These releases address a directory-traversal vulnerability in one of Django's built-in template tags. While this issue requires some fairly specific factors to be exploitable, we encourage all users of Django to upgrad r ty is assigned CVE-2013-3368.
RT 3.8.0 and above allow calling of arbitrary Mason components (without control of arguments) for users who can see administration pages. This could be used by a malicious user to run private components which may have ne₯ΐ V T uΝ@ 7;Tilla
Using a crafted table name, it was possible to produce a
Έ r e>
A flaw was found in the handling of the scoreboard. An
unprivileged child process could cause the parent process to
crash at shutdown rather than terminate cleanly. A flaw was found in the default error response for status code
Δΰ F JσyB r Dgopy23-django
Certain unspecified input passed to the "Indexed Search Engine"
system extension is not properly sanitised before being used to invoke
commands. This can be exploited to inject and execute arbitrary πΐ
v@z r 2
Heap-based buffer φΰ r t point on, the remote server can give as many recipients as it
likes and spamdyke will ignore them all -- they will not be filtered
at all. After that, the remote server can give the DATA command and
send the actual message data. Because spamdyke is coύ W
U Gο dUction which handles the incoming queries from the
clients is affected by a vulnerability which allows an attacker
to crash the server remotely using the smallest RTSP query
possible to use. Secunia Advisory reports: Some vulnerabilities have been reported in lighttpdΐ r ck may lead to administrator
access if certain conditions are met. The way page caching was implemented allows a denial of
service attack. An attacker has to have thΰ r ame>
Andrea Barisani of Gentoo Linux discovered xzgv and zgv
allocate insufficient memory when rendering images with
more than 3 output components, such as images using the
YCCK or CMYK colour space. When xzgv or zgv attempt to
render the image, data 2i ^τ~G r 0ree the dynamic array
of failed addresses, and calls the free() function with an
invalid pointe6-0321 To support MULTIAPPENDS the cmd_append handler uses the
global stage array. This array is one of the things that gets
destructed when the fatal() function is triggered. When the
Cyrus IMAP code adds new enΑΰ
^ r
½?Ύ r age>
Malicious users may spoof DNS lookups if the DNS client UDP port
(random, assigned by OS as startup) is unfiltered and your network
is not protected from IP spoofing.