  <vuln vid="8db2f8b2-9e12-11ea-9e83-0cc47ac16c9d">
    <topic>qmail -- 64 bit integer overflows with possible remote code execution on large SMTP requests</topic>
    <affects>
      <package>
	<name>netqmail</name>
	<range><le>1.06_4</le></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Georgi Guninski writes:</p>
	<blockquote cite="http://www.guninski.com/where_do_you_want_billg_to_go_today_4.html">
	  <p>There are several issues with qmail on 64 bit platforms - classical integer overflow, pointer with signed index and signedness problem (not counting the memory consumtion dos, which just helps).</p>
	  <p>Update: the problem with the signed index is exploitable on Freebsd 5.4 amd64 wih a lot of virtual memory.</p>
	</blockquote>
	<p>The national vulnerability database summarizes:</p>
	<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2005-1513">
	  <p>Integer overflow in the stralloc_readyplus function in qmail, when running on 64 bit platforms with a large amount of virtual memory, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a large SMTP request.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <url>http://www.guninski.com/where_do_you_want_billg_to_go_today_4.html</url>
      <url>https://www.qualys.com/2020/05/19/cve-2005-1513/remote-code-execution-qmail.txt</url>
      <cvename>CVE-2005-1513</cvename>
      <cvename>CVE-2005-1514</cvename>
      <cvename>CVE-2005-1515</cvename>
    </references>
    <dates>
      <discovery>2005-05-06</discovery>
      <entry>2005-05-11</entry>
    </dates>
  </vuln>

  <vuln vid="b495af21-9e10-11ea-9e83-0cc47ac16c9d">
    <topic>qmail -- 64 bit integer overflows with possible remote code execution on large SMTP requests</topic>
    <affects>
      <package>
	<name>netqmail-tls</name>
	<range><le>1.06.20160918_2</le></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Georgi Guninski writes:</p>
	<blockquote cite="http://www.guninski.com/where_do_you_want_billg_to_go_today_4.html">
	  <p>There are several issues with qmail on 64 bit platforms - classical integer overflow, pointer with signed index and signedness problem (not counting the memory consumtion dos, which just helps).</p>
	  <p>Update: the problem with the signed index is exploitable on Freebsd 5.4 amd64 wih a lot of virtual memory.</p>
	</blockquote>
	<p>The national vulnerability database summarizes:</p>
	<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2005-1513">
	  <p>Integer overflow in the stralloc_readyplus function in qmail, when running on 64 bit platforms with a large amount of virtual memory, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a large SMTP request.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <url>http://www.guninski.com/where_do_you_want_billg_to_go_today_4.html</url>
      <url>https://www.qualys.com/2020/05/19/cve-2005-1513/remote-code-execution-qmail.txt</url>
      <cvename>CVE-2005-1513</cvename>
      <cvename>CVE-2005-1514</cvename>
      <cvename>CVE-2005-1515</cvename>
    </references>
    <dates>
      <discovery>2005-05-06</discovery>
      <entry>2005-05-11</entry>
    </dates>
  </vuln>

  <vuln vid="d6540411-9e10-11ea-9e83-0cc47ac16c9d">
    <topic>qmail -- 64 bit integer overflows with possible remote code execution on large SMTP requests</topic>
    <affects>
      <package>
	<name>netqmail-mysql</name>
	<range><le>1.06.1.1.15_1</le></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Georgi Guninski writes:</p>
	<blockquote cite="http://www.guninski.com/where_do_you_want_billg_to_go_today_4.html">
	  <p>There are several issues with qmail on 64 bit platforms - classical integer overflow, pointer with signed index and signedness problem (not counting the memory consumtion dos, which just helps).</p>
	  <p>Update: the problem with the signed index is exploitable on Freebsd 5.4 amd64 wih a lot of virtual memory.</p>
	</blockquote>
	<p>The national vulnerability database summarizes:</p>
	<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2005-1513">
	  <p>Integer overflow in the stralloc_readyplus function in qmail, when running on 64 bit platforms with a large amount of virtual memory, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a large SMTP request.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <url>http://www.guninski.com/where_do_you_want_billg_to_go_today_4.html</url>
      <url>https://www.qualys.com/2020/05/19/cve-2005-1513/remote-code-execution-qmail.txt</url>
      <cvename>CVE-2005-1513</cvename>
      <cvename>CVE-2005-1514</cvename>
      <cvename>CVE-2005-1515</cvename>
    </references>
    <dates>
      <discovery>2005-05-06</discovery>
      <entry>2005-05-11</entry>
    </dates>
  </vuln>

  <vuln vid="43770b1c-72f6-11da-8c1d-000e0c2e438a">
    <topic>nbd-server -- buffer overflow vulnerability</topic>
    <affects>
      <package>
	<name>nbd-server</name>
	<range><lt>2.8.2_1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Kurt Fitzner reports a buffer overflow vulnerability
	  within nbd.  This could potentially allow the execution
	  of arbitrary code on the nbd server.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-3534</cvename>
      <url>http://www.debian.org/security/2005/dsa-924</url>
    </references>
    <dates>
      <discovery>2005-12-21</discovery>
      <entry>2005-12-22</entry>
      <modified>2005-12-25</modified>
    </dates>
  </vuln>

  <vuln vid="b5a49db7-72fc-11da-9827-021106004fd6">
    <topic>scponly -- local privilege escalation exploits</topic>
      <affects>
	<package>
	  <name>scponly</name>
	  <range><lt>4.2</lt></range>
	</package>
      </affects>
      <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Max Vozeler reports:</p>
	<blockquote cite="https://lists.ccs.neu.edu/pipermail/scponly/2005-December/001027.html">
	  <p>If ALL the following conditions are true, administrators using
	    scponly-4.1 or older may be at risk of a local privilege
	    escalation exploit:</p>
	  <ul>
	    <li>the chrooted setuid scponlyc binary is installed</li>
	    <li>regular non-scponly users have interactive shell access
	      to the box</li>
	    <li>a user executable dynamically linked setuid binary
	      (such as ping) exists on the same file system mount
	      as the user's home directory</li>
	    <li>the operating system supports an LD_PRELOAD style
	      mechanism to overload dynamic library loading</li>
	  </ul>
	</blockquote>
	<p>Pekka Pessi also reports:</p>
	<blockquote cite="https://lists.ccs.neu.edu/pipermail/scponly/2005-December/001027.html">
	  <p>If ANY the following conditions are true, administrators
	    using scponly-4.1 or older may be at risk of a local privilege
	    escalation exploit:</p>
	  <ul>
	    <li>scp compatibility is enabled</li>
	    <li>rsync compatibility is enabled</li>
	  </ul>
	</blockquote>
      </body>
    </description>
    <references>
      <url>https://lists.ccs.neu.edu/pipermail/scponly/2005-December/001027.html</url>
      <url>http://sublimation.org/scponly/#relnotes</url>
    </references>
    <dates>
      <discovery>2005-12-21</discovery>
      <entry>2005-12-22</entry>
    </dates>
  </vuln>

  <vuln vid="f7eb0b23-7099-11da-a15c-0060084a00e5">
    <topic>fetchmail -- null pointer dereference in multidrop mode with headerless email</topic>
      <affects>
	<package>
	  <name>fetchmail</name>
	  <range><lt>6.3.1</lt></range>
	</package>
      </affects>
      <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The fetchmail team reports:</p>
	<blockquote cite="http://www.fetchmail.info/fetchmail-SA-2005-03.txt">
	  <p>Fetchmail contains a bug that causes an application crash
	    when fetchmail is configured for multidrop mode and the
	    upstream mail server sends a message without headers.  As
	    fetchmail does not record this message as "previously fetched",
	    it will crash with the same message if it is re-executed, so it
	    cannot make progress. A malicious or broken-into upstream server
	    could thus cause a denial of service in fetchmail clients.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-4348</cvename>
      <url>http://www.fetchmail.info/fetchmail-SA-2005-03.txt</url>
      <url>http://article.gmane.org/gmane.mail.fetchmail.user/7573</url>
      <url>http://bugs.debian.org/343836</url>
    </references>
    <dates>
      <discovery>2005-12-19</discovery>
      <entry>2005-12-19</entry>
    </dates>
  </vuln>

  <vuln vid="82a41084-6ce7-11da-b90c-000e0c2e438a">
    <topic>mantis -- "t_core_path" file inclusion vulnerability</topic>
    <affects>
      <package>
	<name>mantis</name>
	<range><lt>1.0.0rc3</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia Research reports:</p>
	<blockquote cite="http://secunia.com/secunia_research/2005-46/advisory/">
	  <p>Input passed to the "t_core_path" parameter in
	    "bug_sponsorship_list_view_inc.php" isn't properly verified,
	    before it used to include files. This can be exploited to
	    include arbitrary files from external and local
	    resources.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-3335</cvename>
      <url>http://secunia.com/secunia_research/2005-46/advisory/</url>
    </references>
    <dates>
      <discovery>2005-10-26</discovery>
      <entry>2005-12-14</entry>
    </dates>
  </vuln>

  <vuln vid="6e3b12e2-6ce3-11da-b90c-000e0c2e438a">
    <topic>mantis -- "view_filters_page.php" cross-site scripting vulnerability</topic>
    <affects>
      <package>
	<name>mantis</name>
	<range><lt>1.0.0rc4</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>r0t reports:</p>
	<blockquote cite="http://pridels.blogspot.com/2005/12/mantis-bugtracking-system-xss-vuln.html">
	  <p>Mantis contains a flaw that allows a remote cross site
	    scripting attack. This flaw exists because input passed to
	    "target_field" parameter in "view_filters_page.php" isn't
	    properly sanitised before being returned to the user.  This
	    could allow a user to create a specially crafted URL that
	    would execute arbitrary code in a user's browser within the
	    trust relationship between the browser and the server,
	    leading to a loss of integrity.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <bid>15842</bid>
      <url>http://pridels.blogspot.com/2005/12/mantis-bugtracking-system-xss-vuln.html</url>
    </references>
    <dates>
      <discovery>2005-12-13</discovery>
      <entry>2005-12-14</entry>
    </dates>
  </vuln>

  <vuln vid="2506f558-6a8a-11da-b96e-000fb586ba73">
    <topic>mnemo -- Cross site scripting vulnerabilities in several of the notepad name and note data fields</topic>
    <affects>
      <package>
	<name>mnemo</name>
	<range><lt>2.0.3</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Announce of Mnemo H3 (2.0.3) (final):</p>
	<blockquote cite="http://marc.theaimsgroup.com/?l=horde-announce&amp;m=113433279228172&amp;w=2">
	  <p>This [2.0.3] is a security release that fixes cross site
	    scripting vulnerabilities in several of the notepad name
	    and note data fields. None of the vulnerabilities can be
	    exploited by unauthenticated users; however, we strongly
	    recommend that all users of Mnemo 2.0.2 upgrade to 2.0.3
	    as soon as possible.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <url>http://marc.theaimsgroup.com/?l=horde-announce&amp;m=113433279228172&amp;w=2</url>
    </references>
    <dates>
      <discovery>2005-12-11</discovery>
      <entry>2005-12-11</entry>
    </dates>
  </vuln>

  <vuln vid="ee6b5956-6a89-11da-b96e-000fb586ba73">
    <topic>nag -- Cross site scripting vulnerabilities in several of the tasklist name and task data fields</topic>
    <affects>
      <package>
	<name>nag</name>
	<range><lt>2.0.4</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Announce of Nag H3 (2.0.4) (final):</p>
	<blockquote cite="http://marc.theaimsgroup.com/?l=horde-announce&amp;m=113433205826731&amp;w=2">
	  <p>This [2.0.4] is a security release that fixes cross site
	    scripting vulnerabilities in several of the tasklist name
	    and task data fields. None of the vulnerabilities can be
	    exploited by unauthenticated users; however, we strongly
	    recommend that all users of Nag 2.0.3 upgrade to 2.0.4 as
	    soon as possible.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <url>http://marc.theaimsgroup.com/?l=horde-announce&amp;m=113433205826731&amp;w=2</url>
    </references>
    <dates>
      <discovery>2005-12-11</discovery>
      <entry>2005-12-11</entry>
    </dates>
  </vuln>

  <vuln vid="eeebd55d-6a88-11da-b96e-000fb586ba73">
    <topic>turba -- Cross site scripting vulnerabilities in several of the address book name and contact data fields</topic>
    <affects>
      <package>
	<name>turba</name>
	<range><lt>2.0.5</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Announce of Turba H3 (2.0.5) (final):</p>
	<blockquote cite="http://marc.theaimsgroup.com/?l=horde-announce&amp;m=113433120829232&amp;w=2">
	  <p>This [2.0.5] is a security release that fixes cross site
	    scripting vulnerabilities in several of the address book
	    name and contact data fields. None of the vulnerabilities
	    can be exploited by unauthenticated users; however, we
	    strongly recommend that all users of Turba 2.0.4 upgrade
	    to 2.0.5 as soon as possible.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <url>http://marc.theaimsgroup.com/?l=horde-announce&amp;m=113433120829232&amp;w=2</url>
    </references>
    <dates>
      <discovery>2005-12-11</discovery>
      <entry>2005-12-11</entry>
    </dates>
  </vuln>

  <vuln vid="36494478-6a88-11da-b96e-000fb586ba73">
    <topic>kronolith -- Cross site scripting vulnerabilities in several of the calendar name and event data fields</topic>
    <affects>
      <package>
	<name>kronolith</name>
	<range><lt>2.0.6</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Announce of Kronolith H3 (2.0.6) (final):</p>
	<blockquote cite="http://marc.theaimsgroup.com/?l=kronolith&amp;m=113433029822279&amp;w=2">
	  <p>This [2.0.6] is a security release that fixes cross site
	    scripting vulnerabilities in several of the calendar name
	    and event data fields. None of the vulnerabilities can be
	    exploited by unauthenticated users; however, we strongly
	    recommend that all users of Kronolith 2.0.5 upgrade to
	    2.0.6 as soon as possible.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <url>http://marc.theaimsgroup.com/?l=kronolith&amp;m=113433029822279&amp;w=2</url>
    </references>
    <dates>
      <discovery>2005-12-11</discovery>
      <entry>2005-12-11</entry>
    </dates>
  </vuln>

  <vuln vid="01356ccc-6a87-11da-b96e-000fb586ba73">
    <topic>horde -- Cross site scripting vulnerabilities in several of Horde's templates</topic>
    <affects>
      <package>
	<name>horde</name>
	<name>horde-php5</name>
	<range><lt>3.0.8</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Announce of Horde H3 3.0.8 (final):</p>
	<blockquote cite="http://marc.theaimsgroup.com/?l=horde-announce&amp;m=113433346726097&amp;w=2">
	  <p>This [3.0.8] is a security release that fixes cross site
	    scripting vulnerabilities in several of Horde's templates.
	    None of the vulnerabilities can be exploited by
	    unauthenticated users; however, we strongly recommend that
	    all users of Horde 3.0.7 upgrade to 3.0.8 as soon as
	    possible.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <url>http://marc.theaimsgroup.com/?l=horde-announce&amp;m=113433346726097&amp;w=2</url>
    </references>
    <dates>
      <discovery>2005-12-11</discovery>
      <entry>2005-12-11</entry>
    </dates>
  </vuln>

  <vuln vid="9b4facec-6761-11da-99f6-00123ffe8333">
    <topic>curl -- URL buffer overflow vulnerability</topic>
    <affects>
      <package>
	<name>curl</name>
	<range><ge>7.11.2</ge><lt>7.15.1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A Project cURL Security Advisory reports:</p>
	<blockquote cite="http://curl.haxx.se/docs/adv_20051207.html">
	  <p>libcurl's URL parser function can overflow a malloced
	    buffer in two ways, if given a too long URL.</p>
	  <p>1 - pass in a URL with no protocol (like "http://")
	    prefix, using no slash and the string is 256 bytes or
	    longer. This leads to a single zero byte overflow of the
	    malloced buffer.</p>
	  <p>2 - pass in a URL with only a question mark as separator
	    (no slash) between the host and the query part of the URL.
	    This leads to a single zero byte overflow of the malloced
	    buffer.</p>
	  <p>Both overflows can be made with the same input string,
	    leading to two single zero byte overwrites.</p>
	  <p>The affected flaw cannot be triggered by a redirect, but
	    the long URL must be passed in "directly" to libcurl. It
	    makes this a "local" problem. Of course, lots of programs
	    may still pass in user-provided URLs to libcurl without doing
	    much syntax checking of their own, allowing a user to exploit
	    this vulnerability.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <bid>15756</bid>
      <cvename>CVE-2005-4077</cvename>
      <url>http://curl.haxx.se/docs/adv_20051207.html</url>
      <url>http://www.hardened-php.net/advisory_242005.109.html</url>
      <url>http://secunia.com/advisories/17907/</url>
    </references>
    <dates>
      <discovery>2005-12-07</discovery>
      <entry>2005-12-09</entry>
      <modified>2006-01-01</modified>
    </dates>
  </vuln>

  <vuln vid="23afd91f-676b-11da-99f6-00123ffe8333">
    <topic>phpmyadmin -- register_globals emulation "import_blacklist" manipulation</topic>
    <affects>
      <package>
	<name>phpMyAdmin</name>
	<range><lt>2.7.0.1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/17925/">
	  <p>Stefan Esser has reported a vulnerability in phpMyAdmin,
	    which can be exploited by malicious people to conduct
	    cross-site scripting attacks, disclose sensitive
	    information, and compromise a vulnerable system.</p>
	  <p>The vulnerability is caused due to an error in the
	    register_globals emulation layer in "grab_globals.php"
	    where the "import_blacklist" variable is not properly
	    protected from being overwritten. This can be exploited
	    to execute arbitrary HTML and script code in a user's
	    browser session in context of an affected site, and
	    include arbitrary files from external and local resources.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <url>http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-9</url>
      <url>http://www.hardened-php.net/advisory_252005.110.html</url>
      <url>http://secunia.com/advisories/17925/</url>
    </references>
    <dates>
      <discovery>2005-12-07</discovery>
      <entry>2005-12-07</entry>
    </dates>
  </vuln>

  <vuln vid="59ada6e5-676a-11da-99f6-00123ffe8333">
    <topic>phpmyadmin -- XSS vulnerabilities</topic>
    <affects>
      <package>
	<name>phpMyAdmin</name>
	<range><lt>2.7.0</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A phpMyAdmin security advisory reports:</p>
	<blockquote cite="http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-8">
	  <p>It was possible to conduct an XSS attack via the
	    HTTP_HOST variable; also, some scripts in the libraries
	    directory that handle header generation were vulnerable
	    to XSS.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-3665</cvename>
      <url>http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-8</url>
      <url>http://secunia.com/advisories/17895/</url>
    </references>
    <dates>
      <discovery>2005-12-05</discovery>
      <entry>2005-12-07</entry>
    </dates>
  </vuln>

  <vuln vid="964161cd-6715-11da-99f6-00123ffe8333">
    <topic>ffmpeg -- libavcodec buffer overflow vulnerability</topic>
    <affects>
      <package>
	<name>ffmpeg</name>
	<range><lt>0.4.9.p1_4</lt></range>
      </package>
      <package>
	<name>ffmpeg-devel</name>
	<range><lt>0.4.9.c.2005120600</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/17892/">
	  <p>Simon Kilvington has reported a vulnerability in
	    FFmpeg libavcodec, which can be exploited by malicious
	    people to cause a DoS (Denial of Service) and
	    potentially to compromise a user's system.</p>
	  <p>The vulnerability is caused due to a boundary error
	    in the "avcodec_default_get_buffer()" function of
	    "utils.c" in libavcodec. This can be exploited to
	    cause a heap-based buffer overflow when a
	    specially-crafted 1x1 ".png" file containing a palette
	    is read.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <url>http://article.gmane.org/gmane.comp.video.ffmpeg.devel/26558</url>
      <url>http://secunia.com/advisories/17892/</url>
    </references>
    <dates>
      <discovery>2005-11-30</discovery>
      <entry>2005-12-07</entry>
    </dates>
  </vuln>

  <vuln vid="7289187b-66a5-11da-99f6-00123ffe8333">
    <topic>trac -- search module SQL injection vulnerability</topic>
    <affects>
      <package>
	<name>trac</name>
	<range><lt>0.9.2</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/17894/">
	  <p>A vulnerability has been reported in Trac, which
	    can be exploited by malicious people to conduct SQL
	    injection attacks.</p>
	  <p>Some unspecified input passed in the search module
	    isn't properly sanitised before being used in a SQL
	    query. This can be exploited to manipulate SQL
	    queries by injecting arbitrary SQL code.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <url>http://projects.edgewall.com/trac/wiki/ChangeLog#a0.9.2</url>
      <url>http://secunia.com/advisories/17894/</url>
    </references>
    <dates>
      <discovery>2005-12-05</discovery>
      <entry>2005-12-07</entry>
    </dates>
  </vuln>

  <vuln vid="faca0843-6281-11da-8630-00123ffe8333">
    <topic>drupal -- multiple vulnerabilities</topic>
    <affects>
      <package>
	<name>drupal</name>
	<range><lt>4.6.4</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/17824/">
	  <p>Some vulnerabilities have been reported in Drupal,
	    which can be exploited by malicious people to bypass
	    certain security restrictions, and conduct script
	    insertion and HTTP response splitting attacks.</p>
	  <p>1) An input validation error in the filtering of
	    HTML code can be exploited to inject arbitrary
	    JavaScript code in submitted content, which will be
	    executed in a user's browser session in context of
	    an affected site when the malicious user data is
	    viewed.
	    Successful exploitation requires that the user has
	    access to the full HTML input format.
	    Ref: sa-2005-007</p>
	  <p>2) An input validation error in the attachment
	    handling can be exploited to upload a malicious
	    image with embedded HTML and script content, which
	    will be executed in a user's browser session in
	    context of an affected site when viewed directly with
	    the Microsoft Internet Explorer browser.
	    This can also be exploited to inject arbitrary HTTP
	    headers, which will be included in the response sent
	    to the user.
	    Ref: sa-2005-008</p>
	  <p>3) The problem is that it is possible to bypass the
	    "access user profile" permission. However, this cannot
	    be exploited to modify data.
	    Successful exploitation requires that the server runs
	    PHP 5.
	    Ref: sa-2005-009</p>
	</blockquote>
      </body>
    </description>
    <references>
      <url>http://drupal.org/files/sa-2005-007/advisory.txt</url>
      <url>http://drupal.org/files/sa-2005-008/advisory.txt</url>
      <url>http://drupal.org/files/sa-2005-009/advisory.txt</url>
      <url>http://secunia.com/advisories/17824/</url>
    </references>
    <dates>
      <discovery>2005-12-01</discovery>
      <entry>2005-12-01</entry>
    </dates>
  </vuln>

  <vuln vid="d6b092bd-61e1-11da-b64c-0001020eed82">
    <topic>opera -- multiple vulnerabilities</topic>
    <affects>
      <package>
	<name>linux-opera</name>
	<name>opera-devel</name>
	<name>opera</name>
	<range><lt>8.51</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Opera reports:</p>
	<blockquote cite="http://www.opera.com/support/search/supsearch.dml?index=819">
	  <p>It is possible to make a form input that looks like an
	    image link. If the form input has a "title" attribute, the
	    status bar will show the "title". A "title" which looks
	    like a URL can mislead the user, since the title can say
	    http://nice.familiar.com/, while the form action can be
	    something else.</p>
	  <p>Opera's tooltip says "Title:" before the title text,
	    making a spoof URL less convincing. A user who has enabled
	    the status bar and disabled tooltips can be affected by
	    this. Neither of these settings are Opera's defaults.</p>
	  <p>This exploit is mostly of interest to users who disable
	    JavaScript. If JavaScript is enabled, any link target or
	    form action can be overridden by the script. The tooltip
	    and the statusbar can only be trusted to show the true
	    location if JavaScript is disabled.</p>
	</blockquote>
	<blockquote cite="http://www.opera.com/support/search/supsearch.dml?index=817">
	  <p>Java code using LiveConnect methods to remove a property
	    of a JavaScript object may in some cases use null pointers
	    that can make Opera crash. This crash is not exploitable
	    and such code is rare on the web.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-3699</cvename>
      <url>http://secunia.com/advisories/17571/</url>
      <url>http://www.opera.com/support/search/supsearch.dml?index=817</url>
      <url>http://www.opera.com/support/search/supsearch.dml?index=819</url>
    </references>
    <dates>
      <discovery>2005-11-16</discovery>
      <entry>2005-11-30</entry>
    </dates>
  </vuln>

  <vuln vid="dfc1daa8-61de-11da-b64c-0001020eed82">
    <topic>opera -- command line URL shell command injection</topic>
    <affects>
      <package>
	<name>linux-opera</name>
	<name>opera-devel</name>
	<name>opera</name>
	<range><lt>8.51</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>An Opera Advisory reports:</p>
	<blockquote cite="http://www.opera.com/support/search/supsearch.dml?index=818">
	  <p>Opera for UNIX uses a wrapper shell script to start up
	    Opera. This shell script reads the input arguments, like
	    the file names or URLs that Opera is to open. It also
	    performs some environment checks, for example whether Java
	    is available and if so, where it is located.</p>
	  <p>This wrapper script can also run commands embedded in the
	    URL, so that a specially crafted URL can make arbitrary
	    commands run on the recipient's machine. Users who have
	    other programs set up to use Opera to open Web links are
	    vulnerable to this flaw. For these users, clicking a Web
	    link in for example OpenOffice.org or Evolution can run a
	    command that was put into the link.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <bid>15521</bid>
      <cvename>CVE-2005-3750</cvename>
      <url>http://secunia.com/secunia_research/2005-57/advisory/</url>
      <url>http://www.opera.com/support/search/supsearch.dml?index=818</url>
    </references>
    <dates>
      <discovery>2005-11-17</discovery>
      <entry>2005-11-30</entry>
    </dates>
  </vuln>

  <vuln vid="ffb82d3a-610f-11da-8823-00123ffe8333">
    <topic>mambo -- "register_globals" emulation layer overwrite vulnerability</topic>
    <affects>
      <package>
	<name>mambo</name>
	<range><lt>4.5.3</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A Secunia Advisory reports:</p>
	<blockquote cite="http://secunia.com/advisories/17622/">
	  <p>peter MC tachatte has discovered a vulnerability in Mambo,
	    which can be exploited by malicious people to manipulate
	    certain information and compromise a vulnerable system.</p>
	  <p>The vulnerability is caused due to an error in the
	    "register_globals" emulation layer in "globals.php" where
	    certain arrays used by the system can be overwritten. This
	    can be exploited to include arbitrary files from external
	    and local resources via the "mosConfig_absolute_path" parameter.</p>
	  <p>Successful exploitation requires that "register_globals"
	    is disabled.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <url>http://www.mamboserver.com/index.php?option=com_content&amp;task=view&amp;id=172&amp;Itemid=1</url>
      <url>http://secunia.com/advisories/17622/</url>
    </references>
    <dates>
      <discovery>2005-11-17</discovery>
      <entry>2005-11-30</entry>
    </dates>
  </vuln>

  <vuln vid="27a70a01-5f6c-11da-8d54-000cf18bbe54">
    <topic>ghostscript -- insecure temporary file creation vulnerability</topic>
    <affects>
      <package>
	<name>ghostscript-gnu</name>
	<name>ghostscript-gnu-nox11</name>
	<range><lt>7.07_14</lt></range>
      </package>
      <package>
	<name>ghostscript-afpl</name>
	<name>ghostscript-afpl-nox11</name>
	<range><lt>8.53_1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<blockquote cite="http://www.securityfocus.com/bid/11285/discuss">
	  <p>Ghostscript is affected by an insecure temporary file
	    creation vulnerability. This issue is likely due
	    to a design error that causes the application to fail
	    to verify the existence of a file before writing to it.</p>

	  <p>An attacker may leverage this issue to overwrite
	    arbitrary files with the privileges of an unsuspecting
	    user that activates the vulnerable application.
	    Reportedly this issue is unlikely to facilitate
	    privilege escalation.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <bid>11285</bid>
      <cvename>CVE-2004-0967</cvename>
    </references>
    <dates>
      <discovery>2004-10-19</discovery>
      <entry>2005-11-27</entry>
    </dates>
  </vuln>

  <vuln vid="873a6542-5b8d-11da-b96e-000fb586ba73">
    <topic>horde -- Cross site scripting vulnerabilities in MIME viewers</topic>
    <affects>
      <package>
	<name>horde</name>
	<name>horde-php5</name>
	<range><lt>3.0.7</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Announce of Horde 3.0.7 (final):</p>
	<blockquote cite="http://lists.horde.org/archives/announce/2005/000232.html">
	  <p>This [3.0.7] is a security release that fixes cross site
	    scripting vulnerabilities in two of Horde's MIME viewers. These
	    holes could for example be exploited by an attacker sending
	    specially crafted emails to Horde's webmail client IMP. The
	    attack could be used to steal users' identity information, taking
	    over users' sessions, or changing users' settings.</p>
	  <p>As a hotfix the css and tgz MIME drivers can be disabled by
	    removing their entries from the
	    $mime_drivers_map['horde']['registered'] list in
	    horde/config/mime_drivers.php.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <bid>15535</bid>
      <cvename>CVE-2005-3759</cvename>
      <url>http://lists.horde.org/archives/announce/2005/000232.html</url>
    </references>
    <dates>
      <discovery>2005-11-22</discovery>
      <entry>2005-11-22</entry>
      <modified>2005-11-26</modified>
    </dates>
  </vuln>

  <vuln vid="c55f9ed0-56a7-11da-a3f0-00123ffe8333">
    <topic>phpmyadmin -- HTTP Response Splitting vulnerability</topic>
    <affects>
      <package>
	<name>phpMyAdmin</name>
	<range><lt>2.6.4.4</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A phpMyAdmin security advisory reports:</p>
	<blockquote cite="http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-6">
	  <p>Some scripts in phpMyAdmin are vulnerable to an
	    HTTP Response Splitting attack.</p>
	  <p>Severity:</p>
	  <p>We consider these vulnerabilities to be serious.
	    However, they can only be triggered on systems running
	    with register_globals = on.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <url>http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-6</url>
      <url>http://secunia.com/advisories/17578/</url>
      <url>http://www.fitsec.com/advisories/FS-05-02.txt</url>
    </references>
    <dates>
      <discovery>2005-11-15</discovery>
      <entry>2005-11-16</entry>
    </dates>
  </vuln>

  <vuln vid="9c1cea79-548a-11da-b53f-0004614cc33d">
    <topic>phpSysInfo -- "register_globals" emulation layer overwrite vulnerability</topic>
    <affects>
      <package>
	<name>phpSysInfo</name>
	<range><lt>2.5.1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A Secunia Advisory reports:</p>
	<blockquote cite="http://secunia.com/advisories/17441/">
	  <p>Christopher Kunz has reported a vulnerability in
	    phpSysInfo, which can be exploited by malicious people
	    to manipulate certain information.</p>
	  <p>The vulnerability is caused due to an error in
	    the "register_globals" emulation layer where certain
	    arrays used by the system can be overwritten.  This can be
	    exploited to execute arbitrary HTML and script code in
	    a user's browser session and include arbitrary files from
	    local resources.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <url>http://www.hardened-php.net/advisory_222005.81.html</url>
      <url>http://secunia.com/advisories/17441/</url>
    </references>
    <dates>
      <discovery>2005-11-10</discovery>
      <entry>2005-11-13</entry>
      <modified>2005-12-25</modified>
    </dates>
  </vuln>

  <vuln vid="aed343b4-5480-11da-b579-001125afbed7">
    <topic>Macromedia flash player -- swf file handling arbitrary code</topic>
    <affects>
      <package>
	<name>linux-flashplugin6</name>
	<range><le>6.0r79_3</le></range>
      </package>
      <package>
	<name>linux-flashplugin7</name>
	<range><lt>7.0r61</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A Secunia Advisory reports:</p>
	<blockquote cite="http://secunia.com/advisories/17430/">
	  <p>A vulnerability has been reported in Macromedia
	    Flash Player, which can be exploited by malicious
	    people to compromise a user's system.</p>
	  <p>The vulnerability is caused due to missing validation
	    of the frame type identifier that is read from
	    a SWF file.  This value is used as an index in Flash.ocx
	    to reference an array of function pointers.  This can be
	    exploited via a specially crafted SWF file to cause
	    the index to reference memory that is under the attacker's
	    control, which causes Flash Player to use attacker
	    supplied values as function pointers.</p>
	  <p>Successful exploitation allows execution of arbitrary
	    code.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <url>http://www.macromedia.com/devnet/security/security_zone/mpsb05-07.html</url>
      <url>http://secunia.com/advisories/17430/</url>
      <url>http://www.eeye.com/html/research/advisories/AD20051104.html</url>
    </references>
    <dates>
      <discovery>2005-06-27</discovery>
      <entry>2005-11-13</entry>
    </dates>
  </vuln>

  <vuln vid="f4b95430-51d8-11da-8e93-0010dc4afb40">
    <topic>flyspray -- cross-site scripting vulnerabilities</topic>
    <affects>
      <package>
	<name>flyspray</name>
	<range><lt>0.9.8</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A Secunia Advisory reports:</p>
	<blockquote cite="http://secunia.com/advisories/17316/">
	  <p>Lostmon has reported some vulnerabilities in Flyspray,
	    which can be exploited by malicious people to conduct
	    cross-site scripting attacks.</p>
	  <p>Some input isn't properly sanitised before being
	    returned to the user.  This can be exploited to execute
	    arbitrary HTML and script code in a user's browser
	    session in context of an affected site.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <bid>15209</bid>
      <url>http://secunia.com/advisories/17316/</url>
      <url>http://lostmon.blogspot.com/2005/10/flyspray-bug-killer-multiple-variable.html</url>
    </references>
    <dates>
      <discovery>2005-10-26</discovery>
      <entry>2005-11-10</entry>
      <modified>2005-11-29</modified>
    </dates>
  </vuln>

  <vuln vid="7f3fdef7-51d2-11da-8e93-0010dc4afb40">
    <topic>p5-Mail-SpamAssassin -- long message header denial of service</topic>
    <affects>
      <package>
	<name>p5-Mail-SpamAssassin</name>
	<range><lt>3.1.0</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A Secunia Advisory reports:</p>
	<blockquote cite="http://secunia.com/advisories/17386/">
	  <p>A vulnerability has been reported in SpamAssassin,
	    which can be exploited by malicious people to cause
	    a DoS (Denial of Service).</p>
	  <p>The vulnerability is caused due to the use of
	    an inefficient regular expression in
	    "/SpamAssassin/Message.pm" to parse email headers.
	    This can cause perl to crash when it runs out of stack
	    space and can be exploited via a malicious email that
	    contains a large number of recipients.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <url>http://secunia.com/advisories/17386/</url>
      <url>http://issues.apache.org/SpamAssassin/show_bug.cgi?id=4570</url>
    </references>
    <dates>
      <discovery>2005-11-10</discovery>
      <entry>2005-11-10</entry>
    </dates>
  </vuln>

  <vuln vid="eb29a575-3381-11da-8340-000e0c2e438a">
    <topic>qpopper -- multiple privilege escalation vulnerabilities</topic>
    <affects>
      <package>
	<name>qpopper</name>
	<range><ge>4.0</ge><le>4.0.5</le></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Jens Steube reports that qpopper is vulnerable to a privilege
	  escalation vulnerability.  qpopper does not properly drop root
	  privileges so that user supplied configuration and trace files
	  can be processed with root privileges.  This could allow a
	  local attacker to create or modify arbitrary files.</p>
	<p>qpopper is also affected by improper umask settings
	  which could allow users to create group or world-writeable
	  files, possibly allowing an attacker to overwrite arbitrary
	  files.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-1151</cvename>
      <cvename>CVE-2005-1152</cvename>
      <url>http://secunia.com/advisories/15475/</url>
    </references>
    <dates>
      <discovery>2005-05-26</discovery>
      <entry>2005-11-07</entry>
      <modified>2005-11-26</modified>
    </dates>
  </vuln>

  <vuln vid="44e5f5bd-4d76-11da-bf37-000fb586ba73">
    <topic>pear-PEAR -- PEAR installer arbitrary code execution vulnerability</topic>
    <affects>
      <package>
	<name>pear-PEAR</name>
	<range><lt>1.4.3</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Gregory Beaver reports:</p>
	<blockquote cite="http://pear.php.net/advisory-20051104.txt">
	  <p>A standard feature of the PEAR installer implemented in
	    all versions of PEAR can lead to the execution of
	    arbitrary PHP code upon running the "pear" command
	    or loading the Web/Gtk frontend.</p>
	  <p>To be vulnerable, a user must explicitly install a
	    publicly released malicious package using the PEAR
	    installer, or explicitly install a package that depends on
	    a malicious package.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <url>http://pear.php.net/advisory-20051104.txt</url>
    </references>
    <dates>
      <discovery>2005-11-01</discovery>
      <entry>2005-11-04</entry>
    </dates>
  </vuln>

  <vuln vid="3de49331-0dec-422c-93e5-e4719e9869c5">
    <topic>openvpn -- potential denial-of-service on servers in TCP mode</topic>
    <affects>
      <package>
	<name>openvpn</name>
	<range><ge>2.0</ge><lt>2.0.4</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>James Yonan reports:</p>
	<blockquote cite="http://openvpn.net/changelog.html">
	  <p>If the TCP server accept() call returns an error status, the
	    resulting exception handler may attempt to indirect through a NULL
	    pointer, causing a segfault.  Affects all OpenVPN 2.0 versions.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-3409</cvename>
      <url>http://openvpn.net/changelog.html</url>
    </references>
    <dates>
      <discovery>2005-11-01</discovery>
      <entry>2005-11-01</entry>
      <modified>2005-11-04</modified>
    </dates>
  </vuln>

  <vuln vid="6129fdc7-6462-456d-a3ef-8fc3fbf44d16">
    <topic>openvpn -- arbitrary code execution on client through malicious or compromised server</topic>
    <affects>
      <package>
	<name>openvpn</name>
	<range><ge>2.0</ge><lt>2.0.4</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>James Yonan reports:</p>
	<blockquote cite="http://openvpn.net/changelog.html">
	  <p>A format string vulnerability
	    in the foreign_option function in options.c could
	    potentially allow a malicious or compromised server
	    to execute arbitrary code on the client.  Only
	    non-Windows clients are affected.  The vulnerability
	    only exists if (a) the client's TLS negotiation with
	    the server succeeds, (b) the server is malicious or
	    has been compromised such that it is configured to
	    push a maliciously crafted options string to the client,
	    and (c) the client indicates its willingness to accept
	    pushed options from the server by having "pull" or
	    "client" in its configuration file (Credit: Vade79).</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-3393</cvename>
      <mlist>http://www.securityfocus.com/archive/1/415293/30/0/threaded</mlist>
      <url>http://openvpn.net/changelog.html</url>
    </references>
    <dates>
      <discovery>2005-10-31</discovery>
      <entry>2005-11-01</entry>
      <modified>2005-11-04</modified>
    </dates>
  </vuln>

  <vuln vid="6821a2db-4ab7-11da-932d-00055d790c25">
    <topic>PHP -- multiple vulnerabilities</topic>
    <affects>
     <package>
	<name>mod_php4-twig</name>
	<name>php4-cgi</name>
	<name>php4-cli</name>
	<name>php4-dtc</name>
	<name>php4-horde</name>
	<name>php4-nms</name>
	<name>php4</name>
	<range><lt>4.4.1</lt></range>
      </package>
      <package>
	<name>mod_php</name>
	<name>mod_php4</name>
	<range><ge>4</ge><lt>4.4.1,1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A Secunia Advisory reports:</p>
	<blockquote cite="http://secunia.com/advisories/17371/">
	  <p>Some vulnerabilities have been reported in PHP,
	    which can be exploited by malicious people to conduct
	    cross-site scripting attacks, bypass certain security
	    restrictions, and potentially compromise a vulnerable
	    system.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <url>http://secunia.com/advisories/17371/</url>
    </references>
    <dates>
      <discovery>2005-10-31</discovery>
      <entry>2005-11-01</entry>
    </dates>
  </vuln>

  <vuln vid="70fc13d9-4ab4-11da-932d-00055d790c25">
    <topic>skype -- multiple buffer overflow vulnerabilities</topic>
    <affects>
     <package>
	<name>skype</name>
	<range><lt>1.2.0.18</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A Secunia Advisory reports:</p>
	<blockquote cite="http://secunia.com/advisories/17305/">
	  <p>Some vulnerabilities have been reported in Skype,
	    which can be exploited by malicious people to cause
	    a DoS or to compromise a user's system.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-3265</cvename>
      <cvename>CVE-2005-3267</cvename>
      <certvu>930345</certvu>
      <certvu>668193</certvu>
      <url>http://secunia.com/advisories/17305/</url>
      <url>http://skype.com/security/skype-sb-2005-02.html</url>
      <url>http://skype.com/security/skype-sb-2005-03.html</url>
    </references>
    <dates>
      <discovery>2005-10-25</discovery>
      <entry>2005-11-01</entry>
      <modified>2005-11-02</modified>
    </dates>
  </vuln>

  <vuln vid="1c3142a3-4ab2-11da-932d-00055d790c25">
    <topic>squid -- FTP server response handling denial of service</topic>
    <affects>
     <package>
	<name>squid</name>
	<range><lt>2.5.11_3</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A Secunia Advisory reports:</p>
	<blockquote cite="http://secunia.com/advisories/17271/">
	  <p>M.A.Young has reported a vulnerability in Squid,
	    which can be exploited by malicious people to cause
	    a DoS (Denial of Service).</p>
	  <p>The vulnerability is caused due to an error in
	    handling certain FTP server responses. This can be
	    exploited to crash Squid by visiting a malicious FTP
	    server via the proxy.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-3258</cvename>
      <url>http://secunia.com/advisories/17271/</url>
    </references>
    <dates>
      <discovery>2005-10-19</discovery>
      <entry>2005-11-01</entry>
    </dates>
  </vuln>

  <vuln vid="f38c87a5-4a3e-11da-8ba2-0004614cc33d">
    <topic>base -- PHP SQL injection vulnerability</topic>
    <affects>
     <package>
	<name>base</name>
	<range><lt>1.2.1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A Secunia Advisory reports:</p>
	<blockquote cite="http://secunia.com/advisories/17314/">
	  <p>Remco Verhoef has discovered a vulnerability in
	    Basic Analysis and Security Engine (BASE), which
	    can be exploited by malicious users to conduct SQL
	    injection attacks.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <bid>15199</bid>
      <url>http://secunia.com/advisories/17314/</url>
    </references>
    <dates>
      <discovery>2005-10-25</discovery>
      <entry>2005-10-31</entry>
    </dates>
  </vuln>

  <vuln vid="baf74e0b-497a-11da-a4f4-0060084a00e5">
    <topic>fetchmail -- fetchmailconf local password exposure</topic>
    <affects>
     <package>
	<name>fetchmail</name>
	<range><lt>6.2.5.2_1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The fetchmail team reports:</p>
	<blockquote cite="http://www.fetchmail.info/fetchmail-SA-2005-02.txt">
	  <p>The fetchmailconf program before and excluding version
	    1.49 opened the run control file, wrote the configuration
	    to it, and only then changed the mode to 0600 (rw-------).
	    Writing the file, which usually contains passwords, before
	    making it unreadable to other users, can expose sensitive
	    password information.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-3088</cvename>
      <url>http://www.fetchmail.info/fetchmail-SA-2005-02.txt</url>
    </references>
    <dates>
      <discovery>2005-10-21</discovery>
      <entry>2005-10-30</entry>
    </dates>
  </vuln>

