---------- Forwarded message ----------
Date: 25 Oct 2007 14:02:47 -0000
From: Secunia <summary@private>
To: submissions@private
Subject: Secunia Weekly Summary - Issue: 2007-43
========================================================================
The Secunia Weekly Advisory Summary
2007-10-18 - 2007-10-25
This week: 85 advisories
========================================================================
Table of Contents:
1.....................................................Word From Secunia
2....................................................This Week In Brief
3...............................This Weeks Top Ten Most Read Advisories
4.......................................Vulnerabilities Summary Listing
5.......................................Vulnerabilities Content Listing
========================================================================
1) Word From Secunia:
2003: 2,700 advisories published
2004: 3,100 advisories published
2005: 4,600 advisories published
2006: 5,300 advisories published
How do you know which Secunia advisories are important to you?
The Secunia Vulnerability Intelligence Solutions allows you to filter
and structure all the information you need, so you can address issues
effectively.
Get a free trial of the Secunia Vulnerability Intelligence Solutions:
http://corporate.secunia.com/how_to_buy/38/vi/?ref=summary_sm
========================================================================
2) This Week in Brief:
An extremely critical vulnerability in RealPlayer was discovered this
week, as it was being actively exploited in the wild. The
vulnerability, due to a signedness error in MPAMedia.dll when handling
playlist names, can be exploited to cause a stack-based buffer
overflow.
Successful exploitation can occur when, for example, a user
unsuspectingly imports a file into a specified playlist with an overly
long name. Exploitation allows execution of arbitrary code.
Users are urged to apply patches for RealPlayer 10.5 and 11 beta. Users
of RealPlayer 10 and RealOne v1 and v2 are urged to upgrade to
RealPlayer 10.5 to be able to apply the patch, especially in light of
active exploitation of the vulnerability.
For more information, refer to:
http://secunia.com/advisories/27248/
--
Multiple vulnerabilities have been reported in IBM Lotus Notes, which
can be exploited by malicious, local users to gain knowledge of
potentially sensitive information and by malicious people to bypass
certain security mechanisms or compromise a user's system.
Highly critical errors within various third-party file viewers can be
exploited to cause buffer overflows by tricking a user into viewing a
specially crafted attachment. Successful exploitation may allow
execution of arbitrary code.
A highly critical boundary error in the parsing of HTML messages in
nnotes.dll can be exploited to cause a buffer overflow when a user
acts upon a malicious HTML message. Successful exploitation may allow
execution of arbitrary code.
An error in the ECL (Execution Control List) mechanism when handling
Notes database (.nsf) and Notes template (.ntf) attachments may result
in the attachments being automatically executed instead of displaying
the Execution Security Alert.
Insecure permissions on shared memory allows any local user to access
memory containing other users' data.
A client crash error when receiving specially crafted SMTP responses
was also reported. Users are urged to upgrade to version 7.0.3 or 8.0.
For more information, refer to:
http://secunia.com/advisories/27279/
Corporate users can request for a trial of the Secunia Network Software
Inspector, which you can use to check which systems in your network are
vulnerable:
http://secunia.com/network_software_inspector/
--
Some vulnerabilities and a weakness have been reported in Mozilla
Firefox, which can be exploited by malicious people to disclose
sensitive information, conduct phishing attacks, manipulate certain
data, and potentially compromise a user's system.
Various errors in the browser engine and Javascript engine can be
exploited to cause memory corruption and may allow execution of
arbitrary code.
An error in the handling of onUnload events can be exploited to read
and manipulate the document's location of new pages.
Input passed to the user ID when making an HTTP request using Digest
Authentication is not properly sanitised before being used in a
request. This can be exploited to insert arbitrary HTTP headers into a
user's request when a proxy is used.
An error when displaying web pages written in the XUL markup language
can be exploited to hide the window's title bar and facilitate phishing
attacks.
An error in the handling of "smb:" and "sftp:" URI schemes on Linux
systems with gnome-vfs support can be exploited to read any file owned
by the target user via a specially crafted page on the same server.
However, successful exploitation requires that the attacker has write
access to a mutually accessible location on the target server and the
user is tricked into loading the malicious page.
An unspecified error in the handling of "XPCNativeWrappers" can lead to
execution of arbitrary Javascript code with the user's privileges via
subsequent access by the browser chrome (for example, when a user
right-clicks to open a context menu).
Additional fixes have also been implemented to prevent the exploitation
of a URI handling vulnerability in Windows, using Firefox as an attack
vector. Users are urged to upgrade to version 2.0.0.8 immediately.
For more information, refer to:
http://secunia.com/advisories/27311/
Associated security updates have also been released for Mozilla
Thunderbird and Mozilla Seamonkey. For more information, refer to:
http://secunia.com/advisories/27313/
http://secunia.com/advisories/27315/
Secunia has constructed the Secunia Personal Software Inspector, which
you can use to check if your personal system is vulnerable:
https://psi.secunia.com/
Corporate users can request for a trial of the Secunia Network Software
Inspector, which you can use to check which systems in your network are
vulnerable:
http://secunia.com/network_software_inspector/
--
VIRUS ALERTS:
During the past week Secunia collected 254 virus descriptions from the
Antivirus vendors. However, none were deemed MEDIUM risk or higher
according to the Secunia assessment scale.
