DELTA 420578 0 22631 SVN† † † † † † œP‡œ]‚‚C£qˆ_¦A‚…ð^¯"š2222e6-a671-60a44ce6887b"> ŒÀ† † Q‚í°„‚í ƒ­‚òP perl 02016-08-22 perl5 perl5.20 perl5.22 perl5-devel 5.19.95.20.2 5.21.05.22.2 5.23.05.23.7 2016-08-22 php56-gd php56-soap php56-wddx php56-xmlrpc 5.6.17PHP reports:

  • Core:
    • Fixed bug #70755 (fpm_log.c memory leak and b¥À† † ‚_ƒX|€~R…v†œj es8477http://www.openwall.com/lists/oss-security/2015/12/05/6 2015-02-19«à† †  ƒ €ƒ †œuƒ /li>
    • Bug 2919 CVE-2015-7852 ntpq atoascii() Memory Corruption Vulnerability. (Cisco TALOS)
    • Bug 2918 CVE-2015-7851 saveconfig Directory Traversal Vulnerability. (OpenVMS) (Cisco TALOS)
    • Bug 2917 CVE-2015-7850 remote config logfile-keyfile. (Cisco TALOS)
    • Bug 2916 CVE-2015-7849 trusted key use-after-free. (Cisco TALOS)
    • Bug 2²€† † h€Nv…Ä@€N‚†œVfpic> graphviz 2.38.0_7Joshua Rogers reports:

      A format string vulnerability has been found in `graphviz'¸ † † ‚—vì?€~†œu‚11.2r202.491Adobe reports:

      Critical vulnerabilities (CVE-2015-5122, CVE-2015-5123) have been identified. Successful exploitation could cause a crash and po¾À† †  ƒ €ƒ †œuƒ lues are extracted from data that has arrived over the network, and those values are subsequently used to figure out what data range to send back.

      The values are used and trusted without boundary checks and are just assumed to be valid. This allows carefully handicrafted packages to trick libcurl into responding and sending off data that was not intendeÄà† †  ƒ €ƒ †œuƒ cvename>CVE-2015-2783 CVE-2015-1351 CVE-2015-1352 ports/199585 2015-04-16 2015-04-25 2015-05-22 wordpress -- mulË€† †  ƒ €ƒ †œuƒ orts:

      Today the Django team is issuing multiple releases -- Django 1.4.18, Django 1.6.10, and Django 1.7.3 -- as part of our security process. These releases are now available on PyPI and our download page.

      These releases address several security issues. We encourage all useÑ † † ´qƒ.€f†œume>phpMyAdmin 4.2.04.2.91.php">

      With a crafted ENUM value it is possible to trigger an XSS in table search and tabl×À† † ‚4€#Y„{€†œu‚2ockquote cite="http://fossil.bsdsx.fr/mohawk/tktview?name=1707f0e351">

      Segfault when parsing malformed / unescaped url, coredump when setting syslog facilityfossil.bsdsx.fr/mohawk/tktview?name=1707f0e351 http://fossil.bsdsx.fr/mohawk/tktview?name=1c7565019e Ýà† † H€dwÖNƒ†6€S†œuFnt files in libXfont libXfont 1.4.7,freedesktop.org4-January/002389.html">

      A BDF font file containing a longer than expected str䀆 † ‚U €‚Su†…@†œ8=‚Sntry>2013-08-07 typo3 -- Multiple vulnerabilities in TYPO3 Core typo3 4.5.04.5.29 4.7.04.7.14 6.1.06.1.ê † † ‚m€a@„÷@€j‚ïR‹‚ðw ƒ¡p‚ü‚k>CVE-2013-3057 http://developer.joomla.org/security/83-20130404-core-xss-vulnerability.html CVE-2013-3056 CVE-2013-3242 CVE-2013-32674-24 2013-04-27

      Due to an eý€† † €e †Ž~†tified>2012-08-25

      The OpenSSL Team reports:

      A flaw in the fix to CVE-2011-4108 can be exploited in a denial of service attack. Only DTLS applications using OpenSSL 1.0.0f aà† †  ‚€‚ †t‚ 7 File upload filename). Reported by Krzysztof Kotowicz. (CVE-2011-2202)

    • Fixed stack buffer overflow in socket_connect(). (CVE-2011-1938)
    • Fixed bug #54238 (use-after-free in substr_replace()). (CVE-2011-1148)
      • –€† †  ‚€‚ †t‚ - Exploitable Stack and Heap Array Overflows asterisk14 1.4.*1.4.39.2 asterisk16 1.6.*1.6.2.1œ † †  ‚€‚ †t‚ ging event handling. Credit to kuzzcc.
      [63444] High Double free in XPath handling. Credit to Yang Dingning from NCNIPC, Graduate University of Chinese Academy of Sciences.

      Fixed in 7.0.517.44:
      [51602] High Use-after-free ¢À† † { €yJƒÍ†=7y http://www.opera.com/support/kb/view/955/ 2010-06-21 2010-06-25 cacti¨à† † @¤N…ã@€†t> arbitrary code in some rare casescvename>CVE-2009-4124 http://www.ruby-lang.org/en/news/2009/12/07/heap-overflow-in-string/ ¯€† † @œNƒ²€"†t>in access the user's displaybid>35015 CVE-2009-1756 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=529306 µ † † 0 €s^„Ë2»†t.ass authorization and cause arbitrary commands to run within the context of the Nagios server. This may aid incvename>CVE-2008-5027 32156 »À† † €Sr‚©@€G†t linux-flashplugin 9.0r124_1 openfire 3.5.0È€† † _½JÉ@¡w‚—?†a^d="20a4eb11-8ea3-11dc-a396-0016179b2dd5"> tikiwikitikiwik 1.9.8.Π† †  ŠyÉ€ †tge>3.2pamAssassin website reports:

      A local user symlÔÀ† †  ‚€‚ †t‚ p://lists.gnupg.org/pipermail/gnupg-announce/2006q4/000491.html">

      GnuPG uses data structures called filters to process OpenPGP messages. These filters are used in a similar way as a pipelines in the shell. For communication between these filtersÚà† † P €NvƒØ@†<8Nsql-server ja-postgresql 7.27.2.7 7.37.3.9 7.47.4.7 8.0.08.0.1ဆ †  ‚€‚ †t‚ ="http://www.w3.org/1999/xhtml">

      Renaud Lifchitz reports a vulnerability within thunderbird. The vulnerability is caused by improper checking of javascript scripts. This could lead to javascript code execution which can lead to information disclosure or ç † †  * €(eþw†s(try> horde -- Cross site scripting vulnerabilities in several of Horde's templateíÀ† †  ‚€‚ †t‚ able to XSS (Cross Site Scripting) attacks. This may be used to launch phising attacks by sending HTML e-mails (i.e.: saying that you need to upgrade to the latest GForge version due to a security problem) and putting in the e-mail an HTML link óà† † < ®R„?€ †t:ences> 2005-06-1012b1a62d-6056-4d90-9e21-45fcde6abae4"> gallery -- remote code injection via HTTP_POST_VARS ú€† † D €VJ÷?€l†tBsh.

    • A bug in the sFlow dissector could make Ethereal crash.
      • 12759 CVE-2005-0699 CVE-2005-0704 http://marc.theaimsgroup.com/?l=full-disclosure&m=110600949323439 http://awstats.sourceforge.net/docs/awstats_changelog.txt http://ww‚†À† †  ‚€‚ †t‚ group.com/?l=full-disclosure&m=109930632317208 2004-11-01 2004-11-10 2004-11-11