========================================================================
The Secunia Weekly Advisory Summary
2007-01-11 - 2007-01-18
This week: 73 advisories
========================================================================
Table of Contents:
1.....................................................Word From Secunia
2....................................................This Week In Brief
3...............................This Weeks Top Ten Most Read Advisories
4.......................................Vulnerabilities Summary Listing
5.......................................Vulnerabilities Content Listing
========================================================================
1) Word From Secunia:
The Secunia Software Inspector is a free service that detects insecure
versions of software that you may have installed in your system. When
insecure versions are detected, the Secunia Software Inspector also
provides thorough guidelines for updating the software to the latest
secure version from the vendor.
Be sure to check your own system:
http://secunia.com/software_inspector/
Feature Overview - The Secunia Software Inspector:
* Detects insecure versions of applications installed
* Verifies that all Microsoft patches are applied
* Assists you in updating your system and applications
* Runs through your browser. No installation or download is required.
Read more in our blog:
http://secunia.com/blog/4/
http://secunia.com/blog/3/
========================================================================
2) This Week in Brief:
A vulnerability in the Sun Java Runtime Environment (JRE) has been
reported, which can be used by malicious people to gain access to a
remote system.
An error occurs when JRE processes a specially crafted GIF image with 0
width, which can be exploited to cause a heap-based buffer overflow.
Successful exploitation allows the execution of arbitrary code.
The vulnerability is reported in the following versions:
* JDK and JRE 5.0 Update 9 and prior.
* SDK and JRE 1.4.2_12 and prior.
* SDK and JRE 1.3.1_18 and prior.
Vendor patches are now available.
You can check if your JRE version is up-to-date by using the Secunia
Software Inspector:
http://secunia.com/software_inspector/
For more information, refer to the following Secunia advisory:
http://secunia.com/advisories/23757/
--
A number of vulnerabilities were reported in various Oracle products,
including some that may facilitate cross-site scripting, SQL injection,
or denial of service (DoS) attacks, exposure of sensitive information,
or allow system access from a remote location.
The vulnerabilities are reported in the following products:
* Oracle Application Server 10g
* Oracle Database 10g
* Oracle Developer Suite 10g
* Oracle E-Business Suite 11i
* Oracle Enterprise Manager 10.x
* Oracle PeopleSoft Enterprise Tools 8.x
* Oracle9i Application Server
* Oracle9i Database Enterprise Edition
* Oracle9i Database Standard Edition
* Oracle9i Developer Suite
Patches are available for these vulnerabilities.
For more information, refer to the following Secunia advisory:
http://secunia.com/advisories/23794/
--
VIRUS ALERTS:
During the past week Secunia collected 241 virus descriptions from the
Antivirus vendors. However, none were deemed MEDIUM risk or higher
according to the Secunia assessment scale.
========================================================================
3) This Weeks Top Ten Most Read Advisories:
1. [SA23677] Microsoft Windows Vector Markup Language Vulnerabilities
2. [SA23666] Adobe Reader Unspecified Heap Corruption Vulnerability
3. [SA23703] Apple Mac OS X UFS ffs_mountfs() Integer Overflow
4. [SA23757] Sun Java JRE GIF Image Processing Buffer Overflow
Vulnerability
5. [SA23716] Snort Rule Matching Backtrack Denial of Service
Vulnerability
6. [SA18787] Internet Explorer Drag-and-Drop Vulnerability
7. [SA22477] Internet Explorer 7 "mhtml:" Redirection Information
Disclosure
8. [SA23686] Red Hat update for libgsf
9. [SA23765] IBM OS/400 Connection Reset Denial of Service
Vulnerability
10. [SA23483] Adobe Reader / Acrobat Multiple Vulnerabilities
========================================================================
4) Vulnerabilities Summary Listing
Windows:
[SA23794] Oracle Products Multiple Vulnerabilities