  <vuln vid="c01170bf-4990-11da-a1b8-000854d03344">
    <topic>lynx -- remote buffer overflow</topic>
    <affects>
      <package>
	<name>lynx</name>
	<name>ja-lynx</name>
	<range><lt>2.8.5_1</lt></range>
	<range><gt>2.8.6*</gt><lt>2.8.6d14</lt></range>
      </package>
      <package>
	<name>lynx-ssl</name>
	<range><lt>2.8.5_1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Ulf Härnhammar reports:</p>
	<blockquote cite="http://lists.grok.org.uk/pipermail/full-disclosure/2005-October/038019.html">
	  <p>When Lynx connects to an NNTP server to fetch information
	    about the available articles in a newsgroup, it will
	    call a function called HTrjis() with the information
	    from certain article headers. The function adds missing
	    ESC characters to certain data, to support Asian character
	    sets. However, it does not check if it writes outside
	    of the char array buf, and that causes a remote stack-based
	    buffer overflow.</p>
	</blockquote>
      </body>
    </description> <references>
      <cvename>CVE-2005-3120</cvename>
      <url>http://lists.grok.org.uk/pipermail/full-disclosure/2005-October/038019.html</url>
    </references> <dates>
      <discovery>2005-10-17</discovery>
      <entry>2005-10-30</entry>
      <modified>2006-10-05</modified>
    </dates>
  </vuln>

  <vuln vid="1daea60a-4719-11da-b5c6-0004614cc33d">
    <topic>ruby -- vulnerability in the safe level settings</topic>
    <affects>
      <package>
	<name>ruby</name>
	<name>ruby_static</name>
	<range><gt>1.6.*</gt><lt>1.6.8.2004.07.28_2</lt></range>
	<range><gt>1.8.*</gt><lt>1.8.2_5</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Ruby home page reports:</p>
	<blockquote cite="http://www.ruby-lang.org/en/20051003.html">
	  <p>The Object Oriented Scripting Language Ruby supports
	    safely executing an untrusted code with two mechanisms:
	    safe level and taint flag on objects.</p>
	  <p>A vulnerability has been found that allows bypassing
	    these mechanisms.</p>
	  <p>By using the vulnerability, arbitrary code can be executed
	    beyond the restrictions specified in each safe level.
	    Therefore, Ruby has to be updated on all systems that use
	    safe level to execute untrusted code.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-2337</cvename>
      <url>http://www.ruby-lang.org/en/20051003.html</url>
    </references>
    <dates>
      <discovery>2005-10-02</discovery>
      <entry>2005-10-27</entry>
    </dates>
  </vuln>

  <vuln vid="2f0cb4bb-416d-11da-99fe-000854d03344">
    <topic>xloadimage -- buffer overflows in NIFF image title handling</topic>
    <affects>
      <package>
	<name>xloadimage</name>
	<range><lt>4.1.15</lt></range>
      </package>
      <package>
	<name>xli</name>
	<range><lt>1.17.0_4</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Ariel Berkman reports:</p>
	<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=112862493918840&amp;w=2">
	  <p>Unlike most of the supported image formats in xloadimage,
	    the NIFF image format can store a title name of arbitrary
	    length as part of the image file.</p>
	  <p>When xloadimage is processing a loaded image, it is
	    creating a new Image object and then writing the processed
	    image to it. At that point, it will also copy the title
	    from the old image to the newly created image.</p>
	  <p>The 'zoom', 'reduce', and 'rotate' functions are using
	    a fixed length buffer to construct the new title name
	    when an image processing is done.  Since the title name
	    in a NIFF format is of varying length, and there are
	    insufficient buffer size validations, the buffer can
	    be overflowed.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <bid>15051</bid>
      <cvename>CVE-2005-3178</cvename>
      <mlist msgid="BOEKKJLADFNHIEFBHCECMEONCFAA.aberkm1@uic.edu">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=112862493918840&amp;w=2</mlist>
    </references>
    <dates>
      <discovery>2005-10-05</discovery>
      <entry>2005-10-20</entry>
      <modified>2005-10-23</modified>
    </dates>
  </vuln>

  <vuln vid="97d45e95-3ffc-11da-a263-0001020eed82">
    <topic>snort -- Back Orifice preprocessor buffer overflow vulnerability</topic>
    <affects>
      <package>
	<name>snort</name>
	<range><ge>2.4.0</ge><lt>2.4.3</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Jennifer Steffens reports:</p>
	<blockquote cite="http://www.snort.org/pub-bin/snortnews.cgi#99">
	  <p>The Back Orifice preprocessor contains a stack-based
	    buffer overflow. This vulnerability could be leveraged by
	    an attacker to execute code remotely on a Snort sensor
	    where the Back Orifice preprocessor is enabled. However,
	    there are a number of factors that make remote code
	    execution difficult to achieve across different builds of
	    Snort on different platforms, even on the same platform
	    with different compiler versions, and it is more likely
	    that an attacker could use the vulnerability as a denial
	    of service attack.</p>
	  <p>The Back Orifice preprocessor can be disabled by
	    commenting out the line "preprocessor bo" in
	    snort.conf. This can be done in any text editor using the
	    following procedure:</p>
	  <ol>
	    <li>Locate the line "preprocessor bo"</li>
	    <li>Comment out this line by preceding it with a hash
	      (#). The new line will look like "#preprocessor bo"</li>
	    <li>Save the file</li>
	    <li>Restart snort</li>
	  </ol>
	</blockquote>
      </body>
    </description>
    <references>
      <certvu>175500</certvu>
      <url>http://www.snort.org/pub-bin/snortnews.cgi#99</url>
      <url>http://xforce.iss.net/xforce/alerts/id/207</url>
    </references>
    <dates>
      <discovery>2005-10-18</discovery>
      <entry>2005-10-18</entry>
    </dates>
  </vuln>

  <vuln vid="60f8fe7b-3cfb-11da-baa2-0004614cc33d">
    <topic>WebCalendar -- remote file inclusion vulnerability</topic>
    <affects>
      <package>
	<name>WebCalendar</name>
	<range><lt>1.0.1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>WebCalendar is proven vulnerable to a remote file inclusion
	  vulnerability.  The send_reminders.php does not properly
	  verify the "includedir" parameter, giving remote attackers
	  the possibility to include local and remote files.  These
	  files can be used by the attacker to gain access to the
	  system.</p>
      </body>
    </description>
    <references>
      <bid>14651</bid>
      <cvename>CVE-2005-2717</cvename>
      <url>http://sourceforge.net/forum/forum.php?thread_id=1342085&amp;forum_id=11587</url>
    </references>
    <dates>
      <discovery>2005-08-26</discovery>
      <entry>2005-10-15</entry>
      <modified>2005-11-08</modified>
    </dates>
  </vuln>

  <vuln vid="47bdabcf-3cf9-11da-baa2-0004614cc33d">
    <topic>gallery2 -- file disclosure vulnerability</topic>
    <affects>
      <package>
	<name>gallery2</name>
	<range><lt>2.0.1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Michael Dipper wrote:</p>
	<blockquote cite="http://dipper.info/security/20051012/">
	  <p>A vulnerability has been discovered in gallery,
	    which allows remote users unauthorized access to files
	    on the webserver.</p>
	  <p>A remote user accessing gallery over the web may use
	    specially crafted HTTP parameters to access arbitrary
	    files located on the webserver. All files readable by
	    the webserver process are subject to disclosure.
	    The vulnerability is *not* restricted to the webserver's
	    document root but extends to the whole server file space.</p>
	  <p>The vulnerability may be used by any anonymous user,
	    there is no login to the application required.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <bid>15108</bid>
      <cvename>CVE-2005-3251</cvename>
      <url>http://dipper.info/security/20051012/</url>
    </references>
    <dates>
      <discovery>2005-10-12</discovery>
      <entry>2005-10-15</entry>
      <modified>2005-11-08</modified>
    </dates>
  </vuln>

  <vuln vid="60e26a40-3b25-11da-9484-00123ffe8333">
    <topic>openssl -- potential SSL 2.0 rollback</topic>
    <affects>
      <package>
	<name>openssl</name>
	<name>openssl-overwrite-base</name>
	<range><le>0.9.7g</le></range>
	<range><ge>0.9.8</ge><le>0.9.8_1</le></range>
	<range><ge>0.9.*_20050325</ge><le>0.9.*_20051011</le></range>
      </package>
      <package>
	<name>openssl-beta</name>
	<name>openssl-beta-overwrite-base</name>
	<range><le>0.9.8_1</le></range>
	<range><ge>0.9.*_20050325</ge><le>0.9.*_20051011</le></range>
      </package>
      <package>
	<name>compat5x-alpha</name>
	<name>compat5x-amd64</name>
	<name>compat5x-i386</name>
	<name>compat5x-sparc64</name>
	<range><lt>5.4.0.8</lt></range>
      </package>
      <package>
	<name>FreeBSD</name>
	<range><lt>4.10_19</lt></range>
	<range><ge>4.11</ge><lt>4.11_13</lt></range>
	<range><ge>5.3</ge><lt>5.3_23</lt></range>
	<range><ge>5.4</ge><lt>5.4_8</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Vulnerability:</p>
	<blockquote cite="http://www.openssl.org/news/secadv_20051011.txt">
	  <p>Such applications are affected if they use the option
	    SSL_OP_MSIE_SSLV2_RSA_PADDING.  This option is implied by use of
	    SSL_OP_ALL, which is intended to work around various bugs in
	    third-party software that might prevent interoperability.  The
	    SSL_OP_MSIE_SSLV2_RSA_PADDING option disables a verification step in
	    the SSL 2.0 server supposed to prevent active protocol-version
	    rollback attacks.  With this verification step disabled, an attacker
	    acting as a "man in the middle" can force a client and a server to
	    negotiate the SSL 2.0 protocol even if these parties both support
	    SSL 3.0 or TLS 1.0.  The SSL 2.0 protocol is known to have severe
	    cryptographic weaknesses and is supported as a fallback only.</p>
	  <p>Applications using neither SSL_OP_MSIE_SSLV2_RSA_PADDING nor
	    SSL_OP_ALL are not affected.  Also, applications that disable
	    use of SSL 2.0 are not affected.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <freebsdsa>SA-05:21.openssl</freebsdsa>
      <cvename>CVE-2005-2969</cvename>
      <url>http://www.openssl.org/news/secadv_20051011.txt</url>
    </references>
    <dates>
      <discovery>2005-10-11</discovery>
      <entry>2005-10-12</entry>
      <modified>2005-10-25</modified>
    </dates>
  </vuln>

  <vuln vid="9b7053fd-3ab5-11da-9484-00123ffe8333">
    <topic>phpmyadmin -- local file inclusion vulnerability</topic>
    <affects>
      <package>
	<name>phpMyAdmin</name>
	<range><ge>2.6.4.r1</ge><le>2.6.4.1</le></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A phpMyAdmin security announcement reports:</p>
	<blockquote cite="http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-4">
	  <p>In libraries/grab_globals.lib.php, the $__redirect
	    parameter was not correctly validated, opening the door to
	    a local file inclusion attack.</p>
	  <p>We consider this vulnerability to be serious.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <bid>15053</bid>
      <mlist msgid="20051010161119.1689.qmail@securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=112907764728209</mlist>
      <url>http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-4</url>
    </references>
    <dates>
      <discovery>2005-10-11</discovery>
      <entry>2005-10-11</entry>
      <modified>2005-10-13</modified>
    </dates>
  </vuln>

  <vuln vid="d2b80c7c-3aae-11da-9484-00123ffe8333">
    <topic>zope -- expose RestructuredText functionality to untrusted users</topic>
    <affects>
      <package>
	<name>zope</name>
	<range><ge>2.6.0</ge><lt>2.7.8</lt></range>
	<range><ge>2.8.0</ge><le>2.8.1_2</le></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A Zope Hotfix Alert reports:</p>
	<blockquote cite="http://www.zope.org/Products/Zope/Hotfix_2005-10-09/security_alert">
	  <p>This hotfix resolves a security issue with docutils.</p>
	  <p>Affected are possibly all Zope instances that expose
	    RestructuredText functionalies to untrusted users through
	    the web.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-3323</cvename>
      <bid>15082</bid>
      <url>http://www.zope.org/Products/Zope/Hotfix_2005-10-09/security_alert</url>
    </references>
    <dates>
      <discovery>2005-10-09</discovery>
      <entry>2005-10-11</entry>
      <modified>2005-11-28</modified>
    </dates>
  </vuln>

  <vuln vid="3bc5691e-38dd-11da-92f5-020039488e34">
    <topic>libxine -- format string vulnerability</topic>
    <affects>
      <package>
	<name>libxine</name>
	<range><lt>1.1.0_1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Gentoo Linux Security Advisory reports:</p>
	<blockquote cite="http://www.gentoo.org/security/en/glsa/glsa-200510-08.xml">
	  <p>Ulf Harnhammar discovered a format string bug in the routines
	    handling CDDB server response contents.</p>
	  <p>An attacker could submit malicious information about an audio
	    CD to a public CDDB server (or impersonate a public CDDB server).
	    When the victim plays this CD on a multimedia frontend relying
	    on xine-lib, it could end up executing arbitrary code.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-2967</cvename>
      <url>http://www.gentoo.org/security/en/glsa/glsa-200510-08.xml</url>
      <url>http://xinehq.de/index.php/security/XSA-2005-1</url>
    </references>
    <dates>
      <discovery>2005-10-08</discovery>
      <entry>2005-10-09</entry>
    </dates>
  </vuln>

  <vuln vid="1f6e2ade-35c2-11da-811d-0050bf27ba24">
    <topic>imap-uw -- mailbox name handling remote buffer vulnerability</topic>
    <affects>
      <package>
	<name>imap-uw</name>
	<range><lt>2004g</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>FrSIRT reports:</p>
	<blockquote cite="http://www.frsirt.com/english/advisories/2005/1953">
	  <p>A vulnerability has been identified in UW-IMAP, which could
	    be exploited by remote attackers to execute arbitrary commands.
	    This flaw is due to a stack overflow error in the
	    "mail_valid_net_parse_work()" [src/c-client/mail.c] function that
	    does not properly handle specially crafted mailbox names containing
	    a quote (") character, which could be exploited by authenticated
	    remote attackers to execute arbitrary commands with the privileges
	    of the IMAP server.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-2933</cvename>
      <url>http://www.frsirt.com/english/advisories/2005/1953</url>
      <url>http://www.idefense.com/application/poi/display?id=313&amp;type=vulnerabilities</url>
      <url>http://www.washington.edu/imap/documentation/RELNOTES.html</url>
    </references>
    <dates>
      <discovery>2005-10-05</discovery>
      <entry>2005-10-05</entry>
    </dates>
  </vuln>

  <vuln vid="d4c70df5-335d-11da-9c70-0040f42d58c6">
    <topic>weex -- remote format string vulnerability</topic>
    <affects>
      <package>
	<name>weex</name>
	<range><lt>2.6.1.5_1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Emanuel Haupt reports:</p>
	<blockquote>
	  <p>Someone who controls an FTP server that weex will log in to
	    can set up malicious data in the account that weex will use,
	    and that will cause a format string bug that will allow remote
	    code execution. It will only happen when weex is first run or
	    when its cache files are rebuilt with the -r option,
	    though. The vulnerability was found by Ulf Harnhammar.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <freebsdpr>ports/86833</freebsdpr>
    </references>
    <dates>
      <discovery>2005-10-02</discovery>
      <entry>2005-10-02</entry>
    </dates>
  </vuln>

  <vuln vid="8a3ece40-3315-11da-a263-0001020eed82">
    <topic>picasm -- buffer overflow vulnerability</topic>
    <affects>
      <package>
	<name>picasm</name>
	<range><lt>1.12c</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Shaun Colley reports:</p>
	<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=111661253517089">
	  <p>When generating error and warning messages, picasm copies
	    strings into fixed length buffers without bounds
	    checking.</p>
	  <p>If an attacker could trick a user into assembling a
	    source file with a malformed 'error' directive, arbitrary
	    code could be executed with the privileges of the user.
	    This could result in full system compromise.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <bid>13698</bid>
      <cvename>CVE-2005-1679</cvename>
      <mlist msgid="c522a35a0505200807744163c4@mail.gmail.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=111661253517089</mlist>
    </references>
    <dates>
      <discovery>2005-05-20</discovery>
      <entry>2005-10-02</entry>
    </dates>
  </vuln>

  <vuln vid="1e606080-3293-11da-ac91-020039488e34">
    <topic>uim -- privilege escalation vulnerability</topic>
    <affects>
      <package>
	<name>ja-uim</name>
	<range><lt>0.4.9.1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The uim developers reports:</p>
	<blockquote cite="http://lists.freedesktop.org/archives/uim/2005-September/001346.html">
	  <p>Masanari Yamamoto discovered that incorrect use
	    of environment variables in uim. This bug causes
	    privilege escalation if setuid/setgid applications
	    was linked to libuim.</p>
	  <p>This bug appears in 'immodule for Qt' enabled Qt.
	    (Normal Qt is also safe.) In some distribution,
	    mlterm is also an setuid/setgid application.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <url>http://lists.freedesktop.org/archives/uim/2005-September/001346.html</url>
    </references>
    <dates>
      <discovery>2005-09-28</discovery>
      <entry>2005-10-01</entry>
    </dates>
  </vuln>

  <vuln vid="8688d5cd-328c-11da-a263-0001020eed82">
    <topic>cfengine -- arbitrary file overwriting vulnerability</topic>
    <affects>
      <package>
	<name>cfengine</name>
	<range><lt>2.1.6_1</lt></range>
      </package>
      <package>
	<name>cfengine2</name>
	<range><gt>0</gt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A Debian Security Advisory reports:</p>
	<blockquote cite="http://www.debian.org/security/2005/dsa-835">
	  <p>Javier Fernández-Sanguino Peña discovered several
	    insecure temporary file uses in cfengine, a tool for
	    configuring and maintaining networked machines, that can
	    be exploited by a symlink attack to overwrite arbitrary
	    files owned by the user executing cfengine, which is
	    probably root.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-2960</cvename>
      <bid>14994</bid>
      <url>http://www.debian.org/security/2005/dsa-835</url>
      <url>http://www.debian.org/security/2005/dsa-836</url>
    </references>
    <dates>
      <discovery>2005-10-01</discovery>
      <entry>2005-10-01</entry>
      <modified>2005-10-07</modified>
    </dates>
  </vuln>

  <vuln vid="271498a9-2cd4-11da-a263-0001020eed82">
    <topic>clamav -- arbitrary code execution and DoS vulnerabilities</topic>
    <affects>
      <package>
	<name>clamav</name>
	<range><lt>0.87</lt></range>
      </package>
      <package>
	<name>clamav-devel</name>
	<range><lt>20050917</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Gentoo Linux Security Advisory reports:</p>
	<blockquote cite="http://www.gentoo.org/security/en/glsa/glsa-200509-13.xml">
	  <p>Clam AntiVirus is vulnerable to a buffer overflow in
	    "libclamav/upx.c" when processing malformed UPX-packed
	    executables. It can also be sent into an infinite loop in
	    "libclamav/fsg.c" when processing specially-crafted
	    FSG-packed executables.</p>
	  <p>By sending a specially-crafted file an attacker could
	    execute arbitrary code with the permissions of the user
	    running Clam AntiVirus, or cause a Denial of Service.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <certvu>363713</certvu>
      <cvename>CVE-2005-2919</cvename>
      <cvename>CVE-2005-2920</cvename>
      <url>http://www.gentoo.org/security/en/glsa/glsa-200509-13.xml</url>
    </references>
    <dates>
      <discovery>2005-09-16</discovery>
      <entry>2005-09-24</entry>
      <modified>2005-10-22</modified>
    </dates>
  </vuln>

  <vuln vid="8f5dd74b-2c61-11da-a263-0001020eed82">
    <topic>firefox &amp; mozilla -- multiple vulnerabilities</topic>
    <affects>
      <package>
	<name>firefox</name>
	<range><lt>1.0.7,1</lt></range>
      </package>
      <package>
	<name>linux-firefox</name>
	<range><lt>1.0.7</lt></range>
      </package>
      <package>
	<name>mozilla</name>
	<range><lt>1.7.12,2</lt></range>
	<range><ge>1.8.*,2</ge></range>
      </package>
      <package>
	<name>linux-mozilla</name>
	<range><lt>1.7.12</lt></range>
      </package>
      <package>
	<name>linux-mozilla-devel</name>
	<range><gt>0</gt></range>
      </package>
      <package>
	<name>netscape7</name>
	<range><ge>0</ge></range>
      </package>
      <package>
	<!-- These ports are obsolete. -->
	<name>de-linux-mozillafirebird</name>
	<name>el-linux-mozillafirebird</name>
	<name>ja-linux-mozillafirebird-gtk1</name>
	<name>ja-mozillafirebird-gtk2</name>
	<name>linux-mozillafirebird</name>
	<name>ru-linux-mozillafirebird</name>
	<name>zhCN-linux-mozillafirebird</name>
	<name>zhTW-linux-mozillafirebird</name>
	<range><ge>0</ge></range>
      </package>
      <package>
	<!-- These package names are obsolete. -->
	<name>de-linux-netscape</name>
	<name>de-netscape7</name>
	<name>fr-linux-netscape</name>
	<name>fr-netscape7</name>
	<name>ja-linux-netscape</name>
	<name>ja-netscape7</name>
	<name>linux-netscape</name>
	<name>linux-phoenix</name>
	<name>mozilla+ipv6</name>
	<name>mozilla-embedded</name>
	<name>mozilla-firebird</name>
	<name>mozilla-gtk1</name>
	<name>mozilla-gtk2</name>
	<name>mozilla-gtk</name>
	<name>mozilla-thunderbird</name>
	<name>phoenix</name>
	<name>pt_BR-netscape7</name>
	<range><ge>0</ge></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A Mozilla Foundation Security Advisory reports of multiple
	  issues:</p>
	<blockquote cite="http://www.mozilla.org/security/announce/mfsa2005-58.html">
	  <h1>Heap overrun in XBM image processing</h1>
	  <p>jackerror reports that an improperly terminated XBM image
	    ending with space characters instead of the expected end
	    tag can lead to a heap buffer overrun. This appears to be
	    exploitable to install or run malicious code on the user's
	    machine.</p>
	  <p>Thunderbird does not support the XBM format and is not
	    affected by this flaw.</p>
	  <h1>Crash on "zero-width non-joiner" sequence</h1>
	  <p>Mats Palmgren discovered that a reported crash on Unicode
	    sequences with "zero-width non-joiner" characters was due
	    to stack corruption that may be exploitable.</p>
	  <h1>XMLHttpRequest header spoofing</h1>
	  <p>It was possible to add illegal and malformed headers to
	    an XMLHttpRequest. This could have been used to exploit
	    server or proxy flaws from the user's machine, or to fool
	    a server or proxy into thinking a single request was a
	    stream of separate requests. The severity of this
	    vulnerability depends on the value of servers which might
	    be vulnerable to HTTP request smuggling and similar
	    attacks, or which share an IP address (virtual hosting)
	    with the attacker's page.</p>
	  <p>For users connecting to the web through a proxy this flaw
	    could be used to bypass the same-origin restriction on
	    XMLHttpRequests by fooling the proxy into handling a
	    single request as multiple pipe-lined requests directed at
	    arbitrary hosts. This could be used, for example, to read
	    files on intranet servers behind a firewall.</p>
	  <h1>Object spoofing using XBL &lt;implements&gt;</h1>
	  <p>moz_bug_r_a4 demonstrated a DOM object spoofing bug
	    similar to <a href="http://www.mozilla.org/security/announce/mfsa2005-55.html">MFSA
	    2005-55</a> using an XBL control that &lt;implements&gt;
	    an internal interface. The severity depends on the version
	    of Firefox: investigation so far indicates Firefox 1.0.x
	    releases don't expose any vulnerable functionality to
	    interfaces spoofed in this way, but that early Deer Park
	    Alpha 1 versions did.</p>
	  <p>XBL was changed to no longer allow unprivileged controls
	    from web content to implement XPCOM interfaces.</p>
	  <h1>JavaScript integer overflow</h1>
	  <p>Georgi Guninski reported an integer overflow in the
	    JavaScript engine. We presume this could be exploited to
	    run arbitrary code under favorable conditions.</p>
	  <h1>Privilege escalation using about: scheme</h1>
	  <p>heatsync and shutdown report two different ways to bypass
	    the restriction on loading high privileged "chrome" pages
	    from an unprivileged "about:" page. By itself this is
	    harmless--once the "about" page's privilege is raised the
	    original page no longer has access--but should this be
	    combined with a same-origin violation this could lead to
	    arbitrary code execution.</p>
	  <h1>Chrome window spoofing</h1>
	  <p>moz_bug_r_a4 demonstrates a way to get a blank "chrome"
	    canvas by opening a window from a reference to a closed
	    window. The resulting window is not privileged, but the
	    normal browser UI is missing and can be used to construct
	    a spoof page without any of the safety features of the
	    browser chrome designed to alert users to phishing sites,
	    such as the address bar and the status bar.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-2701</cvename>
      <cvename>CVE-2005-2702</cvename>
      <cvename>CVE-2005-2703</cvename>
      <cvename>CVE-2005-2704</cvename>
      <cvename>CVE-2005-2705</cvename>
      <cvename>CVE-2005-2706</cvename>
      <cvename>CVE-2005-2707</cvename>
      <url>http://www.mozilla.org/security/announce/mfsa2005-58.html</url>
    </references>
    <dates>
      <discovery>2005-09-22</discovery>
      <entry>2005-09-23</entry>
      <modified>2005-10-26</modified>
    </dates>
  </vuln>

  <vuln vid="2e28cefb-2aee-11da-a263-0001020eed82">
    <topic>firefox &amp; mozilla -- command line URL shell command injection</topic>
    <affects>
      <package>
	<name>firefox</name>
	<range><lt>1.0.7,1</lt></range>
      </package>
      <package>
	<name>linux-firefox</name>
	<range><lt>1.0.7</lt></range>
      </package>
      <package>
	<name>mozilla</name>
	<range><lt>1.7.12,2</lt></range>
	<range><ge>1.8.*,2</ge></range>
      </package>
      <package>
	<name>linux-mozilla</name>
	<range><lt>1.7.12</lt></range>
      </package>
      <package>
	<name>linux-mozilla-devel</name>
	<range><gt>0</gt></range>
      </package>
      <package>
	<name>netscape7</name>
	<range><ge>0</ge></range>
      </package>
      <package>
	<!-- These ports are obsolete. -->
	<name>de-linux-mozillafirebird</name>
	<name>el-linux-mozillafirebird</name>
	<name>ja-linux-mozillafirebird-gtk1</name>
	<name>ja-mozillafirebird-gtk2</name>
	<name>linux-mozillafirebird</name>
	<name>ru-linux-mozillafirebird</name>
	<name>zhCN-linux-mozillafirebird</name>
	<name>zhTW-linux-mozillafirebird</name>
	<range><ge>0</ge></range>
      </package>
      <package>
	<!-- These package names are obsolete. -->
	<name>de-linux-netscape</name>
	<name>de-netscape7</name>
	<name>fr-linux-netscape</name>
	<name>fr-netscape7</name>
	<name>ja-linux-netscape</name>
	<name>ja-netscape7</name>
	<name>linux-netscape</name>
	<name>linux-phoenix</name>
	<name>mozilla+ipv6</name>
	<name>mozilla-embedded</name>
	<name>mozilla-firebird</name>
	<name>mozilla-gtk1</name>
	<name>mozilla-gtk2</name>
	<name>mozilla-gtk</name>
	<name>mozilla-thunderbird</name>
	<name>phoenix</name>
	<name>pt_BR-netscape7</name>
	<range><ge>0</ge></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A Secunia Advisory reports:</p>
	<blockquote cite="http://secunia.com/advisories/16869/">
	  <p>Peter Zelezny has discovered a vulnerability in Firefox,
	    which can be exploited by malicious people to compromise a
	    user's system.</p>
	  <p>The vulnerability is caused due to the shell script used
	    to launch Firefox parsing shell commands that are enclosed
	    within backticks in the URL provided via the command
	    line. This can e.g. be exploited to execute arbitrary
	    shell commands by tricking a user into following a
	    malicious link in an external application which uses
	    Firefox as the default browser.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-2968</cvename>
      <url>https://bugzilla.mozilla.org/show_bug.cgi?id=307185</url>
      <url>http://secunia.com/advisories/16869/</url>
      <url>http://www.mozilla.org/security/announce/mfsa2005-59.html</url>
    </references>
    <dates>
      <discovery>2005-09-06</discovery>
      <entry>2005-09-22</entry>
      <modified>2005-10-26</modified>
    </dates>
  </vuln>

  <vuln vid="e936d612-253f-11da-bc01-000e0c2e438a">
    <topic>apache -- Certificate Revocation List (CRL) off-by-one vulnerability</topic>
    <affects>
      <package>
	<name>apache</name>
	<range><gt>2.*</gt><lt>2.0.54_1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Marc Stern reports an off-by-one vulnerability in within
	  mod_ssl.  The vulnerability lies in mod_ssl's Certificate
	  Revocation List (CRL).  If Apache is configured to use a
	  CRL this could allow an attacker to crash a child process
	  causing a Denial of Service.</p>
      </body>
    </description>
    <references>
      <bid>14366</bid>
      <cvename>CVE-2005-1268</cvename>
    </references>
    <dates>
      <discovery>2005-07-12</discovery>
      <entry>2005-09-17</entry>
    </dates>
  </vuln>

  <vuln vid="7d52081f-2795-11da-bc01-000e0c2e438a">
    <topic>squirrelmail -- _$POST variable handling allows for various attacks</topic>
    <affects>
      <package>
	<name>squirrelmail</name>
	<name>ja-squirrelmail</name>
	<range><ge>1.4.0</ge><lt>1.4.5</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A Squirrelmail Advisory reports:</p>
	<blockquote cite="http://www.squirrelmail.org/security/issue/2005-07-13">
	  <p>An extract($_POST) was done in options_identities.php which
	    allowed for an attacker to set random variables in that
	    file.  This could lead to the reading (and possible
	    writing) of other people's preferences, cross site scripting
	    or writing files in webserver-writable locations.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <bid>14254</bid>
      <cvename>CVE-2005-2095</cvename>
      <url>http://www.squirrelmail.org/security/issue/2005-07-13</url>
    </references>
    <dates>
      <discovery>2005-07-13</discovery>
      <entry>2005-09-17</entry>
      <modified>2005-09-19</modified>
    </dates>
  </vuln>

  <vuln vid="a863aa74-24be-11da-8882-000e0c33c2dc">
    <topic>X11 server -- pixmap allocation vulnerability</topic>
    <affects>
      <package>
	<name>XFree86-Server</name>
	<range><lt>4.5.0_2</lt></range>
      </package>
      <package>
	<name>xorg-server</name>
	<range><lt>6.8.2_5</lt></range>
	<range><gt>6.8.99</gt><lt>6.8.99.12_1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Allocating large pixmaps by a client can trigger an integer
	  overflow in the X server, potentially leading to execution of
	  arbitrary code with elevated (root) privileges.</p>
      </body>
    </description>
    <references>
      <bid>14807</bid>
      <certvu>102441</certvu>
      <cvename>CVE-2005-2495</cvename>
      <url>https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=166856</url>
      <url>https://bugs.freedesktop.org/show_bug.cgi?id=594</url>
    </references>
    <dates>
      <discovery>2005-09-12</discovery>
      <entry>2005-09-15</entry>
    </dates>
  </vuln>

  <vuln vid="9750cf22-216d-11da-bc01-000e0c2e438a">
    <topic>unzip -- permission race vulnerability</topic>
    <affects>
      <package>
	<name>unzip</name>
	<name>zh-unzip</name>
	<name>ko-unzip</name>
	<range><lt>5.52_2</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Imran Ghory reports a vulnerability within unzip.  The
	  vulnerability is caused by a race condition between
	  extracting an archive and changing the permissions of the
	  extracted files.  This would give an attacker enough time to
	  remove a file and hardlink it to another file owned by the
	  user running unzip.  When unzip changes the permissions of
	  the file it could give the attacker access to files that
	  normally would not have been accessible for others.</p>
      </body>
    </description>
    <references>
      <bid>14450</bid>
      <cvename>CVE-2005-2475</cvename>
      <mlist msgid="7389fc4b05080116031536adf7@mail.gmail.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=112300046224117</mlist>
    </references>
    <dates>
      <discovery>2005-08-02</discovery>
      <entry>2005-09-13</entry>
    </dates>
  </vuln>

  <vuln vid="8665ebb9-2237-11da-978e-0001020eed82">
    <topic>firefox &amp; mozilla -- buffer overflow vulnerability</topic>
    <affects>
      <package>
	<name>firefox</name>
	<range><lt>1.0.6_5,1</lt></range>
      </package>
      <package>
	<name>linux-firefox</name>
	<range><lt>1.0.7</lt></range>
      </package>
      <package>
	<name>mozilla</name>
	<range><lt>1.7.11_1,2</lt></range>
	<range><ge>1.8.*,2</ge><lt>1.8.b1_5,2</lt></range>
      </package>
      <package>
	<name>linux-mozilla</name>
	<range><lt>1.7.12</lt></range>
      </package>
      <package>
	<name>linux-mozilla-devel</name>
	<range><gt>0</gt></range>
      </package>
      <package>
	<name>netscape7</name>
	<range><ge>0</ge></range>
      </package>
      <package>
	<!-- These ports are obsolete. -->
	<name>de-linux-mozillafirebird</name>
	<name>el-linux-mozillafirebird</name>
	<name>ja-linux-mozillafirebird-gtk1</name>
	<name>ja-mozillafirebird-gtk2</name>
	<name>linux-mozillafirebird</name>
	<name>ru-linux-mozillafirebird</name>
	<name>zhCN-linux-mozillafirebird</name>
	<name>zhTW-linux-mozillafirebird</name>
	<range><ge>0</ge></range>
      </package>
      <package>
	<!-- These package names are obsolete. -->
	<name>de-linux-netscape</name>
	<name>de-netscape7</name>
	<name>fr-linux-netscape</name>
	<name>fr-netscape7</name>
	<name>ja-linux-netscape</name>
	<name>ja-netscape7</name>
	<name>linux-netscape</name>
	<name>linux-phoenix</name>
	<name>mozilla+ipv6</name>
	<name>mozilla-embedded</name>
	<name>mozilla-firebird</name>
	<name>mozilla-gtk1</name>
	<name>mozilla-gtk2</name>
	<name>mozilla-gtk</name>
	<name>mozilla-thunderbird</name>
	<name>phoenix</name>
	<name>pt_BR-netscape7</name>
	<range><ge>0</ge></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Tom Ferris reports:</p>
	<blockquote cite="http://marc.theaimsgroup.com/?l=full-disclosure&amp;m=112624614008387">
	  <p>A buffer overflow vulnerability exists within Firefox
	    version 1.0.6 and all other prior versions which allows
	    for an attacker to remotely execute arbitrary code on an
	    affected host.</p>
	  <p>The problem seems to be when a hostname which has all
	    dashes causes the NormalizeIDN call in
	    nsStandardURL::BuildNormalizedSpec to return true, but is
	    sets encHost to an empty string.  Meaning, Firefox appends
	    0 to approxLen and then appends the long string of dashes
	    to the buffer instead.</p>
	</blockquote>
	<p><strong>Note:</strong> It is possible to disable IDN
	  support as a workaround to protect against this buffer
	  overflow. How to do this is described on the <em><a href="http://www.mozilla.org/security/idn.html">What Firefox
	  and Mozilla users should know about the IDN buffer overflow
	  security issue</a></em> web page.</p>
      </body>
    </description>
    <references>
      <bid>14784</bid>
      <certvu>573857</certvu>
      <cvename>CVE-2005-2871</cvename>
      <url>http://marc.theaimsgroup.com/?l=full-disclosure&amp;m=112624614008387</url>
      <url>http://www.mozilla.org/security/idn.html</url>
      <url>https://bugzilla.mozilla.org/show_bug.cgi?id=307259</url>
      <url>http://www.mozilla.org/security/announce/mfsa2005-57.html</url>
    </references>
    <dates>
      <discovery>2005-09-08</discovery>
      <entry>2005-09-10</entry>
      <modified>2005-10-26</modified>
    </dates>
  </vuln>

  <vuln vid="673aec6f-1cae-11da-bc01-000e0c2e438a">
    <topic>htdig -- cross site scripting vulnerability</topic>
    <affects>
      <package>
	<name>htdig</name>
	<range><lt>3.2.0.b6_1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Michael Krax reports a vulnerability within htdig.  The
	  vulnerability lies within an unsanitized config parameter,
	  allowing a malicious attacker to execute arbitrary scripting
	  code on the target's browser.  This might allow the attacker
	  to obtain the user's cookies which are associated with the
	  site, including cookies used for authentication.</p>
      </body>
    </description>
    <references>
      <bid>12442</bid>
      <cvename>CVE-2005-0085</cvename>
      <url>http://www.securitytracker.com/alerts/2005/Feb/1013078.html</url>
    </references>
    <dates>
      <discovery>2005-02-03</discovery>
      <entry>2005-09-04</entry>
      <modified>2005-09-13</modified>
    </dates>
  </vuln>

  <vuln vid="4e210d72-1c5c-11da-92ce-0048543d60ce">
    <topic>squid -- Denial Of Service Vulnerability in sslConnectTimeout</topic>
    <affects>
      <package>
	<name>squid</name>
	<range><lt>2.5.10_5</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The squid patches page notes:</p>
	<blockquote cite="http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE10-sslConnectTimeout">
	  <p>After certain slightly odd requests Squid crashes with a
	    segmentation fault in sslConnectTimeout.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <bid>14731</bid>
      <cvename>CVE-2005-2796</cvename>
      <url>http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE10-sslConnectTimeout</url>
      <url>http://www.squid-cache.org/bugs/show_bug.cgi?id=1355</url>
      <url>http://secunia.com/advisories/16674/</url>
    </references>
    <dates>
      <discovery>2005-07-21</discovery>
      <entry>2005-09-04</entry>
      <modified>2005-10-02</modified>
    </dates>
  </vuln>

  <vuln vid="0c0dc409-1c5e-11da-92ce-0048543d60ce">
    <topic>squid -- Possible Denial Of Service Vulnerability in store.c</topic>
    <affects>
      <package>
	<name>squid</name>
	<range><lt>2.5.10_5</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The squid patches page notes:</p>
	<blockquote cite="http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE10-STORE_PENDING">
	  <p>Squid crashes with the above assertion failure [assertion failed:
	    store.c:523: "e-&gt;store_status == STORE_PENDING"] in certain
	    conditions involving aborted requests.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <bid>14761</bid>
      <cvename>CVE-2005-2794</cvename>
      <url>http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE10-STORE_PENDING</url>
      <url>http://www.squid-cache.org/bugs/show_bug.cgi?id=1368</url>
      <url>http://secunia.com/advisories/16708/</url>
    </references>
    <dates>
      <discovery>2005-08-02</discovery>
      <entry>2005-09-04</entry>
      <modified>2005-10-02</modified>
    </dates>
  </vuln>

  <vuln vid="30e4ed7b-1ca6-11da-bc01-000e0c2e438a">
    <topic>bind9 -- denial of service</topic>
    <affects>
      <package>
	<name>bind9</name>
	<range><eq>9.3.0</eq></range>
      </package>
      <package>
	<name>FreeBSD</name>
	<range><ge>5.3</ge><lt>5.3_16</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Problem description</p>
	<p>A DNSSEC-related validator function in BIND 9.3.0 contains an
	  inappropriate internal consistency test.  When this test is
	  triggered, named(8) will exit.</p>
	<p>Impact</p>
	<p>On systems with DNSSEC enabled, a remote attacker may be able
	  to inject a specially crafted packet that will cause the
	  internal consistency test to trigger, and named(8) to
	  terminate.  As a result, the name server will no longer be
	  available to service requests.</p>
	<p>Workaround</p>
	<p>DNSSEC is not enabled by default, and the "dnssec-enable"
	  directive is not normally present.  If DNSSEC has been
	  enabled, disable it by changing the "dnssec-enable" directive
	  to "dnssec-enable no;" in the named.conf(5) configuration
	  file.</p>
      </body>
    </description>
    <references>
      <certvu>938617</certvu>
      <cvename>CVE-2005-0034</cvename>
      <url>http://www.uniras.gov.uk/niscc/docs/al-20050125-00060.html?lang=en</url>
      <url>http://www.isc.org/sw/bind/bind9.3.php#security</url>
    </references>
    <dates>
      <discovery>2005-01-25</discovery>
      <entry>2005-09-03</entry>
    </dates>
  </vuln>

  <vuln vid="947f4b14-1c89-11da-bc01-000e0c2e438a">
    <topic>bind -- buffer overrun vulnerability</topic>
    <affects>
      <package>
	<name>bind84</name>
	<range><ge>8.4.4</ge><lt>8.4.6</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>An ISC advisory reports a buffer overrun vulnerability within
	  bind.  The vulnerability could result in a Denial of Service.
	  A workaround is available by disabling recursion and glue
	  fetching.</p>
      </body>
    </description>
    <references>
      <certvu>327633</certvu>
      <cvename>CVE-2005-0033</cvename>
      <url>http://www.uniras.gov.uk/niscc/docs/al-20050125-00059.html?lang=en</url>
      <url>http://www.isc.org/sw/bind/bind-security.php</url>
    </references>
    <dates>
      <discovery>2005-01-25</discovery>
      <entry>2005-09-03</entry>
      <modified>2005-09-21</modified>
    </dates>
  </vuln>

  <vuln vid="08df5d46-1baf-11da-8038-0040f42d58c6">
    <topic>urban -- stack overflow vulnerabilities</topic>
    <affects>
      <package>
	<name>urban</name>
	<range><lt>1.5.3_2</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Several filename-related stack overflow bugs allow a local
	  attacker to elevate its privileges to the games group, since
	  urban is installed setgid games.</p>
	<p>Issue discovered and fixed by &lt;shaun@rsc.cx&gt;.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-2864</cvename>
      <mlist msgid="55104.213.107.125.108.1125844783.squirrel@webmail.rsc.cx">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=112604855119036</mlist>
    </references>
    <dates>
      <discovery>2005-09-02</discovery>
      <entry>2005-09-02</entry>
      <modified>2005-09-22</modified>
    </dates>
  </vuln>

  <vuln vid="6e27f3b6-189b-11da-b6be-0090274e8dbb">
    <topic>fswiki -- command injection vulnerability</topic>
    <affects>
      <package>
	<name>fswiki</name>
	<range><lt>3.5.9</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>There is a command injection vulnerability in admin page
	  of fswiki.</p>
      </body>
    </description>
    <references>
      <url>http://jvn.jp/jp/JVN%2342435855/index.html</url>
    </references>
    <dates>
      <discovery>2005-08-29</discovery>
      <entry>2005-08-29</entry>
    </dates>
  </vuln>

