========================================================================
The Secunia Weekly Advisory Summary
2007-03-15 - 2007-03-22
This week: 66 advisories
========================================================================
Table of Contents:
1.....................................................Word From Secunia
2....................................................This Week In Brief
3...............................This Weeks Top Ten Most Read Advisories
4.......................................Vulnerabilities Summary Listing
5.......................................Vulnerabilities Content Listing
========================================================================
1) Word From Secunia:
Should you be interested in a career within Secunia, the current job
openings are available right now:
Security Sales Engineer:
http://corporate.secunia.com/about_secunia/54/
German Key Account Manager:
http://corporate.secunia.com/about_secunia/55/
International Account Manager - Enterprise Sales:
http://corporate.secunia.com/about_secunia/52/
International Sales Manager - IT Security Partner:
http://corporate.secunia.com/about_secunia/51/
Danish: Disassembling og Reversing
http://secunia.com/Disassembling_og_Reversing/
Linux Security Specialist:
http://secunia.com/Linux_Security_Specialist/
========================================================================
2) This Week in Brief:
Multiple vulnerabilities were reported in Openoffice.org, which could
lead to compromise of a vulnerable system.
Some of the vulnerabilities were originally reported in the libwpd
library used by Openoffice.org, and could be exploited by tricking an
unsuspecting user into opening a specially crafted Wordperfect
document. Successful exploitation may cause a denial of service (DoS),
or allow an attacker to execute arbitrary code on the vulnerable
system.
A vulnerability in StarCalc parser could be exploited to cause a
stack-based buffer overflow and compromise a vulnerable system.
However, for this to take place, an attack must also trick an
unsuspecting user into opening a specially crafted document using
StarCalc.
The final vulnerability is due to shell meta characters not being
properly escaped, which can be exploited to inject and execute
arbitrary shell commands. Successful exploitation also entails that
the user is tricked into opening a specially crafted document and
clicking on a malicious link.
All vulnerabilities discussed in the advisory currently remain
unpatched. Users are urged not to open untrusted documents. For more
information, refer to:
http://secunia.com/advisories/24588/
--
Secunia Research has discovered a vulnerability in Evolution, which
could cause a denial of service (DoS) or compromise a vulnerable
system.
A format string error in the "write_html()" function in
calendar/gui/e-cal-component-memo-preview.c when displaying a memo's
categories can potentially be exploited to execute arbitrary code via a
specially crafted shared memo containing format specifiers.
Successful exploitation requires that the user opens a shared memo in
their mailbox, clicks on "Accept", and views the memo under the "Memo"
tab.
This vulnerability remains unpatched, and users are advised not to open
untrusted shared memos. For more information, refer to:
http://secunia.com/advisories/24234/
--
Secunia Research has discovered a vulnerability in Interactual Player,
which could compromise a vulnerable system.
The vulnerability is caused due to a boundary error in the
IASystemInfo.dll ActiveX control when processing the "ApplicationType"
property. This can be exploited to cause a stack-based buffer overflow
via an overly long string (more than 260 bytes).
Successful exploitation allows execution of arbitrary code when, for
example, a user visits a malicious website.
This vulnerability remains unpatched, and users are advised to set the
kill-bit for the ActiveX control. For more information, refer to:
http://secunia.com/advisories/23032/
--
VIRUS ALERTS:
During the past week Secunia collected 490 virus descriptions from the
Antivirus vendors. However, none were deemed MEDIUM risk or higher
according to the Secunia assessment scale.
