========================================================================
The Secunia Weekly Advisory Summary
2005-01-20 - 2005-01-27
This week : 100 advisories
========================================================================
Table of Contents:
1.....................................................Word From Secunia
2....................................................This Week In Brief
3...............................This Weeks Top Ten Most Read Advisories
4.......................................Vulnerabilities Summary Listing
5.......................................Vulnerabilities Content Listing
========================================================================
1) Word From Secunia:
The Secunia staff is spending hours every day to assure you the best
and most reliable source for vulnerability information. Every single
vulnerability report is being validated and verified before a Secunia
advisory is written.
Secunia validates and verifies vulnerability reports in many different
ways e.g. by downloading the software and performing comprehensive
tests, by reviewing source code, or by validating the credibility of
the source from which the vulnerability report was issued.
As a result, Secunia's database is the most correct and complete source
for recent vulnerability information available on the Internet.
Secunia Online Vulnerability Database:
http://secunia.com/
========================================================================
2) This Week in Brief:
ADVISORIES:
Two vulnerabilities have been reported in Sun Java Plug-in, which can
be exploited by malicious people to bypass certain security
restrictions or compromise a user's system.
The vendor has issued updated versions.
References:
http://secunia.com/SA13918/
--
Apple has issued a security update for Mac OS X, which fixes various
vulnerabilities.
In addition, a vulnerability was reported in iSync mRouter for Mac OS
X, which can be exploited by local users to escalate their privileges.
More information can be found in Secunia advisories below.
References:
http://secunia.com/SA13965/
http://secunia.com/SA14005/
VIRUS ALERTS:
During the last week, Secunia issued 1 MEDIUM RISK virus alert.
Please refer to the grouped virus profile below for more information:
Bagle.bj - MEDIUM RISK Virus Alert - 2005-01-27 11:16 GMT+1
http://secunia.com/virus_information/14877/bagle.bj/
========================================================================
3) This Weeks Top Ten Most Read Advisories:
1. [SA12889] Microsoft Internet Explorer Multiple Vulnerabilities
2. [SA13482] Internet Explorer DHTML Edit ActiveX Control Cross-Site
Scripting
3. [SA14005] Mac OS X Security Update Fixes Multiple Vulnerabilities
4. [SA13918] Sun Java Plug-In Two Vulnerabilities
5. [SA13129] Mozilla / Mozilla Firefox Window Injection Vulnerability
6. [SA13599] Mozilla / Mozilla Firefox Download Dialog Source Spoofing
7. [SA13862] Oracle Products 23 Vulnerabilities
8. [SA12758] Microsoft Word Document Parsing Buffer Overflow
Vulnerability
9. [SA13861] BlackBerry Enterprise Server Mobile Data Service Denial
of Service
10. [SA13251] Microsoft Internet Explorer Window Injection
Vulnerability
========================================================================
4) Vulnerabilities Summary Listing
Windows:
[SA13986] W32Dasm Import/Export Functions Buffer Overflow
[SA13969] DivX Player ".dps" Skin File Directory Traversal
Vulnerability
[SA13966] Golden FTP Server Pro "RNTO" Command Buffer Overflow
[SA13964] Comersus Cart Multiple Vulnerabilities
[SA13985] Spectrum Cash Receipting System Weak Password Encryption
UNIX/Linux:
[SA14043] Gentoo update for graphicsmagick
[SA14028] Red Hat update for xpdf
[SA14021] Fedora update for koffice
[SA14020] Fedora update for kdegraphics
[SA14019] Fedora update for kdelibs
[SA14018] Debian update for xine-lib
[SA14014] Conectiva update for xpdf
[SA14011] Avaya Products Multiple Vulnerabilities
[SA14007] Gentoo update for awstats
[SA14005] Mac OS X Security Update Fixes Multiple Vulnerabilities
[SA14004] Mandrake update for tetex
[SA14003] Mandrake update for kdegraphics
[SA13998] Mandrake update for koffice
[SA13997] Mandrake update for gpdf
[SA13996] Mandrake update for xpdf
[SA13994] SUSE realplayer Multiple Vulnerabilities
[SA13991] Fedora update for tetex
[SA13974] Gentoo update for tetex/cstetex/ptex
[SA13963] SGI Advanced Linux Environment Multiple Updates
[SA13960] GraphicsMagick PSD Image Decoding Buffer Overflow
[SA13958] Gentoo update for koffice/kdegraphics
[SA13957] teTeX Multiple Vulnerabilities
[SA13949] Gentoo update for xpdf/gpdf
[SA13945] Fedora update for xpdf
[SA13941] Debian update for sword
[SA13939] Conectiva update for libtiff3
[SA13934] KOffice "Decrypt::makeFileKey2()" Buffer Overflow
[SA14048] Fedora update for enscript
[SA14038] Openswan XAUTH/PAM Buffer Overflow Vulnerability
[SA14036] Mandrake update for bind
[SA14026] BNC IRC proxy FD_SET Overflow Vulnerability
[SA14023] Conectiva update for squid
[SA14022] Fedora update for ethereal
[SA14009] BIND "q_usedns" Array Buffer Overflow Vulnerability
