========================================================================
The Secunia Weekly Advisory Summary
2005-01-13 - 2005-01-20
This week : 58 advisories
========================================================================
Table of Contents:
1.....................................................Word From Secunia
2....................................................This Week In Brief
3...............................This Weeks Top Ten Most Read Advisories
4.......................................Vulnerabilities Summary Listing
5.......................................Vulnerabilities Content Listing
========================================================================
1) Word From Secunia:
The Secunia staff is spending hours every day to assure you the best
and most reliable source for vulnerability information. Every single
vulnerability report is being validated and verified before a Secunia
advisory is written.
Secunia validates and verifies vulnerability reports in many different
ways e.g. by downloading the software and performing comprehensive
tests, by reviewing source code, or by validating the credibility of
the source from which the vulnerability report was issued.
As a result, Secunia's database is the most correct and complete source
for recent vulnerability information available on the Internet.
Secunia Online Vulnerability Database:
http://secunia.com/
========================================================================
2) This Week in Brief:
ADVISORIES:
23 vulnerabilities have been reported in various Oracle products. Some
have an unknown impact and others can be exploited to disclose
sensitive information, gain escalated privileges, conduct PL/SQL
injection attacks, manipulate information, or cause a DoS (Denial of
Service).
Additional details about the 23 vulnerabilities can be found in the
referenced Secunia advisory below.
References:
http://secunia.com/SA13862
VIRUS ALERTS:
Secunia has not issued any virus alerts during the week.
========================================================================
3) This Weeks Top Ten Most Read Advisories:
1. [SA12889] Microsoft Internet Explorer Multiple Vulnerabilities
2. [SA13599] Mozilla / Mozilla Firefox Download Dialog Source Spoofing
3. [SA13482] Internet Explorer DHTML Edit ActiveX Control Cross-Site
Scripting
4. [SA13804] Apple iTunes Playlist Handling Buffer Overflow
Vulnerability
5. [SA13786] Mozilla / Mozilla Firefox Dialog Overlapping Weakness
6. [SA13129] Mozilla / Mozilla Firefox Window Injection Vulnerability
7. [SA13792] Check Point Firewall-1 NG SmartDefense RFC2397 Bypass
Weakness
8. [SA12041] Microsoft Outlook / Word Object Tag Vulnerability
9. [SA13818] Opera "data:" URI Handler Spoofing Vulnerability
10. [SA13704] Internet Explorer FTP Download Directory Traversal
========================================================================
4) Vulnerabilities Summary Listing
Windows:
[SA13868] Halocon Empty UDP Datagram Denial of Service Vulnerability
[SA13881] NodeManager Professional Buffer Overflow Vulnerability
[SA13861] BlackBerry Enterprise Server Mobile Data Service Denial of
Service
[SA13879] Kazaa Lite K++ K-Sig Directory Traversal Weakness
[SA13872] Internet Explorer Global Variables Local File Detection
Weakness
UNIX/Linux:
[SA13912] Debian update for imagemagick
[SA13910] Ubuntu update for xpdf/cupsys
[SA13908] Ubuntu update for imagemagick/libmagick6
[SA13895] SUSE update for php4/mod_php4
[SA13893] AWStats "configdir" Parameter Arbitrary Command Execution
[SA13892] ImageMagick PSD Image Decoding Buffer Overflow
[SA13886] SGI Advanced Linux Environment Multiple Updates
[SA13885] SGI Advanced Linux Environment Multiple Updates
[SA13852] Conectiva update for ethereal
[SA13851] Conectiva update for php4
[SA13850] Red Hat update for libtiff
[SA13906] Avaya Products ncompress Vulnerability
