 |
|
|
|
| Trend Micro VirusWall for Linux buffer overflow | | Published: |  | 28.01.2007 | | Source: |  | BUGTRAQ | | SecurityVulns ID: |  | 7113 | | Type: |  | local | | Level: |  | 5/10 | | Description: |  | Buffer overflow in libvsapi.so library used by vscan suid root application. |
| Affected: |  | TM : InterScan VirusWall 3.81 | | CVE: |  | CVE-2007-0602 (Buffer overflow in libvsapi.so in the VSAPI library in Trend Micro VirusWall 3.81 for Linux, as used by IScan.BASE/vscan, allows local users to gain privileges via a long command line argument, a different vulnerability than CVE-2005-0533.) |
| PGP Desktop code execution | | Published: | | 28.01.2007 | | Source: | | BUGTRAQ | | SecurityVulns ID: | | 7114 | | Type: | | local | | Level: | | 6/10 | | Description: | | PGPServ.exe/PGPsdkServ.exe Service doesn't validate data received through named pipe \pipe\pgpserv or \pipe\pgpsdkser. |
| Affected: | | PGP : PGP Desktop 9.5 | | CVE: | | CVE-2007-0603 (PGP Desktop before 9.5.1 does not validate data objects received over the (1) \pipe\pgpserv named pipe for PGPServ.exe or the (2) \pipe\pgpsdkserv named pipe for PGPsdkServ.exe, which allows remote authenticated users to gain privileges by sending a data object representing an absolute pointer, which causes code execution at the corresponding address.) |
| Daily web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl) | | Published: | | 28.01.2007 | | Source: | | | | SecurityVulns ID: | | 7115 | | Type: | | remote | | Level: | | 5/10 | | Description: | | PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc. |
| Affected: | | SQLLEDGER : SQL-Ledger 2.6 | | | | LOCI : Local Calendar System 1.1 | | | | OPENADS : Max Media Manager 0.1 | | | | OPENADS : Max Media Manager 0.3 | | | | MOVABLETYPES : Movable Type 3.33 | | | | PHPMM : PHP Membership Manager 1.5 | | | | FDSCRIPT : FdScript 1.3 | | | | LEDGERSMB : LedgerSMB 1.1 | | | | OPENCONFERENCE : Open Conference Systems 2.8 | | CVE: | | CVE-2007-0860 (** DISPUTED ** Multiple PHP remote file inclusion vulnerabilities in local Calendar System 1.1 allow remote attackers to execute arbitrary PHP code via a URL in the (1) TEMPLATE_DIR parameter to (a) showinvoices.php, (b) showmonth.php, (c) showevents.php, (d) retrieveinvoice.php, (e) modifyitem.php, and (f) lookup_userid.php; or the LIBDIR parameter to (g) editevent.php, (h) resetpassword.php, (i) signup.php, showmonth.php, (j) showday.php, showevents.php, and lookup_userid.php. NOTE: this issue has been disputed by a third party, who states that the associated variables are set in config.php before use.) | | | | CVE-2007-0620 (download.php in FD Script 1.3.2 and earlier allows remote attackers to read source of files under the web document root with certain extensions, including .php, via a relative pathname in the fname parameter, as demonstrated by downloading config.php.) | | | | CVE-2007-0604 (Cross-site scripting (XSS) vulnerability in Movable Type (MT) before 3.34 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to the MTCommentPreviewIsStatic tag, which can open the "comment entry screen," a different vulnerability than CVE-2007-0231.) | | | | CVE-2007-0567 (Cross-site scripting (XSS) vulnerability in admin.php in Interactive-Scripts.Com PHP Membership Manager 1.5 allows remote attackers to inject arbitrary web script or HTML via the _p parameter.) | | | | CVE-2006-5872 (login.pl in SQL-Ledger before 2.6.21 and LedgerSMB before 1.1.5 allows remote attackers to execute arbitrary Perl code via the "-e" flag in the script parameter, which is used as an argument to the perl program.) |
| Yahoo Messanger crossaplication scripting | | Published: | | 28.01.2007 | | Source: | | BUGTRAQ | | SecurityVulns ID: | | 7116 | | Type: | | remote | | Level: | | 7/10 | | Description: | | Chat sign in / sign out messages are shown with Internet Explorer allowing scripting in local computer zone. |
| Affected: | | YAHOO : Yahoo! Messenger 8.1 | | CVE: | | CVE-2007-0868 (Unspecified vulnerability in the Chat Room functionality in Yahoo! Messenger 8.1.0.239 and earlier allows remote attackers to cause a denial of service via unspecified vectors. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.) | | | | CVE-2007-0768 (Multiple cross-site scripting (XSS) vulnerabilities in the Contact Details functionality in Yahoo! Messenger 8.1.0.209 and earlier allow user-assisted remote attackers to inject arbitrary web script or HTML via a javascript: URI in the SRC attribute of an IMG element to the (1) First Name, (2) Last Name, and (3) Nickname fields. NOTE: some of these details are obtained from third party information.) |