  <vuln vid="e5afdf63-1746-11da-978e-0001020eed82">
    <topic>evolution -- remote format string vulnerabilities</topic>
    <affects>
      <package>
	<name>evolution</name>
	<range><gt>1.5</gt><lt>2.2.3_1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A SITIC Vulnerability Advisory reports:</p>
	<blockquote cite="http://www.sitic.se/eng/advisories_and_recommendations/sa05-001.html">
	  <p>Evolution suffers from several format string bugs when
	    handling data from remote sources. These bugs lead to
	    crashes or the execution of arbitrary assembly language
	    code.</p>
	  <ol>
	    <li>The first format string bug occurs when viewing the
	      full vCard data attached to an e-mail message.</li>
	    <li>The second format string bug occurs when displaying
	      contact data from remote LDAP servers.</li>
	    <li>The third format string bug occurs when displaying
	      task list data from remote servers.</li>
	    <li>The fourth, and least serious, format string bug
	      occurs when the user goes to the Calendars tab to save
	      task list data that is vulnerable to problem 3
	      above. Other calendar entries that do not come from task
	      lists are also affected.</li>
	  </ol>
	</blockquote>
      </body>
    </description>
    <references>
      <bid>14532</bid>
      <cvename>CVE-2005-2549</cvename>
      <cvename>CVE-2005-2550</cvename>
      <url>http://www.sitic.se/eng/advisories_and_recommendations/sa05-001.html</url>
    </references>
    <dates>
      <discovery>2005-08-10</discovery>
      <entry>2005-08-27</entry>
      <modified>2006-03-24</modified>
    </dates>
  </vuln>

  <vuln vid="38c76fcf-1744-11da-978e-0001020eed82">
    <topic>pam_ldap -- authentication bypass vulnerability</topic>
    <affects>
      <package>
	<name>pam_ldap</name>
	<range><lt>1.8.0</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Luke Howard reports:</p>
	<blockquote cite="https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=166163">
	  <p>If a pam_ldap client authenticates against an LDAP server
	    that returns a passwordPolicyResponse control, but omits
	    the optional "error" field of the
	    PasswordPolicyResponseValue, then the LDAP authentication
	    result will be ignored and the authentication step will
	    always succeed.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-2641</cvename>
      <certvu>778916</certvu>
      <url>https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=166163</url>
    </references>
    <dates>
      <discovery>2005-08-22</discovery>
      <entry>2005-08-27</entry>
    </dates>
  </vuln>

  <vuln vid="b971d2a6-1670-11da-978e-0001020eed82">
    <topic>pcre -- regular expression buffer overflow</topic>
    <affects>
      <package>
	<name>pcre</name>
	<name>pcre-utf8</name>
	<range><lt>6.2</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The pcre library is vulnerable to a buffer overflow
	  vulnerability due to insufficient validation of quantifier
	  values.  This could lead execution of arbitrary code with
	  the permissions of the program using pcre by way of a
	  specially crated regular expression.</p>
      </body>
    </description>
    <references>
      <bid>14620</bid>
      <cvename>CVE-2005-2491</cvename>
      <url>http://www.pcre.org/changelog.txt</url>
    </references>
    <dates>
      <discovery>2005-08-01</discovery>
      <entry>2005-08-26</entry>
    </dates>
  </vuln>

  <vuln vid="f66e011d-13ff-11da-af41-0004614cc33d">
    <topic>elm -- remote buffer overflow in Expires header</topic>
    <affects>
      <package>
	<name>elm</name>
	<range><lt>2.5.8</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Ulf Harnhammar has discovered a remotely exploitable buffer
	  overflow in Elm e-mail client when parsing the Expires header
	  of an e-mail message:</p>
	<blockquote cite="http://archives.neohapsis.com/archives/fulldisclosure/2005-08/0688.html">
	  <p>The attacker only needs to send the victim an e-mail
	    message. When the victim with that message in his or her
	    inbox starts Elm or simply views the inbox in an already
	    started copy of Elm, the buffer overflow will happen
	    immediately. The overflow is stack-based, and it gives full
	    control over EIP, EBP and EBX. It is caused by a bad
	    sscanf(3) call, using a format string containing "%s"
	    to copy from a long char array to a shorter array.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <url>http://archives.neohapsis.com/archives/fulldisclosure/2005-08/0688.html</url>
    </references>
    <dates>
      <discovery>2005-08-20</discovery>
      <entry>2005-08-23</entry>
    </dates>
  </vuln>

  <vuln vid="5ad3e437-e527-4514-b9ed-280b2ca1a8c9">
    <topic>openvpn -- multiple TCP clients connecting with the same certificate at the same time can crash the server</topic>
    <affects>
      <package>
	<name>openvpn</name>
	<range><lt>2.0.1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>James Yonan reports:</p>
	<blockquote cite="http://openvpn.net/changelog.html">
	  <p>If two or more client machines try to connect to the server
	    at the same time via TCP, using the same client certificate,
	    and when --duplicate-cn is not enabled on the server, a race
	    condition can crash the server with "Assertion failed at
	    mtcp.c:411"</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-2534</cvename>
      <url>http://openvpn.net/changelog.html</url>
    </references>
    <dates>
      <discovery>2005-08-03</discovery>
      <entry>2005-08-19</entry>
    </dates>
  </vuln>

  <vuln vid="1986449a-8b74-40fa-b7cc-0d8def8aad65">
    <topic>openvpn -- denial of service: malicious authenticated "tap" client can deplete server virtual memory</topic>
    <affects>
      <package>
	<name>openvpn</name>
	<range><lt>2.0.1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>James Yonan reports:</p>
	<blockquote cite="http://openvpn.net/changelog.html">
	  <p>A malicious [authenticated] client in "dev tap"
	    ethernet bridging mode could theoretically flood the server
	    with packets appearing to come from hundreds of thousands
	    of different MAC addresses, causing the OpenVPN process to
	    deplete system virtual memory as it expands its internal
	    routing table.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-2533</cvename>
      <url>http://openvpn.net/changelog.html</url>
    </references>
    <dates>
      <discovery>2005-07-27</discovery>
      <entry>2005-08-19</entry>
    </dates>
  </vuln>

  <vuln vid="d1c39c8e-05ab-4739-870f-765490fa2052">
    <topic>openvpn -- denial of service: undecryptable packet from authorized client can disconnect unrelated clients</topic>
    <affects>
      <package>
	<name>openvpn</name>
	<range><lt>2.0.1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>James Yonan reports:</p>
	<blockquote cite="http://openvpn.net/changelog.html">
	  <p>If the client sends a packet which fails to decrypt on the
	    server, the OpenSSL error queue is not properly flushed,
	    which can result in another unrelated client instance on the
	    server seeing the error and responding to it, resulting in
	    disconnection of the unrelated client.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-2532</cvename>
      <url>http://openvpn.net/changelog.html</url>
    </references>
    <dates>
      <discovery>2005-07-27</discovery>
      <entry>2005-08-19</entry>
    </dates>
  </vuln>

  <vuln vid="a51ad838-2077-48b2-a136-e888a7db5f8d">
    <topic>openvpn -- denial of service: client certificate validation can disconnect unrelated clients</topic>
    <affects>
      <package>
	<name>openvpn</name>
	<range><lt>2.0.1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>James Yonan reports:</p>
	<blockquote cite="http://openvpn.net/changelog.html">
	  <p>DoS attack against server when run with "verb 0" and
	    without "tls-auth".  If a client connection to the server
	    fails certificate verification, the OpenSSL error queue is
	    not properly flushed, which can result in another unrelated
	    client instance on the server seeing the error and
	    responding to it, resulting in disconnection of the
	    unrelated client.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-2531</cvename>
      <url>http://openvpn.net/changelog.html</url>
    </references>
    <dates>
      <discovery>2005-08-03</discovery>
      <entry>2005-08-19</entry>
    </dates>
  </vuln>

  <vuln vid="5fde5c30-0f4e-11da-bc01-000e0c2e438a">
    <topic>tor -- diffie-hellman handshake flaw</topic>
    <affects>
      <package>
	<name>tor</name>
	<range><lt>0.1.0.14</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A tor advisory reports</p>
	<blockquote cite="http://archives.seul.org/or/announce/Aug-2005/msg00002.html">
	  <p>Tor clients can completely loose anonymity, confidentiality,
	    and data integrity if the first Tor server in their path is
	    malicious.	Specifically, if the Tor client chooses a
	    malicious Tor server for her first hop in the circuit, that
	    server can learn all the keys she negotiates for the rest of
	    the circuit (or just spoof the whole circuit), and then read
	    and/or modify all her traffic over that circuit.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-2643</cvename>
      <url>http://archives.seul.org/or/announce/Aug-2005/msg00002.html</url>
    </references>
    <dates>
      <discovery>2005-08-11</discovery>
      <entry>2005-08-17</entry>
      <modified>2005-09-21</modified>
    </dates>
  </vuln>

  <vuln vid="f74dc01b-0e83-11da-bc08-0001020eed82">
    <topic>acroread -- plug-in buffer overflow vulnerability</topic>
    <affects>
      <package>
	<name>acroread</name>
	<range><lt>7.0.1</lt></range>
	<range><gt>5.*,1</gt><lt>7.0.1,1</lt></range>
      </package>
      <package>
	<name>acroread4</name>
	<name>acroread5</name>
	<range><ge>0</ge></range>
      </package>
      <package>
	<name>acroread7</name>
	<range><lt>7.0.1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A Adobe Security Advisory reports:</p>
	<blockquote cite="http://www.adobe.com/support/techdocs/321644.html">
	  <p>The identified vulnerability is a buffer overflow within
	    a core application plug-in, which is part of Adobe Acrobat
	    and Adobe Reader. If a malicious file were opened it could
	    trigger a buffer overflow as the file is being loaded into
	    Adobe Acrobat and Adobe Reader. A buffer overflow can
	    cause the application to crash and increase the risk of
	    malicious code execution.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-2470</cvename>
      <url>http://www.adobe.com/support/techdocs/321644.html</url>
    </references>
    <dates>
      <discovery>2005-08-16</discovery>
      <entry>2005-08-16</entry>
    </dates>
  </vuln>

  <vuln vid="e65ad1bf-0d8b-11da-90d0-00304823c0d3">
    <topic>pear-XML_RPC -- remote PHP code injection vulnerability</topic>
    <affects>
      <package>
	<name>pear-XML_RPC</name>
	<range><lt>1.4.0</lt></range>
      </package>
      <package>
	<name>phpmyfaq</name>
	<range><lt>1.4.11</lt></range>
      </package>
      <package>
	<name>drupal</name>
	<range><lt>4.6.3</lt></range>
      </package>
      <package>
	<name>eGroupWare</name>
	<range><lt>1.0.0.009</lt></range>
      </package>
      <package>
	<name>phpAdsNew</name>
	<range><lt>2.0.5</lt></range>
      </package>
      <package>
	<name>phpgroupware</name>
	<range><lt>0.9.16.007</lt></range>
      </package>
      <package>
	<name>b2evolution</name>
	<range><lt>0.9.0.12_2</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A Hardened-PHP Project Security Advisory reports:</p>
	<blockquote cite="http://www.hardened-php.net/advisory_142005.66.html">
	  <p>When the library parses XMLRPC requests/responses, it constructs
	    a string of PHP code, that is later evaluated.  This means any
	    failure to properly handle the construction of this string can
	    result in arbitrary execution of PHP code.</p>
	  <p>This new injection vulnerability is cause by not properly
	    handling the situation, when certain XML tags are nested
	    in the parsed document, that were never meant to be nested
	    at all. This can be easily exploited in a way, that
	    user-input is placed outside of string delimiters within
	    the evaluation string, which obviously results in
	    arbitrary code execution.</p>
	</blockquote>
	<p>Note that several applications contains an embedded version
	  on XML_RPC, therefor making them the vulnerable to the same
	  code injection vulnerability.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-2498</cvename>
      <url>http://b2evolution.net/news/2005/08/31/fix_for_xml_rpc_vulnerability_again_1</url>
      <url>http://downloads.phpgroupware.org/changelog</url>
      <url>http://drupal.org/files/sa-2005-004/advisory.txt</url>
      <url>http://phpadsnew.com/two/nucleus/index.php?itemid=45</url>
      <url>http://sourceforge.net/project/shownotes.php?release_id=349626</url>
      <url>http://www.hardened-php.net/advisory_142005.66.html</url>
      <url>http://www.hardened-php.net/advisory_152005.67.html</url>
      <url>http://www.phpmyfaq.de/advisory_2005-08-15.php</url>
    </references>
    <dates>
      <discovery>2005-08-15</discovery>
      <entry>2005-08-15</entry>
      <modified>2005-09-04</modified>
    </dates>
  </vuln>

  <vuln vid="e86fbb5f-0d04-11da-bc08-0001020eed82">
    <topic>awstats -- arbitrary code execution vulnerability</topic>
    <affects>
      <package>
	<name>awstats</name>
	<range><lt>6.4_1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>An iDEFENSE Security Advisory reports:</p>
	<blockquote cite="http://www.idefense.com/application/poi/display?id=290&amp;type=vulnerabilities">
	  <p>Remote exploitation of an input validation vulnerability
	    in AWStats allows remote attackers to execute arbitrary
	    commands.</p>

	  <p>The problem specifically exists because of insufficient
	    input filtering before passing user-supplied data to an
	    <code>eval()</code> function. As part of the statistics
	    reporting function, AWStats displays information about the
	    most common referrer values that caused users to visit the
	    website. The referrer data is used without proper
	    sanitation in an <code>eval()</code> statement, resulting
	    in the execution of arbitrary perl code.</p>

	  <p>Successful exploitation results in the execution of
	    arbitrary commands with permissions of the web
	    service. Exploitation will not occur until the stats page
	    has been regenerated with the tainted referrer values from
	    the http access log. Note that AWStats is only vulnerable
	    in situations where at least one URLPlugin is enabled.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-1527</cvename>
      <mlist msgid="20050811155502.61E3C7A00B4@mail.idefense.com">http://marc.theaimsgroup.com/?l=full-disclosure&amp;m=112377934108902</mlist>
      <url>http://www.idefense.com/application/poi/display?id=290&amp;type=vulnerabilities</url>
    </references>
    <dates>
      <discovery>2005-08-09</discovery>
      <entry>2005-08-14</entry>
      <modified>2005-08-23</modified>
    </dates>
  </vuln>

  <vuln vid="3b4a6982-0b24-11da-bc08-0001020eed82">
    <topic>libgadu -- multiple vulnerabilities</topic>
    <affects>
      <package>
	<name>gaim</name>
	<name>ja-gaim</name>
	<name>ko-gaim</name>
	<name>ru-gaim</name>
	<range><lt>1.4.0_1</lt></range>
      </package>
      <package>
	<name>kdenetwork</name>
	<range><gt>3.2.2</gt><lt>3.4.2</lt></range>
      </package>
      <package>
	<name>pl-ekg</name>
	<range><lt>1.6r3,1</lt></range>
      </package>
      <package>
	<name>centericq</name>
	<range><lt>4.21.0_1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Wojtek Kaniewski reports:</p>
	<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=112198499417250">
	  <p>Multiple vulnerabilities have been found in libgadu, a
	    library for handling Gadu-Gadu instant messaging
	    protocol. It is a part of ekg, a Gadu-Gadu client, but is
	    widely used in other clients. Also some of the user
	    contributed scripts were found to behave in an insecure
	    manner.</p>
	  <ul>
	    <li>integer overflow in libgadu (CVE-2005-1852) that could
	      be triggered by an incomming message and lead to
	      application crash and/or remote code execution</li>
	    <li>insecure file creation (CVE-2005-1850) and shell
	      command injection (CVE-2005-1851) in other user
	      contributed scripts (discovered by Marcin Owsiany and
	      Wojtek Kaniewski)</li>
	    <li>several signedness errors in libgadu that could be
	      triggered by an incomming network data or an application
	      passing invalid user input to the library</li>
	    <li>memory alignment errors in libgadu that could be
	      triggered by an incomming message and lead to bus errors
	      on architectures like SPARC</li>
	    <li>endianness errors in libgadu that could cause invalid
	      behaviour of applications on big-endian
	      architectures</li>
	  </ul>
	</blockquote>
      </body>
    </description>
    <references>
      <bid>14345</bid>
      <cvename>CVE-2005-1850</cvename>
      <cvename>CVE-2005-1851</cvename>
      <cvename>CVE-2005-1852</cvename>
      <cvename>CVE-2005-2369</cvename>
      <cvename>CVE-2005-2370</cvename>
      <cvename>CVE-2005-2448</cvename>
      <mlist msgid="42DFF06F.7060005@toxygen.net">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=112198499417250</mlist>
      <url>http://gaim.sourceforge.net/security/?id=20</url>
      <url>http://www.kde.org/info/security/advisory-20050721-1.txt</url>
    </references>
    <dates>
      <discovery>2005-07-21</discovery>
      <entry>2005-08-12</entry>
      <modified>2005-10-23</modified>
    </dates>
  </vuln>

  <vuln vid="09db2844-0b21-11da-bc08-0001020eed82">
    <topic>gaim -- AIM/ICQ non-UTF-8 filename crash</topic>
    <affects>
      <package>
	<name>gaim</name>
	<name>ja-gaim</name>
	<name>ko-gaim</name>
	<name>ru-gaim</name>
	<range><lt>1.4.0_1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The GAIM team reports:</p>
	<blockquote cite="http://gaim.sourceforge.net/security/?id=21">
	  <p>A remote user could cause Gaim to crash on some systems
	    by sending the Gaim user a file whose filename contains
	    certain invalid characters. It is unknown what combination
	    of systems are affected, but it is suspected that Windows
	    users and systems with older versions of GTK+ are
	    especially susceptible.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-2102</cvename>
      <url>http://gaim.sourceforge.net/security/?id=21</url>
    </references>
    <dates>
      <discovery>2005-08-09</discovery>
      <entry>2005-08-12</entry>
    </dates>
  </vuln>

  <vuln vid="6d1761d2-0b23-11da-bc08-0001020eed82">
    <topic>gaim -- AIM/ICQ away message buffer overflow</topic>
    <affects>
      <package>
	<name>gaim</name>
	<name>ja-gaim</name>
	<name>ko-gaim</name>
	<name>ru-gaim</name>
	<range><lt>1.4.0_1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The GAIM team reports:</p>
	<blockquote cite="http://gaim.sourceforge.net/security/?id=22">
	  <p>A remote AIM or ICQ user can cause a buffer overflow in
	    Gaim by setting an away message containing many AIM
	    substitution strings (such as %t or %n).</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-2103</cvename>
      <url>http://gaim.sourceforge.net/security/?id=22</url>
    </references>
    <dates>
      <discovery>2005-08-09</discovery>
      <entry>2005-08-12</entry>
    </dates>
  </vuln>

  <vuln vid="24eee285-09c7-11da-bc08-0001020eed82">
    <topic>xpdf -- disk fill DoS vulnerability</topic>
    <affects>
      <package>
	<name>xpdf</name>
	<range><lt>3.00_7</lt></range>
      </package>
      <package>
	<name>kdegraphics</name>
	<range><lt>3.4.2</lt></range>
      </package>
      <package>
	<name>gpdf</name>
	<range><lt>2.10.0_2</lt></range>
      </package>
      <package>
	<name>cups-base</name>
	<range><lt>1.1.23.0_5</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>xpdf is vulnerable to a denial of service vulnerability
	  which can cause xpdf to create an infinitely large file,
	  thereby filling up the /tmp partition, when opening a
	  specially crafted PDF file.</p>
	<p>Note that several applications contains an embedded version
	  of xpdf, therefor making them the vulnerable to the same
	  DoS.	In CUPS this vulnerability would cause the pdftops
	  filter to crash.</p>
      </body>
    </description>
    <references>
      <bid>14529</bid>
      <cvename>CVE-2005-2097</cvename>
      <url>http://rhn.redhat.com/errata/RHSA-2005-670.html</url>
      <url>http://www.kde.org/info/security/advisory-20050809-1.txt</url>
    </references>
    <dates>
      <discovery>2005-08-09</discovery>
      <entry>2005-08-12</entry>
      <modified>2005-09-07</modified>
    </dates>
  </vuln>

  <vuln vid="d7cd5015-08c9-11da-bc08-0001020eed82">
    <topic>gforge -- XSS and email flood vulnerabilities</topic>
    <affects>
      <package>
	<name>gforge</name>
	<range><gt>0</gt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Jose Antonio Coret reports that GForge contains multiple
	  Cross Site Scripting vulnerabilities and an e-mail flood
	  vulnerability:</p>
	<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=112259845904350">
	  <p>The login form is also vulnerable to XSS (Cross Site
	    Scripting) attacks.  This may be used to launch phising
	    attacks by sending HTML e-mails (i.e.: saying that you
	    need to upgrade to the latest GForge version due to a
	    security problem) and putting in the e-mail an HTML link
	    that points to an specially crafted url that inserts an
	    html form in the GForge login page and when the user press
	    the login button, he/she send the credentials to the
	    attackers website.</p>

	  <p>The 'forgot your password?' feature allows a remote user
	    to load a certain URL to cause the service to send a
	    validation e-mail to the specified user's e-mail address.
	    There is no limit to the number of messages sent over a
	    period of time, so a remote user can flood the target
	    user's secondary e-mail address. E-Mail Flood, E-Mail
	    bomber.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <bid>14405</bid>
      <cvename>CVE-2005-2430</cvename>
      <cvename>CVE-2005-2431</cvename>
      <mlist msgid="1122496636.26878.2.camel@localhost.localdomain">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=112259845904350</mlist>
    </references>
    <dates>
      <discovery>2005-07-27</discovery>
      <entry>2005-08-09</entry>
    </dates>
  </vuln>

  <vuln vid="0274a9f1-0759-11da-bc08-0001020eed82">
    <topic>postnuke -- multiple vulnerabilities</topic>
    <affects>
      <package>
	<name>postnuke</name>
	<range><lt>0.760</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Postnuke Security Announcementss reports of the following
	  vulnerabilities:</p>
	<blockquote cite="http://news.postnuke.com/Article2691.html">
	  <ul>
	    <li>missing input validation within /modules/Messages/readpmsg.php</li>
	    <li>possible path disclosure within /user.php</li>
	    <li>possible path disclosure within /modules/News/article.php</li>
	    <li>possible remote code injection within /includes/pnMod.php</li>
	    <li>possible cross-site-scripting in /index.php</li>
	  </ul>
	</blockquote>
	<blockquote cite="http://news.postnuke.com/Article2699.html">
	  <ul>
	    <li>remote code injection via xml rpc library</li>
	  </ul>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-1621</cvename>
      <cvename>CVE-2005-1695</cvename>
      <cvename>CVE-2005-1696</cvename>
      <cvename>CVE-2005-1698</cvename>
      <cvename>CVE-2005-1777</cvename>
      <cvename>CVE-2005-1778</cvename>
      <cvename>CVE-2005-1921</cvename>
      <mlist msgid="20050527223753.21735.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=111721364707520</mlist>
      <url>http://secunia.com/advisories/15450/</url>
      <url>http://news.postnuke.com/Article2691.html</url>
      <url>http://news.postnuke.com/Article2699.html</url>
    </references>
    <dates>
      <discovery>2005-05-27</discovery>
      <entry>2005-08-08</entry>
    </dates>
  </vuln>

  <vuln vid="0bf9d7fb-05b3-11da-bc08-0001020eed82">
    <topic>mambo -- multiple vulnerabilities</topic>
    <affects>
      <package>
	<name>mambo</name>
	<range><lt>4.5.2.3</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A Secunia Advisory reports:</p>
	<blockquote cite="http://secunia.com/advisories/15710/">
	  <p>Some vulnerabilities have been reported in Mambo, where
	    some have unknown impacts and others can be exploited by
	    malicious people to conduct spoofing and SQL injection
	    attacks.</p>
	  <ol>
	    <li>Input passed to the "user_rating" parameter when
	      voting isn't properly sanitised before being used in a
	      SQL query. This can be exploited to manipulate SQL
	      queries by injecting arbitrary SQL code.</li>
	    <li>Some unspecified vulnerabilities in the "mosDBTable"
	      class and the "DOMIT" library have an unknown
	      impact.</li>
	    <li>An unspecified error in the "administrator/index3.php"
	      script can be exploited to spoof session IDs.</li>
	  </ol>
	</blockquote>
      </body>
    </description>
    <references>
      <bid>13966</bid>
      <cvename>CVE-2005-2002</cvename>
      <url>http://secunia.com/advisories/15710/</url>
    </references>
    <dates>
      <discovery>2005-06-15</discovery>
      <entry>2005-08-05</entry>
    </dates>
  </vuln>

  <vuln vid="2b6e47b1-0598-11da-86bc-000e0c2e438a">
    <topic>ipsec -- Incorrect key usage in AES-XCBC-MAC</topic>
    <affects>
      <package>
	<name>FreeBSD</name>
	<range><ge>5.4</ge><lt>5.4_6</lt></range>
	<range><ge>5.*</ge><lt>5.3_20</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem description</h1>
	<p>A programming error in the implementation of the
	  AES-XCBC-MAC algorithm for authentication resulted in a
	  constant key being used instead of the key specified by the
	  system administrator.</p>
	<h1>Impact</h1>
	<p>If the AES-XCBC-MAC algorithm is used for authentication in
	  the absence of any encryption, then an attacker may be able to
	  forge packets which appear to originate from a different
	  system and thereby succeed in establishing an IPsec session.
	  If access to sensitive information or systems is controlled
	  based on the identity of the source system, this may result
	  in information disclosure or privilege escalation.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-2359</cvename>
      <freebsdsa>SA-05:19.ipsec</freebsdsa>
    </references>
    <dates>
      <discovery>2005-07-27</discovery>
      <entry>2005-08-05</entry>
    </dates>
  </vuln>

  <vuln vid="837b9fb2-0595-11da-86bc-000e0c2e438a">
    <topic>zlib -- buffer overflow vulnerability</topic>
    <affects>
      <package>
	<name>linux_base-suse</name>
	<range><lt>9.3_1</lt></range>
      </package>
      <package>
	<name>FreeBSD</name>
	<range><ge>5.4</ge><lt>5.4_6</lt></range>
	<range><ge>5.3</ge><lt>5.3_20</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem description</h1>
	<p>A fixed-size buffer is used in the decompression of data
	  streams.  Due to erronous analysis performed when zlib was
	  written, this buffer, which was belived to be sufficiently
	  large to handle any possible input stream, is in fact too
	  small.</p>
	<h1>Impact</h1>
	<p>A carefully constructed compressed data stream can result in
	  zlib overwriting some data structures.  This may cause
	  applications to halt, resulting in a denial of service; or
	  it may result in an attacker gaining elevated privileges.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-1849</cvename>
      <freebsdsa>SA-05:18.zlib</freebsdsa>
    </references>
    <dates>
      <discovery>2005-07-27</discovery>
      <entry>2005-08-05</entry>
      <modified>2005-09-24</modified>
    </dates>
  </vuln>

  <vuln vid="7257b26f-0597-11da-86bc-000e0c2e438a">
    <topic>devfs -- ruleset bypass</topic>
    <affects>
      <package>
	<name>FreeBSD</name>
	<range><ge>5.4</ge><lt>5.4_5</lt></range>
	<range><ge>5.*</ge><lt>5.3_19</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem description</h1>
	<p>Due to insufficient parameter checking of the node type
	  during device creation, any user can expose hidden device
	  nodes on devfs mounted file systems within their jail.
	  Device nodes will be created in the jail with their normal
	  default access permissions.</p>
	<h1>Impact</h1>
	<p>Jailed processes can get access to restricted resources on
	  the host system.  For jailed processes running with superuser
	  privileges this implies access to all devices on the system.
	  This level of access can lead to information leakage and
	  privilege escalation.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-2218</cvename>
      <freebsdsa>SA-05:17.devfs</freebsdsa>
    </references>
    <dates>
      <discovery>2005-07-20</discovery>
      <entry>2005-08-05</entry>
    </dates>
  </vuln>

  <vuln vid="c28f4705-043f-11da-bc08-0001020eed82">
    <topic>proftpd -- format string vulnerabilities</topic>
    <affects>
      <package>
	<name>proftpd</name>
	<name>proftpd-mysql</name>
	<range><lt>1.3.0.rc2</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The ProFTPD release notes states:</p>
	<blockquote cite="http://www.proftpd.org/docs/RELEASE_NOTES-1.3.0rc2">
	  <p>sean &lt;infamous42md at hotpop.com&gt; found two format
	    string vulnerabilities, one in mod_sql's SQLShowInfo
	    directive, and one involving the 'ftpshut' utility.  Both
	    can be considered low risk, as they require active
	    involvement on the part of the site administrator in order
	    to be exploited.</p>
	</blockquote>
	<p>These vulnerabilities could potentially lead to information
	  disclosure, a denial-of-server situation, or execution of
	  arbitrary code with the permissions of the user running
	  ProFTPD.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-2390</cvename>
      <url>http://www.gentoo.org/security/en/glsa/glsa-200508-02.xml</url>
      <url>http://www.proftpd.org/docs/RELEASE_NOTES-1.3.0rc2</url>
    </references>
    <dates>
      <discovery>2005-07-26</discovery>
      <entry>2005-08-03</entry>
    </dates>
  </vuln>

  <vuln vid="debbb39c-fdb3-11d9-a30d-00b0d09acbfc">
    <topic>nbsmtp -- format string vulnerability</topic>
    <affects>
      <package>
	<name>nbsmtp</name>
	<range><lt>0.99_1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>When nbsmtp is executed in debug mode, server messages
	will be printed to stdout and logged via syslog. Syslog is
	used insecurely and user-supplied format characters are
	directly fed to the syslog function, which results in a
	format string vulnerability.</p>
	<p>Under some circumstances, an SMTP server may be able to
	abuse this vulnerability in order to alter the nbsmtp
	process and execute malicious code.</p>
      </body>
    </description>
    <references>
      <url>http://people.freebsd.org/~niels/issues/nbsmtp-20050726.txt</url>
    </references>
    <dates>
      <discovery>2005-07-25</discovery>
      <entry>2005-08-01</entry>
    </dates>
  </vuln>

  <vuln vid="b1e8c810-01d0-11da-bc08-0001020eed82">
    <topic>sylpheed -- MIME-encoded file name buffer overflow vulnerability</topic>
    <affects>
      <package>
	<name>sylpheed</name>
	<name>sylpheed-gtk2</name>
	<name>sylpheed-claws</name>
	<range><lt>1.0.4</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Sylpheed is vulnerable to a buffer overflow when displaying
	  emails with attachments that have MIME-encoded file names.
	  This could be used by a remote attacker to crash sylpheed
	  potentially allowing execution of arbitrary code with the
	  permissions of the user running sylpheed.</p>
      </body>
    </description>
    <references>
      <bid>12934</bid>
      <cvename>CVE-2005-0926</cvename>
      <url>http://sylpheed.good-day.net/changelog.html.en</url>
    </references>
    <dates>
      <discovery>2005-03-29</discovery>
      <entry>2005-07-31</entry>
    </dates>
  </vuln>

  <vuln vid="58247a96-01c8-11da-bc08-0001020eed82">
    <topic>phpmyadmin -- cross site scripting vulnerability</topic>
    <affects>
      <package>
	<name>phpmyadmin</name>
	<name>phpMyAdmin</name>
	<range><lt>2.6.2.r1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A phpMyAdmin security announcement reports:</p>
	<blockquote cite="http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-3">
	  <p>The convcharset parameter was not correctly validated,
	    opening the door to a XSS attack.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <bid>12982</bid>
      <cvename>CVE-2005-0992</cvename>
      <mlist msgid="4f9e4516050404101223fbdeed@mail.gmail.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=111264361622660</mlist>
      <url>http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-3</url>
    </references>
    <dates>
      <discovery>2005-04-03</discovery>
      <entry>2005-07-31</entry>
    </dates>
  </vuln>

  <vuln vid="8375a73f-01bf-11da-bc08-0001020eed82">
    <topic>gnupg -- OpenPGP symmetric encryption vulnerability</topic>
    <affects>
      <package>
	<name>gnupg</name>
	<range><lt>1.4.1</lt></range>
      </package>
      <package>
	<name>p5-Crypt-OpenPGP</name>
	<range><le>1.03</le></range>
      </package>
      <package>
	<name>pgp</name>
	<range><ge>3.0</ge></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Serge Mister and Robert Zuccherato reports that the OpenPGP
	  protocol is vulnerable to a cryptographic attack when using
	  symmetric encryption in an automated way.</p>
	<p>David Shaw reports about the impact:</p>
	<blockquote cite="http://lists.gnupg.org/pipermail/gnupg-announce/2005q1/000191.html">
	  <p>This attack, while very significant from a cryptographic
	    point of view, is not generally effective in the real
	    world.  To be specific, unless you have your OpenPGP
	    program set up as part of an automated system to accept
	    encrypted messages, decrypt them, and then provide a
	    response to the submitter, then this does not affect you
	    at all.</p>
	</blockquote>
	<p>Note that the <q>fix</q> in GnuPG does note completely
	  eliminate the potential problem:</p>
	<blockquote cite="http://lists.gnupg.org/pipermail/gnupg-announce/2005q1/000191.html">
	  <p>These patches disable a portion of the OpenPGP protocol
	    that the attack is exploiting.  This change should not be
	    user visible.  With the patch in place, this attack will
	    not work using a public-key encrypted message.  It will
	    still work using a passphrase-encrypted message.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <certvu>303094</certvu>
      <cvename>CVE-2005-0366</cvename>
      <url>http://eprint.iacr.org/2005/033</url>
      <url>http://lists.gnupg.org/pipermail/gnupg-announce/2005q1/000191.html</url>
      <url>http://www.pgp.com/newsroom/ctocorner/openpgp.html</url>
    </references>
    <dates>
      <discovery>2005-02-08</discovery>
      <entry>2005-07-31</entry>
      <modified>2007-04-23</modified>
    </dates>
  </vuln>

  <vuln vid="81f127a8-0038-11da-86bc-000e0c2e438a">
    <topic>vim -- vulnerabilities in modeline handling: glob, expand</topic>
    <affects>
      <package>
	<name>vim</name>
	<name>vim-console</name>
	<name>vim-lite</name>
	<name>vim+ruby</name>
	<range><ge>6.3</ge><lt>6.3.82</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Georgi Guninski discovered a way to construct Vim modelines
	  that execute arbitrary shell commands.  The vulnerability
	  can be exploited by including shell commands in modelines
	  that call the glob() or expand() functions.  An attacker
	  could trick an user to read or edit a trojaned file with
	  modelines enabled, after which the attacker is able to
	  execute arbitrary commands with the privileges of the user.</p>
	<p><strong>Note:</strong> It is generally recommended that VIM
	  users use <code>set nomodeline</code> in
	  <code>~/.vimrc</code> to avoid the possibility of trojaned
	  text files.</p>
      </body>
    </description>
    <references>
      <bid>14374</bid>
      <cvename>CVE-2005-2368</cvename>
      <url>http://www.guninski.com/where_do_you_want_billg_to_go_today_5.html</url>
    </references>
    <dates>
      <discovery>2005-07-25</discovery>
      <entry>2005-07-31</entry>
    </dates>
  </vuln>

  <vuln vid="68222076-010b-11da-bc08-0001020eed82">
    <topic>tiff -- buffer overflow vulnerability</topic>
    <affects>
      <package>
	<name>tiff</name>
	<range><lt>3.7.3</lt></range>
      </package>
      <package>
	<name>linux-tiff</name>
	<range><lt>3.6.1_3</lt></range>
      </package>
      <package>
	<name>pdflib</name>
	<name>pdflib-perl</name>
	<range><lt>6.0.1_2</lt></range>
      </package>
      <package>
	<name>gdal</name>
	<range><lt>1.2.1_2</lt></range>
      </package>
      <package>
	<name>ivtools</name>
	<range><lt>1.2.3</lt></range>
      </package>
      <package>
	<name>paraview</name>
	<range><lt>2.4.3</lt></range>
      </package>
      <package>
	<name>fractorama</name>
	<range><lt>1.6.7_1</lt></range>
      </package>
      <package>
	<name>iv</name>
	<name>ja-iv</name>
	<name>ja-libimg</name>
	<range><gt>0</gt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A Gentoo Linux Security Advisory reports:</p>
	<blockquote cite="http://www.gentoo.org/security/en/glsa/glsa-200505-07.xml">
	  <p>Tavis Ormandy of the Gentoo Linux Security Audit Team
	    discovered a stack based buffer overflow in the libTIFF
	    library when reading a TIFF image with a malformed
	    BitsPerSample tag.</p>
	  <p>Successful exploitation would require the victim to open
	    a specially crafted TIFF image, resulting in the execution
	    of arbitrary code.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-1544</cvename>
      <url>http://bugzilla.remotesensing.org/show_bug.cgi?id=843</url>
      <url>http://www.gentoo.org/security/en/glsa/glsa-200505-07.xml</url>
      <url>http://www.remotesensing.org/libtiff/v3.7.3.html</url>
    </references>
    <dates>
      <discovery>2005-05-10</discovery>
      <entry>2005-07-30</entry>
      <modified>2006-06-08</modified>
    </dates>
  </vuln>

  <vuln vid="934b1de4-00d7-11da-bc08-0001020eed82">
    <topic>opera -- image dragging vulnerability</topic>
    <affects>
      <package>
	<name>linux-opera</name>
	<name>opera-devel</name>
	<name>opera</name>
	<range><lt>8.02</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A Secunia Advisory reports:</p>
	<blockquote cite="http://secunia.com/advisories/15756/">
	  <p>Secunia Research has discovered a vulnerability in Opera,
	    which can be exploited by malicious people to conduct
	    cross-site scripting attacks and retrieve a user's
	    files.</p>
	  <p>The vulnerability is caused due to Opera allowing a user
	    to drag e.g. an image, which is actually a "javascript:"
	    URI, resulting in cross-site scripting if dropped over
	    another site. This may also be used to populate a file
	    upload form, resulting in uploading of arbitrary files to
	    a malicious web site.</p>
	  <p>Successful exploitation requires that the user is tricked
	    into dragging and dropping e.g. an image or a link.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <url>http://secunia.com/advisories/15756/</url>
      <url>http://www.opera.com/freebsd/changelogs/802/</url>
    </references>
    <dates>
      <discovery>2005-07-28</discovery>
      <entry>2005-07-30</entry>
      <modified>2006-06-08</modified>
    </dates>
  </vuln>

  <vuln vid="a2aa24fd-00d4-11da-bc08-0001020eed82">
    <topic>opera -- download dialog spoofing vulnerability</topic>
    <affects>
      <package>
	<name>linux-opera</name>
	<name>opera-devel</name>
	<name>opera</name>
	<range><lt>8.02</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A Secunia Advisory reports:</p>
	<blockquote cite="http://secunia.com/advisories/15870/">
	  <p>Secunia Research has discovered a vulnerability in Opera,
	    which can be exploited by malicious people to trick users
	    into executing malicious files.</p>
	  <p>The vulnerability is caused due to an error in the
	    handling of extended ASCII codes in the download
	    dialog. This can be exploited to spoof the file extension
	    in the file download dialog via a specially crafted
	    "Content-Disposition" HTTP header.</p>
	  <p>Successful exploitation may result in users being tricked
	    into executing a malicious file via the download dialog,
	    but requires that the "Arial Unicode MS" font
	    (ARIALUNI.TTF) has been installed on the system.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <url>http://secunia.com/advisories/15870/</url>
      <url>http://www.opera.com/freebsd/changelogs/802/</url>
    </references>
    <dates>
      <discovery>2005-07-28</discovery>
      <entry>2005-07-30</entry>
    </dates>
  </vuln>

  <vuln vid="5d51d245-00ca-11da-bc08-0001020eed82">
    <topic>ethereal -- multiple protocol dissectors vulnerabilities</topic>
    <affects>
      <package>
	<name>ethereal</name>
	<name>ethereal-lite</name>
	<name>tethereal</name>
	<name>tethereal-lite</name>
	<range><ge>0.8.5</ge><lt>0.10.12</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>An Ethreal Security Advisories reports:</p>
	<blockquote cite="http://www.ethereal.com/appnotes/enpa-sa-00020.html">
	  <p>Our testing program has turned up several more security
	    issues:</p>
	  <ul>
	    <li>The LDAP dissector could free static memory and crash.</li>
	    <li>The AgentX dissector could crash.</li>
	    <li>The 802.3 dissector could go into an infinite loop.</li>
	    <li>The PER dissector could abort.</li>
	    <li>The DHCP dissector could go into an infinite loop.</li>
	    <li>The BER dissector could abort or loop infinitely.</li>
	    <li>The MEGACO dissector could go into an infinite loop.</li>
	    <li>The GIOP dissector could dereference a null pointer.</li>
	    <li>The SMB dissector was susceptible to a buffer overflow.</li>
	    <li>The WBXML could dereference a null pointer.</li>
	    <li>The H1 dissector could go into an infinite loop.</li>
	    <li>The DOCSIS dissector could cause a crash.</li>
	    <li>The SMPP dissector could go into an infinite loop.</li>
	    <li>SCTP graphs could crash.</li>
	    <li>The HTTP dissector could crash.</li>
	    <li>The SMB dissector could go into a large loop.</li>
	    <li>The DCERPC dissector could crash.</li>
	    <li>Several dissectors could crash while reassembling packets.</li>
	  </ul>
	  <p>Steve Grubb at Red Hat found the following issues:</p>
	  <ul>
	    <li>The CAMEL dissector could dereference a null pointer.</li>
	    <li>The DHCP dissector could crash.</li>
	    <li>The CAMEL dissector could crash.</li>
	    <li>The PER dissector could crash.</li>
	    <li>The RADIUS dissector could crash.</li>
	    <li>The Telnet dissector could crash.</li>
	    <li>The IS-IS LSP dissector could crash.</li>
	    <li>The NCP dissector could crash.</li>
	  </ul>
	  <p>iDEFENSE found the following issues:</p>
	  <ul>
	    <li>Several dissectors were susceptible to a format string
	      overflow.</li>
	  </ul>
	  <h1>Impact:</h1>
	  <p>It may be possible to make Ethereal crash, use up
	    available memory, or run arbitrary code by injecting a
	    purposefully malformed packet onto the wire or by
	    convincing someone to read a malformed packet trace
	    file.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <url>http://www.ethereal.com/appnotes/enpa-sa-00020.html</url>
    </references>
    <dates>
      <discovery>2005-07-26</discovery>
      <entry>2005-07-30</entry>
    </dates>
  </vuln>