========================================================================
3) This Weeks Top Ten Most Read Advisories:
1. [SA27311] Mozilla Firefox Multiple Vulnerabilities
2. [SA27248] RealPlayer Playlist Handling Buffer Overflow
Vulnerability
3. [SA27313] Mozilla Thunderbird Memory Corruption Vulnerabilities
4. [SA27315] Mozilla SeaMonkey Multiple Vulnerabilities
5. [SA27193] Cisco PIX and ASA TLS/MGCP Packet Processing Denial of
Service
6. [SA27279] IBM Lotus Notes Multiple Vulnerabilities
7. [SA27310] WWWISIS IAH Module "exprSearch" Cross-Site Scripting
8. [SA27226] Support Incident Tracker Unspecified Security Issues
9. [SA27236] Cisco FWSM HTTPS/MGCP Packet Processing Denial of
Service
10. [SA27295] Mandriva update for tk
========================================================================
4) Vulnerabilities Summary Listing
Windows:
[SA27317] IBM Lotus Notes WordPerfect File Viewer Vulnerability
[SA27304] Verity Keyview SDK Multiple Vulnerabilities
[SA27396] Aleris Web Publishing Server "mode" SQL Injection
[SA27349] Mono System.Web StaticFileHandler.cs Source Code Disclosure
Vulnerability
[SA27321] IBM Lotus Domino Multiple Vulnerabilities
[SA27301] CA Host-Based Intrusion Prevention System Server Script
Insertion
[SA27368] CREApark GOLD KY PORTALI "aranan" Cross-Site Scripting
[SA27365] WebIf "cmd" Cross-Site Scripting Vulnerability
[SA27339] CandyPress Store "msg" Cross-Site Scripting Vulnerability
[SA27337] ASP Site Search SearchSimon Lite "QUERY" Cross-Site
Scripting
[SA27342] IBM Lotus Notes Insecure Default Directory Permissions
[SA27312] SpeedFan Speedfan.sys Privilege Escalation and Denial of
Service
UNIX/Linux:
[SA27393] JustSystems Ichitaro Document Processing Multiple Buffer
Overflows
[SA27387] Fedora update for firefox
[SA27383] Ubuntu update for mozilla-thunderbird
[SA27370] Gentoo update for openoffice
[SA27364] Gentoo update for imagemagick
[SA27363] Ubuntu update for OpenSSL
[SA27358] Fedora update for blam
[SA27356] Fedora update for seamonkey
[SA27345] Jeebles Directory Information Disclosure and PHP Code
Execution
[SA27344] Gentoo update for tikiwiki
[SA27336] Debian update for xulrunner
[SA27335] Ubuntu update for firefox
[SA27330] Red Hat update for openssl
[SA27327] Red Hat update for seamonkey
[SA27326] Debian update for icedove
[SA27325] Red Hat update for thunderbird
[SA27309] rPath update for ImageMagick
[SA27308] Gentoo pdfkit and imagekits "StreamPredictor"
Vulnerabilities
[SA27298] SUSE update for Mozilla Firefox
[SA27377] rPath update for php, php-mysql and php-pgsql
[SA27366] Gentoo MLDonkey Empty "p2p" Password Security Issue
[SA27362] Ubuntu update for nagios-plugins
[SA27357] DeleGate Multiple Vulnerabilities
[SA27355] Red Hat update for flac
[SA27351] Red Hat update for php
[SA27322] Red Hat update for kernel
[SA27305] InstaGuide Weather Free "PageName" Local File Inclusion
[SA27302] LiteSpeed Web Server Script Source Code Disclosure
[SA27350] Ubuntu update for dhcp
[SA27338] Red Hat update for dhcp
[SA27391] Red Hat update for libpng
[SA27369] Fedora update for libpng and libpng10
[SA27352] Fedora update for drupal
[SA27334] Debian update for reprepro
[SA27319] Ubuntu update for ghostscript and gs-gpl
[SA27318] Gentoo update for star
[SA27316] Nagios Cross-Site Scripting Vulnerability
[SA27314] Gentoo update for sleuthkit
[SA27307] The Sleuth Kit "file" Integer Underflow Vulnerability
[SA27303] Debian update for zoph
[SA27297] Debian update for t1lib
[SA27397] Gentoo update for hplip
[SA27389] Xen "xenbaked" Insecure Temporary Files
[SA27343] Gentoo update for tramp
[SA27332] Mandriva update for hplip
[SA27374] Debian update for xfce4-terminal
[SA27331] rPath update for cpio and tar
[SA27386] Avaya CMS / IR Sun Solaris RPC Services Library Denial of
Service
[SA27392] Fedora update for xscreensaver, tempest, and rss-glx
[SA27381] Ubuntu update for gnome-screensaver
[SA27354] Ubuntu update for util-linux
[SA27306] Sun Solaris Kernel Statistics Retrieval Denial of Service
Other:
[SA27333] Warpzilla Enhanced Multiple Vulnerabilities
[SA27328] Sun Solaris Mozilla Layout Engine Unspecified
Vulnerabilities
[SA27329] Cisco Products EAP Denial of Service Vulnerability
Cross Platform:
[SA27385] php basic basicFramework "root" File Inclusion Vulnerability
[SA27360] Netscape Multiple Vulnerabilities
[SA27347] PHP Project Management File Inclusion Vulnerabilities
[SA27320] Sun JRE Applet Handling Vulnerability
[SA27315] Mozilla SeaMonkey Multiple Vulnerabilities
[SA27313] Mozilla Thunderbird Memory Corruption Vulnerabilities
[SA27311] Mozilla Firefox Multiple Vulnerabilities
[SA27359] Simple PHP Blog Multiple Vulnerabilities
[SA27348] Vanilla SQL Injection Vulnerabilities
[SA27346] Simple Machines Forum SQL Injection Vulnerabilities
[SA27323] MultiXTpm Application Server "DebugPrint()" Buffer Overflow
[SA27398] Apache Tomcat WebDAV Arbitrary File Content Disclosure
[SA27390] SWAMP "username" Cross-Site Scripting Vulnerability
[SA27341] HP OpenView Products httpd.tkd Unspecified Unauthorized Data
Access
[SA27324] SocketMail "lost_id" Cross-Site Scripting Vulnerability
[SA27310] WWWISIS IAH Module "exprSearch" Cross-Site Scripting
[SA27353] 3proxy FTP Proxy Module "OPEN" Command Double-Free
Vulnerability
[SA27372] Pidgin HTML Processing Denial of Service
========================================================================
5) Vulnerabilities Content Listing
Windows:--
[SA27317] IBM Lotus Notes WordPerfect File Viewer Vulnerability
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2007-10-23
Tan Chew Keong has reported a vulnerability in IBM Lotus Notes, which
potentially can be exploited by malicious people to compromise a user's
system.