[SA14008] BIND Validator Denial of Service Vulnerability
[SA14002] Mandrake update for kernel
[SA13990] Gentoo update for evolution
[SA13989] Gentoo update for konversation
[SA13983] Mandrake update for squid
[SA13979] Mandrake update for ethereal
[SA13975] Debian update for enscript
[SA13973] Ubuntu update for enscript
[SA13968] GNU Enscript Multiple Vulnerabilities
[SA13967] Ubuntu update for evolution
[SA13955] Debian update for ethereal
[SA13954] Gentoo update for ethereal
[SA13953] Ubuntu update for squid
[SA13952] UnixWare update for OpenSSL
[SA13951] Debian update for unarj
[SA13946] Ethereal Multiple Unspecified Packet Dissector
Vulnerabilities
[SA13943] Debian update for squid
[SA13999] Mandrake update for cups
[SA13956] Gentoo update for cups
[SA13940] Fedora update for cups
[SA14013] SCO OpenServer update for wu-ftpd
[SA13978] Mandrake update for mailman
[SA13950] Gentoo update for mailman
[SA14050] Debian update for libdbi-perl
[SA14044] Gentoo update for perl/dbi
[SA14040] Astaro update for kernel
[SA14015] Perl DBI ProxyServer.pm Insecure Temporary File Creation
[SA14012] SCO OpenServer scosession Privilege Escalation Vulnerability
[SA13995] Debian update for vdr
[SA13992] Sun Solaris DHCP Administration Utilities Vulnerability
[SA13987] Debian update for zhcon
[SA13982] Mandrake update for zhcon
[SA13977] zhcon Arbitrary File Content Disclosure
[SA13972] Red Hat update for kernel
[SA13970] FireHOL Insecure Temporary File Creation Vulnerabilities
[SA13965] Mac OS X iSync mRouter Buffer Overflow Vulnerability
[SA13961] SUSE update for kernel
[SA13959] Gentoo update for mysql
[SA13944] Ubuntu update for php4
[SA13938] Debian xtrlock Security Bypass Vulnerability
[SA13933] Ghostscript Various Scripts Insecure Temporary File Creation
[SA13932] Ubuntu update for apache-utils
[SA13947] SCO OpenServer update for bind
[SA14037] Sun Solaris UDP End Point Handling Denial of Service
Other:
[SA14049] Juniper JUNOS Unspecified Packet Processing Denial of
Service
[SA14032] Cisco IOS IPv6 Packet Processing Denial of Service
[SA13942] OfficeConnect Wireless 11g Access Point Information
Disclosure
[SA14034] Cisco IOS BGP Protocol Processing Denial of Service
[SA14031] Cisco IOS MPLS Packet Processing Denial of Service
[SA13971] Xerox WorkCentre Pro PostScript Directory Traversal
Cross Platform:
[SA13948] TikiWiki "temp" Arbitrary Script Execution Vulnerability
[SA14027] Citadel/UX FD_SET Overflow Vulnerability
[SA14001] MoinMoin Unspecified Search ACL Security Bypass
Vulnerability
[SA13980] IDA Pro Import Library Name Handling Buffer Overflow
[SA13976] BRIBBLE webadmin Authentication Bypass Vulnerability
[SA13962] SquirrelMail Three Vulnerabilities
[SA13935] Help Desk Reloaded Unspecified Login Vulnerability
[SA14000] phpEventCalendar Events Script Insertion Vulnerability
[SA13988] Exponent CMS "module" Parameter Cross-Site Scripting
Vulnerability
[SA14010] iChain Mutual Authentication Unauthorised Resource Access
[SA13936] OpenH323 Gatekeeper Multiple Sockets Buffer Overflow
========================================================================
5) Vulnerabilities Content Listing
Windows:--
[SA13986] W32Dasm Import/Export Functions Buffer Overflow
Critical: Moderately critical
Where: From remote
Impact: System access
Released: 2005-01-25
Luigi Auriemma has reported a vulnerability in W32Dasm, which
potentially can be exploited by malicious people to compromise a user's
system.
Full Advisory:
http://secunia.com/advisories/13986/
--
[SA13969] DivX Player ".dps" Skin File Directory Traversal
Vulnerability
Critical: Moderately critical
Where: From remote
Impact: System access
Released: 2005-01-25
Luigi Auriemma has discovered a vulnerability in DivX Player, which can
be exploited by malicious people to compromise a user's system.
Full Advisory:
http://secunia.com/advisories/13969/
--
[SA13966] Golden FTP Server Pro "RNTO" Command Buffer Overflow
Critical: Moderately critical
Where: From remote
Impact: System access
Released: 2005-01-24
barabas mutsonline has reported a vulnerability in Golden FTP Server
Pro, which can be exploited by malicious users to compromise a
vulnerable system.
Full Advisory:
http://secunia.com/advisories/13966/
--
[SA13964] Comersus Cart Multiple Vulnerabilities
Critical: Moderately critical
Where: From remote
Impact: Security Bypass, Cross Site Scripting, Manipulation of
data
Released: 2005-01-25
raf somers has reported some vulnerabilities in Comersus Cart, which
can be exploited by malicious people to bypass certain security
restrictions, and conduct SQL injection and cross-site scripting
attacks.
Full Advisory:
http://secunia.com/advisories/13964/
--
[SA13985] Spectrum Cash Receipting System Weak Password Encryption
Critical: Not critical
Where: Local system
Impact: Brute force, Exposure of sensitive information
Released: 2005-01-26
Paul J Docherty has reported a security issue in Spectrum Cash
Receipting System, which potentially can be exploited by malicious,
local users to disclose user credentials.