========================================================================
3) This Weeks Top Ten Most Read Advisories:
1. [SA14921] Microsoft Windows Message Queuing Buffer Overflow
Vulnerability
2. [SA24535] Internet Explorer 7 navcancl.htm Cross-Site Scripting
Vulnerability
3. [SA24450] Trend Micro Products UPX Processing Denial of Service
4. [SA24479] Mac OS X Security Update Fixes Multiple Vulnerabilities
5. [SA24466] McAfee ePolicy Orchestrator / ProtectionPilot ActiveX
Control Buffer Overflows
6. [SA24542] PHP Multiple Code Execution Vulnerabilities
7. [SA18787] Internet Explorer Drag-and-Drop Vulnerability
8. [SA24505] PHP Session Handling Double Free Vulnerabilities
9. [SA24600] Cisco IP Phone 7940/7960 SIP INVITE Denial of Service
Vulnerability
10. [SA24529] PHP Interbase Extension "isc_attach_database()" Buffer
Overflow
========================================================================
4) Vulnerabilities Summary Listing
Windows:
[SA24603] NewsGlue Feed Script Insertion Vulnerability
[SA24596] Mercur Messaging IMAP NTLM Authentication Buffer Overflow
Vulnerabilities
[SA24574] Active Link Engine "catid" SQL Injection Vulnerability
[SA24568] Active Photo Gallery "catid" SQL Injection Vulnerability
[SA24561] Web Wiz Forums "formatSQLInput()" SQL Injection
[SA24549] Systemwalker Desktop Encryption Self-Decoding File
Information Disclosure
[SA24543] Absolute Image Gallery XE "categoryid" SQL Injection
[SA24612] NETxEIB OPC Server Improper Handle Validation
[SA24570] Takebishi DeviceXPlorer OPC Server Improper Handle
Validation
[SA24598] Microsoft Windows NDISTAPI.SYS Denial of Service
UNIX/Linux:
[SA24613] Debian update for openoffice.org
[SA24606] Gentoo update for php
[SA24569] SUSE update for MozillaThunderbird and seamonkey
[SA24562] Gentoo update for nss
[SA24558] Gentoo update for mod_jk
[SA24553] Php-Stats SQL Injections and PHP Code Execution
[SA24550] Red Hat update for openoffice.org
[SA24615] Inkscape Format String Vulnerabilities
[SA24611] Squid TRACE Request Denial of Service Vulnerability
[SA24597] Ubuntu update for inkscape
[SA24593] Mandriva update for openoffice.org
[SA24581] Ubuntu update for libwpd
[SA24580] Mandriva update for libwpd
[SA24578] Gentoo update for asterisk
[SA24576] MPM Chat "logi" Local File Inclusion Vulnerability
[SA24573] Fedora update for libwpd
[SA24572] Debian update for libwpd
[SA24564] Asterisk SIP INVITE Denial of Service Vulnerability
[SA24557] rPath update for libwpd
[SA24547] SUSE update for kernel
[SA24544] rPath update for gnupg
[SA24609] Ubuntu update for mysql
[SA24604] Ubuntu update for file
[SA24592] rPath update for file
[SA24583] Fedora update for tcpdump
[SA24579] Asterisk SIP Response Code Denial of Service
[SA24567] WordPress "PHP_SELF" Cross-Site Scripting Vulnerability
[SA24566] Gentoo wordpress Multiple Vulnerabilities
[SA24548] file "file_printf()" Integer Underflow Vulnerability
[SA24607] Debian update for openafs
[SA24599] Mandriva update for openafs
[SA24577] Avaya Products PostgreSQL Denial of Service and Information
Disclosure
[SA24575] Fedora Xen VNC Server Host File Disclosure Security Issue
[SA24601] Mandriva update for nas
[SA24590] Debian update for lookup-el
Other:
[SA24600] Cisco IP Phone 7940/7960 SIP INVITE Denial of Service
Vulnerability
Cross Platform:
[SA24605] W-Agora Multiple Vulnerabilities
[SA24588] OpenOffice.org Multiple Vulnerabilities
[SA24585] LedgerSMB Unspecified Code Execution Vulnerability
[SA24571] NPDS "_FILES[DB][tmp_name]" SQL Injection Vulnerability
[SA24560] SQL-Ledger Unspecified Code Execution Vulnerability
[SA24602] realGuestbook SQL Injection and Cross-Site Scripting
Vulnerabilities
[SA24595] ScriptMagix Jokes "catid" SQL Injection Vulnerability
[SA24594] ScriptMagix Recipes "catid" SQL Injection Vulnerability
[SA24589] pragmaMX Landkarten Module "module_name" Local File
Inclusion
[SA24563] ScriptMagix Lyrics "recid" SQL Injection Vulnerability
[SA24559] Particle Blogger "postid" SQL Injection Vulnerability
[SA24546] TYPOlight webCMS Unspecified Vulnerability
[SA24545] Sun Java System Web Server Unspecified Information
Disclosure
[SA24541] IMP Script Insertion and Cross-Site Scripting
Vulnerabilities
[SA24555] FrontBase Relational Database Server "create procedure"
Buffer Overflow
[SA24586] ZZIPlib Library "zzip_open_shared_io()" Filename Buffer
Overflow
[SA24552] IBM WebSphere Application Server Unspecified HTTP Response
Splitting
[SA24551] DirectAdmin "RESULT" Cross-Site Scripting Vulnerability
[SA24582] OpenAFS Spoofed "FetchStatus" Privilege Escalation
[SA24542] PHP Multiple Code Execution Vulnerabilities
========================================================================
5) Vulnerabilities Content Listing
Windows:--
[SA24603] NewsGlue Feed Script Insertion Vulnerability
Critical: Moderately critical
Where: From remote
Impact: Cross Site Scripting
Released: 2007-03-22
A vulnerability has been reported in NewsGlue, which can be exploited
by malicious people to conduct script insertion attacks.