[SA13894] Debian update for chbg
[SA13889] Debian update for gallery
[SA13865] Gentoo update for poppassd_pam
[SA13864] Gentoo update for squid
[SA13863] Debian update for mc
[SA13859] Midnight Commander Multiple Unspecified Vulnerabilities
[SA13856] Gentoo update for tnftp
[SA13855] Debian update for gopherd
[SA13905] Debian update for cupsys
[SA13904] CUPS xpdf "Decrypt::makeFileKey2()" Buffer Overflow
[SA13888] Mandrake update for cups
[SA13882] Solaris/SEAM Kerberos 5 Administration Library Vulnerability
[SA13871] VMware ESX Server Three Vulnerabilities
[SA13880] Avaya Products Multiple Vulnerabilities
[SA13915] UnixWare Chroot Escape Vulnerability
[SA13914] Debian update for mysql
[SA13911] Debian update for queue
[SA13909] GNU Queue Buffer Overflow Vulnerabilities
[SA13907] Red Hat update for kernel
[SA13891] Ubuntu update for vim
[SA13890] Debian update for playmidi
[SA13884] Debian GATOS xatitv "exported_display()" Buffer Overflow
[SA13876] Ubuntu update for kernel
[SA13867] MySQL mysqlaccess Script Insecure Temporary File Creation
[SA13858] SGI IRIX inpview Privilege Escalation Vulnerability
[SA13857] Fedora update for kernel
[SA13853] Debian update for exim-tls
[SA13900] Clam AntiVirus RFC2397 Bypass Weakness
Other:
Cross Platform:
[SA13903] Xpdf "Decrypt::makeFileKey2()" Function Buffer Overflow
[SA13854] PRADO "page" File Inclusion Vulnerability
[SA13849] MPM Guestbook Pro "header" File Inclusion Vulnerability
[SA13901] vBulletin Unspecified Vulnerability
[SA13877] ExBB Nested BBcode Script Insertion Vulnerability
[SA13875] SparkleBlog Multiple Vulnerabilities
[SA13874] ITA Forum SQL Injection Vulnerabilities
[SA13873] PHP Gift Registry SQL Injection Vulnerabilities
[SA13869] SafeHTML Hexadecimal HTML Entities Security Bypass
[SA13862] Oracle Products 23 Vulnerabilities
[SA13887] Gallery "username" Cross-Site Scripting Vulnerability
[SA13866] Minis "month" Directory Traversal Vulnerability
[SA13860] Horde "url" and "group" Cross-Site Scripting Vulnerabilities
========================================================================
5) Vulnerabilities Content Listing
Windows:--
[SA13868] Halocon Empty UDP Datagram Denial of Service Vulnerability
Critical: Moderately critical
Where: From remote
Impact: DoS
Released: 2005-01-17
Luigi Auriemma has reported a vulnerability in Halocon, which can be
exploited by malicious people to cause a DoS (Denial of Service).
Full Advisory:
http://secunia.com/advisories/13868/
--
[SA13881] NodeManager Professional Buffer Overflow Vulnerability
Critical: Moderately critical
Where: From local network
Impact: System access
Released: 2005-01-18
Tan Chew Keong has reported a vulnerability in NodeManager
Professional, which can be exploited by malicious people to compromise
a vulnerable system.
Full Advisory:
http://secunia.com/advisories/13881/
--
[SA13861] BlackBerry Enterprise Server Mobile Data Service Denial of
Service
Critical: Less critical
Where: From remote
Impact: DoS
Released: 2005-01-17
A vulnerability has been reported in BlackBerry Enterprise Server,
which can be exploited by malicious people to cause a DoS (Denial of
Service).
Full Advisory:
http://secunia.com/advisories/13861/
--
[SA13879] Kazaa Lite K++ K-Sig Directory Traversal Weakness
Critical: Not critical
Where: From remote
Impact: Manipulation of data, DoS
Released: 2005-01-18
Rafel Ivgi has discovered a weakness in Kazaa Lite K++, which can be
exploited by malicious people to create or overwrite files on a user's
system.
Full Advisory:
http://secunia.com/advisories/13879/
--
[SA13872] Internet Explorer Global Variables Local File Detection
Weakness
Critical: Not critical
Where: From remote
Impact: Exposure of system information
Released: 2005-01-18
Berend-Jan Wever has discovered a weakness in Internet Explorer, which
can be exploited by malicious people to detect the presence of local
files.
