Section: .. / 0803-advisories /
| /// File Name: |
glsa-200803-11.txt |
Description:
|
Gentoo Linux Security Advisory GLSA 200803-11 - Joey Hess reported that vobcopy appends data to the file /tmp/vobcopy.bla in an insecure manner. Versions less than 1.1.0 are affected.
| | Homepage: | http://security.gentoo.org | | File Size: | 2782 | | Related CVE(s): | CVE-2007-5718 | | Last Modified: | Mar 12 14:43:44 2008 |
| MD5 Checksum: | 1bbe42001ff27c03dc97257e8a4df97b |
|
| /// File Name: |
glsa-200803-12.txt |
Description:
|
Gentoo Linux Security Advisory GLSA 200803-12 - Ulf Harnhammar from Secunia Research discovered a format string error in the emf_multipart_encrypted() function in the file mail/em-format.c when reading certain data (e.g. the Version: field) from an encrypted e-mail. Versions less than 2.12.3-r1 are affected.
| | Homepage: | http://security.gentoo.org | | File Size: | 2932 | | Related CVE(s): | CVE-2008-0072 | | Last Modified: | Mar 12 16:25:12 2008 |
| MD5 Checksum: | fec966c95aecd78ec71983543a776515 |
|
| /// File Name: |
glsa-200803-14.txt |
Description:
|
Gentoo Linux Security Advisory GLSA 200803-14 - Chris Evans (Google Security) discovered a stack-based buffer overflow within the zseticcspace() function in the file zicc.c when processing a PostScript file containing a long Range array in a .seticcscpate operator. Versions less than 8.15.4-r1 are affected.
| | Homepage: | http://security.gentoo.org | | File Size: | 3649 | | Related CVE(s): | CVE-2008-0411 | | Last Modified: | Mar 12 18:54:31 2008 |
| MD5 Checksum: | 6bea26a9670869a60625a228fbb462ca |
|
| /// File Name: |
glsa-200803-15.txt |
Description:
|
Gentoo Linux Security Advisory GLSA 200803-15 - Richard Cunningham reported that phpMyAdmin uses the $_REQUEST variable of $_GET and $_POST as a source for its parameters. Versions less than 2.11.5 are affected.
| | Homepage: | http://security.gentoo.org | | File Size: | 2874 | | Related CVE(s): | CVE-2008-1149 | | Last Modified: | Mar 12 18:55:34 2008 |
| MD5 Checksum: | f37c7a57ed8f1b91372947d99206f9a6 |
|
| /// File Name: |
glsa-200803-17.txt |
Description:
|
Gentoo Linux Security Advisory GLSA 200803-17 - poplix reported multiple boundary errors in the pdc_fsearch_fopen() function when processing overly long filenames. Versions less than 7.0.2_p8 are affected.
| | Homepage: | http://security.gentoo.org | | File Size: | 2805 | | Related CVE(s): | CVE-2007-6561 | | Last Modified: | Mar 12 20:31:55 2008 |
| MD5 Checksum: | c71644cbb11aa3d599ea1998b544e571 |
|
| /// File Name: |
glsa-200803-19.txt |
Description:
|
Gentoo Linux Security Advisory GLSA 200803-19 - Adrian Pastor and Amir Azam (ProCheckUp) reported that the HTTP Method specifier header is not properly sanitized when the HTTP return code is 413 Request Entity too large (CVE-2007-6203). The mod_proxy_balancer module does not properly check the balancer name before using it (CVE-2007-6422). The mod_proxy_ftp does not define a charset in its answers (CVE-2008-0005). Stefano Di Paola (Minded Security) reported that filenames are not properly sanitized within the mod_negociation module (CVE-2008-0455, CVE-2008-0456). Versions less than 2.2.8 are affected.
| | Homepage: | http://security.gentoo.org | | File Size: | 3663 | | Related CVE(s): | CVE-2007-6203, CVE-2007-6422, CVE-2008-0005, CVE-2008-0455, CVE-2008-0456 | | Last Modified: | Mar 13 00:49:36 2008 |
| MD5 Checksum: | dc957d1a1a0a8a3af3296443b86966e4 |
|
| /// File Name: |
glsa-200803-20.txt |
Description:
|
Gentoo Linux Security Advisory GLSA 200803-20 - Will Drewry (Google Security) reported a vulnerability in the regular expression engine when using back references to capture \0 characters (CVE-2007-4770). He also found that the backtracking stack size is not limited, possibly allowing for a heap-based buffer overflow (CVE-2007-4771). Versions less than 3.8.1-r1 are affected.
| | Homepage: | http://security.gentoo.org | | File Size: | 3361 | | Related CVE(s): | CVE-2007-4770, CVE-2007-4771 | | Last Modified: | Mar 13 00:54:32 2008 |
| MD5 Checksum: | eaf7de4e9d22e760b2e1a5d10e3173f9 |
|
| /// File Name: |
glsa-200803-21.txt |
Description:
|
Gentoo Linux Security Advisory GLSA 200803-21 - Sarg doesn't properly check its input for abnormal content when processing Squid log files. Versions less than 2.2.5 are affected.
| | Homepage: | http://security.gentoo.org | | File Size: | 2832 | | Related CVE(s): | CVE-2008-1167, CVE-2008-1168 | | Last Modified: | Mar 13 01:50:44 2008 |
| MD5 Checksum: | 8507a82a3018f92e30f921c57e5ed0a0 |
|
| /// File Name: |
glsa-200803-22.txt |
Description:
|
Gentoo Linux Security Advisory GLSA 200803-22 - Luigi Auriemma reported a signedness error in the parseRTSPRequestString() function when processing short RTSP queries. Versions less than 2008.02.08 are affected.