Full Advisory:
http://secunia.com/advisories/24603/
--
[SA24596] Mercur Messaging IMAP NTLM Authentication Buffer Overflow
Vulnerabilities
Critical: Moderately critical
Where: From remote
Impact: DoS, System access
Released: 2007-03-21
mu-b has discovered some vulnerabilities in Mercur Messaging 2005,
which can be exploited by malicious people to cause a DoS (Denial of
Service) or to potentially compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/24596/
--
[SA24574] Active Link Engine "catid" SQL Injection Vulnerability
Critical: Moderately critical
Where: From remote
Impact: Manipulation of data
Released: 2007-03-22
CyberGhost has reported a vulnerability in Active Link Engine, which
can be exploited by malicious people to conduct SQL injection attacks.
Full Advisory:
http://secunia.com/advisories/24574/
--
[SA24568] Active Photo Gallery "catid" SQL Injection Vulnerability
Critical: Moderately critical
Where: From remote
Impact: Manipulation of data
Released: 2007-03-22
CyberGhost has reported a vulnerability in Active Photo Gallery, which
can be exploited by malicious people to conduct SQL injection attacks.
Full Advisory:
http://secunia.com/advisories/24568/
--
[SA24561] Web Wiz Forums "formatSQLInput()" SQL Injection
Critical: Moderately critical
Where: From remote
Impact: Manipulation of data
Released: 2007-03-21
Ivan Fratric has reported a vulnerability in Web Wiz Forums, which can
be exploited by malicious people to conduct SQL injection attacks.
Full Advisory:
http://secunia.com/advisories/24561/
--
[SA24549] Systemwalker Desktop Encryption Self-Decoding File
Information Disclosure
Critical: Moderately critical
Where: From remote
Impact: Exposure of sensitive information
Released: 2007-03-16
A vulnerability has been reported in Systemwalker Desktop Encryption,
which can be exploited by malicious people to disclose sensitive
information.
Full Advisory:
http://secunia.com/advisories/24549/
--
[SA24543] Absolute Image Gallery XE "categoryid" SQL Injection
Critical: Moderately critical
Where: From remote
Impact: Manipulation of data
Released: 2007-03-16
UniquE-Key{UniquE-Cracker} has reported a vulnerability in Absolute
Image Gallery XE, which can be exploited by malicious people to conduct
SQL injection attacks.
Full Advisory:
http://secunia.com/advisories/24543/
--
[SA24612] NETxEIB OPC Server Improper Handle Validation
Critical: Moderately critical
Where: From local network
Impact: DoS, System access
Released: 2007-03-21
A vulnerability has been reported in NETxEIB OPC Server, which
potentially can be exploited by malicious people to cause a DoS (Denial
of Service) or to compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/24612/
--
[SA24570] Takebishi DeviceXPlorer OPC Server Improper Handle
Validation
Critical: Moderately critical
Where: From local network
Impact: DoS, System access
Released: 2007-03-20
A vulnerability has been reported in Takebishi DeviceXplorer OPC
Server, which potentially can be exploited by malicious people to cause
a DoS (Denial of Service) or to compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/24570/
--
[SA24598] Microsoft Windows NDISTAPI.SYS Denial of Service
Critical: Not critical
Where: Local system
Impact: DoS
Released: 2007-03-20
Rubn Santamarta has reported a vulnerability in Microsoft Windows,
which can be exploited by malicious, local users to cause a DoS (Denial
of Service).