  <vuln vid="651996e0-fe07-11d9-8329-000e0c2e438a">
    <topic>apache -- http request smuggling</topic>
    <affects>
      <package>
	<name>apache</name>
	<range><lt>1.3.33_2</lt></range>
	<range><gt>2.*</gt><lt>2.0.54_1</lt></range>
	<range><gt>2.1.0</gt><lt>2.1.6_1</lt></range>
      </package>
      <package>
	<name>apache+ssl</name>
	<range><lt>1.3.33.1.55_1</lt></range>
      </package>
      <package>
	<name>apache+mod_perl</name>
	<range><lt>1.3.33_3</lt></range>
      </package>
      <package>
	<name>apache+mod_ssl</name>
	<name>apache+mod_ssl+ipv6</name>
	<name>apache+mod_ssl+mod_accel</name>
	<name>apache+mod_ssl+mod_accel+ipv6</name>
	<name>apache+mod_ssl+mod_accel+mod_deflate</name>
	<name>apache+mod_ssl+mod_accel+mod_deflate+ipv6</name>
	<name>apache+mod_ssl+mod_deflate</name>
	<name>apache+mod_ssl+mod_deflate+ipv6</name>
	<name>apache+mod_ssl+mod_snmp</name>
	<name>apache+mod_ssl+mod_snmp+mod_accel</name>
	<name>apache+mod_ssl+mod_snmp+mod_accel+ipv6</name>
	<name>apache+mod_ssl+mod_snmp+mod_deflate</name>
	<name>apache+mod_ssl+mod_snmp+mod_deflate+ipv6</name>
	<name>apache+mod_ssl+mod_snmp+mod_accel+mod_deflate+ipv6</name>
	<range><lt>1.3.33+2.8.22_1</lt></range>
      </package>
      <package>
	<name>apache_fp</name>
	<range><gt>0</gt></range>
      </package>
      <package>
	<name>apache+ipv6</name>
	<range><lt>1.3.37</lt></range>
      </package>
      <package>
	<name>ru-apache</name>
	<range><lt>1.3.34+30.22</lt></range>
      </package>
      <package>
	<name>ru-apache+mod_ssl</name>
	<range><lt>1.3.34+30.22+2.8.25</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A Watchfire whitepaper reports an vulnerability in the
	  Apache webserver.  The vulnerability can be exploited by
	  malicious people causing cross site scripting, web cache
	  poisoining, session hijacking and most importantly the
	  ability to bypass web application firewall protection.
	  Exploiting this vulnerability requires multiple carefully
	  crafted HTTP requests, taking advantage of an caching server,
	  proxy server, web application firewall etc. This only affects
	  installations where Apache is used as HTTP proxy in
	  combination with the following web servers:</p>
	<ul>
	  <li>IIS/6.0 and 5.0</li>
	  <li>Apache 2.0.45 (as web server)</li>
	  <li>apache 1.3.29</li>
	  <li>WebSphere 5.1 and 5.0</li>
	  <li>WebLogic 8.1 SP1</li>
	  <li>Oracle9iAS web server 9.0.2</li>
	  <li>SunONE web server 6.1 SP4</li>
	</ul>
      </body>
    </description>
    <references>
      <bid>14106</bid>
      <cvename>CVE-2005-2088</cvename>
      <url>http://www.watchfire.com/resources/HTTP-Request-Smuggling.pdf</url>
    </references>
    <dates>
      <discovery>2005-07-25</discovery>
      <entry>2005-07-26</entry>
      <modified>2009-01-23</modified>
    </dates>
  </vuln>

  <vuln vid="1db7ecf5-fd24-11d9-b4d6-0007e900f87b">
    <topic>clamav -- multiple remote buffer overflows</topic>
    <affects>
      <package>
	<name>clamav</name>
	<range><lt>0.86.2</lt></range>
      </package>
      <package>
	<name>clamav-devel</name>
	<range><le>20050704</le></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>An Secunia Advisory reports:</p>
	<blockquote cite="http://secunia.com/advisories/16180/">
	  <p>Neel Mehta and Alex Wheeler have reported some
	    vulnerabilities in Clam AntiVirus, which can be exploited
	    by malicious people to cause a DoS (Denial of Service)
	    or compromise a vulnerable system.</p>
	  <ol>
	    <li>Two integer overflow errors in "libclamav/tnef.c"
	      when processing TNEF files can be exploited to cause
	      a heap-based buffer overflow via a specially crafted
	      TNEF file with a length value of -1 in the header.</li>
	    <li>An integer overflow error in "libclamav/chmunpack.c"
	      can be exploited to cause a heap-based buffer overflow
	      via a specially crafted CHM file with a chunk entry that
	      has a filename length of -1.</li>
	    <li>A boundary error in "libclamav/fsg.c" when
	      processing a FSG compressed file can cause a heap-based
	      buffer overflow.</li>
	  </ol>
	</blockquote>
      </body>
    </description>
    <references>
      <url>http://www.rem0te.com/public/images/clamav.pdf</url>
      <url>http://secunia.com/advisories/16180/</url>
    </references>
    <dates>
      <discovery>2005-07-24</discovery>
      <entry>2005-07-25</entry>
    </dates>
  </vuln>

  <vuln vid="ccd325d2-fa08-11d9-bc08-0001020eed82">
    <topic>isc-dhcpd -- format string vulnerabilities</topic>
    <affects>
      <package>
	<name>isc-dhcp3-client</name>
	<name>isc-dhcp3-devel</name>
	<name>isc-dhcp3-relay</name>
	<name>isc-dhcp3-server</name>
	<name>isc-dhcp3</name>
	<name>isc-dhcp</name>
	<name>isc-dhcpd</name>
	<range><lt>3.0.1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The ISC DHCP programs are vulnerable to several format
	  string vulnerabilities which may allow a remote attacker to
	  execute arbitrary code with the permissions of the DHCP
	  programs, typically root for the DHCP server.</p>
      </body>
    </description>
    <references>
      <bid>11591</bid>
      <certvu>448384</certvu>
      <cvename>CVE-2004-1006</cvename>
      <mlist msgid="20041109003345.GG763@isc.org">http://marc.theaimsgroup.com/?l=dhcp-announce&amp;m=109996073218290</mlist>
    </references>
    <dates>
      <discovery>2004-11-08</discovery>
      <entry>2005-07-23</entry>
    </dates>
  </vuln>

  <vuln vid="b4892b5b-fb1c-11d9-96ba-00909925db3e">
    <topic>egroupware -- multiple cross-site scripting (XSS) and SQL injection vulnerabilities</topic>
    <affects>
      <package>
	<name>egroupware</name>
	<range><lt>1.0.0.007</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Multiple cross-site scripting (XSS) vulnerabilities in eGroupware
	  before 1.0.0.007 allow remote attackers to inject arbitrary web
	  script or HTML via the (1) ab_id, (2) page, (3) type,
	  or (4) lang parameter to index.php or (5) category_id parameter.
	</p>
	<p>Multiple SQL injection vulnerabilities in index.php in eGroupware
	  before 1.0.0.007 allow remote attackers to execute arbitrary SQL
	  commands via the (1) filter or (2) cats_app parameter.
	</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-1202</cvename>
      <cvename>CVE-2005-1203</cvename>
      <url>http://sourceforge.net/project/shownotes.php?release_id=320768</url>
    </references>
    <dates>
      <discovery>2005-04-20</discovery>
      <entry>2005-07-23</entry>
    </dates>
  </vuln>

  <vuln vid="3f4ac724-fa8b-11d9-afcf-0060084a00e5">
    <topic>fetchmail -- denial of service/crash from malicious POP3 server</topic>
    <affects>
      <package>
	<name>fetchmail</name>
	<range><eq>6.2.5.1</eq></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>In fetchmail 6.2.5.1, the remote code injection via
	  POP3 UIDL was fixed, but a denial of service attack was
	  introduced:</p>
	<p>Two possible NULL-pointer dereferences allow a malicious
	  POP3 server to crash fetchmail by respondig with UID lines
	  containing only the article number but no UID (in violation
	  of RFC-1939), or a message without Message-ID when no UIDL
	  support is available.</p>
      </body>
    </description>
    <references>
      <mlist msgid="20050721172317.GB3071@amilo.ms.mff.cuni.cz">http://lists.berlios.de/pipermail/fetchmail-devel/2005-July/000397.html</mlist>
      <url>http://www.fetchmail.info/fetchmail-SA-2005-01.txt</url>
    </references>
    <dates>
      <discovery>2005-07-21</discovery>
      <entry>2005-07-22</entry>
    </dates>
  </vuln>

  <vuln vid="e72fd82b-fa01-11d9-bc08-0001020eed82">
    <topic>dnrd -- remote buffer and stack overflow vulnerabilities</topic>
    <affects>
      <package>
	<name>dnrd</name>
	<range><lt>2.19.1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Natanael Copa reports that dnrd is vulnerable to a remote
	  buffer overflow and a remote stack overflow.	These
	  vulnerabilities can be triggered by sending invalid DNS
	  packets to dnrd.</p>
	<p>The buffer overflow could potentially be used to execute
	  arbitrary code with the permissions of the dnrd daemon.
	  Note that dnrd runs in an chroot environment and runs as
	  non-root.</p>
	<p>The stack overflow vulnerability can cause dnrd to
	  crash.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-2315</cvename>
      <cvename>CVE-2005-2316</cvename>
      <freebsdpr>ports/83851</freebsdpr>
    </references>
    <dates>
      <discovery>2005-07-21</discovery>
      <entry>2005-07-21</entry>
    </dates>
  </vuln>

  <vuln vid="43a7b0a7-f9bc-11d9-b473-00061bc2ad93">
    <topic>PowerDNS -- LDAP backend fails to escape all queries</topic>
    <affects>
      <package>
	<name>powerdns</name>
	<range><lt>2.9.18</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The LDAP backend in PowerDNS has issues with escaping
	  queries which could cause connection errors.	This would
	  make it possible for a malicious user to temporarily blank
	  domains.</p>
	<blockquote cite="http://doc.powerdns.com/security-policy.html">
	<p>This is known to affect all releases prior to 2.9.18.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-2302</cvename>
      <url>http://doc.powerdns.com/security-policy.html</url>
      <url>http://marc.theaimsgroup.com/?l=bugtraq&amp;m=112155941310297&amp;w=2</url>
    </references>
    <dates>
      <discovery>2005-07-16</discovery>
      <entry>2005-07-21</entry>
    </dates>
  </vuln>

  <vuln vid="3497d7be-2fef-45f4-8162-9063751b573a">
    <topic>fetchmail -- remote root/code injection from malicious POP3 server</topic>
    <affects>
      <package>
	<name>fetchmail</name>
	<range><lt>6.2.5.1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>fetchmail's POP3/UIDL code does not truncate received UIDs properly.
	  A malicious or compromised POP3 server can thus corrupt fetchmail's
	  stack and inject code when fetchmail is using UIDL, either through
	  configuration, or as a result of certain server capabilities. Note
	  that fetchmail is run as root on some sites, so an attack might
	  compromise the root account and thus the whole machine.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-2335</cvename>
      <freebsdpr>ports/83805</freebsdpr>
      <url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=212762</url>
      <url>http://www.fetchmail.info/fetchmail-SA-2005-01.txt</url>
    </references>
    <dates>
      <discovery>2005-07-20</discovery>
      <entry>2005-07-20</entry>
      <modified>2005-07-21</modified>
    </dates>
  </vuln>

  <vuln vid="2e116ba5-f7c3-11d9-928e-000b5d7e6dd5">
    <topic>kdebase -- Kate backup file permission leak</topic>
    <affects>
      <package>
	<name>kdebase</name>
	<range><ge>3.2.0</ge><lt>3.4.1</lt></range>
      </package>
      <package>
	<name>linux_base-suse</name>
	<range><ge>9.3</ge><lt>9.3_2</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A KDE Security Advisory explains:</p>
	<blockquote cite="http://www.kde.org/info/security/advisory-20050718-1.txt">
	  <p>Kate / Kwrite create a file backup before saving a modified
	    file. These backup files are created with default permissions,
	    even if the original file had more strict permissions set.</p>
	  <p>Depending on the system security settings, backup files
	    might be readable by other users.  Kate / Kwrite are
	    network transparent applications and therefore this
	    vulnerability might not be restricted to local users.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-1920</cvename>
      <url>https://bugs.kde.org/show_bug.cgi?id=103331</url>
      <url>http://www.kde.org/info/security/advisory-20050718-1.txt</url>
    </references>
    <dates>
      <discovery>2005-07-18</discovery>
      <entry>2005-07-18</entry>
      <modified>2005-10-09</modified>
    </dates>
  </vuln>

  <vuln vid="5d72701a-f601-11d9-bcd1-02061b08fc24">
    <topic>firefox &amp; mozilla -- multiple vulnerabilities</topic>
    <affects>
      <package>
	<name>firefox</name>
	<range><lt>1.0.5,1</lt></range>
      </package>
      <package>
	<name>linux-firefox</name>
	<range><lt>1.0.5</lt></range>
      </package>
      <package>
	<name>mozilla</name>
	<range><lt>1.7.9,2</lt></range>
	<range><ge>1.8.*,2</ge></range>
      </package>
      <package>
	<name>linux-mozilla</name>
	<name>linux-mozilla-devel</name>
	<range><lt>1.7.9</lt></range>
	<range><ge>1.8.*</ge></range>
      </package>
      <package>
	<name>netscape7</name>
	<range><ge>0</ge></range>
      </package>
      <package>
	<!-- These ports are obsolete. -->
	<name>de-linux-mozillafirebird</name>
	<name>el-linux-mozillafirebird</name>
	<name>ja-linux-mozillafirebird-gtk1</name>
	<name>ja-mozillafirebird-gtk2</name>
	<name>linux-mozillafirebird</name>
	<name>ru-linux-mozillafirebird</name>
	<name>zhCN-linux-mozillafirebird</name>
	<name>zhTW-linux-mozillafirebird</name>
	<range><ge>0</ge></range>
      </package>
      <package>
	<!-- These package names are obsolete. -->
	<name>de-linux-netscape</name>
	<name>de-netscape7</name>
	<name>fr-linux-netscape</name>
	<name>fr-netscape7</name>
	<name>ja-linux-netscape</name>
	<name>ja-netscape7</name>
	<name>linux-netscape</name>
	<name>linux-phoenix</name>
	<name>mozilla+ipv6</name>
	<name>mozilla-embedded</name>
	<name>mozilla-firebird</name>
	<name>mozilla-gtk1</name>
	<name>mozilla-gtk2</name>
	<name>mozilla-gtk</name>
	<name>mozilla-thunderbird</name>
	<name>phoenix</name>
	<name>pt_BR-netscape7</name>
	<range><ge>0</ge></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Mozilla Foundation reports of multiple security
	  vulnerabilities in Firefox and Mozilla:</p>
	<blockquote cite="http://www.mozilla.org/projects/security/known-vulnerabilities.html">
	  <ul>
	    <li><em>MFSA 2005-56</em> Code execution through shared function
	      objects</li>
	    <li><em>MFSA 2005-55</em> XHTML node spoofing</li>
	    <li><em>MFSA 2005-54</em> Javascript prompt origin spoofing</li>
	    <li><em>MFSA 2005-53</em> Standalone applications can run arbitrary
	      code through the browser</li>
	    <li><em>MFSA 2005-52</em> Same origin violation: frame calling
	      top.focus()</li>
	    <li><em>MFSA 2005-51</em> The return of frame-injection
	      spoofing</li>
	    <li><em>MFSA 2005-50</em> Possibly exploitable crash in
	      InstallVersion.compareTo()</li>
	    <li><em>MFSA 2005-49</em> Script injection from Firefox sidebar
	      panel using data:</li>
	    <li><em>MFSA 2005-48</em> Same-origin violation with InstallTrigger
	      callback</li>
	    <li><em>MFSA 2005-47</em> Code execution via "Set as
	      Wallpaper"</li>
	    <li><em>MFSA 2005-46</em> XBL scripts ran even when Javascript
	      disabled</li>
	    <li><em>MFSA 2005-45</em> Content-generated event
	      vulnerabilities</li>
	  </ul>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-1937</cvename>
      <cvename>CVE-2005-2260</cvename>
      <cvename>CVE-2005-2261</cvename>
      <cvename>CVE-2005-2262</cvename>
      <cvename>CVE-2005-2263</cvename>
      <cvename>CVE-2005-2264</cvename>
      <cvename>CVE-2005-2265</cvename>
      <cvename>CVE-2005-2266</cvename>
      <cvename>CVE-2005-2267</cvename>
      <cvename>CVE-2005-2268</cvename>
      <cvename>CVE-2005-2269</cvename>
      <cvename>CVE-2005-2270</cvename>
      <url>http://www.mozilla.org/projects/security/known-vulnerabilities.html</url>
      <url>http://www.mozilla.org/security/announce/mfsa2005-45.html</url>
      <url>http://www.mozilla.org/security/announce/mfsa2005-46.html</url>
      <url>http://www.mozilla.org/security/announce/mfsa2005-47.html</url>
      <url>http://www.mozilla.org/security/announce/mfsa2005-48.html</url>
      <url>http://www.mozilla.org/security/announce/mfsa2005-49.html</url>
      <url>http://www.mozilla.org/security/announce/mfsa2005-50.html</url>
      <url>http://www.mozilla.org/security/announce/mfsa2005-51.html</url>
      <url>http://www.mozilla.org/security/announce/mfsa2005-52.html</url>
      <url>http://www.mozilla.org/security/announce/mfsa2005-53.html</url>
      <url>http://www.mozilla.org/security/announce/mfsa2005-54.html</url>
      <url>http://www.mozilla.org/security/announce/mfsa2005-55.html</url>
      <url>http://www.mozilla.org/security/announce/mfsa2005-56.html</url>
    </references>
    <dates>
      <discovery>2005-07-12</discovery>
      <entry>2005-07-16</entry>
    </dates>
  </vuln>

  <vuln vid="f241641e-f5ea-11d9-a6db-000d608ed240">
    <topic>drupal -- PHP code execution vulnerabilities</topic>
    <affects>
      <package>
	<name>drupal</name>
	<range><lt>4.6.2</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Kuba Zygmunt discovered a flaw in the input validation routines
	  of Drupal's filter mechanism.  An attacker could execute
	  arbitrary PHP code on a target site when public comments or
	  postings are allowed.</p>
      </body>
    </description>
    <references>
	<cvename>CVE-2005-1921</cvename>
	<cvename>CVE-2005-2106</cvename>
	<url>http://drupal.org/files/sa-2005-002/advisory.txt</url>
    </references>
    <dates>
      <discovery>2005-06-29</discovery>
      <entry>2005-07-16</entry>
    </dates>
  </vuln>

  <vuln vid="50457509-d05e-11d9-9aed-000e0c2e438a">
    <topic>phpSysInfo -- cross site scripting vulnerability</topic>
    <affects>
      <package>
	<name>phpSysInfo</name>
	<range><lt>2.5.1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A Securityreason.com advisory reports that various cross
	  site scripting vulnerabilities have been found in phpSysInfo.
	  Input is not properly sanitised before it is returned to the
	  user.  A malicious person could exploit this to execute
	  arbitrary HTML and script code in a users browser session.
	  Also it is possible to view the full path of certain scripts
	  by accessing them directly.</p>
      </body>
    </description>
    <references>
      <bid>12887</bid>
      <cvename>CVE-2005-0869</cvename>
      <cvename>CVE-2005-0870</cvename>
      <mlist msgid="20050323180207.11987.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=111161017209422</mlist>
    </references>
    <dates>
      <discovery>2005-03-22</discovery>
      <entry>2005-07-09</entry>
      <modified>2005-12-25</modified>
    </dates>
  </vuln>

  <vuln vid="eeae6cce-d05c-11d9-9aed-000e0c2e438a">
    <topic>mysql-server -- insecure temporary file creation</topic>
    <affects>
      <package>
	<name>mysql-server</name>
	<range><gt>4.1</gt><lt>4.1.12</lt></range>
	<range><gt>5.0</gt><lt>5.0.6</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A Zataz advisory reports that MySQL contains a security
	  flaw which could allow a malicious local user to inject
	  arbitrary SQL commands during the initial database creation
	  process.</p>
	<p>The problem lies in the mysql_install_db script which
	  creates temporary files based on the PID used by the
	  script.</p>
      </body>
    </description>
    <references>
      <bid>13660</bid>
      <cvename>CVE-2005-1636</cvename>
      <url>http://www.zataz.net/adviso/mysql-05172005.txt</url>
    </references>
    <dates>
      <discovery>2005-05-07</discovery>
      <entry>2005-07-09</entry>
    </dates>
  </vuln>

  <vuln vid="3e0072d4-d05b-11d9-9aed-000e0c2e438a">
    <topic>net-snmp -- fixproc insecure temporary file creation</topic>
    <affects>
      <package>
	<name>net-snmp</name>
	<range><lt>5.2.1.2</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A Gentoo advisory reports:</p>
	<blockquote cite="http://www.gentoo.org/security/en/glsa/glsa-200505-18.xml">
	  <p>Net-SNMP creates temporary files in an insecure manner,
	    possibly allowing the execution of arbitrary code.</p>
	  <p>A malicious local attacker could exploit a race condition
	    to change the content of the temporary files before they
	    are executed by fixproc, possibly leading to the execution
	    of arbitrary code.	A local attacker could also create
	    symbolic links in the temporary files directory, pointing
	    to a valid file somewhere on the filesystem.  When fixproc
	    is executed, this would result in the file being
	    overwritten.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <bid>13715</bid>
      <cvename>CVE-2005-1740</cvename>
      <url>http://security.gentoo.org/glsa/glsa-200505-18.xml</url>
    </references>
    <dates>
      <discovery>2005-05-23</discovery>
      <entry>2005-07-09</entry>
      <modified>2005-07-13</modified>
    </dates>
  </vuln>

  <vuln vid="326c517a-d029-11d9-9aed-000e0c2e438a">
    <topic>phpbb -- multiple vulnerabilities</topic>
    <affects>
      <package>
	<name>phpbb</name>
	<range><lt>2.0.12</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>phpBB is vulnerable to remote exploitation of an input
	  validation vulnerability allows attackers to read the
	  contents of arbitrary system files under the privileges
	  of the webserver.  This also allows remote attackers to
	  unlink arbitrary system files under the privileges of the
	  webserver.</p>
      </body>
    </description>
    <references>
      <bid>12618</bid>
      <bid>12621</bid>
      <bid>12623</bid>
      <cvename>CVE-2005-0258</cvename>
      <cvename>CVE-2005-0259</cvename>
      <url>http://security.gentoo.org/glsa/glsa-200503-02.xml</url>
      <url>http://www.idefense.com/application/poi/display?id=205&amp;type=vulnerabilities</url>
      <url>http://www.idefense.com/application/poi/display?id=204&amp;type=vulnerabilities</url>
    </references>
    <dates>
      <discovery>2005-02-22</discovery>
     <entry>2005-07-09</entry>
    </dates>
  </vuln>

  <vuln vid="6596bb80-d026-11d9-9aed-000e0c2e438a">
    <topic>shtool -- insecure temporary file creation</topic>
    <affects>
      <package>
	<name>shtool</name>
	<range><le>2.0.1</le></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A Zataz advisory reports that shtool contains a security
	  flaw which could allow a malicious local user to create or
	  overwrite the contents of arbitrary files.  The attacker
	  could fool a user into executing the arbitrary file possibly
	  executing arbitrary code.</p>
      </body>
    </description>
    <references>
      <bid>13767</bid>
      <url>http://www.zataz.net/adviso/shtool-05252005.txt</url>
    </references>
    <dates>
      <discovery>2005-05-25</discovery>
      <entry>2005-07-09</entry>
    </dates>
  </vuln>

  <vuln vid="88188a8c-eff6-11d9-8310-0001020eed82">
    <topic>phppgadmin -- "formLanguage" local file inclusion vulnerability</topic>
    <affects>
      <package>
	<name>phppgadmin</name>
	<range><lt>3.5.4</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A Secunia Advisory reports:</p>
	<blockquote cite="http://secunia.com/advisories/15941/">
	  <p>A vulnerability has been reported in phpPgAdmin, which
	    can be exploited by malicious people to disclose sensitive
	    information.</p>
	  <p>Input passed to the "formLanguage" parameter in
	    "index.php" isn't properly verified, before it is used to
	    include files. This can be exploited to include arbitrary
	    files from local resources.</p>
	  <p>Successful exploitation requires that "magic_quotes_gpc"
	    is disabled.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <bid>14142</bid>
      <cvename>CVE-2005-2256</cvename>
      <url>http://secunia.com/advisories/15941/</url>
      <url>http://sourceforge.net/project/shownotes.php?release_id=342261</url>
    </references>
    <dates>
      <discovery>2005-07-05</discovery>
      <entry>2005-07-08</entry>
      <modified>2005-07-21</modified>
    </dates>
  </vuln>

  <vuln vid="b64481d9-eff4-11d9-8310-0001020eed82">
    <topic>pear-XML_RPC -- information disclosure vulnerabilities</topic>
    <affects>
      <package>
	<name>pear-XML_RPC</name>
	<range><lt>1.3.2</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The pear-XML_RPC release notes reports that the following
	  issues has been fixed:</p>
	<blockquote cite="http://pear.php.net/package/XML_RPC/download/1.3.2">
	  <p>Eliminate path disclosure vulnerabilities by suppressing
	    error messages when eval()'ing.</p>
	  <p>Eliminate path disclosure vulnerability by catching bogus
	    parameters submitted to
	    <code>XML_RPC_Value::serializeval()</code>.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <url>http://pear.php.net/package/XML_RPC/download/1.3.2</url>
    </references>
    <dates>
      <discovery>2005-07-07</discovery>
      <entry>2005-07-08</entry>
    </dates>
  </vuln>

  <vuln vid="9a035a56-eff0-11d9-8310-0001020eed82">
    <topic>ekg -- insecure temporary file creation</topic>
    <affects>
      <package>
	<name>pl-ekg</name>
	<range><lt>1.6r2,1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Eric Romang reports that ekg creates temporary files in an
	  insecure manner.  This can be exploited by an attacker using
	  a symlink attack to overwrite arbitrary files and possibly
	  execute arbitrary commands with the permissions of the user
	  running ekg.</p>
      </body>
    </description>
    <references>
      <bid>14146</bid>
      <cvename>CVE-2005-1916</cvename>
      <mlist msgid="42CA2DDB.5030606@zataz.net">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=112060146011122</mlist>
      <url>http://bugs.gentoo.org/show_bug.cgi?id=94172</url>
    </references>
    <dates>
      <discovery>2005-07-05</discovery>
      <entry>2005-07-08</entry>
      <modified>2005-07-31</modified>
    </dates>
  </vuln>

  <vuln vid="6e33f4ab-efed-11d9-8310-0001020eed82">
    <topic>bugzilla -- multiple vulnerabilities</topic>
    <affects>
      <package>
	<name>bugzilla</name>
	<name>ja-bugzilla</name>
	<range><ge>2.17.1</ge><lt>2.18.2</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A Bugzilla Security Advisory reports:</p>
	<blockquote cite="http://www.bugzilla.org/security/2.18.1/">
	  <p>Any user can change any flag on any bug, even if they
	    don't have access to that bug, or even if they can't
	    normally make bug changes. This also allows them to expose
	    the summary of a bug.</p>
	  <p>Bugs are inserted into the database before they are
	    marked as private, in Bugzilla code. Thus, MySQL
	    replication can lag in between the time that the bug is
	    inserted and when it is marked as private (usually less
	    than a second). If replication lags at this point, the bug
	    summary will be accessible to all users until replication
	    catches up.  Also, on a very slow machine, there may be a
	    pause longer than a second that allows users to see the
	    title of the newly-filed bug.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-2173</cvename>
      <cvename>CVE-2005-2174</cvename>
      <url>http://www.bugzilla.org/security/2.18.1/</url>
      <url>https://bugzilla.mozilla.org/show_bug.cgi?id=292544</url>
      <url>https://bugzilla.mozilla.org/show_bug.cgi?id=293159</url>
    </references>
    <dates>
      <discovery>2005-07-07</discovery>
      <entry>2005-07-08</entry>
      <modified>2005-07-18</modified>
    </dates>
  </vuln>

  <vuln vid="d177d9f9-e317-11d9-8088-00123f0f7307">
    <topic>nwclient -- multiple vulnerabilities</topic>
    <affects>
      <package>
	<name>nwclient</name>
	<range><gt>0</gt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Insecure file permissions, network access control and DNS
	  usage put systems that use Legato NetWorker at risk.</p>
	<p>When the software is running, several files that contain
	  sensitive information are created with insecure permissions.
	  The information exposed include passwords and can therefore
	  be used for privilege elevation.</p>
	<p>An empty "servers" file, which should normally
	  contain hostnames of authorized backup servers, may allow
	  unauthorized backups to be made. Sensitive information can
	  be extracted from these backups.</p>
	<p>When reverse DNS fails for the Legato client IP a weak
	  authorization scheme, containing a flaw that allows
	  unauthorized access, is used. This may allow unauthorized
	  access.</p>
      </body>
    </description>
    <references>
      <bid>3564</bid>
      <bid>3840</bid>
      <bid>3842</bid>
      <cvename>CVE-2001-0910</cvename>
      <cvename>CVE-2002-0113</cvename>
      <cvename>CVE-2002-0114</cvename>
      <url>http://portal1.legato.com/resources/bulletins/372.html</url>
    </references>
    <dates>
      <discovery>2002-01-10</discovery>
      <entry>2005-07-08</entry>
    </dates>
  </vuln>

  <vuln vid="107692a1-ee6c-11d9-8310-0001020eed82">
    <topic>acroread -- insecure temporary file creation</topic>
    <affects>
      <package>
	<name>acroread4</name>
	<name>acroread5</name>
	<range><ge>0</ge></range>
      </package>
      <package>
	<name>acroread</name>
	<range><lt>7.0.0</lt></range>
	<range><gt>5.*,1</gt><lt>7.0.0,1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia Research reports:</p>
	<blockquote cite="http://secunia.com/secunia_research/2005-6/advisory/">
	  <p>Secunia has discovered a security issue in Adobe Reader
	    for Linux, which can be exploited by malicious, local
	    users to gain knowledge of sensitive information.</p>
	  <p>The problem is caused due to temporary files being
	    created with permissions based on a user's umask in the
	    "/tmp" folder under certain circumstances when documents
	    are opened.</p>
	  <p>Successful exploitation allows an unprivileged user to
	    read arbitrary users' documents.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-1912</cvename>
      <url>http://secunia.com/secunia_research/2005-6/advisory/</url>
    </references>
    <dates>
      <discovery>2005-06-29</discovery>
      <entry>2005-07-06</entry>
    </dates>
  </vuln>

  <vuln vid="d8e1aadd-ee68-11d9-8310-0001020eed82">
    <topic>clamav -- cabinet file handling DoS vulnerability</topic>
    <affects>
      <package>
	<name>clamav</name>
	<range><lt>0.86</lt></range>
      </package>
      <package>
	<name>clamav-devel</name>
	<range><lt>20050620</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>An iDEFENSE Security Advisory reports:</p>
	<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=112006456809016">
	  <p>Remote exploitation of an input validation error in Clam
	    AntiVirus ClamAV allows attackers to cause a denial of
	    service condition.</p>
	  <p>The vulnerability specifically exists due to insufficient
	    validation on cabinet file header data. The
	    <code>ENSURE_BITS()</code> macro fails to check for zero
	    length reads, allowing a carefully constructed cabinet
	    file to cause an infinite loop.</p>
	  <p>ClamAV is used in a number of mail gateway
	    products. Successful exploitation requires an attacker to
	    send a specially constructed CAB file through a mail
	    gateway or personal anti-virus client utilizing the ClamAV
	    scanning engine. The infinate loop will cause the ClamAV
	    software to use all available processor resources,
	    resulting in a denial of service or severe degradation to
	    system performance. Remote exploitation can be achieved by
	    sending a malicious file in an e-mail message or during an
	    HTTP session.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-1923</cvename>
      <mlist msgid="FB24803D1DF2A34FA59FC157B77C97050462A3AB@IDSERV04.idef.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=112006456809016</mlist>
    </references>
    <dates>
      <discovery>2005-06-29</discovery>
      <entry>2005-07-06</entry>
    </dates>
  </vuln>

  <vuln vid="6d18fe19-ee67-11d9-8310-0001020eed82">
    <topic>clamav -- MS-Expand file handling DoS vulnerability</topic>
    <affects>
      <package>
	<name>clamav</name>
	<range><lt>0.86</lt></range>
      </package>
      <package>
	<name>clamav-devel</name>
	<range><lt>20050620</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>An iDEFENSE Security Advisory reports:</p>
	<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=112006402411598">
	  <p>Remote exploitation of an input validation error in Clam
	    AntiVirus ClamAV allows attackers to cause a denial of
	    service condition.</p>
	  <p>The vulnerability specifically exists due to improper
	    behavior during exceptional conditions.</p>
	  <p>Successful exploitation allows attackers to exhaust file
	    descriptors pool and memory. Anti-virus detection
	    functionality will fail if there is no file descriptors
	    available with which to open files. Remote exploitation
	    can be achieved by sending a malicious file in an e-mail
	    message or during an HTTP session.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-1922</cvename>
      <mlist msgid="FB24803D1DF2A34FA59FC157B77C97050462A3AC@IDSERV04.idef.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=112006402411598</mlist>
    </references>
    <dates>
      <discovery>2005-06-29</discovery>
      <entry>2005-07-06</entry>
    </dates>
  </vuln>

  <vuln vid="8efe93e2-ee62-11d9-8310-0001020eed82">
    <topic>zlib -- buffer overflow vulnerability</topic>
    <affects>
      <package>
	<name>zsync</name>
	<range><lt>0.4.1</lt></range>
      </package>
      <package>
	<name>FreeBSD</name>
	<range><ge>5.4</ge><lt>5.4_4</lt></range>
	<range><ge>5.3</ge><lt>5.3_18</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description</h1>
	<p>An error in the handling of corrupt compressed data streams
	  can result in a buffer being overflowed.</p>
	<h1>Impact</h1>
	<p>By carefully crafting a corrupt compressed data stream, an
	  attacker can overwrite data structures in a zlib-using
	  application.	This may cause the application to halt,
	  causing a denial of service; or it may result in the
	  attacker gaining elevated privileges.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-2096</cvename>
      <freebsdsa>SA-05:16.zlib</freebsdsa>
    </references>
    <dates>
      <discovery>2005-07-06</discovery>
      <entry>2005-07-06</entry>
      <modified>2005-10-01</modified>
    </dates>
  </vuln>

  <vuln vid="70c59485-ee5a-11d9-8310-0001020eed82">
    <topic>acroread -- buffer overflow vulnerability</topic>
    <affects>
      <package>
	<name>acroread4</name>
	<name>acroread5</name>
	<range><ge>0</ge></range>
      </package>
      <package>
	<name>acroread</name>
	<range><lt>7.0.0</lt></range>
	<range><gt>5.*,1</gt><lt>7.0.0,1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>An Adobe Security Advisory reports:</p>
	<blockquote cite="http://www.adobe.com/support/techdocs/329083.html">
	  <p>A vulnerability within Adobe Reader has been
	    identified. Under certain circumstances, remote
	    exploitation of a buffer overflow in Adobe Reader could
	    allow an attacker to execute arbitrary code.</p>
	  <p>If exploited, it could allow the execution of arbitrary
	    code under the privileges of the local user. Remote
	    exploitation is possible if the malicious PDF document is
	    sent as an email attachment or if the PDF document is
	    accessed via a web link.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-1625</cvename>
      <url>http://www.adobe.com/support/techdocs/329083.html</url>
      <mlist msgid="FB24803D1DF2A34FA59FC157B77C97050462A5E2@IDSERV04.idef.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=112059685332569</mlist>
    </references>
    <dates>
      <discovery>2005-07-05</discovery>
      <entry>2005-07-06</entry>
    </dates>
  </vuln>

  <vuln vid="b2a1a3b5-ed95-11d9-8310-0001020eed82">
    <topic>net-snmp -- remote DoS vulnerability</topic>
    <affects>
      <package>
	<name>net-snmp</name>
	<range><lt>5.2.1.2</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A Net-SNMP release announcement reports:</p>
	<blockquote cite="http://marc.theaimsgroup.com/?l=net-snmp-announce&amp;m=112059518426328">
	  <p>A security vulnerability has been found in Net-SNMP
	    releases that could allow a denial of service attack
	    against Net-SNMP agent's which have opened a stream based
	    protocol (EG, TCP but not UDP; it should be noted that
	    Net-SNMP does not by default open a TCP port).</p>
	</blockquote>
      </body>
    </description>
    <references>
      <bid>14168</bid>
      <cvename>CVE-2005-2177</cvename>
      <mlist msgid="sdzmt5sul0.fsf@wes.hardakers.net">http://marc.theaimsgroup.com/?l=net-snmp-announce&amp;m=112059518426328</mlist>
    </references>
    <dates>
      <discovery>2005-07-02</discovery>
      <entry>2005-07-05</entry>
      <modified>2005-10-26</modified>
    </dates>
  </vuln>

  <vuln vid="1cf00643-ed8a-11d9-8310-0001020eed82">
    <topic>cacti -- multiple vulnerabilities</topic>
    <affects>
      <package>
	<name>cacti</name>
	<range><lt>0.8.6f</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Stefan Esser reports:</p>
	<blockquote cite="http://www.hardened-php.net/advisory-032005.php">
	  <p>Wrongly implemented user input filters lead to multiple
	    SQL Injection vulnerabilities which can lead f.e. to
	    disclosure of the admin password hash.</p>
	</blockquote>
	<blockquote cite="http://www.hardened-php.net/advisory-042005.php">
	  <p>Wrongly implemented user input filters allows injection
	    of user input into executed commandline.</p>
	  <p>Alberto Trivero posted his Remote Command Execution
	    Exploit for Cacti &lt;= 0.8.6d to Bugtraq on the 22th
	    June. Having analysed his bug we come to the conclusion,
	    that the malfunctioning input filters, which were already
	    mentioned in the previous advisory are also responsible
	    for this bug still being exploitable.</p>
	</blockquote>
	<blockquote cite="http://www.hardened-php.net/advisory-052005.php">
	  <p>A HTTP headers bypass switch can also be used to
	    completely bypass the authentification system of Cacti. As
	    admin it is possible to execute shell commands with the
	    permission of the webserver.</p>
	  <p>While looking at the source of Cacti a HTTP headers
	    bypass switch was discovered, that also switches off a
	    call to <code>session_start()</code> and the manual
	    application of <code>addslashes()</code> in case of
	    <code>magic_quotes_gpc=Off</code>.</p>
	  <p>When register_globals is turned on* an attacker can use
	    this switch to disables Cacti's use of PHP's session
	    support and therefore supply the session variables on his
	    own through f.e.  the URL. Additionally using the switch
	    renders several SQL statements vulnerable to SQL
	    Injections attacks, when magic_quotes_gpc is turned off,
	    which is the recommended setting.</p>
	  <p>Logged in as an admin it is possible to issue shell
	    commands.</p>
	  <p>(*) register_globals is turned off by default since PHP
	    4.2 but is activated on most servers because of older
	    scripts requiring it.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <mlist msgid="007301c57753$5ab17f60$0100a8c0@alberto">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=111954136315248</mlist>
      <url>http://www.hardened-php.net/advisory-032005.php</url>
      <url>http://www.hardened-php.net/advisory-042005.php</url>
      <url>http://www.hardened-php.net/advisory-052005.php</url>
    </references>
    <dates>
      <discovery>2005-06-22</discovery>
      <entry>2005-07-05</entry>
    </dates>
  </vuln>

  <vuln vid="dca0a345-ed81-11d9-8310-0001020eed82">
    <topic>wordpress -- multiple vulnerabilities</topic>
    <affects>
      <package>
	<name>wordpress</name>
	<range><lt>1.5.1.3,1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>GulfTech Security Research reports:</p>
	<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=112006967221438">
	  <p>There are a number of vulnerabilities in WordPress that
	    may allow an attacker to ultimately run arbitrary code on
	    the vulnerable system. These vulnerabilities include SQL
	    Injection, Cross Site Scripting, and also issues that may
	    aid an attacker in social engineering.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-2107</cvename>
      <cvename>CVE-2005-2108</cvename>
      <cvename>CVE-2005-2109</cvename>
      <cvename>CVE-2005-2110</cvename>
      <mlist msgid="42C2BE6E.2050408@gulftech.org">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=112006967221438</mlist>
    </references>
    <dates>
      <discovery>2005-06-28</discovery>
      <entry>2005-07-05</entry>
    </dates>
  </vuln>

  <vuln vid="a4955b32-ed84-11d9-8310-0001020eed82">
    <topic>wordpress -- multiple vulnerabilities</topic>
    <affects>
      <package>
	<name>wordpress</name>
	<range><lt>1.5.1.2,1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A Gentoo Linux Security Advisory reports:</p>
	<blockquote cite="http://www.gentoo.org/security/en/glsa/glsa-200506-04.xml">
	  <p>Due to a lack of input validation, WordPress is
	    vulnerable to SQL injection and XSS attacks.</p>
	  <p>An attacker could use the SQL injection vulnerabilities to
	    gain information from the database. Furthermore the
	    cross-site scripting issues give an attacker the ability
	    to inject and execute malicious script code or to steal
	    cookie-based authentication credentials, potentially
	    compromising the victim's browser.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-1810</cvename>
      <url>http://www.gentoo.org/security/en/glsa/glsa-200506-04.xml</url>
    </references>
    <dates>
      <discovery>2005-04-12</discovery>
      <entry>2005-07-05</entry>
    </dates>
  </vuln>

  <vuln vid="4afacca1-eb9d-11d9-a8bd-000cf18bbe54">
    <topic>phpbb -- remote PHP code execution vulnerability</topic>
    <affects>
      <package>
	<name>phpbb</name>
	<range><lt>2.0.16</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>FrSIRT Advisory reports:</p>
	<blockquote cite="http://www.frsirt.com/english/advisories/2005/0904">
	  <p>A vulnerability was identified in phpBB, which
	    may be exploited by attackers to compromise a vulnerable
	    web server. This flaw is due to an input validation error
	    in the "viewtopic.php" script that does not properly filter
	    the "highlight" parameter before calling the "preg_replace()"
	    function, which may be exploited by remote attackers to execute
	    arbitrary PHP commands with the privileges of the web server.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-2086</cvename>
      <url>http://www.frsirt.com/english/advisories/2005/0904</url>
      <url>http://www.phpbb.com/phpBB/viewtopic.php?t=302011</url>
    </references>
    <dates>
      <discovery>2005-06-28</discovery>
      <entry>2005-07-03</entry>
      <modified>2005-07-07</modified>
    </dates>
  </vuln>

  <vuln vid="523fad14-eb9d-11d9-a8bd-000cf18bbe54">
    <topic>pear-XML_RPC -- arbitrary remote code execution</topic>
    <affects>
      <package>
	<name>pear-XML_RPC</name>
	<range><lt>1.3.1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>GulfTech Security Research Team reports:</p>
	<blockquote cite="http://www.gulftech.org/?node=research&amp;article_id=00087-07012005">
	  <p>PEAR XML_RPC is vulnerable to a very high risk php code
	    injection vulnerability due to unsanatized data being
	    passed into an eval() call.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-1921</cvename>
      <url>http://www.gulftech.org/?node=research&amp;article_id=00087-07012005</url>
      <url>http://www.hardened-php.net/advisory-022005.php</url>
    </references>
    <dates>
      <discovery>2005-06-29</discovery>
      <entry>2005-07-03</entry>
    </dates>
  </vuln>

  <vuln vid="f70f8860-e8ee-11d9-b875-0001020eed82">
    <topic>kernel -- ipfw packet matching errors with address tables</topic>
    <affects>
      <package>
	<name>FreeBSD</name>
	<range><ge>5.4</ge><lt>5.4_3</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description</h1>
	<p>The ipfw tables lookup code caches the result of the last
	  query.  The kernel may process multiple packets
	  concurrently, performing several concurrent table lookups.
	  Due to an insufficient locking, a cached result can become
	  corrupted that could cause some addresses to be incorrectly
	  matched against a lookup table.</p>
	<h1>Impact</h1>
	<p>When lookup tables are used with ipfw, packets may on very
	  rare occasions incorrectly match a lookup table.  This could
	  result in a packet being treated contrary to the defined
	  packet filtering ruleset. For example, a packet may be
	  allowed to pass through when it should have been
	  discarded.</p>
	<p>The problem can only occur on Symmetric Multi-Processor
	  (SMP) systems, or on Uni Processor (UP) systems with the
	  PREEMPTION kernel option enabled (not the default).</p>
	<h1>Workaround</h1>
	<p>a) Do not use lookup tables.</p>
	<p>OR</p>
	<p>b) Disable concurrent processing of packets in the network
	  stack by setting the "debug.mpsafenet=0" tunable:</p>
	<p># echo "debug.mpsafenet=0" &lt;&lt; /boot/loader.conf</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-2019</cvename>
      <freebsdsa>SA-05:13.ipfw</freebsdsa>
    </references>
    <dates>
      <discovery>2005-06-29</discovery>
      <entry>2005-06-29</entry>
      <modified>2005-07-06</modified>
    </dates>
  </vuln>