Full Advisory:
http://secunia.com/advisories/27317/
--
[SA27304] Verity Keyview SDK Multiple Vulnerabilities
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2007-10-23
Multiple vulnerabilities have been reported in Verity Keyview SDK,
which potentially can be exploited by malicious people to compromise a
user's system.
Full Advisory:
http://secunia.com/advisories/27304/
--
[SA27396] Aleris Web Publishing Server "mode" SQL Injection
Critical: Moderately critical
Where: From remote
Impact: Manipulation of data
Released: 2007-10-25
Joseph.Giron13 has reported a vulnerability in Aleris Web Publishing
Server, which can be exploited by malicious people to conduct SQL
injection attacks.
Full Advisory:
http://secunia.com/advisories/27396/
--
[SA27349] Mono System.Web StaticFileHandler.cs Source Code Disclosure
Vulnerability
Critical: Moderately critical
Where: From remote
Impact: Exposure of sensitive information
Released: 2007-10-22
A vulnerability has been reported in Mono, which can be exploited by
malicious people to disclose potentially sensitive information.
Full Advisory:
http://secunia.com/advisories/27349/
--
[SA27321] IBM Lotus Domino Multiple Vulnerabilities
Critical: Moderately critical
Where: From remote
Impact: Exposure of sensitive information, System access
Released: 2007-10-23
Multiple vulnerabilities have been reported in IBM Lotus Domino, which
can be exploited by malicious, local users to gain knowledge of
sensitive information and by malicious users to bypass certain security
restrictions or compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/27321/
--
[SA27301] CA Host-Based Intrusion Prevention System Server Script
Insertion
Critical: Moderately critical
Where: From remote
Impact: Cross Site Scripting
Released: 2007-10-19
A vulnerability has been reported in CA Host-Based Intrusion Prevention
System (CA HIPS), which can be exploited by malicious people to conduct
script insertion attacks.
Full Advisory:
http://secunia.com/advisories/27301/
--
[SA27368] CREApark GOLD KY PORTALI "aranan" Cross-Site Scripting
Critical: Less critical
Where: From remote
Impact: Cross Site Scripting
Released: 2007-10-24
GeFORC3 has reported a vulnerability in CREApark GOLD KY PORTALI,
which can be exploited by malicious people to conduct cross-site
scripting attacks.
Full Advisory:
http://secunia.com/advisories/27368/
--
[SA27365] WebIf "cmd" Cross-Site Scripting Vulnerability
Critical: Less critical
Where: From remote
Impact: Cross Site Scripting
Released: 2007-10-23
SkyOut has reported a vulnerability in WebIf, which can be exploited by
malicious people to conduct cross-site scripting attacks.
Full Advisory:
http://secunia.com/advisories/27365/
--
[SA27339] CandyPress Store "msg" Cross-Site Scripting Vulnerability
Critical: Less critical
Where: From remote
Impact: Cross Site Scripting
Released: 2007-10-24
Snoop Security has reported a vulnerability in CandyPress Store, which
can be exploited by malicious people to conduct cross-site scripting
attacks.
Full Advisory:
http://secunia.com/advisories/27339/
--
[SA27337] ASP Site Search SearchSimon Lite "QUERY" Cross-Site
Scripting
Critical: Less critical
Where: From remote
Impact: Cross Site Scripting
Released: 2007-10-22
Aria-Security has reported a vulnerability in ASP Site Search
SearchSimon Lite, which can be exploited by malicious people to conduct
cross-site scripting attacks.
Full Advisory:
http://secunia.com/advisories/27337/
--
[SA27342] IBM Lotus Notes Insecure Default Directory Permissions
Critical: Less critical
Where: Local system
Impact: Privilege escalation
Released: 2007-10-24
A security issue has been discovered in IBM Lotus Notes, which can be
exploited by malicious, local users to manipulate arbitrary files.
Full Advisory:
http://secunia.com/advisories/27342/
--
[SA27312] SpeedFan Speedfan.sys Privilege Escalation and Denial of
Service
Critical: Less critical
Where: Local system
Impact: Security Bypass, Privilege escalation, DoS
Released: 2007-10-19
Ruben Santamarta has reported some vulnerabilities and a weakness in
SpeedFan, which can be exploited by malicious, local users to bypass
certain security restrictions, cause a DoS (Denial of Service) or gain
escalated privileges.
Full Advisory:
http://secunia.com/advisories/27312/
UNIX/Linux:--
[SA27393] JustSystems Ichitaro Document Processing Multiple Buffer
Overflows
Critical: Highly critical
Where: From remote
Impact: DoS, System access
Released: 2007-10-25
Hiroshi Ukai has reported some vulnerabilities in Ichitaro, which can
be exploited by malicious people to compromise a user's system.
Full Advisory:
http://secunia.com/advisories/27393/
--
[SA27387] Fedora update for firefox
Critical: Highly critical
Where: From remote
Impact: Spoofing, Manipulation of data, Exposure of sensitive
information, DoS, System access
Released: 2007-10-24
Fedora has issued an update for firefox. This fixes some
vulnerabilities and weaknesses, which can be exploited by malicious
people to disclose sensitive information, conduct phishing attacks,
manipulate certain data, and potentially compromise a user's system.