[SA23760] LunarPoll "PollDir" File Inclusion Vulnerability
[SA23731] Dream FTP Server Data Handling Buffer Overflow Vulnerability
[SA23759] Ezboxx Portal Multiple Vulnerabilities
[SA23756] MiNT Haber Sistemi "id" SQL Injection Vulnerability
[SA23755] Okul Web Otomasyon Sistemi "id" SQL Injection Vulnerability
[SA23744] DigiAffiliate "id" SQL Injection Vulnerability
[SA23787] InstantForum.NET Members1.aspx and Logon.aspx Cross-Site
Scripting
[SA23774] Fritz!DSL Software AR7 Web Server Directory Traversal
[SA23775] Remedy Action Request System User Enumeration Weakness
UNIX/Linux:
[SA23811] Fedora update squirrelmail
[SA23792] Fedora update for w3m
[SA23785] IPCop update for various packages
[SA23773] Gentoo update for w3m
[SA23772] Ubuntu update for krb5
[SA23771] Gentoo update for opera
[SA23762] Gentoo update for openoffice
[SA23739] SUSE update for opera
[SA23723] Mandriva update for mozilla-thunderbird
[SA23797] Gentoo update for oftpd
[SA23790] oftpd LPSV and LPRT Denial of Service Vulnerability
[SA23788] Red Hat update for kernel
[SA23783] rPath update for gd
[SA23780] Gentoo update for kronolith
[SA23779] Gentoo update for mono
[SA23776] Fedora Core 5 update for mono
[SA23752] Mandriva update for kernel
[SA23727] Fedora Core 6 update for mono
[SA23798] Mandriva update for BlueZ
[SA23781] Mandriva update for fetchmail
[SA23770] Debian update for libsoup
[SA23767] Squid Denial of Service Vulnerabilities
[SA23765] IBM OS/400 Connection Reset Denial of Service Vulnerability
[SA23763] Mandriva update for libneon
[SA23751] neon "ne_uri_parse()" Denial of Service
[SA23747] BlueZ HID Insecure Device Connection Vulnerability
[SA23738] Quick.Cart "p" Cross-Site Scripting Vulnerability
[SA23734] libsoup "soup_headers_parse()" Denial of Service
[SA23733] Fastilo "p" Cross-Site Scripting Vulnerability
[SA23804] Fedora update for fetchmail
[SA23782] Fedora update for Avahi
[SA23789] Debian update for xfree86
[SA23777] Ubuntu update for libgtop2
[SA23758] SUSE update for XFree86 and Xorg
[SA23736] libgtop2 "glibtop_get_proc_map_s()" Buffer Overflow
[SA23730] FreeBSD jail rc.d Security Bypass Vulnerability
[SA23801] Colloquy "INVITE" Denial of Service Weakness
[SA23799] KDE and KOffice PDF Invalid Tree Node Denial of Service
Weakness
[SA23742] Mac OS X HFS+ "do_hfs_truncate()" Denial of Service
[SA23728] Gentoo update for kdegraphics-kfile-plugins
[SA23725] Apple Mac OS X UFS Denial of Service Vulnerabilities
[SA23721] FreeBSD UFS "ufs_dirbad()" Local Denial of Service
Other:
[SA23737] Ingate Firewall and SIParator Replay Attack Vulnerability
Cross Platform:
[SA23761] Poplar Gedcom Viewer "env[rootPath]" File Inclusion
Vulnerability
[SA23757] Sun Java JRE GIF Image Processing Buffer Overflow
Vulnerability
[SA23746] sNews Authentication Bypass Vulnerability
[SA23743] FdWeB Espace Membre "path" File Inclusion Vulnerability
[SA23722] TLM CMS "chemin" File Inclusion Vulnerability
[SA23784] Jax Petition Book "language" Local File Inclusion
[SA23766] SmE FileMailer "ps" SQL Injection Vulnerability
[SA23750] BEA WebLogic Multiple Vulnerabilities and Security Issues
[SA23749] GOsa Unspecified Manipulation of Data
[SA23748] PHP-Nuke "cat" Old Articles Block SQL Injection
[SA23741] Gentoo update for wordpress
[SA23740] All In One Control Panel (AIOCP) SQL Injection
Vulnerabilities
[SA23735] ThWboard "board[styleid]" SQL Injection Vulnerability
[SA23726] All In One Control Panel "download_category" SQL Injection
[SA23724] JV2 Folder Gallery "file" Information Disclosure
[SA23729] HP OpenView Network Node Manager Two Vulnerabilities
[SA23778] dt_guestbook "error[]" Cross-Site Scripting Vulnerability
[SA23764] Indexu Multiple Cross-Site Scripting Vulnerabilities
[SA23732] All In One Control Panel (AIOCP) Unspecified Cross-Site
Scripting
[SA23786] BEA AquaLogic Weakness and Multiple Vulnerabilities
========================================================================
5) Vulnerabilities Content Listing
Windows:--
[SA23794] Oracle Products Multiple Vulnerabilities
Critical: Highly critical
Where: From remote
Impact: Unknown, Cross Site Scripting, Manipulation of data,
Exposure of sensitive information, DoS, System access
Released: 2007-01-17
Multiple vulnerabilities have been reported in various Oracle products.
