========================================================================
The Secunia Weekly Advisory Summary
2005-09-22 - 2005-09-29
This week : 67 advisories
========================================================================
Table of Contents:
1.....................................................Word From Secunia
2....................................................This Week In Brief
3...............................This Weeks Top Ten Most Read Advisories
4.......................................Vulnerabilities Summary Listing
5.......................................Vulnerabilities Content Listing
========================================================================
1) Word From Secunia:
The Secunia staff is spending hours every day to assure you the best
and most reliable source for vulnerability information. Every single
vulnerability report is being validated and verified before a Secunia
advisory is written.
Secunia validates and verifies vulnerability reports in many different
ways e.g. by downloading the software and performing comprehensive
tests, by reviewing source code, or by validating the credibility of
the source from which the vulnerability report was issued.
As a result, Secunia's database is the most correct and complete source
for recent vulnerability information available on the Internet.
Secunia Online Vulnerability Database:
http://secunia.com/
========================================================================
2) This Week in Brief:
A vulnerability has been discovered in RealPlayer / Helix Player, which
potentially can be exploited by malicious people to compromise a user's
system.
Currently, no solution is available from the vendor. Please see the
referenced Secunia advisories for additional details.
References:
http://secunia.com/SA16961
http://secunia.com/SA16954
--
Apple has release a security update for Mac OS X, which fixes 10
vulnerabilities.
A complete list and details about the vulnerabilities fixed can be
found in the Secunia advisory below.
Reference:
http://secunia.com/SA16920
VIRUS ALERTS:
Secunia has not issued any virus alerts during the week.
========================================================================
3) This Weeks Top Ten Most Read Advisories:
1. [SA16869] Firefox Command Line URL Shell Command Injection
2. [SA16901] Thunderbird Command Line URL Shell Command Injection
3. [SA16911] Firefox Multiple Vulnerabilities
4. [SA16942] Microsoft Internet Explorer "XMLHTTP" HTTP Request
Injection
5. [SA16922] Sony PSP Photo Viewer TIFF File Handling Buffer Overflow
6. [SA16917] Mozilla Multiple Vulnerabilities
7. [SA16920] Mac OS X Security Update Fixes Multiple Vulnerabilities
8. [SA11762] Opera Browser Favicon Displaying Address Bar Spoofing
Vulnerability
9. [SA16944] Netscape Multiple Vulnerabilities
10. [SA16764] Firefox IDN URL Domain Name Buffer Overflow
========================================================================
4) Vulnerabilities Summary Listing
Windows:
[SA16958] FL Studio FLP File Handling Buffer Overflow
[SA16942] Microsoft Internet Explorer "XMLHTTP" HTTP Request Injection
[SA16909] SecureW2 Insecure Pre-Master Secret Generation
UNIX/Linux:
[SA16965] Fedora update for firefox
[SA16960] Slackware update for mozilla
[SA16928] Ubuntu update for mozilla/mozilla-firefox
[SA16919] Red Hat update for firefox
[SA16986] Fedora update for HelixPlayer
[SA16980] TWiki "%INCLUDE" Shell Command Injection Vulnerability
[SA16976] Gentoo update for php
[SA16974] SGI Advanced Linux Environment Multiple Updates
[SA16964] Fedora update for mozilla
[SA16962] Red Hat update for HelixPlayer
[SA16961] RealPlayer Error Message Format String Vulnerability
[SA16954] Helix Player Error Message Format String Vulnerability
[SA16953] Mandriva update for mozilla
[SA16948] Trustix update for clamav
[SA16930] SUSE update for clamav