Full Advisory:
http://secunia.com/advisories/27387/
--
[SA27383] Ubuntu update for mozilla-thunderbird
Critical: Highly critical
Where: From remote
Impact: Cross Site Scripting, Spoofing, Manipulation of data,
Exposure of sensitive information, DoS, System access
Released: 2007-10-24
Ubuntu has issued an update for mozilla-thunderbird. This fixes a
weakness and some vulnerabilities, which can be exploited by malicious
people to conduct cross-site scripting and spoofing attacks, manipulate
certain data, expose sensitive information, or compromise a user's
system.
Full Advisory:
http://secunia.com/advisories/27383/
--
[SA27370] Gentoo update for openoffice
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2007-10-23
Gentoo has issued an update for openoffice. This fixes some
vulnerabilities, which can be exploited by malicious people to
compromise a user's system.
Full Advisory:
http://secunia.com/advisories/27370/
--
[SA27364] Gentoo update for imagemagick
Critical: Highly critical
Where: From remote
Impact: DoS, System access
Released: 2007-10-25
Gentoo has issued an update for imagemagick. This fixes some
vulnerabilities, which can be exploited by malicious people to conduct
DoS (Denial of Service) attacks or compromise a user's system.
Full Advisory:
http://secunia.com/advisories/27364/
--
[SA27363] Ubuntu update for OpenSSL
Critical: Highly critical
Where: From remote
Impact: DoS, System access
Released: 2007-10-23
Ubuntu has issued an update for OpenSSL. This fixes a vulnerability,
which can be exploited by malicious people to cause a DoS (Denial of
Service) and potentially compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/27363/
--
[SA27358] Fedora update for blam
Critical: Highly critical
Where: From remote
Impact: Spoofing, Manipulation of data, Exposure of sensitive
information, DoS, System access
Released: 2007-10-25
Fedora has issued an update for blam. This package has been rebuilt
against a new version of the firefox package. This fixes some
vulnerabilities and weaknesses, which can be exploited by malicious
people to disclose sensitive information, conduct phishing attacks,
manipulate certain data, and potentially compromise a user's system.
Full Advisory:
http://secunia.com/advisories/27358/
--
[SA27356] Fedora update for seamonkey
Critical: Highly critical
Where: From remote
Impact: Spoofing, Manipulation of data, Exposure of sensitive
information, DoS, System access
Released: 2007-10-24
Fedora has issued an update for seamonkey. This fixes some
vulnerabilities and a weakness, which can be exploited by malicious
people to disclose sensitive information, conduct phishing attacks,
manipulate certain data, and potentially compromise a user's system.
Full Advisory:
http://secunia.com/advisories/27356/
--
[SA27345] Jeebles Directory Information Disclosure and PHP Code
Execution
Critical: Highly critical
Where: From remote
Impact: Exposure of system information, Exposure of sensitive
information, System access
Released: 2007-10-23
Some vulnerabilities have been discovered in Jeebles Directory, which
can be exploited by malicious people to disclose sensitive information
and by malicious users to compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/27345/
--
[SA27344] Gentoo update for tikiwiki
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2007-10-22
Gentoo has issued an update for tikiwiki. This fixes a vulnerability,
which can be exploited by malicious people to compromise a vulnerable
system.
Full Advisory:
http://secunia.com/advisories/27344/
--
[SA27336] Debian update for xulrunner
Critical: Highly critical
Where: From remote
Impact: Spoofing, Manipulation of data, Exposure of sensitive
information, DoS, System access
Released: 2007-10-22
Debian has issued an update for xulrunner. This fixes some
vulnerabilities and weaknesses, which can be exploited by malicious
people to disclose sensitive information, conduct phishing attacks,
manipulate certain data, and potentially compromise a user's system.
Full Advisory:
http://secunia.com/advisories/27336/
--
[SA27335] Ubuntu update for firefox
Critical: Highly critical
Where: From remote
Impact: Spoofing, Manipulation of data, Exposure of sensitive
information, DoS, System access
Released: 2007-10-23
Ubuntu has issued an update for firefox. This fixes some
vulnerabilities and weaknesses, which can be exploited by malicious
people to disclose sensitive information, conduct phishing attacks,
manipulate certain data, and potentially compromise a user's system.
Full Advisory:
http://secunia.com/advisories/27335/
--
[SA27330] Red Hat update for openssl
Critical: Highly critical
Where: From remote
Impact: DoS, System access
Released: 2007-10-22
Red Hat has issued an update for openssl. This fixes a vulnerability,
which potentially can be exploited by malicious people to cause a DoS
(Denial of Service) or potentially compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/27330/
--
[SA27327] Red Hat update for seamonkey
Critical: Highly critical
Where: From remote
Impact: Cross Site Scripting, Spoofing, Manipulation of data,
Exposure of sensitive information, System access
Released: 2007-10-22
Red Hat has issued an update for seamonkey. This fixes some
vulnerabilities, which can be exploited by malicious people to conduct
cross-site scripting attacks, disclose sensitive information, conduct
phishing attacks, manipulate certain data and compromise a user's
system.
Full Advisory:
http://secunia.com/advisories/27327/
--
[SA27326] Debian update for icedove
Critical: Highly critical
Where: From remote
Impact: Cross Site Scripting, DoS, System access
Released: 2007-10-22
Debian has issued an update for icedove. This fixes some
vulnerabilities, which potentially can be exploited by malicious people
to compromise a user's system.