Some of these vulnerabilities have unknown impacts while others can be
exploited to gain access to sensitive information, cause a DoS (Denial
of Service), conduct cross-site scripting and SQL injection attacks,
and potentially compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/23794/
--
[SA23760] LunarPoll "PollDir" File Inclusion Vulnerability
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2007-01-15
ilker Kandemir has discovered a vulnerability in LunarPoll, which can
be exploited by malicious people to compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/23760/
--
[SA23731] Dream FTP Server Data Handling Buffer Overflow Vulnerability
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2007-01-15
Marsu has discovered a vulnerability in Dream FTP Server, which can be
exploited by malicious people to compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/23731/
--
[SA23759] Ezboxx Portal Multiple Vulnerabilities
Critical: Moderately critical
Where: From remote
Impact: Cross Site Scripting, Manipulation of data, Exposure of
system information
Released: 2007-01-16
Doron P and Eyal G have reported some vulnerabilities in Ezboxx Portal
System, which can be exploited by malicious users to conduct cross-site
scripting attacks and by malicious people to conduct cross-site
scripting attacks and conduct SQL-injection attacks.
Full Advisory:
http://secunia.com/advisories/23759/
--
[SA23756] MiNT Haber Sistemi "id" SQL Injection Vulnerability
Critical: Moderately critical
Where: From remote
Impact: Manipulation of data
Released: 2007-01-16
chernobiLe has reported a vulnerability in MiNT Haber Sistemi, which
can be exploited by malicious people to conduct SQL injection attacks.
Full Advisory:
http://secunia.com/advisories/23756/
--
[SA23755] Okul Web Otomasyon Sistemi "id" SQL Injection Vulnerability
Critical: Moderately critical
Where: From remote
Impact: Manipulation of data
Released: 2007-01-16
ilker Kandemir has reported a vulnerability in Okul Web Otomasyon
Sistemi, which can be exploited by malicious people to conduct SQL
injection attacks.
Full Advisory:
http://secunia.com/advisories/23755/
--
[SA23744] DigiAffiliate "id" SQL Injection Vulnerability
Critical: Moderately critical
Where: From remote
Impact: Manipulation of data
Released: 2007-01-15
ajann has reported a vulnerability in DigiAffiliate, which can be
exploited by malicious people to conduct SQL Injection Attacks.
Full Advisory:
http://secunia.com/advisories/23744/
--
[SA23787] InstantForum.NET Members1.aspx and Logon.aspx Cross-Site
Scripting
Critical: Less critical
Where: From remote
Impact: Cross Site Scripting
Released: 2007-01-17
Doz has reported some vulnerabilities in InstantForum.NET, which can be
exploited by malicious people to conduct cross-site scripting attacks.
Full Advisory:
http://secunia.com/advisories/23787/
--
[SA23774] Fritz!DSL Software AR7 Web Server Directory Traversal
Critical: Less critical
Where: From local network
Impact: Exposure of system information, Exposure of sensitive
information
Released: 2007-01-18
DPR has discovered a vulnerability in Fritz!DSL Software, which can be
exploited by malicious people to disclose sensitive information.
Full Advisory:
http://secunia.com/advisories/23774/
--
[SA23775] Remedy Action Request System User Enumeration Weakness
Critical: Not critical
Where: From remote
Impact: Exposure of sensitive information
Released: 2007-01-16
Davide Del Vecchio has reported a weakness in Remedy Action Request
System, which can be exploited by malicious people to identify valid
user accounts.
Full Advisory:
http://secunia.com/advisories/23775/
UNIX/Linux:--
[SA23811] Fedora update squirrelmail
Critical: Highly critical
Where: From remote
Impact: Cross Site Scripting
Released: 2007-01-18
Fedora has issued an update for squirrelmail. This fixes some
vulnerabilities, which can be exploited by malicious people to conduct
cross-site scripting and script insertion attacks.
Full Advisory:
http://secunia.com/advisories/23811/
--
[SA23792] Fedora update for w3m
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2007-01-16
Fedora has issued an update for w3m. This fixes a vulnerability, which
can be exploited by malicious people to compromise a user's system.