[SA16920] Mac OS X Security Update Fixes Multiple Vulnerabilities
[SA16918] Red Hat update for mozilla
[SA16972] Debian update for python2.3
[SA16968] SUSE update for opera
[SA16967] Astaro Security Linux PPTP Denial of Service Vulnerability
[SA16957] Gentoo update for qt
[SA16945] jPortal Download Search SQL Injection Vulnerability
[SA16940] Gentoo update for webmin/usermin
[SA16939] Debian update for courier
[SA16938] Gentoo update for mantis
[SA16936] wzdftpd SITE Command Arbitrary Shell Command Injection
[SA16923] Interchange Catalog Skeleton SQL Injection and ITL Injection
Vulnerabilities
[SA16914] Debian update for python2.1
[SA16943] IBM HMC apache/mod_ssl Vulnerabilities
[SA16978] Polipo Disclosure of Sensitive Information
[SA16950] Red Hat update for cups
[SA16912] Fedora update for cups
[SA16969] Linux Kernel URB Handling Denial of Service Vulnerability
[SA16959] Slackware update for x11
[SA16955] Sun Solaris Xsun and Xprt Privilege Escalation Vulnerability
[SA16935] Qpopper poppassd Insecure Trace File Creation Vulnerability
[SA16927] Ubuntu update for kernel
[SA16925] SUSE update for XFree86-server/xorg-x11-server
[SA16924] SUN Solaris UFS File System Denial of Service
[SA16916] Debian update for kdeedu
[SA16910] Fedora update for kernel
[SA16984] Red Hat update for wget
Other:
[SA16956] Avaya Products httpd/mod_ssl Vulnerabilities
[SA16922] Sony PSP Photo Viewer TIFF File Handling Buffer Overflow
[SA16952] Anycom Blue Stereo Headset BSH-100 Pairing Mode
Vulnerability
[SA16931] Plantronics M2500 Bluetooth Headset Pairing Mode
Vulnerability
Cross Platform:
[SA16944] Netscape Multiple Vulnerabilities
[SA16941] AlstraSoft E-Friends "mode" File Inclusion Vulnerability
[SA16933] phpMyFAQ Multiple Vulnerabilities
[SA16917] Mozilla Multiple Vulnerabilities
[SA16911] Firefox Multiple Vulnerabilities
[SA16979] PostNuke Local File Inclusion and Comment Bypass
Vulnerabilities
[SA16949] SEO-Board admin.php SQL Injection Vulnerability
[SA16937] Mailgust "email" SQL Injection Vulnerability
[SA16929] ContentServ "ctsWebsite" Local File Inclusion Vulnerability
[SA16926] MultiTheftAuto Server "motd.txt" Modification and Denial of
Service
[SA16913] My Little Forum "search" SQL Injection Vulnerability
[SA16908] PunBB Two Vulnerabilities
[SA16947] RSyslog Syslog Message SQL Injection Vulnerability
[SA16970] CJ LinkOut "123" Cross-Site Scripting Vulnerability
[SA16966] CJ Tag Board Cross-Site Scripting Vulnerabilities
[SA16963] CJ Web2Mail Cross-Site Scripting Vulnerabilities
[SA16934] IPB Riverdark RSS Syndicator Module Cross-Site Scripting
[SA16971] PHP Trailing Slash "open_basedir" Security Bypass
========================================================================
5) Vulnerabilities Content Listing
Windows:--
[SA16958] FL Studio FLP File Handling Buffer Overflow
Critical: Moderately critical
Where: From remote
Impact: System access
Released: 2005-09-27
varunuppal has discovered a vulnerability in FL Studio, which
potentially can be exploited by malicious people to compromise a user's
system.
Full Advisory:
http://secunia.com/advisories/16958/
--
[SA16942] Microsoft Internet Explorer "XMLHTTP" HTTP Request Injection
Critical: Moderately critical
Where: From remote
Impact: Security Bypass, Manipulation of data, Exposure of
sensitive information
Released: 2005-09-26
Amit Klein has discovered a vulnerability in Microsoft Internet
Explorer, which can be exploited by malicious people to manipulate
certain data and conduct HTTP request smuggling attacks.
Full Advisory:
http://secunia.com/advisories/16942/
--
[SA16909] SecureW2 Insecure Pre-Master Secret Generation
Critical: Less critical
Where: From local network
Impact: Exposure of sensitive information
Released: 2005-09-26
Simon Josefsson has reported a security issue in SecureW2, which
potentially can be exploited by malicious people to disclose certain
sensitive information.