Full Advisory:
http://secunia.com/advisories/27326/
--
[SA27325] Red Hat update for thunderbird
Critical: Highly critical
Where: From remote
Impact: Cross Site Scripting, Spoofing, Manipulation of data,
Exposure of sensitive information, DoS, System access
Released: 2007-10-22
Red Hat has issued an update for thunderbird. This fixes some
vulnerabilities, which can be exploited by malicious people to conduct
cross-site scripting attacks, disclose sensitive information, conduct
phishing attacks, manipulate certain data, and potentially compromise a
user's system.
Full Advisory:
http://secunia.com/advisories/27325/
--
[SA27309] rPath update for ImageMagick
Critical: Highly critical
Where: From remote
Impact: DoS, System access
Released: 2007-10-19
rPath has issued an update for ImageMagick. This fixes some
vulnerabilities, which can be exploited by malicious people to conduct
DoS (Denial of Service) attacks or compromise a user's system.
Full Advisory:
http://secunia.com/advisories/27309/
--
[SA27308] Gentoo pdfkit and imagekits "StreamPredictor"
Vulnerabilities
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2007-10-19
Gentoo has acknowledged some vulnerabilities in pdfkit and imagekits,
which can be exploited by malicious people to compromise a vulnerable
system.
Full Advisory:
http://secunia.com/advisories/27308/
--
[SA27298] SUSE update for Mozilla Firefox
Critical: Highly critical
Where: From remote
Impact: Cross Site Scripting, Spoofing, Manipulation of data,
Exposure of sensitive information, DoS, System access
Released: 2007-10-22
SUSE has issued an update for Mozilla Firefox. This fixes some
vulnerabilities and weaknesses, which can be exploited by malicious
people to disclose sensitive information, conduct phishing attacks,
manipulate certain data, and potentially compromise a user's system.
Full Advisory:
http://secunia.com/advisories/27298/
--
[SA27377] rPath update for php, php-mysql and php-pgsql
Critical: Moderately critical
Where: From remote
Impact: Unknown, Security Bypass, DoS, System access
Released: 2007-10-25
rPath has issued an update for php, php-mysql and php-pgsql. This fixes
some vulnerabilities, where some have unknown impacts and others can be
exploited by malicious users to bypass certain security restrictions or
by malicious people to potentially compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/27377/
--
[SA27366] Gentoo MLDonkey Empty "p2p" Password Security Issue
Critical: Moderately critical
Where: From remote
Impact: System access
Released: 2007-10-25
A security issue has been reported in Gentoo, which can be exploited by
malicious people to compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/27366/
--
[SA27362] Ubuntu update for nagios-plugins
Critical: Moderately critical
Where: From remote
Impact: System access
Released: 2007-10-23
Ubuntu has issued an update for nagios-plugins. This fixes a
vulnerability, which can be exploited by malicious people to compromise
a vulnerable system.
Full Advisory:
http://secunia.com/advisories/27362/
--
[SA27357] DeleGate Multiple Vulnerabilities
Critical: Moderately critical
Where: From remote
Impact: DoS, System access
Released: 2007-10-23
Some vulnerabilities have been reported in DeleGate, which can be
exploited by malicious people to cause a DoS (Denial of Service) or
potentially compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/27357/
--
[SA27355] Red Hat update for flac
Critical: Moderately critical
Where: From remote
Impact: System access
Released: 2007-10-23
Red Hat has issued an update for flac. This fixes some vulnerabilities,
which can be exploited by malicious people to compromise a user's
system.
Full Advisory:
http://secunia.com/advisories/27355/
--
[SA27351] Red Hat update for php
Critical: Moderately critical
Where: From remote
Impact: Security Bypass, Privilege escalation
Released: 2007-10-24
Red Hat has issued an update for php. This fixes a weakness and some
vulnerabilities, which can be exploited by malicious users to bypass
certain security restrictions and gain escalated privileges, and by
malicious people to bypass certain security restrictions.
Full Advisory:
http://secunia.com/advisories/27351/
--
[SA27322] Red Hat update for kernel
Critical: Moderately critical
Where: From remote
Impact: Security Bypass, DoS
Released: 2007-10-22
Red Hat has issued an update for the kernel. This fixes some
vulnerabilities, which can be exploited by malicious, local users to
bypass certain security restrictions and to cause a DoS (Denial of
Service), and by malicious people to cause a DoS.
Full Advisory:
http://secunia.com/advisories/27322/
--
[SA27305] InstaGuide Weather Free "PageName" Local File Inclusion
Critical: Moderately critical
Where: From remote
Impact: Exposure of system information, Exposure of sensitive
information
Released: 2007-10-23
BorN To K!LL has discovered a vulnerability in InstaGuide Weather Free,
which can be exploited by malicious people to disclose sensitive
information.
Full Advisory:
http://secunia.com/advisories/27305/
--
[SA27302] LiteSpeed Web Server Script Source Code Disclosure
Critical: Moderately critical
Where: From remote
Impact: Exposure of sensitive information
Released: 2007-10-23
Tr3mbl3r has reported a vulnerability in LiteSpeed Web Server, which
can be exploited by malicious people to disclose potentially sensitive
information.
Full Advisory:
http://secunia.com/advisories/27302/
--
[SA27350] Ubuntu update for dhcp
Critical: Moderately critical
Where: From local network
Impact: DoS, System access
Released: 2007-10-23
Ubuntu has issued an update for dhcp. This fixes a vulnerability, which
can be exploited by malicious people to cause a DoS (Denial of Service)
or potentially compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/27350/
--
[SA27338] Red Hat update for dhcp
Critical: Moderately critical
Where: From local network
Impact: DoS, System access
Released: 2007-10-24
Red Hat has issued an update for dhcp. This fixes a vulnerability,
which can be exploited by malicious people to cause a DoS (Denial of
Service) or potentially compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/27338/
--
[SA27391] Red Hat update for libpng
Critical: Less critical
Where: From remote
Impact: DoS
Released: 2007-10-24
Red Hat has issued an update for libpng. This fixes a vulnerability,
which can be exploited by malicious people to cause a DoS (Denial of
Service).