Full Advisory:
http://secunia.com/advisories/23792/
--
[SA23785] IPCop update for various packages
Critical: Highly critical
Where: From remote
Impact: Security Bypass, Manipulation of data, DoS, System access
Released: 2007-01-16
An updated version of IPCop has been released, which fixes some
vulnerabilities in various packages. The vulnerabilities can be
exploited by malicious people to bypass certain security restrictions,
overwrite arbitrary files, cause a DoS (Denial of Service), or
compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/23785/
--
[SA23773] Gentoo update for w3m
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2007-01-15
Gentoo has issued an update for w3m. This fixes a vulnerability, which
can be exploited by malicious people to compromise a user's system.
Full Advisory:
http://secunia.com/advisories/23773/
--
[SA23772] Ubuntu update for krb5
Critical: Highly critical
Where: From remote
Impact: DoS, System access
Released: 2007-01-16
Ubuntu has issued an update for krb5. This fixes a vulnerability, which
can potentially be exploited by malicious people to cause a DoS (Denial
of Service) or compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/23772/
--
[SA23771] Gentoo update for opera
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2007-01-15
Gentoo has issued an update for opera. This fixes two vulnerabilities,
which can be exploited by malicious people to compromise a user's
system.
Full Advisory:
http://secunia.com/advisories/23771/
--
[SA23762] Gentoo update for openoffice
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2007-01-15
Gentoo has issued an update for openoffice. This fixes some
vulnerabilities, which can be exploited by malicious people to
compromise a user's system.
Full Advisory:
http://secunia.com/advisories/23762/
--
[SA23739] SUSE update for opera
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2007-01-15
SUSE has issued an update for opera. This fixes some vulnerabilities,
which can be exploited by malicious people to compromise a user's
system.
Full Advisory:
http://secunia.com/advisories/23739/
--
[SA23723] Mandriva update for mozilla-thunderbird
Critical: Highly critical
Where: From remote
Impact: Cross Site Scripting, DoS, System access
Released: 2007-01-12
Mandriva has issued an update for mozilla-thunderbird. This fixes some
vulnerabilities, which can be exploited by malicious people to conduct
cross-site scripting attacks and potentially compromise a user's
system.
Full Advisory:
http://secunia.com/advisories/23723/
--
[SA23797] Gentoo update for oftpd
Critical: Moderately critical
Where: From remote
Impact: DoS
Released: 2007-01-16
Gentoo has issued an update for oftpd. This fixes a vulnerability,
which can be exploited by malicious people to cause a DoS (Denial of
Service).
Full Advisory:
http://secunia.com/advisories/23797/
--
[SA23790] oftpd LPSV and LPRT Denial of Service Vulnerability
Critical: Moderately critical
Where: From remote
Impact: DoS
Released: 2007-01-16
Tavis Ormandy has reported a vulnerability in oftpd, which can be
exploited by malicious people to cause a DoS (Denial of Service).
Full Advisory:
http://secunia.com/advisories/23790/
--
[SA23788] Red Hat update for kernel
Critical: Moderately critical
Where: From remote
Impact: DoS
Released: 2007-01-17
Red Hat has issued an update for the kernel. This fixes a
vulnerability, which can be exploited by malicious people to cause a
DoS (Denial of Service).
Full Advisory:
http://secunia.com/advisories/23788/
--
[SA23783] rPath update for gd
Critical: Moderately critical
Where: From remote
Impact: DoS, System access
Released: 2007-01-16
rPath has issued an update for gd. This fixes some vulnerabilities,
which can be exploited by malicious people to cause a DoS (Denial of
Service) or potentially compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/23783/
--
[SA23780] Gentoo update for kronolith
Critical: Moderately critical
Where: From remote
Impact: Exposure of sensitive information
Released: 2007-01-17
Gentoo has issued an update for kronolith. This fixes a vulnerability,
which can be exploited by malicious users to disclose sensitive
information.
Full Advisory:
http://secunia.com/advisories/23780/
--
[SA23779] Gentoo update for mono
Critical: Moderately critical
Where: From remote
Impact: Exposure of sensitive information
Released: 2007-01-17
Gentoo has issued an update for mono. This fixes a vulnerability, which
can be exploited by malicious people to disclose potentially sensitive
information.
Full Advisory:
http://secunia.com/advisories/23779/
--
[SA23776] Fedora Core 5 update for mono
Critical: Moderately critical
Where: From remote
Impact: Exposure of sensitive information, Privilege escalation
Released: 2007-01-15
Fedora has issued an update for mono. This fixes some vulnerabilities,
which can be exploited by malicious, local users to perform certain
actions with escalated privileges, and by malicious people to disclose
potentially sensitive information.