Full Advisory:
http://secunia.com/advisories/13985/
UNIX/Linux:--
[SA14043] Gentoo update for graphicsmagick
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2005-01-27
Gentoo has issued an update for graphicsmagick. This fixes a
vulnerability, which potentially can be exploited by malicious people
to compromise a user's system.
Full Advisory:
http://secunia.com/advisories/14043/
--
[SA14028] Red Hat update for xpdf
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2005-01-27
Red Hat has issued an update for xpdf. This fixes a vulnerability,
which can be exploited by malicious people to compromise a user's
system.
Full Advisory:
http://secunia.com/advisories/14028/
--
[SA14021] Fedora update for koffice
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2005-01-26
Fedora has issued an update for koffice. This fixes a vulnerability,
which can be exploited by malicious people to compromise a user's
system.
Full Advisory:
http://secunia.com/advisories/14021/
--
[SA14020] Fedora update for kdegraphics
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2005-01-26
Fedora has issued an update for kdegraphics. This fixes two
vulnerabilities, which can be exploited by malicious people to
compromise a user's system.
Full Advisory:
http://secunia.com/advisories/14020/
--
[SA14019] Fedora update for kdelibs
Critical: Highly critical
Where: From remote
Impact: Manipulation of data, System access
Released: 2005-01-26
Fedora has issued an update for kdelibs. This fixes some
vulnerabilities, which can be exploited by malicious people to conduct
FTP command injection attacks and compromise a user's system.
Full Advisory:
http://secunia.com/advisories/14019/
--
[SA14018] Debian update for xine-lib
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2005-01-26
Debian has issued an update for xine-lib. This fixes some
vulnerabilities, which can be exploited by malicious people to
compromise a user's system.
Full Advisory:
http://secunia.com/advisories/14018/
--
[SA14014] Conectiva update for xpdf
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2005-01-26
Conectiva has issued an update for xpdf. This fixes two
vulnerabilities, which can be exploited by malicious people to
compromise a user's system.
Full Advisory:
http://secunia.com/advisories/14014/
--
[SA14011] Avaya Products Multiple Vulnerabilities
Critical: Highly critical
Where: From remote
Impact: Privilege escalation, DoS, System access
Released: 2005-01-26
Avaya has acknowledged multiple vulnerabilities in various products,
which potentially can be exploited to cause a DoS (Denial of Service),
gain escalated privileges, or compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/14011/
--
[SA14007] Gentoo update for awstats
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2005-01-26
Gentoo has issued an update for awstats. This fixes a vulnerability,
which can be exploited by malicious people to compromise a vulnerable
system.
Full Advisory:
http://secunia.com/advisories/14007/
--
[SA14005] Mac OS X Security Update Fixes Multiple Vulnerabilities
Critical: Highly critical
Where: From remote
Impact: Security Bypass, Cross Site Scripting, Spoofing, Exposure
of system information, Exposure of sensitive information, Privilege
escalation, System access
Released: 2005-01-26
Apple has issued a security update for Mac OS X, which fixes various
vulnerabilities.
Full Advisory:
http://secunia.com/advisories/14005/
--
[SA14004] Mandrake update for tetex
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2005-01-26
MandrakeSoft has issued an update for tetex. This fixes a
vulnerability, which can be exploited by malicious people to compromise
a user's system.
Full Advisory:
http://secunia.com/advisories/14004/
--
[SA14003] Mandrake update for kdegraphics
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2005-01-26
MandrakeSoft has issued an update for kdegraphics. This fixes a
vulnerability, which can be exploited by malicious people to compromise
a user's system.
Full Advisory:
http://secunia.com/advisories/14003/
--
[SA13998] Mandrake update for koffice
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2005-01-26
MandrakeSoft has issued an update for koffice. This fixes a
vulnerability, which can be exploited by malicious people to compromise
a user's system.
Full Advisory:
http://secunia.com/advisories/13998/
--
[SA13997] Mandrake update for gpdf
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2005-01-26
MandrakeSoft has issued an update for gpdf. This fixes a vulnerability,
which potentially can be exploited by malicious people to compromise a
user's system.
Full Advisory:
http://secunia.com/advisories/13997/
--
[SA13996] Mandrake update for xpdf
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2005-01-26
MandrakeSoft has issued an update for xpdf. This fixes a vulnerability,
which can be exploited by malicious people to compromise a user's
system.
Full Advisory:
http://secunia.com/advisories/13996/
--
[SA13994] SUSE realplayer Multiple Vulnerabilities
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2005-01-25
SUSE has acknowledged some vulnerabilities in realplayer, which can be
exploited by malicious people to compromise a user's system.
Full Advisory:
http://secunia.com/advisories/13994/
--
[SA13991] Fedora update for tetex
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2005-01-25
Fedora has issued an update for tetex. This fixes a vulnerability,
which can be exploited by malicious people to compromise a user's
system.
Full Advisory:
http://secunia.com/advisories/13991/
--
[SA13974] Gentoo update for tetex/cstetex/ptex
Critical: Highly critical
Where: From remote
Impact: Privilege escalation, System access
Released: 2005-01-24
Gentoo has issued updates for tetex, cstetex and ptex. These fix some
vulnerabilities, which can be exploited by malicious people to
compromise a user's system and by malicious, local users to perform
certain actions on a vulnerable system with escalated privileges.
Full Advisory:
http://secunia.com/advisories/13974/
--
[SA13963] SGI Advanced Linux Environment Multiple Updates
Critical: Highly critical
Where: From remote
Impact: Manipulation of data, DoS, System access
Released: 2005-01-24
SGI has issued a patch for SGI Advanced Linux Environment. This fixes
multiple vulnerabilities, which can be exploited to cause a DoS (Denial
of Service), manipulate certain files, or potentially compromise a
vulnerable system.
