========================================================================
The Secunia Weekly Advisory Summary
2004-12-09 - 2004-12-16
This week : 64 advisories
========================================================================
Table of Contents:
1.....................................................Word From Secunia
2....................................................This Week In Brief
3...............................This Weeks Top Ten Most Read Advisories
4.......................................Vulnerabilities Summary Listing
5.......................................Vulnerabilities Content Listing
========================================================================
1) Word From Secunia:
Monitor, Filter, and Manage Security Information
- Filtering and Management of Secunia advisories
- Overview, documentation, and detailed reports
- Alerting via email and SMS
Request Trial:
https://ca.secunia.com/?f=s
========================================================================
2) This Week in Brief:
ADVISORIES:
Microsoft has issued the monthly security updates for December. The
updates covers vulnerabilities in almost every single operating system
from Microsoft.
All Microsoft users are advised to visit WindowUpdate and check for
available updates.
Additional details about the specific vulnerabilities can be found in
referenced Secunia advisories below.
References:
http://secunia.com/SA13466/
http://secunia.com/SA13465/
http://secunia.com/SA13464/
http://secunia.com/SA13463/
http://secunia.com/SA13462/
--
3 more browsers have been found vulnerable to the Window Injection
vulnerability, which was disclosed last week by Secunia Research. The
affected browsers are: iCab, Internet Explorer for Mac, and OmniWeb.
Secunia has an online demonstration of the vulnerability here:
http://secunia.com/multiple_browsers_window_injection_vulnerability_test/
References:
http://secunia.com/SA13356/
http://secunia.com/SA13412/
http://secunia.com/SA13418/
VIRUS ALERTS:
During the last week, Secunia issued 1 MEDIUM RISK virus alert and 1
HIGH RISK virus alert.
Please refer to the grouped virus profiles below for more information:
Zafi.D - HIGH RISK Virus Alert - 2004-12-15 09:04 GMT+1
http://secunia.com/virus_information/13871/zafi.d/
Zafi.D - MEDIUM RISK Virus Alert - 2004-12-14 15:31 GMT+1
http://secunia.com/virus_information/13871/zafi.d/
========================================================================
3) This Weeks Top Ten Most Read Advisories:
1. [SA13129] Mozilla / Mozilla Firefox Window Injection Vulnerability
2. [SA13251] Microsoft Internet Explorer Window Injection
Vulnerability
3. [SA12889] Microsoft Internet Explorer Two Vulnerabilities
4. [SA13253] Opera Window Injection Vulnerability
5. [SA13252] Safari Window Injection Vulnerability
6. [SA13402] Netscape Window Injection Vulnerability
7. [SA13404] Microsoft Internet Explorer FTP Command Injection
Vulnerability
8. [SA13254] Konqueror Window Injection Vulnerability
9. [SA11978] Multiple Browsers Frame Injection Vulnerability
10. [SA12712] Mozilla / Mozilla Firefox / Camino Tabbed Browsing
Vulnerabilities
========================================================================
4) Vulnerabilities Summary Listing
Windows:
[SA13464] Microsoft Windows HyperTerminal Buffer Overflow
Vulnerability
[SA13462] Microsoft Word for Windows Converter Buffer Overflow
Vulnerabilities
[SA13427] Gore: Ultimate Soldier CD-Key Validation Buffer Overflow
[SA13426] GameSpy CD-Key Validation SDK Buffer Overflow Vulnerability
[SA13411] MIMEsweeper for SMTP PDF File Processing Denial of Service
[SA13466] Microsoft Windows WINS "Name" Validation Vulnerability
[SA13463] Microsoft Windows NT DHCP Buffer Overflow Vulnerabilities