Full Advisory:
http://secunia.com/advisories/23776/
--
[SA23752] Mandriva update for kernel
Critical: Moderately critical
Where: From remote
Impact: Exposure of sensitive information, Privilege escalation,
DoS
Released: 2007-01-15
Mandriva has issued an update for the kernel. This fixes some
vulnerabilities, which have unknown impact or can be exploited by
malicious, local users to gain knowledge of potentially sensitive
information, cause a DoS (Denial of Service), or gain escalated
privileges, and by malicious people to cause a DoS.
Full Advisory:
http://secunia.com/advisories/23752/
--
[SA23727] Fedora Core 6 update for mono
Critical: Moderately critical
Where: From remote
Impact: Exposure of sensitive information
Released: 2007-01-15
Fedora has issued an update for mono. This fixes a vulnerability, which
can be exploited by malicious people to disclose potentially sensitive
information.
Full Advisory:
http://secunia.com/advisories/23727/
--
[SA23798] Mandriva update for BlueZ
Critical: Less critical
Where: From remote
Impact: System access
Released: 2007-01-16
Mandriva has issued an update for BlueZ. This fixes a vulnerability,
which can be exploited by malicious people to compromise a vulnerable
system.
Full Advisory:
http://secunia.com/advisories/23798/
--
[SA23781] Mandriva update for fetchmail
Critical: Less critical
Where: From remote
Impact: Exposure of sensitive information
Released: 2007-01-16
Mandriva has issued an update for fetchmail. This fixes a security
issue, which can be exploited by malicious people to gain sensitive
information.
Full Advisory:
http://secunia.com/advisories/23781/
--
[SA23770] Debian update for libsoup
Critical: Less critical
Where: From remote
Impact: DoS
Released: 2007-01-15
Debian has issued an update for libsoup. This fixes a vulnerability,
which can be exploited by malicious people to cause a DoS (Denial of
Service).
Full Advisory:
http://secunia.com/advisories/23770/
--
[SA23767] Squid Denial of Service Vulnerabilities
Critical: Less critical
Where: From remote
Impact: DoS
Released: 2007-01-16
Two vulnerabilities have been reported in Squid, which can be exploited
by malicious people to cause a DoS (Denial of Service).
Full Advisory:
http://secunia.com/advisories/23767/
--
[SA23765] IBM OS/400 Connection Reset Denial of Service Vulnerability
Critical: Less critical
Where: From remote
Impact: DoS
Released: 2007-01-15
IBM has acknowledged a vulnerability in OS/400, which can be exploited
by malicious people to reset established TCP connections on a
vulnerable system.
Full Advisory:
http://secunia.com/advisories/23765/
--
[SA23763] Mandriva update for libneon
Critical: Less critical
Where: From remote
Impact: DoS
Released: 2007-01-15
Mandriva has issued an update for libneon. This fixes a vulnerability,
which can be exploited by malicious people to cause a DoS (Denial of
Service).
Full Advisory:
http://secunia.com/advisories/23763/
--
[SA23751] neon "ne_uri_parse()" Denial of Service
Critical: Less critical
Where: From remote
Impact: DoS
Released: 2007-01-15
A vulnerability has been reported in neon, which can be exploited by
malicious people to cause a DoS (Denial of Service).
Full Advisory:
http://secunia.com/advisories/23751/
--
[SA23747] BlueZ HID Insecure Device Connection Vulnerability
Critical: Less critical
Where: From remote
Impact: System access
Released: 2007-01-16
Collin Mulliner has reported a vulnerability in BlueZ, which can be
exploited by malicious people to compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/23747/
--
[SA23738] Quick.Cart "p" Cross-Site Scripting Vulnerability
Critical: Less critical
Where: From remote
Impact: Cross Site Scripting
Released: 2007-01-12
David Sopas has discovered a vulnerability in Quick.Cart, which can be
exploited by malicious people to conduct cross-site scripting attacks.
Full Advisory:
http://secunia.com/advisories/23738/
--
[SA23734] libsoup "soup_headers_parse()" Denial of Service
Critical: Less critical
Where: From remote
Impact: DoS
Released: 2007-01-15
Roland Lezuo and Josselin Mouette have reported a vulnerability in
libsoup, which can be exploited by malicious people to cause a DoS
(Denial of Service).