Full Advisory:
http://secunia.com/advisories/16909/
UNIX/Linux:--
[SA16965] Fedora update for firefox
Critical: Extremely critical
Where: From remote
Impact: Security Bypass, Spoofing, Manipulation of data, System
access
Released: 2005-09-27
Fedora has issued an update for firefox. This fixes some
vulnerabilities, which can be exploited by malicious people to conduct
spoofing attacks, manipulate certain data, bypass certain security
restrictions, and compromise a user's system.
Full Advisory:
http://secunia.com/advisories/16965/
--
[SA16960] Slackware update for mozilla
Critical: Extremely critical
Where: From remote
Impact: Security Bypass, Spoofing, Manipulation of data, System
access
Released: 2005-09-27
Slackware has issued an update for mozilla. This fixes some
vulnerabilities, which can be exploited by malicious people to conduct
spoofing attacks, manipulate certain data, bypass certain security
restrictions, and compromise a user's system.
Full Advisory:
http://secunia.com/advisories/16960/
--
[SA16928] Ubuntu update for mozilla/mozilla-firefox
Critical: Extremely critical
Where: From remote
Impact: Security Bypass, Spoofing, Manipulation of data, System
access
Released: 2005-09-26
Ubuntu has issued updates for mozilla and mozilla-firefox. These fix
some vulnerabilities, which can be exploited by malicious people to
conduct spoofing attacks, manipulate certain data, bypass certain
security restrictions, and compromise a user's system.
Full Advisory:
http://secunia.com/advisories/16928/
--
[SA16919] Red Hat update for firefox
Critical: Extremely critical
Where: From remote
Impact: Security Bypass, Spoofing, Manipulation of data, System
access
Released: 2005-09-23
Red Hat has issued an update for firefox. This fixes some
vulnerabilities, which can be exploited by malicious people to conduct
spoofing attacks, manipulate certain data, bypass certain security
restrictions, and compromise a user's system.
Full Advisory:
http://secunia.com/advisories/16919/
--
[SA16986] Fedora update for HelixPlayer
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2005-09-28
Fedora has issued an update for HelixPlayer. This fixes a
vulnerability, which potentially can be exploited by malicious people
to compromise a user's system.
Full Advisory:
http://secunia.com/advisories/16986/
--
[SA16980] TWiki "%INCLUDE" Shell Command Injection Vulnerability
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2005-09-28
A vulnerability has been reported in TWiki, which can be exploited by
malicious people to compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/16980/
--
[SA16976] Gentoo update for php
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2005-09-28
Gentoo has issued an update for php. This fixes two vulnerabilities,
which can be exploited by malicious people to compromise a vulnerable
system.
Full Advisory:
http://secunia.com/advisories/16976/
--
[SA16974] SGI Advanced Linux Environment Multiple Updates
Critical: Highly critical
Where: From remote
Impact: DoS, System access
Released: 2005-09-28
SGI has issued a patch for SGI Advanced Linux Environment. This fixes
some vulnerabilities, which can be exploited by malicious people to
cause a DoS (Denial of Service) or to compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/16974/
--
[SA16964] Fedora update for mozilla
Critical: Highly critical
Where: From remote
Impact: Security Bypass, Spoofing, Manipulation of data, System
access
Released: 2005-09-27
Fedora has issued an update for mozilla. This fixes some
vulnerabilities, which can be exploited by malicious people to conduct
spoofing attacks, manipulate certain data, bypass certain security
restrictions, and compromise a user's system.
Full Advisory:
http://secunia.com/advisories/16964/
--
[SA16962] Red Hat update for HelixPlayer
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2005-09-27
Red Hat has issued an update for HelixPlayer. This fixes a
vulnerability, which potentially can be exploited by malicious people
to compromise a user's system.
Full Advisory:
http://secunia.com/advisories/16962/
--
[SA16961] RealPlayer Error Message Format String Vulnerability
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2005-09-27
c0ntex has discovered a vulnerability in RealPlayer, which potentially
can be exploited by malicious people to compromise a user's system.
Full Advisory:
http://secunia.com/advisories/16961/
--
[SA16954] Helix Player Error Message Format String Vulnerability
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2005-09-27
c0ntex has discovered a vulnerability in Helix Player, which
potentially can be exploited by malicious people to compromise a user's
system.