[SA13423] Codename Eagle Empty UDP Datagram Denial of Service
Vulnerability
[SA13415] FirstClass HTTP Large Request Handling Denial of Service
[SA13465] Microsoft Windows Kernel and LSASS Privilege Escalation
Vulnerabilities
[SA13460] Kerio MailServer / ServerFirewall Potential User Password
Disclosure
[SA13445] Symantec Windows LiveUpdate NetDetect Privilege Escalation
[SA13438] Winmail Server Installation Path Disclosure Weakness
[SA13416] F-Secure Policy Manager "fsmsh.dll" Path Disclosure Weakness
[SA13409] Microsoft Office SharePoint Portal Server Disclosure of User
Credentials
UNIX/Linux:
[SA13474] Adobe Acrobat Reader "mailListIsPdf()" Function Buffer
Overflow
[SA13461] Debian update for zgv
[SA13435] Red Hat update for imlib
[SA13425] Citadel/UX "lprintf()" Function Format String Vulnerability
[SA13417] Debian update for xfree86
[SA13456] Red Hat update for ncompress
[SA13449] zgv/xzgv Multiple Integer Overflow Vulnerabilities
[SA13439] Gentoo update for file
[SA13436] Sun Solaris Sendmail DNS TXT Records Buffer Overflow
[SA13428] Gentoo update for phprojekt
[SA13418] OmniWeb Window Injection Vulnerability
[SA13412] iCab Window Injection Vulnerability
[SA13459] Gentoo update for nfs-utils
[SA13458] Red Hat update for itanium kernel
[SA13457] Red Hat update for kernel
[SA13440] nfs-utils "getquotainfo()" Buffer Overflow Vulnerability
[SA13429] SGI IRIX update for samba
[SA13455] Red Hat update for apache/mod_ssl
[SA13454] Red Hat update for ruby
[SA13447] Opera Default Application "kfmclient exec" Security Issue
[SA13437] Sun Java System Web Server / Application Server Session ID
Disclosure
[SA13432] mnoGoSearch Cross-Site Scripting Vulnerabilities
[SA13469] Linux Kernel IGMP and "__scm_send()" Vulnerabilities
[SA13473] Debian update for atari800
[SA13442] Mandrake update for postgresql
[SA13430] mtr "mtr_curses_keyaction()" Function Buffer Overflow
Vulnerability
[SA13410] Linux Kernel "sys32_ni_syscall" and "sys32_vm86_warning"
Buffer Overflows
[SA13480] Gentoo update for ncpfs
[SA13444] Mandrake update for iproute2
[SA13443] OpenBSD isakmpd Denial of Service Vulnerability
Other:
[SA13434] Novell Netware "nlm" Screensaver Password Bypass
Vulnerability
Cross Platform:
[SA13479] GNUBoard "doc" Parameter Arbitrary File Inclusion
Vulnerability
[SA13478] MoniWiki Multiple File Extensions Script Upload
Vulnerability
[SA13471] Adobe Reader / Adobe Acrobat Multiple Vulnerabilities
[SA13468] Ethereal Multiple Vulnerabilities
[SA13448] NetMail IMAPD Unspecified Buffer Overflow Vulnerability
[SA13424] phpMyAdmin Two Vulnerabilities
[SA13421] phpBB Attachment Mod Two Vulnerabilities
[SA13419] MediaWiki "images" Arbitrary Script Upload and Execution
Vulnerability
[SA13467] phpGroupWare Cross-Site Scripting and SQL Injection
Vulnerabilities
[SA13451] Sugar Sales Arbitrary Local File Inclusion Vulnerabilities
[SA13446] Lithtech Engine UDP Datagram Denial of Service Vulnerability
[SA13431] SQLgrey Postfix greylisting service Unspecified SQL
Injection
[SA13422] PhpDig Unspecified Vulnerability
[SA13420] PHP Live! Unspecified Vulnerability
[SA13413] IlohaMail Unspecified Vulnerability
[SA13452] UBB.threads "Cat" Cross-Site Scripting Vulnerabilities
[SA13441] UseModWiki "wiki.pl" Cross-Site Scripting Vulnerability
[SA13414] PHP Gift Registry "message" Cross-Site Scripting
Vulnerabilities
========================================================================
5) Vulnerabilities Content Listing
Windows:--
[SA13464] Microsoft Windows HyperTerminal Buffer Overflow
Vulnerability
Critical: Moderately critical
Where: From remote
Impact: System access
Released: 2004-12-14
Brett Moore has reported a vulnerability in Microsoft Windows, which
can be exploited by malicious people to compromise a user's system.