  <vuln vid="197f444f-e8ef-11d9-b875-0001020eed82">
    <topic>bzip2 -- denial of service and permission race vulnerabilities</topic>
    <affects>
      <package>
	<name>FreeBSD</name>
	<range><ge>5.4</ge><lt>5.4_3</lt></range>
	<range><ge>5.0</ge><lt>5.3_17</lt></range>
	<range><ge>4.11</ge><lt>4.11_11</lt></range>
	<range><lt>4.10_16</lt></range>
      </package>
      <package>
	<name>bzip2</name>
	<range><lt>1.0.3_1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description</h1>
	<p>Two problems have been discovered relating to the
	  extraction of bzip2-compressed files.  First, a carefully
	  constructed invalid bzip2 archive can cause bzip2 to enter
	  an infinite loop.  Second, when creating a new file, bzip2
	  closes the file before setting its permissions.</p>
	<h1>Impact</h1>
	<p>The first problem can cause bzip2 to extract a bzip2
	  archive to an infinitely large file.	If bzip2 is used in
	  automated processing of untrusted files this could be
	  exploited by an attacker to create an denial-of-service
	  situation by exhausting disk space or by consuming all
	  available cpu time.</p>
	<p>The second problem can allow a local attacker to change the
	  permissions of local files owned by the user executing bzip2
	  providing that they have write access to the directory in
	  which the file is being extracted.</p>
	<h1>Workaround</h1>
	<p>Do not uncompress bzip2 archives from untrusted sources and
	  do not uncompress files in directories where untrusted users
	  have write access.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-0953</cvename>
      <cvename>CVE-2005-1260</cvename>
      <freebsdsa>SA-05:14.bzip2</freebsdsa>
      <url>http://scary.beasts.org/security/CESA-2005-002.txt</url>
    </references>
    <dates>
      <discovery>2005-03-30</discovery>
      <entry>2005-06-29</entry>
      <modified>2016-08-09</modified>
    </dates>
  </vuln>

  <vuln vid="3ec8f43b-e8ef-11d9-b875-0001020eed82">
    <topic>kernel -- TCP connection stall denial of service</topic>
    <affects>
      <package>
	<name>FreeBSD</name>
	<range><ge>5.4</ge><lt>5.4_3</lt></range>
	<range><ge>5.0</ge><lt>5.3_17</lt></range>
	<range><ge>4.11</ge><lt>4.11_11</lt></range>
	<range><lt>4.10_16</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description</h1>
	<p>Two problems have been discovered in the FreeBSD TCP stack.</p>
	<p>First, when a TCP packets containing a timestamp is
	  received, inadequate checking of sequence numbers is
	  performed, allowing an attacker to artificially increase the
	  internal "recent" timestamp for a connection.</p>
	<p>Second, a TCP packet with the SYN flag set is accepted for
	  established connections, allowing an attacker to overwrite
	  certain TCP options.</p>
	<h1>Impact</h1>
	<p>Using either of the two problems an attacker with knowledge
	  of the local and remote IP and port numbers associated with
	  a connection can cause a denial of service situation by
	  stalling the TCP connection. The stalled TCP connection my
	  be closed after some time by the other host.</p>
	<h1>Workaround</h1>
	<p>In some cases it may be possible to defend against these
	  attacks by blocking the attack packets using a firewall.
	  Packets used to effect either of these attacks would have
	  spoofed source IP addresses.</p>
      </body>
    </description>
    <references>
      <certvu>637934</certvu>
      <cvename>CVE-2005-0356</cvename>
      <cvename>CVE-2005-2068</cvename>
      <freebsdsa>SA-05:15.tcp</freebsdsa>
    </references>
    <dates>
      <discovery>2005-06-29</discovery>
      <entry>2005-06-29</entry>
      <modified>2016-08-09</modified>
    </dates>
  </vuln>

  <vuln vid="76adaab0-e4e3-11d9-b875-0001020eed82">
    <topic>ethereal -- multiple protocol dissectors vulnerabilities</topic>
    <affects>
      <package>
	<name>ethereal</name>
	<name>ethereal-lite</name>
	<name>tethereal</name>
	<name>tethereal-lite</name>
	<range><ge>0.8.14</ge><lt>0.10.11</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>An Ethreal Security Advisories reports:</p>
	<blockquote cite="http://www.ethereal.com/appnotes/enpa-sa-00019.html">
	  <p>An aggressive testing program as well as independent
	    discovery has turned up a multitude of security issues</p>
	  <p>Please reference CVE/URL list for details</p>
	</blockquote>
      </body>
    </description>
    <references>
      <bid>13391</bid>
      <bid>13504</bid>
      <bid>13567</bid>
      <cvename>CVE-2005-1281</cvename>
      <cvename>CVE-2005-1456</cvename>
      <cvename>CVE-2005-1457</cvename>
      <cvename>CVE-2005-1458</cvename>
      <cvename>CVE-2005-1459</cvename>
      <cvename>CVE-2005-1460</cvename>
      <cvename>CVE-2005-1461</cvename>
      <cvename>CVE-2005-1462</cvename>
      <cvename>CVE-2005-1463</cvename>
      <cvename>CVE-2005-1464</cvename>
      <cvename>CVE-2005-1465</cvename>
      <cvename>CVE-2005-1466</cvename>
      <cvename>CVE-2005-1467</cvename>
      <cvename>CVE-2005-1468</cvename>
      <cvename>CVE-2005-1469</cvename>
      <cvename>CVE-2005-1470</cvename>
      <url>http://www.ethereal.com/appnotes/enpa-sa-00019.html</url>
    </references>
    <dates>
      <discovery>2005-05-04</discovery>
      <entry>2005-06-24</entry>
    </dates>
  </vuln>

  <vuln vid="691ed622-e499-11d9-a8bd-000cf18bbe54">
    <topic>tor -- information disclosure</topic>
    <affects>
      <package>
	<name>tor</name>
	<range><lt>0.1.0.10</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Roger Dingledine reports:</p>
	<blockquote cite="http://archives.seul.org/or/announce/Jun-2005/msg00001.html">
	  <p>The Tor 0.1.0.10 release from a few days ago
	    includes a fix for a bug that might allow an attacker
	    to read arbitrary memory (maybe even keys) from an exit
	    server's process space.  We haven't heard any reports of
	    exploits yet, but hey.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <mlist>http://archives.seul.org/or/announce/Jun-2005/msg00001.html</mlist>
    </references>
    <dates>
      <discovery>2005-06-16</discovery>
      <entry>2005-06-24</entry>
    </dates>
  </vuln>

  <vuln vid="95ee96f2-e488-11d9-bf22-080020c11455">
    <topic>linux-realplayer -- RealText parsing heap overflow</topic>
    <affects>
      <package>
	<name>linux-realplayer</name>
	<range><le>10.0.4_1</le></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>An iDEFENSE Security Advisory reports:</p>
	<blockquote cite="http://www.idefense.com/application/poi/display?id=250&amp;type=vulnerabilities&amp;flashstatus=false">
	  <p>Remote exploitation of a heap-based buffer
	    overflow vulnerability in the RealText file format
	    parser within various versions of RealNetworks
	    Inc.'s RealPlayer could allow attackers to
	    execute arbitrary code.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-1277</cvename>
      <url>http://www.idefense.com/application/poi/display?id=250&amp;type=vulnerabilities&amp;flashstatus=false</url>
      <url>http://service.real.com/help/faq/security/050623_player/EN/</url>
    </references>
    <dates>
      <discovery>2005-06-23</discovery>
      <entry>2005-06-24</entry>
    </dates>
  </vuln>

  <vuln vid="594eb447-e398-11d9-a8bd-000cf18bbe54">
    <topic>ruby -- arbitrary command execution on XMLRPC server</topic>
    <affects>
      <package>
	<name>ruby</name>
	<name>ruby_static</name>
	<range><gt>1.8.*</gt><lt>1.8.2_3</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Nobuhiro IMAI reports:</p>
	<blockquote cite="http://blade.nagaokaut.ac.jp/cgi-bin/scat.rb/ruby/ruby-core/5237">
	  <p>the default value modification on
	    Module#public_instance_methods (from false to true) breaks
	    s.add_handler(XMLRPC::iPIMethods("sample"), MyHandler.new) style
	    security protection.</p>
	  <p>This problem could allow a remote attacker to execute arbitrary
	    commands on XMLRPC server of libruby.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-1992</cvename>
      <url>http://blade.nagaokaut.ac.jp/cgi-bin/scat.rb/ruby/ruby-core/5237</url>
      <url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=315064</url>
    </references>
    <dates>
      <discovery>2005-06-22</discovery>
      <entry>2005-06-23</entry>
      <modified>2005-11-06</modified>
    </dates>
  </vuln>

  <vuln vid="96948a6a-e239-11d9-83cf-0010dc5df42d">
    <topic>cacti -- potential SQL injection and cross site scripting attacks</topic>
    <affects>
      <package>
	<name>cacti</name>
	<range><le>0.8.6d</le></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>iDEFENSE security group disclosed potential SQL injection
	  attacks from unchecked user input and two security holes
	  regarding potential cross site scripting attacks</p>
      </body>
    </description>
    <references>
      <url>http://www.cacti.net/release_notes_0_8_6e.php</url>
    </references>
    <dates>
      <discovery>2005-06-21</discovery>
      <entry>2005-06-21</entry>
    </dates>
  </vuln>

  <vuln vid="79217c9b-e1d9-11d9-b875-0001020eed82">
    <topic>opera -- XMLHttpRequest security bypass</topic>
    <affects>
      <package>
	<name>linux-opera</name>
	<name>opera-devel</name>
	<name>opera</name>
	<range><gt>8.*</gt><lt>8.01</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A Secunia Advisory reports:</p>
	<blockquote cite="http://secunia.com/advisories/15008/">
	  <p>Secunia Research has discovered a vulnerability in Opera,
	    which can be exploited by malicious people to steal
	    content or to perform actions on other web sites with the
	    privileges of the user.</p>
	  <p>Normally, it should not be possible for the
	    <code>XMLHttpRequest</code> object to access resources
	    from outside the domain of which the object was
	    opened. However, due to insufficient validation of server
	    side redirects, it is possible to circumvent this
	    restriction.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-1475</cvename>
      <url>http://secunia.com/advisories/15008/</url>
      <url>http://secunia.com/secunia_research/2005-4/advisory/</url>
      <url>http://www.opera.com/freebsd/changelogs/801/#security</url>
    </references>
    <dates>
      <discovery>2005-06-16</discovery>
      <entry>2005-06-20</entry>
    </dates>
  </vuln>

  <vuln vid="40856a51-e1d9-11d9-b875-0001020eed82">
    <topic>opera -- "javascript:" URL cross-site scripting vulnerability</topic>
    <affects>
      <package>
	<name>linux-opera</name>
	<name>opera-devel</name>
	<name>opera</name>
	<range><lt>8.01</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A Secunia Advisory reports:</p>
	<blockquote cite="http://secunia.com/advisories/15411/">
	  <p>Secunia Research has discovered a vulnerability in Opera,
	    which can be exploited by malicious people to conduct
	    cross-site scripting attacks and to read local files.</p>
	  <p>The vulnerability is caused due to Opera not properly
	    restricting the privileges of "javascript:" URLs when
	    opened in e.g. new windows or frames.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-1669</cvename>
      <url>http://secunia.com/advisories/15411/</url>
      <url>http://www.opera.com/freebsd/changelogs/801/#security</url>
    </references>
    <dates>
      <discovery>2005-06-16</discovery>
      <entry>2005-06-20</entry>
    </dates>
  </vuln>

  <vuln vid="985bfcf0-e1d7-11d9-b875-0001020eed82">
    <topic>opera -- redirection cross-site scripting vulnerability</topic>
    <affects>
      <package>
	<name>linux-opera</name>
	<name>opera-devel</name>
	<name>opera</name>
	<range><gt>8.*</gt><lt>8.01</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A Secunia Advisory reports:</p>
	<blockquote cite="http://secunia.com/advisories/15423/">
	  <p>Secunia Research has discovered a vulnerability in Opera,
	    which can be exploited by malicious people to conduct
	    cross-site scripting attacks against users.</p>
	  <p>The vulnerability is caused due to input not being
	    sanitised, when Opera generates a temporary page for
	    displaying a redirection when "Automatic redirection" is
	    disabled (not default setting).</p>
	</blockquote>
      </body>
    </description>
    <references>
      <url>http://secunia.com/advisories/15423/</url>
      <url>http://secunia.com/secunia_research/2003-1/advisory/</url>
      <url>http://www.opera.com/freebsd/changelogs/801/#security</url>
    </references>
    <dates>
      <discovery>2005-06-16</discovery>
      <entry>2005-06-20</entry>
    </dates>
  </vuln>

  <vuln vid="3bf157fa-e1c6-11d9-b875-0001020eed82">
    <topic>sudo -- local race condition vulnerability</topic>
    <affects>
      <package>
	<name>sudo</name>
	<range><lt>1.6.8.9</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Todd C. Miller reports:</p>
	<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=111928183431376">
	  <p>A race condition in Sudo's command pathname handling
	    prior to Sudo version 1.6.8p9 that could allow a user with
	    Sudo privileges to run arbitrary commands.</p>
	  <p>Exploitation of the bug requires that the user be allowed
	    to run one or more commands via Sudo and be able to create
	    symbolic links in the filesystem.  Furthermore, a sudoers
	    entry giving another user access to the ALL pseudo-command
	    must follow the user's sudoers entry for the race to
	    exist.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <bid>13993</bid>
      <cvename>CVE-2005-1993</cvename>
      <mlist msgid="200506201424.j5KEOhQI024645@xerxes.courtesan.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=111928183431376</mlist>
    </references>
    <dates>
      <discovery>2005-06-20</discovery>
      <entry>2005-06-20</entry>
      <modified>2005-11-14</modified>
    </dates>
  </vuln>

  <vuln vid="b02c1d80-e1bb-11d9-b875-0001020eed82">
    <topic>trac -- file upload/download vulnerability</topic>
    <affects>
      <package>
	<name>trac</name>
	<range><lt>0.8.4</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Stefan Esser reports:</p>
	<blockquote cite="http://www.hardened-php.net/advisory-012005.php">
	  <p>Trac's wiki and ticket systems allows to add attachments
	    to wiki entries and bug tracker tickets. These attachments
	    are stored within directories that are determined by the
	    id of the corresponding ticket or wiki entry.</p>
	  <p>Due to a missing validation of the id parameter it is
	    possible for an attacker to supply arbitrary paths to the
	    upload and attachment viewer scripts. This means that a
	    potential attacker can retrieve any file accessible by the
	    webserver user.</p>
	  <p>Additionally it is possible to upload arbitrary files (up
	    to a configured file length) to any place the webserver
	    has write access too.</p>
	  <p>For obvious reasons this can lead to the execution of
	    arbitrary code if it possible to upload files to the
	    document root or it's subdirectories. One example of a
	    configuration would be f.e.  running Trac and
	    s9y/wordpress with writeable content directories on the
	    same webserver.</p>
	  <p>Another potential usage of this exploit would be to abuse
	    Trac powered webservers as storage for f.e. torrent
	    files.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <bid>13990</bid>
      <url>http://www.hardened-php.net/advisory-012005.php</url>
      <url>http://projects.edgewall.com/trac/wiki/ChangeLog</url>
    </references>
    <dates>
      <discovery>2005-06-20</discovery>
      <entry>2005-06-20</entry>
    </dates>
  </vuln>

  <vuln vid="85069fb6-e15b-11d9-83cf-0010dc5df42d">
    <topic>razor-agents -- denial of service vulnerability</topic>
    <affects>
      <package>
	<name>razor-agents</name>
	<range><le>2.71</le></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A Secunia security advisory reports:</p>
	<blockquote cite="http://secunia.com/advisories/15739/">
	  <p>Two vulnerabilities have been reported in Razor-agents,
	    which can be exploited by malicious people to cause a DoS
	    (Denial of Service).</p>
	  <ol>
	    <li>An unspecified error in the preprocessing of certain
	      HTML messages can be exploited to crash the
	      application.</li>
	    <li>A bug in the discovery logic causes Razor-agents to go
	      into an infinite loop and consume a large amount of
	      memory when discovery fails.</li>
	  </ol>
	</blockquote>
      </body>
    </description>
    <references>
      <url>http://secunia.com/advisories/15739/</url>
    </references>
    <dates>
      <discovery>2005-06-17</discovery>
      <entry>2005-06-20</entry>
    </dates>
  </vuln>

  <vuln vid="cc4ce06b-e01c-11d9-a8bd-000cf18bbe54">
    <topic>p5-Mail-SpamAssassin -- denial of service vulnerability</topic>
    <affects>
      <package>
	<name>p5-Mail-SpamAssassin</name>
	<range><ge>3.0.1</ge><lt>3.0.4</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Apache SpamAssassin Security Team reports:</p>
	<blockquote cite="http://mail-archives.apache.org/mod_mbox/spamassassin-announce/200506.mbox/%3c17072.35054.586017.822288@proton.pathname.com%3e">
	  <p>Apache SpamAssassin 3.0.4 was recently released, and
	    fixes a denial of service vulnerability in versions 3.0.1, 3.0.2,
	    and 3.0.3.	The vulnerability allows certain misformatted
	    long message headers to cause spam checking to
	    take a very long time.</p>
	  <p>While the exploit has yet to be seen in the wild,
	    we are concerned that there may be attempts to abuse
	    the vulnerability in the future.  Therefore, we strongly
	    recommend all users of these versions upgrade to
	    Apache SpamAssassin 3.0.4 as soon as possible.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-1266</cvename>
      <mlist msgid="c17072.35054.586017.822288@proton.pathname.com">http://mail-archives.apache.org/mod_mbox/spamassassin-announce/200506.mbox/%3c17072.35054.586017.822288@proton.pathname.com%3e</mlist>
    </references>
    <dates>
      <discovery>2005-06-15</discovery>
      <entry>2005-06-18</entry>
    </dates>
  </vuln>

  <vuln vid="e879ca68-e01b-11d9-a8bd-000cf18bbe54">
    <topic>squirrelmail -- Several cross site scripting vulnerabilities</topic>
    <affects>
      <package>
	<name>squirrelmail</name>
	<name>ja-squirrelmail</name>
	<range><ge>1.4.0</ge><le>1.4.4</le></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A SquirrelMail Security Advisory reports:</p>
	<blockquote cite="http://www.squirrelmail.org/security/issue/2005-06-15">
	  <p>Several cross site scripting (XSS) vulnerabilities have been
	    discovered in SquirrelMail versions 1.4.0 - 1.4.4.</p>
	  <p>The vulnerabilities are in two categories: the majority can be
	    exploited through URL manipulation, and some by sending a specially
	    crafted email to a victim. When done very carefully,
	    this can cause the session of the user to be hijacked.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-1769</cvename>
      <url>http://www.squirrelmail.org/security/issue/2005-06-15</url>
    </references>
    <dates>
      <discovery>2005-06-15</discovery>
      <entry>2005-06-18</entry>
    </dates>
  </vuln>

  <vuln vid="02bc9b7c-e019-11d9-a8bd-000cf18bbe54">
    <topic>acroread -- XML External Entity vulnerability</topic>
    <affects>
      <package>
	<name>acroread7</name>
	<name>ja-acroread</name>
	<range><ge>7.0.0</ge><lt>7.0.1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Sverre H. Huseby discovered a vulnerability in Adobe Acrobat
	  and Adobe Reader.
	  Under certain circumstances, using XML scripts it is possible
	  to discover the existence of local files.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-1306</cvename>
      <url>http://shh.thathost.com/secadv/adobexxe/</url>
      <url>http://www.adobe.com/support/techdocs/331710.html</url>
      <url>http://support.adobe.co.jp/faq/faq/qadoc.sv?226360+002+3</url>
    </references>
    <dates>
      <discovery>2005-06-15</discovery>
      <entry>2005-06-18</entry>
      <modified>2005-08-28</modified>
    </dates>
  </vuln>

  <vuln vid="63bd4bad-dffe-11d9-b875-0001020eed82">
    <topic>gzip -- directory traversal and permission race vulnerabilities</topic>
    <affects>
      <package>
	<name>FreeBSD</name>
	<range><ge>5.4</ge><lt>5.4_2</lt></range>
	<range><ge>5.0</ge><lt>5.3_16</lt></range>
	<range><ge>4.11</ge><lt>4.11_10</lt></range>
	<range><ge>4.10</ge><lt>4.10_15</lt></range>
	<range><ge>4.9</ge><lt>4.9_18</lt></range>
	<range><lt>4.8_33</lt></range>
      </package>
      <package>
	<name>gzip</name>
	<range><lt>1.3.5_2</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description</h1>
	<p>Two problems related to extraction of files exist in gzip:</p>
	<p>The first problem is that gzip does not properly sanitize
	  filenames containing "/" when uncompressing files using the
	  -N command line option.</p>
	<p>The second problem is that gzip does not set permissions on
	  newly extracted files until after the file has been created
	  and the file descriptor has been closed.</p>
	<h1>Impact</h1>
	<p>The first problem can allow an attacker to overwrite
	  arbitrary local files when uncompressing a file using the -N
	  command line option.</p>
	<p>The second problem can allow a local attacker to change the
	  permissions of arbitrary local files, on the same partition
	  as the one the user is uncompressing a file on, by removing
	  the file the user is uncompressing and replacing it with a
	  hardlink before the uncompress operation is finished.</p>
	<h1>Workaround</h1>
	<p>Do not use the -N command line option on untrusted files
	  and do not uncompress files in directories where untrusted
	  users have write access.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-0988</cvename>
      <cvename>CVE-2005-1228</cvename>
      <freebsdsa>SA-05:11.gzip</freebsdsa>
      <mlist msgid="7389fc4b05040412574f819112@mail.gmail.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=111271860708210</mlist>
      <mlist msgid="7389fc4b0504201224759f31b@mail.gmail.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=111402732406477</mlist>
    </references>
    <dates>
      <discovery>2005-04-20</discovery>
      <entry>2005-06-18</entry>
      <modified>2005-07-06</modified>
    </dates>
  </vuln>

  <vuln vid="9fae0f1f-df82-11d9-b875-0001020eed82">
    <topic>tcpdump -- infinite loops in protocol decoding</topic>
    <affects>
      <package>
	<name>FreeBSD</name>
	<range><ge>5.4</ge><lt>5.4_2</lt></range>
	<range><ge>5.3</ge><lt>5.3_16</lt></range>
      </package>
      <package>
	<name>tcpdump</name>
	<range><lt>3.8.3_2</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description</h1>
	<p>Several tcpdump protocol decoders contain programming
	  errors which can cause them to go into infinite loops.</p>
	<h1>Impact</h1>
	<p>An attacker can inject specially crafted packets into the
	   network which, when processed by tcpdump, could lead to a
	   denial-of-service. After the attack, tcpdump would no
	   longer capture traffic, and would potentially use all
	   available processor time.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-1267</cvename>
      <cvename>CVE-2005-1278</cvename>
      <cvename>CVE-2005-1279</cvename>
      <cvename>CVE-2005-1280</cvename>
      <freebsdsa>SA-05:10.tcpdump</freebsdsa>
      <mlist msgid="20050426100140.1945.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=111454406222040</mlist>
      <mlist msgid="20050426100057.1748.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=111454461300644</mlist>
      <mlist msgid="20050619091553.GB982@zaphod.nitro.dk">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=111928309502304</mlist>
    </references>
    <dates>
      <discovery>2005-06-09</discovery>
      <entry>2005-06-18</entry>
      <modified>2005-06-20</modified>
    </dates>
  </vuln>

  <vuln vid="2701611f-df5c-11d9-b875-0001020eed82">
    <topic>gaim -- Yahoo! remote crash vulnerability</topic>
    <affects>
      <package>
	<name>gaim</name>
	<name>ja-gaim</name>
	<name>ko-gaim</name>
	<name>ru-gaim</name>
	<range><lt>1.3.1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Jacopo Ottaviani reports that Gaim can be crashed by being
	  offered files with names containing non-ASCII
	  characters via the Yahoo! protocol.</p>
      </body>
    </description>
    <references>
      <bid>13931</bid>
      <cvename>CVE-2005-1269</cvename>
      <url>http://gaim.sourceforge.net/security/index.php?id=18</url>
    </references>
    <dates>
      <discovery>2005-06-10</discovery>
      <entry>2005-06-17</entry>
    </dates>
  </vuln>

  <vuln vid="b6612eee-df5f-11d9-b875-0001020eed82">
    <topic>gaim -- MSN Remote DoS vulnerability</topic>
    <affects>
      <package>
	<name>gaim</name>
	<name>ja-gaim</name>
	<name>ko-gaim</name>
	<name>ru-gaim</name>
	<range><lt>1.3.1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The GAIM team reports:</p>
	<blockquote cite="http://gaim.sourceforge.net/security/index.php?id=19">
	  <p>Remote attackers can cause a denial of service (crash)
	    via a malformed MSN message that leads to a memory
	    allocation of a large size, possibly due to an integer
	    signedness error.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <bid>13932</bid>
      <cvename>CVE-2005-1934</cvename>
      <url>http://gaim.sourceforge.net/security/index.php?id=19</url>
    </references>
    <dates>
      <discovery>2005-06-10</discovery>
      <entry>2005-06-17</entry>
    </dates>
  </vuln>

  <vuln vid="12b1a62d-6056-4d90-9e21-45fcde6abae4">
    <topic>gallery -- remote code injection via HTTP_POST_VARS</topic>
    <affects>
      <package>
	<name>gallery</name>
	<range><lt>1.4.1.1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A web server running Gallery can be exploited for arbitrary
	  PHP code execution through the use of a maliciously crafted
	  URL.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2004-2124</cvename>
      <mlist msgid="0c0a01c3e525$1c0ed2b0$c90c030a@bmedirattatg">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=107524414317693</mlist>
    </references>
    <dates>
      <discovery>2004-01-27</discovery>
      <entry>2005-06-17</entry>
    </dates>
  </vuln>

  <vuln vid="5752a0df-60c5-4876-a872-f12f9a02fa05">
    <topic>gallery -- cross-site scripting</topic>
    <affects>
      <package>
	<name>gallery</name>
	<range><lt>1.4.4.5</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Gallery includes several cross-site scripting vulnerabilities
	  that could allow malicious content to be injected.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2004-1106</cvename>
      <cvename>CVE-2005-0219</cvename>
      <cvename>CVE-2005-0220</cvename>
      <cvename>CVE-2005-0221</cvename>
      <cvename>CVE-2005-0222</cvename>
      <bid>11602</bid>
      <url>http://gallery.menalto.com/modules.php?op=modload&amp;name=News&amp;file=article&amp;sid=147</url>
      <url>http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110608459222364</url>
    </references>
    <dates>
      <discovery>2005-01-26</discovery>
      <entry>2005-06-17</entry>
    </dates>
  </vuln>

  <vuln vid="0512b761-70fb-40d3-9954-aa4565528fa8">
    <topic>kstars -- exploitable set-user-ID application fliccd</topic>
    <affects>
      <package>
	<name>kdeedu</name>
	<range><lt>3.3.2_1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A KDE Security Advisory explains:</p>
	<blockquote cite="http://www.kde.org/info/security/advisory-20050215-1.txt">
	  <h1>Overview</h1>
	  <p>KStars includes support for the Instrument Neutral
	    Distributed Interface (INDI). The build system of this
	    extra 3rd party software contained an installation hook to
	    install fliccd (part of INDI) as SUID root
	    application.</p>
	  <p>Erik Sjölund discovered that the code contains several
	    vulnerabilities that allow stack based buffer
	    overflows.</p>
	  <h1>Impact</h1>
	  <p>If the fliccd binary is installed as suid root, it
	    enables root privilege escalation for local users, or, if
	    the daemon is actually running (which it does not by
	    default) and is running as root, remote root privilege
	    escalation.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-0011</cvename>
      <url>http://www.kde.org/info/security/advisory-20050215-1.txt</url>
    </references>
    <dates>
      <discovery>2005-01-05</discovery>
      <entry>2005-06-17</entry>
    </dates>
  </vuln>

  <vuln vid="4c005a5e-2541-4d95-80a0-00c76919aa66">
    <topic>fd_set -- bitmap index overflow in multiple applications</topic>
    <affects>
      <package>
	<name>gatekeeper</name>
	<range><lt>2.2.1</lt></range>
      </package>
      <package>
	<name>citadel</name>
	<range><lt>6.29</lt></range>
      </package>
      <package>
	<name>3proxy</name>
	<range><lt>0.5.b</lt></range>
      </package>
      <package>
	<name>jabber</name>
	<range><lt>1.4.3.1_1,1</lt></range>
	<range><eq>1.4.4</eq></range>
      </package>
      <package>
	<name>bnc</name>
	<range><lt>2.9.3</lt></range>
      </package>
      <package>
	<name>rinetd</name>
	<range><lt>0.62_1</lt></range>
      </package>
      <package>
	<name>dante</name>
	<range><lt>1.1.15</lt></range>
      </package>
      <package>
	<name>bld</name>
	<range><lt>0.3.3</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>3APA3A reports:</p>
	<blockquote cite="http://www.security.nnov.ru/advisories/sockets.asp">
	  <p>If programmer fails to check socket number before using
	    select() or fd_set macros, it's possible to overwrite
	    memory behind fd_set structure. Very few select() based
	    application actually check FD_SETSIZE value. <em>[...]</em></p>
	  <p>Depending on vulnerable application it's possible to
	    overwrite portions of memory. Impact is close to
	    off-by-one overflows, code execution doesn't seems
	    exploitable.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <url>http://www.gotbnc.com/changes.html#2.9.3</url>
      <url>http://www.security.nnov.ru/advisories/sockets.asp</url>
      <mlist msgid="1473827718.20050124233008@security.nnov.ru">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110660879328901</mlist>
    </references>
    <dates>
      <discovery>2004-12-12</discovery>
      <entry>2005-06-17</entry>
      <modified>2006-09-03</modified>
    </dates>
  </vuln>

  <vuln vid="b5ffaa2a-ee50-4498-af99-61bc1b163c00">
    <topic>leafnode -- denial of service vulnerability</topic>
    <affects>
      <package>
	<name>leafnode</name>
	<range><lt>1.11.3</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Matthias Andree reports:</p>
	<blockquote cite="http://leafnode.sourceforge.net/leafnode-SA-2005-02.txt">
	  <p>A vulnerability was found in the fetchnews program (the NNTP
	    client) that may under some circumstances cause a wait for input
	    that never arrives, fetchnews "hangs". [...]</p>
	  <p>As only one fetchnews program can run at a time, subsequently
	    started fetchnews and texpire programs will terminate. [...]</p>
	  <p>Upgrade your leafnode package to version 1.11.3.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-1911</cvename>
      <url>http://leafnode.sourceforge.net/leafnode-SA-2005-02.txt</url>
      <freebsdpr>ports/82056</freebsdpr>
      <mlist msgid="20050608215155.GB27234@merlin.emma.line.org">http://marc.theaimsgroup.com/?l=vulnwatch&amp;m=111827180929063</mlist>
    </references>
    <dates>
      <discovery>2005-06-08</discovery>
      <entry>2005-06-09</entry>
    </dates>
  </vuln>

  <vuln vid="fe903533-ff96-4c7a-bd3e-4d40efa71897">
    <topic>gforge -- directory traversal vulnerability</topic>
    <affects>
      <package>
	<name>gforge</name>
	<range><lt>4.0</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>An STG Security Advisory reports:</p>
	  <blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110627132209963">
	    <p>GForge CVS module made by Dragos Moinescu and another
	      module made by Ronald Petty have a directory traversal
	      vulnerability. [...] malicious attackers can read
	      arbitrary directory lists.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-0299</cvename>
      <bid>12318</bid>
      <mlist msgid="20050120051735.2832.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110627132209963</mlist>
    </references>
    <dates>
      <discovery>2005-01-20</discovery>
      <entry>2005-06-03</entry>
    </dates>
  </vuln>

  <vuln vid="d1bbc235-c0c9-45cd-8d2d-c1b8fd22e616">
    <topic>imap-uw -- authentication bypass when CRAM-MD5 is enabled</topic>
    <affects>
      <package>
	<name>imap-uw</name>
	<range><lt>2004b,1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The CRAM-MD5 authentication support of the University of
	  Washington IMAP and POP3 servers contains a vulnerability that
	  may allow an attacker to bypass authentication and impersonate
	  arbitrary users.  Only installations with CRAM-MD5 support
	  configured are affected.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-0198</cvename>
      <certvu>702777</certvu>
    </references>
    <dates>
      <discovery>2005-01-04</discovery>
      <entry>2005-06-03</entry>
    </dates>
  </vuln>

  <vuln vid="5bf1a715-cc57-440f-b0a5-6406961c54a7">
    <topic>squid -- denial-of-service vulnerabilities</topic>
    <affects>
      <package>
	<name>squid</name>
	<range><lt>2.5.9</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Squid team reported several denial-of-service
	  vulnerabilities related to the handling of DNS responses and
	  NT Lan Manager messages.  These may allow an attacker to crash
	  the Squid cache.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-0446</cvename>
      <url>http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE8-dns_assert</url>
      <cvename>CVE-2005-0096</cvename>
      <cvename>CVE-2005-0097</cvename>
      <url>http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-fakeauth_auth</url>
    </references>
    <dates>
      <discovery>2005-01-16</discovery>
      <entry>2005-06-03</entry>
    </dates>
  </vuln>

  <vuln vid="3b260179-e464-460d-bf9f-d5cda6204020">
    <topic>racoon -- remote denial-of-service</topic>
    <affects>
      <package>
	<name>racoon</name>
	<range><lt>20050510a</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Sebastian Krahmer discovered that the racoon ISAKMP daemon
	  could be crashed with a maliciously crafted UDP packet.  No
	  authentication is required in order to perform the attack.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-0398</cvename>
      <mlist>http://sourceforge.net/mailarchive/forum.php?thread_id=6787713&amp;forum_id=32000</mlist>
      <url>http://xforce.iss.net/xforce/xfdb/19707</url>
      <url>https://bugzilla.redhat.com/bugzilla/attachment.cgi?id=109966&amp;action=view</url>
    </references>
    <dates>
      <discovery>2005-03-12</discovery>
      <entry>2005-06-03</entry>
    </dates>
  </vuln>

  <vuln vid="bfbbd505-3bd6-409c-8c67-445d3635cf4b">
    <topic>xli -- integer overflows in image size calculations</topic>
    <affects>
      <package>
	<name>xli</name>
	<range><le>1.17.0_1</le></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Tavis Ormandy discovered several integer overflows in xli's
	  image size handling.	A maliciously crafted image may be able
	  to cause a heap buffer overflow and execute arbitrary code.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-0639</cvename>
      <url>http://bugs.gentoo.org/show_bug.cgi?id=79762</url>
      <url>http://pantransit.reptiles.org/prog/xli/CHANGES</url>
    </references>
    <dates>
      <discovery>2005-02-08</discovery>
      <entry>2005-06-03</entry>
    </dates>
  </vuln>

  <vuln vid="310d0087-0fde-4929-a41f-96f17c5adffe">
    <topic>xloadimage -- arbitrary command execution when handling compressed files</topic>
    <affects>
      <package>
	<name>xli</name>
	<range><le>1.17.0_1</le></range>
      </package>
      <package>
	<name>xloadimage</name>
	<range><le>4.1.10</le></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Tavis Ormandy discovered that xli and xloadimage attempt to
	  decompress images by piping them through <code>gunzip</code>
	  or similar decompression tools.  Unfortunately, the
	  unsanitized file name is included as part of the command.
	  This is dangerous, as in some situations, such as mailcap
	  processing, an attacker may control the input file name.  As a
	  result, an attacker may be able to cause arbitrary command
	  execution.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-0638</cvename>
      <url>http://bugs.gentoo.org/show_bug.cgi?id=79762</url>
    </references>
    <dates>
      <discovery>2005-02-18</discovery>
      <entry>2005-06-03</entry>
    </dates>
  </vuln>

  <vuln vid="8c1da77d-d3e9-11d9-8ffb-00061bc2ad93">
    <topic>xloadimage -- buffer overflow in FACES image handling</topic>
    <affects>
      <package>
	<name>xli</name>
	<range><le>1.17.0_1</le></range>
      </package>
      <package>
	<name>xloadimage</name>
	<range><lt>4.1.9</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>In 2001, zen-parse discovered a buffer overflow in
	  xloadimage's FACES image loader.  A maliciously crafted image
	  could cause xloadimage to execute arbitrary code.  A published
	  exploit exists for this vulnerability.</p>
	<p>In 2005, Rob Holland discovered that the same vulnerability
	  was present in xli.</p>
      </body>
    </description>
    <references>
	<cvename>CVE-2001-0775</cvename>
	<mlist>http://marc.theaimsgroup.com/?l=bugtraq&amp;m=99477230306845</mlist>
	<url>https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=46186</url>
	<url>http://bugs.gentoo.org/show_bug.cgi?id=79762</url>
    </references>
    <dates>
      <discovery>2000-02-19</discovery>
      <entry>2005-06-03</entry>
    </dates>
  </vuln>

  <vuln vid="99b5cfa5-d3d2-11d9-8ffb-00061bc2ad93">
    <topic>yamt -- buffer overflow and directory traversal issues</topic>
    <affects>
      <package>
	<name>yamt</name>
	<range><lt>0.5_2</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Stanislav Brabec discovered errors in yamt's path name
	  handling that lead to buffer overflows and directory traversal
	  issues.  When processing a file with a maliciously crafted ID3
	  tag, yamt might overwrite arbitrary files or possibly execute
	  arbitrary code.</p>
	<p>The SuSE package ChangeLog contains:</p>
	<blockquote>
	  <ul>
	    <li>Several security fixes (#49337):</li>
	    <li>directory traversal in rename</li>
	    <li>directory traversal in sort</li>
	    <li>buffer overflow in sort</li>
	    <li>buffer overflow in rename</li>
	  </ul>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-1846</cvename>
      <cvename>CVE-2005-1847</cvename>
      <url>http://rpmfind.net/linux/RPM/suse/updates/8.2/i386/rpm/i586/yamt-0.5-1277.i586.html</url>
      <url>ftp://ftp.suse.com/pub/suse/i386/update/8.2/rpm/src/yamt-0.5-1277.src.rpm</url>
    </references>
    <dates>
      <discovery>2005-01-20</discovery>
      <entry>2005-06-03</entry>
    </dates>
  </vuln>

  <vuln vid="ae6ec9b8-2f43-4d02-8129-c6a3a53ef09d">
    <topic>xview -- multiple buffer overflows in xv_parse_one</topic>
    <affects>
      <package>
	<name>xview</name>
	<range><lt>3.2.1_3</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A Debian Security Advisory reports:</p>
	<blockquote cite="http://www.debian.org/security/2005/dsa-672">
	  <p>Erik Sjölund discovered that programs linked against xview
	    are vulnerable to a number of buffer overflows in the XView
	    library. When the overflow is triggered in a program which
	    is installed setuid root a malicious user could perhaps
	    execute arbitrary code as privileged user.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-0076</cvename>
      <url>http://www.debian.org/security/2005/dsa-672</url>
      <url>http://xforce.iss.net/xforce/xfdb/19271</url>
    </references>
    <dates>
      <discovery>2005-02-09</discovery>
      <entry>2005-06-01</entry>
    </dates>
  </vuln>

  <vuln vid="f7e8d2ca-410e-40b2-8748-3abd021e44a9">
    <topic>xtrlock -- X display locking bypass</topic>
    <affects>
      <package>
	<name>xtrlock</name>
	<range><lt>2.0.10</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The X display locking program <code>xtrlock</code> contains
	  an integer overflow bug.  It is possible for an attacker with
	  physical access to the system to bypass the display lock.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-0079</cvename>
      <url>http://www.debian.org/security/2005/dsa-649</url>
      <url>http://xforce.iss.net/xforce/xfdb/18991</url>
      <url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=278191</url>
    </references>
    <dates>
      <discovery>2004-10-25</discovery>
      <entry>2005-06-01</entry>
    </dates>
  </vuln>

  <vuln vid="bf2e7483-d3fa-440d-8c6e-8f1f2f018818">
    <topic>linux_base -- vulnerabilities in Red Hat 7.1 libraries</topic>
    <affects>
      <package>
	<name>linux_base</name>
	<range><lt>7.3</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Trevor Johnson reported that the Red Hat Linux RPMs used
	  by linux_base contained multiple older vulnerabilities, such
	  as a DNS resolver issue and critical bugs in X font handling
	  and XPM image handling.</p>
      </body>
    </description>
    <references>
      <url>http://fedoralegacy.org/updates/RH7.3/2004-10-23-FLSA_2004_1947__Updated_glibc_packages_fix_flaws.html</url>
      <url>http://rhn.redhat.com/errata/RHSA-2004-059.html</url>
      <url>http://rhn.redhat.com/errata/RHSA-2004-478.html</url>
      <url>http://rhn.redhat.com/errata/RHSA-2004-612.html</url>
      <cvename>CVE-2002-0029</cvename>
      <cvename>CVE-2004-0083</cvename>
      <cvename>CVE-2004-0084</cvename>
      <cvename>CVE-2004-0106</cvename>
      <cvename>CVE-2004-0687</cvename>
      <cvename>CVE-2004-0688</cvename>
      <cvename>CVE-2004-0692</cvename>
      <cvename>CVE-2004-0914</cvename>
    </references>
    <dates>
      <discovery>2004-09-27</discovery>
      <entry>2005-06-01</entry>
    </dates>
  </vuln>

  <vuln vid="79630c0c-8dcc-45d0-9908-4087fe1d618c">
    <topic>squirrelmail -- XSS and remote code injection vulnerabilities</topic>
    <affects>
      <package>
	<name>squirrelmail</name>
	<name>ja-squirrelmail</name>
	<range><lt>1.4.4</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A SquirrelMail Security Advisory reports:</p>
	<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110702772714662">
	  <p>SquirrelMail 1.4.4 has been released to resolve a number of
	    security issues disclosed below.  It is strongly recommended
	    that all running SquirrelMail prior to 1.4.4 upgrade to the
	    latest release.</p>
	  <h1>Remote File Inclusion</h1>
	  <p>Manoel Zaninetti reported an issue in src/webmail.php which
	    would allow a crafted URL to include a remote web page.
	    This was assigned CAN-2005-0103 by the Common
	    Vulnerabilities and Exposures.</p>
	  <h1>Cross Site Scripting Issues</h1>
	  <p>A possible cross site scripting issue exists in
	    src/webmail.php that is only accessible when the PHP
	    installation is running with register_globals set to On.
	    This issue was uncovered internally by the SquirrelMail
	    Development team. This isssue was assigned CAN-2005-0104 by
	    the Common Vulnerabilities and Exposures.</p>
	  <p>A second issue which was resolved in the 1.4.4-rc1 release
	    was uncovered and assigned CAN-2004-1036 by the Common
	    Vulnerabilities and Exposures.  This issue could allow a
	    remote user to send a specially crafted header and cause
	    execution of script (such as javascript) in the client
	    browser.</p>
	  <h1>Local File Inclusion</h1>
	  <p>A possible local file inclusion issue was uncovered by one
	    of our developers involving custom preference handlers.
	    This issue is only active if the PHP installation is running
	    with register_globals set to On.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2004-1036</cvename>
      <cvename>CVE-2005-0075</cvename>
      <cvename>CVE-2005-0103</cvename>
      <cvename>CVE-2005-0104</cvename>
      <mlist msgid="47249.24.0.109.81.1106975343.squirrel@sm-14.netdork.net">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110702772714662</mlist>
      <url>http://www.squirrelmail.org/security/issue/2005-01-14</url>
      <url>http://www.squirrelmail.org/security/issue/2005-01-19</url>
      <url>http://www.squirrelmail.org/security/issue/2005-01-20</url>
    </references>
    <dates>
      <discovery>2005-01-29</discovery>
      <entry>2005-06-01</entry>
    </dates>
  </vuln>

