SecurityFocus

MDKSA-2004:123 - Updated perl-MIME-tools packages fix vulnerability 2004-11-02
Mandrake Linux Security Team (security linux-mandrake com)

MDKSA-2004:122 - Updated mod_ssl packages fix information disclosure vulnerability 2004-11-02
Mandrake Linux Security Team (security linux-mandrake com)

MDKSA-2004:121 - Updated netatalk packages fix temporary file vulnerability 2004-11-02
Mandrake Linux Security Team (security linux-mandrake com)

MDKSA-2004:120 - Updated mpg123 packages fix vulnerability 2004-11-02
Mandrake Linux Security Team (security linux-mandrake com)

MDKSA-2004:119 - Updated MySQL packages fix multiple vulnerabilities 2004-11-02
Mandrake Linux Security Team (security linux-mandrake com)

MDKSA-2004:118 - Updated perl-Archive-Zip packages fix vulnerability 2004-11-02
Mandrake Linux Security Team (security linux-mandrake com)

MDKSA-2004:117 - Updated gaim packages fix vulnerability 2004-11-02
Mandrake Linux Security Team (security linux-mandrake com)

Multiple Vulnerabilities in Web Forums Server 2004-11-02
R00tCr4ck (root cyberspy org)

#####################################
# CHT Security Research Center-2004 #
# http://www.CyberSpy.Org #
# Turkey #
#####################################

Software:
Web Forums Server

Web Site:
http://www.minihttpserver.net

Affected Version(s):
1.6,2.0 Power Pack

[ more ] [ reply ]

zlib 1.2.2 released 2004-11-01
Mark Adler (madler alumni caltech edu) (1 replies)

Security guardians,

zlib 1.2.2 has been released, which remedies a vulnerability to a
denial-of-service attack ( ). You can get the latest release here:

http://www.zlib.net/

Note that the "canonical" zlib site at http://www.zlib.org/ has yet to
be updated by the owner, Jean-loup Gailly, a

[ more ] [ reply ]

zlib 1.2.2 released 2004-11-02
Mark Adler (madler alumni caltech edu)

Exploiting default exception handler to increase exploit stability on win32 2004-11-01
tal zeltzer (tal zeltzer gmail com)

Summary:

Every win32 application has a default exception handler which can be abused to increase

exploit stability in the case of a stack overflow

Impact:

The results of such attack is an exploit with two return addresses

Proof of Concept:

a tutorial And proof of concept code is

[ more ] [ reply ]

[ GLSA 200411-04 ] Speedtouch USB driver: Privilege escalationvulnerability 2004-11-02
Luke Macken (lewk gentoo org)

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 200411-04
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - -

[ more ] [ reply ]

Cisco Security Advisory: Vulnerability in Cisco Secure Access Control Server EAP-TLS Authentication 2004-11-02
Cisco Systems Product Security Incident Response Team (psirt cisco com)

[SECURITY] [DSA 581-1] New xpdf packages fix arbitrary code execution 2004-11-02
joey infodrom org (Martin Schulze)

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- ------------------------------------------------------------------------
--
Debian Security Advisory DSA 581-1 security (at) debian (dot) org [email concealed]
http://www.debian.org/security/ Martin Schulze
November 2nd, 2004

[ more ] [ reply ]

Medium Risk Vulnerability in WinRAR 2004-11-02
NGSSoftware Insight Security Research (nisr ngssoftware com)

Peter Winter-Smith of NGSSoftware has discovered a medium risk
vulnerability within the 'Repair Archive' feature in WinRAR.

WinRAR versions 3.40 and older are vulnerable to this issue.