Full Advisory:
http://secunia.com/advisories/27391/
--
[SA27369] Fedora update for libpng and libpng10
Critical: Less critical
Where: From remote
Impact: DoS
Released: 2007-10-24
Fedora has issued an update for libpng and libpng10. This fixes a
vulnerability, which can be exploited by malicious people to cause a
DoS (Denial of Service).
Full Advisory:
http://secunia.com/advisories/27369/
--
[SA27352] Fedora update for drupal
Critical: Less critical
Where: From remote
Impact: Security Bypass, Cross Site Scripting, System access
Released: 2007-10-24
Fedora has issued an update for drupal. This fixes some
vulnerabilities, which can be exploited by malicious users to conduct
HTTP response splitting attacks, and by malicious people to conduct
cross-site request forgery and cross-site scripting attacks, bypass
certain security restrictions, and to compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/27352/
--
[SA27334] Debian update for reprepro
Critical: Less critical
Where: From remote
Impact: Security Bypass
Released: 2007-10-24
Debian has issued an update for reprepro. This fixes a vulnerability,
which can be exploited by malicious people to bypass certain security
restrictions.
Full Advisory:
http://secunia.com/advisories/27334/
--
[SA27319] Ubuntu update for ghostscript and gs-gpl
Critical: Less critical
Where: From remote
Impact: DoS
Released: 2007-10-23
Ubuntu has issued an update for ghostscript and gs-gpl. This fixes a
vulnerability, which can be exploited by malicious people to cause a
DoS (Denial of Service).
Full Advisory:
http://secunia.com/advisories/27319/
--
[SA27318] Gentoo update for star
Critical: Less critical
Where: From remote
Impact: System access
Released: 2007-10-23
Gentoo has issued an update for star. This fixes a vulnerability, which
can be exploited by malicious people to compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/27318/
--
[SA27316] Nagios Cross-Site Scripting Vulnerability
Critical: Less critical
Where: From remote
Impact: Cross Site Scripting
Released: 2007-10-22
A vulnerability has been reported in Nagios, which can be exploited by
malicious people to conduct cross-site scripting attacks.
Full Advisory:
http://secunia.com/advisories/27316/
--
[SA27314] Gentoo update for sleuthkit
Critical: Less critical
Where: From remote
Impact: DoS, System access
Released: 2007-10-19
Gentoo has issued an update for sleuthkit. This fixes a vulnerability,
which can be exploited by malicious people to compromise a vulnerable
system.
Full Advisory:
http://secunia.com/advisories/27314/
--
[SA27307] The Sleuth Kit "file" Integer Underflow Vulnerability
Critical: Less critical
Where: From remote
Impact: DoS, System access
Released: 2007-10-19
A vulnerability has been reported in The Sleuth Kit, which can be
exploited by malicious people to compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/27307/
--
[SA27303] Debian update for zoph
Critical: Less critical
Where: From remote
Impact: Manipulation of data
Released: 2007-10-19
Debian has issued an update for zoph. This fixes a vulnerability, which
can be exploited by malicious users to conduct SQL injection attacks.
Full Advisory:
http://secunia.com/advisories/27303/
--
[SA27297] Debian update for t1lib
Critical: Less critical
Where: From remote
Impact: DoS, System access
Released: 2007-10-19
Debian has issued an update for t1lib. This fixes a vulnerability,
which can be exploited by malicious users to potentially compromise a
vulnerable system.
Full Advisory:
http://secunia.com/advisories/27297/
--
[SA27397] Gentoo update for hplip
Critical: Less critical
Where: Local system
Impact: Privilege escalation
Released: 2007-10-25
Gentoo has issued an update for hplip. This fixes a vulnerability,
which can be exploited by malicious, local users to gain escalated
privileges.
Full Advisory:
http://secunia.com/advisories/27397/
--
[SA27389] Xen "xenbaked" Insecure Temporary Files
Critical: Less critical
Where: Local system
Impact: Manipulation of data
Released: 2007-10-24
Steve Kemp has reported a security issue in Xen, which can be exploited
by malicious, local users to truncate arbitrary files.
Full Advisory:
http://secunia.com/advisories/27389/
--
[SA27343] Gentoo update for tramp
Critical: Less critical
Where: Local system
Impact: Privilege escalation
Released: 2007-10-22
Gentoo has issued an update for tramp. This fixes a vulnerability,
which can be exploited by malicious, local users to perform certain
actions with escalated privileges.
Full Advisory:
http://secunia.com/advisories/27343/
--
[SA27332] Mandriva update for hplip
Critical: Less critical
Where: Local system
Impact: Privilege escalation
Released: 2007-10-23
Mandriva has issued an update for hplip. This fixes a vulnerability,
which can be exploited by malicious, local users to gain escalated
privileges.
Full Advisory:
http://secunia.com/advisories/27332/
--
[SA27374] Debian update for xfce4-terminal
Critical: Not critical
Where: From remote
Impact: Security Bypass
Released: 2007-10-24
Debian has issued an update for xfce4-terminal. This fixes a security
issue, which can be exploited by malicious people to inject shell
commands.
Full Advisory:
http://secunia.com/advisories/27374/
--
[SA27331] rPath update for cpio and tar
Critical: Not critical
Where: From remote
Impact: DoS
Released: 2007-10-24
rPath has issued an update for cpio and tar. This fixes a
vulnerability, which can be exploited by malicious people to cause a
DoS (Denial of Service).