  <vuln vid="0d9ba03b-0dbb-42b4-ae0f-60e27af78e22">
    <topic>sympa -- buffer overflow in "queue"</topic>
    <affects>
      <package>
	<name>sympa</name>
	<range><lt>4.1.2_1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Erik Sjölund discovered a vulnerability in Sympa.  The
	  <code>queue</code> application processes messages received via
	  aliases.  It contains a buffer overflow in the usage of
	  <code>sprintf</code>.  In some configurations, it may allow an
	  attacker to execute arbitrary code as the <code>sympa</code>
	  user.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-0073</cvename>
      <url>http://www.debian.org/security/2005/dsa-677</url>
    </references>
    <dates>
      <discovery>2005-02-11</discovery>
      <entry>2005-06-01</entry>
    </dates>
  </vuln>

  <vuln vid="b3cd00f7-c0c5-452d-87bc-086c5635333e">
    <topic>mailman -- generated passwords are poor quality</topic>
    <affects>
      <package>
	<name>mailman</name>
	<name>ja-mailman</name>
	<range><lt>2.1.6</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Florian Weimer wrote:</p>
	<blockquote cite="http://mail.python.org/pipermail/mailman-developers/attachments/20041215/be238297/attachment.mht">
	  <p>Mailman 2.1.5 uses weak auto-generated passwords for new
	    subscribers.  These passwords are assigned when members
	    subscribe without specifying their own password (either by
	    email or the web frontend).  Knowledge of this password
	    allows an attacker to gain access to the list archive even
	    though she's not a member and the archive is restricted to
	    members only.  [...]</p>
	  <p>This means that only about 5 million different passwords
	    are ever generated, a number that is in the range of brute
	    force attacks -- you only have to guess one subscriber
	    address (which is usually not that hard).</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2004-1143</cvename>
      <mlist>http://mail.python.org/pipermail/mailman-developers/2004-December/017553.html</mlist>
      <mlist msgid="87llc0u6l8.fsf@deneb.enyo.de">http://mail.python.org/pipermail/mailman-developers/attachments/20041215/be238297/attachment.mht</mlist>
    </references>
    <dates>
      <discovery>2004-12-15</discovery>
      <entry>2005-06-01</entry>
    </dates>
  </vuln>

  <vuln vid="ad9d2518-3471-4737-b60b-9a1f51023b28">
    <topic>mailman -- password disclosure</topic>
    <affects>
      <package>
	<name>mailman</name>
	<name>ja-mailman</name>
	<range><lt>2.1.5</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Barry Warsaw reports:</p>
	<blockquote cite="http://mail.python.org/pipermail/mailman-announce/2004-May/000072.html">
	  <p>Today I am releasing Mailman 2.1.5, a bug fix release
	    [...] This version also contains a fix for an exploit that
	    could allow 3rd parties to retrieve member passwords.  It is
	    thus highly recommended that all existing sites upgrade to
	    the latest version.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2004-0412</cvename>
      <mlist>http://mail.python.org/pipermail/mailman-announce/2004-May/000072.html</mlist>
    </references>
    <dates>
      <discovery>2004-05-15</discovery>
      <entry>2005-06-01</entry>
    </dates>
  </vuln>

  <vuln vid="26a08c77-32da-4dd7-a884-a76fc49aa824">
    <topic>tomcat -- Tomcat Manager cross-site scripting</topic>
    <affects>
      <package>
	<name>jakarta-tomcat</name>
	<range><ge>5.0.*</ge><lt>5.0.30_5</lt></range>
	<range><ge>5.5.*</ge><lt>5.5.7</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Oliver Karow discovered cross-site scripting issues in
	  the Apache Jakarta Tomcat manager.  The developers refer to
	  the issues as <q>minor</q>.</p>
      </body>
    </description>
    <references>
      <url>http://www.oliverkarow.de/research/jakarta556_xss.txt</url>
      <mlist>http://www.mail-archive.com/tomcat-dev@jakarta.apache.org/msg66978.html</mlist>
    </references>
    <dates>
      <discovery>2005-01-03</discovery>
      <entry>2005-06-01</entry>
      <modified>2006-09-12</modified>
    </dates>
  </vuln>

  <vuln vid="84479a62-ca5f-11d9-b772-000c29b00e99">
    <topic>fswiki -- XSS problem in file upload form</topic>
    <affects>
      <package>
	<name>fswiki</name>
	<range><le>3.5.6</le></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A Secunia security advisory reports:</p>
	<blockquote cite="http://secunia.com/advisories/15538">
	  <p>A vulnerability has been reported in FreeStyle Wiki and
	    FSWikiLite, which can be exploited by malicious people to
	    conduct script insertion attacks.</p>
	  <p>Input passed in uploaded attachments is not properly
	    sanitised before being used. This can be exploited to inject
	    arbitrary HTML and script code, which will be executed in a
	    user's browser session in context of an affected site when
	    the malicious attachment is viewed.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-1799</cvename>
      <url>http://secunia.com/advisories/15538</url>
      <freebsdpr>ports/81520</freebsdpr>
      <url>http://fswiki.poi.jp/wiki.cgi?page=%CD%FA%CE%F2%2F2005%2D5%2D19</url>
      <url>http://jvn.jp/jp/JVN%23465742E4/index.html</url>
    </references>
    <dates>
      <discovery>2005-05-19</discovery>
      <entry>2005-05-29</entry>
      <modified>2005-06-01</modified>
    </dates>
  </vuln>

  <vuln vid="2fbe16c2-cab6-11d9-9aed-000e0c2e438a">
    <topic>freeradius -- sql injection and denial of service vulnerability</topic>
    <affects>
      <package>
	<name>freeradius</name>
	<range><le>1.0.2_1</le></range>
      </package>
      <package>
	<name>freeradius-devel</name>
	<range><le>1.0.2</le></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A Gentoo Advisory reports:</p>
	<blockquote cite="http://www.gentoo.org/security/en/glsa/glsa-200505-13.xml">
	  <p>The FreeRADIUS server is vulnerable to an SQL injection
	    attack and a buffer overflow, possibly resulting in
	    disclosure and modification of data and Denial of
	    Service.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <bid>13540</bid>
      <bid>13541</bid>
      <url>http://www.gentoo.org/security/en/glsa/glsa-200505-13.xml</url>
    </references>
    <dates>
      <discovery>2005-05-17</discovery>
      <entry>2005-05-22</entry>
      <modified>2008-01-20</modified>
    </dates>
  </vuln>

  <vuln vid="641e8609-cab5-11d9-9aed-000e0c2e438a">
    <topic>ppxp -- local root exploit</topic>
    <affects>
      <package>
	<name>ppxp</name>
	<range><gt>0</gt></range>
      </package>
      <package>
	<name>ja-ppxp</name>
	<range><gt>0</gt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A Debian Advisory reports:</p>
	<blockquote cite="http://www.debian.org/security/2005/dsa-725">
	  <p>Jens Steube discovered that ppxp, yet another PPP program,
	    does not release root privileges when opening potentially
	    user supplied log files.  This can be tricked into opening
	    a root shell.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-0392</cvename>
      <url>http://www.debian.org/security/2005/dsa-725</url>
    </references>
    <dates>
      <discovery>2005-05-19</discovery>
      <entry>2005-05-22</entry>
    </dates>
  </vuln>

  <vuln vid="1033750f-cab4-11d9-9aed-000e0c2e438a">
    <topic>oops -- format string vulnerability</topic>
    <affects>
      <package>
	<name>oops</name>
	<range><le>1.5.24</le></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A RST/GHC Advisory reports that there is an format string
	  vulnerability in oops.  The vulnerability can be found in
	  the MySQL/PgSQL authentication module.  Succesful
	  exploitation may allow execution of arbitrary code.</p>
      </body>
    </description>
    <references>
      <bid>13172</bid>
      <cvename>CVE-2005-1121</cvename>
      <url>http://rst.void.ru/papers/advisory24.txt</url>
    </references>
    <dates>
      <discovery>2005-04-14</discovery>
      <entry>2005-05-22</entry>
    </dates>
  </vuln>

  <vuln vid="d51a7e6e-c546-11d9-9aed-000e0c2e438a">
    <topic>cdrdao -- unspecified privilege escalation vulnerability</topic>
    <affects>
      <package>
	<name>cdrdao</name>
	<range><lt>1.2.0</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The developers of cdrdao report that there is a potential
	  root exploit in the software.  In order to be able to
	  succesfully exploit this vulnerability cdrdao must be
	  installed setuid root.  When succesfully exploited a local
	  user might get escalated privileges.	By default this port is
	  not installed setuid root.</p>
      </body>
    </description>
    <references>
      <url>http://secunia.com/advisories/15354/</url>
      <url>http://sourceforge.net/forum/forum.php?forum_id=466399</url>
    </references>
    <dates>
      <discovery>2005-05-13</discovery>
      <entry>2005-05-19</entry>
    </dates>
  </vuln>

  <vuln vid="ad5e70bb-c429-11d9-ac59-02061b08fc24">
    <topic>gaim -- MSN remote DoS vulnerability</topic>
    <affects>
      <package>
	<name>gaim</name>
	<name>ja-gaim</name>
	<name>ko-gaim</name>
	<name>ru-gaim</name>
	<range><lt>1.3.0</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The GAIM team reports:</p>
	<blockquote cite="http://gaim.sourceforge.net/security/index.php?id=17">
	  <p>Potential remote denial of service bug resulting from not
	    checking a pointer for non-NULL before passing it to
	    strncmp, which results in a crash. This can be triggered
	    by a remote client sending an SLP message with an empty
	    body.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-1262</cvename>
      <url>http://gaim.sourceforge.net/security/index.php?id=17</url>
    </references>
    <dates>
      <discovery>2005-05-10</discovery>
      <entry>2005-05-14</entry>
    </dates>
  </vuln>

  <vuln vid="889061af-c427-11d9-ac59-02061b08fc24">
    <topic>gaim -- remote crash on some protocols</topic>
    <affects>
      <package>
	<name>gaim</name>
	<name>ja-gaim</name>
	<name>ko-gaim</name>
	<name>ru-gaim</name>
	<range><lt>1.3.0</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The GAIM team reports that GAIM is vulnerable to a
	  denial-of-service vulnerability which can cause GAIM to
	  crash:</p>
	<blockquote cite="http://gaim.sourceforge.net/security/index.php?id=16">
	  <p>It is possible for a remote user to overflow a static
	    buffer by sending an IM containing a very large URL
	    (greater than 8192 bytes) to the Gaim user. This is not
	    possible on all protocols, due to message length
	    restrictions. Jabber are SILC are known to be
	    vulnerable.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-1261</cvename>
      <url>http://gaim.sourceforge.net/security/index.php?id=16</url>
    </references>
    <dates>
      <discovery>2005-05-10</discovery>
      <entry>2005-05-14</entry>
    </dates>
  </vuln>

  <vuln vid="180e9a38-060f-4c16-a6b7-49f3505ff22a">
    <topic>kernel -- information disclosure when using HTT</topic>
    <affects>
      <package>
	<name>FreeBSD</name>
	<range><ge>5.4</ge><lt>5.4_1</lt></range>
	<range><ge>5.0</ge><lt>5.3_15</lt></range>
	<range><ge>4.11</ge><lt>4.11_9</lt></range>
	<range><lt>4.10_14</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem description and impact</h1>
	<p>When running on processors supporting Hyper-Threading Technology, it
	  is possible for a malicious thread to monitor the execution of another
	  thread.</p>
	<p>Information may be disclosed to local users, allowing in many
	  cases for privilege escalation.  For example, on a multi-user
	  system, it may be possible to steal cryptographic keys used in
	  applications such as OpenSSH or SSL-enabled web servers.</p>
	<p><strong>NOTE:</strong> Similar problems may exist in other
	  simultaneous multithreading implementations, or even some
	  systems in the absence of simultaneous multithreading.
	  However, current research has only demonstrated this flaw in
	  Hyper-Threading Technology, where shared memory caches are
	  used.</p>
	<h1>Workaround</h1>
	<p>Systems not using processors with Hyper-Threading Technology
	  support are not affected by this issue.  On systems which are
	  affected, the security flaw can be eliminated by setting the
	  "machdep.hlt_logical_cpus" tunable:</p>
	<pre># echo "machdep.hlt_logical_cpus=1" &gt;&gt; /boot/loader.conf</pre>
	<p>The system must be rebooted in order for tunables to take effect.</p>
	<p>Use of this workaround is not recommended on "dual-core" systems, as
	  this workaround will also disable one of the processor
	  cores.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-0109</cvename>
      <freebsdsa>SA-05:09.htt</freebsdsa>
      <url>http://www.daemonology.net/hyperthreading-considered-harmful/</url>
    </references>
    <dates>
      <discovery>2005-05-13</discovery>
      <entry>2005-05-13</entry>
    </dates>
  </vuln>

  <vuln vid="66dbb2ee-99b8-45b2-bb3e-640caea67a60">
    <topic>leafnode -- fetchnews denial-of-service triggered by transmission abort/timeout</topic>
    <affects>
      <package>
	<name>leafnode</name>
	<range><ge>1.9.48</ge><lt>1.11.2</lt></range>
      </package>
    </affects>
    <description>
       <body xmlns="http://www.w3.org/1999/xhtml">
	 <p>When an upstream server aborts the transmission or stops sending
	   data after the fetchnews program has requested an article header
	   or body, fetchnews may crash, without querying further servers
	   that are configured. This can prevent articles from being fetched.
	</p>
      </body>
    </description>
    <references>
      <url>http://leafnode.sourceforge.net/leafnode-SA-2005-01.txt</url>
      <cvename>CVE-2005-1453</cvename>
      <freebsdpr>ports/80663</freebsdpr>
      <bid>13489</bid>
      <bid>13492</bid>
      <mlist msgid="20050504152311.GA25593@merlin.emma.line.org">http://sourceforge.net/mailarchive/forum.php?thread_id=7186974&amp;forum_id=10210</mlist>
      <mlist msgid="20050504152311.GA25593@merlin.emma.line.org">http://article.gmane.org/gmane.network.leafnode.announce/52</mlist>
      <mlist msgid="20050504152311.GA25593@merlin.emma.line.org">http://www.dt.e-technik.uni-dortmund.de/pipermail/leafnode-list/2005q2/000900.html</mlist>
      <mlist msgid="20050504152311.GA25593@merlin.emma.line.org">http://www.fredi.de/maillist/msg00111.html</mlist>
      <mlist msgid="20050504152311.GA25593@merlin.emma.line.org">http://archives.neohapsis.com/archives/vulnwatch/2005-q2/0037.html</mlist>
      <url>http://www.frsirt.com/english/advisories/2005/0468</url>
      <url>http://secunia.com/advisories/15252</url>
    </references>
    <dates>
      <discovery>2005-05-04</discovery>
      <entry>2005-05-13</entry>
    </dates>
  </vuln>

  <vuln vid="a6427195-c2c7-11d9-89f7-02061b08fc24">
    <topic>mozilla -- privilege escalation via non-DOM property overrides</topic>
    <affects>
      <package>
	<name>firefox</name>
	<range><lt>1.0.4,1</lt></range>
      </package>
      <package>
	<name>linux-firefox</name>
	<range><lt>1.0.4</lt></range>
      </package>
      <package>
	<name>mozilla</name>
	<range><lt>1.7.8,2</lt></range>
	<range><ge>1.8.*,2</ge></range>
      </package>
      <package>
	<name>linux-mozilla</name>
	<name>linux-mozilla-devel</name>
	<range><lt>1.7.8</lt></range>
	<range><ge>1.8.*</ge></range>
      </package>
      <package>
	<name>netscape7</name>
	<range><ge>0</ge></range>
      </package>
      <package>
	<!-- These ports are obsolete. -->
	<name>de-linux-mozillafirebird</name>
	<name>el-linux-mozillafirebird</name>
	<name>ja-linux-mozillafirebird-gtk1</name>
	<name>ja-mozillafirebird-gtk2</name>
	<name>linux-mozillafirebird</name>
	<name>ru-linux-mozillafirebird</name>
	<name>zhCN-linux-mozillafirebird</name>
	<name>zhTW-linux-mozillafirebird</name>
	<range><ge>0</ge></range>
      </package>
      <package>
	<!-- These package names are obsolete. -->
	<name>de-linux-netscape</name>
	<name>de-netscape7</name>
	<name>fr-linux-netscape</name>
	<name>fr-netscape7</name>
	<name>ja-linux-netscape</name>
	<name>ja-netscape7</name>
	<name>linux-netscape</name>
	<name>linux-phoenix</name>
	<name>mozilla+ipv6</name>
	<name>mozilla-embedded</name>
	<name>mozilla-firebird</name>
	<name>mozilla-gtk1</name>
	<name>mozilla-gtk2</name>
	<name>mozilla-gtk</name>
	<name>mozilla-thunderbird</name>
	<name>phoenix</name>
	<name>pt_BR-netscape7</name>
	<range><ge>0</ge></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A Mozilla Foundation Security Advisory reports:</p>
	<blockquote cite="http://www.mozilla.org/security/announce/mfsa2005-44.html">
	  <p>Additional checks were added to make sure Javascript eval
	    and Script objects are run with the privileges of the
	    context that created them, not the potentially elevated
	    privilege of the context calling them in order to protect
	    against an additional variant of <a href="http://www.mozilla.org/security/announce/mfsa2005-41.html">MFSA
	    2005-41</a>.</p>
	</blockquote>
	<p>The Mozilla Foundation Security Advisory MFSA 2005-41
	  reports:</p>
	<blockquote cite="http://www.mozilla.org/security/announce/mfsa2005-41.html">
	  <p>moz_bug_r_a4 reported several exploits giving an attacker
	    the ability to install malicious code or steal data,
	    requiring only that the user do commonplace actions like
	    click on a link or open the context menu.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <url>http://www.mozilla.org/security/announce/mfsa2005-44.html</url>
    </references>
    <dates>
      <discovery>2005-05-11</discovery>
      <entry>2005-05-12</entry>
    </dates>
  </vuln>

  <vuln vid="a81746a1-c2c7-11d9-89f7-02061b08fc24">
    <topic>mozilla -- "Wrapped" javascript: urls bypass security checks</topic>
    <affects>
      <package>
	<name>firefox</name>
	<range><lt>1.0.4,1</lt></range>
      </package>
      <package>
	<name>linux-firefox</name>
	<range><lt>1.0.4</lt></range>
      </package>
      <package>
	<name>mozilla</name>
	<range><lt>1.7.8,2</lt></range>
	<range><ge>1.8.*,2</ge></range>
      </package>
      <package>
	<name>linux-mozilla</name>
	<name>linux-mozilla-devel</name>
	<range><lt>1.7.8</lt></range>
	<range><ge>1.8.*</ge></range>
      </package>
      <package>
	<name>netscape7</name>
	<range><ge>0</ge></range>
      </package>
      <package>
	<!-- These ports are obsolete. -->
	<name>de-linux-mozillafirebird</name>
	<name>el-linux-mozillafirebird</name>
	<name>ja-linux-mozillafirebird-gtk1</name>
	<name>ja-mozillafirebird-gtk2</name>
	<name>linux-mozillafirebird</name>
	<name>ru-linux-mozillafirebird</name>
	<name>zhCN-linux-mozillafirebird</name>
	<name>zhTW-linux-mozillafirebird</name>
	<range><ge>0</ge></range>
      </package>
      <package>
	<!-- These package names are obsolete. -->
	<name>de-linux-netscape</name>
	<name>de-netscape7</name>
	<name>fr-linux-netscape</name>
	<name>fr-netscape7</name>
	<name>ja-linux-netscape</name>
	<name>ja-netscape7</name>
	<name>linux-netscape</name>
	<name>linux-phoenix</name>
	<name>mozilla+ipv6</name>
	<name>mozilla-embedded</name>
	<name>mozilla-firebird</name>
	<name>mozilla-gtk1</name>
	<name>mozilla-gtk2</name>
	<name>mozilla-gtk</name>
	<name>mozilla-thunderbird</name>
	<name>phoenix</name>
	<name>pt_BR-netscape7</name>
	<range><ge>0</ge></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A Mozilla Foundation Security Advisory reports:</p>
	<blockquote cite="http://www.mozilla.org/security/announce/mfsa2005-43.html">
	  <p>Some security checks intended to prevent script injection
	    were incorrect and could be bypassed by wrapping a
	    javascript: url in the view-source:
	    pseudo-protocol. Michael Krax demonstrated that a variant
	    of his <a href="http://www.mozilla.org/security/announce/mfsa2005-37.html">favicon</a>
	    exploit could still execute arbitrary code, and the same
	    technique could also be used to perform cross-site
	    scripting.</p>
	  <p>Georgi Guninski demonstrated the same flaw wrapping
	    javascript: urls with the jar: pseudo-protocol.</p>
	  <p>L. David Baron discovered a nested variant that defeated
	    checks in the script security manager.</p>
	  <p><strong>Workaround:</strong> Disable Javascript</p>
	</blockquote>
      </body>
    </description>
    <references>
      <url>http://www.mozilla.org/security/announce/mfsa2005-43.html</url>
    </references>
    <dates>
      <discovery>2005-05-11</discovery>
      <entry>2005-05-12</entry>
    </dates>
  </vuln>

  <vuln vid="eca6195a-c233-11d9-804c-02061b08fc24">
    <topic>mozilla -- code execution via javascript: IconURL vulnerability</topic>
    <affects>
      <package>
	<name>firefox</name>
	<range><lt>1.0.4,1</lt></range>
      </package>
      <package>
	<name>linux-firefox</name>
	<range><lt>1.0.4</lt></range>
      </package>
      <package>
	<name>mozilla</name>
	<range><lt>1.7.8,2</lt></range>
	<range><ge>1.8.*,2</ge></range>
      </package>
      <package>
	<name>linux-mozilla</name>
	<name>linux-mozilla-devel</name>
	<range><lt>1.7.8</lt></range>
	<range><ge>1.8.*</ge></range>
      </package>
      <package>
	<name>netscape7</name>
	<range><ge>0</ge></range>
      </package>
      <package>
	<!-- These ports are obsolete. -->
	<name>de-linux-mozillafirebird</name>
	<name>el-linux-mozillafirebird</name>
	<name>ja-linux-mozillafirebird-gtk1</name>
	<name>ja-mozillafirebird-gtk2</name>
	<name>linux-mozillafirebird</name>
	<name>ru-linux-mozillafirebird</name>
	<name>zhCN-linux-mozillafirebird</name>
	<name>zhTW-linux-mozillafirebird</name>
	<range><ge>0</ge></range>
      </package>
      <package>
	<!-- These package names are obsolete. -->
	<name>de-linux-netscape</name>
	<name>de-netscape7</name>
	<name>fr-linux-netscape</name>
	<name>fr-netscape7</name>
	<name>ja-linux-netscape</name>
	<name>ja-netscape7</name>
	<name>linux-netscape</name>
	<name>linux-phoenix</name>
	<name>mozilla+ipv6</name>
	<name>mozilla-embedded</name>
	<name>mozilla-firebird</name>
	<name>mozilla-gtk1</name>
	<name>mozilla-gtk2</name>
	<name>mozilla-gtk</name>
	<name>mozilla-thunderbird</name>
	<name>phoenix</name>
	<name>pt_BR-netscape7</name>
	<range><ge>0</ge></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A Mozilla Foundation Security Advisory reports:</p>
	<blockquote cite="http://www.mozilla.org/security/announce/mfsa2005-42.html">
	  <p>Two vulnerabilities have been discovered in Firefox,
	    which can be exploited by malicious people to conduct
	    cross-site scripting attacks and compromise a user's
	    system.</p>
	  <ol>
	    <li>The problem is that "IFRAME" JavaScript URLs are not
	      properly protected from being executed in context of
	      another URL in the history list. This can be exploited
	      to execute arbitrary HTML and script code in a user's
	      browser session in context of an arbitrary site.</li>
	    <li>Input passed to the "IconURL" parameter in
	      "InstallTrigger.install()" is not properly verified
	      before being used. This can be exploited to execute
	      arbitrary JavaScript code with escalated privileges via
	      a specially crafted JavaScript URL.</li>
	  </ol>
	  <p>Successful exploitation requires that the site is allowed
	    to install software (default sites are
	    "update.mozilla.org" and "addons.mozilla.org").</p>
	  <p>A combination of vulnerability 1 and 2 can be exploited
	    to execute arbitrary code.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-1476</cvename>
      <cvename>CVE-2005-1477</cvename>
      <url>http://www.mozilla.org/security/announce/mfsa2005-42.html</url>
    </references>
    <dates>
      <discovery>2005-05-08</discovery>
      <entry>2005-05-11</entry>
    </dates>
  </vuln>

  <vuln vid="01bb84e2-bd88-11d9-a281-02e018374e71">
    <topic>groff -- pic2graph and eqn2graph are vulnerable to symlink attack through temporary files</topic>
    <affects>
      <package>
	<name>ja-groff</name>
	<range><ge>1.18.1</ge><lt>1.18.1_8</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The eqn2graph and pic2graph scripts in groff 1.18.1
	  allow local users to overwrite arbitrary files via
	  a symlink attack on temporary files.</p>
      </body>
    </description>
    <references>
      <freebsdpr>ports/80671</freebsdpr>
      <bid>12058</bid>
      <cvename>CVE-2004-1296</cvename>
      <url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=286371</url>
      <url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=286372</url>
    </references>
    <dates>
      <discovery>2004-12-20</discovery>
      <entry>2005-05-09</entry>
    </dates>
  </vuln>

  <vuln vid="169f422f-bd88-11d9-a281-02e018374e71">
    <topic>groff -- groffer uses temporary files unsafely</topic>
    <affects>
      <package>
	<name>ja-groff</name>
	<range><ge>1.18</ge><lt>1.18.1_8</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The groffer script in the groff package 1.18 and later versions
	  allows local users to overwrite files via a symlink attack
	  on temporary files.</p>
      </body>
    </description>
    <references>
      <freebsdpr>ports/80671</freebsdpr>
      <bid>11287</bid>
      <cvename>CVE-2004-0969</cvename>
      <url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=278265</url>
    </references>
    <dates>
      <discovery>2004-09-30</discovery>
      <entry>2005-05-09</entry>
    </dates>
  </vuln>

  <vuln vid="5f003a08-ba3c-11d9-837d-000e0c2e438a">
    <topic>sharutils -- unshar insecure temporary file creation</topic>
    <affects>
      <package>
	<name>sharutils</name>
	<range><lt>4.3.80</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>An Ubuntu Advisory reports:</p>
	<blockquote cite="http://www.ubuntulinux.org/support/documentation/usn/usn-104-1">
	  <p>Joey Hess discovered that "unshar" created temporary files
	    in an insecure manner. This could allow a symbolic link
	    attack to create or overwrite arbitrary files with the
	    privileges of the user invoking the program.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <bid>12981</bid>
      <cvename>CVE-2005-0990</cvename>
      <url>http://www.ubuntulinux.org/support/documentation/usn/usn-104-1</url>
    </references>
    <dates>
      <discovery>2005-04-04</discovery>
      <entry>2005-05-01</entry>
    </dates>
  </vuln>

  <vuln vid="8c5ad0cf-ba37-11d9-837d-000e0c2e438a">
    <topic>rsnapshot -- local privilege escalation</topic>
    <affects>
      <package>
	<name>rsnapshot</name>
	<range><lt>1.1.7</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>An rsnapshot Advisory reports:</p>
	<blockquote cite="http://www.rsnapshot.org/security/2005/001.html">
	  <p>The copy_symlink() subroutine in rsnapshot incorrectly
	    changes file ownership on the files pointed to by symlinks,
	    not on the symlinks themselves. This would allow, under
	    certain circumstances, an arbitrary user to take ownership
	    of a file on the main filesystem.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <bid>13095</bid>
      <cvename>CVE-2005-1064</cvename>
      <url>http://www.rsnapshot.org/security/2005/001.html</url>
    </references>
    <dates>
      <discovery>2005-04-10</discovery>
      <entry>2005-05-01</entry>
    </dates>
  </vuln>

  <vuln vid="756db070-b9d4-11d9-ae81-000ae42e9b93">
    <topic>coppermine -- IP spoofing and XSS vulnerability</topic>
    <affects>
      <package>
	<name>coppermine</name>
	<range><lt>1.3.2</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>GHC team reports about coppermine</p>
	<blockquote cite="http://www.securityfocus.com/archive/1/396080">
	  <p>The lack of sanitizing of user defined variables may
	    result in undesirable consequences such as IP spoofing
	    or XSS attack.</p>
	  <p>Generally users of Coppermine Gallery can post comments.
	    Remote address &amp; x-forwarded-for variables are logged
	    for admin's eyes.  X-Forwarded-for variable does not pass
	    throu any filtration before logging into database. User
	    can define/redefine this variable.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <mlist msgid="20050418122434.10438.qmail@www.securityfocus.com">http://www.securityfocus.com/archive/1/396080</mlist>
      <bid>13218</bid>
      <cvename>CVE-2005-1172</cvename>
      <url>http://coppermine.sourceforge.net/board/index.php?topic=17134.0</url>
    </references>
    <dates>
      <discovery>2005-04-18</discovery>
      <entry>2005-05-01</entry>
    </dates>
  </vuln>

  <vuln vid="cd286cc5-b762-11d9-bfb7-000c6ec775d9">
    <topic>ImageMagick -- ReadPNMImage() heap overflow vulnerability</topic>
    <affects>
      <package>
	<name>ImageMagick</name>
	<name>ImageMagick-nox11</name>
	<range><lt>6.2.2</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Damian Put reports about ImageMagick:</p>
	<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=111445767107869">
	  <p>Remote exploitation of a heap overflow vulnerability
	    could allow execution of arbitrary code or course denial
	    of service.</p>
	  <p>A heap overflow exists in ReadPNMImage() function, that
	    is used to decode a PNM image files.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <bid>13351</bid>
      <url>http://marc.theaimsgroup.com/?l=bugtraq&amp;m=111445767107869</url>
    </references>
    <dates>
      <discovery>2005-04-25</discovery>
      <entry>2005-04-27</entry>
    </dates>
  </vuln>

  <vuln vid="91c606fc-b5d0-11d9-a788-0001020eed82">
    <topic>mplayer &amp; libxine -- MMS and Real RTSP buffer overflow vulnerabilities</topic>
    <affects>
      <package>
	<name>mplayer</name>
	<name>mplayer-gtk</name>
	<name>mplayer-gtk2</name>
	<name>mplayer-esound</name>
	<name>mplayer-gtk-esound</name>
	<name>mplayer-gtk2-esound</name>
	<range><lt>0.99.7</lt></range>
      </package>
      <package>
	<name>libxine</name>
	<range><ge>0.9.9</ge><lt>1.0.1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A xine security announcement reports:</p>
	<blockquote cite="http://xinehq.de/index.php/security/XSA-2004-8">
	  <p>By a user receiving data from a malicious network
	    streaming server, an attacker can overrun a heap buffer,
	    which can, on some systems, lead to or help in executing
	    attacker-chosen malicious code with the permissions of the
	    user running a xine-lib based media application.</p>
	  <p>Both the MMS and Real RTSP streaming client code made
	    some too-strong assumptions on the transferred
	    data. Several critical bounds checks were missing,
	    resulting in the possibility of heap overflows, should the
	    remote server not adhere to these assumptions. In the MMS
	    case, a remote server could present content with too many
	    individual streams; in the RTSP case, a remote server's
	    reply could have too many lines.</p>
	  <p>An attacker can set up a server delivering malicious data
	    to the users. This can be used to overflow a heap buffer,
	    which can, with certain implementations of heap
	    management, lead to attacker chosen data written to the
	    stack. This can cause attacker-chosen code being executed
	    with the permissions of the user running the
	    application. By tricking users to retrieve a stream, which
	    can be as easy as providing a link on a website, this
	    vulnerability can be exploited remotely.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <bid>13270</bid>
      <bid>13271</bid>
      <cvename>CVE-2005-1195</cvename>
      <url>http://www.mplayerhq.hu/homepage/design7/news.html#vuln10</url>
      <url>http://www.mplayerhq.hu/homepage/design7/news.html#vuln11</url>
      <url>http://xinehq.de/index.php/security/XSA-2004-8</url>
    </references>
    <dates>
      <discovery>2005-04-16</discovery>
      <entry>2005-04-25</entry>
    </dates>
  </vuln>

  <vuln vid="8b0e94cc-b5cd-11d9-a788-0001020eed82">
    <topic>gaim -- AIM/ICQ remote denial of service vulnerability</topic>
    <affects>
      <package>
	<name>gaim</name>
	<name>ja-gaim</name>
	<name>ko-gaim</name>
	<name>ru-gaim</name>
	<range><lt>1.1.3</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The GAIM team reports that GAIM is vulnerable to a
	  denial-of-service vulnerability which can cause GAIM to
	  freeze:</p>
	<blockquote cite="http://gaim.sourceforge.net/security/index.php?id=10">
	  <p>Certain malformed SNAC packets sent by other AIM or ICQ
	    users can trigger an infinite loop in Gaim when parsing
	    the SNAC. The remote user would need a custom client, able
	    to generate malformed SNACs.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-0472</cvename>
      <url>http://gaim.sourceforge.net/security/index.php?id=10</url>
    </references>
    <dates>
      <discovery>2005-02-17</discovery>
      <entry>2005-04-25</entry>
    </dates>
  </vuln>

  <vuln vid="142353df-b5cc-11d9-a788-0001020eed82">
    <topic>gaim -- remote DoS on receiving malformed HTML</topic>
    <affects>
      <package>
	<name>gaim</name>
	<name>ja-gaim</name>
	<name>ko-gaim</name>
	<name>ru-gaim</name>
	<range><lt>1.1.4</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The GAIM team reports:</p>
	<blockquote cite="http://gaim.sourceforge.net/security/index.php?id=12">
	  <p>Receiving malformed HTML can result in an invalid memory
	    access causing Gaim to crash.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-0208</cvename>
      <cvename>CVE-2005-0473</cvename>
      <url>http://gaim.sourceforge.net/security/index.php?id=11</url>
      <url>http://gaim.sourceforge.net/security/index.php?id=12</url>
    </references>
    <dates>
      <discovery>2005-02-17</discovery>
      <entry>2005-04-25</entry>
    </dates>
  </vuln>

  <vuln vid="91f1adc7-b3e9-11d9-a788-0001020eed82">
    <topic>kdewebdev -- kommander untrusted code execution vulnerability</topic>
    <affects>
      <package>
	<name>kdewebdev</name>
	<range><gt>3.2,2</gt><lt>3.4.0_1,2</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A KDE Security Advisory reports:</p>
	<blockquote cite="http://www.kde.org/info/security/advisory-20050420-1.txt">
	  <p>Kommander executes without user confirmation data files
	    from possibly untrusted locations. As they contain
	    scripts, the user might accidentally run arbitrary
	    code.</p>
	  <p><strong>Impact:</strong> Remotly supplied kommander files
	    from untrusted sources are executed without
	    confirmation.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-0754</cvename>
      <url>http://www.kde.org/info/security/advisory-20050420-1.txt</url>
    </references>
    <dates>
      <discovery>2005-04-20</discovery>
      <entry>2005-04-23</entry>
      <modified>2008-08-04</modified>
    </dates>
  </vuln>

  <vuln vid="97edf5ab-b319-11d9-837d-000e0c2e438a">
    <topic>junkbuster -- heap corruption vulnerability and configuration modification vulnerability</topic>
    <affects>
      <package>
	<name>junkbuster</name>
	<range><lt>2.0.2_3</lt></range>
      </package>
      <package>
	<name>junkbuster-zlib</name>
	<range><gt>0</gt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A Debian advisory reports:</p>
	<blockquote cite="http://www.debian.org/security/2005/dsa-713">
	  <p>James Ranson discovered that an attacker can modify the
	    referrer setting with a carefully crafted URL by accidently
	    overwriting a global variable.</p>
	  <p>Tavis Ormandy from the Gentoo Security Team discovered
	    several heap corruptions due to inconsistent use of an
	    internal function that can crash the daemon or possibly
	    lead to the execution of arbitrary code.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <bid>13146</bid>
      <bid>13147</bid>
      <cvename>CVE-2005-1108</cvename>
      <cvename>CVE-2005-1109</cvename>
      <url>http://www.debian.org/security/2005/dsa-713</url>
      <url>http://www.gentoo.org/security/en/glsa/glsa-200504-11.xml</url>
    </references>
    <dates>
      <discovery>2005-04-13</discovery>
      <entry>2005-04-22</entry>
    </dates>
  </vuln>

  <vuln vid="06404241-b306-11d9-a788-0001020eed82">
    <topic>kdelibs -- kimgio input validation errors</topic>
    <affects>
      <package>
	<name>kdelibs</name>
	<range><ge>3.2</ge><lt>3.4.0_2</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A KDE Security Advisory reports:</p>
	<blockquote cite="http://www.kde.org/info/security/advisory-20050421-1.txt">
	  <p>kimgio contains a PCX image file format reader that does
	    not properly perform input validation. A source code audit
	    performed by the KDE security team discovered several
	    vulnerabilities in the PCX and other image file format
	    readers, some of them exploitable to execute arbitrary
	    code.</p>
	  <p><strong>Impact:</strong> Remotely supplied, specially
	    crafted image files can be used to execute arbitrary
	    code.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-1046</cvename>
      <url>http://bugs.kde.org/102328</url>
      <url>http://www.kde.org/info/security/advisory-20050421-1.txt</url>
    </references>
    <dates>
      <discovery>2005-04-21</discovery>
      <entry>2005-04-22</entry>
    </dates>
  </vuln>

  <vuln vid="6c2d4f29-af3e-11d9-837d-000e0c2e438a">
    <topic>gld -- format string and buffer overflow vulnerabilities</topic>
    <affects>
      <package>
	<name>gld</name>
	<range><lt>1.5</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Gld has been found vulnerable to multiple buffer overflows as
	  well as multiple format string vulnerabilities.</p>
	<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=111339935903880">
	  <p>An attacker could exploit this vulnerability to execute
	    arbitrary code with the permissions of the user running Gld,
	    the default user being root.</p>
	</blockquote>
	<p>The FreeBSD port defaults to running gld as the root user.
	  The risk of exploitation can be minimized by making gld
	  listen on the loopback address only, or configure it to only
	  accept connections from trusted smtp servers.</p>
      </body>
    </description>
    <references>
      <bid>13129</bid>
      <bid>13133</bid>
      <cvename>CVE-2005-1099</cvename>
      <cvename>CVE-2005-1100</cvename>
      <mlist msgid="20050412004111.562AC7A890E@ws4-4.us4.outblaze.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=111339935903880</mlist>
      <mlist msgid="20050413174736.20947.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=111342432325670</mlist>
    </references>
    <dates>
      <discovery>2005-04-12</discovery>
      <entry>2005-04-19</entry>
    </dates>
  </vuln>

  <vuln vid="0163b498-af54-11d9-acd0-000854d03344">
    <topic>axel -- remote buffer overflow</topic>
    <affects>
      <package>
	<name>axel</name>
	<range><lt>1.0a_4</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A Debian Security Advisory reports:</p>
	<blockquote cite="http://www.debian.org/security/2005/dsa-706">
	  <p>Ulf Härnhammar from the Debian Security Audit Project
	  discovered a buffer overflow in axel, a light download
	  accelerator.	When reading remote input the program did
	  not check if a part of the input can overflow a buffer
	  and maybe trigger the execution of arbitrary code.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <bid>13059</bid>
      <cvename>CVE-2005-0390</cvename>
      <url>http://www.debian.org/security/2005/dsa-706</url>
    </references>
    <dates>
      <discovery>2005-04-16</discovery>
      <entry>2005-04-17</entry>
    </dates>
  </vuln>

  <vuln vid="ce6ac624-aec8-11d9-a788-0001020eed82">
    <topic>firefox -- PLUGINSPAGE privileged javascript execution</topic>
    <affects>
      <package>
	<name>firefox</name>
	<range><lt>1.0.3,1</lt></range>
      </package>
      <package>
	<name>linux-firefox</name>
	<range><lt>1.0.3</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A Mozilla Foundation Security Advisory reports:</p>
	<blockquote cite="http://www.mozilla.org/security/announce/mfsa2005-34.html">
	  <p>When a webpage requires a plugin that is not installed
	    the user can click to launch the Plugin Finder Service
	    (PFS) to find an appropriate plugin. If the service does
	    not have an appropriate plugin the EMBED tag is checked
	    for a PLUGINSPAGE attribute, and if one is found the PFS
	    dialog will contain a "manual install" button that will
	    load the PLUGINSPAGE url.</p>
	  <p>Omar Khan reported that if the PLUGINSPAGE attribute
	    contains a javascript: url then pressing the button could
	    launch arbitrary code capable of stealing local data or
	    installing malicious code.</p>
	  <p>Doron Rosenberg reported a variant that injects script by
	    appending it to a malformed URL of any protocol.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-0752</cvename>
      <url>http://www.mozilla.org/security/announce/mfsa2005-34.html</url>
      <url>https://bugzilla.mozilla.org/show_bug.cgi?id=288556</url>
      <url>https://bugzilla.mozilla.org/show_bug.cgi?id=289171</url>
    </references>
    <dates>
      <discovery>2005-03-31</discovery>
      <entry>2005-04-16</entry>
    </dates>
  </vuln>

  <vuln vid="18e5428f-ae7c-11d9-837d-000e0c2e438a">
    <topic>jdk -- jar directory traversal vulnerability</topic>
    <affects>
      <package>
	<name>jdk</name>
	<range><le>1.2.2p11_3</le></range>
	<range><ge>1.3.*</ge><le>1.3.1p9_4</le></range>
	<range><ge>1.4.*</ge><le>1.4.2p7</le></range>
	<range><ge>1.5.*</ge><le>1.5.0p1_1</le></range>
      </package>
      <package>
	<name>linux-ibm-jdk</name>
	<range><le>1.4.2_1</le></range>
      </package>
      <package>
	<name>linux-sun-jdk</name>
	<range><le>1.4.2.08_1</le></range>
	<range><eq>1.5.0b1</eq></range>
	<range><eq>1.5.0b1,1</eq></range>
	<range><ge>1.5.0,2</ge><le>1.5.0.02,2</le></range>
      </package>
      <package>
	<name>linux-blackdown-jdk</name>
	<range><le>1.4.2_2</le></range>
      </package>
      <package>
	<name>diablo-jdk</name>
	<range><le>1.3.1.0_1</le></range>
      </package>
      <package>
	<name>diablo-jdk-freebsd6</name>
	<range><le>i386.1.5.0.07.00</le></range>
      </package>
      <package>
	<name>linux-jdk</name>
	<range><ge>0</ge></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Pluf has discovered a vulnerability in Sun Java JDK/SDK,
	  which potentially can be exploited by malicious people to
	  compromise a user's system.</p>
	<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=111331593310508">
	  <p>The jar tool does not check properly if the files to be
	    extracted have the string "../" on its names, so it's
	    possible for an attacker to create a malicious jar file in
	    order to overwrite arbitrary files within the filesystem.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-1080</cvename>
      <mlist msgid="200504120226.10559.pluf@7a69ezine.org">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=111331593310508</mlist>
      <url>http://www.securiteam.com/securitynews/5IP0C0AFGW.html</url>
      <url>http://secunia.com/advisories/14902/</url>
    </references>
    <dates>
      <discovery>2005-04-11</discovery>
      <entry>2005-04-16</entry>
      <modified>2006-09-12</modified>
    </dates>
  </vuln>