Full Advisory:
http://secunia.com/advisories/13872/
UNIX/Linux:--
[SA13912] Debian update for imagemagick
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2005-01-19
Debian has issued an update for imagemagick. This fixes a
vulnerability, which potentially can be exploited by malicious people
to compromise a user's system.
Full Advisory:
http://secunia.com/advisories/13912/
--
[SA13910] Ubuntu update for xpdf/cupsys
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2005-01-19
Ubuntu has issued updates for cupsys, libcupsimage2,
libcupsys2-gnutls10, xpdf-reader, and xpdf-utils. These fix a
vulnerability, which can be exploited by malicious people to compromise
a vulnerable system.
Full Advisory:
http://secunia.com/advisories/13910/
--
[SA13908] Ubuntu update for imagemagick/libmagick6
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2005-01-19
Ubuntu has issued updates for imagemagick and libmagick6. These fix a
vulnerability, which potentially can be exploited by malicious people
to compromise a user's system.
Full Advisory:
http://secunia.com/advisories/13908/
--
[SA13895] SUSE update for php4/mod_php4
Critical: Highly critical
Where: From remote
Impact: Security Bypass, Exposure of sensitive information,
Privilege escalation, System access
Released: 2005-01-18
SUSE has issued updates for php4 and mod_php4. These fix multiple
vulnerabilities, which can be exploited to gain escalated privileges,
bypass certain security restrictions, gain knowledge of sensitive
information, or compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/13895/
--
[SA13893] AWStats "configdir" Parameter Arbitrary Command Execution
Critical: Highly critical
Where: From remote
Impact: Unknown, System access
Released: 2005-01-18
Two vulnerabilities have been reported in AWStats, where one has an
unknown impact and the other can be exploited by malicious people to
compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/13893/
--
[SA13892] ImageMagick PSD Image Decoding Buffer Overflow
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2005-01-18
Andrei Nigmatulin has reported a vulnerability in ImageMagick, which
potentially can be exploited by malicious people to compromise a user's
system.
Full Advisory:
http://secunia.com/advisories/13892/
--
[SA13886] SGI Advanced Linux Environment Multiple Updates
Critical: Highly critical
Where: From remote
Impact: Security Bypass, Cross Site Scripting, Exposure of
sensitive information, Privilege escalation, DoS, System access
Released: 2005-01-17
SGI has issued a patch for SGI Advanced Linux Environment. This fixes
multiple vulnerabilities, which can be exploited to gain escalated
privileges, cause a DoS (Denial of Service), bypass certain security
restrictions, conduct script insertion attacks, gain knowledge of
sensitive information, or compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/13886/
--
[SA13885] SGI Advanced Linux Environment Multiple Updates
Critical: Highly critical
Where: From remote
Impact: System access, DoS, Privilege escalation
Released: 2005-01-17
SGI has issued a patch for XFree86, VIM, and glibc. This fixes multiple
vulnerabilities, which can be exploited to cause a DoS (Denial of
Service), perform certain actions with escalated privileges, gain
escalated privileges, or compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/13885/
--
[SA13852] Conectiva update for ethereal
Critical: Highly critical
Where: From remote
Impact: DoS, System access
Released: 2005-01-13
Conectiva has issued an update for ethereal. This fixes some
vulnerabilities, which can be exploited by malicious people to cause a
DoS (Denial of Service) or compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/13852/
--
[SA13851] Conectiva update for php4
Critical: Highly critical
Where: From remote
Impact: Security Bypass, Exposure of sensitive information,
Privilege escalation, System access
Released: 2005-01-13
Conectiva has issued an update for php4. This fixes some
vulnerabilities, which can be exploited to gain escalated privileges,
bypass certain security restrictions, gain knowledge of sensitive
information, or compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/13851/
--
[SA13850] Red Hat update for libtiff
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2005-01-13
Red Hat has issued an update for libtiff. This fixes some
vulnerabilities, which can be exploited by malicious people to
compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/13850/
--
[SA13906] Avaya Products ncompress Vulnerability
Critical: Moderately critical
Where: From remote
Impact: System access
Released: 2005-01-19
Avaya has confirmed an old vulnerability in ncompress, which is
included in various products. This can potentially be exploited by
malicious people to compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/13906/
--
[SA13894] Debian update for chbg
Critical: Moderately critical
Where: From remote
Impact: System access
Released: 2005-01-18
Debian has issued an update for chbg. This fixes a vulnerability, which
can be exploited by malicious people to compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/13894/
--
[SA13889] Debian update for gallery
Critical: Moderately critical
Where: From remote
Impact: Cross Site Scripting, Manipulation of data
Released: 2005-01-18
Debian has issued an update for gallery. This fixes some
vulnerabilities, which can be exploited by malicious people to conduct
script insertion attacks.