Full Advisory:
http://secunia.com/advisories/13464/
--
[SA13462] Microsoft Word for Windows Converter Buffer Overflow
Vulnerabilities
Critical: Moderately critical
Where: From remote
Impact: System access
Released: 2004-12-14
Some vulnerabilities have been reported in Microsoft Windows, which can
be exploited by malicious people to compromise a user's system.
Full Advisory:
http://secunia.com/advisories/13462/
--
[SA13427] Gore: Ultimate Soldier CD-Key Validation Buffer Overflow
Critical: Moderately critical
Where: From remote
Impact: System access
Released: 2004-12-14
Luigi Auriemma has reported a vulnerability in Gore: Ultimate Soldier,
which potentially can be exploited by malicious people to compromise a
vulnerable system.
Full Advisory:
http://secunia.com/advisories/13427/
--
[SA13426] GameSpy CD-Key Validation SDK Buffer Overflow Vulnerability
Critical: Moderately critical
Where: From remote
Impact: System access
Released: 2004-12-13
Luigi Auriemma has reported a vulnerability in the Gamespy CD-Key
Validation SDK, which potentially can be exploited by malicious people
to compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/13426/
--
[SA13411] MIMEsweeper for SMTP PDF File Processing Denial of Service
Critical: Moderately critical
Where: From remote
Impact: DoS
Released: 2004-12-10
A vulnerability has been reported in MIMEsweeper for SMTP, which can be
exploited by malicious people to cause a DoS (Denial of Service).
Full Advisory:
http://secunia.com/advisories/13411/
--
[SA13466] Microsoft Windows WINS "Name" Validation Vulnerability
Critical: Moderately critical
Where: From local network
Impact: System access
Released: 2004-12-14
Kostya Kortchinsky has reported two vulnerabilities in Microsoft
Windows, allowing malicious people to compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/13466/
--
[SA13463] Microsoft Windows NT DHCP Buffer Overflow Vulnerabilities
Critical: Moderately critical
Where: From local network
Impact: System access, DoS
Released: 2004-12-14
Kostya Kortchinsky has reported two vulnerabilities in Microsoft
Windows NT, allowing malicious people to cause a DoS (Denial of
Service) or compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/13463/
--
[SA13423] Codename Eagle Empty UDP Datagram Denial of Service
Vulnerability
Critical: Less critical
Where: From remote
Impact: DoS
Released: 2004-12-13
Luigi Auriemma has reported a vulnerability in Codename Eagle, which
can be exploited by malicious people to cause a DoS (Denial of
Service).
Full Advisory:
http://secunia.com/advisories/13423/
--
[SA13415] FirstClass HTTP Large Request Handling Denial of Service
Critical: Less critical
Where: From remote
Impact: DoS
Released: 2004-12-14
XWaRloRDX and DiLA have reported a vulnerability in FirstClass, which
potentially can be exploited by malicious people to cause a DoS (Denial
of Service).
Full Advisory:
http://secunia.com/advisories/13415/
--
[SA13465] Microsoft Windows Kernel and LSASS Privilege Escalation
Vulnerabilities
Critical: Less critical
Where: Local system
Impact: Privilege escalation
Released: 2004-12-14
Cesar Cerrudo has reported two vulnerabilities in Microsoft Windows,
allowing malicious, local users to escalate their privileges.
Full Advisory:
http://secunia.com/advisories/13465/
--
[SA13460] Kerio MailServer / ServerFirewall Potential User Password
Disclosure
Critical: Less critical
Where: Local system
Impact: Exposure of sensitive information
Released: 2004-12-14
Javier Munoz has reported a security issue in Kerio MailServer and
Kerio ServerFirewall, which potentially can be exploited by malicious,
local users to gain knowledge of sensitive information.