Full Advisory:
http://secunia.com/advisories/16954/
--
[SA16953] Mandriva update for mozilla
Critical: Highly critical
Where: From remote
Impact: System access, Manipulation of data, Spoofing, Security
Bypass
Released: 2005-09-27
Mandriva has issued an update for mozilla. This fixes some
vulnerabilities, which can be exploited by malicious people to conduct
spoofing attacks, manipulate certain data, bypass certain security
restrictions, and compromise a user's system.
Full Advisory:
http://secunia.com/advisories/16953/
--
[SA16948] Trustix update for clamav
Critical: Highly critical
Where: From remote
Impact: DoS, System access
Released: 2005-09-26
Trustix has issued an update for clamav. This fixes a vulnerability,
which can be exploited by malicious people to cause a DoS (Denial of
Service), or potentially to compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/16948/
--
[SA16930] SUSE update for clamav
Critical: Highly critical
Where: From remote
Impact: DoS, System access
Released: 2005-09-26
SUSE has issued an update for clamav. This fixes two vulnerabilities,
which can be exploited by malicious people to cause a DoS (Denial of
Service), or potentially to compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/16930/
--
[SA16920] Mac OS X Security Update Fixes Multiple Vulnerabilities
Critical: Highly critical
Where: From remote
Impact: Security Bypass, Cross Site Scripting, Exposure of
sensitive information, Privilege escalation, System access
Released: 2005-09-23
Apple has issued a security update for Mac OS X, which fixes 10
vulnerabilities.
Full Advisory:
http://secunia.com/advisories/16920/
--
[SA16918] Red Hat update for mozilla
Critical: Highly critical
Where: From remote
Impact: Security Bypass, Spoofing, Manipulation of data, System
access
Released: 2005-09-23
Red Hat has issued an update for mozilla. This fixes some
vulnerabilities, which can be exploited by malicious people to conduct
spoofing attacks, manipulate certain data, bypass certain security
restrictions, and compromise a user's system.
Full Advisory:
http://secunia.com/advisories/16918/
--
[SA16972] Debian update for python2.3
Critical: Moderately critical
Where: From remote
Impact: DoS, System access
Released: 2005-09-28
Debian has issued an update for python2.3. This fixes a vulnerability,
which potentially can be exploited by malicious people to compromise a
vulnerable system.
Full Advisory:
http://secunia.com/advisories/16972/
--
[SA16968] SUSE update for opera
Critical: Moderately critical
Where: From remote
Impact: Unknown, Cross Site Scripting, Spoofing
Released: 2005-09-27
SUSE has issued an update for opera. This fixes two vulnerabilities,
which can be exploited by a malicious person to conduct script
insertion attacks and to spoof the name of attached files.
Full Advisory:
http://secunia.com/advisories/16968/
--
[SA16967] Astaro Security Linux PPTP Denial of Service Vulnerability
Critical: Moderately critical
Where: From remote
Impact: DoS
Released: 2005-09-27
A vulnerability has been reported in Astaro Security Linux, which can
be exploited by malicious people to cause a DoS (Denial of Service).
Full Advisory:
http://secunia.com/advisories/16967/
--
[SA16957] Gentoo update for qt
Critical: Moderately critical
Where: From remote
Impact: DoS, System access
Released: 2005-09-27
Gentoo has issued an update for qt. This fixes some vulnerabilities,
which can be exploited by malicious people to cause a DoS (Denial of
Service) or potentially compromise a user's system.
Full Advisory:
http://secunia.com/advisories/16957/
--
[SA16945] jPortal Download Search SQL Injection Vulnerability
Critical: Moderately critical
Where: From remote
Impact: Manipulation of data
Released: 2005-09-27
krasza has discovered a vulnerability in jPortal, which can be
exploited by malicious people to conduct SQL injection attacks.
Full Advisory:
http://secunia.com/advisories/16945/
--
[SA16940] Gentoo update for webmin/usermin
Critical: Moderately critical
Where: From remote
Impact: Security Bypass
Released: 2005-09-26
Gentoo has issued an update for webmin/usermin. This fixes a
vulnerability, which can be exploited by malicious people to bypass
certain security restrictions.