Full Advisory:
http://secunia.com/advisories/23734/
--
[SA23733] Fastilo "p" Cross-Site Scripting Vulnerability
Critical: Less critical
Where: From remote
Impact: Cross Site Scripting
Released: 2007-01-12
David Sopas has discovered a vulnerability in Fastilo, which can be
exploited by malicious people to conduct cross-site scripting attacks.
Full Advisory:
http://secunia.com/advisories/23733/
--
[SA23804] Fedora update for fetchmail
Critical: Less critical
Where: From local network
Impact: Exposure of sensitive information, DoS
Released: 2007-01-17
Fedora has issued an update for fetchmail. This fixes a vulnerability
and a security issue, which can be exploited by malicious, local users
to cause a DoS (Denial of Service) and malicious people to gain
knowledge of sensitive information.
Full Advisory:
http://secunia.com/advisories/23804/
--
[SA23782] Fedora update for Avahi
Critical: Less critical
Where: From local network
Impact: DoS
Released: 2007-01-16
Fedora has issued an update for Avahi. This fixes a vulnerability,
which can be exploited by malicious people to cause a DoS (Denial of
Service).
Full Advisory:
http://secunia.com/advisories/23782/
--
[SA23789] Debian update for xfree86
Critical: Less critical
Where: Local system
Impact: Privilege escalation
Released: 2007-01-16
Debian has issued an update for xfree86. This fixes some
vulnerabilities, which can be exploited by malicious, local users to
gain escalated privileges.
Full Advisory:
http://secunia.com/advisories/23789/
--
[SA23777] Ubuntu update for libgtop2
Critical: Less critical
Where: Local system
Impact: Privilege escalation
Released: 2007-01-15
Ubuntu has issued an update for libgtop2. This fixes a vulnerability,
which can be exploited by malicious, local users to gain escalated
privileges.
Full Advisory:
http://secunia.com/advisories/23777/
--
[SA23758] SUSE update for XFree86 and Xorg
Critical: Less critical
Where: Local system
Impact: Privilege escalation
Released: 2007-01-15
SUSE has issued an update for XFree86 and Xorg. This fixes some
vulnerabilities, which can be exploited by malicious, local users to
gain escalated privileges.
Full Advisory:
http://secunia.com/advisories/23758/
--
[SA23736] libgtop2 "glibtop_get_proc_map_s()" Buffer Overflow
Critical: Less critical
Where: Local system
Impact: Privilege escalation
Released: 2007-01-15
Liu Qishuai has reported a vulnerability in libgtop2, which can be
exploited by malicious, local users to gain escalated privileges.
Full Advisory:
http://secunia.com/advisories/23736/
--
[SA23730] FreeBSD jail rc.d Security Bypass Vulnerability
Critical: Less critical
Where: Local system
Impact: Security Bypass
Released: 2007-01-12
A vulnerability has been reported in FreeBSD, which can be exploited by
malicious, local users to bypass certain security restrictions.
Full Advisory:
http://secunia.com/advisories/23730/
--
[SA23801] Colloquy "INVITE" Denial of Service Weakness
Critical: Not critical
Where: From remote
Impact: DoS
Released: 2007-01-18
KF and LMH have reported a weakness in Colloquy, which can be exploited
by malicious people to cause a DoS (Denial of Service).
Full Advisory:
http://secunia.com/advisories/23801/
--
[SA23799] KDE and KOffice PDF Invalid Tree Node Denial of Service
Weakness
Critical: Not critical
Where: From remote
Impact: DoS
Released: 2007-01-17
A weakness has been reported in KDE and KOffice, which can be exploited
by malicious people to cause a DoS (Denial of Service).
Full Advisory:
http://secunia.com/advisories/23799/
--
[SA23742] Mac OS X HFS+ "do_hfs_truncate()" Denial of Service
Critical: Not critical
Where: From remote
Impact: DoS
Released: 2007-01-15
LMH has reported a vulnerability in Mac OS X, which can be exploited by
malicious people to cause a DoS (Denial of Service).
Full Advisory:
http://secunia.com/advisories/23742/
--
[SA23728] Gentoo update for kdegraphics-kfile-plugins
Critical: Not critical
Where: From remote
Impact: DoS
Released: 2007-01-15
Gentoo has issued an update for kdegraphics-kfile-plugins. This fixes a
weakness, which can be exploited by malicious people to cause a DoS
(Denial of Service).
Full Advisory:
http://secunia.com/advisories/23728/
--
[SA23725] Apple Mac OS X UFS Denial of Service Vulnerabilities
Critical: Not critical
Where: From remote
Impact: DoS
Released: 2007-01-12
LMH has reported some vulnerabilities in Apple Mac OS X, which can be
exploited by malicious people to cause a DoS (Denial of Service).