Full Advisory:
http://secunia.com/advisories/27331/
--
[SA27386] Avaya CMS / IR Sun Solaris RPC Services Library Denial of
Service
Critical: Not critical
Where: From local network
Impact: DoS
Released: 2007-10-25
Avaya has acknowledged a vulnerability in Avaya CMS and IR, which can
be exploited by malicious, local users and malicious users to cause a
DoS (Denial of Service).
Full Advisory:
http://secunia.com/advisories/27386/
--
[SA27392] Fedora update for xscreensaver, tempest, and rss-glx
Critical: Not critical
Where: Local system
Impact: Security Bypass
Released: 2007-10-24
Fedora has issued updates for xscreensaver, tempest, and rss-glx. These
fix a security issue, which can be exploited by malicious people with
physical access to a system to bypass certain security restrictions.
Full Advisory:
http://secunia.com/advisories/27392/
--
[SA27381] Ubuntu update for gnome-screensaver
Critical: Not critical
Where: Local system
Impact: Security Bypass
Released: 2007-10-24
Ubuntu has issued an update for gnome-screensaver. This fixes a
security issue, which can be exploited by malicious people with
physical access to a system to bypass certain security restrictions.
Full Advisory:
http://secunia.com/advisories/27381/
--
[SA27354] Ubuntu update for util-linux
Critical: Not critical
Where: Local system
Impact: Privilege escalation
Released: 2007-10-23
Ubuntu has issued an update for util-linux. This fixes a vulnerability,
which potentially can be exploited by malicious, local users to perform
certain actions with escalated privileges.
Full Advisory:
http://secunia.com/advisories/27354/
--
[SA27306] Sun Solaris Kernel Statistics Retrieval Denial of Service
Critical: Not critical
Where: Local system
Impact: DoS
Released: 2007-10-19
Sun has acknowledged some vulnerabilities in Sun Solaris, which can be
exploited by malicious, local users to cause a DoS (Denial of
Service).
Full Advisory:
http://secunia.com/advisories/27306/
Other:--
[SA27333] Warpzilla Enhanced Multiple Vulnerabilities
Critical: Highly critical
Where: From remote
Impact: Spoofing, Manipulation of data, Exposure of sensitive
information, DoS, System access
Released: 2007-10-22
Some vulnerabilities and a weakness have been reported in Warpzilla
Enhanced, which can be exploited by malicious people to disclose
sensitive information, conduct phishing attacks, manipulate certain
data, and potentially compromise a user's system.
Full Advisory:
http://secunia.com/advisories/27333/
--
[SA27328] Sun Solaris Mozilla Layout Engine Unspecified
Vulnerabilities
Critical: Moderately critical
Where: From remote
Impact: DoS, System access
Released: 2007-10-23
Sun has acknowledged some vulnerabilities in Sun Solaris, which can be
exploited by malicious people to cause a DoS (Denial of Service) or
potentially compromise a user's system.
Full Advisory:
http://secunia.com/advisories/27328/
--
[SA27329] Cisco Products EAP Denial of Service Vulnerability
Critical: Less critical
Where: From local network
Impact: DoS
Released: 2007-10-22
A vulnerability has been reported in various Cisco products, which can
be exploited by malicious people to cause a DoS (Denial of Service).
Full Advisory:
http://secunia.com/advisories/27329/
Cross Platform:--
[SA27385] php basic basicFramework "root" File Inclusion Vulnerability
Critical: Highly critical
Where: From remote
Impact: Exposure of system information, Exposure of sensitive
information, System access
Released: 2007-10-24
Alucar has reported a vulnerability in php basic basicFramework, which
can be exploited by malicious people to disclose sensitive information
or to compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/27385/
--
[SA27360] Netscape Multiple Vulnerabilities
Critical: Highly critical
Where: From remote
Impact: Spoofing, Manipulation of data, Exposure of sensitive
information, DoS, System access
Released: 2007-10-23
Netscape has acknowledged some vulnerabilities and a weakness in
Netscape Navigator, which can be exploited by malicious people to
disclose sensitive information, conduct phishing attacks, manipulate
certain data, and potentially compromise a user's system.
Full Advisory:
http://secunia.com/advisories/27360/
--
[SA27347] PHP Project Management File Inclusion Vulnerabilities
Critical: Highly critical
Where: From remote
Impact: Exposure of system information, Exposure of sensitive
information, System access
Released: 2007-10-23
Some vulnerabilities have been reported in PHP Project Management,
which can be exploited by malicious people to disclose sensitive
information and compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/27347/
--
[SA27320] Sun JRE Applet Handling Vulnerability
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2007-10-23
A vulnerability has been reported in Sun JRE, which can be exploited by
malicious people to compromise a user's system.
Full Advisory:
http://secunia.com/advisories/27320/
--
[SA27315] Mozilla SeaMonkey Multiple Vulnerabilities
Critical: Highly critical
Where: From remote
Impact: Spoofing, Manipulation of data, Exposure of sensitive
information, DoS, System access
Released: 2007-10-19
Some vulnerabilities and a weakness have been reported in Mozilla
SeaMonkey, which can be exploited by malicious people to disclose
sensitive information, conduct phishing attacks, manipulate certain
data, and potentially compromise a user's system.
Full Advisory:
http://secunia.com/advisories/27315/
--
[SA27313] Mozilla Thunderbird Memory Corruption Vulnerabilities
Critical: Highly critical
Where: From remote
Impact: DoS, System access
Released: 2007-10-19
Some vulnerabilities have been reported in Mozilla Thunderbird, which
potentially can be exploited by malicious people to compromise a user's
system.
