t=491013040Firefox 1.0 does not prevent the user from dragging an executable file to the desktop when it has an image/gif content type but has a dangerous extension such as .bat or .exe, which allows remote attackers to bypass the intended restriction and execute arbitrary commands via malformed GIF files that can still be parsed by the Windows batch file parser, aka "firedragging."http://www.mozilla.org/security/announce/mfsa2005-25.htmlGLSA-200503-30GLSA-200503-10https://bugzilla.mozilla.org/show_bug.cgi?id=27994512468SUSE-SA:2006:004http://www.mikx.de/firedragging/20050207 Firedragging [Firefox 1.0]SUSE-SA:2006:00419823oval:org.mitre.oval:def:100033Firefox 1.0 does not invoke the Javascript Security Manager when a user drags a javascript: or data: URL to a tab, which allows remote attackers to bypass the security model, aka "firetabbing."https://bugzilla.mozilla.org/show_bug.cgi?id=280056mozilla-firefox-tab-gain-access(19264)SUSE-SA:2005:016http://www.mozilla.org/security/announce/mfsa2005-26.htmlGLSA-200503-30GLSA-200503-10http://www.mikx.de/firetabbing/oval:org.mitre.oval:def:1007920050207 Firetabbing [Firefox 1.0]RHSA-2005:384RHSA-2005:176oval:org.mitre.oval:def:100032Firefox 1.0 allows remote attackers to modify Boolean configuration parameters for the about:config site by using a plugin such as Flash, and the -moz-opacity filter, to display the about:config site then cause the user to double-click at a certain screen position, aka "Fireflashing."mozilla-firefox-aboutconfig-modify(19266)RHSA-2005:323SUSE-SA:2005:016GLSA-200503-30GLSA-200503-10https://bugzilla.mozilla.org/show_bug.cgi?id=280664http://www.mozilla.org/security/announce/mfsa2005-27.htmlhttp://www.mikx.de/fireflashing/oval:org.mitre.oval:def:1096720050207 Fireflashing [Firefox 1.0]RHSA-2005:384RHSA-2005:176The International Domain Name (IDN) support in Firefox 1.0, Camino .8.5, and Mozilla before 1.7.6 allows remote attackers to spoof domain names using punycode encoded domain names that are decoded in URLs and SSL certificates in a way that uses homograph characters from other character sets, which facilitates phishing attacks.multiple-browsers-idn-spoof(19236)SUSE-SA:2005:016http://www.mozilla.org/security/announce/mfsa2005-29.htmlGLSA-200503-30GLSA-200503-10http://www.shmoo.com/idn/homograph.txthttp://www.shmoo.com/idn12461RHSA-2005:384RHSA-2005:176oval:org.mitre.oval:def:1122920050208 International Domain Name [IDN] support in modern browsers allows attackers to spoof domain name URLs + SSL certs.20050206 state of homograph attacksoval:org.mitre.oval:def:100029The International Domain Name (IDN) support in Safari 1.2.5 allows remote attackers to spoof domain names using punycode encoded domain names that are decoded in URLs and SSL certificates in a way that uses homograph characters from other character sets, which facilitates phishing attacks.multiple-browsers-idn-spoof(19236)http://www.shmoo.com/idn/homograph.txthttp://www.shmoo.com/idn20050208 International Domain Name [IDN] support in modern browsers allows attackers to spoof domain name URLs + SSL certs.20050206 state of homograph attacksAPPLE-SA-2005-03-2112461The International Domain Name (IDN) support in Opera 7.54 allows remote attackers to spoof domain names using punycode encoded domain names that are decoded in URLs and SSL certificates in a way that uses homograph characters from other character sets, which facilitates phishing attacks.multiple-browsers-idn-spoof(19236)http://www.shmoo.com/idn/homograph.txthttp://www.shmoo.com/idn20050208 International Domain Name [IDN] support in modern browsers allows attackers to spoof domain name URLs + SSL certs.20050206 state of homograph attacks12461SUSE-SA:2005:031The International Domain Name (IDN) support in Omniweb 5 allows remote attackers to spoof domain names using punycode encoded domain names that are decoded in URLs and SSL certificates in a way that uses homograph characters from other character sets, which facilitates phishing attacks.multiple-browsers-idn-spoof(19236)http://www.shmoo.com/idn/homograph.txthttp://www.shmoo.com/idn1246120050208 International Domain Name [IDN] support in modern browsers allows attackers to spoof domain name URLs + SSL certs.20050206 state of homograph attacksThe International Domain Name (IDN) support in Konqueror 3.2.1 on KDE 3.2.1 allows remote attackers to spoof domain names using punycode encoded domain names that are decoded in URLs and SSL certificates in a way that uses homograph characters from other character sets, which facilitates phishing attacks.multiple-browsers-idn-spoof(19236)http://www.kde.org/info/security/advisory-20050316-2.txt14162http://www.shmoo.com/idn/homograph.txthttp://www.shmoo.com/idnoval:org.mitre.oval:def:1067120050206 Re: state of homograph attacks20050206 state of homograph attacks12461FLSA:178606RHSA-2005:325MDKSA-2005:058The International Domain Name (IDN) support in Epiphany allows remote attackers to spoof domain names using punycode encoded domain names that are decoded in URLs and SSL certificates in a way that uses homograph characters from other character sets, which facilitates phishing attacks.https://bugzilla.redhat.com/beta/show_bug.cgi?id=147399multiple-browsers-idn-spoof(19236)http://www.shmoo.com/idn/homograph.txthttp://www.shmoo.com/idn1246120050206 state of homograph attacksviewcert.php in the S/MIME plugin 0.4 and 0.5 for Squirrelmail allows remote attackers to execute arbitrary commands via shell metacharacters in the cert parameter.VU#502328squirrelmail-smime-command-execution(19242)http://www.squirrelmail.org/plugin_view.php?id=5420050207 SquirrelMail S/MIME Plugin Command Injection VulnerabilityFormat string vulnerability in chdev on IBM AIX 5.2 allows local users to execute arbitrary code via format string specifiers in a command line argument, which is not properly handled when printing an error message.aix-chdev-format-string(19244)20050207 IBM AIX chdev Local Format String VulnerabilityIY67654IY67455The httpProcessReplyHeader function in http.c for Squid 2.5-STABLE7 and earlier does not properly set the debug context when it is handling "oversized" HTTP reply headers, which might allow remote attackers to poison the cache or bypass access controls based on header size.VU#823350squid-http-cache-poisoning(19060)http://www.squid-cache.org/Versions/v2/2.5/bugs/squid-2.5.STABLE7-oversize_reply_headers.patchhttp://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-oversize_reply_headershttp://www.squid-cache.org/bugs/show_bug.cgi?id=1216RHSA-2005:061RHSA-2005:060SUSE-SA:2005:006CLA-2005:931oval:org.mitre.oval:def:109981241214091FLSA-2006:152809The Audio Setup Wizard (asw.dll) in Yahoo! Messenger 6.0.0.1750, and possibly other versions, allows attackers to arbitrary code by placing a malicious ping.exe program into the Messenger program directory, which is installed with weak default permissions.http://secunia.com/secunia_research/2004-6/advisory/11815Yahoo! Messenger 6.0.0.1750, and possibly other versions before 6.0.0.1921, does not properly display long filenames in file dialog boxes, which could allow remote attackers to trick users into downloading and executing programs via file names containing a large number of spaces and multiple file extensions.http://secunia.com/secunia_research/2005-2/advisory/13712PostgreSQL 8.0.0 and earlier allows local users to bypass the EXECUTE permission check for functions by using the CREATE AGGREGATE command.postgresql-security-bypass(19184)RHSA-2005:1381294820050210 [USN-79-1] PostgreSQL vulnerabilities12417SUSE-SA:2005:036MDKSA-2005:040oval:org.mitre.oval:def:10927[pgsql-hackers] 20050127 Permissions on aggregate component functionsBuffer overflow in gram.y for PostgreSQL 8.0.0 and earlier may allow attackers to execute arbitrary code via a large number of arguments to a refcursor function (gram.y), which leads to a heap-based buffer overflow, a different vulnerability than CVE-2005-0247.postgresql-cursor-bo(19188)RHSA-2005:150RHSA-2005:13812948DSA-683oval:org.mitre.oval:def:1017520050210 [USN-79-1] PostgreSQL vulnerabilities[pgsql-patches] 20050120 Re: WIP: pl/pgsql cleanup[pgsql-committers] 20050207 pgsql: Prevent 4 more buffer overruns in the PL/PgSQL parser.[pgsql-committers] 20050121 pgsql: Prevent overrunning a heap-allocated buffer is more than 102412417SUSE-SA:2005:036MDKSA-2005:040The intagg contrib module for PostgreSQL 8.0.0 and earlier allows attackers to cause a denial of service (crash) via crafted arrays.postgresql-contribintagg-dos(19185)RHSA-2005:1381294820050210 [USN-79-1] PostgreSQL vulnerabilities[pgsql-committers] 20050127 pgsql: Fix security and 64-bit issues in contrib/intagg.oval:org.mitre.oval:def:1014812417SUSE-SA:2005:036MDKSA-2005:040Multiple buffer overflows in gram.y for PostgreSQL 8.0.1 and earlier may allow attackers to execute arbitrary code via (1) a large number of variables in a SQL statement being handled by the read_sql_construct function, (2) a large number of INTO variables in a SELECT statement being handled by the make_select_stmt function, (3) a large number of arbitrary variables in a SELECT statement being handled by the make_select_stmt function, and (4) a large number of INTO variables in a FETCH statement being handled by the make_fetch_stmt function, a different set of vulnerabilities than CVE-2005-0245.postgresql-fetch-makefetchstmt-bo(19378)postgresql-makeselectstmt-arbitrary-bo(19377)postgresql-makeselectstmt-input-bo(19376)postgresql-readsqlconstruct-bo(19375)RHSA-2005:150RHSA-2005:138SUSE-SA:2005:027GLSA-200502-19DSA-68320050210 [USN-79-1] PostgreSQL vulnerabilities[pgsql-committers] 20050207 pgsql: Prevent 4 more buffer overruns in the PL/PgSQL parser.12417SUSE-SA:2005:036MDKSA-2005:040oval:org.mitre.oval:def:9345The Solaris Management Console (SMC) GUI for Solaris 8 and 9, when creating user accounts that are configured for password aging, creates the accounts with a blank password, which allows remote or local attackers to break into those accounts.solaris-smc-blank-password(18868)122605771713803P-0961012860Heap-based buffer overflow in the DEC2EXE module for Symantec AntiVirus Library allows remote attackers to execute arbitrary code via a UPX compressed file containing a negative virtual offset to a crafted PE header.VU#107822upx-engine-gain-control(18869)20050208 Symantec AntiVirus Library Heap Overflowhttp://www.symantec.com/avcenter/security/Content/2005.02.08.html1013133Format string vulnerability in auditselect on IBM AIX 5.1, 5.2, and 5.3 allows local users to execute arbitrary code via format string specifiers in a command line argument.VU#8967291249620050208 IBM AIX auditselect Local Format String Vulnerabilityaix-auditselect-format-string(19255)IY67802IY67519IY67472141981013103Cross-site scripting (XSS) vulnerability in bibindex.php for BibORB 1.3.2, and possibly earlier versions, allows remote attackers to inject arbitrary HTML and web script via the search parameter.1258320050217 Advisory: Multiple Vulnerabilities in BibORB20050217 Advisory: Multiple Vulnerabilities in BibORBSQL injection vulnerability in BibORB 1.3.2, and possibly earlier versions, allows remote attackers to execute arbitrary SQL commands via the (1) Username or (2) Password.1258320050217 Advisory: Multiple Vulnerabilities in BibORB20050217 Advisory: Multiple Vulnerabilities in BibORBDirectory traversal vulnerability in index.php for BibORB 1.3.2, and possibly earlier versions, allows remote attackers to delete arbitrary files via a Delete action and .. (dot dot) sequences in the database_name parameter.1258320050217 Advisory: Multiple Vulnerabilities in BibORB20050217 Advisory: Multiple Vulnerabilities in BibORBBibORB 1.3.2, and possibly earlier versions, does not properly enforce a restriction for uploading only PDF and PS files, which allows remote attackers to upload arbitrary files that are presented to other users with PDF or PS icons, which may trick some users into downloading and executing those files.1258320050217 Advisory: Multiple Vulnerabilities in BibORB20050217 Advisory: Multiple Vulnerabilities in BibORBString handling functions in Mozilla 1.7.3, Firefox 1.0, and Thunderbird before 1.0.2, such as the nsTSubstring_CharT::Replace function, do not properly check the return values of other functions that resize the string, which allows remote attackers to cause a denial of service and possibly execute arbitrary code by forcing an out-of-memory state that causes a reallocation to fail and return a pointer to a fixed address, which leads to heap corruption.RHSA-2005:337RHSA-2005:277SUSE-SA:2005:01620050228 Mozilla Firefox and Mozilla Browser Out Of Memory Heap Corruption Design ErrorGLSA-200503-30GLSA-200503-10SUSE-SA:2006:004http://www.mozilla.org/security/announce/mfsa2005-18.htmloval:org.mitre.oval:def:911112659RHSA-2005:176SUSE-SA:2006:00419823oval:org.mitre.oval:def:100040The wu_fnmatch function in wu_fnmatch.c in wu-ftpd 2.6.1 and 2.6.2 allows remote attackers to cause a denial of service (CPU exhaustion by recursion) via a glob pattern with a large number of * (wildcard) characters, as demonstrated using the dir command.DSA-705ADV-2006-1271ADV-2005-05881420320050225 WU-FTPD File Globbing Denial of Service Vulnerability57795101699195611821014411HPSBUX02110SSRT061110SCOSA-2005.63oval:org.mitre.oval:def:1762oval:org.mitre.oval:def:1333oval:org.mitre.oval:def:1265Directory traversal vulnerability in (1) usercp_register.php and (2) usercp_avatar.php for phpBB 2.0.11, and possibly other versions, with gallery avatars enabled, allows remote attackers to delete (unlink) arbitrary files via "/../" sequences in the avatarselect parameter.20050222 phpBB Group phpBB2 Arbitrary File Unlink Vulnerabilityhttp://www.phpbb.com/support/documents.php?mode=changelogGLSA-200503-02phpBB 2.0.11, and possibly other versions, with remote avatars and avatar uploading enabled, allows