| chmlib library memory corruption | | Published: | | 28.01.2007 | | Source: | | BUGTRAQ | | SecurityVulns ID: | | 7118 | | Type: | | library | | Level: | | 6/10 | | Description: | | Value from file is used directly in alloca() function call. |
| Affected: | | CHMLIB : CHMlib 0.38 | | | | XCHM : xchm 1.10 | | CVE: | | CVE-2007-0619 (chmlib before 0.39 allows user-assisted remote attackers to execute arbitrary code via a crafted page block length in a CHM file, which triggers memory corruption.) |
| bind named DoS | | Published: | | 28.01.2007 | | Source: | | BUGTRAQ | | SecurityVulns ID: | | 7119 | | Type: | | remote | | Level: | | 5/10 | | Description: | | 2 errors (use-after-free and type ANY response parsing) on response parsing of DNSSEC request. |
| CVE: | | CVE-2007-0494 (ISC BIND 9.0.x, 9.1.x, 9.2.0 up to 9.2.7, 9.3.0 up to 9.3.3, 9.4.0a1 up to 9.4.0a6, 9.4.0b1 up to 9.4.0b4, 9.4.0rc1, and 9.5.0a1 (Bind Forum only) allows remote attackers to cause a denial of service (exit) via a type * (ANY) DNS query response that contains multiple RRsets, which triggers an assertion error, aka the "DNSSEC Validation" vulnerability.) | | | | CVE-2007-0493 (Use-after-free vulnerability in ISC BIND 9.3.0 up to 9.3.3, 9.4.0a1 up to 9.4.0a6, 9.4.0b1 up to 9.4.0b4, 9.4.0rc1, and 9.5.0a1 (Bind Forum only) allows remote attackers to cause a denial of service (named daemon crash) via unspecified vectors that cause named to "dereference a freed fetch context.") |
| Multiple QNX security vulnerabilites | | Published: | | 28.01.2007 | | Source: | | BUGTRAQ | | SecurityVulns ID: | | 7122 | | Type: | | local | | Level: | | 6/10 | | Description: | | Unprivileged user can debug suid applications. Clipboard is world accessible. |
| ulogd buffer overflow | | Published: | | 28.01.2007 | | Source: | | BUGTRAQ | | SecurityVulns ID: | | 7120 | | Type: | | remote | | Level: | | 6/10 |
| Affected: | | ULOGD : ulogd 1.23 | | CVE: | | CVE-2007-0460 (Multiple buffer overflows in ulogd for SUSE Linux 9.3 up to 10.1, and possibly other distributions, have unknown impact and attack vectors related to "improper string length calculations.") |
| IPSwitch WS_FTP unfilterd shell characters security vulnerability | | Published: | | 28.01.2007 | | Source: | | BUGTRAQ | | SecurityVulns ID: | | 7121 | | Type: | | remote | | Level: | | 6/10 | | Description: | | Shell charCters problem on SCP files parsing. |
| Affected: | | IPSWITCH : WS_FTP 2007 | | CVE: | | CVE-2007-0665 (Format string vulnerability in the SCP module in Ipswitch WS_FTP 2007 Professional might allow remote attackers to execute arbitrary commands via format string specifiers in the filename, related to the SHELL WS_FTP script command.) |
| PHP Safe Mod protection bypass | | Published: | | 28.01.2007 | | Source: | | FULL-DISCLOSURE | | SecurityVulns ID: | | 7123 | | Type: | | local | | Level: | | 6/10 | | Description: | | It's possible to traverse working directory protection by using writing mode (srpath://../ file prefix for fopen()). |
| Affected: | | PHP : PHP 5.2 | | CVE: | | CVE-2007-0448 (The fopen function in PHP 5.2.0 does not properly handle invalid URI handlers, which allows context-dependent attackers to bypass safe_mode restrictions and read arbitrary files via a file path specified with an invalid URI, as demonstrated via the srpath URI.) |
Cisco Catalyst switches VTP DoS
updated since 28.01.2007 | | Published: | | 30.01.2007 | | Source: | | BUGTRAQ | | SecurityVulns ID: | | 7117 | | Type: | | remote | | Level: | | 5/10 | | Description: | | Switch crashes on malformed VTP (VLAN Trunking Protocol) Subset-Advert message. |
| CVE: | | CVE-2006-4776 (Heap-based buffer overflow in the VLAN Trunking Protocol (VTP) feature in Cisco IOS 12.1(19) allows remote attackers to execute arbitrary code via a long VLAN name in a VTP type 2 summary advertisement.) | | | | CVE-2006-4775 (The VLAN Trunking Protocol (VTP) feature in Cisco IOS 12.1(19) and CatOS allows remote attackers to cause a denial of service by sending a VTP update with a revision value of 0x7FFFFFFF, which is incremented to 0x80000000 and is interpreted as a negative number in a signed context.) | | | | CVE-2006-4774 (The VLAN Trunking Protocol (VTP) feature in Cisco IOS 12.1(19) allows remote attackers to cause a denial of service by sending a VTP version 1 summary frame with a VTP version field value of 2.) | | | | CVE-2005-4826 (Unspecified vulnerability in the VLAN Trunking Protocol (VTP) feature in Cisco IOS 12.1(22)EA3 on Catalyst 2950T switches allows remote attackers to cause a denial of service (device reboot) via a crafted Subset-Advert message packet, a different issue than CVE-2006-4774, CVE-2006-4775, and CVE-2006-4776.) |
|
|
|
|
|
|
|
|