Full Advisory:
http://secunia.com/advisories/13963/
--
[SA13960] GraphicsMagick PSD Image Decoding Buffer Overflow
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2005-01-24
A vulnerability has been reported in GraphicsMagick, which potentially
can be exploited by malicious people to compromise a user's system.
Full Advisory:
http://secunia.com/advisories/13960/
--
[SA13958] Gentoo update for koffice/kdegraphics
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2005-01-24
Gentoo has issued updates for koffice and kdegraphics. These fix a
vulnerability, which can be exploited by malicious people to compromise
a user's system.
Full Advisory:
http://secunia.com/advisories/13958/
--
[SA13957] teTeX Multiple Vulnerabilities
Critical: Highly critical
Where: From remote
Impact: Privilege escalation, System access
Released: 2005-01-24
Some vulnerabilities has been reported in teTeX, which potentially can
be exploited by malicious people to compromise a user's system and by
malicious, local users to perform certain actions on a vulnerable
system with escalated privileges.
Full Advisory:
http://secunia.com/advisories/13957/
--
[SA13949] Gentoo update for xpdf/gpdf
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2005-01-24
Gentoo has issued updates for xpdf and gpdf. These fix a vulnerability,
which can be exploited by malicious people to compromise a user's
system.
Full Advisory:
http://secunia.com/advisories/13949/
--
[SA13945] Fedora update for xpdf
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2005-01-20
Fedora has issued an update for xpdf. This fixes a vulnerability, which
can be exploited by malicious people to compromise a user's system.
Full Advisory:
http://secunia.com/advisories/13945/
--
[SA13941] Debian update for sword
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2005-01-21
Debian has issued an update for sword. This fixes a vulnerability,
which can be exploited by malicious people to compromise a vulnerable
system.
Full Advisory:
http://secunia.com/advisories/13941/
--
[SA13939] Conectiva update for libtiff3
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2005-01-20
Conectiva has issued an update for libtiff3. This fixes some
vulnerabilities, which can be exploited by malicious people to
compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/13939/
--
[SA13934] KOffice "Decrypt::makeFileKey2()" Buffer Overflow
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2005-01-21
A vulnerability has been reported in KOffice, which can be exploited by
malicious people to compromise a user's system.
Full Advisory:
http://secunia.com/advisories/13934/
--
[SA14048] Fedora update for enscript
Critical: Moderately critical
Where: From remote
Impact: System access
Released: 2005-01-27
Fedora has issued an update for enscript. This fixes some
vulnerabilities, which potentially can be exploited by malicious people
to compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/14048/
--
[SA14038] Openswan XAUTH/PAM Buffer Overflow Vulnerability
Critical: Moderately critical
Where: From remote
Impact: System access
Released: 2005-01-27
A vulnerability has been reported in Openswan, which can be exploited
by malicious users to compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/14038/
--
[SA14036] Mandrake update for bind
Critical: Moderately critical
Where: From remote
Impact: DoS
Released: 2005-01-27
MandrakeSoft has issued an update for bind. This fixes a vulnerability,
which can be exploited by malicious people to cause a DoS (Denial of
Service).
Full Advisory:
http://secunia.com/advisories/14036/
--
[SA14026] BNC IRC proxy FD_SET Overflow Vulnerability
Critical: Moderately critical
Where: From remote
Impact: DoS
Released: 2005-01-26
3APA3A has reported a vulnerability in BNC IRC proxy, which can be
exploited by malicious people to cause a DoS (Denial of Service).
Full Advisory:
http://secunia.com/advisories/14026/
--
[SA14023] Conectiva update for squid
Critical: Moderately critical
Where: From remote
Impact: Security Bypass, DoS, System access
Released: 2005-01-27
Conectiva has issued an update for squid. This fixes some
vulnerabilities, which can be exploited by malicious people to cause a
DoS (Denial of Service), bypass certain security restrictions and
potentially compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/14023/
--
[SA14022] Fedora update for ethereal
Critical: Moderately critical
Where: From remote
Impact: DoS, System access
Released: 2005-01-26
Fedora has issued an update for ethereal. This fixes multiple
vulnerabilities, which can be exploited by malicious people to cause a
DoS (Denial of Service) or potentially compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/14022/
--
[SA14009] BIND "q_usedns" Array Buffer Overflow Vulnerability
Critical: Moderately critical
Where: From remote
Impact: DoS
Released: 2005-01-26
A vulnerability has been reported in BIND, which can be exploited by
malicious people to cause a DoS (Denial of Service).
Full Advisory:
http://secunia.com/advisories/14009/
--
[SA14008] BIND Validator Denial of Service Vulnerability
Critical: Moderately critical
Where: From remote
Impact: DoS
Released: 2005-01-26
A vulnerability has been reported in BIND, which can be exploited by
malicious people to cause a DoS (Denial of Service).
Full Advisory:
http://secunia.com/advisories/14008/
--
[SA14002] Mandrake update for kernel
Critical: Moderately critical
Where: From remote
Impact: Security Bypass, Exposure of sensitive information,
Privilege escalation, DoS
Released: 2005-01-26
MandrakeSoft has issued an update for the kernel. This fixes multiple
vulnerabilities, which can be exploited to gain knowledge of sensitive
information, cause a DoS (Denial of Service), bypass certain security
restrictions, or gain escalated privileges on a vulnerable system.