local users to read arbitrary files by providing both a local and remote location for an avatar, then modifying the "Upload Avatar from a URL:" field to reference the target file.VU#77468620050222 phpBB Group phpBB Arbitrary File Disclosure Vulnerabilityhttp://www.phpbb.com/support/documents.php?mode=changelogGLSA-200503-0214362Stack-based buffer overflow in the Discovery Service for BrightStor ARCserve Backup 11.1 and earlier allows remote attackers to execute arbitrary code via a long packet to UDP port 41524, which is not properly handled in a recvfrom call.20050209 Computer Associates BrightStor ARCserve Backup v11 Discovery Service Remote Buffer Overflow Vulnerabilityhttp://supportconnectw.ca.com/public/enews/BrightStor/brigcurrent.asp#news1brightstor-discovery-bo(19251)101313814183lspath in AIX 5.2, 5.3, and possibly earlier versions, does not drop privileges before processing the -f option, which allows local users to read one line of arbitrary files.IY67655IY67457ibm-aix-ispath-information-disclosure(19281)20050210 IBM AIX lspath Local File Access Vulnerability1251314232Buffer overflow in ipl_varyon on AIX 5.1, 5.2, and 5.3 allows local users to execute arbitrary code via a long -d argument.20050210 IBM AIX ipl_varyon Local Buffer Overflow Vulnerabilityibm-aix-iplvaryon-bo(19282)IY67812IY67750IY669331251614231Buffer overflow in netpmon on AIX 5.1, 5.2, and 5.3 allows local users to execute arbitrary code via a long -O argument.20050210 IBM AIX netpmon Local Buffer Overflow Vulnerabilityibm-aix-netpmon-bo(19278)IY67807IY67136IY671241251714237Multiple cross-site scripting (XSS) vulnerabilities in browse.php in OWL 0.7 and 0.8 allow remote attackers to inject arbitrary web script or HTML via the (1) expand or (2) order parameter.20050101 Various Vulnerabilities in OWL Intranet Engineowl-intranet-engine-xss(18705)1211413695Multiple SQL injection vulnerabilities in browse.php in OWL 0.7 and 0.8 allow remote attackers to execute arbitrary SQL commands via the (1) parent or (2) sortposted parameter.12114owl-intranet-engine-sql-injection(18704)20050101 Various Vulnerabilities in OWL Intranet Engine13695Cross-site scripting (XSS) vulnerability in index.php in SugarCRM 1.X allows remote attackers to inject arbitrary web script or HTML via the (1) return_module, (2) return_action, (3) name, (4) module, or (5) record parameter.20050101 Cross Site Scripting Vulnerabilities and Possible Code Executionsugar-sales-index-xss(18719)12113index.php in FlatNuke 2.5.1 allows remote attackers to create an administrator account via carriage returns and #10 in the url_avatar field, which is interpreted as a sensitive directive.12150flatnuke-indexphp-gain-access(18741)20050102 Multiple Vulnerabilities in FlatNukeDirect code injection vulnerability in FlatNuke 2.5.1 allows remote attackers to execute arbitrary PHP code by placing the code into the url_avatar field.flatnuke-indexphp-xss(18746)1215020050102 Multiple Vulnerabilities in FlatNukeThe file extension check in GNUBoard 3.40 and earlier only verifies extensions that contain all lowercase letters, which allows remote attackers to upload arbitrary files via file extensions that include uppercase letters.gnuboard-gbupdate-file-upload(18729)121491371120050103 STG Security Advisory: [SSA-20041224-21] File extensionsMultiple cross-site scripting (XSS) vulnerabilities in ReviewPost PHP Pro before 2.84 allow remote attackers to inject arbitrary web script or HTML via the (1) si parameter to showcat.php, (2) cat or (3) page parameter to showproduct.php, or (4) report parameter to reportproduct.php.reviewpost-php-xss(18731)http://www.gulftech.org/?node=research&article_id=00062-010220051369720050103 Serious Vulnerabilities In PhotoPost ReviewPostMultiple SQL injection vulnerabilities in ReviewPost PHP Pro before 2.84 allow remote attackers to execute arbitrary SQL commands via the (1) cat parameter to showcat.php or (2) product parameter to addfav.php.reviewpost-php-sql-injection(18732)http://www.gulftech.org/?node=research&article_id=00062-010220051369720050103 Serious Vulnerabilities In PhotoPost ReviewPostReviewPost PHP Pro before 2.84 allows remote attackers to upload and execute arbitrary PHP files by posting a review file with multiple extensions, which bypasses the intended restrictions.1369720050103 Serious Vulnerabilities In PhotoPost ReviewPostreviewpost-php-file-upload(18735)Multiple SQL injection vulnerabilities in showgallery.php in PhotoPost before 4.86 allow remote attackers to execute arbitrary SQL commands via the (1) cat or (2) ppuser parameter.photopost-php-showgallery-xss(18744)12156http://www.gulftech.org/?node=research&article_id=00063-010320051368020050103 Multiple PhotoPost Pro VulnerabilitiesMultiple cross-site scripting (XSS) vulnerabilities in showgallery.php in PhotoPost before 4.86 allow remote attackers to inject arbitrary web script or HTML via the (1) cat, (2) si, (3) page, or (4) ppuser parameters.photopost-php-showgallery-xss(18744)12156http://www.gulftech.org/?node=research&article_id=00063-0103200520050103 Multiple PhotoPost Pro Vulnerabilities13680TFTP in 3Com 3CDaemon 2.0 revision 10 allows remote attackers to cause a denial of service (application crash) via a GET request containing an MS-DOS device name.3cdaemon-reserved-name-dos(18750)20050104 3Com 3CDaemon Multiple VulnerabilitiesMultiple format string vulnerabilities in the FTP service in 3Com 3CDaemon 2.0 revision 10 allow remote attackers to cause a denial of service (application crash) via format string specifiers in (1) the username, (2) cd, (3) delete, (4) rename, (5) rmdir, (6) literal, (7) stat, or (8) CWD commands.3cdaemon-login-dos(18751)1215520050104 3Com 3CDaemon Multiple VulnerabilitiesBuffer overflow in the FTP service in 3Com 3CDaemon 2.0 revision 10 allows remote attackers to cause a denial of service (application crash) and execute arbitrary code via (1) a long username in the USER command or (2) an FTP command that contains a long argument, such as cd, send, or ls.3cdaemon-long-command-dos(18754)1215520050218 3com 3CDaemon FTP Unauthorized "USER" Remote BOverflow20050104 3Com 3CDaemon Multiple VulnerabilitiesThe FTP service in 3Com 3CDaemon 2.0 revision 10 allows remote attackers to gain sensitive information via a cd command that contains an MS-DOS device name, which reveals the installation path in an error message.3cdaemon-command-obtain-information(18756)1215520050104 3Com 3CDaemon Multiple VulnerabilitiesSoldner Secret Wars 30830 and earlier does not properly handle the "message too long" socket error, which allows remote attackers to cause a denial of service (socket termination) via a long UDP packet.soldner-secret-wars-dos(18749)121621371620050104 Socket termination, format string and XSS in Soldner Secret WarsFormat string vulnerability in Soldner Secret Wars 30830 and earlier allows remote attackers to cause a denial of service (server crash) and possibly execute arbitrary code via format string specifiers in a message.soldner-secret-wars-format-string(18752)121621371620050104 Socket termination, format string and XSS in Soldner Secret WarsCross-site scripting (XSS) vulnerability in the web interface in Soldner Secret Wars 30830 allows remote attackers to inject arbitrary web script or HTML via a user message, which is not filtered or quoted when the administrator views the server logs.soldner-secret-wars-xss(18753)121621371620050104 Socket termination, format string and XSS in Soldner Secret WarsSQL injection vulnerability in member.php in MyBulletinBoard (MyBB) allows remote attackers to execute arbitrary SQL commands via the uid parameter.mybb-member-sql-injection(18755)1216120050104 MyBB SQL InjectionDirectory traversal vulnerability in index.php in QwikiWiki allows remote attackers to read arbitrary files via a .. (dot dot) and a %00 at the end of the filename in the page parameter.qwikiwiki-directory-traversal(18748)1216320050104 QWikiwiki directory traversal vulnerabilityhttp://www.qwikiwiki.com/index.php?page=QwikiVulnerability12044SQL injection vulnerability in addentry.php in Woltlab Burning Book 1.0 Gold, 1.1.1e, and possibly other versions, allows remote attackers to execute arbitrary SQL commands via the user-agent parameter.woltlab-book-addentry-sql-injection(18859)20050110 Woltlab Burning Book addentry.php SQL InjectionWebseries Payment Application does not properly restrict privileged operations, which allows remote authenticated users to gain privileges by directly accessing certain URLs.webseries-pa-url-security-bypass(18848)1221620050110 Portcullis Security Advisory 05-001101285413821eMotion MediaPartner Web Server 5.0 and 5.1 allows remote attackers to obtain sensitive information via an HTTP request for a .bhtml file that contains a (1) . (dot) or (2) + (plus sign) at the end, which returns the source code for that file.mediapartner-bhtml-source-disclosure(18861)1223620050110 Portcullis Security Advisory 05-004101285513820Bottomline Webseries Payment Application allows remote attackers to read arbitrary files on the network via a report template with modified ReportPath or ReportName values.webseries-report-execution(18862)20050110 Portcullis Security Advisory 05-009101285413821The change password functionality in Bottomline Webseries Payment Application does not require the old password when users enter a new password, which could allow remote authenticated users to change other users' passwords.webseries-pa-password-gain-access(18860)1223120050110 Portcullis Security Advisory 05-008101285413821Apple AirPort Express prior to 6.1.1 and Extreme prior to 5.5.1, configured as a Wireless Data Service (WDS), allows remote attackers to cause a denial of service (device freeze) by connecting to UDP port 161 and before link-state change occurs.20050115 Apple Airport WDS DoSapple-airport-dos(18865)1215213753NETGEAR FVS318 running firmware 2.4, and possibly other versions, allows remote attackers to bypass the filters using hex encoded URLs, as demonstrated using a hex encoded file extension.netgear-fvs318-filter-bypass(18920)1227820050117 Multiple Vulnerabilities in Netgear FVS318 Router20050117 Multiple Vulnerabilities in Netgear FVS318 Router101291313787Cross-site scripting (XSS) vulnerability in the log viewer in NETGEAR FVS318 running firmware 2.4, and possibly other versions, allows remote attackers to inject arbitrary web script or HTML via a blocked URL phrase.netgear-fvs318-log-xss(18921)1227820050117 Multiple Vulnerabilities in Netgear FVS318 Router20050117 Multiple Vulnerabilities in Netgear FVS318 Router13012101291313787Multiple SQL injection vulnerabilities in index.php in PHP Gift Registry (phpGiftReg) 1.4.0, and possibly other versions before 1.5.0b1, allow remote attackers to execute arbitrary SQL commands via the (1) messageid, (2) shopper, (3) shopfor, or (4) itemid parameters.1228920050307 Re: phpGiftReq SQL Injectionphpgiftregistry-sql-injection(18925)1387320050116 phpGiftReq SQL Injection20050116 phpGiftReq SQL Injection1012910Directory traversal vulnerability in minis.php in Minis 0.2.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the month parameter.minis-month-directory-traversal(18928)1227920050116 Minis directory traversal vulnerability101291113866minis.php in Minis 0.2.1 allows remote attackers to cause a denial of service (infinite loop) via an HTTP request for a file that the web server does not have permission to read, as demonstrated using the month parameter.minis-month-dos(18929)20050116 Minis directory traversal vulnerability20050116 Minis directory traversal vulnerability101291113866npptnt2.sys in nProtect Gameguard provides unrestricted I/O to any process that calls it, which allows local users to gain privileges.nprotect-npptnt2-gain-access(18952)1228020050116 Unrestricted I/O access vulnerability in INCA Gameguard13928** DISPUTED ** NOTE: this issue has been disputed by the vendor. The error module in Novell GroupWise WebAccess allows remote attackers who have not authenticated to read potentially sensitive information, such as the version, via an incorrect login and a modified (1) error or (2) modify parameter that returns template files or the "about" information page. NOTE: the vendor has disputed this issue.groupwise-error-auth-bypass(18954)1228520050127 NOVL-2005-10096251 GroupWise WebAccess error handling modules (report)20050121 NOVL-2005-10096251 GroupWise WebAccess error handling modules (report)http://support.novell.com/servlet/tidfinder/1009625120050117 Novell GroupWise WebAccess error modules loading13135SQL injection vulnerability in Oracle Database 9i and 10g allows remote attackers to execute arbitrary SQL commands and gain privileges.20050118 Multiple high risk vulnerabilities in Oracle RDBMS 10g/9iThe DIRECTORY objects in Oracle 8i through Oracle 10g contain the location of a specific operating system directory, which allows users with read privileges to a DIRECTORY object to obtain sensitive information.oracle-directory-lob-obtain-info(18947)http://www.petefinnigan.com/directory_traversal.pdfhttp://www.oracle.com/technology/deploy/security/pdf/cpu-jan-2005_advisory.pdf20050118 PeteFinnigan.com - Oracle security advisoryDirectory traversal vulnerability in GForge 3.3 and earlier allows remote attackers to list arbitrary directories via a .. (dot dot) in the (1) dir parameter to controller.php or (2) dir_name parameter to controlleroo.php.1231820050120 STG Security Advisory: [SSA-20050120-24] GForge 3.x directorygforge-dir-dirname-directory-traversal(18988)1012950Directory traversal vulnerability in session.php in JSBoard 2.0.9 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the table parameter.jsboard-session-file-include(18990)1231920050120 STG Security Advisory: [SSA-20050120-22] JSBoard file disclosure101294913920comersus_backoffice_install10.asp in BackOffice Lite 6.0 and 6.01 allows remote attackers