Full Advisory:
http://secunia.com/advisories/27313/
--
[SA27311] Mozilla Firefox Multiple Vulnerabilities
Critical: Highly critical
Where: From remote
Impact: Spoofing, Manipulation of data, Exposure of sensitive
information, DoS, System access
Released: 2007-10-19
Some vulnerabilities and a weakness have been reported in Mozilla
Firefox, which can be exploited by malicious people to disclose
sensitive information, conduct phishing attacks, manipulate certain
data, and potentially compromise a user's system.
Full Advisory:
http://secunia.com/advisories/27311/
--
[SA27359] Simple PHP Blog Multiple Vulnerabilities
Critical: Moderately critical
Where: From remote
Impact: Security Bypass, Cross Site Scripting, Exposure of system
information, Exposure of sensitive information, System access
Released: 2007-10-24
DarkFig has reported some vulnerabilities in Simple PHP Blog, which can
be exploited by malicious people to bypass certain security restrictions
and conduct script insertion and cross-site request forgery attacks, and
by malicious users to disclose sensitive information and compromise a
vulnerable system.
Full Advisory:
http://secunia.com/advisories/27359/
--
[SA27348] Vanilla SQL Injection Vulnerabilities
Critical: Moderately critical
Where: From remote
Impact: Manipulation of data
Released: 2007-10-22
InATeam has reported some vulnerabilities in Vanilla, which can be
exploited by malicious people to conduct SQL injection attacks.
Full Advisory:
http://secunia.com/advisories/27348/
--
[SA27346] Simple Machines Forum SQL Injection Vulnerabilities
Critical: Moderately critical
Where: From remote
Impact: Manipulation of data
Released: 2007-10-22
Michael Brooks has reported some vulnerabilities in Simple Machines
Forum, which can be exploited by malicious users and malicious people
to conduct SQL injection attacks.
Full Advisory:
http://secunia.com/advisories/27346/
--
[SA27323] MultiXTpm Application Server "DebugPrint()" Buffer Overflow
Critical: Moderately critical
Where: From remote
Impact: System access
Released: 2007-10-23
A vulnerability has been reported in MultiXTpm Application Server,
which potentially can be exploited by malicious people to compromise a
vulnerable system.
Full Advisory:
http://secunia.com/advisories/27323/
--
[SA27398] Apache Tomcat WebDAV Arbitrary File Content Disclosure
Critical: Less critical
Where: From remote
Impact: Exposure of sensitive information
Released: 2007-10-25
eliteb0y has reported a vulnerability in Apache Tomcat, which can be
exploited by malicious users to disclose potentially sensitive
information.
Full Advisory:
http://secunia.com/advisories/27398/
--
[SA27390] SWAMP "username" Cross-Site Scripting Vulnerability
Critical: Less critical
Where: From remote
Impact: Cross Site Scripting
Released: 2007-10-25
morin.josh has reported a vulnerability in SWAMP, which can be
exploited by malicious people to conduct cross-site scripting attacks.
Full Advisory:
http://secunia.com/advisories/27390/
--
[SA27341] HP OpenView Products httpd.tkd Unspecified Unauthorized Data
Access
Critical: Less critical
Where: From remote
Impact: Exposure of sensitive information
Released: 2007-10-25
A vulnerability has been reported in HP OpenView Configuration
Management (CM) Infrastructure (Radia) and Client Configuration Manager
(CCM), which can be exploited by malicious people to disclose
potentially sensitive information.
Full Advisory:
http://secunia.com/advisories/27341/
--
[SA27324] SocketMail "lost_id" Cross-Site Scripting Vulnerability
Critical: Less critical
Where: From remote
Impact: Cross Site Scripting
Released: 2007-10-23
Ivan Sanchez and Maximiliano Soler have reported a vulnerability in
SocketMail, which can be exploited by malicious people to conduct
cross-site scripting attacks.
Full Advisory:
http://secunia.com/advisories/27324/
--
[SA27310] WWWISIS IAH Module "exprSearch" Cross-Site Scripting
Critical: Less critical
Where: From remote
Impact: Cross Site Scripting
Released: 2007-10-19
A vulnerability has been discovered in the IAH (Interface for Access of
Health Information) module for WWWISIS, which can be exploited by
malicious people to conduct cross-site scripting attacks.
Full Advisory:
http://secunia.com/advisories/27310/
--
[SA27353] 3proxy FTP Proxy Module "OPEN" Command Double-Free
Vulnerability
Critical: Less critical
Where: From local network
Impact: DoS
Released: 2007-10-24
Venustech AD-LAB has reported a vulnerability in 3proxy, which can be
exploited by malicious people to cause a DoS (Denial of Service).
Full Advisory:
http://secunia.com/advisories/27353/
--
[SA27372] Pidgin HTML Processing Denial of Service
Critical: Not critical
Where: From remote
Impact: DoS
Released: 2007-10-25
A weakness has been reported in Pidgin, which can be exploited by
malicious people to cause a DoS (Denial of Service).
Full Advisory:
http://secunia.com/advisories/27372/
========================================================================
Secunia recommends that you verify all advisories you receive,
by clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only use
those supplied by the vendor.
Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/
Subscribe:
http://secunia.com/secunia_weekly_summary/
Contact details:
Web : http://secunia.com/
E-mail : support@private
Tel : +45 70 20 51 44
Fax : +45 70 20 51 45
__________________________________________________________________
CSI 2007 is the only conference that delivers a business-focused
overview of enterprise security. It will convene 1,500+ delegates,
80 exhibitors and features 100+ sessions/seminars providing a
roadmap for integrating policies and procedures with new tools
and techniques. Register now for savings on conference fees
and/or free exhibits admission. - www.csiannual.com
This archive was generated by hypermail 2.1.3 : Fri Oct 26 2007 - 00:32:58 PDT