Full Advisory:
http://secunia.com/advisories/13460/
--
[SA13445] Symantec Windows LiveUpdate NetDetect Privilege Escalation
Critical: Less critical
Where: Local system
Impact: Privilege escalation
Released: 2004-12-14
Secure Network Operations has reported a vulnerability in Symantec
Windows LiveUpdate, which can be exploited by malicious, local users to
gain escalated privileges.
Full Advisory:
http://secunia.com/advisories/13445/
--
[SA13438] Winmail Server Installation Path Disclosure Weakness
Critical: Not critical
Where: From remote
Impact: Exposure of system information
Released: 2004-12-13
Ziv Kamir has reported a weakness in WinMail Server, which can be
exploited by malicious people to disclose certain system information.
Full Advisory:
http://secunia.com/advisories/13438/
--
[SA13416] F-Secure Policy Manager "fsmsh.dll" Path Disclosure Weakness
Critical: Not critical
Where: From local network
Impact: Exposure of system information
Released: 2004-12-10
Oliver Karow has reported a weakness in F-Secure Policy Manager, which
can be exploited by malicious people to disclose certain system
information.
Full Advisory:
http://secunia.com/advisories/13416/
--
[SA13409] Microsoft Office SharePoint Portal Server Disclosure of User
Credentials
Critical: Not critical
Where: Local system
Impact: Exposure of sensitive information
Released: 2004-12-10
Alexander Fichman has reported a weakness in Microsoft Office
SharePoint Portal Server 2003, which may disclose sensitive information
to malicious, local users on the system.
Full Advisory:
http://secunia.com/advisories/13409/
UNIX/Linux:--
[SA13474] Adobe Acrobat Reader "mailListIsPdf()" Function Buffer
Overflow
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2004-12-15
iDEFENSE has reported a vulnerability in Adobe Acrobat Reader, which
can be exploited by malicious people to compromise a user's system.
Full Advisory:
http://secunia.com/advisories/13474/
--
[SA13461] Debian update for zgv
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2004-12-15
Debian has issued an update for zgv. This fixes multiple
vulnerabilities, which potentially can be exploited by malicious people
to compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/13461/
--
[SA13435] Red Hat update for imlib
Critical: Highly critical
Where: From remote
Impact: System access, DoS
Released: 2004-12-13
Red Hat has issued an update for imlib. This fixes multiple
vulnerabilities, which potentially can be exploited by malicious people
to compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/13435/
--
[SA13425] Citadel/UX "lprintf()" Function Format String Vulnerability
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2004-12-13
CoKi has reported a vulnerability in Citadel/UX, which can be exploited
by malicious people to compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/13425/
--
[SA13417] Debian update for xfree86
Critical: Highly critical
Where: From remote
Impact: DoS, System access
Released: 2004-12-13
Debian has issued an update for xfree86. This fixes some
vulnerabilities, which can be exploited by malicious people to cause a
DoS (Denial of Service) or compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/13417/
--
[SA13456] Red Hat update for ncompress
Critical: Moderately critical
Where: From remote
Impact: System access
Released: 2004-12-14
Red Hat has issued an update for ncompress. This fixes an old
vulnerability, which potentially can be exploited by malicious people
to compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/13456/
--
[SA13449] zgv/xzgv Multiple Integer Overflow Vulnerabilities
Critical: Moderately critical
Where: From remote
Impact: System access
Released: 2004-12-14
Some vulnerabilities have been reported in zgv/xzgv, which potentially
can be exploited by malicious people to compromise a vulnerable
system.
Full Advisory:
http://secunia.com/advisories/13449/
--
[SA13439] Gentoo update for file
Critical: Moderately critical
Where: From remote
Impact: System access
Released: 2004-12-14
Gentoo has issued an update for file. This fixes a vulnerability, which
potentially can be exploited by malicious people to compromise a user's
system.