Full Advisory:
http://secunia.com/advisories/13889/
--
[SA13865] Gentoo update for poppassd_pam
Critical: Moderately critical
Where: From remote
Impact: Security Bypass, Manipulation of data
Released: 2005-01-14
Gentoo has issued an update for poppassd_pam. This fixes a
vulnerability, which can be exploited by malicious people to change
system passwords.
Full Advisory:
http://secunia.com/advisories/13865/
--
[SA13864] Gentoo update for squid
Critical: Moderately critical
Where: From remote
Impact: System access, DoS
Released: 2005-01-17
Gentoo has issued an update for squid. This fixes some vulnerabilities,
which can be exploited by malicious people to cause a DoS (Denial of
Service) or potentially compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/13864/
--
[SA13863] Debian update for mc
Critical: Moderately critical
Where: From remote
Impact: Unknown, Privilege escalation, DoS
Released: 2005-01-14
Debian has issued an update for mc. This fixes multiple
vulnerabilities, where many have an unknown impact and others can be
exploited to cause a DoS (Denial of Service) or potentially perform
certain actions with escalated privileges.
Full Advisory:
http://secunia.com/advisories/13863/
--
[SA13859] Midnight Commander Multiple Unspecified Vulnerabilities
Critical: Moderately critical
Where: From remote
Impact: Unknown, Privilege escalation, DoS
Released: 2005-01-14
Multiple vulnerabilities have been reported in Midnight Commander,
where many have an unknown impact and others can be exploited to cause
a DoS (Denial of Service) or potentially perform certain actions with
escalated privileges.
Full Advisory:
http://secunia.com/advisories/13859/
--
[SA13856] Gentoo update for tnftp
Critical: Moderately critical
Where: From remote
Impact: Manipulation of data, System access
Released: 2005-01-14
Gentoo has issued an update for tnftp. This fixes a vulnerability,
allowing malicious people to overwrite local files.
Full Advisory:
http://secunia.com/advisories/13856/
--
[SA13855] Debian update for gopherd
Critical: Moderately critical
Where: From remote
Impact: Unknown
Released: 2005-01-14
Debian has issued an update for gopherd. This fixes some
vulnerabilities with unknown impacts.
Full Advisory:
http://secunia.com/advisories/13855/
--
[SA13905] Debian update for cupsys
Critical: Moderately critical
Where: From local network
Impact: System access
Released: 2005-01-19
Debian has issued an update for cupsys. This fixes a vulnerability,
which potentially can be exploited by malicious users to compromise a
vulnerable system.
Full Advisory:
http://secunia.com/advisories/13905/
--
[SA13904] CUPS xpdf "Decrypt::makeFileKey2()" Buffer Overflow
Critical: Moderately critical
Where: From local network
Impact: System access
Released: 2005-01-19
A vulnerability has been reported in CUPS, which potentially can be
exploited by malicious users to compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/13904/
--
[SA13888] Mandrake update for cups
Critical: Moderately critical
Where: From local network
Impact: Manipulation of data, DoS, System access
Released: 2005-01-18
MandrakeSoft has issued an update for cups. This fixes some
vulnerabilities, which can be exploited by malicious users to
manipulate certain files, cause a DoS (Denial of Service), or
compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/13888/
--
[SA13882] Solaris/SEAM Kerberos 5 Administration Library Vulnerability
Critical: Moderately critical
Where: From local network
Impact: System access
Released: 2005-01-17
Sun has acknowledged a vulnerability in Solaris and SEAM, which
potentially can be exploited by malicious users to compromise a
vulnerable system.