Full Advisory:
http://secunia.com/advisories/14002/
--
[SA13990] Gentoo update for evolution
Critical: Moderately critical
Where: From remote
Impact: System access, Privilege escalation
Released: 2005-01-25
Gentoo has issued an update for evolution. This fixes a vulnerability,
which can be exploited by malicious people to compromise a user's
system or by malicious, local users to gain escalated privileges.
Full Advisory:
http://secunia.com/advisories/13990/
--
[SA13989] Gentoo update for konversation
Critical: Moderately critical
Where: From remote
Impact: System access
Released: 2005-01-25
Gentoo has issued an update for konversation. This fixes some
vulnerabilities, which potentially can be exploited by malicious people
to compromise a user's system.
Full Advisory:
http://secunia.com/advisories/13989/
--
[SA13983] Mandrake update for squid
Critical: Moderately critical
Where: From remote
Impact: DoS, System access
Released: 2005-01-25
MandrakeSoft has issued an update for squid. This fixes two
vulnerabilities, which can be exploited by malicious people to cause a
DoS (Denial of Service) or potentially compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/13983/
--
[SA13979] Mandrake update for ethereal
Critical: Moderately critical
Where: From remote
Impact: DoS, System access
Released: 2005-01-25
MandrakeSoft has issued an update for ethereal. This fixes multiple
vulnerabilities, which can be exploited by malicious people to cause a
DoS (Denial of Service) or potentially compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/13979/
--
[SA13975] Debian update for enscript
Critical: Moderately critical
Where: From remote
Impact: System access
Released: 2005-01-25
Debian has issued an update for enscript. This fixes some
vulnerabilities, which potentially can be exploited by malicious people
to compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/13975/
--
[SA13973] Ubuntu update for enscript
Critical: Moderately critical
Where: From remote
Impact: System access
Released: 2005-01-25
Ubuntu has issued an update for enscript. This fixes some
vulnerabilities, which potentially can be exploited by malicious people
to compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/13973/
--
[SA13968] GNU Enscript Multiple Vulnerabilities
Critical: Moderately critical
Where: From remote
Impact: System access
Released: 2005-01-25
Erik Sjölund has reported some vulnerabilities in GNU Enscript, which
potentially can be exploited by malicious people to compromise a
vulnerable system.
Full Advisory:
http://secunia.com/advisories/13968/
--
[SA13967] Ubuntu update for evolution
Critical: Moderately critical
Where: From remote
Impact: System access, Privilege escalation
Released: 2005-01-25
Ubuntu has issued an update for evolution. This fixes a vulnerability,
which can be exploited by malicious people to compromise a user's
system, or by malicious, local users to gain escalated privileges.
Full Advisory:
http://secunia.com/advisories/13967/
--
[SA13955] Debian update for ethereal
Critical: Moderately critical
Where: From remote
Impact: DoS, System access
Released: 2005-01-21
Debian has issued an update for ethereal. This fixes multiple
vulnerabilities, which can be exploited by malicious people to cause a
DoS (Denial of Service) or potentially compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/13955/
--
[SA13954] Gentoo update for ethereal
Critical: Moderately critical
Where: From remote
Impact: System access, DoS
Released: 2005-01-21
Gentoo has issued an update for ethereal. This fixes multiple
vulnerabilities, which can be exploited by malicious people to cause a
DoS (Denial of Service) or potentially compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/13954/
--
[SA13953] Ubuntu update for squid
Critical: Moderately critical
Where: From remote
Impact: DoS, System access
Released: 2005-01-21
Ubuntu has issued an update for squid. This fixes some vulnerabilities,
which can be exploited by malicious people to cause a DoS (Denial of
Service) or potentially compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/13953/
--
[SA13952] UnixWare update for OpenSSL
Critical: Moderately critical
Where: From remote
Impact: DoS
Released: 2005-01-21
SCO has issued updates for OpenSSL. These fix three vulnerabilities,
which can be exploited by malicious people to cause a DoS (Denial of
Service).
Full Advisory:
http://secunia.com/advisories/13952/
--
[SA13951] Debian update for unarj
Critical: Moderately critical
Where: From remote
Impact: System access
Released: 2005-01-21
Debian has issued an update for unarj. This fixes two vulnerabilities,
which potentially can be exploited by malicious people to overwrite
files or compromise a user's system.
Full Advisory:
http://secunia.com/advisories/13951/
--
[SA13946] Ethereal Multiple Unspecified Packet Dissector
Vulnerabilities
Critical: Moderately critical
Where: From remote
Impact: DoS, System access
Released: 2005-01-21
Multiple vulnerabilities have been reported in Ethereal, which can be
exploited by malicious people to cause a DoS (Denial of Service) or
potentially compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/13946/
--
[SA13943] Debian update for squid
Critical: Moderately critical
Where: From remote
Impact: DoS, System access
Released: 2005-01-20
Debian has issued an update for squid. This fixes two vulnerabilities,
which can be exploited by malicious people to cause a DoS (Denial of
Service) or potentially compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/13943/
--
[SA13999] Mandrake update for cups
Critical: Moderately critical
Where: From local network
Impact: System access
Released: 2005-01-26
MandrakeSoft has issued an update for cups. This fixes a vulnerability,
which potentially can be exploited by malicious users to compromise a
vulnerable system.