to bypass authentication and gain privileges via a direct request to the program.backoffice-lite-administrative-bypass(19010)20050121 bug report comersus Back Office Lite 6.0 and 6.0.1http://www.securiteam.com/windowsntfocus/5TP0Q0UEKI.htmlhttp://www.comersus.org/forum/displayMessage.asp?mid=32753SQL injection vulnerability in default.asp in BackOffice Lite 6.0 and 6.01 allows remote attackers to execute arbitrary SQL commands via the referer field in the HTTP header.backoffice-lite-sql-injection(19013)http://www.securiteam.com/windowsntfocus/5TP0Q0UEKI.html20050121 bug report comersus Back Office Lite 6.0 and 6.0.1Multiple cross-site scripting (XSS) vulnerabilities in (1) comersus_supportError.asp or (2) comersus_backofficelite_supportError.asp in BackOffice Lite 6.0 and 6.01 allow remote attackers to inject arbitrary web script or HTML via the error parameter.backoffice-lite-xss(19014)20050121 bug report comersus Back Office Lite 6.0 and 6.0.1http://www.securiteam.com/windowsntfocus/5TP0Q0UEKI.htmlDirectory traversal vulnerability in DivX Player 2.6 and earlier allows remote attackers to overwrite arbitrary files via a .. (dot dot) in a filename in a ZIP file for a skin.divx-player-directory-traversal(19030)1233220050121 Arbitrary files overwriting through skins in DivX Player 2.613969http://aluigi.altervista.org/adv/divxplayer-adv.txtCRLF injection vulnerability in users.php in Siteman 1.1.10 and earlier allows remote attackers to add arbitrary users and gain privileges via the line parameter in a docreate operation.siteman-gain-access(18998)1230420050122 Siteman User Database Line Insertion Vulnerability20050120 God Admin Injection Vulnerability in Siteman 1.0.x,131311012951MercuryBoard 1.1.1 allows remote attackers to gain sensitive information via an HTTP request with the n parameter set to 0, which causes a divide-by-zero error and reveals the path in the resulting error message.mercuryboard-multiple-script-path-disclosure(19048)1235920050124 Multiple vulnerabilities in MercuryBoard 1.1.1Multiple cross-site scripting (XSS) vulnerabilities in index.php in MercuryBoard 1.1.1 allow remote attackers to inject arbitrary web script or HTML via the (1) s, (2) l, (3) a, (4) t, (5) to, or (6) re parameters.mercuryboard-multiple-scripts-xss(19050)1235920050124 Multiple vulnerabilities in MercuryBoard 1.1.1Buffer overflow in the wsprintf function in W32Dasm 8.93 and earlier allows remote attackers to execute arbitrary code via a large import or export function name.w32dasm-wsprintf-bo(19044)1235220050124 Local buffer-overflow in W32Dasm 8.93101299713986Multiple cross-site scripting (XSS) vulnerabilities in (1) index.php or (2) mod.php in Exponent 0.95 allow remote attackers to inject arbitrary web script or HTML via the module parameter.exponent-module-xss(19061)1235820050125 Vulnerabilities in eXponent 0.951319013188Exponent 0.95 allows remote attackers to obtain sensitive information via a direct HTTP request to (1) search.info.php, (2) permissions.info.php, (3) security.info.php, (4) formcontrol.php, or (5) file_modules.php, which reveals the path in an error message because the pathos_core_version variable is undefined.exponent-pathoscoreversion-path-disclosure(19064)20050125 Vulnerabilities in eXponent 0.95Ingate Firewall 4.1.3 and earlier does not terminate the PPTP session for an active user when the administrator disables that user from a resource, which could allow remote authenticated users to retain unauthorized access to resources.ingate-firewall-unath-access(19123)1238320050127 Ingate Firewall: Removed PPTP tunnels not deactivatedhttp://www.ingate.com/relnote-422.php101302214060WarFTPD 1.82 RC9, when running as an NT service, allows remote authenticated users to cause a denial of service (access violation) via a CWD command with a crafted pathname, as demonstrated using a large string of "%s" sequences, possibly indicating a format string vulnerability.1238420050127 WarFTPD 1.82 RC9 DoSwarftpd-cwd-dos(19129)http://support.jgaa.com/index.php?cmd=ShowReport&ID=02643Multiple directory traversal vulnerabilities in Magic Winmail Server 4.0 Build 1112 allow remote attackers to (1) upload arbitrary files via certain parameters to upload.php or (2) read arbitrary files via certain parameters to download.php, and remote authenticated users to read, create, or delete arbitrary directories and files via the IMAP commands (3) CREATE, (4) EXAMINE, (5) SELECT, or (6) DELETE.magic-winmail-command-directory-traversal(19114)magicwinmail-uploadphp-file-upload(19108)1238810130171405320050127 [SIG^2 G-TEC] Magic Winmail Server v4.0 Multiple VulnerabilitiesCross-site scripting (XSS) vulnerability in user.php in Magic Winmail Server 4.0 Build 1112 allows remote attackers to inject arbitrary web script or HTML via the personal information fields.magic-winmail-userphp-xss(19113)1238820050127 [SIG^2 G-TEC] Magic Winmail Server v4.0 Multiple Vulnerabilities101301714053The FTP service in Magic Winmail Server 4.0 Build 1112 does not verify that the IP address in a PORT command is the same as the IP address of the user of the FTP session, which allows remote authenticated users to use the server as an intermediary for port scanning.magicwinmail-ftp-obtain-information(19115)1238820050127 [SIG^2 G-TEC] Magic Winmail Server v4.0 Multiple Vulnerabilities101301714053WebWasher Classic 2.2.1 and 3.3, when running in server mode, does not properly drop CONNECT requests to the localhost from external systems, which could allow remote attackers to bypass intended access restrictions.1239414058webwasher-classic-connect-gain-access(19144)http://www.oliverkarow.de/research/WebWasherCONNECT.txt20050128 WebWasher Classic - HTTP CONNECT weakness1013036Cross-site scripting (XSS) vulnerability in useredit_account.wdm in Alt-N WebAdmin 3.0.4 allows remote attackers to inject arbitrary web script or HTML via the user parameter.webadmin-usereditaccountwdm-xss(19161)1239520050128 Multiple vulnerabilities in Alt-N WebAdmin <= 3.0.2101303814079useredit_account.wdm in Alt-N WebAdmin 3.0.4 does not properly validate account edits by the logged in user, which allows remote authenticated users to edit other users' account information via a modified user parameter.12395101303820050128 Multiple vulnerabilities in Alt-N WebAdmin <= 3.0.2Direct remote injection vulnerability in modalfram.wdm in Alt-N WebAdmin 3.0.4 allows remote attackers to load external webpages that appear to come from the WebAdmin server, which allows remote attackers to inject arbitrary HTML or web script to facilitate cross-site scripting (XSS) and phishing attacks.12395webadmin-html-injection(19162)20050128 Multiple vulnerabilities in Alt-N WebAdmin <= 3.0.2Multiple cross-site scripting vulnerabilities in MERAK Mail Server 7.6.0 with Icewarp Web Mail 5.3.0 allow remote attackers to inject arbitrary web script or HTML via the (1) username parameter to login.html, (2) accountid parameter to accountsettings_add.html, or the (3) note, (4) title, and (5) location fields to calendar.html.12396merak-icewarp-multiple-xss(19147)20050128 Multiple vulnerabilities in Icewarp Web Mail 5.3.0: New holesMERAK Mail Server 7.6.0 with Icewarp Web Mail 5.3.0 allows remote authenticated users to gain sensitive information via an HTTP request to (1) calendar_d.html, (2) calendar_m.html, (3) calendar_w.html, or (4) calendar_y.html, which reveal the installation path.merak-icewarp-user-path-disclosure(19152)20050128 Multiple vulnerabilities in Icewarp Web Mail 5.3.0: New holesMERAK Mail Server 7.6.0 with Icewarp Web Mail 5.3.0 and Mail Server 7.6.4r with Icewarp Mail Server 5.3.2 uses weak encryption in the (1) users.cfg, (2) settings.cfg, (3) users.dat or (4) user.dat files, which allows local users to extract the passwords.merak-icewarp-weak-password-encryption(19153)20050128 Multiple vulnerabilities in Icewarp Web Mail 5.3.0: New holesCross-site scripting (XSS) vulnerability in Infinite Mobile Delivery Webmail 2.6 allows remote attackers to inject arbitrary web script or HTML via the URL.infinite-mobile-delivery-xss(19151)20050129 XSS in Infinite Mobile Delivery v2.6 Webmail12399http://www.lovebug.org/imd_advisory.txt101304414075Infinite Mobile Delivery Webmail 2.6 allows remote attackers to gain sensitive information via an HTTP request that contains invalid characters for a Windows foldername, which reveals the path in an error message.infinite-mobile-delivery-path-disclosure(19154)20050129 XSS in Infinite Mobile Delivery v2.6 Webmail12399http://www.lovebug.org/imd_advisory.txt101304414075Xpand Rally 1.0.0.0 allows remote attackers or remote malicious game servers to cause a denial of service (application crash) via a packet with large values that are not properly handled in certain malloc or memcpy operations.xpand-rally-memory-dos(19150)20050130 Broadcast crash in Xpand Rally 1.0.0.0http://aluigi.altervista.org/adv/xprallyboom-adv.txt1240910130431407320050130 Broadcast crash in Xpand Rally 1.0.0.0pafiledb.php in PaFileDB 3.1 allows remote attackers to gain sensitive information via an invalid or missing action parameter, which reveals the path in an error message when it cannot include a login.php script.20050131 [PersianHacker.net] Full Path Disclosure and PHP Injection In Pafiledb 3.1 Finalpafiledb-login-path-disclosure(19175)pafiledb.php in Pafiledb 3.1 may allow remote attackers to execute arbitrary PHP code via a modified action parameter that is used in an include statement for login.php.pafiledb-login-file-include(19176)20050131 [PersianHacker.net] Full Path Disclosure and PHP Injection In Pafiledb 3.1 FinalZyxel P310, P314, P324 and Netgear RT311, RT314 running the latest firmware, allows remote attackers on the WAN to obtain the IP address of the LAN side interface by pinging a valid LAN IP address, which generates an ARP reply from the WAN address side that maps the LAN IP address to the WAN's MAC address.zyxel-netgear-ping-information-disclosure(20609)20050131 Zyxel / Netgear and probably other routers leaking information.Directory traversal vulnerability in ZipGenius 5.5 and earlier allows remote attackers to create and possibly modify arbitrary files via a ZIP file with a file whose name includes .. (dot dot) sequences.12419101354220050202 7a69Adv#19 - ZipGenius unpack path disclosurezipgenius-path-disclosure(19203)14123Buffer overflow in Painkiller 1.35 and earlier, and possibly other versions before 1.61, allows remote authenticated users to cause a denial of service and possibly execute arbitrary code via a long cd-key hash.painkiller-long-cdkey-bo(19205)1242314113101306620050202 Limited buffer-overflow in Painkiller 1.35Directory traversal vulnerability in WinRAR 3.42 and earlier, when the user clicks on the ZIP file to extract it, allows remote attackers to create arbitrary files via a ... (triple dot) in the filename of the ZIP file.winrar-dotdotdotdirectory-traversal(20585)1242220050202 7a69Adv#21 - WinRAR unpack one-folder path disclosureDirectory traversal vulnerability in DeskNow Mail and Collaboration Server 2.5.12 allows remote attackers to (1) upload and possibly execute files outside the directory via the AttachmentsKey parameter to attachment.do, as demonstrated using JSP pages, or (2) delete arbitrary files via the select_file parameter to file.do.desknow-jsp-gain-access(19211)desknow-attachmentkey-file-upload(19206)12421desknow-filedo-file-deletion(19212)http://www.security.org.sg/vuln/desknow2512.html10130601411620050202 [SIG^2 G-TEC] DeskNow Mail and Collaboration Server Directory Traversal VulnerabilitiesLANChat Pro Revival 1.666c allows remote attackers to cause a denial of service (application crash) via a malformed UDP packet.lanchatpro-udp-packet-dos(19213)12439http://www.autistici.org/fdonato/advisory/LANChatRevival1.666c-adv.txt20050203 DoS in LANChat Pro Revival 1.666cLinksys PSUS4 running firmware 6032 allows remote attackers to cause a denial of service (device crash) via an HTTP POST request containing an unknown parameter without a value.linksys-psus4-dos(19222)124431413620050203 [ RSTACK Public Security Advisory ] Remote DOS against Linksys PSUS4Directory traversal vulnerability in EMotion MediaPartner Web Server 5.0 allows remote attackers to read arbitrary files via a .. (dot dot) in the URL.mediapartner-dotdot-directory-traversal(18842)12236101283820050110 Portcullis Security Advisory 05-01013820Cross-site scripting (XSS) vulnerability in EMotion MediaPartner Web Server 5.0 allows remote attackers to inject arbitrary HTML or web script, as demonstrated using a URL containing .. sequences and HTML, which results in a directory browsing page that does not properly filter the HTML.mediapartner-url-xss(18845)12236101283820050110 Portcullis Security Advisory 05-01013820Postfix 2.1.3, when /proc/net/if_inet6 is not available and permit_mx_backup is enabled in smtpd_recipient_restrictions, allows remote attackers to bypass e-mail restrictions and perform mail relaying by sending mail to an IPv6 hostname.postfix-ipv6-security-bypass(19218)124451413720050204 [USN-74-1] Postfix vulnerabilityoval:org.mitre.oval:def:11339http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=267837RHSA-2005:152Buffer overflow in Savant Web Server 3.1 allows remote attackers to execute arbitrary code via a long HTTP request.savant-bo(19177)1242920050201 Remotely exploitable buffer overflow vulnerability in Savant Web Server 3.120050201 Remotely exploitable buffer overflow vulnerability in Savant Web Server 3.120050204 Exploit For Savant Web Server 3.1 (tested on win2003)Buffer overflow in Foxmail 2.0 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long MAIL FROM command.foxmail-mailfrom-bo(19229)1245420050205 Foxmail Server Remote Buffer Overflow VulnerabilityInteger signedness error in Apple File Service (AFP Server) allows remote attackers to cause a denial of service (application