  <vuln vid="f650d5b8-ae62-11d9-a788-0001020eed82">
    <topic>mozilla -- privilege escalation via DOM property overrides</topic>
    <affects>
      <package>
	<name>firefox</name>
	<range><lt>1.0.3,1</lt></range>
      </package>
      <package>
	<name>linux-firefox</name>
	<range><lt>1.0.3</lt></range>
      </package>
      <package>
	<name>mozilla</name>
	<range><lt>1.7.7,2</lt></range>
	<range><ge>1.8.*,2</ge></range>
      </package>
      <package>
	<name>linux-mozilla</name>
	<name>linux-mozilla-devel</name>
	<range><lt>1.7.7</lt></range>
	<range><ge>1.8.*</ge></range>
      </package>
      <package>
	<name>netscape7</name>
	<range><ge>0</ge></range>
      </package>
      <package>
	<!-- These ports are obsolete. -->
	<name>de-linux-mozillafirebird</name>
	<name>el-linux-mozillafirebird</name>
	<name>ja-linux-mozillafirebird-gtk1</name>
	<name>ja-mozillafirebird-gtk2</name>
	<name>linux-mozillafirebird</name>
	<name>ru-linux-mozillafirebird</name>
	<name>zhCN-linux-mozillafirebird</name>
	<name>zhTW-linux-mozillafirebird</name>
	<range><ge>0</ge></range>
      </package>
      <package>
	<!-- These package names are obsolete. -->
	<name>de-linux-netscape</name>
	<name>de-netscape7</name>
	<name>fr-linux-netscape</name>
	<name>fr-netscape7</name>
	<name>ja-linux-netscape</name>
	<name>ja-netscape7</name>
	<name>linux-netscape</name>
	<name>linux-phoenix</name>
	<name>mozilla+ipv6</name>
	<name>mozilla-embedded</name>
	<name>mozilla-firebird</name>
	<name>mozilla-gtk1</name>
	<name>mozilla-gtk2</name>
	<name>mozilla-gtk</name>
	<name>mozilla-thunderbird</name>
	<name>phoenix</name>
	<name>pt_BR-netscape7</name>
	<range><ge>0</ge></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A Mozilla Foundation Security Advisory reports:</p>
	<blockquote cite="http://www.mozilla.org/security/announce/mfsa2005-41.html">
	  <p>moz_bug_r_a4 reported several exploits giving an attacker
	    the ability to install malicious code or steal data,
	    requiring only that the user do commonplace actions like
	    click on a link or open the context menu. The common cause
	    in each case was privileged UI code ("chrome") being
	    overly trusting of DOM nodes from the content
	    window. Scripts in the web page can override properties
	    and methods of DOM nodes and shadow the native values,
	    unless steps are taken to get the true underlying values.</p>
	  <p>We found that most extensions also interacted with
	    content DOM in a natural, but unsafe, manner. Changes were
	    made so that chrome code using this natural DOM coding
	    style will now automatically use the native DOM value if
	    it exists without having to use cumbersome wrapper
	    objects.</p>
	  <p>Most of the specific exploits involved tricking the
	    privileged code into calling eval() on an
	    attacker-supplied script string, or the equivalent using
	    the Script() object. Checks were added in the security
	    manager to make sure eval and Script objects are run with
	    the privileges of the context that created them, not the
	    potentially elevated privileges of the context calling
	    them.</p>
	  <p><strong>Workaround</strong>: Disable Javascript</p>
	</blockquote>
      </body>
    </description>
    <references>
      <url>http://www.mozilla.org/security/announce/mfsa2005-41.html</url>
    </references>
    <dates>
      <discovery>2005-04-15</discovery>
      <entry>2005-04-16</entry>
    </dates>
  </vuln>

  <vuln vid="1989b511-ae62-11d9-a788-0001020eed82">
    <topic>mozilla -- code execution through javascript: favicons</topic>
    <affects>
      <package>
	<name>firefox</name>
	<range><lt>1.0.3,1</lt></range>
      </package>
      <package>
	<name>linux-firefox</name>
	<range><lt>1.0.3</lt></range>
      </package>
      <package>
	<name>mozilla</name>
	<range><lt>1.7.7,2</lt></range>
	<range><ge>1.8.*,2</ge></range>
      </package>
      <package>
	<name>linux-mozilla</name>
	<name>linux-mozilla-devel</name>
	<range><lt>1.7.7</lt></range>
	<range><ge>1.8.*</ge></range>
      </package>
      <package>
	<name>netscape7</name>
	<range><ge>0</ge></range>
      </package>
      <package>
	<!-- These ports are obsolete. -->
	<name>de-linux-mozillafirebird</name>
	<name>el-linux-mozillafirebird</name>
	<name>ja-linux-mozillafirebird-gtk1</name>
	<name>ja-mozillafirebird-gtk2</name>
	<name>linux-mozillafirebird</name>
	<name>ru-linux-mozillafirebird</name>
	<name>zhCN-linux-mozillafirebird</name>
	<name>zhTW-linux-mozillafirebird</name>
	<range><ge>0</ge></range>
      </package>
      <package>
	<!-- These package names are obsolete. -->
	<name>de-linux-netscape</name>
	<name>de-netscape7</name>
	<name>fr-linux-netscape</name>
	<name>fr-netscape7</name>
	<name>ja-linux-netscape</name>
	<name>ja-netscape7</name>
	<name>linux-netscape</name>
	<name>linux-phoenix</name>
	<name>mozilla+ipv6</name>
	<name>mozilla-embedded</name>
	<name>mozilla-firebird</name>
	<name>mozilla-gtk1</name>
	<name>mozilla-gtk2</name>
	<name>mozilla-gtk</name>
	<name>mozilla-thunderbird</name>
	<name>phoenix</name>
	<name>pt_BR-netscape7</name>
	<range><ge>0</ge></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A Mozilla Foundation Security Advisory reports:</p>
	<blockquote cite="http://www.mozilla.org/security/announce/mfsa2005-37.html">
	  <p>Firefox and the Mozilla Suite support custom "favicons"
	    through the &lt;LINK rel="icon"&gt; tag. If a link tag is added
	    to the page programmatically and a javascript: url is
	    used, then script will run with elevated privileges and
	    could run or install malicious software.</p>
	  <p><strong>Workaround</strong>: Disable Javascript</p>
	</blockquote>
      </body>
    </description>
    <references>
      <url>http://www.mozilla.org/security/announce/mfsa2005-37.html</url>
    </references>
    <dates>
      <discovery>2005-04-12</discovery>
      <entry>2005-04-16</entry>
    </dates>
  </vuln>

  <vuln vid="45b75152-ae5f-11d9-a788-0001020eed82">
    <topic>mozilla -- javascript "lambda" replace exposes memory contents</topic>
    <affects>
      <package>
	<name>firefox</name>
	<range><lt>1.0.3,1</lt></range>
      </package>
      <package>
	<name>linux-firefox</name>
	<range><lt>1.0.3</lt></range>
      </package>
      <package>
	<name>mozilla</name>
	<range><lt>1.7.7,2</lt></range>
	<range><ge>1.8.*,2</ge></range>
      </package>
      <package>
	<name>linux-mozilla</name>
	<name>linux-mozilla-devel</name>
	<range><lt>1.7.7</lt></range>
	<range><ge>1.8.*</ge></range>
      </package>
      <package>
	<name>netscape7</name>
	<range><ge>0</ge></range>
      </package>
      <package>
	<!-- These ports are obsolete. -->
	<name>de-linux-mozillafirebird</name>
	<name>el-linux-mozillafirebird</name>
	<name>ja-linux-mozillafirebird-gtk1</name>
	<name>ja-mozillafirebird-gtk2</name>
	<name>linux-mozillafirebird</name>
	<name>ru-linux-mozillafirebird</name>
	<name>zhCN-linux-mozillafirebird</name>
	<name>zhTW-linux-mozillafirebird</name>
	<range><ge>0</ge></range>
      </package>
      <package>
	<!-- These package names are obsolete. -->
	<name>de-linux-netscape</name>
	<name>de-netscape7</name>
	<name>fr-linux-netscape</name>
	<name>fr-netscape7</name>
	<name>ja-linux-netscape</name>
	<name>ja-netscape7</name>
	<name>linux-netscape</name>
	<name>linux-phoenix</name>
	<name>mozilla+ipv6</name>
	<name>mozilla-embedded</name>
	<name>mozilla-firebird</name>
	<name>mozilla-gtk1</name>
	<name>mozilla-gtk2</name>
	<name>mozilla-gtk</name>
	<name>mozilla-thunderbird</name>
	<name>phoenix</name>
	<name>pt_BR-netscape7</name>
	<range><ge>0</ge></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A Mozilla Foundation Security Advisory reports:</p>
	<blockquote cite="http://www.mozilla.org/security/announce/mfsa2005-33.html">
	  <p>A bug in javascript's regular expression string
	    replacement when using an anonymous function as the
	    replacement argument allows a malicious script to capture
	    blocks of memory allocated to the browser. A web site
	    could capture data and transmit it to a server without
	    user interaction or knowledge.</p>
	  <p><strong>Workaround</strong>: Disable Javascript</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-0989</cvename>
      <url>http://www.mozilla.org/security/announce/mfsa2005-33.html</url>
      <url>https://bugzilla.mozilla.org/show_bug.cgi?id=288688</url>
    </references>
    <dates>
      <discovery>2005-04-01</discovery>
      <entry>2005-04-16</entry>
    </dates>
  </vuln>

  <vuln vid="1f2fdcff-ae60-11d9-a788-0001020eed82">
    <topic>firefox -- arbitrary code execution in sidebar panel</topic>
    <affects>
      <package>
	<name>firefox</name>
	<range><lt>1.0.3,1</lt></range>
      </package>
      <package>
	<name>linux-firefox</name>
	<range><lt>1.0.3</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A Mozilla Foundation Security Advisory reports:</p>
	<blockquote cite="http://www.mozilla.org/security/announce/mfsa2005-39.html">
	  <p>Sites can use the _search target to open links in the
	    Firefox sidebar. Two missing security checks allow
	    malicious scripts to first open a privileged page (such as
	    about:config) and then inject script using a javascript:
	    url. This could be used to install malicious code or steal
	    data without user interaction.</p>
	  <p><strong>Workaround</strong>: Disable Javascript</p>
	</blockquote>
      </body>
    </description>
    <references>
      <url>http://www.mozilla.org/security/announce/mfsa2005-39.html</url>
    </references>
    <dates>
      <discovery>2005-04-12</discovery>
      <entry>2005-04-16</entry>
    </dates>
  </vuln>

  <vuln vid="b206dd82-ac67-11d9-a788-0001020eed82">
    <topic>openoffice -- DOC document heap overflow vulnerability</topic>
    <affects>
      <package>
	<name>openoffice</name>
	<name>ar-openoffice</name>
	<name>ca-openoffice</name>
	<name>cs-openoffice</name>
	<name>de-openoffice</name>
	<name>dk-openoffice</name>
	<name>el-openoffice</name>
	<name>es-openoffice</name>
	<name>et-openoffice</name>
	<name>fi-openoffice</name>
	<name>fr-openoffice</name>
	<name>gr-openoffice</name>
	<name>hu-openoffice</name>
	<name>it-openoffice</name>
	<name>ja-openoffice</name>
	<name>ko-openoffice</name>
	<name>nl-openoffice</name>
	<name>pl-openoffice</name>
	<name>pt-openoffice</name>
	<name>pt_BR-openoffice</name>
	<name>ru-openoffice</name>
	<name>se-openoffice</name>
	<name>sk-openoffice</name>
	<name>sl-openoffice-SI</name>
	<name>tr-openoffice</name>
	<name>zh-openoffice-CN</name>
	<name>zh-openoffice-TW</name>
	<!-- Deprecated names -->
	<name>jp-openoffice</name>
	<name>kr-openoffice</name>
	<name>sl-openoffice-SL</name>
	<name>zh-openoffice</name>
	<name>zh_TW-openoffice</name>
	<range><lt>1.1.4_2</lt></range>
	<range><gt>2.*</gt><le>2.0.20050406</le></range>
      </package>
      <package>
	<name>openoffice</name>
	<name>ja-openoffice</name>
	<range><ge>6.0.a609</ge><le>6.0.a638</le></range>
	<range><ge>641c</ge><le>645</le></range>
	<range><eq>1.1RC4</eq></range>
	<range><eq>1.1rc5</eq></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>AD-LAB reports that a heap-based buffer overflow
	  vulnerability exists in OpenOffice's handling of DOC
	  documents.  When reading a DOC document 16 bit from a 32 bit
	  integer is used for memory allocation, but the full 32 bit
	  is used for further processing of the document.  This can
	  allow an attacker to crash OpenOffice, or potentially
	  execute arbitrary code as the user running OpenOffice, by
	  tricking an user into opening a specially crafted DOC
	  document.</p>
      </body>
    </description>
    <references>
      <bid>13092</bid>
      <cvename>CVE-2005-0941</cvename>
      <mlist msgid="20050412000438.17342.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=111325305109137</mlist>
      <url>http://www.openoffice.org/issues/show_bug.cgi?id=46388</url>
    </references>
    <dates>
      <discovery>2005-04-11</discovery>
      <entry>2005-04-13</entry>
      <modified>2005-04-20</modified>
    </dates>
  </vuln>

  <vuln vid="22f00553-a09d-11d9-a788-0001020eed82">
    <topic>portupgrade -- insecure temporary file handling vulnerability</topic>
    <affects>
      <package>
	<name>portupgrade</name>
	<range><lt>20041226_2</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Simon L. Nielsen discovered that portupgrade handles
	  temporary files in an insecure manner.  This could allow an
	  unprivileged local attacker to execute arbitrary commands or
	  overwrite arbitrary files with the permissions of the user
	  running portupgrade, typically root, by way of a symlink
	  attack.</p>
	<p>The following issues exist where the temporary files are
	  created, by default in the world writeable directory
	  /var/tmp, with the permissions of the user running
	  portupgrade:</p>
	<ul>
	  <li>pkg_fetch download packages with a predictable local
	    filename allowing a local attacker to overwrite arbitrary
	    local files or potentially replace the downloaded package
	    after download but before install with a package with
	    malicious content, allowing the attacker to run arbitrary
	    commands.</li>
	  <li>portupgrade will, when upgrading ports/packages, write
	    the old package to a predictable temporary file, allowing
	    an attacker to overwrite arbitrary files via a symlink
	    attack.</li>
	  <li>portupgrade will <q>touch</q> a temporary file
	    with a constant filename (pkgdb.fixme) allowing an
	    attacker to create arbitrary zero-byte files via a symlink
	    attack.</li>
	</ul>
	<p>A workaround for these issues is to set the
	  <code>PKG_TMPDIR</code> environment variable to a directory
	  only write-able by the user running portupgrade.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-0610</cvename>
    </references>
    <dates>
      <discovery>2005-04-12</discovery>
      <entry>2005-04-12</entry>
    </dates>
  </vuln>

  <vuln vid="ecf68408-a9f5-11d9-a788-0001020eed82">
    <topic>gaim -- jabber remote crash</topic>
    <affects>
      <package>
	<name>gaim</name>
	<name>ja-gaim</name>
	<name>ko-gaim</name>
	<name>ru-gaim</name>
	<range><lt>1.2.1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The GAIM team reports:</p>
	<blockquote cite="http://gaim.sourceforge.net/security/?id=15">
	  <p>A remote jabber user can cause Gaim to crash by sending a
	    specific file transfer request.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <bid>13004</bid>
      <cvename>CVE-2005-0967</cvename>
      <url>http://gaim.sourceforge.net/security/?id=15</url>
    </references>
    <dates>
      <discovery>2005-04-04</discovery>
      <entry>2005-04-10</entry>
    </dates>
  </vuln>

  <vuln vid="ec09baa3-a9f5-11d9-a788-0001020eed82">
    <topic>gaim -- remote DoS on receiving certain messages over IRC</topic>
    <affects>
      <package>
	<name>gaim</name>
	<name>ja-gaim</name>
	<name>ko-gaim</name>
	<name>ru-gaim</name>
	<range><lt>1.2.1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The GAIM team reports:</p>
	<blockquote cite="http://gaim.sourceforge.net/security/?id=14">
	  <p>The IRC protocol plugin in Gaim 1.2.0, and possibly
	    earlier versions, allows (1) remote attackers to inject
	    arbitrary Gaim markup via irc_msg_kick, irc_msg_mode,
	    irc_msg_part, irc_msg_quit, (2) remote attackers to inject
	    arbitrary Pango markup and pop up empty dialog boxes via
	    irc_msg_invite, or (3) malicious IRC servers to cause a
	    denial of service (application crash) by injecting certain
	    Pango markup into irc_msg_badmode, irc_msg_banned,
	    irc_msg_unknown, irc_msg_nochan functions.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <bid>13003</bid>
      <cvename>CVE-2005-0966</cvename>
      <url>http://gaim.sourceforge.net/security/?id=14</url>
    </references>
    <dates>
      <discovery>2005-04-02</discovery>
      <entry>2005-04-10</entry>
    </dates>
  </vuln>

  <vuln vid="3fa2b372-a9f5-11d9-a788-0001020eed82">
    <topic>gaim -- remote DoS on receiving malformed HTML</topic>
    <affects>
      <package>
	<name>gaim</name>
	<name>ja-gaim</name>
	<name>ko-gaim</name>
	<name>ru-gaim</name>
	<range><lt>1.2.1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The GAIM team reports:</p>
	<blockquote cite="http://gaim.sourceforge.net/security/?id=13">
	  <p>The gaim_markup_strip_html function in Gaim 1.2.0, and
	    possibly earlier versions, allows remote attackers to
	    cause a denial of service (application crash) via a string
	    that contains malformed HTML, which causes an
	    out-of-bounds read.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <bid>12999</bid>
      <cvename>CVE-2005-0965</cvename>
      <url>http://gaim.sourceforge.net/security/?id=13</url>
    </references>
    <dates>
      <discovery>2005-04-02</discovery>
      <entry>2005-04-10</entry>
    </dates>
  </vuln>

  <vuln vid="07f3fe15-a9de-11d9-a788-0001020eed82">
    <topic>php -- readfile() DoS vulnerability</topic>
    <affects>
      <package>
	<name>mod_php4-twig</name>
	<name>php4-cgi</name>
	<name>php4-cli</name>
	<name>php4-dtc</name>
	<name>php4-horde</name>
	<name>php4-nms</name>
	<name>php4</name>
	<range><lt>4.3.5_7</lt></range>
      </package>
      <package>
	<name>mod_php</name>
	<name>mod_php4</name>
	<range><lt>4.3.5_7,1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A SUSE Security advisory reports:</p>
	<blockquote cite="http://www.novell.com/linux/security/advisories/2005_06_sr.html">
	  <p>A bug in the readfile() function of php4 could be used to
	    to crash the httpd running the php4 code when accessing
	    files with a multiple of the architectures page size
	    leading to a denial of service.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <bid>12665</bid>
      <cvename>CVE-2005-0596</cvename>
      <url>http://bugs.php.net/bug.php?id=27037</url>
      <url>http://www.novell.com/linux/security/advisories/2005_06_sr.html</url>
    </references>
    <dates>
      <discovery>2004-01-25</discovery>
      <entry>2005-04-10</entry>
    </dates>
  </vuln>

  <vuln vid="8dbf7894-a9a8-11d9-a788-0001020eed82">
    <topic>squid -- DoS on failed PUT/POST requests vulnerability</topic>
    <affects>
      <package>
	<name>squid</name>
	<range><le>2.5.7_12</le></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The squid patches page notes:</p>
	<blockquote cite="http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-post">
	  <p>An inconsistent state is entered on a failed PUT/POST
	    request making a high risk for segmentation faults or
	    other strange errors</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-0718</cvename>
      <url>http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-post</url>
      <url>http://www.squid-cache.org/bugs/show_bug.cgi?id=1224</url>
    </references>
    <dates>
      <discovery>2005-02-03</discovery>
      <entry>2005-04-10</entry>
    </dates>
  </vuln>

  <vuln vid="396ee517-a607-11d9-ac72-000bdb1444a4">
    <topic>horde -- Horde Page Title Cross-Site Scripting Vulnerability</topic>
    <affects>
      <package>
	<name>horde</name>
	<name>horde-php5</name>
	<range><gt>3.*</gt><lt>3.0.4</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia Advisory: SA14730</p>
	<blockquote cite="http://secunia.com/advisories/14730">
	  <p>A vulnerability has been reported in Horde, which can be
	     exploited by malicious people to conduct cross-site scripting
	     attacks.</p>
	  <p>Input passed when setting the parent frame's page title via
	     JavaScript is not properly sanitised before being returned to
	     the user. This can be exploited to execute arbitrary HTML and
	     script code in a user's browser session in context of an affected
	     site.</p>
	  <p>The vulnerability has been reported in version 3.0.4-RC2. Prior
	     versions may also be affected.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-0961</cvename>
      <mlist msgid="20050329111028.6A112117243@neo.wg.de">http://lists.horde.org/archives/announce/2005/000176.html</mlist>
      <url>http://cvs.horde.org/diff.php/horde/docs/CHANGES?r1=1.515.2.49&amp;r2=1.515.2.93&amp;ty=h</url>
    </references>
    <dates>
      <discovery>2005-03-29</discovery>
      <entry>2005-04-05</entry>
    </dates>
  </vuln>

  <vuln vid="ef410571-a541-11d9-a788-0001020eed82">
    <topic>wu-ftpd -- remote globbing DoS vulnerability</topic>
    <affects>
      <package>
	<name>wu-ftpd</name>
	<range><lt>2.6.2_6</lt></range>
      </package>
      <package>
	<name>wu-ftpd+ipv6</name>
	<range><lt>2.6.2_7</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>An iDEFENSE Security Advisory reports:</p>
	<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110935886414939">
	  <p>Remote exploitation of an input validation vulnerability
	    in version 2.6.2 of WU-FPTD could allow for a denial of
	    service of the system by resource exhaustion.</p>
	  <p>The vulnerability specifically exists in the
	    <code>wu_fnmatch()</code> function in wu_fnmatch.c. When a
	    pattern containing a '*' character is supplied as input,
	    the function calls itself recursively on a smaller
	    substring. By supplying a string which contains a large
	    number of '*' characters, the system will take a long time
	    to return the results, during which time it will be using
	    a large amount of CPU time.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-0256</cvename>
      <mlist msgid="FB24803D1DF2A34FA59FC157B77C970503E249AF@idserv04.idef.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110935886414939</mlist>
    </references>
    <dates>
      <discovery>2005-02-05</discovery>
      <entry>2005-04-04</entry>
    </dates>
  </vuln>

  <vuln vid="5ebfe901-a3cb-11d9-b248-000854d03344">
    <topic>hashcash -- format string vulnerability</topic>
    <affects>
      <package>
	<name>hashcash</name>
	<range><lt>1.17</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A Gentoo Linux Security Advisory reports:</p>
	<blockquote cite="http://www.gentoo.org/security/en/glsa/glsa-200503-12.xml">
	  <p>Tavis Ormandy of the Gentoo Linux Security Audit Team
	    identified a flaw in the Hashcash utility that an attacker
	    could expose by specifying a malformed reply address.</p>
	  <p>Successful exploitation would permit an attacker to disrupt
	    Hashcash users, and potentially execute arbitrary code.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-0687</cvename>
      <url>http://www.gentoo.org/security/en/glsa/glsa-200503-12.xml</url>
    </references>
    <dates>
      <discovery>2005-03-06</discovery>
      <entry>2005-04-02</entry>
      <modified>2005-04-03</modified>
    </dates>
  </vuln>

  <vuln vid="70b62f5e-9e2e-11d9-a256-0001020eed82">
    <topic>clamav -- zip handling DoS vulnerability</topic>
    <affects>
      <package>
	<name>clamav</name>
	<range><lt>0.81</lt></range>
      </package>
      <package>
	<name>clamav-devel</name>
	<range><lt>20050408</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The clamav daemon is vulnerable to a DoS vulnerability due
	  to insufficient handling of malformed zip files which can
	  crash the clamav daemon.</p>
      </body>
    </description>
    <references>
      <bid>12408</bid>
      <cvename>CVE-2005-0133</cvename>
      <url>http://sourceforge.net/project/shownotes.php?release_id=300116</url>
    </references>
    <dates>
      <discovery>2005-01-27</discovery>
      <entry>2005-03-26</entry>
      <modified>2005-04-09</modified>
    </dates>
  </vuln>

  <vuln vid="48a59c96-9c6e-11d9-a040-000a95bc6fae">
    <topic>wine -- information disclosure due to insecure temporary file handling</topic>
    <affects>
      <package>
	<name>wine</name>
	<range><lt>20050310</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Due to insecure temporary file creation in the Wine Windows
	  emulator, it is possible for any user to read potentially
	  sensitive information from temporary registry files.</p>
	<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=111082537009842">
	  <p>When a Win32 application is launched by wine, wine makes
	    a dump of the Windows registry in /tmp with name
	    regxxxxyyyy.tmp , where xxxxxx is the pid in hexadecimal
	    value of the current wine process and yyyy is an integer
	    value usually equal to zero.</p>
	  <p>regxxxxyyyy.tmp is created with 0644 (-rw-r--r--)
	    permissions.  This could represent a security problem in a
	    multi-user environment.  Indeed, any local user could
	    access to windows regstry's dump and get sensitive
	    information, like passwords and other private data.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-0787</cvename>
      <mlist msgid="20050314135701.30231.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=111082537009842</mlist>
      <url>http://bugs.winehq.org/show_bug.cgi?id=2715</url>
      <url>http://www.securitytracker.com/alerts/2005/Mar/1013428.html</url>
      <url>http://www.zone-h.org/advisories/read/id=7300</url>
      <url>http://www.securityfocus.com/bid/12791</url>
      <url>http://xforce.iss.net/xforce/xfdb/19697</url>
    </references>
    <dates>
      <discovery>2005-03-13</discovery>
      <entry>2005-03-24</entry>
    </dates>
  </vuln>

  <vuln vid="741f8841-9c6b-11d9-9dbe-000a95bc6fae">
    <topic>firefox -- arbitrary code execution from sidebar panel</topic>
    <affects>
      <package>
	<name>firefox</name>
	<range><lt>1.0.2,1</lt></range>
      </package>
      <package>
	<name>linux-firefox</name>
	<range><lt>1.0.2</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A Mozilla Foundation Security Advisory states:</p>
	<blockquote cite="http://www.mozilla.org/security/announce/mfsa2005-31.html">
	  <p>If a user bookmarked a malicious page as a Firefox
	    sidebar panel that page could execute arbitrary programs
	    by opening a privileged page and injecting javascript into
	    it.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-0402</cvename>
      <url>http://www.mozilla.org/security/announce/mfsa2005-31.html</url>
    </references>
    <dates>
      <discovery>2005-03-03</discovery>
      <entry>2005-03-24</entry>
    </dates>
  </vuln>

  <vuln vid="7d2aac52-9c6b-11d9-99a7-000a95bc6fae">
    <topic>mozilla -- heap buffer overflow in GIF image processing</topic>
    <affects>
      <package>
	<name>firefox</name>
	<range><lt>1.0.2,1</lt></range>
      </package>
      <package>
	<name>thunderbird</name>
	<name>linux-firefox</name>
	<range><lt>1.0.2</lt></range>
      </package>
      <package>
	<name>mozilla</name>
	<range><lt>1.7.6,2</lt></range>
	<range><ge>1.8.*,2</ge></range>
      </package>
      <package>
	<name>linux-mozilla</name>
	<name>linux-mozilla-devel</name>
	<range><lt>1.7.6</lt></range>
	<range><ge>1.8.*</ge></range>
      </package>
      <package>
	<name>netscape7</name>
	<range><ge>0</ge></range>
      </package>
      <package>
	<!-- These ports are obsolete. -->
	<name>de-linux-mozillafirebird</name>
	<name>el-linux-mozillafirebird</name>
	<name>ja-linux-mozillafirebird-gtk1</name>
	<name>ja-mozillafirebird-gtk2</name>
	<name>linux-mozillafirebird</name>
	<name>ru-linux-mozillafirebird</name>
	<name>zhCN-linux-mozillafirebird</name>
	<name>zhTW-linux-mozillafirebird</name>
	<range><ge>0</ge></range>
      </package>
      <package>
	<!-- These package names are obsolete. -->
	<name>de-linux-netscape</name>
	<name>de-netscape7</name>
	<name>fr-linux-netscape</name>
	<name>fr-netscape7</name>
	<name>ja-linux-netscape</name>
	<name>ja-netscape7</name>
	<name>linux-netscape</name>
	<name>linux-phoenix</name>
	<name>mozilla+ipv6</name>
	<name>mozilla-embedded</name>
	<name>mozilla-firebird</name>
	<name>mozilla-gtk1</name>
	<name>mozilla-gtk2</name>
	<name>mozilla-gtk</name>
	<name>mozilla-thunderbird</name>
	<name>phoenix</name>
	<name>pt_BR-netscape7</name>
	<range><ge>0</ge></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A Mozilla Foundation Security Advisory states:</p>
	<blockquote cite="http://www.mozilla.org/security/announce/mfsa2005-31.html">
	  <p>An <em>(sic)</em> GIF processing error when parsing the
	    obsolete Netscape extension 2 can lead to an exploitable
	    heap overrun, allowing an attacker to run arbitrary code on
	    the user's machine.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-0399</cvename>
      <url>http://www.mozilla.org/security/announce/mfsa2005-30.html</url>
      <url>http://xforce.iss.net/xforce/alerts/id/191</url>
      <url>https://bugzilla.mozilla.org/show_bug.cgi?id=285595</url>
    </references>
    <dates>
      <discovery>2005-03-10</discovery>
      <entry>2005-03-24</entry>
    </dates>
  </vuln>

  <vuln vid="f8536143-9bc4-11d9-b8b3-000a95bc6fae">
    <topic>sylpheed -- buffer overflow in header processing</topic>
    <affects>
      <package>
	<name>sylpheed</name>
	<name>sylpheed-claws</name>
	<name>sylpheed-gtk2</name>
	<range><ge>0.8.*</ge><lt>1.0.3</lt></range>
	<range><ge>1.9.*</ge><lt>1.9.5</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Sylpheed web site states:</p>
	<blockquote cite="http://sylpheed.good-day.net/index.cgi.en#changes">
	  <p>A buffer overflow which occurred when replying to a
	  message with certain headers which contain non-ascii
	  characters was fixed.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-0667</cvename>
      <url>http://sylpheed.good-day.net/index.cgi.en#changes</url>
    </references>
    <dates>
      <discovery>2005-03-07</discovery>
      <entry>2005-03-23</entry>
    </dates>
  </vuln>

  <vuln vid="a4bd3039-9a48-11d9-a256-0001020eed82">
    <topic>xv -- filename handling format string vulnerability</topic>
    <affects>
      <package>
	<name>xv</name>
	<name>ja-xv</name>
	<range><lt>3.10a_5</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A Gentoo Linux Security Advisory reports:</p>
	<blockquote cite="http://www.gentoo.org/security/en/glsa/glsa-200503-09.xml">
	  <p>Tavis Ormandy of the Gentoo Linux Security Audit Team
	    identified a flaw in the handling of image filenames by xv.</p>
	  <p>Successful exploitation would require a victim to process
	    a specially crafted image with a malformed filename,
	    potentially resulting in the execution of arbitrary code.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-0665</cvename>
      <url>http://www.gentoo.org/security/en/glsa/glsa-200503-09.xml</url>
    </references>
    <dates>
      <discovery>2005-03-01</discovery>
      <entry>2005-03-21</entry>
    </dates>
  </vuln>

  <vuln vid="972697a7-9a42-11d9-a256-0001020eed82">
    <topic>kdelibs -- local DCOP denial of service vulnerability</topic>
    <affects>
      <package>
	<name>ja-kdelibs</name>
	<name>kdelibs-nocups</name>
	<name>kdelibs</name>
	<range><lt>3.4.0</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A KDE Security Advisory reports:</p>
	<blockquote cite="http://www.kde.org/info/security/advisory-20050316-1.txt">
	  <p>Sebastian Krahmer of the SUSE LINUX Security Team
	    reported a local denial of service vulnerability in KDE's
	    Desktop Communication Protocol (DCOP) daemon better known
	    as dcopserver.</p>
	  <p>A local user can lock up the dcopserver of arbitrary
	    other users on the same machine. This can cause a
	    significant reduction in desktop functionality for the
	    affected users including, but not limited to, the
	    inability to browse the internet and the inability to
	    start new applications.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-0396</cvename>
      <url>http://www.kde.org/info/security/advisory-20050316-1.txt</url>
    </references>
    <dates>
      <discovery>2005-03-16</discovery>
      <entry>2005-03-21</entry>
    </dates>
  </vuln>

  <vuln vid="6192ae3d-9595-11d9-a9e0-0001020eed82">
    <topic>phpmyadmin -- increased privilege vulnerability</topic>
    <affects>
      <package>
	<name>phpmyadmin</name>
	<name>phpMyAdmin</name>
	<range><lt>2.6.1.3</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The phpMyAdmin team reports:</p>
	<blockquote cite="http://sourceforge.net/forum/forum.php?forum_id=450948">
	  <p>Escaping of the "_" character was not properly done,
	    giving a wildcard privilege when editing db-specific
	    privileges with phpMyAdmin.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-0653</cvename>
      <url>http://sourceforge.net/forum/forum.php?forum_id=450948</url>
      <url>http://sourceforge.net/tracker/index.php?func=detail&amp;aid=1113788&amp;group_id=23067&amp;atid=377408</url>
    </references>
    <dates>
      <discovery>2005-02-01</discovery>
      <entry>2005-03-15</entry>
    </dates>
  </vuln>

  <vuln vid="cb470368-94d2-11d9-a9e0-0001020eed82">
    <topic>ethereal -- multiple protocol dissectors vulnerabilities</topic>
    <affects>
      <package>
	<name>ethereal</name>
	<name>ethereal-lite</name>
	<name>tethereal</name>
	<name>tethereal-lite</name>
	<range><ge>0.9.1</ge><lt>0.10.10</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>An Ethreal Security Advisories reports:</p>
	<blockquote cite="http://www.ethereal.com/appnotes/enpa-sa-00018.html">
	  <p>Issues have been discovered in the following protocol
	    dissectors:</p>
	  <ul>
	    <li>Matevz Pustisek discovered a buffer overflow in the
	      Etheric dissector. CVE: CAN-2005-0704</li>
	    <li>The GPRS-LLC dissector could crash if the "ignore
	      cipher bit" option was enabled. CVE: CAN-2005-0705</li>
	    <li>Diego Giago discovered a buffer overflow in the 3GPP2
	      A11 dissector. This flaw was later reported by Leon
	      Juranic. CVE: CAN-2005-0699</li>
	    <li>Leon Juranic discovered a buffer overflow in the IAPP dissector.
	      CVE: CAN-2005-0739</li>
	    <li>A bug in the JXTA dissector could make Ethereal crash.</li>
	    <li>A bug in the sFlow dissector could make Ethereal crash.</li>
	  </ul>
	</blockquote>
      </body>
    </description>
    <references>
      <bid>12759</bid>
      <cvename>CVE-2005-0699</cvename>
      <cvename>CVE-2005-0704</cvename>
      <cvename>CVE-2005-0705</cvename>
      <cvename>CVE-2005-0739</cvename>
      <url>http://www.ethereal.com/appnotes/enpa-sa-00018.html</url>
    </references>
    <dates>
      <discovery>2005-03-09</discovery>
      <entry>2005-03-14</entry>
      <modified>2005-06-24</modified>
    </dates>
  </vuln>

  <vuln vid="bcf27002-94c3-11d9-a9e0-0001020eed82">
    <topic>grip -- CDDB response multiple matches buffer overflow vulnerability</topic>
    <affects>
      <package>
	<name>grip</name>
	<range><lt>3.2.0_7</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Joseph VanAndel reports that grip is vulnerability to a
	  buffer overflow vulnerability when receiving more than 16
	  CDDB responses.  This could lead to a crash in grip and
	  potentially execution arbitrary code.</p>
	<p>A workaround is to disable CDDB lookups.</p>
      </body>
    </description>
    <references>
      <bid>12770</bid>
      <cvename>CVE-2005-0706</cvename>
      <url>http://sourceforge.net/tracker/index.php?func=detail&amp;aid=834724&amp;group_id=3714&amp;atid=103714</url>
    </references>
    <dates>
      <discovery>2003-11-02</discovery>
      <entry>2005-03-14</entry>
      <modified>2005-03-18</modified>
    </dates>
  </vuln>

  <vuln vid="619ef337-949a-11d9-b813-00d05964249f">
    <topic>mysql-server -- multiple remote vulnerabilities</topic>
    <affects>
      <package>
	<name>mysql-server</name>
	<range><ge>4.0.0</ge><lt>4.0.24</lt></range>
	<range><ge>4.1.0</ge><lt>4.1.10a</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>SecurityFocus reports:</p>
	<blockquote cite="http://www.securityfocus.com/bid/12781/discussion/">
	  <p>MySQL is reported prone to an insecure temporary file creation
	    vulnerability.</p>
	  <p>Reports indicate that an attacker that has 'CREATE TEMPORARY TABLE'
	    privileges on an affected installation may leverage this
	    vulnerability to corrupt files with the privileges of the MySQL
	    process.</p>
	  <p>MySQL is reported prone to an input validation vulnerability that
	    can be exploited by remote users that have INSERT and DELETE
	    privileges on the 'mysql' administrative database.</p>
	  <p>Reports indicate that this issue may be leveraged to load an
	    execute a malicious library in the context of the MySQL process.</p>
	  <p>Finally, MySQL is reported prone to a remote arbitrary code
	    execution vulnerability. It is reported that the vulnerability may
	    be triggered by employing the 'CREATE FUNCTION' statement to
	    manipulate functions in order to control sensitive data
	    structures.</p>
	  <p>This issue may be exploited to execute arbitrary code in the
	    context of the database process.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <bid>12781</bid>
      <cvename>CVE-2005-0709</cvename>
      <cvename>CVE-2005-0710</cvename>
      <cvename>CVE-2005-0711</cvename>
    </references>
    <dates>
      <discovery>2005-03-11</discovery>
      <entry>2005-03-14</entry>
    </dates>
  </vuln>

  <vuln vid="d4bd4046-93a6-11d9-8378-000bdb1444a4">
    <topic>rxvt-unicode -- buffer overflow vulnerability</topic>
    <affects>
      <package>
	<name>rxvt-unicode</name>
	<range><lt>5.3</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A rxvt-unicode changelog reports:</p>
	<blockquote cite="http://dist.schmorp.de/rxvt-unicode/Changes">
	  <p>Fix a bug that allowed to overflow a buffer via a long
	    escape sequence, which is probably exploitable (fix by
	    Rob Holland / Yoann Vandoorselaere / Gentoo Audit Team).</p>
	</blockquote>
      </body>
    </description>
    <references>
      <url>http://dist.schmorp.de/rxvt-unicode/Changes</url>
    </references>
    <dates>
      <discovery>2005-03-13</discovery>
      <entry>2005-03-13</entry>
    </dates>
  </vuln>

  <vuln vid="a7062952-9023-11d9-a22c-0001020eed82">
    <topic>phpmyadmin -- information disclosure vulnerability</topic>
    <affects>
      <package>
	<name>phpmyadmin</name>
	<name>phpMyAdmin</name>
	<range><lt>2.6.1.2</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A phpMyAdmin security announcement reports:</p>
	<blockquote cite="http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-2">
	  <p>By calling some scripts that are part of phpMyAdmin in an
	    unexpected way (especially scripts in the libraries
	    subdirectory), it is possible to trigger phpMyAdmin to
	    display a PHP error message which contains the full path
	    of the directory where phpMyAdmin is installed.</p>
	  <p><strong>Mitigation factor:</strong> This path disclosure
	    is possible on servers where the recommended setting of
	    the PHP configuration directive
	    <code>display_errors</code> is set to on, which is against
	    the recommendations given in the PHP manual.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-0544</cvename>
      <url>http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-2</url>
    </references>
    <dates>
      <discovery>2005-02-22</discovery>
      <entry>2005-03-08</entry>
    </dates>
  </vuln>

  <vuln vid="882ef43b-901f-11d9-a22c-0001020eed82">
    <topic>phpmyadmin -- arbitrary file include and XSS vulnerabilities</topic>
    <affects>
      <package>
	<name>phpmyadmin</name>
	<name>phpMyAdmin</name>
	<range><gt>1.3.1</gt><lt>2.6.1.2</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A phpMyAdmin security announcement reports:</p>
	<blockquote cite="http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-1">
	  <p>We received two bug reports by Maksymilian Arciemowicz
	    about those vulnerabilities and we wish to thank him for
	    his work.  The vulnerabilities apply to those points:</p>
	  <ol>
	    <li>css/phpmyadmin.css.php was vulnerable against
	      <code>$cfg</code> and <code>GLOBALS</code> variable
	      injections. This way, a possible attacker could
	      manipulate any configuration parameter. Using
	      phpMyAdmin's theming mechanism, he was able to include
	      arbitrary files. This is especially dangerous if php is
	      not running in safe mode.</li>
	    <li>A possible attacker could manipulate phpMyAdmin's
	      localized strings via the URL and inject harmful
	      JavaScript code this way, which could be used for XSS
	      attacks.</li>
	  </ol>
	</blockquote>
      </body>
    </description>
    <references>
      <bid>12644</bid>
      <bid>12645</bid>
      <cvename>CVE-2005-0543</cvename>
      <cvename>CVE-2005-0567</cvename>
      <mlist msgid="20050224190307.20197.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110929725801154</mlist>
      <url>http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-1</url>
    </references>
    <dates>
      <discovery>2005-02-21</discovery>
      <entry>2005-03-08</entry>
    </dates>
  </vuln>

  <vuln vid="624fe633-9006-11d9-a22c-0001020eed82">
    <topic>libexif -- buffer overflow vulnerability</topic>
    <affects>
      <package>
	<name>libexif</name>
	<range><lt>0.6.10_1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Sylvain Defresne reports that libexif is vulnerable to a
	  buffer overflow vulnerability due to insufficient input
	  checking.  This could lead crash of applications using
	  libexif.</p>
      </body>
    </description>
    <references>
      <bid>12744</bid>
      <cvename>CVE-2005-0664</cvename>
      <url>https://bugzilla.ubuntulinux.org/show_bug.cgi?id=7152</url>
    </references>
    <dates>
      <discovery>2005-03-03</discovery>
      <entry>2005-03-08</entry>
    </dates>
  </vuln>