Full Advisory:
http://secunia.com/advisories/16940/
--
[SA16939] Debian update for courier
Critical: Moderately critical
Where: From remote
Impact: Cross Site Scripting
Released: 2005-09-26
Debian has issued an update for courier. This fixes a vulnerability,
which can be exploited by malicious people to conduct script insertion
attacks.
Full Advisory:
http://secunia.com/advisories/16939/
--
[SA16938] Gentoo update for mantis
Critical: Moderately critical
Where: From remote
Impact: Cross Site Scripting, Manipulation of data
Released: 2005-09-26
Gentoo has issued an update for mantis. This fixes some
vulnerabilities, which can be exploited by malicious people to conduct
cross-site scripting and SQL injection attacks.
Full Advisory:
http://secunia.com/advisories/16938/
--
[SA16936] wzdftpd SITE Command Arbitrary Shell Command Injection
Critical: Moderately critical
Where: From remote
Impact: System access
Released: 2005-09-26
kcope has discovered a vulnerability in wzdftpd, which can be exploited
by malicious users to compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/16936/
--
[SA16923] Interchange Catalog Skeleton SQL Injection and ITL Injection
Vulnerabilities
Critical: Moderately critical
Where: From remote
Impact: Unknown, Manipulation of data
Released: 2005-09-23
Two vulnerabilities have been reported in Interchange, which can be
exploited by malicious people to conduct SQL injection attacks, or to
perform actions with an unknown impact.
Full Advisory:
http://secunia.com/advisories/16923/
--
[SA16914] Debian update for python2.1
Critical: Moderately critical
Where: From remote
Impact: DoS, System access
Released: 2005-09-23
Debian has issued an update for python2.1. This fixes a vulnerability,
which potentially can be exploited by malicious people to compromise a
vulnerable system.
Full Advisory:
http://secunia.com/advisories/16914/
--
[SA16943] IBM HMC apache/mod_ssl Vulnerabilities
Critical: Less critical
Where: From remote
Impact: Security Bypass, Cross Site Scripting, Manipulation of
data, Privilege escalation
Released: 2005-09-26
IBM has acknowledged some vulnerabilities in IBM HMC, which can be
exploited by malicious, local users to cause a DoS (Denial of Service)
or potentially gain escalated privileges, or by malicious people to
bypass certain security restrictions or conduct HTTP request smuggling
attacks.
Full Advisory:
http://secunia.com/advisories/16943/
--
[SA16978] Polipo Disclosure of Sensitive Information
Critical: Less critical
Where: From local network
Impact: Unknown, Exposure of sensitive information
Released: 2005-09-28
A vulnerability has been reported in Polipo, which can be exploited by
malicious people to disclose potentially sensitive information.
Full Advisory:
http://secunia.com/advisories/16978/
--
[SA16950] Red Hat update for cups
Critical: Less critical
Where: From local network
Impact: DoS
Released: 2005-09-27
Red Hat has issued an update for cups. This fixes a vulnerability,
which can be exploited by malicious users to cause a DoS (Denial of
Service).
Full Advisory:
http://secunia.com/advisories/16950/
--
[SA16912] Fedora update for cups
Critical: Less critical
Where: From local network
Impact: DoS
Released: 2005-09-23
Fedora has issued an update for cups. This fixes a vulnerability, which
can be exploited by malicious users to cause a DoS (Denial of Service).
Full Advisory:
http://secunia.com/advisories/16912/
--
[SA16969] Linux Kernel URB Handling Denial of Service Vulnerability
Critical: Less critical
Where: Local system
Impact: DoS
Released: 2005-09-27
A vulnerability and a security issue have been reported in the Linux
Kernel, which can be exploited by malicious, local users to cause a DoS
(Denial of Service).
Full Advisory:
http://secunia.com/advisories/16969/
--
[SA16959] Slackware update for x11
Critical: Less critical
Where: Local system
Impact: Privilege escalation
Released: 2005-09-27
Slackware has issued an update for x11. This fixes a vulnerability,
which potentially can be exploited by malicious, local users to gain
escalated privileges.