crash) via a negative UAM string length in a FPLoginExt packet.APPLE-SA-2005-03-21Applefileserver-fploginext-dos(19263)20050208 AppleFileServer Denial of Service.12478Apple Safari 1.2.4 does not obey the Content-type field in the HTTP header and renders text as HTML, which allows remote attackers to inject arbitrary web script or HTML and perform cross-site scripting (XSS) attacks.safari-contenttype-xss(19227)http://tigger.uic.edu/~jrockw2/safari_20050204.txt101308720050204 Input Validation Vulnerability in Apple Safari version 1.2.4 v125.12The Finder in Mac OS X and earlier allows local users to overwrite arbitrary files and gain privileges by creating a hard link from the .DS_Store file to an arbitrary file.14188APPLE-SA-2005-05-03finder-dsstore-file-overwrite(19253)1245820050207 [OSX Finder] DS_Store arbitrary file overwrite vulnerability.SQL injection vulnerability in PerlDesk 1.x allows remote attackers to inject arbitrary SQL commands via the view parameter.1247112512perldesk-view-sql-injection(19245)http://www.security-project.org/projects/board/showthread.php?p=5172#post517220050207 [SePro Bugtraq] SQL-Injection in PerlDesk 1.xDirectory traversal vulnerability in 602LAN SUITE 2004.0.04.1221 allows remote authenticated users to upload and execute arbitrary files via a .. (dot dot) in the filename parameter.http://www.security.org.sg/vuln/602lansuite1221.html1416920050208 [SIG^2 G-TEC] 602LAN SUITE Web Mail Vulnerability Allows File Upload to Arbitrary Directories602lansuite-webmail-directory-traversal(19258)1013106viewthread.php in php-fusion 4.x does not check the (1) forum_id or (2) forum_cat parameters, which allows remote attackers to view protected forums via the thread_id parameter.phpfusion-viewthread-obtain-information(19257)20050208 php-fusion 4.x vuln12482SafeNet SoftRemote VPN Client stores the VPN password (pre-shared key) in cleartext in memory of the IreIKE.exe process, which allows local users to gain sensitive information if they have access to that process.softremote-vpn-password-disclosure(19256)http://www.nta-monitor.com/news/vpn-flaws/safenet/index.htm20050208 SafeNet SoftRemote VPN Client Issue: Clear-text password1013134Integer overflow in RealArcade 1.2.0.994 and earlier allows remote attackers to execute arbitrary code via an RGS file with an invalid size string for the GUID and game name, which leads to a buffer overflow.realarcade-rgs-bo(19259)1418720050208 Integer overflow and arbitrary files deletion in RealArcade1013128Directory traversal vulnerability in RealArcade 1.2.0.994 allows remote attackers to delete arbitrary files via an RGP file with a .. (dot dot) in the FILENAME tag.realarcade-rgp-file-deletion(19260)124941418720050208 Integer overflow and arbitrary files deletion in RealArcade1013128The production release of the UniversalAgent for UNIX in BrightStor ARCserve Backup 11.1 contains hard-coded credentials, which allows remote attackers to access the file system and possibly execute arbitrary commands.20050210 Computer Associates BrightStor ARCserve Backup UniversalAgent Backdoor Vulnerabilityhttp://supportconnect.ca.com/sc/solcenter/sol_detail.jsp?aparno=QO63672&os=UNIX&returninput=0ADV-2005-01451252213706101314414233Heap-based buffer overflow in multiple F-Secure Anti-Virus and Internet Security products allows remote attackers to execute arbitrary code via a crafted ARJ archive.20050210 F-Secure AntiVirus Library Heap Overflowhttp://www.f-secure.com/security/fsc-2005-1.shtmlBuffer overflow in (1) termsh, (2) atcronsh, and (3) auditsh in SCO OpenServer 5.0.6 and 5.0.7 might allow local users to execute arbitrary code via a long HOME environment variable.SCOSA-2005.1513062Servers Alive 4.1 and 5.0, when running as a service, does not drop SYSTEM privileges before loading local manual under the help menu, which allows local users to gain privileges.serversalive-gain-privileges(19715)128221461620050316 Servers Alive: Local Privilege EscalationBuffer overflow in the Sentinel LM (Lservnt) service in the Sentinel License Manager 7.2.0.2 allows remote attackers to execute arbitrary code by sending a large amount of data to UDP port 5093.VU#108790http://www.cirt.dk/advisories/cirt-30-advisory.pdf14511sentinel-license-manager-bo(19621)1274220050313 [HAT-SQUAD] SafeNet Sentinel LM, UDP License Manager Exploit20050307 CIRT.DK Advisory - SafeNet Inc Sentinel License Manager 7.2.0.2 Buffer OverflowMultiple TCP implementations with Protection Against Wrapped Sequence Numbers (PAWS) with the timestamps option enabled allow remote attackers to cause a denial of service (connection loss) via a spoofed packet with a large timer value, which causes the host to discard later packets because they appear to be too old.VU#63793415417tcp-ip-timestamp-dos(20635)1367620050518 Vulnerability in a Variant of the TCP Timestamps Option15393http://support.avaya.com/elmodocs2/security/ASA-2006-032.htm1866218222SCOSA-2005.64FreeBSD-SA-05:15EMC Legato NetWorker, Sun Solstice Backup 6.0 and 6.1, and StorEdge Enterprise Backup 7.0 through 7.2 rely on AUTH_UNIX authentication, which relies on user ID for authentication and allows remote attackers to bypass authentication and gain privileges by spoofing a username or UID.VU#606857legato-authunix-bypass-authentication(21887)14582http://www.legato.com/support/websupport/product_alerts/081605_NW_authentication.htm1018861014713164641880016470EMC Legato NetWorker, Solstice Backup 6.0 and 6.1, and StorEdge Enterprise Backup 6.0 through 7.2 do not properly verify authentication tokens, which allows remote attackers to gain privileges by modifying an authentication token.VU#407641legato-token-gain-privileges(21892)1458210188610147131646418801http://www.legato.com/support/websupport/product_alerts/081605_NW_token_authentication.htm16470The Legato PortMapper in EMC Legato NetWorker, Sun Solstice Backup 6.0 and 6.1, and StorEdge Enterprise Backup 7.0 through 7.2 does not restrict access to the pmap_set and pmap_unset commands, which allows remote attackers to (1) cause a denial of service by using pmap_unset to un-register a NetWorker service, or (2) obtain sensitive information from NetWorker services by using pmap_set to register a new service.VU#801089legato-portmapper-obtain-information(21893)14582http://www.legato.com/support/websupport/product_alerts/081605_NW_port_mapper.htm1018861014713164641880216470The Microsoft Log Sink Class ActiveX control in pkmcore.dll is marked as "safe for scripting" for Internet Explorer, which allows remote attackers to create or append to arbitrary files.VU#165022awstats.pl in AWStats 6.2 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) "pluginmode", (2) "loadplugin", or (3) "noloadplugin" parameters.http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=29448816089awstats.pl in AWStats 4.0 and 6.2 allows remote attackers to execute arbitrary commands via shell metacharacters in the config parameter.DSA-682http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=294488Unknown vulnerability in BIND 9.2.0 in HP-UX B.11.00, B.11.11, and B.11.23 allows remote attackers to cause a denial of service.hpux-bind-dos(19276)14220HPSBUX01117oval:org.mitre.oval:def:5690The dcopidlng script in KDE 3.2.x and 3.3.x creates temporary files with predictable filenames, which allows local users to overwrite arbitrary files via a symlink attack.http://www.kde.org/info/security/advisory-20050316-2.txtGLSA-200503-1420050211 insecure temporary file creation in kdelibs 3.3.2http://bugs.kde.org/show_bug.cgi?id=97608oval:org.mitre.oval:def:10676RHSA-2005:325MDKSA-2005:058MDKSA-2005:045101352514254FEDORA-2005-245The integrity check feature in OpenPGP, when handling a message that was encrypted using cipher feedback (CFB) mode, allows remote attackers to recover part of the plaintext via a chosen-ciphertext attack when the first 2 bytes of a message block are known, and an oracle or other mechanism is available to determine whether an integrity check failed.VU#303094http://www.pgp.com/library/ctocorner/openpgp.htmlGLSA-200503-29http://eprint.iacr.org/2005/033.pdf1252913775SUSE-SR:2005:007MDKSA-2005:0571013166http://eprint.iacr.org/2005/033Multiple directory traversal vulnerabilities in ArGoSoft Mail Server 1.8.7.3 allow remote authenticated users to read, delete, or upload arbitrary files via a .. (dot dot) in (1) the filename of an e-mail attachment, (2) the _msgatt.rec file, (3) and the /msg, /delete, /folderadd, and /folderdelete operations for the Folder parameter.20050209 [SIG^2 G-TEC] ArGoSoft Mail Server Webmail Multiple Directory Traversal Vulnerabilitieshttp://www.security.org.sg/vuln/argosoftmail1873.htmlMultiple SQL injection vulnerabilities in CMScore allow remote attackers to execute arbitrary SQL commands via the (1) EntryID or (2) searchterm parameter to index.php, or (3) username parameter to authenticate.php.cmscore-multiple-sql-injection(19235)124571414220050209 CMS Core SQL injectionArmagetron 0.2.6.0 and earlier and Armagetron Advanced 0.2.7.0 earlier allows remote attackers to cause a denial of service (application crash) via a packet with a large (1) descriptor ID or (2) claim_id, which exceeds the boundaries of an array.20050210 Crashes and socket unreacheable in Armagetron Advanced 0.2.7.0Armagetron 0.2.6.0 and earlier and Armagetron Advanced 0.2.7.0 and earlier allow remote attackers to cause a denial of service (network disconnection) via an empty UDP packet, which is not properly distinguished from the "no new packets" state of the associated socket.20050210 Crashes and socket unreacheable in Armagetron Advanced 0.2.7.0Armagetron 0.2.6.0 and earlier and Armagetron Advanced 0.2.7.0 and earlier allow remote attackers to cause a denial of service (freeze) via a large number of player connections that do not send any data.20050210 Crashes and socket unreacheable in Armagetron Advanced 0.2.7.0Directory traversal vulnerability in gftp before 2.0.18 for GTK+ allows remote malicious FTP servers to read arbitrary files via .. (dot dot) sequences in filenames returned from a LIST command.12539GLSA-200502-27DSA-686FEDORA-2005-310FEDORA-2005-309oval:org.mitre.oval:def:9923CLSA-2005:957RHSA-2005:410MDKSA-2005:050oval:org.mitre.oval:def:717Buffer overflow in digestmd5.c CVS release 1.170 (also referred to as digestmda5.c), as used in the DIGEST-MD5 SASL plugin for Cyrus-SASL but not in any official releases, allows remote attackers to execute arbitrary code.cyrus-sasl-digestmda5-bo(17642)11347[openbsd-ports] 20040717 UPDATE: cyrus-sasl-2.1.19SUSE-SR:2005:006GLSA-200410-05https://bugzilla.andrew.cmu.edu/cgi-bin/cvsweb.cgi/src/sasl/plugins/digestmd5.c?rev=1.171&content-type=text/x-cvsweb-markuphttps://bugzilla.andrew.cmu.edu/cgi-bin/cvsweb.cgi/src/sasl/plugins/digestmd5.c.diff?r1=1.170&r2=1.171MDKSA-2005:054Cross-site scripting (XSS) vulnerability in Bitboard 2.5 and earlier allows remote attackers to inject arbitrary web script or HTML via an [img] bbcode image tag with an event such as mouseover.bitshifters-bitboard-xss(18871)12248101286420050112 Security Advisory: BiTBOARD xssimageview.php in SGallery 1.01 allows remote attackers to obtain sensitive information via an HTTP request with (1) idalbum and (2) idimage unset, which reveals the installation path in an error message for the sql_fetch_row function.20050112 [waraxe-2005-SA#039] - Critical Sql Injection in Sgallery module for PhpNukesgallery-path-disclosure(18877)http://www.waraxe.us/advisory-39.html1012868PHP remote file inclusion vulnerability in SGallery 1.01 allows local and possibly remote attackers to execute arbitrary PHP code by modifying the DOCUMENT_ROOT parameter to reference a URL on a remote web server that contains (1) config.php or (2) sql_layer.php.sgallery-file-include(18878)http://www.waraxe.us/advisory-39.html10128681382420050112 [waraxe-2005-SA#039] - Critical Sql Injection in Sgallery module for PhpNuke20050112 [waraxe-2005-SA#039] - Critical Sql Injection in Sgallery module for PhpNukeSQL injection vulnerability in imageview.php for SGallery 1.01 allows remote attackers to execute arbitrary SQL commands via the (1) idalbum or (2) idimage parameters.sgallery-imageview-sql-injection(18876)http://www.waraxe.us/advisory-39.html1224910128681382420050112 [waraxe-2005-SA#039] - Critical Sql Injection in Sgallery module for PhpNukeMultiple cross-site scripting (XSS) vulnerabilities in Horde 3.0 allow remote attackers to inject arbitrary web script or HTML via the (1) group parameter to prefs.php or (2) url parameter to index.php.1225520050113 Cross Site Scripting holes found in Horde 3.0horde-prefs-index-xss(18881)http://www.hyperdose.com/advisories/H2005-01.txt1012892Multiple directory traversal vulnerabilities in ZeroBoard 4.1pl5 and earlier allow remote attackers to read arbitrary files via a .. (dot dot) in the _zb_path parameter to (1) _head.php or (2) outlogin.php, or the dir parameter to (3) write.php.zeroboard-file-disclosure(18891)12257101288420050113 STG Security Advisory: [SSA-20050113-25] ZeroBoard multiple vulnerabilitiesMultiple PHP remote file inclusion vulnerabilities in (1) print_category.php, (2) login.php, (3) setup.php, (4) ask_password.php, or (5) error.php in ZeroBoard 4.1pl5 and earlier allow remote attackers to execute arbitrary PHP code by modifying the dir parameter to reference a URL on a remote web server that contains the code.13769zeroboard-zero-vote-file-include(18893)zeroboard-printcategory-file-include(18892)12258122061293212931129301292912928101288420050113 STG Security Advisory: [SSA-20050113-25] ZeroBoard multiple vulnerabilitiesCross-site scripting (XSS) vulnerability in f.aspx in forumKIT 1.0 allows remote attackers to inject arbitrary web script or HTML via the members parameter.forumkit-members-xss(18880)12256101289520050113 XSS Vulnerability in ForumKITBreed patch 1 and earlier allows remote attackers to cause a denial of service (application