Full Advisory:
http://secunia.com/advisories/23725/
--
[SA23721] FreeBSD UFS "ufs_dirbad()" Local Denial of Service
Critical: Not critical
Where: Local system
Impact: DoS
Released: 2007-01-16
LMH has reported a vulnerability in FreeBSD, which can be exploited by
malicious, local users to cause a DoS (Denial of Service).
Full Advisory:
http://secunia.com/advisories/23721/
Other:--
[SA23737] Ingate Firewall and SIParator Replay Attack Vulnerability
Critical: Less critical
Where: From remote
Impact: Security Bypass
Released: 2007-01-16
A vulnerability has been reported in Ingate Firewall and SIParator,
which can be exploited by malicious people to bypass certain security
restrictions.
Full Advisory:
http://secunia.com/advisories/23737/
Cross Platform:--
[SA23761] Poplar Gedcom Viewer "env[rootPath]" File Inclusion
Vulnerability
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2007-01-15
Mahmood_ali has discovered a vulnerability in Poplar Gedcom Viewer,
which can be exploited by malicious people to compromise a vulnerable
system.
Full Advisory:
http://secunia.com/advisories/23761/
--
[SA23757] Sun Java JRE GIF Image Processing Buffer Overflow
Vulnerability
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2007-01-17
A vulnerability has been reported in Sun Java Runtime Environment
(JRE), which can be exploited by malicious people to compromise a
vulnerable system.
Full Advisory:
http://secunia.com/advisories/23757/
--
[SA23746] sNews Authentication Bypass Vulnerability
Critical: Highly critical
Where: From remote
Impact: Security Bypass
Released: 2007-01-15
rgod has discovered a vulnerability in sNews, which can be exploited by
malicious people to bypass certain security restrictions.
Full Advisory:
http://secunia.com/advisories/23746/
--
[SA23743] FdWeB Espace Membre "path" File Inclusion Vulnerability
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2007-01-16
ajann has discovered a vulnerability in FdWeb Espace Membre, which can
be exploited by malicious people to compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/23743/
--
[SA23722] TLM CMS "chemin" File Inclusion Vulnerability
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2007-01-15
Mahmood_ali has discovered a vulnerability in TLM CMS, which can be
exploited by malicious people to compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/23722/
--
[SA23784] Jax Petition Book "language" Local File Inclusion
Critical: Moderately critical
Where: From remote
Impact: Exposure of system information, Exposure of sensitive
information
Released: 2007-01-17
ilker Kandemir has discovered two vulnerabilities in Jax Petition Book,
which can be exploited by malicious people to disclose sensitive
information.
Full Advisory:
http://secunia.com/advisories/23784/
--
[SA23766] SmE FileMailer "ps" SQL Injection Vulnerability
Critical: Moderately critical
Where: From remote
Impact: Manipulation of data
Released: 2007-01-17
CorryL has discovered a vulnerability in SmE FileMailer, which can be
exploited by malicious people to conduct SQL injection attacks.
Full Advisory:
http://secunia.com/advisories/23766/
--
[SA23750] BEA WebLogic Multiple Vulnerabilities and Security Issues
Critical: Moderately critical
Where: From remote
Impact: Security Bypass, Spoofing, Exposure of sensitive
information, DoS, System access
Released: 2007-01-17
Multiple vulnerabilities and security issues have been reported in BEA
Weblogic, which can be exploited by malicious people or malicious users
to gain knowledge of sensitive information, bypass certain security
restrictions, conduct spoofing attacks, cause a DoS (Denial Of
Service), or potentially compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/23750/
--
[SA23749] GOsa Unspecified Manipulation of Data
Critical: Moderately critical
Where: From remote
Impact: Manipulation of data
Released: 2007-01-16
A vulnerability has been reported in GOsa, which can be exploited by
malicious users to manipulate certain data.
Full Advisory:
http://secunia.com/advisories/23749/
--
[SA23748] PHP-Nuke "cat" Old Articles Block SQL Injection
Critical: Moderately critical
Where: From remote
Impact: Manipulation of data, Exposure of sensitive information
Released: 2007-01-17
Paisterist has discovered a vulnerability in PHP-Nuke, which can be
exploited by malicious people to conduct SQL injection attacks.