Full Advisory:
http://secunia.com/advisories/13439/
--
[SA13436] Sun Solaris Sendmail DNS TXT Records Buffer Overflow
Critical: Moderately critical
Where: From remote
Impact: DoS, System access
Released: 2004-12-14
An old vulnerability has been reported in sendmail included in Solaris
9, which can be exploited by malicious people to cause a DoS (Denial of
Service) and potentially compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/13436/
--
[SA13428] Gentoo update for phprojekt
Critical: Moderately critical
Where: From remote
Impact: Security Bypass
Released: 2004-12-13
Gentoo has issued an update for phprojekt. This fixes a vulnerability,
which can be exploited by malicious people to bypass certain security
restrictions.
Full Advisory:
http://secunia.com/advisories/13428/
--
[SA13418] OmniWeb Window Injection Vulnerability
Critical: Moderately critical
Where: From remote
Impact: Spoofing
Released: 2004-12-10
Secunia Research has reported a vulnerability in OmniWeb, which can be
exploited by malicious people to spoof the content of websites.
Full Advisory:
http://secunia.com/advisories/13418/
--
[SA13412] iCab Window Injection Vulnerability
Critical: Moderately critical
Where: From remote
Impact: Spoofing
Released: 2004-12-10
Secunia Research has reported a vulnerability in iCab, which can be
exploited by malicious people to spoof the content of websites.
Full Advisory:
http://secunia.com/advisories/13412/
--
[SA13459] Gentoo update for nfs-utils
Critical: Moderately critical
Where: From local network
Impact: DoS, System access
Released: 2004-12-14
Gentoo has issued an update for nfs-utils. This fixes some
vulnerabilities, which can be exploited by malicious people to cause a
DoS (Denial of Service) or potentially compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/13459/
--
[SA13458] Red Hat update for itanium kernel
Critical: Moderately critical
Where: From local network
Impact: Exposure of system information, Exposure of sensitive
information, Privilege escalation, DoS, System access
Released: 2004-12-14
Red Hat has issued an update for the itanium kernel. This fixes
multiple vulnerabilities, which can be exploited to gain escalated
privileges, cause a DoS (Denial of Service), gain knowledge of
sensitive information, or potentially compromise a system.
Full Advisory:
http://secunia.com/advisories/13458/
--
[SA13457] Red Hat update for kernel
Critical: Moderately critical
Where: From local network
Impact: Exposure of sensitive information, Privilege escalation,
DoS, System access
Released: 2004-12-14
Red Hat has issued an update for the kernel. This fixes multiple
vulnerabilities, which can be exploited to gain escalated privileges,
gain knowledge of sensitive information, cause a DoS (Denial of
Service), or potentially compromise a system.
Full Advisory:
http://secunia.com/advisories/13457/
--
[SA13440] nfs-utils "getquotainfo()" Buffer Overflow Vulnerability
Critical: Moderately critical
Where: From local network
Impact: System access
Released: 2004-12-14
Arjan van de Ven has reported a vulnerability in nfs-utils, which
potentially can be exploited by malicious people to compromise a
vulnerable system.
Full Advisory:
http://secunia.com/advisories/13440/
--
[SA13429] SGI IRIX update for samba
Critical: Moderately critical
Where: From local network
Impact: DoS, System access
Released: 2004-12-13
SGI has issued an update for samba. This fixes multiple
vulnerabilities, which can be exploited to cause a DoS (Denial of
Service) or compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/13429/
--
[SA13455] Red Hat update for apache/mod_ssl
Critical: Less critical
Where: From remote
Impact: Security Bypass, Spoofing, Privilege escalation
Released: 2004-12-14
Red Hat has issued updates for apache and mod_ssl. These fix multiple
vulnerabilities, which can be exploited to gain escalated privileges,
gain unauthorised access to other web sites, or bypass certain security
restrictions.