Full Advisory:
http://secunia.com/advisories/13999/
--
[SA13956] Gentoo update for cups
Critical: Moderately critical
Where: From local network
Impact: System access
Released: 2005-01-24
Gentoo has issued an update for cups. This fixes a vulnerability, which
potentially can be exploited by malicious users to compromise a
vulnerable system.
Full Advisory:
http://secunia.com/advisories/13956/
--
[SA13940] Fedora update for cups
Critical: Moderately critical
Where: From local network
Impact: System access
Released: 2005-01-20
Fedora has issued an update for cups. This fixes a vulnerability, which
potentially can be exploited by malicious users to compromise a
vulnerable system.
Full Advisory:
http://secunia.com/advisories/13940/
--
[SA14013] SCO OpenServer update for wu-ftpd
Critical: Less critical
Where: From remote
Impact: Security Bypass
Released: 2005-01-26
SCO has issued an update for wu-ftpd. This fixes a vulnerability, which
can be exploited by malicious, authenticated users to circumvent certain
restrictions.
Full Advisory:
http://secunia.com/advisories/14013/
--
[SA13978] Mandrake update for mailman
Critical: Less critical
Where: From remote
Impact: Cross Site Scripting
Released: 2005-01-25
MandrakeSoft has issued an update for mailman. This fixes a
vulnerability, which can be exploited by malicious people to conduct
cross-site scripting attacks.
Full Advisory:
http://secunia.com/advisories/13978/
--
[SA13950] Gentoo update for mailman
Critical: Less critical
Where: From remote
Impact: Cross Site Scripting
Released: 2005-01-24
Gentoo has issued an update for mailman. This fixes a vulnerability,
which can be exploited by malicious people to conduct cross-site
scripting attacks.
Full Advisory:
http://secunia.com/advisories/13950/
--
[SA14050] Debian update for libdbi-perl
Critical: Less critical
Where: Local system
Impact: Privilege escalation
Released: 2005-01-27
Debian has issued an update for libdbi-perl. This fixes a
vulnerability, which can be exploited by malicious, local users to
perform certain actions on a vulnerable system with escalated
privileges.
Full Advisory:
http://secunia.com/advisories/14050/
--
[SA14044] Gentoo update for perl/dbi
Critical: Less critical
Where: Local system
Impact: Privilege escalation
Released: 2005-01-27
Gentoo has issued updates for perl and DBI. These fix some
vulnerabilities, which can be exploited by malicious, local users to
perform certain actions on a vulnerable system with escalated
privileges.
Full Advisory:
http://secunia.com/advisories/14044/
--
[SA14040] Astaro update for kernel
Critical: Less critical
Where: Local system
Impact: Privilege escalation
Released: 2005-01-27
Astaro has issued an update for the kernel. This fixes a vulnerability,
which can be exploited by malicious, local users to gain escalated
privileges.
Full Advisory:
http://secunia.com/advisories/14040/
--
[SA14015] Perl DBI ProxyServer.pm Insecure Temporary File Creation
Critical: Less critical
Where: Local system
Impact: Privilege escalation
Released: 2005-01-27
Javier Fernández-Sanguino Peña has reported a vulnerability in Perl
DBI, which can be exploited by malicious, local users to perform
certain actions on a vulnerable system with escalated privileges.
Full Advisory:
http://secunia.com/advisories/14015/
--
[SA14012] SCO OpenServer scosession Privilege Escalation Vulnerability
Critical: Less critical
Where: Local system
Impact: Privilege escalation
Released: 2005-01-26
A vulnerability has been reported in scosession in OpenServer, which
can be exploited by malicious, local users to gain escalated
privileges.
Full Advisory:
http://secunia.com/advisories/14012/
--
[SA13995] Debian update for vdr
Critical: Less critical
Where: Local system
Impact: Manipulation of data
Released: 2005-01-25
Debian has issued an update for vdr. This fixes a vulnerability, which
can be exploited by malicious, local users to manipulate sensitive
information.
Full Advisory:
http://secunia.com/advisories/13995/
--
[SA13992] Sun Solaris DHCP Administration Utilities Vulnerability
Critical: Less critical
Where: Local system
Impact: Privilege escalation
Released: 2005-01-25
A vulnerability has been reported in Sun Solaris, which can be
exploited by malicious, local users to gain escalated privileges.
Full Advisory:
http://secunia.com/advisories/13992/
--
[SA13987] Debian update for zhcon
Critical: Less critical
Where: Local system
Impact: Exposure of sensitive information
Released: 2005-01-25
Debian has issued an update for zhcon. This fixes a vulnerability,
which can be exploited by malicious, local users to disclose the
contents of arbitrary files.
Full Advisory:
http://secunia.com/advisories/13987/
--
[SA13982] Mandrake update for zhcon
Critical: Less critical
Where: Local system
Impact: Exposure of sensitive information
Released: 2005-01-25
MandrakeSoft has issued an update for zhcon. This fixes a
vulnerability, which can be exploited by malicious, local users to
disclose the contents of arbitrary files.
Full Advisory:
http://secunia.com/advisories/13982/
--
[SA13977] zhcon Arbitrary File Content Disclosure
Critical: Less critical
Where: Local system
Impact: Exposure of sensitive information
Released: 2005-01-25
Erik Sjölund has reported a vulnerability in zhcon, which can be
exploited by malicious, local users to disclose sensitive information.
