sieve-connect was not actually verifying TLS certificate identities
matched the expected hostnameurl>http://mail.globnix.net/pipermail/sieve-connect-anê † † ‚
€‚ Jõ … †* ‚ in in browser
or to upgrade linux-sun-* packages to the non-vulnerable
version.
It is not recommended to run untrusted applets using
appletviewer, since this may lead to the execution of the
malicious code on vulnerable versions on JDK/JRE.
In HTML bugmails, all bug IDs and attachment IDs are
linkified, and hovering these links displays a tooltip
with the bug summary or the attachment description if
the user is allowed to see the bug or attachment.
But when validating user permissions when generating the
email, the permissý€ † † ‚X€‚V †* ‚VDED-FOR
header of an authentication request, an attacker could bypass
the current lockout policy used for protection against brute-
force password discovery. This vulnerability can only be
exploited if the 'inbound_proxies' parameter is set.
Cross Site Scripting
A JavaScript template used by buglisƒ † † }€ [‰7€d †* {
Ubuntu Security Notice USN-1320-1 reports:
A pair of defects cause the server to halt upon processing
certain packets. The patch is to properly discard or process
those packets.
2748
CVE-2011-2749
à † † ]€x {‚Ø<€c †* [ary Shell Command Injection Vulnerability
rubygem-mail
2Secunia reports:
Input passed v–€ † † ‚X€‚V †* ‚Vname>CVE-2011-2878
CVE-2011-2879
CVE-2011-2880
CVE-2011-2881
CVE-2011-3234
CVE-2011-3873
CVE-2011-3873
CVE-2011-3875
CVE-2011-3876
œ † † ‚X€‚V †* ‚V>
CVE-2010-2181
CVE-2010-2182
CVE-2010-2183
CVE-2010-2184
CVE-2010-2185
CVE-2010-2186
CVE-2010-2187
CVE-2010-2188
CVE-2010-2189¢À † † ‚€T T…Ê@® †* ‚
CVE-2009-4032
http://docs.cacti.net/#cross-site_scripting_fixes
2009-11-21
2009-11-230640198a-d117-11de-b667-0030843d3802">
libwmf -- integlibwmf
0.2.8.4_3¯€ † † €B A‚¾„ x†n€W †* >
http://www.washington.edu/imap/documentation/RELNOTES2-16a6713190-dfea-11dd-a765-0030843d3802">
imap-uw -- local buffer overflow vulnµ † † ‚
€‚ U„±? †‚aracters like < in its output. This allows an attacker who
is able to write data into a table to hide or modify records in
the output, and to inject potentially dangerous code, e. g.
Javascript to perform cross-site scripting or cross-site request
forgery»À † † '€ Lá@• uªS †%ckers to execute arbitrary code via a header structure
containing a negative offset, which is used to dereference a
function pointer.) CVE-2008-16Áà † † ‚X€‚V †* ‚Viption>
CVE-2007-5226
http://dircproxy.securiweb.net/ticket/89
https://bugzilla.redhat.com/show_bug.cgi?id=319301
2006-09-06
2007-11-04
2008-01-31
Olivier Dobberkau, Andreas Otto, and Thorsten Kahler report:
An unspecified error in the internal form engine can be used for
sending arbitrary mail headers, using it for purposes which it
is not meaÎ † † €i vƒ™@‹ V†5– †*
ic>gnupg -- buffer overflow
gnupg
1.4.5_1Werner Koch4/000241.html">
ÔÀ † † ‚X€‚V †* ‚Vd>
apache -- mod_rewrite buffer overflow vulnerability
apache
1.3.281.3.36_1
2.0.462.0.58_2
2.2.02.2.2_1
http://secunia.com/advisories/19469/
http://mail.gnome.org/archives/dia-list/2006-March/msg00149.html
3) The problem is that it is possible to bypass the
"access user profile" permission. However, tç † † E® R²<€ `íg † Cthe permissions of the user running
ProFTPD90
http://www.gentoo.org/security/en/glsa/glsa-200508-02.xml
http://www.proftpd.org/docs/RELEASE_NOTES-1.3.0rc2íÀ † † -¹ Y„Ö?€M Ržs¥ †* +name>CVE-2005-0096
CVE-2005-0097fakeauth_auth
2005-01-163b260179-e464-460d-bf9f-d5cda6204020"óà † † z
€^ ^ˆš †* xs.com">http://marc.theaimsgroup.com/?l=bugtraq&m=110987231502274
http://marc.theaimsgroup.com/?l=bugtraq&m=110988400407204
ú€ † † ‚ €I L‚•=€A †* ‚
t>
2004-12-29
2005-01-13
mpg123 --mpg123
mpg123-nas
mpg123-esoundrssh
2.2.1There is a format string bug in rssh that enables an attacker
to execute arbitrary code from an account configured to use
rssh. On FreeBSD it is only possible to compromise the rssh
‚†À † † ;€d I‚Îz€J T‚Ð4‹ †* 9/ge>7.52