Full Advisory:
http://secunia.com/advisories/13455/
--
[SA13454] Red Hat update for ruby
Critical: Less critical
Where: From remote
Impact: DoS
Released: 2004-12-14
Red Hat has issued an update for ruby. This fixes a vulnerability,
which can be exploited by malicious people to cause a DoS (Denial of
Service).
Full Advisory:
http://secunia.com/advisories/13454/
--
[SA13447] Opera Default Application "kfmclient exec" Security Issue
Critical: Less critical
Where: From remote
Impact: System access
Released: 2004-12-15
Giovanni Delvecchio has discovered a security issue in Opera, which can
be exploited by malicious people to compromise a user's system.
Full Advisory:
http://secunia.com/advisories/13447/
--
[SA13437] Sun Java System Web Server / Application Server Session ID
Disclosure
Critical: Less critical
Where: From remote
Impact: Exposure of sensitive information
Released: 2004-12-14
A vulnerability has been reported in Sun Java System Web Server and
Application Server, which can be exploited by malicious people to gain
knowledge of sensitive information.
Full Advisory:
http://secunia.com/advisories/13437/
--
[SA13432] mnoGoSearch Cross-Site Scripting Vulnerabilities
Critical: Less critical
Where: From remote
Impact: Cross Site Scripting
Released: 2004-12-13
Michael Krax and Mark J. Cox has reported some vulnerabilities in
mnoGoSearch, which can be exploited by malicious people to conduct
cross-site scripting attacks.
Full Advisory:
http://secunia.com/advisories/13432/
--
[SA13469] Linux Kernel IGMP and "__scm_send()" Vulnerabilities
Critical: Less critical
Where: From local network
Impact: Exposure of sensitive information, Privilege escalation,
DoS
Released: 2004-12-15
Paul Starzetz has reported some vulnerabilities in the Linux Kernel,
which can be exploited by malicious people to cause a DoS (Denial of
Service), and by malicious, local users to cause a DoS, gain knowledge
of sensitive information, or potentially gain escalated privileges.
Full Advisory:
http://secunia.com/advisories/13469/
--
[SA13473] Debian update for atari800
Critical: Less critical
Where: Local system
Impact: Privilege escalation
Released: 2004-12-15
Debian has issued an update for atari800. This fixes multiple
vulnerabilities, which can be exploited by malicious, local users to
escalate their privileges on a vulnerable system.
Full Advisory:
http://secunia.com/advisories/13473/
--
[SA13442] Mandrake update for postgresql
Critical: Less critical
Where: Local system
Impact: Privilege escalation
Released: 2004-12-14
MandrakeSoft has issued an update for postgresql. This fixes a
vulnerability, which can be exploited by malicious, local users to
perform certain actions on a vulnerable system with escalated
privileges.
Full Advisory:
http://secunia.com/advisories/13442/
--
[SA13430] mtr "mtr_curses_keyaction()" Function Buffer Overflow
Vulnerability
Critical: Less critical
Where: Local system
Impact: Privilege escalation
Released: 2004-12-14
Przemysaw Frasunek has reported a vulnerability in mtr, which
potentially can be exploited by malicious, local users to perform
certain actions with escalated privileges.
Full Advisory:
http://secunia.com/advisories/13430/
--
[SA13410] Linux Kernel "sys32_ni_syscall" and "sys32_vm86_warning"
Buffer Overflows
Critical: Less critical
Where: Local system
Impact: Unknown
Released: 2004-12-09
Jeremy Fitzhardinge has reported some potential vulnerabilities with an
unknown impact in the Linux Kernel.
Full Advisory:
http://secunia.com/advisories/13410/
--
[SA13480] Gentoo update for ncpfs
Critical: Not critical
Where: Local system
Impact: DoS
Released: 2004-12-15
Gentoo has issued an update for ncpfs. This fixes a potential
vulnerability, which can be exploited by malicious, local users.