Full Advisory:
http://secunia.com/advisories/24598/
UNIX/Linux:--
[SA24613] Debian update for openoffice.org
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2007-03-21
Debian has issued an update for openoffice.org. This fixes some
vulnerabilities, which potentially can be exploited by malicious people
to compromise a user's system.
Full Advisory:
http://secunia.com/advisories/24613/
--
[SA24606] Gentoo update for php
Critical: Highly critical
Where: From remote
Impact: Security Bypass, Exposure of sensitive information, DoS,
System access
Released: 2007-03-21
Gentoo has issued an update for php. This fixes some vulnerabilities,
which can be exploited by malicious people to disclose potentially
sensitive information, bypass certain security restrictions, to cause a
DoS (Denial of Service), or potentially compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/24606/
--
[SA24569] SUSE update for MozillaThunderbird and seamonkey
Critical: Highly critical
Where: From remote
Impact: Security Bypass, Cross Site Scripting, Spoofing, Exposure
of sensitive information, System access
Released: 2007-03-20
SUSE has issued an update for MozillaThunderbird and seamonkey. This
fixes some vulnerabilities, which can be exploited by malicious people
to bypass certain security restrictions, conduct cross-site scripting
and spoofing attacks, gain knowledge of sensitive information, and
potentially compromise a user's system.
Full Advisory:
http://secunia.com/advisories/24569/
--
[SA24562] Gentoo update for nss
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2007-03-21
Gentoo has issued an update for nss. This fixes some vulnerabilities in
nss, which potentially can be exploited by malicious people to
compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/24562/
--
[SA24558] Gentoo update for mod_jk
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2007-03-19
Gentoo has issued an update for mod_jk. This fixes a vulnerability,
which can be exploited by malicious people to compromise a vulnerable
system.
Full Advisory:
http://secunia.com/advisories/24558/
--
[SA24553] Php-Stats SQL Injections and PHP Code Execution
Critical: Highly critical
Where: From remote
Impact: Manipulation of data, System access
Released: 2007-03-19
rgod has reported some vulnerabilities in Php-Stats, which can be
exploited by malicious people to conduct SQL injection attacks or
compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/24553/
--
[SA24550] Red Hat update for openoffice.org
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2007-03-22
Red Hat has issued an update for openoffice.org. This fixes some
vulnerabilities, which can be exploited by malicious people to
potentially compromise a user's system.
Full Advisory:
http://secunia.com/advisories/24550/
--
[SA24615] Inkscape Format String Vulnerabilities
Critical: Moderately critical
Where: From remote
Impact: DoS, System access
Released: 2007-03-22
Some vulnerabilities have been reported in Inkscape, which potentially
can be exploited by malicious people to compromise a user's system.
Full Advisory:
http://secunia.com/advisories/24615/
--
[SA24611] Squid TRACE Request Denial of Service Vulnerability
Critical: Moderately critical
Where: From remote
Impact: DoS
Released: 2007-03-21
A vulnerability has been reported in Squid, which can be exploited by
malicious people to cause a DoS (Denial of Service).
Full Advisory:
http://secunia.com/advisories/24611/
--
[SA24597] Ubuntu update for inkscape
Critical: Moderately critical
Where: From remote
Impact: DoS, System access
Released: 2007-03-22
Ubuntu has issued an update for inkscape. This fixes a vulnerability,
which potentially can be exploited to compromise a user's system.
Full Advisory:
http://secunia.com/advisories/24597/
--
[SA24593] Mandriva update for openoffice.org
Critical: Moderately critical
Where: From remote
Impact: DoS, System access
Released: 2007-03-19
Mandriva has issued an update for openoffice.org. This fixes some
vulnerabilities, which can be exploited by malicious people to cause a
DoS (Denial of Service) or potentially compromise a user's system.