Full Advisory:
http://secunia.com/advisories/13882/
--
[SA13871] VMware ESX Server Three Vulnerabilities
Critical: Moderately critical
Where: From local network
Impact: Security Bypass, Exposure of system information, Exposure
of sensitive information, System access
Released: 2005-01-17
VMware has acknowledged some vulnerabilities in ESX Server, which can
be exploited to disclose sensitive information in kernel memory, bypass
certain security restrictions, and potentially compromise a vulnerable
system.
Full Advisory:
http://secunia.com/advisories/13871/
--
[SA13880] Avaya Products Multiple Vulnerabilities
Critical: Less critical
Where: From remote
Impact: Security Bypass, Spoofing, Privilege escalation
Released: 2005-01-17
Avaya has acknowledged multiple vulnerabilities in various products,
which potentially can be exploited to gain unauthorised access to other
websites, bypass certain security restrictions, or gain escalated
privileges.
Full Advisory:
http://secunia.com/advisories/13880/
--
[SA13915] UnixWare Chroot Escape Vulnerability
Critical: Less critical
Where: Local system
Impact: Security Bypass
Released: 2005-01-19
Simon Roses Femerling has reported a vulnerability in UnixWare, which
can be exploited by malicious, local users to break out of the chroot
jail.
Full Advisory:
http://secunia.com/advisories/13915/
--
[SA13914] Debian update for mysql
Critical: Less critical
Where: Local system
Impact: Manipulation of data, Exposure of sensitive information,
Privilege escalation
Released: 2005-01-19
Debian has issued an update for mysql. This fixes a vulnerability,
which can be exploited by malicious, local users to perform certain
actions on a vulnerable system with escalated privileges.
Full Advisory:
http://secunia.com/advisories/13914/
--
[SA13911] Debian update for queue
Critical: Less critical
Where: Local system
Impact: Privilege escalation
Released: 2005-01-19
Debian has issued an update for queue. This fixes some vulnerabilities,
which potentially can be exploited by malicious, local users to gain
escalated privileges.
Full Advisory:
http://secunia.com/advisories/13911/
--
[SA13909] GNU Queue Buffer Overflow Vulnerabilities
Critical: Less critical
Where: Local system
Impact: Privilege escalation
Released: 2005-01-19
jaguar has reported some vulnerabilities in GNU Queue, which
potentially can be exploited by malicious, local users to gain
escalated privileges.
Full Advisory:
http://secunia.com/advisories/13909/
--
[SA13907] Red Hat update for kernel
Critical: Less critical
Where: Local system
Impact: Privilege escalation, DoS
Released: 2005-01-19
Red Hat has issued an update for the kernel. This fixes some
vulnerabilities, which can be exploited by malicious, local users to
cause a DoS (Denial of Service) or gain escalated privileges.
Full Advisory:
http://secunia.com/advisories/13907/
--
[SA13891] Ubuntu update for vim
Critical: Less critical
Where: Local system
Impact: Privilege escalation
Released: 2005-01-19
Ubuntu has issued updates for kvim, vim, vim-gnome, vim-gtk,
vim-lesstif, vim-perl, vim-python and vim-tcl. These fix some
vulnerabilities, which can be exploited by malicious, local users to
gain escalated privileges.
Full Advisory:
http://secunia.com/advisories/13891/
--
[SA13890] Debian update for playmidi
Critical: Less critical
Where: Local system
Impact: Privilege escalation
Released: 2005-01-19
Debian has issued an update for playmidi. This fixes a vulnerability,
which can be exploited by malicious, local users to gain escalated
privileges.