crash) via an empty UDP packet, which triggers a null dereference.breed-udp-datagram-dos(18890)122621321120050113 Server crash in Breed patch #1Trend Micro Control Manager 3.0 Enterprise Edition allows remote attackers to gain privileges via a replay attack of the encrypted username and password.http://www.cirt.dk/advisories/cirt-28-advisory.pdf20050113 Trend Micro Control Manager - Enterprise Edition 3.0 Web application Replay attackcontrol-manager-replay-attack(18887)20050113 Trend Micro Control Manager - Enterprise Edition 3.0 Web application Replay attackUnknown vulnerability in the PPP driver for the Linux kernel 2.6.8.1 allows remote attackers to cause a denial of service (kernel crash) via a pppd client.FLSA:152532USN-95-12005-000912810RHSA-2005:366RHSA-2005:293RHSA-2005:284RHSA-2005:283SUSE-SA:2005:018DSA-1082DSA-1070DSA-1069DSA-1067203382020220163oval:org.mitre.oval:def:9562Buffer overflow in luxman before 0.41, if used with certain insecure svgalib libraries, allows local users to execute arbitrary code via a long -f command line argument.12797luxman-bo-execute-commands(19680)20050314 DMA[2005-0310a] - 'Frank McIngvale LuxMan buffer overflow'http://www.digitalmunition.com/DMA[2005-0310a].txt DSA-69314582Cross-site scripting (XSS) vulnerability in network.cgi in mailreader before 2.3.29 earlier allows remote attackers to inject arbitrary web script or HTML via MIME text/enriched or text/richtext messages.DSA-70014777remstats 1.0.13 and earlier, when processing uptime data, allows local users to create or overwrite arbitrary files via a symlink attack on temporary files.DSA-704Unknown vulnerability in the remoteping service in remstats 1.0.13 and earlier allows remote attackers to execute arbitrary commands "due to missing input sanitising."DSA-704** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2005-0814. Reason: This candidate is a duplicate of CVE-2005-0814. Notes: All CVE users should reference CVE-2005-0814 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.Buffer overflow in the HTTP redirection capability in conn.c for Axel before 1.0b may allow remote attackers to execute arbitrary code.13059DSA-706GLSA-200504-0914831http://www.mail-archive.com/debian-devel-changes@lists.debian.org/msg118978.htmlgeneweb 4.10 and earlier does not properly check file permissions and content during conversion, which allows attackers to modify arbitrary files.DSA-712geneweb-insecure-file-permission(20176)ppxp does not drop root privileges before opening log files, which allows local users to execute arbitrary commands.13681DSA-725The helper scripts for crip 3.5 do not properly use temporary files, which allows local users to have an unknown impact with unknown attack vectors.DSA-733** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate has been revoked by its Candidate Numbering Authority (CNA) because it was initially assigned to a problem that was not a security issue. Notes: none.Desktop Communication Protocol (DCOP) daemon, aka dcopserver, in KDE before 3.4 allows local users to cause a denial of service (dcopserver consumption) by "stalling the DCOP authentication process."http://www.kde.org/info/security/advisory-20050316-1.txtGLSA-200503-2220050316 Multiple KDE Security Advisories (2005-03-16)oval:org.mitre.oval:def:1043212820FLSA:178606RHSA-2005:325RHSA-2005:307MDKSA-2005:058Format string vulnerability in the SetImageInfo function in image.c for ImageMagick before 6.0.2.5 may allow remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via format string specifiers in a filename argument to convert, which may be called by other web applications.imagemagick-filename-format-string(19586)RHSA-2005:320SUSE-SA:2005:017GLSA-200503-11DSA-70220050303 [USN-90-1] Imagemagick vulnerabilityhttp://bugs.gentoo.org/show_bug.cgi?id=83542oval:org.mitre.oval:def:10302RHSA-2005:070The KAME racoon daemon in ipsec-tools before 0.5 allows remote attackers to cause a denial of service (crash) via malformed ISAKMP packets.https://bugzilla.redhat.com/bugzilla/attachment.cgi?id=109966&action=viewracoon-isakmp-header-dos(19707)12804RHSA-2005:232[ipsec-tools-devel] 20050312 potential remote crash in racoon1013433GLSA-200503-3314584ADV-2005-0264oval:org.mitre.oval:def:10028MDKSA-2005:062Heap-based buffer overflow in GIF2.cpp in Firefox before 1.0.2, Mozilla before to 1.7.6, and Thunderbird before 1.0.2, and possibly other applications that use the same library, allows remote attackers to execute arbitrary code via a GIF image with a crafted Netscape extension 2 block and buffer size.VU#55794814654https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=150877gif-extension-overflow(19269)20050323 Mozilla Foundation GIF OverflowADV-2005-029612881RHSA-2005:337RHSA-2005:336RHSA-2005:335RHSA-2005:323SUSE-SA:2006:004http://www.mozilla.org/security/announce/mfsa2005-30.htmlGLSA-200503-30P-160oval:org.mitre.oval:def:1137715495SUSE-SA:2006:00419823SCOSA-2005.49oval:org.mitre.oval:def:100028The ext2_make_empty function call in the Linux kernel before 2.6.11.6 does not properly initialize memory when creating a block for a new directory entry, which allows local users to obtain potentially sensitive information by reading the block.kernel-ext2-information-disclosure(19866)FLSA:152532ADV-2005-1878USN-103-114713oval:org.mitre.oval:def:10336http://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.11.6http://arkoon.net/advisories/ext2-make-empty-leak.txt12932RHSA-2006:0191RHSA-2006:0190RHSA-2005:663RHSA-2005:366186841700220050401 Information leak in the Linux kernel ext2 implementationFireFox 1.0.1 and Mozilla before 1.7.6 do not sufficiently address all attack vectors for loading chrome files and hijacking drag and drop events, which allows remote attackers to execute arbitrary XUL code by tricking a user into dragging a scrollbar, a variant of CVE-2005-0527, aka "Firescrolling 2."12885ADV-2005-0296RHSA-2005:336RHSA-2005:335http://www.mozilla.org/security/announce/mfsa2005-32.htmlGLSA-200503-3014654oval:org.mitre.oval:def:9650http://mikx.de/firescrolling2/20050324 Firescrolling 2 [Firefox 1.0.1]RHSA-2005:384oval:org.mitre.oval:def:100026Firefox before 1.0.2 allows remote attackers to execute arbitrary code by tricking a user into saving a page as a Firefox sidebar panel, then using the sidebar panel to inject Javascript into a privileged page.https://bugzilla.mozilla.org/show_bug.cgi?id=284627RHSA-2005:33614654ADV-2005-0296http://www.mozilla.org/security/announce/mfsa2005-31.htmloval:org.mitre.oval:def:11868oval:org.mitre.oval:def:100027init_dev in tty_io.c in the Red Hat backport of NPTL to Red Hat Enterprise Linux 3 does not properly clear controlling tty's in multi-threaded applications, which allows local users to cause a denial of service (crash) and possibly gain tty access via unknown attack vectors that trigger an access of a pointer to a freed structure.RHSA-2005:293https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=144059oval:org.mitre.oval:def:9435KMail 1.7.1 in KDE 3.3.2 allows remote attackers to spoof email information, such as whether the email has been digitally signed or encrypted, via HTML formatted email.http://www.securiteam.com/unixfocus/5GP0B0AFFE.htmlhttp://bugs.kde.org/show_bug.cgi?id=9602014925[kmail-devel] 20050215 [Bug 96020] HTML Allows Spoofing of Emails ContentA design flaw in image processing software that modifies JPEG images might not modify the original EXIF thumbnail, which could lead to an information leak of potentially sensitive visual information that had been removed from the main JPEG image.http://www.redteam-pentesting.de/advisories/rt-sa-2005-008.txt20050214 Advisory: JPEG EXIF information disclosureCross-site scripting (XSS) vulnerability in Openconf 1.04, and possibly other versions before 1.10, allows remote attackers to inject arbitrary HTML and web script via the paper title.12554http://www.redteam-pentesting.de/advisories/rt-sa-2005-007.txt1429420050214 Advisory: Cross Site Scripting Vulnerability in Openconf Conference Management SoftwareCitrusDB 0.3.6 and earlier generates easily predictable MD5 hashes of the user name for the id_hash cookie, which allows remote attackers to bypass authentication and gain privileges by calculating the MD5 checksum of the user name combined with the "boogaadeeboo" string, which is hard-coded in the $hidden_hash variable.http://www.redteam-pentesting.de/advisories/rt-sa-2005-002.txt20050214 Advisory: Authentication bypass in CitrusDBCitrusDB 0.3.6 and earlier does not verify authorization for the (1) importcc.php and (2) uploadcc.php, which allows remote attackers to upload credit card data and obtain sensitive information such as the pathnames for temporary files that store credit card data, and facilitates the exploitation of other vulnerabilities.http://www.redteam-pentesting.de/advisories/rt-sa-2005-003.txt20050214 Advisory: Upload Authorization bypass in CitrusDBSQL injection vulnerability in importcc.php for CitrusDB 0.3.6 and earlier allows remote attackers to inject data via the fields of a CSV file.http://www.redteam-pentesting.de/advisories/rt-sa-2005-004.txt20050214 Advisory: SQL-Injection in CitrusDBDirectory traversal vulnerability in index.php for CitrusDB 0.3.6 and earlier allows remote attackers and local users to include arbitrary PHP files via .. (dot dot) sequences in the load parameter.http://www.redteam-pentesting.de/advisories/rt-sa-2005-005.txt20050214 Advisory: Directory traversal in CitrusDBCross-site scripting (XSS) vulnerability in Spidean PostWrap allows remote attackers to inject arbitrary HTML and web script via the page parameter.postwrap-xss(19261)101313020050208 XSS VULNERABILITY AT MODULE PostWrapMultiple SQL injection vulnerabilities in MyPHP Forum 1.0 allow remote attackers to execute arbitrary SQL commands via (1) the fid in forum.php, (2) the member parameter in member.php, (3) the email parameter in forgot.php, or (4) the nbuser or nbpass parameters in include.php. NOTE: it was later reported that vector 2 exists in 3.0 and earlier.myphpforum-member-sql-injection(39348)myphpforum-multiple-sql-injection(19272)2708312501482210131361420520050209 Several SQL injection bugs in myPHP Forum v.1.0SQL injection vulnerability in post.php for MercuryBoard 1.1.1 allows remote attackers to execute arbitrary SQL commands via a reply post action for index.php with (1) the t parameter or (2) the qu parameter.101313720050124 Multiple vulnerabilities in MercuryBoard 1.1.1mercuryboard-index-sql-injection(19051)20050209 Mercuryboard =?iso-8859-1?Q?<=3D?= 1.1.1 Working Sql Injectionhttp://cvs.sunsite.dk/viewcvs.cgi/mercury/func/post.php.diff?r1=1.68&r2=1.70Multiple memory leaks in the MQL parser in Emdros before 1.1.22 allow remote attackers to cause a denial of service (memory consumption) via malformed MQL statements.emdros-mql-dos(19273)http://sourceforge.net/tracker/index.php?func=detail&aid=1116935&group_id=37219&atid=419458http://sourceforge.net/project/shownotes.php?release_id=303465The Windows Animated Cursor (ANI) capability in Windows NT, Windows 2000 through SP4, Windows XP through SP1, and Windows 2003 allows remote attackers to execute arbitrary code via the AnimationHeaderBlock length field, which leads to a stack-based buffer overflow.win-user32-aniheader-overflow(18879)12233MS05-002http://eeye.com/html/research/advisories/AD20050111.html20050112 Windows ANI File Parsing Proof Of Concept (MS05-002)20050111 EEYE: Windows ANI File Parsing Buffer OverflowUnknown "high risk" vulnerability in DB2 Universal Database 8.1 and earlier has unknown impact and attack vectors. NOTE: due to the delayed disclosure of details for this issue, this candidate may be SPLIT in the future. In addition, this may be a duplicate of other issues as reported by the vendor.1250820050209 Patch available for high risk IBM DB2 Universal Database flawhttp://www.ngssoftware.com/advisories/db2-09-05-05.htmArgument injection vulnerability in Java Web Start for J2SE 1.4.2 up to 1.4.2_06, on Mac OS X, allows untrusted applications to gain privileges via the value parameter of a property tag in a JNLP file. NOTE: it is highly likely that this item will be MERGED with CVE-2005-0836.APPLE-SA-2005-03-24Multiple heap-based buffer overflows in 3Com 3CServer allow remote authenticated users to execute arbitrary code via long FTP commands, as demonstrated using the STAT command.3cserver-multiple-command-bo(19250)20050207 Vulnerability in 3Com 3CServer v1.1Microsoft Outlook Web Access (OWA), when used with Exchange, allows remote attackers to redirect users to arbitrary URLs for login via a link to the owalogon.asp application.owa-owalogonasp-url-redirect(19225)ADV-2005-0105124591414420050206 Microsoft Outlook Web Access URL Injection VulnerabilityDelphiTurk FTP 1.0 stores usernames and passwords in the profile.dat file, which allows local users to gain privileges.delphiturkcodebank-obtain-information(19248)1013139DelphiTurk CodeBank (aka KodBank) 3.1 and earlier stores usernames and passwords in the Codebank registry key, which allows local users to gain privileges.delphiturkcodebank-obtain-information(19248)1013139SQL injection vulnerability in login.asp in ASPjar Guestbook allows remote attackers to execute arbitrary SQL commands via the password field.12521aspjar-guest-login-sql-injection(19299)1422520050210 ASPjar guestbook (Injection in login page)Unknown vulnerability in the delete.asp program in certain versions of ASPjar Guestbook allows remote attackers to delete messages. NOTE: there is insufficient information to know if this is the same issue as CVE-2002-1730.12521aspjar-delete-message-deletion(19301)1422520050210 ASPjar guestbook (Injection in login page)Unknown vulnerability in IBM Websphere Application Server 5.0, 5.1, and 6.0 when running on Windows, allows remote attackers to obtain the source code for Java Server Pages (.jsp) via a crafted URL