Full Advisory:
http://secunia.com/advisories/13480/
--
[SA13444] Mandrake update for iproute2
Critical: Not critical
Where: Local system
Impact: DoS
Released: 2004-12-14
MandrakeSoft has issued an update for iproute2. This fixes a
vulnerability, which can be exploited by malicious, local users to
cause a DoS (Denial of Service).
Full Advisory:
http://secunia.com/advisories/13444/
--
[SA13443] OpenBSD isakmpd Denial of Service Vulnerability
Critical: Not critical
Where: Local system
Impact: DoS
Released: 2004-12-15
A vulnerability has been reported in OpenBSD, which can be exploited by
malicious, local users to cause a DoS (Denial of Service).
Full Advisory:
http://secunia.com/advisories/13443/
Other:--
[SA13434] Novell Netware "nlm" Screensaver Password Bypass
Vulnerability
Critical: Less critical
Where: Local system
Impact: Security Bypass
Released: 2004-12-14
Novacoast has reported a vulnerability in Novell Netware, which can be
exploited by a malicious person with physical access to a system to
bypass the password protected screensaver.
Full Advisory:
http://secunia.com/advisories/13434/
Cross Platform:--
[SA13479] GNUBoard "doc" Parameter Arbitrary File Inclusion
Vulnerability
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2004-12-15
Jeremy Bae has reported a vulnerability in GNUBoard, which can be
exploited by malicious people to compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/13479/
--
[SA13478] MoniWiki Multiple File Extensions Script Upload
Vulnerability
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2004-12-15
Jeremy Bae has reported a vulnerability in MoniWiki, which potentially
can be exploited by malicious people to compromise a vulnerable
system.
Full Advisory:
http://secunia.com/advisories/13478/
--
[SA13471] Adobe Reader / Adobe Acrobat Multiple Vulnerabilities
Critical: Highly critical
Where: From remote
Impact: Exposure of sensitive information, System access
Released: 2004-12-15
Some vulnerabilities have been reported in Adobe Reader and Adobe
Acrobat, which can be exploited by malicious people to disclose
sensitive information or compromise a user's system.
Full Advisory:
http://secunia.com/advisories/13471/
--
[SA13468] Ethereal Multiple Vulnerabilities
Critical: Highly critical
Where: From remote
Impact: DoS, System access
Released: 2004-12-15
Multiple vulnerabilities have been reported in Ethereal, which can be
exploited by malicious people to cause a DoS (Denial of Service) and
potentially compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/13468/
--
[SA13448] NetMail IMAPD Unspecified Buffer Overflow Vulnerability
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2004-12-15
A vulnerability has been reported in NetMail, which can be exploited by
malicious people to compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/13448/
--
[SA13424] phpMyAdmin Two Vulnerabilities
Critical: Highly critical
Where: From remote
Impact: Exposure of sensitive information, System access
Released: 2004-12-14
Nicolas Gregoire has reported two vulnerabilities in phpMyAdmin, which
can be exploited by malicious people to compromise a vulnerable system
and by malicious users to disclose sensitive information.
Full Advisory:
http://secunia.com/advisories/13424/
--
[SA13421] phpBB Attachment Mod Two Vulnerabilities
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2004-12-13
Two vulnerabilities have been reported in the Attachment Mod module for
phpBB, which can be exploited by malicious people to compromise a
vulnerable system.
Full Advisory:
http://secunia.com/advisories/13421/
--
[SA13419] MediaWiki "images" Arbitrary Script Upload and Execution
Vulnerability
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2004-12-13
A vulnerability has been reported in MediaWiki, which can be exploited
by malicious people to compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/13419/
--
[SA13467] phpGroupWare Cross-Site Scripting and SQL Injection
Vulnerabilities
Critical: Moderately critical
Where: From remote
Impact: Cross Site Scripting, Manipulation of data, Exposure of
system information
Released: 2004-12-15
James Bercegay has reported some vulnerabilities in phpGroupWare, which
can be exploited by malicious people to conduct cross-site scripting and
SQL injection attacks.