Full Advisory:
http://secunia.com/advisories/13890/
--
[SA13884] Debian GATOS xatitv "exported_display()" Buffer Overflow
Critical: Less critical
Where: Local system
Impact: Privilege escalation
Released: 2005-01-17
Debian has issued an update for gatos. This fixes a vulnerability,
which potentially can be exploited by malicious, local users to gain
escalated privileges.
Full Advisory:
http://secunia.com/advisories/13884/
--
[SA13876] Ubuntu update for kernel
Critical: Less critical
Where: Local system
Impact: Privilege escalation, DoS
Released: 2005-01-17
Ubuntu has issued an update for the kernel. This fixes some
vulnerabilities, which can be exploited by malicious, local users to
cause a DoS (Denial of Service) or gain escalated privileges.
Full Advisory:
http://secunia.com/advisories/13876/
--
[SA13867] MySQL mysqlaccess Script Insecure Temporary File Creation
Critical: Less critical
Where: Local system
Impact: Manipulation of data, Exposure of sensitive information,
Privilege escalation
Released: 2005-01-17
Javier Fernández-Sanguino Peńa has reported a vulnerability in MySQL,
which can be exploited by malicious, local users to perform certain
actions on a vulnerable system with escalated privileges.
Full Advisory:
http://secunia.com/advisories/13867/
--
[SA13858] SGI IRIX inpview Privilege Escalation Vulnerability
Critical: Less critical
Where: Local system
Impact: Privilege escalation
Released: 2005-01-14
iDEFENSE has reported a vulnerability in SGI IRIX, which can be
exploited by malicious, local users to gain escalated privileges.
Full Advisory:
http://secunia.com/advisories/13858/
--
[SA13857] Fedora update for kernel
Critical: Less critical
Where: Local system
Impact: Privilege escalation
Released: 2005-01-14
Fedora has issued an update for the kernel. This fixes a vulnerability,
which can be exploited by malicious, local users to gain escalated
privileges.
Full Advisory:
http://secunia.com/advisories/13857/
--
[SA13853] Debian update for exim-tls
Critical: Less critical
Where: Local system
Impact: Privilege escalation
Released: 2005-01-13
Debian has issued an update for exim-tls. This fixes a vulnerability,
which potentially can be exploited by malicious, local users to gain
escalated privileges.
Full Advisory:
http://secunia.com/advisories/13853/
--
[SA13900] Clam AntiVirus RFC2397 Bypass Weakness
Critical: Not critical
Where: From remote
Impact: Security Bypass
Released: 2005-01-19
The vendor has acknowledged a weakness in Clam AntiVirus, which allows
malware to bypass detection.
Full Advisory:
http://secunia.com/advisories/13900/
Other:
Cross Platform:--
[SA13903] Xpdf "Decrypt::makeFileKey2()" Function Buffer Overflow
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2005-01-19
A vulnerability has been reported in Xpdf, which can be exploited by
malicious people to compromise a user's system.
Full Advisory:
http://secunia.com/advisories/13903/
--
[SA13854] PRADO "page" File Inclusion Vulnerability
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2005-01-14
Paul Brereton has reported a vulnerability in PRADO, which can be
exploited by malicious people to compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/13854/
--
[SA13849] MPM Guestbook Pro "header" File Inclusion Vulnerability
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2005-01-13
SmOk3 has reported a vulnerability in MPM Guestbook Pro, which can be
exploited by malicious people to compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/13849/
--
[SA13901] vBulletin Unspecified Vulnerability
Critical: Moderately critical
Where: From remote
Impact: Unknown
Released: 2005-01-18
A vulnerability with an unknown impact has been reported in vBulletin.
Full Advisory:
http://secunia.com/advisories/13901/
--
[SA13877] ExBB Nested BBcode Script Insertion Vulnerability
Critical: Moderately critical
Where: From remote
Impact: Cross Site Scripting
Released: 2005-01-19
Algol has reported a vulnerability in ExBB, which potentially can be
exploited by malicious people to conduct script insertion attacks.