that causes the page to be processed by the file serving servlet instead of the JSP engine.http://www-1.ibm.com/support/docview.wss?uid=swg24008815http://www-1.ibm.com/support/docview.wss?uid=swg2400881414274Unknown vulnerability in Solaris 8 and 9 allows remote attackers to cause a denial of service (panic) via "Heavy UDP Usage" that triggers a NULL dereference.solaris-udp-end-point-dos(19119)1238557728The ebuild of Webmin before 1.170-r3 on Gentoo Linux includes the encrypted root password in the miniserv.users file when building a tbz2 of the webmin package, which allows remote attackers to obtain and possibly crack the encrypted password.GLSA-200502-12webmin-encrypted-password(19315)http://bugs.gentoo.org/show_bug.cgi?id=77731The DNSPacket::expand method in dnspacket.cc in PowerDNS before 2.9.17 allows remote attackers to cause a denial of service by sending a random stream of bytes.powerdns-random-bytes-dos(19221)12446GLSA-200502-15http://ds9a.nl/cgi-bin/cvstrac/pdns/tktview?tn=21http://doc.powerdns.com/changelog.html#CHANGELOG-2-9-17Direct code injection vulnerability in forumdisplay.php in vBulletin 3.0 through 3.0.4, when showforumusers is enabled, allows remote attackers to execute inject arbitrary PHP commands via the comma parameter.20050213 vbulletin 3.0.x PHP code execution12542The Quake 3 engine, as used in multiple game packages, allows remote attackers to cause a denial of service (shutdown game server) and possibly crash the server via a long infostring, possibly triggering a buffer overflow.http://aluigi.altervista.org/adv/q3infoboom-adv.txt1253420050212 Infostring crash and shutdown in the Quake 3 engineBarracuda Spam Firewall 3.1.10 and earlier does not restrict the domains that white-listed domains can send mail to, which allows members of white-listed domains to use Barracuda as an open mail relay for spam.barracuda-open-relay(19283)1424320050210 Barracuda Spam Firewall <= 3.1.10 acts as open relay for whitelisted senders.BEA WebLogic Server 7.0 Service Pack 5 and earlier, and 8.1 Service Pack 3 and earlier, generates different login exceptions that suggest why an authentication attempt fails, which makes it easier for remote attackers to guess passwords via brute force attacks.14298http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA05-74.00.jspPhp-Nuke 7.5 allows remote attackers to determine the full path of the web server via invalid or missing arguments to (1) db.php, (2) mainfile.php, (3) Downloads/index.php, or (4) Web_Links/index.php, which lists the path in a PHP error message.phpnuke-multiple-scripts-path-disclosure(19344)http://www.waraxe.us/advisory-40.html12561Multiple cross-site scripting (XSS) vulnerabilities in Php-Nuke 7.5 allow remote attackers to inject arbitrary HTML or web script via (1) the newdownloadshowdays parameter in a NewDownloads operation or (2) the newlinkshowdays parameter in a NewLinks operation.phpnuke-downloads-weblinks-xss(19346)http://www.waraxe.us/advisory-40.html12561awstats.pl in AWStats 6.3 and 6.4 allows remote attackers to read server web logs by setting the loadplugin and pluginmode parameters to rawlog.14299awstats-awstatpl-obtain-information(19333)20050214 AWStats <= 6.4 Multiple vulnerabilitiesDirect code injection vulnerability in awstats.pl in AWStats 6.3 and 6.4 allows remote attackers to execute portions of Perl code via the PluginMode parameter.14299awstats-function-code-execution(19336)20050214 AWStats <= 6.4 Multiple vulnerabilities13832Directory traversal vulnerability in awstats.pl in AWStats 6.3 and 6.4 allows remote attackers to include arbitrary Perl modules via .. (dot dot) sequences in the loadplugin parameter.1429920050214 AWStats <= 6.4 Multiple vulnerabilitiesawstats.pl in AWStats 6.3 and 6.4 allows remote attackers to obtain sensitive information by setting the debug parameter.14299awstats-information-disclosure(19477)20050214 AWStats <= 6.4 Multiple vulnerabilitiesBuffer overflow in the decode_post function in ELOG before 2.5.7 allows remote attackers to execute arbitrary code via attachments with long file names.12556http://sourceforge.net/project/shownotes.php?group_id=40505&release_id=304880http://midas.psi.ch/elogs/Forum/941elog-weblog-bo(19313)ELOG before 2.5.7 allows remote attackers to bypass authentication and download a configuration file that contains a sensitive write password via a modified URL.12556http://sourceforge.net/project/shownotes.php?group_id=40505&release_id=304880http://midas.psi.ch/elogs/Forum/941Multiple stack-based buffer overflows in Sybase Adaptive Server Enterprise (ASE) 12.x before 12.5.3 ESD#1 allow remote authenticated users to execute arbitrary code via the (1) attrib_valid function, (2) covert function, (3) declare statement, or (4) a crafted query plan, or remote authenticated users with database owner or "sa" role privileges to execute arbitrary code via (5) a crafted install java statement.sybase-ase-install-java-bo(19980)sybase-ase-abstract-bo(19979)sybase-ase-declare-bo(19978)sybase-ase-convert-bo(19976)sybase-ase-attribvalid-bo(19974)sybase-adaptive-server(19354)http://www.sybase.com/detail?id=1034752http://www.sybase.com/detail?id=10345201208020050321 Details of Sybase ASE bugs withheld1363220050405 Sybase ASE Multiple Security Issues (#NISR05042005)20041222 Sybase ASE 12.5.2 vulnerabilitieshttp://www.ngssoftware.com/advisories/sybase-ase.txtDirectory traversal vulnerability in index.php for CubeCart 2.0.4 allows remote attackers to read arbitrary files via the language parameter.12549http://www.cubecart.com/site/forums/index.php?showtopic=574114272cubecart-dotdot-directory-traversal(19322)20050406 RE: [NOBYTES.COM: #6] CubeCart 2.0.6 - Information Disclosure20050214 [NOBYTES.COM: #2] CubeCart 2.0.4 - Multiple Vulnerabilitiesindex.php in CubeCart 2.0.4 allows remote attackers to (1) obtain the full path for the web server or (2) conduct cross-site scripting (XSS) attacks via an invalid language parameter, which echoes the parameter in a PHP error message.12549http://www.cubecart.com/site/forums/index.php?showtopic=5741cubecart-index-xss(19328)20050214 [NOBYTES.COM: #2] CubeCart 2.0.4 - Multiple Vulnerabilities14064VMware before 4.5.2.8848-r5 searches for gdk-pixbuf shared libraries using a path that includes the rrdharan world-writable temporary directory, which allows local users to execute arbitrary code.GLSA-200502-18Cross-site scripting (XSS) vulnerability in Open WebMail 2.x allows remote attackers to inject arbitrary HTML or web script via the domain name parameter (logindomain) in the login page.14253open-webmail-logindomain-xss(19335)http://turtle.ee.ncku.edu.tw/openwebmail/download/cert/patches/SA-05:01/2.5x.patchhttp://turtle.ee.ncku.edu.tw/openwebmail/doc/changes.txt125471013172Squid 2.5.STABLE8 and earlier allows remote attackers to cause a denial of service (crash) via certain DNS responses regarding (1) Fully Qualified Domain Names (FQDN) in fqdncache.c or (2) IP addresses in ipcache.c, which trigger an assertion failure.http://www.squid-cache.org/Versions/v2/2.5/bugs/squid-2.5.STABLE8-dns_assert.patchhttp://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE8-dns_assertRHSA-2005:173GLSA-200502-25DSA-68814271CLA-2005:931squid-xstrndup-dos(19332)oval:org.mitre.oval:def:1126420050221 [USN-84-1] Squid vulnerabilities12551RHSA-2005:201MDKSA-2005:047FLSA-2006:152809Solaris 7, 8, and 9 allows remote attackers to cause a denial of service (hang) via a flood of certain ARP packets.14286solaris-arp-dos(19331)12553576731013179Race condition in the rmtree function in File::Path.pm in Perl before 5.8.4 allows local users to create arbitrary setuid binaries in the tree being deleted, a different vulnerability than CVE-2004-0452.GLSA-200501-38DSA-696HPSBUX01208oval:org.mitre.oval:def:10475USN-94-112767HPSBUX01208RHSA-2005:881RHSA-2005:674MDKSA-2005:07918517180751707914531FLSA-2006:152845CLSA-2006:105620060101-01-Uoval:org.mitre.oval:def:728The netfilter/iptables module in Linux before 2.6.8.1 allows remote attackers to cause a denial of service (kernel crash) or bypass firewall rules via crafted packets, which are not properly handled by the skb_checksum_help function.RHSA-2005:284RHSA-2005:283SUSE-SA:2005:018CLA-2005:945FLSA:152532USN-82-112598RHSA-2005:366RHSA-2005:293MDKSA-2005:218DSA-1018DSA-1017196071937419369oval:org.mitre.oval:def:10753[netdev] 20050124 Re: skb_checksum_help20060402-01-UDirectory traversal vulnerability in Sami HTTP Server 1.0.5 allows remote attackers to read arbitrary files via an HTTP request containing (1) .. (dot dot) or (2) "%2e%2e" (encoded dot dot) sequences.101319114283Sami HTTP Server 1.0.5 allows remote attackers to cause a denial of service via an HTTP request containing two CRLF sequences, which triggers a NULL dereference.101319114283Multiple cross-site scripting (XSS) vulnerabilities in Microsoft ASP.NET (.Net) 1.0 and 1.1 to SP1 allow remote attackers to inject arbitrary HTML or web script via Unicode representations for ASCII fullwidth characters that are converted to normal ASCII characters, including ">" and "<".125741421420050217 XSS vulnerabilty in ASP.Net [with details]http://it-project.ru/andir/docs/aspxvuln/aspxvuln.en.xmlThe buffer_urldecode function in Lighttpd 1.3.7 and earlier does not properly handle control characters, which allows remote attackers to obtain the source code for CGI and FastCGI scripts via a URL with a %00 (null) character after the file extension.GLSA-200502-2114297http://article.gmane.org/gmane.comp.web.lighttpd/1171Multiple SQL injection vulnerabilities in DCP-Portal 6.1.1 and earlier allow remote attackers to execute arbitrary SQL commands via (1) the lcat, doc, or uid parameters to index.php, or (2) the mid or bid parameters to forums.php.http://www.hackgen.org/advisories/hackgen-2005-003.txt101321620050216 [hackgen-2005-#003] - SQL injection bugs in DCP-Portaldcpportal-multiple-sql-injection(19361)1257320051211 [PHP-CHECKER] 99 potential SQL injection vulnerabilities108http://glide.stanford.edu/yichen/research/sec.pdfStack-based buffer overflow in the CSmil1Parser::testAttributeFailed function in smlparse.cpp for RealNetworks RealPlayer 10.5 (6.0.12.1056 and earlier), 10, 8, and RealOne Player V2 and V1 allows remote attackers to execute arbitrary code via a .SMIL file with a large system-screen-size value.RHSA-2005:26520050301 RealNetworks RealPlayer .smil Buffer Overflow Vulnerabilityhttp://service.real.com/help/faq/security/050224_playeroval:org.mitre.oval:def:10926RHSA-2005:271Opera 7.54 and earlier does not properly validate base64 encoded binary data in a data: (RFC 2397) URL, which causes the URL to be obscured in a download dialog, which may allow remote attackers to trick users into executing arbitrary code.VU#882926http://www.opera.com/linux/changelogs/754u2/GLSA-200502-1713818opera-data-dialog-spoofing(18867)SUSE-SA:2005:031Opera 7.54 and earlier on Gentoo Linux uses an insecure path for plugins, which could allow local users to gain privileges by inserting malicious libraries into the PORTAGE_TMPDIR (portage) temporary directory.GLSA-200502-17http://bugs.gentoo.org/show_bug.cgi?id=81747Cross-site scripting (XSS) vulnerability in contact_us.php in osCommerce 2.2-MS2 allows remote attackers to inject arbitrary web script or HTML via the enquiry parameter.20050215 [NOBYTES.COM: #3] osCommerce 2.2-MS2 - XSS VulnerabilityphpMyAdmin 2.6.2-dev, and possibly earlier versions, allows remote attackers to determine the full path of the web root via a direct request to select_lang.lib.php, which reveals the path in a PHP error message.1013210index.php in MercuryBoard 1.0.x and 1.1.x allows remote attackers to obtain sensitive information by setting the debug parameter.1378714284http://lostmon.blogspot.com/2005/02/mercuryboard-debug-information.htmlUnknown vulnerability in NewsBruiser 2.x before 2.6.1 allows remote attackers to "take actions on comments."14262http://newsbruiser.tigris.org/servlets/NewsItemView?newsItemID=1016http://newsbruiser.tigris.org/source/browse/newsbruiser/CHANGELOG?rev=1.283&content-type=text/x-cvsweb-markupCross-site scripting (XSS) vulnerability in MercuryBoard 1.0.x and 1.1.x allows remote attackers to inject arbitrary HTML and web script via the f parameter.13937http://lostmon.blogspot.com/2005/02/mercuryboard-forumphp-f-variable-xss.htmlUnknown "major security flaws" in Ulog-php before 1.0, related to input validation, have unknown impact and attack vectors, probably related to SQL injection vulnerabilities in (1) host.php, (2) port.php, and (3) index.php.12610http://www.inl.fr/article.php3?id_article=710132201432113853gr_osview in SGI IRIX 6.5.22, and possibly other 6.5 versions, does not drop privileges when opening description files while in debug mode, which allows local users to read a line from arbitrary files via the -d and -D options, which prints the line as a formatting error.20050407 SGI IRIX gr_osview Information Disclosure Vulnerability20050402-01-P15351101366214875gr_osview in SGI IRIX does not drop privileges before opening files, which allows local users to overwrite arbitrary files via the -s option.20050407 SGI IRIX gr_osview File Overwrite Vulnerability20050402-01-P101366214875Multiple integer overflows in the (1) sftp_pkt_getstring and (2) fxp_readdir_recv functions in the PSFTP and PSCP clients for PuTTY 0.56, and possibly earlier versions, allow remote malicious web sites to execute arbitrary code via SFTP responses that corrupt the heap after insufficient memory has been allocated.20050221 Multiple PuTTY SFTP Client Packet Parsing Integer Overflow VulnerabilitiesGLSA-200502-2814333putty-sftppktgetstring-bo(19403)http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-sftp-string.htmlhttp://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-sftp-readdir.htmlhttp://www-1.ibm.com/support/docview.wss?uid=ssg1S1002416http://www-1.ibm.com/support/docview.wss?uid=ssg1S100241417214Heap-based