Full Advisory:
http://secunia.com/advisories/24593/
--
[SA24581] Ubuntu update for libwpd
Critical: Moderately critical
Where: From remote
Impact: DoS, System access
Released: 2007-03-20
Ubuntu has issued an update for libwpd. This fixes some
vulnerabilities, which can be exploited by malicious people to cause a
DoS (Denial of Service) or to compromise an application using the
library.
Full Advisory:
http://secunia.com/advisories/24581/
--
[SA24580] Mandriva update for libwpd
Critical: Moderately critical
Where: From remote
Impact: DoS, System access
Released: 2007-03-19
Mandriva has issued an update for libwpd. This fixes some
vulnerabilities, which can be exploited by malicious people to cause a
DoS (Denial of Service) or to compromise an application using the
library.
Full Advisory:
http://secunia.com/advisories/24580/
--
[SA24578] Gentoo update for asterisk
Critical: Moderately critical
Where: From remote
Impact: DoS
Released: 2007-03-19
Gentoo has issued an update for asterisk. This fixes a vulnerability,
which can be exploited by malicious people to cause a DoS (Denial of
Service).
Full Advisory:
http://secunia.com/advisories/24578/
--
[SA24576] MPM Chat "logi" Local File Inclusion Vulnerability
Critical: Moderately critical
Where: From remote
Impact: Exposure of system information, Exposure of sensitive
information
Released: 2007-03-19
GloD_M has discovered a vulnerability in MPM Chat, which can be
exploited by malicious people to disclose sensitive information.
Full Advisory:
http://secunia.com/advisories/24576/
--
[SA24573] Fedora update for libwpd
Critical: Moderately critical
Where: From remote
Impact: DoS, System access
Released: 2007-03-20
Fedora has issued an update for libwpd. This fixes some
vulnerabilities, which can be exploited by malicious people to cause a
DoS (Denial of Service) or to compromise an application using the
library.
Full Advisory:
http://secunia.com/advisories/24573/
--
[SA24572] Debian update for libwpd
Critical: Moderately critical
Where: From remote
Impact: DoS, System access
Released: 2007-03-19
Debian has issued an update for libwpd. This fixes some
vulnerabilities, which can be exploited by malicious people to cause a
DoS (Denial of Service) or to compromise an application using the
library.
Full Advisory:
http://secunia.com/advisories/24572/
--
[SA24564] Asterisk SIP INVITE Denial of Service Vulnerability
Critical: Moderately critical
Where: From remote
Impact: DoS
Released: 2007-03-21
A vulnerability has been reported in Asterisk, which can be exploited
by malicious people to cause a DoS (Denial of Service).
Full Advisory:
http://secunia.com/advisories/24564/
--
[SA24557] rPath update for libwpd
Critical: Moderately critical
Where: From remote
Impact: DoS, System access
Released: 2007-03-19
rPath has issued an update for libwpd. This fixes some vulnerabilities,
which can be exploited by malicious people to cause a DoS (Denial of
Service) or to compromise an application using the library.
Full Advisory:
http://secunia.com/advisories/24557/
--
[SA24547] SUSE update for kernel
Critical: Moderately critical
Where: From remote
Impact: Unknown, Privilege escalation, DoS
Released: 2007-03-16
SUSE has issued an update for the kernel. This fixes some
vulnerabilities, where one has unknown impacts and others can be
exploited by malicious, local users to gain escalated privileges and
cause a DoS (Denial of Service), or by malicious people to cause a DoS
(Denial of Service).
Full Advisory:
http://secunia.com/advisories/24547/
--
[SA24544] rPath update for gnupg
Critical: Moderately critical
Where: From remote
Impact: Security Bypass
Released: 2007-03-19
rPath has issued an update for gnupg. This fixes a vulnerability, which
potentially can be exploited by malicious people to bypass certain
security restrictions when applications use GnuPG in an insecure
manner.
Full Advisory:
http://secunia.com/advisories/24544/
--
[SA24609] Ubuntu update for mysql
Critical: Less critical
Where: From remote
Impact: DoS
Released: 2007-03-22
Ubuntu has issued an update for mysql. This fixes a vulnerability,
which can be exploited by malicious users to cause a DoS (Denial of
Service).