Full Advisory:
http://secunia.com/advisories/13877/
--
[SA13875] SparkleBlog Multiple Vulnerabilities
Critical: Moderately critical
Where: From remote
Impact: Cross Site Scripting, Manipulation of data
Released: 2005-01-17
Kovács László has discovered some vulnerabilities in SparkleBlog, which
can be exploited by malicious people to conduct SQL injection and
cross-site scripting attacks.
Full Advisory:
http://secunia.com/advisories/13875/
--
[SA13874] ITA Forum SQL Injection Vulnerabilities
Critical: Moderately critical
Where: From remote
Impact: Manipulation of data
Released: 2005-01-17
RusH security team has reported some vulnerabilities in ITA Forum,
which potentially can be exploited by malicious people to conduct SQL
injection attacks.
Full Advisory:
http://secunia.com/advisories/13874/
--
[SA13873] PHP Gift Registry SQL Injection Vulnerabilities
Critical: Moderately critical
Where: From remote
Impact: Manipulation of data
Released: 2005-01-17
Madelman has reported some vulnerabilities in PHP Gift Registry, which
can be exploited by malicious people to conduct SQL injection attacks.
Full Advisory:
http://secunia.com/advisories/13873/
--
[SA13869] SafeHTML Hexadecimal HTML Entities Security Bypass
Critical: Moderately critical
Where: From remote
Impact: Security Bypass
Released: 2005-01-17
Christian Stocker has reported a vulnerability in SafeHTML, which can
be exploited by malicious people to bypass certain security
restrictions.
Full Advisory:
http://secunia.com/advisories/13869/
--
[SA13862] Oracle Products 23 Vulnerabilities
Critical: Moderately critical
Where: From remote
Impact: Unknown, Manipulation of data, Exposure of sensitive
information, Privilege escalation, DoS
Released: 2005-01-19
23 vulnerabilities have been reported in various Oracle products. Some
have an unknown impact and others can be exploited to disclose
sensitive information, gain escalated privileges, conduct PL/SQL
injection attacks, manipulate information, or cause a DoS (Denial of
Service).
Full Advisory:
http://secunia.com/advisories/13862/
--
[SA13887] Gallery "username" Cross-Site Scripting Vulnerability
Critical: Less critical
Where: From remote
Impact: Cross Site Scripting
Released: 2005-01-18
Rafel Ivgi has discovered a vulnerability in Gallery, which can be
exploited by malicious people to conduct cross-site scripting attacks.
Full Advisory:
http://secunia.com/advisories/13887/
--
[SA13866] Minis "month" Directory Traversal Vulnerability
Critical: Less critical
Where: From remote
Impact: Exposure of sensitive information, DoS
Released: 2005-01-17
Madelman has reported a vulnerability in Minis, which can be exploited
by malicious people to disclose sensitive information and cause a DoS
(Denial of Service).
Full Advisory:
http://secunia.com/advisories/13866/
--
[SA13860] Horde "url" and "group" Cross-Site Scripting Vulnerabilities
Critical: Less critical
Where: From remote
Impact: Cross Site Scripting
Released: 2005-01-14
Robert Fly has reported two vulnerabilities in Horde, which can be
exploited by malicious people to conduct cross-site scripting attacks.
Full Advisory:
http://secunia.com/advisories/13860/
========================================================================
Secunia recommends that you verify all advisories you receive,
by clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only use
those supplied by the vendor.
Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/
Subscribe:
http://secunia.com/secunia_weekly_summary/
Contact details:
Web : http://secunia.com/
E-mail : support@private
Tel : +45 70 20 51 44
Fax : +45 70 20 51 45
========================================================================
_________________________________________
Open Source Vulnerability Database (OSVDB) Everything is Vulnerable - http://www.osvdb.org/
This archive was generated by hypermail 2.1.3 : Fri Jan 21 2005 - 00:57:19 PST