| | Homepage: | http://security.gentoo.org | | File Size: | 3076 | | Related CVE(s): | CVE-2007-6036 | | Last Modified: | Mar 13 19:17:24 2008 |
| MD5 Checksum: | 3f3b2a67d06191bdcd33f49cfaedb27a |
|
| /// File Name: |
glsa-200803-23.txt |
Description:
|
Gentoo Linux Security Advisory GLSA 200803-23 - Temporary files are handled insecurely in the files wml_backend/p1_ipp/ipp.src, wml_contrib/wmg.cgi, and wml_backend/p3_eperl/eperl_sys.c, allowing users to overwrite or delete arbitrary files with the privileges of the user running the program. Versions less than 2.0.11-r3 are affected.
| | Homepage: | http://security.gentoo.org | | File Size: | 3090 | | Related CVE(s): | CVE-2008-0665, CVE-2008-0666 | | Last Modified: | Mar 17 14:29:51 2008 |
| MD5 Checksum: | 44fed14f5744d1d1bba3fe39892b8e4e |
|
| /// File Name: |
glsa-200803-24-02.txt |
Description:
|
Gentoo Linux Security Advisory GLSA 200803-24:02 - PCRE contains a buffer overflow vulnerability when processing a character class containing a very large number of characters with codepoints greater than 255. Versions less than 7.6-r1 are affected.
| | Homepage: | http://security.gentoo.org | | File Size: | 3411 | | Related CVE(s): | CVE-2008-0674 | | Last Modified: | Mar 18 21:43:24 2008 |
| MD5 Checksum: | 2e890d70d0956a2904ab3874722f1435 |
|
| /// File Name: |
glsa-200803-25.txt |
Description:
|
Gentoo Linux Security Advisory GLSA 200803-25 - Dovecot uses the group configured via the mail_extra_groups setting, which should be used to create lockfiles in the /var/mail directory, when accessing arbitrary files (CVE-2008-1199). Dovecot does not escape TAB characters in passwords when saving them, which might allow for argument injection in blocking passdbs such as MySQL, PAM or shadow (CVE-2008-1218). Versions less than 1.0.13-r1 are affected.
| | Homepage: | http://security.gentoo.org | | File Size: | 3325 | | Related CVE(s): | CVE-2008-1199, CVE-2008-1218 | | Last Modified: | Mar 18 21:49:51 2008 |
| MD5 Checksum: | 76e43260116a23ea2d999c1d92295e87 |
|
| /// File Name: |
glsa-200803-26.txt |
Description:
|
Gentoo Linux Security Advisory GLSA 200803-26 - SUSE reported that the acroread wrapper script does not create temporary files in a secure manner when handling SSL certificates (CVE-2008-0883). Versions less than 8.1.2-r1 are affected.
| | Homepage: | http://security.gentoo.org | | File Size: | 2496 | | Related CVE(s): | CVE-2008-0883 | | Last Modified: | Mar 18 21:50:11 2008 |
| MD5 Checksum: | ba7bd20480a9c289bb055b91d942814d |
|
| /// File Name: |
glsa-200803-30.txt |
Description:
|
Gentoo Linux Security Advisory GLSA 200803-30 - Robin Johnson reported that the docert() function provided by ssl-cert.eclass can be called by source building stages of an ebuild, such as src_compile() or src_install(), which will result in the generated SSL keys being included inside binary packages (binpkgs). Versions less than 8.1.16 are affected.
| | Homepage: | http://security.gentoo.org | | File Size: | 5640 | | Related CVE(s): | CVE-2008-1383 | | Last Modified: | Mar 20 16:52:00 2008 |
| MD5 Checksum: | 93740d26539dc111ca0a765b76fd3cae |
|
| /// File Name: |
glsa-200803-31.txt |
Description:
|
Gentoo Linux Security Advisory GLSA 200803-31 - Two vulnerabilities were found in the Kerberos 4 support in KDC: A global variable is not set for some incoming message types, leading to a NULL pointer dereference or a double free() and unused portions of a buffer are not properly cleared when generating an error message, which results in stack content being contained in a reply. Versions less than 1.6.3-r1 are affected.
| | Homepage: | http://security.gentoo.org/ | | File Size: | 4514 | | Related CVE(s): | CVE-2007-5901, CVE-2007-5971, CVE-2008-0062, CVE-2008-0063, CVE-2008-0947 | | Last Modified: | Mar 24 18:48:28 2008 |
| MD5 Checksum: | d97e73211f5b32866700162abb9e1ca9 |
|
| /// File Name: |
Hacking_Plone_CMS.pdf |
Description:
|
The Plone CMS is susceptible to cross site request forgery attacks and suffers from other vulnerabilities such as credentials being stored in cookies, a lack of authentication state on the server side, and session cookies never changing.
| | Author: | Adrian Pastor | | Homepage: | http://www.procheckup.com/ | | File Size: | 277656 | | Related CVE(s): | CVE-2008-0164 | | Last Modified: | Mar 13 19:15:47 2008 |
| MD5 Checksum: | 9c85af67bd6e456f894d3a6f645b6a9b |
|
| /// File Name: |
ie-spoof.txt |
Description:
|
It appears that Internet Explorer 7 may have an address bar spoofing vulnerability.
| | Author: | Juan Pablo Lopez Yacubian | | File Size: | 1099 | | Last Modified: | Mar 28 17:17:52 2008 |
| MD5 Checksum: | a2a9fcbc095113cb1345ed904bad851c |
|
|
|
|
|
![.:[ packet storm ]:.](/images/ps-ani.gif)