Full Advisory:
http://secunia.com/advisories/24609/
--
[SA24604] Ubuntu update for file
Critical: Less critical
Where: From remote
Impact: DoS, System access
Released: 2007-03-22
Ubuntu has issued an update for file. This fixes a vulnerability, which
potentially can be exploited by malicious people to compromise a
vulnerable system.
Full Advisory:
http://secunia.com/advisories/24604/
--
[SA24592] rPath update for file
Critical: Less critical
Where: From remote
Impact: Manipulation of data, DoS, System access
Released: 2007-03-22
rPath has issued an update for file. This fixes a vulnerability, which
potentially can be exploited by malicious people to compromise a
vulnerable system.
Full Advisory:
http://secunia.com/advisories/24592/
--
[SA24583] Fedora update for tcpdump
Critical: Less critical
Where: From remote
Impact: DoS
Released: 2007-03-19
Fedora has issued an update for tcpdump. This fixes a vulnerability,
which potentially can be exploited by malicious people to cause a DoS
(Denial of Service).
Full Advisory:
http://secunia.com/advisories/24583/
--
[SA24579] Asterisk SIP Response Code Denial of Service
Critical: Less critical
Where: From remote
Impact: DoS
Released: 2007-03-22
qwerty1979 has reported a vulnerability in Asterisk, which can be
exploited by malicious people to cause a DoS (Denial of Service).
Full Advisory:
http://secunia.com/advisories/24579/
--
[SA24567] WordPress "PHP_SELF" Cross-Site Scripting Vulnerability
Critical: Less critical
Where: From remote
Impact: Cross Site Scripting
Released: 2007-03-19
A vulnerability has been discovered in WordPress, which can be
exploited by malicious people to conduct cross-site scripting attacks.
Full Advisory:
http://secunia.com/advisories/24567/
--
[SA24566] Gentoo wordpress Multiple Vulnerabilities
Critical: Less critical
Where: From remote
Impact: Cross Site Scripting
Released: 2007-03-21
Gentoo has acknowledge some vulnerabilities in wordpress, which can be
exploited by malicious people to conduct cross-site scripting attacks.
Full Advisory:
http://secunia.com/advisories/24566/
--
[SA24548] file "file_printf()" Integer Underflow Vulnerability
Critical: Less critical
Where: From remote
Impact: DoS, System access
Released: 2007-03-19
A vulnerability has been reported in file, which potentially can be
exploited by malicious people to compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/24548/
--
[SA24607] Debian update for openafs
Critical: Less critical
Where: From local network
Impact: Privilege escalation
Released: 2007-03-21
Debian has issued an update for openafs. This fixes a vulnerability,
which can be exploited by malicious users to gain escalated
privileges.
Full Advisory:
http://secunia.com/advisories/24607/
--
[SA24599] Mandriva update for openafs
Critical: Less critical
Where: From local network
Impact: Privilege escalation
Released: 2007-03-21
Mandriva has issued an update for openafs. This fixes a vulnerability,
which can be exploited by malicious users to gain escalated
privileges.
Full Advisory:
http://secunia.com/advisories/24599/
--
[SA24577] Avaya Products PostgreSQL Denial of Service and Information
Disclosure
Critical: Less critical
Where: From local network
Impact: Exposure of sensitive information, DoS
Released: 2007-03-20
Avaya has acknowledged some vulnerabilities in various Avaya products,
which can be exploited by malicious users to gain knowledge of
potentially sensitive information and cause a DoS (Denial of Service).
Full Advisory:
http://secunia.com/advisories/24577/
--
[SA24575] Fedora Xen VNC Server Host File Disclosure Security Issue
Critical: Less critical
Where: From local network
Impact: Exposure of sensitive information
Released: 2007-03-20
Fedora has acknowledged a security issue, which can be exploited by
malicious users to gain knowledge of sensitive information.
Full Advisory:
http://secunia.com/advisories/24575/
--
[SA24601] Mandriva update for nas
Critical: Less critical
Where: Local system
Impact: Privilege escalation, DoS
Released: 2007-03-21
Mandriva has issued an update for nas. This fixes some vulnerabilities,
which can be exploited by malicious, local users to gain escalated
privileges or by malicious people to cause a DoS (Denial of Service).