Full Advisory:
http://secunia.com/advisories/16959/
--
[SA16955] Sun Solaris Xsun and Xprt Privilege Escalation Vulnerability
Critical: Less critical
Where: Local system
Impact: Privilege escalation
Released: 2005-09-27
A vulnerability has been reported in Solaris, which can be exploited by
malicious, local users to gain escalated privileges.
Full Advisory:
http://secunia.com/advisories/16955/
--
[SA16935] Qpopper poppassd Insecure Trace File Creation Vulnerability
Critical: Less critical
Where: Local system
Impact: Privilege escalation
Released: 2005-09-26
kcope has discovered a vulnerability in Qpopper, which can be exploited
by malicious, local users to perform certain actions on a vulnerable
system with escalated privileges.
Full Advisory:
http://secunia.com/advisories/16935/
--
[SA16927] Ubuntu update for kernel
Critical: Less critical
Where: Local system
Impact: DoS
Released: 2005-09-26
Ubuntu has issued an update for the kernel. This fixes two
vulnerabilities, which potentially can be exploited by malicious, local
users to cause a DoS (Denial of Service).
Full Advisory:
http://secunia.com/advisories/16927/
--
[SA16925] SUSE update for XFree86-server/xorg-x11-server
Critical: Less critical
Where: Local system
Impact: Privilege escalation
Released: 2005-09-26
SUSE has issued an update for XFree86-server/xorg-x11-server. This
fixes a vulnerability, which potentially can be exploited by malicious,
local users to gain escalated privileges.
Full Advisory:
http://secunia.com/advisories/16925/
--
[SA16924] SUN Solaris UFS File System Denial of Service
Critical: Less critical
Where: Local system
Impact: DoS
Released: 2005-09-23
A vulnerability has been reported in Solaris, which can be exploited by
malicious, local users to cause a DoS (Denial of Service).
Full Advisory:
http://secunia.com/advisories/16924/
--
[SA16916] Debian update for kdeedu
Critical: Less critical
Where: Local system
Impact: Privilege escalation
Released: 2005-09-23
Debian has issued an update for kdeedu. This fixes a vulnerability,
which can be exploited by malicious, local users to perform certain
actions with escalated privileges on a vulnerable system.
Full Advisory:
http://secunia.com/advisories/16916/
--
[SA16910] Fedora update for kernel
Critical: Less critical
Where: Local system
Impact: DoS, Privilege escalation, Exposure of sensitive
information
Released: 2005-09-23
Fedora has issued an update for the kernel. This fixes some
vulnerabilities, which potentially can be exploited by malicious, local
users to disclose certain sensitive information, cause a DoS (Denial of
Service), and gain escalated privileges.
Full Advisory:
http://secunia.com/advisories/16910/
--
[SA16984] Red Hat update for wget
Critical: Not critical
Where: Local system
Impact: Privilege escalation
Released: 2005-09-28
Red Hat has issued an update for wget. This fixes a vulnerability,
which can be exploited by malicious, local users to perform certain
actions on a vulnerable system with escalated privileges.
Full Advisory:
http://secunia.com/advisories/16984/
Other:--
[SA16956] Avaya Products httpd/mod_ssl Vulnerabilities
Critical: Moderately critical
Where: From remote
Impact: Security Bypass, DoS
Released: 2005-09-27
Avaya has acknowledged some vulnerabilities in httpd/mod_ssl included
in some products, which can be exploited by malicious people to cause a
DoS (Denial of Service) and potentially bypass certain security
restrictions.
Full Advisory:
http://secunia.com/advisories/16956/
--
[SA16922] Sony PSP Photo Viewer TIFF File Handling Buffer Overflow
Critical: Moderately critical
Where: From remote
Impact: System access
Released: 2005-09-26
A vulnerability has been reported in Sony PSP, which potentially can be
exploited by malicious people to compromise a user's system.
Full Advisory:
http://secunia.com/advisories/16922/
--
[SA16952] Anycom Blue Stereo Headset BSH-100 Pairing Mode
Vulnerability
Critical: Less critical
Where: From remote
Impact: Manipulation of data, Exposure of sensitive information,
DoS
Released: 2005-09-26
KF has reported a vulnerability in Anycom Blue Stereo Headset BSH-100,
which can be exploited by malicious people to cause a DoS (Denial of
Service), disclose sensitive information, and manipulate certain data.