buffer overflow in the env_opt_add function in telnet.c for various BSD-based Telnet clients allows remote attackers to execute arbitrary code via responses that contain a large number of characters that require escaping, which consumers more memory than allocated.VU#341908RHSA-2005:330RHSA-2005:327DSA-703http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2005-001-telnet.txt20050405-01-PUSN-224-11291920050328 Multiple Telnet Client env_opt_add() Buffer Overflow VulnerabilityDSA-73157761577551016711016651789914745oval:org.mitre.oval:def:9640CLA-2005:962FreeBSD-SA-05:01.telnetMDKSA-2005:061Buffer overflow in the slc_add_reply function in various BSD-based Telnet clients, when handling LINEMODE suboptions, allows remote attackers to execute arbitrary code via a reply with a large number of Set Local Character (SLC) commands.VU#291924RHSA-2005:330RHSA-2005:32720050328 Multiple Telnet Client slc_add_reply() Buffer Overflow VulnerabilityGLSA-200503-36DSA-703DSA-699DSA-697http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2005-001-telnet.txt5775520050405-01-PUSN-224-112918DSA-731577611016711016651789914745oval:org.mitre.oval:def:9708FreeBSD-SA-05:01.telnetMDKSA-2005:061Buffer overflow in wpa_supplicant before 0.2.7 allows remote attackers to cause a denial of service (segmentation fault) via invalid EAPOL-Key packet data.wpasupplicant-bo(19357)GLSA-200502-22143131013226[HostAP] 20050213 wpa_supplicant - new stable releases v0.3.8 and v0.2.7Sun Java JRE 1.1.x through 1.4.x writes temporary files with long filenames that become predictable on a file system that uses 8.3 style short names, which allows remote attackers to write arbitrary files to known locations and facilitates the exploitation of vulnerabilities in applications that rely on unpredictable file names.VU#544392sun-java-create-files(19285)http://secunia.com/secunia_research/2004-7/advisory/11070Gaim before 1.1.3 allows remote attackers to cause a denial of service (infinite loop) via malformed SNAC packets from (1) AIM or (2) ICQ.VU#839280gaim-snac-dos(19380)RHSA-2005:432RHSA-2005:215GLSA-200503-03DSA-71614322oval:org.mitre.oval:def:10433http://gaim.sourceforge.net/security/index.php?id=1012589FLSA:158543SUSE-SA:2005:036MDKSA-2005:04920050225 [USN-85-1] Gaim vulnerabilitiesCLA-2005:933The HTML parsing functions in Gaim before 1.1.3 allow remote attackers to cause a denial of service (application crash) via malformed HTML that causes "an invalid memory access," a different vulnerability than CVE-2005-0208.VU#523888gaim-html-dos(19381)RHSA-2005:215GLSA-200503-0314322oval:org.mitre.oval:def:10212http://gaim.sourceforge.net/security/index.php?id=1112589FLSA:158543SUSE-SA:2005:036MDKSA-2005:04920050225 [USN-85-1] Gaim vulnerabilitiesCLA-2005:933SQL injection vulnerability in the user_valid_crypt function in user.php in WebCalendar 0.9.45 allows remote attackers to execute arbitrary SQL commands via an encoded webcalendar_session cookie.webcalendar-sql-injection(19369)http://www.scovettalabs.com/advisory/SCL-2005.001.txt1431913918101323120050217 [ SCL-2005.001 ] - WebCalendar: SQL Injection from encoded cookieSQL injection vulnerability in paFAQ Beta4, and possibly other versions, allows remote attackers to execute arbitrary SQL code via the (1) offset, (2) limit, (3) order, or (4) orderby parameter to question.php, (5) offset parameter to answer.php, (6) search_item parameter to search.php, (7) cat_id, (8) cid, or (9) id parameter to comment.php.20050217 [PersianHacker.NET 200505-07] paFAQ Beta4 Sql Injectionpafaq-sql-injection(19371)Cross-site scripting (XSS) vulnerability in hpm_guestbook.cgi allows remote attackers to inject arbitrary web script or HTML by posting a message.hpm-guestbook-xss(19372)20050217 hpm_guestbook.cgi JavaScript-InjectionCross-site scripting (XSS) vulnerability in the SML code for Invision Power Board 1.3.1 FINAL allows remote attackers to inject arbitrary web script via (1) a signature file or (2) a message post containing an IMG tag within a COLOR tag whose style is set to background:url.invision-power-board-sml-xss(19399)20050217 Invision Power Boards 1.3.1 FINAL XSS ExploitMultiple buffer overflows in TrackerCam 5.12 and earlier allow remote attackers to cause a denial of service and possibly execute arbitrary code via (1) an HTTP request with a long User-Agent header or (2) a long argument to an arbitrary PHP script.trackercam-php-bo(19411)trackercam-useragent-bo(19409)1259220050218 Multiple vulnerabilities in TrackerCam 5.12Directory traversal vulnerability in ComGetLogFile.php3 for TrackerCam 5.12 and earlier allows remote attackers to read arbitrary files via ".." sequences and (1) "/" slash), (2) "\" (backslash), or (3) hex-encoded characters in the fn parameter.trackercam-fn-directory-traversal(19414)1259220050218 Multiple vulnerabilities in TrackerCam 5.12Cross-site scripting (XSS) vulnerability in TrackerCam 5.12 and earlier allows remote attackers to inject arbitrary HTML or web script via the login request, which is recorded in a log file but not properly handled when the administrator views the log file.trackercam-xss(19416)1259220050218 Multiple vulnerabilities in TrackerCam 5.12TrackerCam 5.12 and earlier allows remote attackers to read log files via the fn parameter in a direct request to the ComGetLogFile.php3 script.trackercam-fn-path-disclosure(19415)1259220050218 Multiple vulnerabilities in TrackerCam 5.12TrackerCam 5.12 and earlier allows remote attackers to cause a denial of service (crash) via (1) a large number of connections with a negative Content-Length header, possibly triggering an integer signedness error, or (2) a large amount of data.trackercam-contentlength-dos(19417)1259220050218 Multiple vulnerabilities in TrackerCam 5.12Multiple directory traversal vulnerabilities in sitenfo.sh, sitezipchk.sh, and siteziplist.sh in Glftpd 1.26 to 2.00 allow remote authenticated users to (1) determine the existence of arbitrary files, (2) list files in restricted directories, or (3) read arbitrary files from within ZIP or gzip files, via .. (dot dot) sequences and globbing ("*") characters in a SITE NFO command.glftpd-sitenfosh-directory-traversal(19401)1258620050218 Multiple vulnerabilities in Glftpd v1.26 - v2.00 default zip based plug-insFormat string vulnerability in gprostats for GProFTPD before 8.1.9 may allow remote attackers to execute arbitrary code via an FTP transfer with a crafted filename that causes format string specifiers to be inserted into the ProFTPD transfer log.GLSA-200502-26http://bugs.gentoo.org/show_bug.cgi?id=81894Cross-site scripting (XSS) vulnerability in comment.php for paNews 2.0b4 for PHP Arena allows remote attackers to inject arbitrary HTML and web script via the showpost parameter.20050216 [PersianHacker.NET 200505-06] paNews v2.0b4 XSS Vulnerabilitypanews-commentphp-xss(19359)12576Tarantella Secure Global Desktop Enterprise Edition 4.00 and 3.42, and Tarantella Enterprise 3 3.40 and 3.30, when using RSA SecurID and multiple users have the same username, reveals sensitive information during authentication, which allows remote attackers to identify valid usernames and the authentication scheme.http://www.tarantella.com/security/bulletin-11.htmltarantella-enterprise-obtain-information(19407)Cross-site scripting (XSS) vulnerability in index.php for Kayako ESupport 2.3.1, and possibly other versions, allows remote attackers to inject arbitrary HTML and web script via the nav parameter.kayako-index-xss(18571)1256320050215 Kayako eSupport v2.3.1 Support Tracker XSSCertain BSD-based Telnet clients, including those used on Solaris and SuSE Linux, allow remote malicious Telnet servers to read sensitive environment variables via the NEW-ENVIRON option with a SEND ENV_USERVAR command.VU#800829TA06-214A5776157755ADV-2006-3101RHSA-2005:504SUSE-SR:2005:016oval:org.mitre.oval:def:1137320050614 Multiple Vendor Telnet Client Information Disclosure Vulnerability1928913940RHSA-2005:56210167110166510142032125317135APPLE-SA-2006-08-01oval:org.mitre.oval:def:1139The /proc handling (proc/base.c) Linux kernel 2.4 before 2.4.17 allows local users to cause a denial of service via unknown vectors that cause an invalid access of free memory.This vulnerability is addressed in the following product release:
Linux, Linux kernel, 2.4.2718173DSA-1082DSA-1070DSA-1069DSA-10672020220163http://kernel.debian.net/debian/pool/main/kernel-source-2.4.17/kernel-source-2.4.17_2.4.17-1woody4_ia64.changes20338Multiple stack-based buffer overflows in libcURL and cURL 7.12.1, and possibly other versions, allow remote malicious web servers to execute arbitrary code via base64 encoded replies that exceed the intended buffer lengths when decoded, which is not properly handled by (1) the Curl_input_ntlm function in http_ntlm.c during NTLM authentication or (2) the Curl_krb_kauth and krb4_auth functions in krb4.c during Kerberos authentication.GLSA-200503-2020050228 [USN-86-1] cURL vulnerabilityCLA-2005:940curl-kerberos-bo(19423)20050221 Multiple Unix/Linux Vendor cURL/libcURL Kerberos Authentication Buffer Overflow Vulnerability20050221 Multiple Unix/Linux Vendor cURL/libcURL NTLM Authentication Buffer Overflow Vulnerabilityoval:org.mitre.oval:def:102731261612615RHSA-2005:340SUSE-SA:2005:011MDKSA-2005:048Stack-based buffer overflow in Knox Arkeia Server Backup 5.3.x allows remote attackers to execute arbitrary code via a long type 77 request.1259414327arkeia-backup-client-bo(19398)20050218 Knox Arkeia remote root/system exploitAdobe Acrobat Reader 6.0.3 and 7.0.0 allows remote attackers to cause a denial of service (application crash) via a PDF file that contains a negative Count value in the root page node.http://www.adobe.com/support/techdocs/331468.htmladobe-root-page-node-dos(19946)ADV-2005-031020050218 Adobe Reader invalid root page node Count value DOS14813CRLF injection vulnerability in bizmail.cgi in Biz Mail Form before 2.2 allows remote attackers to bypass the email check and send spam e-mail via CRLF sequences and forged mail headers in the email parameter.Upgrade to newest version.20050218 BizMail 2.1 Spam ExploitThe RgSecurity form in the HTTP server for the Thomson TCW690 cable modem running firmware 2.1 and software ST42.03.0a does not properly validate the password before performing changes, which allows remote attackers on the LAN to gain access via a direct POST request.thomson-tcw690-gain-access(19387)1435320050219 Thomson TCW690 POST Password Validation VulnerabilityCross-site scripting (XSS) vulnerability in ZeroBoard allows remote attackers to inject arbitrary web script or HTML via the (1) sn1, (2) year, or (3) page parameter to zboard.php or (4) filename to view_image.php.zeroboard-xss(19420)101324320050219 Multiples vulnerability in ZeroBoard,Arkeia Network Backup Client 5.x contains hard-coded credentials that effectively serve as a back door, which allows remote attackers to access the file system and possibly execute arbitrary commands.arkeia-backup-client-gain-access(20667)1013256http://metasploit.com/research/arkeia_agent/20050220 Arkeia Network Backup Client Remote AccessADP Elite System Max 9000 allows remote authenticated users to gain privileges by uploading a .profile that sets the ADPROOT environment variable to the root directory.20050219 ADP Elite System Max 9000 Series Login Vulnerabilityadp-elite-gain-privileges(20622)Gigafast router (aka CompUSA router) allows remote attackers to gain sensitive information and bypass the login page via a direct request to backup.cfg, which reveals the administrator password in plaintext.gigafast-backupcfg-plaintext-password(19422)20050220 Gigafast/CompUSA router (model EE400-R) vulnerabilitiesGigafast router (aka CompUSA router) with the DNS proxy option enabled allows remote attackers to cause a denial of service via malformed DNS queries.gigafast-dns-queries-dos(19426)20050220 Gigafast/CompUSA router (model EE400-R) vulnerabilitiesInternet Explorer 6.0 on Windows XP SP2 allows remote attackers to spoof the domain name of a URL in a titlebar for a script-initiated popup window, which could facilitate phishing attacks.ie-title-bar-spoofing(19452)1260220050221 WindowsXPSP2 script-initiated popup window14335Buffer overflow in Bontago 1.1 and earlier allows remote attackers exeucte arbitrary code via a long nickname.bontago-nickname-bo(19406)1260314350http://aluigi.altervista.org/adv/bontagobof-adv.txtDirectory traversal vulnerability in Xinkaa 1.0.3 and earlier allows remote attackers to read arbitrary files via (1) ../ and (2) ..