Full Advisory:
http://secunia.com/advisories/24601/
--
[SA24590] Debian update for lookup-el
Critical: Less critical
Where: Local system
Impact: Privilege escalation
Released: 2007-03-19
Debian has issued an update for lookup-el. This fixes a vulnerability,
which can be exploited by malicious, local users to perform certain
actions with escalated privileges.
Full Advisory:
http://secunia.com/advisories/24590/
Other:--
[SA24600] Cisco IP Phone 7940/7960 SIP INVITE Denial of Service
Vulnerability
Critical: Moderately critical
Where: From remote
Impact: DoS
Released: 2007-03-20
A vulnerability has been reported in Cisco IP Phone 7940 and 7960,
which can be exploited by malicious people to cause a DoS (Denial of
Service).
Full Advisory:
http://secunia.com/advisories/24600/
Cross Platform:--
[SA24605] W-Agora Multiple Vulnerabilities
Critical: Highly critical
Where: From remote
Impact: Cross Site Scripting, Manipulation of data, System access
Released: 2007-03-21
laurent gaffi has discovered some vulnerabilities in W-Agora, which
can be exploited by malicious people to conduct cross-site scripting
and SQL injection attacks or compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/24605/
--
[SA24588] OpenOffice.org Multiple Vulnerabilities
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2007-03-21
Some vulnerabilities have been reported in OpenOffice.org, which
potentially can be exploited by malicious people to compromise a user's
system.
Full Advisory:
http://secunia.com/advisories/24588/
--
[SA24585] LedgerSMB Unspecified Code Execution Vulnerability
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2007-03-19
A vulnerability has been reported in LedgerSMB, which potentially can
be exploited by malicious people to compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/24585/
--
[SA24571] NPDS "_FILES[DB][tmp_name]" SQL Injection Vulnerability
Critical: Highly critical
Where: From remote
Impact: Manipulation of data
Released: 2007-03-20
DarkFig has discovered a vulnerability in NPDS, which can be exploited
by malicious people to conduct SQL injection attacks.
Full Advisory:
http://secunia.com/advisories/24571/
--
[SA24560] SQL-Ledger Unspecified Code Execution Vulnerability
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2007-03-20
A vulnerability has been reported in SQL-Ledger, which potentially can
be exploited by malicious people to compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/24560/
--
[SA24602] realGuestbook SQL Injection and Cross-Site Scripting
Vulnerabilities
Critical: Moderately critical
Where: From remote
Impact: Cross Site Scripting, Manipulation of data
Released: 2007-03-21
Some vulnerabilities have been discovered in realGuestbook, which can
be exploited by malicious people to conduct SQL injection or cross-site
scripting attacks.
Full Advisory:
http://secunia.com/advisories/24602/
--
[SA24595] ScriptMagix Jokes "catid" SQL Injection Vulnerability
Critical: Moderately critical
Where: From remote
Impact: Manipulation of data
Released: 2007-03-19
ajann has reported a vulnerability in ScriptMagix Jokes, which can be
exploited by malicious people to conduct SQL injection attacks.
Full Advisory:
http://secunia.com/advisories/24595/
--
[SA24594] ScriptMagix Recipes "catid" SQL Injection Vulnerability
Critical: Moderately critical
Where: From remote
Impact: Manipulation of data
Released: 2007-03-19
ajann has reported a vulnerability in ScriptMagix Recipes, which can be
exploited by malicious people to conduct SQL injection attacks.
Full Advisory:
http://secunia.com/advisories/24594/
--
[SA24589] pragmaMX Landkarten Module "module_name" Local File
Inclusion
Critical: Moderately critical
Where: From remote
Impact: Exposure of sensitive information
Released: 2007-03-20
bd0rk has reported a vulnerability in the Landkarten module for
pragmaMX, which can be exploited by malicious people to disclose
potentially sensitive information.
Full Advisory:
http://secunia.com/advisories/24589/
--
[SA24563] ScriptMagix Lyrics "recid" SQL Injection Vulnerability
Critical: Moderately critical
Where: From remote
Impact: Manipulation of data
Released: 2007-03-19
ajann has reported a vulnerability in ScriptMagix Lyrics, which can be
exploited by malicious people to conduct SQL injection attacks.