Full Advisory:
http://secunia.com/advisories/13977/
--
[SA13972] Red Hat update for kernel
Critical: Less critical
Where: Local system
Impact: Unknown, Privilege escalation, DoS
Released: 2005-01-24
Red Hat has issued an update for the kernel. This fixes multiple
vulnerabilities, which can be exploited by malicious, local users to
cause a DoS (Denial of Service) or gain escalated privileges.
Full Advisory:
http://secunia.com/advisories/13972/
--
[SA13970] FireHOL Insecure Temporary File Creation Vulnerabilities
Critical: Less critical
Where: Local system
Impact: Privilege escalation
Released: 2005-01-24
Sam Couter has reported some vulnerabilities in FireHOL, which can be
exploited by malicious, local users to perform certain actions on a
vulnerable system with escalated privileges.
Full Advisory:
http://secunia.com/advisories/13970/
--
[SA13965] Mac OS X iSync mRouter Buffer Overflow Vulnerability
Critical: Less critical
Where: Local system
Impact: Privilege escalation
Released: 2005-01-26
Braden Thomas has reported a vulnerability in iSync, which can be
exploited by malicious, local users to gain escalated privileges.
Full Advisory:
http://secunia.com/advisories/13965/
--
[SA13961] SUSE update for kernel
Critical: Less critical
Where: Local system
Impact: Privilege escalation, DoS
Released: 2005-01-24
SUSE has issued an update for the kernel. This fixes some
vulnerabilities, which can be exploited by malicious, local users to
cause a DoS (Denial of Service) or gain escalated privileges.
Full Advisory:
http://secunia.com/advisories/13961/
--
[SA13959] Gentoo update for mysql
Critical: Less critical
Where: Local system
Impact: Manipulation of data, Exposure of sensitive information,
Privilege escalation
Released: 2005-01-24
Gentoo has issued an update for mysql. This fixes a vulnerability,
which can be exploited by malicious, local users to perform certain
actions on a vulnerable system with escalated privileges.
Full Advisory:
http://secunia.com/advisories/13959/
--
[SA13944] Ubuntu update for php4
Critical: Less critical
Where: Local system
Impact: Security Bypass
Released: 2005-01-21
Ubuntu has issued an update for php4. This fixes a vulnerability, which
can be exploited to access files outside the "open_basedir" root and
potentially bypass safe_mode restrictions.
Full Advisory:
http://secunia.com/advisories/13944/
--
[SA13938] Debian xtrlock Security Bypass Vulnerability
Critical: Less critical
Where: Local system
Impact: Security Bypass
Released: 2005-01-20
Debian has issued an update for xtrlock. This fixes a vulnerability,
which can be exploited by a malicious person with physical access to a
system to bypass certain security restrictions.
Full Advisory:
http://secunia.com/advisories/13938/
--
[SA13933] Ghostscript Various Scripts Insecure Temporary File Creation
Critical: Less critical
Where: Local system
Impact: Privilege escalation
Released: 2005-01-21
Javier Fernández-Sanguino Peña has reported some vulnerabilities in
Ghostscript, which potentially can be exploited by malicious, local
users to conduct certain actions on a vulnerable system with escalated
privileges.
Full Advisory:
http://secunia.com/advisories/13933/
--
[SA13932] Ubuntu update for apache-utils
Critical: Less critical
Where: Local system
Impact: Privilege escalation
Released: 2005-01-20
Ubuntu has issued an update for apache-utils. This fixes a
vulnerability, which can be exploited by malicious, local users to
perform certain actions on a vulnerable system with escalated
privileges.
Full Advisory:
http://secunia.com/advisories/13932/
--
[SA13947] SCO OpenServer update for bind
Critical: Not critical
Where: From local network
Impact: DoS
Released: 2005-01-21
SCO has issued an update for bind in OpenServer. This fixes a
vulnerability, which can be exploited by malicious people to poison the
DNS cache.
Full Advisory:
http://secunia.com/advisories/13947/
--
[SA14037] Sun Solaris UDP End Point Handling Denial of Service
Critical: Not critical
Where: Local system
Impact: DoS
Released: 2005-01-27
A vulnerability has been reported in Sun Solaris, which potentially can
be exploited by malicious, local users to cause a DoS (Denial of
Service).
Full Advisory:
http://secunia.com/advisories/14037/
Other:--
[SA14049] Juniper JUNOS Unspecified Packet Processing Denial of
Service
Critical: Moderately critical
Where: From remote
Impact: DoS
Released: 2005-01-27
A vulnerability has been reported in JUNOS, which can be exploited by
malicious people to cause a DoS (Denial of Service).
Full Advisory:
http://secunia.com/advisories/14049/
--
[SA14032] Cisco IOS IPv6 Packet Processing Denial of Service
Critical: Moderately critical
Where: From remote
Impact: DoS
Released: 2005-01-27
A vulnerability has been reported in Cisco IOS, which can be exploited
by malicious people to cause a DoS (Denial of Service).
Full Advisory:
http://secunia.com/advisories/14032/
--
[SA13942] OfficeConnect Wireless 11g Access Point Information
Disclosure
Critical: Moderately critical
Where: From local network
Impact: Exposure of system information, Exposure of sensitive
information
Released: 2005-01-20
A vulnerability has been reported in 3Com OfficeConnect Wireless 11g
Access Point, which can be exploited by malicious people to gain
knowledge of sensitive information.