This vulnerability has now been fixed by RARLabs in WinRAR version 3.41,
and a fix can be downloaded from the off

[ more ] [ reply ]

[ GLSA 200411-03 ] Apache 1.3: Buffer overflow vulnerability in mod_include 2004-11-02
Matthias Geerdsen (vorlon gentoo org)

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 200411-03
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - -

[ more ] [ reply ]

[USN-15-1] lvm10 vulnerability 2004-11-01
Martin Pitt (martin pitt canonical com)

===========================================================
Ubuntu Security Notice USN-15-1 November 01, 2004
lvm10 vulnerability
CAN-2004-0972
===========================================================

A security issue affects the following Ubuntu releases:

Ubuntu 4.10 (Warty Warthog)

The fo

[ more ] [ reply ]

[CLA-2004:881] Conectiva Security Announcement - rsync 2004-11-01
Conectiva Updates (secure conectiva com br)

[ GLSA 200411-02 ] Cherokee: Format string vulnerability 2004-11-01
Sune Kloppenborg Jeppesen (jaervosz gentoo org)

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 200411-02
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - -

[ more ] [ reply ]

Internet Explorer HTML Help Control ActiveX Cross Domain/Zone Scripting Vulnerabilities 2004-10-31
roozbeh afrasiabi (roozbeh_afrasiabi yahoo com)

TITLE :

Internet Explorer HTML Help Control ActiveX Cross Domain/Zone Scripting Vulnerabilities

Criticality :

Less Critical :)

WHERE :

From remote

Requires user interaction

IMPACT :

Security Bypass

System Access

Exposure of Sensitive Information

SOFTWARE :

Microsoft Internet

[ more ] [ reply ]

Safari vulnerable to URL spoofing 2004-10-31
Gilbert Verdian (gverdian neoresearch org)

Following the discovery by Benjamin Tobias Franz for spoofing URLs in
IE by using tables within links.

http://www.packetstormsecurity.nl/0410-advisories/msieLink.txt

It is possible to spoof URLs under OS X in the latest Safari browser
1.2.3 (v125.9) by using the same method.
Ironically, this doe

[ more ] [ reply ]

[OpenPKG-SA-2004.049] OpenPKG Security Advisory (gd) 2004-10-30
OpenPKG (openpkg openpkg org)

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

________________________________________________________________________

OpenPKG Security Advisory The OpenPKG Project
http://www.openpkg.org/security.html http://www.openpkg.org
openpkg-security (at) openpkg (dot) org [email concealed]

[ more ] [ reply ]

[OpenPKG-SA-2004.050] OpenPKG Security Advisory (libxml) 2004-10-31
OpenPKG (openpkg openpkg org)

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

________________________________________________________________________

OpenPKG Security Advisory The OpenPKG Project
http://www.openpkg.org/security.html http://www.openpkg.org
openpkg-security (at) openpkg (dot) org [email concealed]

[ more ] [ reply ]

[SECURITY] [DSA 580-1] New iptables packages fix modprobe failure 2004-11-01
joey infodrom org (Martin Schulze)

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- ------------------------------------------------------------------------
--
Debian Security Advisory DSA 580-1 security (at) debian (dot) org [email concealed]
http://www.debian.org/security/ Martin Schulze
November 1st, 2004

[ more ] [ reply ]

[OpenPKG-SA-2004.045] OpenPKG Security Advisory (mysql) 2004-10-30
OpenPKG (openpkg openpkg org)

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

________________________________________________________________________

OpenPKG Security Advisory The OpenPKG Project
http://www.openpkg.org/security.html http://www.openpkg.org
openpkg-security (at) openpkg (dot) org [email concealed]

[ more ] [ reply ]

[USN-14-1] xpdf vulnerabilities 2004-11-01
Martin Pitt (martin pitt canonical com)

===========================================================
Ubuntu Security Notice 14-1 November 1, 2004
xpdf vulnerabilities
CAN-2004-0888, CAN-2004-0889
===========================================================

A security issue affects the following Ubuntu releases:

Ubuntu 4.10

[ more ] [ reply ]

[USN-13-1] groff utility vulnerability 2004-11-01
Martin Pitt (martin pitt canonical com)

===========================================================
Ubuntu Security Notice USN-13-1 November 1, 2004
groff utility vulnerability
CAN-2004-0969
===========================================================

A security issue affects the following Ubuntu releases:

Ubuntu 4.10 (Warty W

[ more ] [ reply ]