\ characters in an HTTP request.xinkaa-web-directory-traversal(19404)ADV-2005-01891260614349http://aluigi.altervista.org/adv/xinkaa-adv.txtuim before 0.4.5.1 trusts certain environment variables when libUIM is used in setuid or setgid applications, which allows local users to gain privileges.1260413981[uim] 20050220 uim 0.4.5.1 releasedMDKSA-2005:046Buffer overflow in the MoxaDriverIoctl function for the moxa serial driver (moxa.c) in Linux 2.2.x, 2.4.x, and 2.6.x before 2.6.22 allows local users to execute arbitrary code via a certain modified length value.12195ADV-2005-1878USN-508-1RHSA-2005:663RHSA-2005:551RHSA-2005:529DSA-1082DSA-1070DSA-1069DSA-10671013273301122665120338202022016317002oval:org.mitre.oval:def:977020050107 grsecurity 2.1.0 release / 5 Linux kernel advisorieshttp://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.22RHSA-2008:0237Unknown vulnerability in Information Resource Manager (IRM) before 1.5.2.1 allows remote attackers has "potentially serious" impact, related to LDAP logins.irm-ldap-security-bypass(19419)http://sourceforge.net/project/shownotes.php?release_id=30662914342The Avaya IP Office Phone Manager, and other products such as the IP Softphone, stores sensitive data in cleartext in a registry key, which allows local and possibly remote users to steal usernames and passwords and impersonate other users via keys such as Avaya\IP400\Generic.http://support.avaya.com/elmodocs2/security/ASA-2005-041_Sensitive_Info_Leak.pdf20050222 Re: Avaya IP Office Phone Manager - Sensitive Information Cleartext Vulnerability20050222 Avaya IP Office Phone Manager - Sensitive Information CleartextDirectory traversal vulnerability in SD Server 4.0.70 and earlier allows remote attackers to read arbitrary files via .. sequences in an HTTP request.1436520050221 SD Server 4.0.70 Directory Traversal Bughttp://www.gdsoftware.dk/20050222 SD Server 4.0.70 Directory Traversal BugUnknown vulnerability in Squiggle for Batik before 1.5.1 allows attackers to bypass certain access controls via certain features of the Rhino scripting engine due to a "script security issue."1261914336http://xml.apache.org/batik/#SecurityWarningMultiple cross-site scripting (XSS) vulnerabilities in the Mono 1.0.5 implementation of ASP.NET (.Net) allow remote attackers to inject arbitrary HTML or web script via Unicode representations for ASCII fullwidth characters that are converted to normal ASCII characters, including ">" and "<".1432520050217 XSS vulnerabilty in ASP.Net [with details]http://it-project.ru/andir/docs/aspxvuln/aspxvuln.en.xmlThe daemon for fallback-reboot before 0.995 allows attackers to cause a denial of service (daemon exit), possibly related to verbose debug messages when the daemon is not on a tty.14328http://dcs.nac.uci.edu/~strombrg/fallback-reboot/misc.php for vBulletin 3.0.6 and earlier, when "Add Template Name in HTML Comments" is enabled, allows remote attackers to execute arbitrary PHP code via nested variables in the template parameter.14326http://www.vbulletin.com/forum/showthread.php?postid=8195621262220050222 [SCAN Associates Security Advisory] vbulletin 3.0.6 and below php code injectionPHP remote file inclusion vulnerability in Tar.php in Mambo 4.5.2 allows remote attackers to execute arbitrary PHP code by modifying the mosConfig_absolute_path parameter to reference a URL on a remote web server that contains the code, a different vulnerability than CVE-2004-1693.14337http://mamboforge.net/frs/download.php/4043/Patch_4.5.2_to_4.5.2.1.zipPHP remote file inclusion vulnerability in mail_autocheck.php in the Email This Entry add-on for pMachine Pro 2.4, and possibly other versions including pMachine Free, allows remote attackers to execute arbitrary PHP code by directly requesting mail_autocheck.php and modifying the pm_path parameter to reference a URL on a remote web server that contains the code, a different vulnerability than CVE-2003-1086.125971547320050219 pMachine Pro / pMachine Free Remote Code ExecutionCross-site scripting (XSS) vulnerability in Verity Ultraseek before 5.3.3 allows remote attackers to inject arbitrary HTML and web script via search parameters.VU#716144http://www.mikx.de/index.php?p=61436720041223 Cross-Site Scripting - an industry-wide problemSmc.exe in My Firewall Plus 5.0 build 1117, and possibly other versions, does not drop privileges before launching the Log Viewer export functionality, which allows local users to corrupt arbitrary files by saving log files.http://www.webroot.com/services/mfp_advisory.php12842http://secunia.com/secunia_research/2004-20/advisory/13577The ImageGalleryPlugin (ImageGalleryPlugin.pm) in Twiki allows remote attackers to execute arbitrary commands via certain commands that generate thumbnails.14384http://www.enyo.de/fw/security/notes/twiki-robustness.htmlhttp://static.enyo.de/fw/patches/twiki/imagegallery-robustness-20041128.diff20050223 Robustness patch for TWiki, vulnerability in ImageGalleryPluginPeerFTP_5 stores sensitive information such as passwords in plaintext in the PeerFTP.ini files, which allows local users to gain privileges.1013263eXeem 0.21 stores sensitive information such as passwords in plaintext in the Exeem registry key, which allows local users to gain privileges via the proxy_user and proxy_password values.1013266ArGoSoft FTP Server before 1.4.2.7 allows remote attackers to read arbitrary files by uploading a ZIP file containing a shortcut (.LNK) file, using SITE UNZIP to extract the .LNK file onto the server, then accessing the file, a different vulnerability than CVE-2005-0520.http://www.argosoft.com/ftpserver/changelist.aspx14172argosoft-ink-file-upload(17939)1248713614ArGoSoft FTP Server before 1.4.2.8 allows remote attackers to read arbitrary files via shortcut (.LNK) files in the SITE COPY command, a different vulnerability than CVE-2005-0519.http://www.argosoft.com/ftpserver/changelist.aspx14372argosoft-site-copy-files(19442)1263214061SendLink 1.5 stores sensitive information, possibly including passwords, in plaintext in the data.eat file, which allows local users to gain privileges.1013269Chat Anywhere 2.72a stores sensitive information such as passwords in plaintext in the .INI file for a chatroom, which allows local users to gain privileges.1013270Format string vulnerability in ProZilla 1.3.7.3 and earlier allows remote attackers to execute arbitrary code via format string specifiers in the Location header.DSA-71912635http://www.securiteam.com/exploits/5WP082KEUW.htmlThe php_handle_iff function in image.c for PHP 4.2.2, 4.3.9, 4.3.10 and 5.0.3, as reachable by the getimagesize PHP function, allows remote attackers to cause a denial of service (infinite loop) via a -8 size value.20050331 PHP getimagesize() Multiple Denial of Service Vulnerabilities101361914792php-phphandleiff-dos(19920)ADV-2005-0305RHSA-2005:406RHSA-2005:405GLSA-200504-15oval:org.mitre.oval:def:9310APPLE-SA-2005-06-0815183MDKSA-2005:072The php_next_marker function in image.c for PHP 4.2.2, 4.3.9, 4.3.10 and 5.0.3, as reachable by the getimagesize PHP function, allows remote attackers to cause a denial of service (infinite loop) via a JPEG image with an invalid marker value, which causes a negative length value to be passed to php_stream_seek.DSA-70814792ADV-2005-030520050331 PHP getimagesize() Multiple Denial of Service VulnerabilitiesRHSA-2005:406RHSA-2005:405GLSA-200504-15DSA-7291013619oval:org.mitre.oval:def:11703APPLE-SA-2005-06-0815184MDKSA-2005:072Multiple cross-site scripting (XSS) vulnerabilities in PBLang 4.65 allow remote attackers to inject arbitrary web script or HTML via (1) the search string to search.php, (2) the subject of a PM, which is processed by pm.php, or (3) the body of a PM, which is processed by pmpshow.php.101327720050222 Software PBLang 4.65 pm.php XSS vulnerability20050222 Software PBLang 4.65 pmpshow.php XSS vulnerability20050222 Software PBLang 4.65 search.php XSS vulnerabilityFirefox 1.0 allows remote attackers to execute arbitrary code via plugins that load "privileged content" into frames, as demonstrated using certain XUL events when a user drags a scrollbar two times, aka "Firescrolling."GLSA-200503-30GLSA-200503-10http://www.mozilla.org/security/announce/mfsa2005-27.htmlhttp://www.mikx.de/?p=111013301oval:org.mitre.oval:def:1177220050225 Firescrolling [Firefox 1.0]RHSA-2005:384RHSA-2005:176oval:org.mitre.oval:def:100031** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2003-0985. Reason: This candidate is a duplicate of CVE-2003-0985. Notes: All CVE users should reference CVE-2003-0985 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.Linux kernel 2.6.10 and 2.6.11rc1-bk6 uses different size types for offset arguments to the proc_file_read and locks_read_proc functions, which leads to a heap-based buffer overflow when a signed comparison causes negative integers to be used in a positive context.http://www.guninski.com/where_do_you_want_billg_to_go_today_3.html20050215 linux kernel 2.6 fun. windoze is a jokeSUSE-SA:2005:018oval:org.mitre.oval:def:899420050315 [USN-95-1] Linux kernel vulnerabilitieshttp://linux.bkbits.net:8080/linux-2.6/cset@4201818eC6aMn0x3GY_9rw3ueb2ZWQCLA-2005:930RHSA-2005:366Signedness error in the copy_from_read_buf function in n_tty.c for Linux kernel 2.6.10 and 2.6.11rc1 allows local users to read kernel memory via a negative argument.http://www.guninski.com/where_do_you_want_billg_to_go_today_3.html20050215 linux kernel 2.6 fun. windoze is a jokeSUSE-SA:2005:018oval:org.mitre.oval:def:1096020050315 [USN-95-1] Linux kernel vulnerabilitieshttp://linux.bkbits.net:8080/linux-2.6/cset@420181322LZmhPTewcCOLkubGwOL3wCLA-2005:930RHSA-2005:366The atm_get_addr function in addr.c for Linux kernel 2.6.10 and 2.6.11 before 2.6.11-rc4 may allow local users to trigger a buffer overflow via negative arguments.http://www.guninski.com/where_do_you_want_billg_to_go_today_3.html20050215 linux kernel 2.6 fun. windoze is a joke20050315 [USN-95-1] Linux kernel vulnerabilitieshttp://linux.bkbits.net:8080/linux-2.6/gnupatch@4208e1fcfccuD-eH2OGM5mBhihmQ3ACLA-2005:930oval:org.mitre.oval:def:10095RHSA-2005:366The reiserfs_copy_from_user_to_file_region function in reiserfs/file.c for Linux kernel 2.6.10 and 2.6.11 before 2.6.11-rc4, when running on 64-bit architectures, may allow local users to trigger a buffer overflow as a result of casting discrepancies between size_t and int data types.SUSE-SA:2005:018http://www.guninski.com/where_do_you_want_billg_to_go_today_3.html20050215 linux kernel 2.6 fun. windoze is a joke20050315 [USN-95-1] Linux kernel vulnerabilitieshttp://linux.bkbits.net:8080/linux-2.6/cset@42018227TkNpHlX6BefnItV_GqMmzQHeap-based buffer overflow in Trend Micro AntiVirus Library VSAPI before 7.510, as used in multiple Trend Micro products, allows remote attackers to execute arbitrary code via a crafted ARJ file with long header file names that modify pointers within a structure.http://www.trendmicro.com/vinfo/secadvisories/default6.asp?VName=Vulnerability+in+VSAPI+ARJ+parsing+could+allow+Remote+Code+execution12643101329010132891439620050224 Trend Micro AntiVirus Library Heap OverflowMultiple cross-site scripting (XSS) vulnerabilities in MediaWiki 1.3.x before 1.3.11 and 1.4 beta before 1.4 rc1 allow remote attackers to inject arbitrary web script.http://sourceforge.net/project/shownotes.php?release_id=307067101326014360GLSA-200502-33Cross-site request forgery (CSRF) vulnerability in MediaWiki 1.3.x before 1.3.11 and 1.4 beta before 1.4 rc1 allows remote attackers to perform unauthorized actions as authenticated MediaWiki users.101326014360GLSA-200502-33Directory traversal vulnerability in MediaWiki 1.3.x before 1.3.11 and 1.4 beta before 1.4 rc1 allows remote attackers to delete arbitrary files or determine file existence via a parameter related to image deletion.http://sourceforge.net/project/shownotes.php?release_id=307067101326014360GLSA-200502-33Multiple SQL injection vulnerabilities in page.php for iGeneric (iG) Shop 1.2 may allow remote attackers to execute arbitrary SQL statements via the (1) cats, (2) l_price, or (3) u_price parameters.10132681436920050221 [NOBYTES.COM: #5] iGeneric eShop 1.2 - Information Disclosure & Possible SQL InjectionDirectory traversal vulnerability in (1) GinpPictureServlet.java and (2) PicCollection.java in ginp (Java Photo Gallery Web Application) before 0.22 allows remote attackers to read arbitrary files.http://sourceforge.net/project/shownotes.php?release_id=30751814373Unknown vulnerability in IBM Hardware Management Console (HMC) before 4.4 for POWER5 servers allows local users to gain privileges, related to the Guided Setup Wizard.http://techsupport.services.ibm.com/server/hmc/power5/fixes/ptf_MH00220.html14377Cyclades AlterPath Manager (APM) Console Server 1.2.1 allows remote attackers to obtain sensitive information via a direct request to the /about.html page.14073http://www.cirt.net/advisories/alterpath_disclosure.shtml1437820050224 Cyclades AlterPath Manager VulnerabilitiesconsoleConnect.jsp in Cyclades AlterPath Manager (APM) Console Server 1.2.1 allows remote attackers to connect to arbitrary consoles by modifying the consolename parameter.14075http://www.cirt.net/advisories/alterpath_console.shtml1437820050224 Cyclades AlterPath Manager VulnerabilitiessaveUser.do in Cyclades AlterPath Manager (APM) Console Server 1.2.1 allows local users to gain privileges by setting the adminUser parameter to true.14074http://www.cirt.net/advisories/alterpath_privesc.shtml1437820050224 Cyclades AlterPath Manager VulnerabilitiesCross-site scripting (XSS) vulnerability in phpMyAdmin 2.6.1 allows remote attackers to inject arbitrary HTML and web script via (1) the strServer, cfg[BgcolorOne], or strServerChoice parameters in select_server.lib.php, (2) the bg_color or row_no parameters in display_tbl_links.lib.php, the left_font_family parameter in theme_left.css.php, or the right_font_family parameter in theme_right.css.php.phpmyadmin-multiple-php-xss(19462)12644GLSA-200503-071438220050224 [SECURITYREASON.COM] phpMyAdmin 2.6.1 Remote file inclusion and XSS cXIb8O3.4phpMyAdmin 2.6.1 allows remote attackers to obtain the full path of the server via direct requests to (1) sqlvalidator.lib.php, (2) sqlparser.lib.php, (3) select_theme.lib.php, (4) select_lang.lib.php, (5) relation_cleanup.lib.php, (6) header_meta_style.inc.php, (7) get_foreign.lib.php, (8) display_tbl_links.lib.php, (9) display_export.lib.php, (10) db_table_exists.lib.php, (11) charset_conversion.lib.php, (12) ufpdf.php, (13) mysqli.dbi.lib.php, (14) setup.php, or (15) cookie.auth.lib.php, which reveals the path in a PHP error message.GLSA-200503-0714382http://sourceforge.net/tracker/index.php?func=detail&aid=1149383&group_id=23067&atid=377408Microsoft Windows XP Pro SP2 and Windows 2000 Server SP4 running Active Directory allow local users to bypass group policies that restrict access to hidden drives by using the browse feature in Office 10 applications such as Word or Excel, or using a flash drive. NOTE: this issue has been disputed in a followup post.1264120050223 Office 10 applications & flashdrives can be used to browse restricted drives20050225 Re: Office 10 applications & flashdrives can be used to browse restricted