Full Advisory:
http://secunia.com/advisories/13942/
--
[SA14034] Cisco IOS BGP Protocol Processing Denial of Service
Critical: Less critical
Where: From remote
Impact: DoS
Released: 2005-01-27
A vulnerability has been reported in Cisco IOS, which can be exploited
by malicious people to cause a DoS (Denial of Service).
Full Advisory:
http://secunia.com/advisories/14034/
--
[SA14031] Cisco IOS MPLS Packet Processing Denial of Service
Critical: Less critical
Where: From local network
Impact: DoS
Released: 2005-01-27
A vulnerability has been reported in Cisco IOS, which can be exploited
by malicious people to cause a DoS (Denial of Service).
Full Advisory:
http://secunia.com/advisories/14031/
--
[SA13971] Xerox WorkCentre Pro PostScript Directory Traversal
Critical: Less critical
Where: From local network
Impact: Exposure of sensitive information
Released: 2005-01-24
A vulnerability has been reported in Xerox WorkCentre Pro, which can be
exploited by malicious users to gain knowledge of sensitive
information.
Full Advisory:
http://secunia.com/advisories/13971/
Cross Platform:--
[SA13948] TikiWiki "temp" Arbitrary Script Execution Vulnerability
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2005-01-21
Some vulnerabilities have been reported in TikiWiki, which can be
exploited by malicious people to compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/13948/
--
[SA14027] Citadel/UX FD_SET Overflow Vulnerability
Critical: Moderately critical
Where: From remote
Impact: DoS
Released: 2005-01-26
3APA3A has reported a vulnerability in Citadel/UX, which can be
exploited by malicious people to cause a DoS (Denial of Service).
Full Advisory:
http://secunia.com/advisories/14027/
--
[SA14001] MoinMoin Unspecified Search ACL Security Bypass
Vulnerability
Critical: Moderately critical
Where: From remote
Impact: Security Bypass
Released: 2005-01-26
A vulnerability has been reported in MoinMoin, which can be exploited
by malicious people to bypass certain security restrictions.
Full Advisory:
http://secunia.com/advisories/14001/
--
[SA13980] IDA Pro Import Library Name Handling Buffer Overflow
Critical: Moderately critical
Where: From remote
Impact: System access
Released: 2005-01-25
Lord Yup has reported a vulnerability in IDA Pro, which potentially can
be exploited by malicious people to compromise a user's system.
Full Advisory:
http://secunia.com/advisories/13980/
--
[SA13976] BRIBBLE webadmin Authentication Bypass Vulnerability
Critical: Moderately critical
Where: From remote
Impact: Security Bypass
Released: 2005-01-25
A vulnerability has been reported in BRIBBLE, which can be exploited by
malicious people to bypass certain security restrictions.
Full Advisory:
http://secunia.com/advisories/13976/
--
[SA13962] SquirrelMail Three Vulnerabilities
Critical: Moderately critical
Where: From remote
Impact: Cross Site Scripting, Exposure of sensitive information
Released: 2005-01-24
Three vulnerabilities have been reported in SquirrelMail, which can be
exploited by malicious people to gain knowledge of sensitive
information or conduct cross-site scripting attacks.
Full Advisory:
http://secunia.com/advisories/13962/
--
[SA13935] Help Desk Reloaded Unspecified Login Vulnerability
Critical: Moderately critical
Where: From remote
Impact: Unknown
Released: 2005-01-24
A vulnerability with an unknown impact has been reported in Help Desk
Reloaded.
Full Advisory:
http://secunia.com/advisories/13935/
--
[SA14000] phpEventCalendar Events Script Insertion Vulnerability
Critical: Less critical
Where: From remote
Impact: Cross Site Scripting
Released: 2005-01-26
Madelman has reported a vulnerability in phpEventCalendar, which can be
exploited by malicious people to conduct script insertion attacks.
Full Advisory:
http://secunia.com/advisories/14000/
--
[SA13988] Exponent CMS "module" Parameter Cross-Site Scripting
Vulnerability
Critical: Less critical
Where: From remote
Impact: Cross Site Scripting, Exposure of system information
Released: 2005-01-26
y3dips has reported a vulnerability in Exponent CMS, which can be
exploited by malicious people to conduct cross-site scripting attacks.
Full Advisory:
http://secunia.com/advisories/13988/
--
[SA14010] iChain Mutual Authentication Unauthorised Resource Access
Critical: Less critical
Where: From local network
Impact: Security Bypass
Released: 2005-01-27
A security issue has been reported in Novell iChain, which potentially
can be exploited by malicious people to bypass certain security
restrictions.
Full Advisory:
http://secunia.com/advisories/14010/
--
[SA13936] OpenH323 Gatekeeper Multiple Sockets Buffer Overflow
Critical: Less critical
Where: From local network
Impact: DoS
Released: 2005-01-24
A vulnerability has been reported in OpenH323 Gatekeeper, which can be
exploited by malicious people to cause a DoS (Denial of Service).
Full Advisory:
http://secunia.com/advisories/13936/
========================================================================
Secunia recommends that you verify all advisories you receive,
by clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only use
those supplied by the vendor.
Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/
Subscribe:
http://secunia.com/secunia_weekly_summary/
Contact details:
Web : http://secunia.com/
E-mail : support@private
Tel : +45 70 20 51 44
Fax : +45 70 20 51 45
_________________________________________
Open Source Vulnerability Database (OSVDB) Everything is Vulnerable - http://www.osvdb.org/
This archive was generated by hypermail 2.1.3 : Mon Jan 31 2005 - 03:51:36 PST