Full Advisory:
http://secunia.com/advisories/13467/
--
[SA13451] Sugar Sales Arbitrary Local File Inclusion Vulnerabilities
Critical: Moderately critical
Where: From remote
Impact: Exposure of system information, Exposure of sensitive
information
Released: 2004-12-14
Daniel Fabian has reported some vulnerabilities in Sugar Sales, which
can be exploited by malicious people to disclose sensitive
information.
Full Advisory:
http://secunia.com/advisories/13451/
--
[SA13446] Lithtech Engine UDP Datagram Denial of Service Vulnerability
Critical: Moderately critical
Where: From remote
Impact: DoS
Released: 2004-12-14
Luigi Auriemma has reported a vulnerability in Lithtech Engine, which
can be exploited by malicious people to cause a DoS (Denial of
Service).
Full Advisory:
http://secunia.com/advisories/13446/
--
[SA13431] SQLgrey Postfix greylisting service Unspecified SQL
Injection
Critical: Moderately critical
Where: From remote
Impact: Manipulation of data
Released: 2004-12-13
A vulnerability has been reported in SQLgrey Postfix greylisting
service, which can be exploited by malicious people to conduct SQL
injection attacks.
Full Advisory:
http://secunia.com/advisories/13431/
--
[SA13422] PhpDig Unspecified Vulnerability
Critical: Moderately critical
Where: From remote
Impact: Unknown
Released: 2004-12-13
A vulnerability with an unknown impact has been reported in PhpDig.
Full Advisory:
http://secunia.com/advisories/13422/
--
[SA13420] PHP Live! Unspecified Vulnerability
Critical: Moderately critical
Where: From remote
Impact: Unknown
Released: 2004-12-13
A vulnerability with an unknown impact has been reported in PHP Live!.
Full Advisory:
http://secunia.com/advisories/13420/
--
[SA13413] IlohaMail Unspecified Vulnerability
Critical: Moderately critical
Where: From remote
Impact: Unknown
Released: 2004-12-10
A vulnerability with an unknown impact has been reported in IlohaMail.
Full Advisory:
http://secunia.com/advisories/13413/
--
[SA13452] UBB.threads "Cat" Cross-Site Scripting Vulnerabilities
Critical: Less critical
Where: From remote
Impact: Cross Site Scripting
Released: 2004-12-14
gp has reported some vulnerabilities in UBB.threads, which can be
exploited by malicious people to conduct cross-site scripting attacks.
Full Advisory:
http://secunia.com/advisories/13452/
--
[SA13441] UseModWiki "wiki.pl" Cross-Site Scripting Vulnerability
Critical: Less critical
Where: From remote
Impact: Cross Site Scripting
Released: 2004-12-14
Jeremy Bae has reported a vulnerability in UseModWiki, which can be
exploited by malicious people to conduct cross-site scripting attacks.
Full Advisory:
http://secunia.com/advisories/13441/
--
[SA13414] PHP Gift Registry "message" Cross-Site Scripting
Vulnerabilities
Critical: Less critical
Where: From remote
Impact: Cross Site Scripting
Released: 2004-12-10
Some vulnerabilities have been reported in PHP Gift Registry, which can
be exploited by malicious people to conduct cross-site scripting
attacks.
Full Advisory:
http://secunia.com/advisories/13414/
========================================================================
Secunia recommends that you verify all advisories you receive,
by clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only use
those supplied by the vendor.
Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/
Subscribe:
http://secunia.com/secunia_weekly_summary/
Contact details:
Web : http://secunia.com/
E-mail : support@private
Tel : +45 70 20 51 44
Fax : +45 70 20 51 45
========================================================================
_________________________________________
Open Source Vulnerability Database (OSVDB) Everything is Vulnerable - http://www.osvdb.org/
This archive was generated by hypermail 2.1.3 : Fri Dec 17 2004 - 03:05:32 PST