Full Advisory:
http://secunia.com/advisories/24563/
--
[SA24559] Particle Blogger "postid" SQL Injection Vulnerability
Critical: Moderately critical
Where: From remote
Impact: Manipulation of data
Released: 2007-03-20
UniquE-Key has discovered a vulnerability in Particle Blogger, which
can be exploited by malicious people to conduct SQL injection attacks.
Full Advisory:
http://secunia.com/advisories/24559/
--
[SA24546] TYPOlight webCMS Unspecified Vulnerability
Critical: Moderately critical
Where: From remote
Impact: Unknown
Released: 2007-03-20
A vulnerability with an unknown impact has been reported in TYPOlight
webCMS.
Full Advisory:
http://secunia.com/advisories/24546/
--
[SA24545] Sun Java System Web Server Unspecified Information
Disclosure
Critical: Moderately critical
Where: From remote
Impact: Exposure of sensitive information
Released: 2007-03-16
Sun has acknowledged a vulnerability in Sun Java System Web Server,
which can be exploited by malicious users to disclose potentially
sensitive information.
Full Advisory:
http://secunia.com/advisories/24545/
--
[SA24541] IMP Script Insertion and Cross-Site Scripting
Vulnerabilities
Critical: Moderately critical
Where: From remote
Impact: Cross Site Scripting
Released: 2007-03-15
Some vulnerabilities have been reported in IMP, which can be exploited
by malicious people to conduct cross-site scripting attacks.
Full Advisory:
http://secunia.com/advisories/24541/
--
[SA24555] FrontBase Relational Database Server "create procedure"
Buffer Overflow
Critical: Moderately critical
Where: From local network
Impact: System access
Released: 2007-03-19
Kevin Finisterre has reported a vulnerability in FrontBase Relational
Database Server, which can be exploited by malicious users to
compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/24555/
--
[SA24586] ZZIPlib Library "zzip_open_shared_io()" Filename Buffer
Overflow
Critical: Less critical
Where: From remote
Impact: Privilege escalation, System access
Released: 2007-03-19
dmcox dmcox has reported a vulnerability in ZZIPlib Library, which
potentially can be exploited by malicious people to gain escalated
privileges or compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/24586/
--
[SA24552] IBM WebSphere Application Server Unspecified HTTP Response
Splitting
Critical: Less critical
Where: From remote
Impact: Cross Site Scripting
Released: 2007-03-21
A vulnerability has been reported in IBM WebSphere Application Server,
which can be exploited by malicious people to conduct HTTP response
splitting attacks.
Full Advisory:
http://secunia.com/advisories/24552/
--
[SA24551] DirectAdmin "RESULT" Cross-Site Scripting Vulnerability
Critical: Less critical
Where: From remote
Impact: Cross Site Scripting
Released: 2007-03-19
Mandr4ke has reported a vulnerability in DirectAdmin, which can be
exploited by malicious people to conduct cross-site scripting attacks.
Full Advisory:
http://secunia.com/advisories/24551/
--
[SA24582] OpenAFS Spoofed "FetchStatus" Privilege Escalation
Critical: Less critical
Where: From local network
Impact: Privilege escalation
Released: 2007-03-21
A vulnerability has been reported in OpenAFS, which can be exploited by
malicious users to gain escalated privileges.
Full Advisory:
http://secunia.com/advisories/24582/
--
[SA24542] PHP Multiple Code Execution Vulnerabilities
Critical: Less critical
Where: Local system
Impact: Privilege escalation
Released: 2007-03-16
Stefan Esser has discovered some vulnerabilities in PHP, which can be
exploited by malicious users to gain escalated privileges.
Full Advisory:
http://secunia.com/advisories/24542/
========================================================================
Secunia recommends that you verify all advisories you receive,
by clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only use
those supplied by the vendor.
Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/
Subscribe:
http://secunia.com/secunia_weekly_summary/
Contact details:
Web : http://secunia.com/
E-mail : support@private
Tel : +45 70 20 51 44
Fax : +45 70 20 51 45
_________________________________________
Visit the InfoSec News Security Bookstore
http://www.shopinfosecnews.org
This archive was generated by hypermail 2.1.3 : Fri Mar 23 2007 - 00:02:28 PST