Full Advisory:
http://secunia.com/advisories/23748/
--
[SA23741] Gentoo update for wordpress
Critical: Moderately critical
Where: From remote
Impact: Cross Site Scripting, Manipulation of data, Exposure of
system information
Released: 2007-01-16
Gentoo has issued an update for wordpress. This fixes some
vulnerabilities and a weakness, which can be exploited by malicious
people to identify valid user accounts and to conduct cross-site
scripting, script insertion, and SQL injection attacks.
Full Advisory:
http://secunia.com/advisories/23741/
--
[SA23740] All In One Control Panel (AIOCP) SQL Injection
Vulnerabilities
Critical: Moderately critical
Where: From remote
Impact: Manipulation of data
Released: 2007-01-15
Coloss has discovered some vulnerabilities in All In One Control Panel
(AIOCP), which can be exploited by malicious people to conduct SQL
injection attacks.
Full Advisory:
http://secunia.com/advisories/23740/
--
[SA23735] ThWboard "board[styleid]" SQL Injection Vulnerability
Critical: Moderately critical
Where: From remote
Impact: Manipulation of data
Released: 2007-01-17
rgod has reported a vulnerability in ThWboard, which can be exploited
by malicious people to conduct SQL injection attacks.
Full Advisory:
http://secunia.com/advisories/23735/
--
[SA23726] All In One Control Panel "download_category" SQL Injection
Critical: Moderately critical
Where: From remote
Impact: Manipulation of data
Released: 2007-01-12
A vulnerability has been reported in All In One Control Panel (AIOCP),
which can be exploited by malicious people to conduct SQL injection
attacks.
Full Advisory:
http://secunia.com/advisories/23726/
--
[SA23724] JV2 Folder Gallery "file" Information Disclosure
Critical: Moderately critical
Where: From remote
Impact: Exposure of sensitive information
Released: 2007-01-15
SaO has reported a vulnerability in JV2 Folder Gallery, which can be
exploited by malicious people to disclose sensitive information.
Full Advisory:
http://secunia.com/advisories/23724/
--
[SA23729] HP OpenView Network Node Manager Two Vulnerabilities
Critical: Moderately critical
Where: From local network
Impact: Exposure of sensitive information, System access
Released: 2007-01-12
Two vulnerabilities have been reported in HP OpenView Network Node
Manager (OV NNM), which can potentially be exploited by malicious
people to bypass certain security restrictions and gain knowledge of
sensitive information, or to compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/23729/
--
[SA23778] dt_guestbook "error[]" Cross-Site Scripting Vulnerability
Critical: Less critical
Where: From remote
Impact: Cross Site Scripting
Released: 2007-01-16
Jesper Jurcenoks has reported a vulnerability in DT Guestbook, which
can be exploited by malicious people to conduct cross-site scripting
attacks.
Full Advisory:
http://secunia.com/advisories/23778/
--
[SA23764] Indexu Multiple Cross-Site Scripting Vulnerabilities
Critical: Less critical
Where: From remote
Impact: Cross Site Scripting
Released: 2007-01-17
Some vulnerabilities have been reported in Indexu, which can be
exploited by malicious people to conduct cross-site scripting attacks.
Full Advisory:
http://secunia.com/advisories/23764/
--
[SA23732] All In One Control Panel (AIOCP) Unspecified Cross-Site
Scripting
Critical: Less critical
Where: From remote
Impact: Cross Site Scripting
Released: 2007-01-15
A vulnerability has been reported in All In One Control Panel (AIOCP),
which can be exploited by malicious people to conduct cross-site
scripting attacks.
Full Advisory:
http://secunia.com/advisories/23732/
--
[SA23786] BEA AquaLogic Weakness and Multiple Vulnerabilities
Critical: Less critical
Where: From local network
Impact: Security Bypass
Released: 2007-01-17
Some vulnerabilities and a weakness have been reported in BEA
AquaLogic, which can be exploited by malicious people to bypass certain
security restrictions.
Full Advisory:
http://secunia.com/advisories/23786/
========================================================================
Secunia recommends that you verify all advisories you receive,
by clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only use
those supplied by the vendor.
Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/
Subscribe:
http://secunia.com/secunia_weekly_summary/
Contact details:
Web : http://secunia.com/
E-mail : support@private
Tel : +45 70 20 51 44
Fax : +45 70 20 51 45
_____________________________
Subscribe to InfoSec News
http://www.infosecnews.org/mailman/listinfo/isn
This archive was generated by hypermail 2.1.3 : Thu Jan 18 2007 - 22:44:53 PST