Full Advisory:
http://secunia.com/advisories/16952/
--
[SA16931] Plantronics M2500 Bluetooth Headset Pairing Mode
Vulnerability
Critical: Less critical
Where: From remote
Impact: Manipulation of data, Exposure of sensitive information
Released: 2005-09-26
KF has reported a vulnerability in Plantronics M2500 Bluetooth Headset,
which can be exploited by malicious people to disclose sensitive
information and manipulate certain data.
Full Advisory:
http://secunia.com/advisories/16931/
Cross Platform:--
[SA16944] Netscape Multiple Vulnerabilities
Critical: Highly critical
Where: From remote
Impact: Security Bypass, Spoofing, Manipulation of data, System
access
Released: 2005-09-26
Some vulnerabilities have been discovered in Netscape, which can be
exploited by malicious people to manipulate certain data, conduct
spoofing attacks, bypass certain security restrictions and potentially
compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/16944/
--
[SA16941] AlstraSoft E-Friends "mode" File Inclusion Vulnerability
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2005-09-26
Kurdish Hackers Clan has reported a vulnerability in AlstraSoft
E-Friends, which can be exploited by malicious people to compromise a
vulnerable system.
Full Advisory:
http://secunia.com/advisories/16941/
--
[SA16933] phpMyFAQ Multiple Vulnerabilities
Critical: Highly critical
Where: From remote
Impact: Cross Site Scripting, Manipulation of data, Exposure of
system information, Exposure of sensitive information, System access
Released: 2005-09-26
rgod has discovered some vulnerabilities in phpMyFAQ, which can be
exploited by malicious people to conduct cross-site scripting and SQL
injection attacks, disclose system and sensitive information, and
compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/16933/
--
[SA16917] Mozilla Multiple Vulnerabilities
Critical: Highly critical
Where: From remote
Impact: Security Bypass, Spoofing, Manipulation of data, System
access
Released: 2005-09-23
Multiple vulnerabilities have been reported in Mozilla Suite, which can
be exploited by malicious people to conduct spoofing attacks, manipulate
certain data, bypass certain security restrictions, and compromise a
user's system.
Full Advisory:
http://secunia.com/advisories/16917/
--
[SA16911] Firefox Multiple Vulnerabilities
Critical: Highly critical
Where: From remote
Impact: Security Bypass, Spoofing, Manipulation of data, System
access
Released: 2005-09-23
Multiple vulnerabilities have been reported in Firefox, which can be
exploited by malicious people to conduct spoofing attacks, manipulate
certain data, bypass certain security restrictions, and compromise a
user's system.
Full Advisory:
http://secunia.com/advisories/16911/
--
[SA16979] PostNuke Local File Inclusion and Comment Bypass
Vulnerabilities
Critical: Moderately critical
Where: From remote
Impact: Security Bypass, Exposure of sensitive information
Released: 2005-09-28
Two vulnerabilities have been reported in PostNuke, which can be
exploited by malicious people to bypass certain security restrictions
and disclose sensitive information.
Full Advisory:
http://secunia.com/advisories/16979/
--
[SA16949] SEO-Board admin.php SQL Injection Vulnerability
Critical: Moderately critical
Where: From remote
Impact: Security Bypass, Manipulation of data
Released: 2005-09-26
foster RST/GHC has reported a vulnerability in SEO-Board, which can be
exploited by malicious people to conduct SQL injection attacks.
Full Advisory:
http://secunia.com/advisories/16949/
--
[SA16937] Mailgust "email" SQL Injection Vulnerability
Critical: Moderately critical
Where: From remote
Impact: Security Bypass, Manipulation of data
Released: 2005-09-26
rgod has reported a vulnerability in Mailgust, which can be exploited
by malicious people to conduct SQL injection attacks.
Full Advisory:
http://secunia.com/advisories/16937/
--
[SA16929] ContentServ "ctsWebsite" Local File Inclusion Vulnerability
Critical: Moderately critical
Where: From remote
Impact: Exposure of sensitive information
Released: 2005-09-26
qobaiashi has reported a vulnerability in ContentServ, which can be
exploited by malicious people to disclose sensitive information.
Full Advisory:
http://secunia.com/advisories/16929/
--
[SA16926] MultiTheftAuto Server "motd.txt" Modification and Denial of
Service
Critical: Moderately critical
Where: From remote
Impact: Manipulation of data, DoS
Released: 2005-09-26
Luigi Auriemma has reported two vulnerabilities in MultiTheftAuto
Server, which can be exploited by malicious people to modify certain
information or cause a DoS (Denial of Service).
Full Advisory:
http://secunia.com/advisories/16926/
--
[SA16913] My Little Forum "search" SQL Injection Vulnerability
Critical: Moderately critical
Where: From remote
Impact: Manipulation of data
Released: 2005-09-23
rgod has discovered a vulnerability in My Little Forum, which can be
exploited by malicious people to conduct SQL injection attacks.
Full Advisory:
http://secunia.com/advisories/16913/
--
[SA16908] PunBB Two Vulnerabilities
Critical: Moderately critical
Where: From remote
Impact: Unknown, Cross Site Scripting
Released: 2005-09-22
Two vulnerabilities have been reported in PunBB, where one has an
unknown impact and the other can be exploited by malicious people to
conduct cross-site scripting attacks.
Full Advisory:
http://secunia.com/advisories/16908/
--
[SA16947] RSyslog Syslog Message SQL Injection Vulnerability
Critical: Moderately critical
Where: From local network
Impact: Manipulation of data, System access
Released: 2005-09-26
A vulnerability has been reported in RSyslog, which can be exploited by
malicious people to conduct SQL injection attacks, and potentially to
compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/16947/
--
[SA16970] CJ LinkOut "123" Cross-Site Scripting Vulnerability
Critical: Less critical
Where: From remote
Impact: Cross Site Scripting
Released: 2005-09-27
Psymera has discovered a vulnerability in CJ LinkOut, which can be
exploited by malicious people to conduct cross-site scripting attacks.
Full Advisory:
http://secunia.com/advisories/16970/
--
[SA16966] CJ Tag Board Cross-Site Scripting Vulnerabilities
Critical: Less critical
Where: From remote
Impact: Cross Site Scripting
Released: 2005-09-27
Psymera has discovered some vulnerabilities in CJ Tag Board, which can
be exploited by malicious people to conduct cross-site scripting
attacks.
Full Advisory:
http://secunia.com/advisories/16966/
--
[SA16963] CJ Web2Mail Cross-Site Scripting Vulnerabilities
Critical: Less critical
Where: From remote
Impact: Cross Site Scripting
Released: 2005-09-27
Psymera has discovered some vulnerabilities in CJ Web2Mail, which can
be exploited by malicious people to conduct cross-site scripting
attacks.
Full Advisory:
http://secunia.com/advisories/16963/
--
[SA16934] IPB Riverdark RSS Syndicator Module Cross-Site Scripting
Critical: Less critical
Where: From remote
Impact: Cross Site Scripting
Released: 2005-09-26
X1NG has reported two vulnerabilities in the Riverdark RSS Syndicator
module for Invision Power Board, which can be exploited by malicious
people to conduct cross-site scripting attacks.
Full Advisory:
http://secunia.com/advisories/16934/
--
[SA16971] PHP Trailing Slash "open_basedir" Security Bypass
Critical: Not critical
Where: Local system
Impact: Security Bypass
Released: 2005-09-27
thorben has discovered a security issue in PHP, which can be exploited
by malicious, local users to access certain files outside the
"open_basedir" root.
Full Advisory:
http://secunia.com/advisories/16971/
========================================================================
Secunia recommends that you verify all advisories you receive,
by clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only use
those supplied by the vendor.
Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/
Subscribe:
http://secunia.com/secunia_weekly_summary/
Contact details:
Web : http://secunia.com/
E-mail : support@private
Tel : +45 70 20 51 44
Fax : +45 70 20 51 45
_________________________________________
InfoSec News v2.0 - Coming Soon!
http://www.infosecnews.org
This archive was generated by hypermail 2.1.3 : Mon Oct 03 2005 - 06:08:02 PDT