  <vuln vid="4a0b334d-8d8d-11d9-afa0-003048705d5a">
    <topic>phpbb -- Insuffient check against HTML code in usercp_register.php</topic>
    <affects>
      <package>
	<name>phpbb</name>
	<range><le>2.0.13</le></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Neo Security Team reports:</p>
	<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110987231502274">
	  <p>If we specify a variable in the html code (any type:
	    hidden, text, radio, check, etc) with the name allowhtml,
	    allowbbcode or allowsmilies, is going to be on the html,
	    bbcode and smilies in our signature.</p>
	</blockquote>
	<p>This is a low risk vulnerability that allows users to bypass
	  forum-wide configuration.</p>
      </body>
    </description>
    <references>
      <mlist msgid="20050303055339.3109.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110987231502274</mlist>
      <mlist msgid="38599.166.68.134.174.1109875231.squirrel@166.68.134.174">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110988400407204</mlist>
    </references>
    <dates>
      <discovery>2005-02-28</discovery>
      <entry>2005-03-05</entry>
      <modified>2005-03-07</modified>
    </dates>
  </vuln>

  <vuln vid="f3eec2b5-8cd8-11d9-8066-000a95bc6fae">
    <topic>postnuke -- SQL injection vulnerabilities</topic>
    <affects>
      <package>
	<name>postnuke</name>
	<range><lt>0.760</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Two separate SQL injection vulnerabilities have been
	   identified in the PostNuke PHP content management
	   system. An attacker can use this vulnerability to
	   potentially insert executable PHP code into the content
	   management system (to view all files within the PHP scope,
	   for instance). Various other SQL injection vulnerabilities
	   exist, which give attackers the ability to run SQL queries
	   on any tables within the database.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-0617</cvename>
      <cvename>CVE-2005-0615</cvename>
      <mlist>http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110962710805864</mlist>
      <mlist>http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110962819232255</mlist>
      <url>http://news.postnuke.com/Article2669.html</url>
    </references>
    <dates>
      <discovery>2005-02-28</discovery>
      <entry>2005-03-04</entry>
    </dates>
  </vuln>

  <vuln vid="7e580822-8cd8-11d9-8c81-000a95bc6fae">
    <topic>postnuke -- cross-site scripting (XSS) vulnerabilities</topic>
    <affects>
      <package>
	<name>postnuke</name>
	<range><lt>0.760</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A cross-site scripting vulnerability is present in the
	   PostNuke PHP content management system. By passing data
	   injected through exploitable errors in input validation, an
	   attacker can insert code which will run on the machine of
	   anybody viewing the page. It is feasible that this attack
	   could be used to retrieve session information from cookies,
	   thereby allowing the attacker to gain administrative access
	   to the CMS.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-0616</cvename>
      <mlist>http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110962768300373</mlist>
      <url>http://news.postnuke.com/Article2669.html</url>
    </references>
    <dates>
      <discovery>2005-02-28</discovery>
      <entry>2005-03-04</entry>
    </dates>
  </vuln>

  <vuln vid="c73305ae-8cd7-11d9-9873-000a95bc6fae">
     <topic>realplayer -- remote heap overflow</topic>
    <affects>
      <package>
	<name>linux-realplayer</name>
	<range><le>10.0.2</le></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Two exploits have been identified in the Linux RealPlayer client.
	   RealNetworks states:</p>
	<blockquote cite="http://service.real.com/help/faq/security/050224_player/EN/">
	  <p>RealNetworks, Inc. has addressed recently discovered
	     security vulnerabilities that offered the potential for
	     an attacker to run arbitrary or malicious code on a
	     customer's machine. RealNetworks has received no reports
	     of machines compromised as a result of the now-remedied
	     vulnerabilities. RealNetworks takes all security
	     vulnerabilities very seriously.</p>
	  <p>The specific exploits were:</p>
	  <ul>
	    <li><strong>Exploit 1:</strong> To fashion a malicious WAV
	      file to cause a buffer overflow which could have allowed
	      an attacker to execute arbitrary code on a customer's
	      machine.</li>
	    <li><strong>Exploit 2:</strong> To fashion a malicious
	      SMIL file to cause a buffer overflow which could have
	      allowed an attacker to execute arbitrary code on a
	      customer's machine.</li>
	  </ul>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-0611</cvename>
      <mlist>http://marc.theaimsgroup.com/?l=vulnwatch&amp;m=110977858619314</mlist>
      <url>http://service.real.com/help/faq/security/050224_player/EN/</url>
    </references>
    <dates>
      <discovery>2005-03-01</discovery>
      <entry>2005-03-04</entry>
    </dates>
  </vuln>

  <vuln vid="713c3913-8c2b-11d9-b58c-0001020eed82">
    <topic>ImageMagick -- format string vulnerability</topic>
    <affects>
      <package>
	<name>ImageMagick</name>
	<name>ImageMagick-nox11</name>
	<range><lt>6.2.0.3</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Tavis Ormandy reports:</p>
	<blockquote>
	  <p>magemagick-6.2.0-3 fixes an potential issue handling
	    malformed filenames, the flaw may affect webapps or
	    scripts that use the imagemagick utilities for image
	    processing, or applications linked with libMagick.</p>
	</blockquote>
	<p>This vulnerability could crash ImageMagick or potentially
	  lead to the execution of arbitrary code with the permissions
	  of the user running ImageMagick.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-0397</cvename>
      <url>http://www.ubuntulinux.org/support/documentation/usn/usn-90-1</url>
    </references>
    <dates>
      <discovery>2005-03-02</discovery>
      <entry>2005-03-03</entry>
    </dates>
  </vuln>

  <vuln vid="fb03b1c6-8a8a-11d9-81f7-02023f003c9f">
    <topic>uim -- privilege escalation vulnerability</topic>
    <affects>
      <package>
	<name>ja-uim</name>
	<range><lt>0.4.6</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The uim developers reports:</p>
	<blockquote cite="http://lists.freedesktop.org/pipermail/uim/2005-February/000996.html">
	  <p>Takumi ASAKI discovered that uim always trusts environment
	    variables.	But this is not correct behavior, sometimes environment
	    variables shouldn't be trusted. This bug causes privilege escalation
	    when libuim is linked against setuid/setgid application. Since GTK+
	    prohibits setuid/setgid applications, the bug appears only in
	    'immodule for Qt' enabled Qt. (Normal Qt is also safe.)</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-0503</cvename>
      <mlist>http://lists.freedesktop.org/pipermail/uim/2005-February/000996.html</mlist>
      <bid>12604</bid>
      <url>http://secunia.com/advisories/13981</url>
    </references>
    <dates>
      <discovery>2005-02-21</discovery>
      <entry>2005-03-01</entry>
    </dates>
  </vuln>

  <vuln vid="bdad9ada-8a52-11d9-9e53-000a95bc6fae">
    <topic>lighttpd -- script source disclosure vulnerability</topic>
    <affects>
      <package>
	<name>lighttpd</name>
	<range><lt>1.3.8</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The lighttpd website reports:</p>
	<blockquote cite="http://article.gmane.org/gmane.comp.web.lighttpd/1171">
	  <p>In lighttpd 1.3.7 and below it is possible to fetch the source
	    files which should be handled by CGI or FastCGI applications.</p>
	</blockquote>
	<p>The vulnerability is in the handling of urlencoded trailing
	  NUL bytes.  Installations that do not use CGI or FastCGI are
	  not affected.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-0453</cvename>
      <mlist>http://article.gmane.org/gmane.comp.web.lighttpd/1171</mlist>
      <url>http://www.lighttpd.net/news/</url>
      <url>http://xforce.iss.net/xforce/xfdb/19350</url>
      <bid>12567</bid>
    </references>
    <dates>
      <discovery>2005-02-12</discovery>
      <entry>2005-03-01</entry>
    </dates>
  </vuln>

  <vuln vid="53e711ed-8972-11d9-9ff8-00306e01dda2">
    <topic>phpbb -- privilege elevation and path disclosure</topic>
    <affects>
      <package>
	<name>phpbb</name>
	<range><lt>2.0.13</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The phpbb developer group reports:</p>
	<blockquote cite="http://www.phpbb.com/phpBB/viewtopic.php?t=267563">
	  <p>phpBB Group announces the release of phpBB 2.0.13, the
	    "Beware of the furries" edition. This release addresses two
	    recent security exploits, one of them critical. They were
	    reported a few days after .12 was released and no one is
	    more annoyed than us, having to release a new version ini
	    such a short period of time. Fortunately both fixes are
	    easy and in each case just one line needs to be edited.</p>
	</blockquote>
      </body>
    </description>
    <references>
	<url>http://www.phpbb.com/phpBB/viewtopic.php?t=267563</url>
	<bid>12678</bid>
    </references>
    <dates>
      <discovery>2005-02-27</discovery>
      <entry>2005-02-28</entry>
      <modified>2005-03-05</modified>
    </dates>
  </vuln>

  <vuln vid="96df5fd0-8900-11d9-aa18-0001020eed82">
    <topic>curl -- authentication buffer overflow vulnerability</topic>
    <affects>
      <package>
	<name>curl</name>
	<range><lt>7.13.1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Two iDEFENSE Security Advisories reports:</p>
	<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110902601221592">
	  <p>An exploitable stack-based buffer overflow condition
	    exists when using NT Lan Manager (NTLM)
	    authentication. The problem specifically exists within
	    <code>Curl_input_ntlm()</code> defined in
	    lib/http_ntlm.c.</p>
	  <p>Successful exploitation allows remote attackers to
	    execute arbitrary code under the privileges of the target
	    user. Exploitation requires that an attacker either coerce
	    or force a target to connect to a malicious server using
	    NTLM authentication.</p>
	</blockquote>
	<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110902850731457">
	  <p>An exploitable stack-based buffer overflow condition
	    exists when using Kerberos authentication. The problem
	    specifically exists within the functions
	    <code>Curl_krb_kauth()</code> and <code>krb4_auth()</code>
	    defined in lib/krb4.c.</p>
	  <p>Successful exploitation allows remote attackers to
	    execute arbitrary code under the privileges of the target
	    user. Exploitation requires that an attacker either coerce
	    or force a target to connect to a malicious server using
	    Kerberos authentication.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <bid>12615</bid>
      <bid>12616</bid>
      <cvename>CVE-2005-0490</cvename>
      <mlist msgid="FB24803D1DF2A34FA59FC157B77C970503E2462D@idserv04.idef.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110902850731457</mlist>
      <mlist msgid="FB24803D1DF2A34FA59FC157B77C970503E2462E@idserv04.idef.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110902601221592</mlist>
    </references>
    <dates>
      <discovery>2004-12-21</discovery>
      <entry>2005-02-27</entry>
    </dates>
  </vuln>

  <vuln vid="b2d248ad-88f6-11d9-aa18-0001020eed82">
    <topic>cyrus-imapd -- multiple buffer overflow vulnerabilities</topic>
    <affects>
      <package>
	<name>cyrus-imapd</name>
	<range><lt>2.1.18</lt></range>
	<range><gt>2.2.*</gt><lt>2.2.11</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Cyrus IMAP Server ChangeLog states:</p>
	<blockquote cite="http://asg.web.cmu.edu/cyrus/download/imapd/changes.html">
	  <ul>
	    <li>Fix possible single byte overflow in mailbox handling
	      code.</li>
	    <li>Fix possible single byte overflows in the imapd
	      annotate extension.</li>
	    <li>Fix stack buffer overflows in fetchnews (exploitable
	      by peer news server), backend (exploitable by admin),
	      and in imapd (exploitable by users though only on
	      platforms where a filename may be larger than a mailbox
	      name).</li>
	  </ul>
	</blockquote>
	<p>The 2.1.X series are reportedly only affected by the second
	  issue.</p>
	<p>These issues may lead to execution of arbitrary code with
	  the permissions of the user running the Cyrus IMAP
	  Server.</p>
      </body>
    </description>
    <references>
      <bid>12636</bid>
      <cvename>CVE-2005-0546</cvename>
      <url>http://asg.web.cmu.edu/cyrus/download/imapd/changes.html</url>
    </references>
    <dates>
      <discovery>2005-02-14</discovery>
      <entry>2005-02-27</entry>
      <modified>2005-04-05</modified>
    </dates>
  </vuln>

  <vuln vid="2c5757f4-88bf-11d9-8720-0007e900f87b">
    <topic>sup -- format string vulnerability</topic>
    <affects>
      <package>
	<name>sup</name>
	<range><lt>2.0.20050226</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Debian Security Advisory reports:</p>
	<blockquote cite="http://www.securityfocus.com/advisories/6874">
	  <p>jaguar@felinemenace.org discovered a format string
	    vulnerability in sup, a set of programs to synchronize
	    collections of files across a number of machines,
	    whereby a remote attacker could potentially cause
	    arbitrary code to be executed with the privileges
	    of the supfilesrv process (this process does not run
	    automatically by default).</p>
	</blockquote>
      </body>
    </description>
    <references>
      <bid>10571</bid>
      <cvename>CVE-2004-0451</cvename>
      <url>http://www.securityfocus.com/advisories/6874</url>
    </references>
    <dates>
      <discovery>2004-06-19</discovery>
      <entry>2005-02-27</entry>
    </dates>
  </vuln>

  <vuln vid="d022754d-8839-11d9-aa18-0001020eed82">
    <topic>mozilla -- insecure temporary directory vulnerability</topic>
    <affects>
      <package>
	<name>firefox</name>
	<range><lt>1.0.1,1</lt></range>
      </package>
      <package>
	<name>mozilla</name>
	<range><lt>1.7.6,2</lt></range>
      </package>
      <package>
	<name>linux-mozilla</name>
	<name>linux-mozilla-devel</name>
	<range><lt>1.7.6</lt></range>
      </package>
      <package>
	<name>netscape7</name>
	<range><ge>0</ge></range>
      </package>
      <package>
	<!-- These ports are obsolete. -->
	<name>de-linux-mozillafirebird</name>
	<name>el-linux-mozillafirebird</name>
	<name>ja-linux-mozillafirebird-gtk1</name>
	<name>ja-mozillafirebird-gtk2</name>
	<name>linux-mozillafirebird</name>
	<name>ru-linux-mozillafirebird</name>
	<name>zhCN-linux-mozillafirebird</name>
	<name>zhTW-linux-mozillafirebird</name>
	<range><ge>0</ge></range>
      </package>
      <package>
	<!-- These package names are obsolete. -->
	<name>de-linux-netscape</name>
	<name>de-netscape7</name>
	<name>fr-linux-netscape</name>
	<name>fr-netscape7</name>
	<name>ja-linux-netscape</name>
	<name>ja-netscape7</name>
	<name>linux-netscape</name>
	<name>linux-phoenix</name>
	<name>mozilla+ipv6</name>
	<name>mozilla-embedded</name>
	<name>mozilla-firebird</name>
	<name>mozilla-gtk1</name>
	<name>mozilla-gtk2</name>
	<name>mozilla-gtk</name>
	<name>mozilla-thunderbird</name>
	<name>phoenix</name>
	<name>pt_BR-netscape7</name>
	<range><ge>0</ge></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A Mozilla Foundation Security Advisory reports:</p>
	<blockquote cite="http://www.mozilla.org/security/announce/mfsa2005-28.html">
	  <p>A predictable name is used for the plugin temporary
	    directory. A malicious local user could symlink this to
	    the victim's home directory and wait for the victim to run
	    Firefox. When Firefox shuts down the victim's directory
	    would be erased.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <url>http://www.mozilla.org/security/announce/mfsa2005-28.html</url>
      <url>https://bugzilla.mozilla.org/show_bug.cgi?id=281284</url>
    </references>
    <dates>
      <discovery>2005-02-06</discovery>
      <entry>2005-02-26</entry>
    </dates>
  </vuln>

  <vuln vid="cbfde1cd-87eb-11d9-aa18-0001020eed82">
    <topic>mozilla -- arbitrary code execution vulnerability</topic>
    <affects>
      <package>
	<name>firefox</name>
	<range><lt>1.0.1,1</lt></range>
      </package>
      <package>
	<name>mozilla</name>
	<range><lt>1.7.6,2</lt></range>
      </package>
      <package>
	<name>linux-mozilla</name>
	<name>linux-mozilla-devel</name>
	<range><lt>1.7.6</lt></range>
      </package>
      <package>
	<name>netscape7</name>
	<range><ge>0</ge></range>
      </package>
      <package>
	<!-- These ports are obsolete. -->
	<name>de-linux-mozillafirebird</name>
	<name>el-linux-mozillafirebird</name>
	<name>ja-linux-mozillafirebird-gtk1</name>
	<name>ja-mozillafirebird-gtk2</name>
	<name>linux-mozillafirebird</name>
	<name>ru-linux-mozillafirebird</name>
	<name>zhCN-linux-mozillafirebird</name>
	<name>zhTW-linux-mozillafirebird</name>
	<range><ge>0</ge></range>
      </package>
      <package>
	<!-- These package names are obsolete. -->
	<name>de-linux-netscape</name>
	<name>de-netscape7</name>
	<name>fr-linux-netscape</name>
	<name>fr-netscape7</name>
	<name>ja-linux-netscape</name>
	<name>ja-netscape7</name>
	<name>linux-netscape</name>
	<name>linux-phoenix</name>
	<name>mozilla+ipv6</name>
	<name>mozilla-embedded</name>
	<name>mozilla-firebird</name>
	<name>mozilla-gtk1</name>
	<name>mozilla-gtk2</name>
	<name>mozilla-gtk</name>
	<name>mozilla-thunderbird</name>
	<name>phoenix</name>
	<name>pt_BR-netscape7</name>
	<range><ge>0</ge></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A Mozilla Foundation Security Advisory reports:</p>
	<blockquote cite="http://www.mozilla.org/security/announce/mfsa2005-27.html">
	  <p>Plugins (such as flash) can be used to load privileged
	    content into a frame. Once loaded various spoofs can be
	    applied to get the user to interact with the privileged
	    content. Michael Krax's "Fireflashing" example
	    demonstrates that an attacker can open about:config in a
	    frame, hide it with an opacity setting, and if the
	    attacker can get the victim to click at a particular spot
	    (design some kind of simple game) you could toggle boolean
	    preferences, some of which would make further attacks
	    easier.</p>
	  <p>The "firescrolling" example demonstrates arbitrary code
	    execution (in this case downloading a file) by convincing
	    the user to scroll twice.</p>
	</blockquote>
	<p><strong>Workaround:</strong> Disable JavaScript.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-0527</cvename>
      <url>http://www.mikx.de/fireflashing/</url>
      <url>http://www.mikx.de/firescrolling/</url>
      <url>http://www.mozilla.org/security/announce/mfsa2005-27.html</url>
    </references>
    <dates>
      <discovery>2005-02-24</discovery>
      <entry>2005-02-26</entry>
    </dates>
  </vuln>

  <vuln vid="32d4f0f1-85c3-11d9-b6dc-0007e900f747">
    <topic>mkbold-mkitalic -- format string vulnerability</topic>
    <affects>
      <package>
	<name>mkbold-mkitalic</name>
	<range><lt>0.07</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The version 0.06_1 and prior
	  have a format string vulnerability which can be triggered
	  by using a carefully-crafted BDF font file.</p>
      </body>
    </description>
    <references>
      <url>http://home.jp.FreeBSD.org/cgi-bin/showmail/ports-jp/15568</url>
    </references>
    <dates>
      <discovery>2005-02-23</discovery>
      <entry>2005-02-24</entry>
    </dates>
  </vuln>

  <vuln vid="03653079-8594-11d9-afa0-003048705d5a">
    <topic>phpbb -- multiple information disclosure vulnerabilities</topic>
    <affects>
      <package>
	<name>phpbb</name>
	<range><lt>2.0.12</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>psoTFX reports:</p>
	<blockquote cite="http://www.phpbb.com/phpBB/viewtopic.php?f=14&amp;t=265423">
	  <p>phpBB Group are pleased to announce the release of phpBB
	    2.0.12 the "Horray for Furrywood" release. This release
	    addresses a number of bugs and a couple of potential
	    exploits.  [...] one of the potential exploits addressed
	    in this release could be serious in certain situations and
	    thus we urge all users, as always, to upgrade to this
	    release as soon as possible. Mostly this release is
	    concerned with eliminating disclosures of information
	    which while useful in debug situations may allow third
	    parties to gain information which could be used to do harm
	    via unknown or unfixed exploits in this or other
	    applications.</p>
	</blockquote>
	<p>The ChangeLog for phpBB 2.0.12 states:</p>
	<blockquote cite="http://www.phpbb.com/support/documents.php?mode=changelog">
	  <ul>
	    <li>Prevented full path display on critical messages</li>
	    <li>Fixed full path disclosure in username handling caused
	      by a PHP 4.3.10 bug - <strong>AnthraX101</strong></li>
	    <li>Added exclude list to unsetting globals (if
	      register_globals is on) -
	      <strong>SpoofedExistence</strong></li>
	    <li>Fixed arbitrary file disclosure vulnerability in avatar
	      handling functions - <strong>AnthraX101</strong></li>
	    <li>Fixed arbitrary file unlink vulnerability in avatar
	      handling functions - <strong>AnthraX101</strong></li>
	    <li>Fixed path disclosure bug in search.php caused by a
	      PHP 4.3.10 bug (related to AnthraX101's discovery)</li>
	    <li>Fixed path disclosure bug in viewtopic.php caused by
	      a PHP 4.3.10 bug - <strong>matrix_killer</strong></li>
	  </ul>
	</blockquote>
      </body>
    </description>
    <references>
      <url>http://www.phpbb.com/support/documents.php?mode=changelog</url>
      <url>http://www.phpbb.com/phpBB/viewtopic.php?f=14&amp;t=265423</url>
      <freebsdpr>ports/77943</freebsdpr>
    </references>
    <dates>
      <discovery>2005-02-22</discovery>
      <entry>2005-02-23</entry>
      <modified>2005-02-25</modified>
    </dates>
  </vuln>

  <vuln vid="1d3a2737-7eb7-11d9-acf7-000854d03344">
    <topic>unace -- multiple vulnerabilities</topic>
    <affects>
      <package>
	<name>unace</name>
	<range><lt>1.2b_2</lt></range>
      </package>
      <package>
	<name>linux-unace</name>
	<range><gt>0</gt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Ulf Härnhammar reports:</p>
	<ul>
	  <li>There are buffer overflows when extracting, testing or
	    listing specially prepared ACE archives.</li>
	  <li>There are directory traversal bugs when extracting ACE
	    archives.</li>
	  <li>There are also buffer overflows when dealing with long
	    (&gt;17000 characters) command line arguments.</li>
	</ul>
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/14359/">
	  <p>The vulnerabilities have been confirmed in version 1.2b.
	    One of the buffer overflow vulnerabilities have also been
	    reported in version 2.04, 2.2 and 2.5. Other versions may
	    also be affected.</p>
	  <p>Successful exploitation may allow execution of arbitrary
	    code.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <certvu>215006</certvu>
      <cvename>CVE-2005-0160</cvename>
      <cvename>CVE-2005-0161</cvename>
      <mlist msgid="1109113175.421bb95705d42@webmail.uu.se">http://marc.theaimsgroup.com/?l=full-disclosure&amp;m=110911451613135</mlist>
      <url>http://secunia.com/advisories/14359/</url>
    </references>
    <dates>
      <discovery>2005-02-14</discovery>
      <entry>2005-02-22</entry>
      <modified>2006-09-26</modified>
    </dates>
  </vuln>

  <vuln vid="a413ed94-836e-11d9-a9e7-0001020eed82">
    <topic>putty -- pscp/psftp heap corruption vulnerabilities</topic>
    <affects>
      <package>
	<name>putty</name>
	<range><lt>0.57</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Simon Tatham reports:</p>
	<blockquote cite="http://lists.tartarus.org/pipermail/putty-announce/2005/000012.html">
	  <p>This version fixes a security hole in previous versions
	    of PuTTY, which can allow a malicious SFTP server to
	    attack your client. If you use either PSCP or PSFTP, you
	    should upgrade. Users of the main PuTTY program are not
	    affected. (However, note that the server must have passed
	    host key verification before this attack can be launched,
	    so a man-in-the-middle shouldn't be able to attack you if
	    you're careful.)</p>
	</blockquote>
      </body>
    </description>
    <references>
      <bid>12601</bid>
      <cvename>CVE-2005-0467</cvename>
      <mlist msgid="E1D2taM-0005R1-00@ixion.tartarus.org">http://lists.tartarus.org/pipermail/putty-announce/2005/000012.html</mlist>
      <mlist msgid="FB24803D1DF2A34FA59FC157B77C970503E2462F@idserv04.idef.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110902510713763</mlist>
      <url>http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-sftp-readdir.html</url>
      <url>http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-sftp-string.html</url>
    </references>
    <dates>
      <discovery>2005-02-20</discovery>
      <entry>2005-02-20</entry>
      <modified>2005-02-23</modified>
    </dates>
  </vuln>

  <vuln vid="29dd0065-81fa-11d9-a9e7-0001020eed82">
    <topic>kdelibs -- insecure temporary file creation</topic>
    <affects>
      <package>
	<name>kdelibs</name>
	<name>ja-kdelibs</name>
	<range><lt>3.3.2_5</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Davide Madrisan reports:</p>
	<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110814653804757">
	  <p>The `dcopidlng' script in the KDE library package
	    (kdelibs-3.3.2/dcop/dcopidlng/dcopidlng) creates temporary
	    files in a unsecure manner.</p>
	</blockquote>
	<p><strong>Note:</strong> dcopidlng is only used at build
	  time, so only users installing KDE are vulnerable, not users
	  already running KDE.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-0365</cvename>
      <url>http://bugs.kde.org/show_bug.cgi?id=97608</url>
      <mlist msgid="200502110916.48921.davide.madrisan@qilinux.it">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110814653804757</mlist>
    </references>
    <dates>
      <discovery>2005-01-21</discovery>
      <entry>2005-02-18</entry>
      <modified>2005-02-20</modified>
    </dates>
  </vuln>

  <vuln vid="74c86a29-81ef-11d9-a9e7-0001020eed82">
    <topic>bidwatcher -- format string vulnerability</topic>
    <affects>
      <package>
	<name>bidwatcher</name>
	<range><lt>1.3.17</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A Debian Security Advisory reports:</p>
	<blockquote cite="http://www.debian.org/security/2005/dsa-687">
	  <p>Ulf Härnhammer from the Debian Security Audit Project
	    discovered a format string vulnerability in bidwatcher, a
	    tool for watching and bidding on eBay auctions. This
	    problem can be triggered remotely by a web server of eBay,
	    or someone pretending to be eBay, sending certain data
	    back.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <bid>12590</bid>
      <cvename>CVE-2005-0158</cvename>
      <url>http://www.debian.org/security/2005/dsa-687</url>
    </references>
    <dates>
      <discovery>2005-02-18</discovery>
      <entry>2005-02-18</entry>
    </dates>
  </vuln>

  <vuln vid="2d8cf857-81ea-11d9-a9e7-0001020eed82">
    <topic>gftp -- directory traversal vulnerability</topic>
    <affects>
      <package>
	<name>gftp</name>
	<range><lt>2.0.18</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A Debian Security Advisory reports:</p>
	<blockquote cite="http://www.debian.org/security/2005/dsa-686">
	  <p>Albert Puigsech Galicia discovered a directory traversal
	    vulnerability in a proprietary FTP client (CAN-2004-1376)
	    which is also present in gftp, a GTK+ FTP client.  A
	    malicious server could provide a specially crafted
	    filename that could cause arbitrary files to be
	    overwritten or created by the client.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <bid>12539</bid>
      <cvename>CVE-2005-0372</cvename>
      <url>http://www.debian.org/security/2005/dsa-686</url>
      <url>http://www.gftp.org/changelog.html</url>
    </references>
    <dates>
      <discovery>2005-02-04</discovery>
      <entry>2005-02-18</entry>
    </dates>
  </vuln>

  <vuln vid="20c9bb14-81e6-11d9-a9e7-0001020eed82">
    <topic>opera -- "data:" URI handler spoofing vulnerability</topic>
    <affects>
      <package>
	<name>opera</name>
	<name>opera-devel</name>
	<name>linux-opera</name>
	<range><lt>7.54.20050131</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A Secunia Advisory reports:</p>
	<blockquote cite="http://secunia.com/advisories/13818/">
	  <p>Michael Holzt has discovered a vulnerability in Opera,
	    which can be exploited by malicious people to trick users
	    into executing malicious files.</p>
	  <p>The vulnerability is caused due to an error in the
	    processing of "data:" URIs, causing wrong information to
	    be shown in a download dialog. This can be exploited by
	    e.g. a malicious website to trick users into executing a
	    malicious file by supplying a specially crafted "data:"
	    URI.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-0456</cvename>
      <certvu>882926</certvu>
      <url>http://secunia.com/advisories/13818/</url>
      <url>http://www.opera.com/freebsd/changelogs/754u2/</url>
    </references>
    <dates>
      <discovery>2005-01-12</discovery>
      <entry>2005-02-18</entry>
    </dates>
  </vuln>

  <vuln vid="d8e55d65-81d6-11d9-a9e7-0001020eed82">
    <topic>opera -- kfmclient exec command execution vulnerability</topic>
    <affects>
      <package>
	<name>opera</name>
	<name>opera-devel</name>
	<name>linux-opera</name>
	<range><lt>7.54.20050131</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Giovanni Delvecchio reports:</p>
	<blockquote cite="http://www.zone-h.org/advisories/read/id=6503">
	  <p>Opera for linux uses "kfmclient exec" as "Default
	    Application" to handle saved files.  This could be used by
	    malicious remote users to execute arbitrary shell commands
	    on a target system.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2004-1491</cvename>
      <url>http://secunia.com/advisories/13447/</url>
      <url>http://www.opera.com/freebsd/changelogs/754u2/</url>
      <url>http://www.zone-h.org/advisories/read/id=6503</url>
    </references>
    <dates>
      <discovery>2004-12-12</discovery>
      <entry>2005-02-18</entry>
    </dates>
  </vuln>

  <vuln vid="6b4b0b3f-8127-11d9-a9e7-0001020eed82">
    <topic>postgresql -- multiple buffer overflows in PL/PgSQL parser</topic>
    <affects>
      <package>
	<name>postgresql</name>
	<name>postgresql-server</name>
	<name>ja-postgresql</name>
	<range><lt>7.3.9_1</lt></range>
	<range><gt>7.4.*</gt><lt>7.4.7_1</lt></range>
	<range><gt>8.*</gt><lt>8.0.1_1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The PL/PgSQL parser in postgresql is vulnerable to several
	  buffer overflows.  These could be exploited by a remote
	  attacker to execute arbitrary code with the permissions of
	  the postgresql server by running a specially crafted
	  query.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-0247</cvename>
      <url>http://archives.postgresql.org/pgsql-committers/2005-02/msg00049.php</url>
    </references>
    <dates>
      <discovery>2005-02-07</discovery>
      <entry>2005-02-17</entry>
      <modified>2005-02-19</modified>
    </dates>
  </vuln>

  <vuln vid="fdad8a87-7f94-11d9-a9e7-0001020eed82">
    <topic>awstats -- arbitrary command execution</topic>
    <affects>
      <package>
	<name>awstats</name>
	<range><lt>6.4</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Several input validation errors exist in AWStats that allow a
	  remote unauthenticated attacker to execute arbitrary commands
	  with the priviliges of the web server.  These programming
	  errors involve CGI parameters including
	  <code>loadplugin</code>, <code>logfile</code>,
	  <code>pluginmode</code>, <code>update</code>, and possibly
	  others.</p>
	<p>Additionally, the <code>debug</code> and other CGI parameters
	  may be used to cause AWStats to disclose AWStats and system
	  configuration information.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-0362</cvename>
      <cvename>CVE-2005-0363</cvename>
      <cvename>CVE-2005-0435</cvename>
      <cvename>CVE-2005-0436</cvename>
      <cvename>CVE-2005-0437</cvename>
      <cvename>CVE-2005-0438</cvename>
      <bid>12543</bid>
      <bid>12545</bid>
      <mlist msgid="20050214081040.3370.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110840530924124</mlist>
      <url>http://awstats.sourceforge.net/docs/awstats_changelog.txt</url>
      <url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=294488</url>
      <url>http://packetstormsecurity.nl/0501-exploits/AWStatsVulnAnalysis.pdf</url>
    </references>
    <dates>
      <discovery>2005-02-10</discovery>
      <entry>2005-02-16</entry>
      <modified>2005-02-23</modified>
    </dates>
  </vuln>

  <vuln vid="5a5422fd-7e1a-11d9-a9e7-0001020eed82">
    <topic>powerdns -- DoS vulnerability</topic>
    <affects>
      <package>
	<name>powerdns</name>
	<range><lt>2.9.17</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>PowerDNS is vulnerable to a temporary denial-of-service
	  vulnerability that can be triggered using a random stream of
	  bytes.</p>
      </body>
    </description>
    <references>
      <bid>12446</bid>
      <url>http://ds9a.nl/cgi-bin/cvstrac/pdns/tktview?tn=21</url>
      <url>http://doc.powerdns.com/changelog.html#CHANGELOG-2-9-17</url>
    </references>
    <dates>
      <discovery>2004-09-18</discovery>
      <entry>2005-02-14</entry>
    </dates>
  </vuln>

  <vuln vid="3e3c860d-7dae-11d9-a9e7-0001020eed82">
    <topic>emacs -- movemail format string vulnerability</topic>
    <affects>
      <package>
	<name>movemail</name>
	<range><le>1.0</le></range>
      </package>
      <package>
	<name>zh-emacs</name>
	<name>emacs</name>
	<range><lt>20.7_4</lt></range>
	<range><gt>21.*</gt><lt>21.3_4</lt></range>
      </package>
      <package>
	<name>xemacs</name>
	<name>xemacs-mule</name>
	<name>zh-xemacs</name>
	<name>zh-xemacs-mule</name>
	<range><lt>21.4.17</lt></range>
      </package>
      <package>
	<name>xemacs-devel</name>
	<range><lt>21.5.b19,1</lt></range>
      </package>
      <package>
	<name>xemacs-devel-21.5</name>
	<range><eq>b11</eq></range>
      </package>
      <package>
	<name>xemacs-devel-mule</name>
	<range><lt>21.5.b19</lt></range>
      </package>
      <package>
	<name>mule-common</name>
	<name>hanemacs</name>
	<range><gt>0</gt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Max Vozeler discovered several format string
	  vulnerabilities in the movemail utility of Emacs.  They can
	  be exploited when connecting to a malicious POP server and
	  can allow an attacker can execute arbitrary code under the
	  privileges of the user running Emacs.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-0100</cvename>
      <bid>12462</bid>
    </references>
    <dates>
      <discovery>2005-01-31</discovery>
      <entry>2005-02-14</entry>
    </dates>
  </vuln>

  <vuln vid="bc4a7efa-7d9a-11d9-a9e7-0001020eed82">
    <topic>ngircd -- format string vulnerability</topic>
    <affects>
      <package>
	<name>ngircd</name>
	<range><lt>0.8.3</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A No System Group security advisory reports that ngircd is
	  vulnerable to a format string vulnerability in the
	  <code>Log_Resolver()</code> function of log.c, if IDENT
	  support is enabled.  This could allow a remote attacker to
	  execute arbitrary code with the permissions of the ngircd
	  daemon, which is <q>root</q> by default.</p>
	<p><strong>Note:</strong> By default the FreeBSD ngircd port
	  does not enable IDENT support.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-0226</cvename>
      <bid>12434</bid>
      <mlist msgid="20050203020909.21785.qmail@www.securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110746413108183</mlist>
    </references>
    <dates>
      <discovery>2005-02-03</discovery>
      <entry>2005-02-13</entry>
    </dates>
  </vuln>

  <vuln vid="7f6dd1bd-7d99-11d9-a9e7-0001020eed82">
    <topic>ngircd -- buffer overflow vulnerability</topic>
    <affects>
      <package>
	<name>ngircd</name>
	<range><lt>0.8.2</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Florian Westphal discovered a buffer overflow in ngircd
	  which can be used remotely crash the server and possibly
	  execute arbitrary code.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-0199</cvename>
      <bid>12397</bid>
      <mlist>http://arthur.ath.cx/pipermail/ngircd-ml/2005-January/000228.html</mlist>
    </references>
    <dates>
      <discovery>2005-01-26</discovery>
      <entry>2005-02-13</entry>
    </dates>
  </vuln>

  <vuln vid="5192e7ca-7d4f-11d9-a9e7-0001020eed82">
    <topic>mod_python -- information leakage vulnerability</topic>
    <affects>
      <package>
	<name>mod_python</name>
	<range><lt>2.7.11</lt></range>
	<range><gt>3.*</gt><lt>3.1.4</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Mark J Cox reports:</p>
	<blockquote>
	  <p>Graham Dumpleton discovered a flaw which can affect
	    anyone using the publisher handle of the Apache Software
	    Foundation mod_python. The publisher handle lets you
	    publish objects inside modules to make them callable via
	    URL. The flaw allows a carefully crafted URL to obtain
	    extra information that should not be visible (information
	    leak).</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-0088</cvename>
    </references>
    <dates>
      <discovery>2005-01-30</discovery>
      <entry>2005-02-13</entry>
    </dates>
  </vuln>

  <vuln vid="c7ccc33f-7d31-11d9-a9e7-0001020eed82">
    <topic>mailman -- directory traversal vulnerability</topic>
    <affects>
      <package>
	<name>mailman</name>
	<name>ja-mailman</name>
	<range><lt>2.1.5_2</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A directory traversal vulnerability in mailman allow remote
	  attackers to read arbitrary files due to inadequate input
	  sanitizing.  This could, among other things, lead remote
	  attackers to gaining access to the mailman configuration
	  database (which contains subscriber email addresses and
	  passwords) or to the mail archives for private lists.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-0202</cvename>
      <mlist msgid="20050209181502.GA26136@grok.org.uk">http://marc.theaimsgroup.com/?l=full-disclosure&amp;m=110797575304304</mlist>
    </references>
    <dates>
      <discovery>2005-01-02</discovery>
      <entry>2005-02-12</entry>
    </dates>
  </vuln>

  <vuln vid="72da8af6-7c75-11d9-8cc5-000854d03344">
    <topic>enscript -- multiple vulnerabilities</topic>
    <affects>
      <package>
	<name>enscript-a4</name>
	<name>enscript-letter</name>
	<name>enscript-letterdj</name>
	<range><lt>1.6.4_1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Erik Sjölund discovered several issues in enscript:
	  it suffers from several buffer overflows, quotes and shell
	  escape characters are insufficiently sanitized in filenames,
	  and it supported taking input from an arbitrary command
	  pipe, with unwanted side effects.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2004-1184</cvename>
      <cvename>CVE-2004-1185</cvename>
      <cvename>CVE-2004-1186</cvename>
      <url>http://www.gentoo.org/security/en/glsa/glsa-200502-03.xml</url>
    </references>
    <dates>
      <discovery>2005-02-02</discovery>
      <entry>2005-02-11</entry>
    </dates>
  </vuln>

  <vuln vid="5d425189-7a03-11d9-a9e7-0001020eed82">
    <topic>postgresql -- privilege escalation vulnerability</topic>
    <affects>
      <package>
	<name>postgresql</name>
	<name>postgresql-server</name>
	<name>ja-postgresql</name>
	<range><lt>7.3.9</lt></range>
	<range><gt>7.4.*</gt><lt>7.4.7</lt></range>
	<range><gt>8.*</gt><lt>8.0.1</lt></range>
      </package>
      <package>
	<name>postgresql-devel</name>
	<range><le>8.0.1,1</le></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>John Heasman and others disovered that non-privileged users
	  could use the <q>LOAD</q> extension to load arbitrary
	  libraries into the postgres server process space.  This
	  could be used by non-privileged local users to execute
	  arbitrary code with the privileges of the postgresql
	  server.</p>
      </body>
    </description>
    <references>
      <bid>12411</bid>
      <cvename>CVE-2005-0227</cvename>
      <mlist>http://archives.postgresql.org/pgsql-announce/2005-02/msg00000.php</mlist>
      <mlist>http://archives.postgresql.org/pgsql-bugs/2005-01/msg00269.php</mlist>
    </references>
    <dates>
      <discovery>2005-01-21</discovery>
      <entry>2005-02-08</entry>
    </dates>
  </vuln>

  <vuln vid="831a6a66-79fa-11d9-a9e7-0001020eed82">
    <topic>ethereal -- multiple protocol dissectors vulnerabilities</topic>
    <affects>
      <package>
	<name>ethereal</name>
	<name>ethereal-lite</name>
	<name>tethereal</name>
	<name>tethereal-lite</name>
	<range><ge>0.8.10</ge><lt>0.10.9</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>An Ethreal Security Advisories reports:</p>
	<blockquote cite="http://www.ethereal.com/appnotes/enpa-sa-00017.html">
	  <p>Issues have been discovered in the following protocol
	    dissectors:</p>
	  <ul>
	    <li>The COPS dissector could go into an infinite
	      loop. CVE: CAN-2005-0006</li>
	    <li>The DLSw dissector could cause an assertion. CVE:
	      CAN-2005-0007</li>
	    <li>The DNP dissector could cause memory corruption. CVE:
	      CAN-2005-0008</li>
	    <li>The Gnutella dissector could cuase an assertion. CVE:
	      CAN-2005-0009</li>
	    <li>The MMSE dissector could free statically-allocated
	      memory. CVE: CAN-2005-0010</li>
	    <li>The X11 dissector is vulnerable to a string buffer
	      overflow. CVE: CAN-2005-0084</li>
	  </ul>
	  <p>Impact: It may be possible to make Ethereal crash or run
	    arbitrary code by injecting a purposefully malformed
	    packet onto the wire or by convincing someone to read a
	    malformed packet trace file.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-0006</cvename>
      <cvename>CVE-2005-0007</cvename>
      <cvename>CVE-2005-0008</cvename>
      <cvename>CVE-2005-0009</cvename>
      <cvename>CVE-2005-0010</cvename>
      <cvename>CVE-2005-0084</cvename>
      <bid>12326</bid>
      <url>http://www.ethereal.com/appnotes/enpa-sa-00017.html</url>
    </references>
    <dates>
      <discovery>2005-01-18</discovery>
      <entry>2005-02-08</entry>
    </dates>
  </vuln>

  <vuln vid="bfda39de-7467-11d9-9e1e-c296ac722cb3">
    <topic>squid -- correct handling of oversized HTTP reply headers</topic>
    <affects>
      <package>
	<name>squid</name>
	<range><lt>2.5.7_12</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The squid patches page notes:</p>
	<blockquote cite="http://www.squid-cache.org/Versions/v2/2.5/bugs/squid-2.5.STABLE7-oversize_reply_headers.patch">
	  <p>This patch addresses a HTTP protocol mismatch related to oversized
	    reply headers. In addition it enhances the cache.log reporting on
	    reply header parsing failures to make it easier to track down which
	    sites are malfunctioning.</p>
	</blockquote>
	<p>It is believed that this bug may lead to cache pollution or
	  allow access controls to be bypassed.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-0241</cvename>
      <url>http://www.squid-cache.org/bugs/show_bug.cgi?id=1216</url>
      <url>http://www.squid-cache.org/Versions/v2/2.5/bugs/squid-2.5.STABLE7-oversize_reply_headers.patch</url>
      <freebsdpr>ports/76967</freebsdpr>
      <certvu>823350</certvu>
    </references>
    <dates>
      <discovery>2005-01-31</discovery>
      <entry>2005-02-08</entry>
    </dates>
  </vuln>

  <vuln vid="6afa87d3-764b-11d9-b0e7-0000e249a0a2">
    <topic>python -- SimpleXMLRPCServer.py allows unrestricted traversal</topic>
    <affects>
      <package>
	<name>python</name>
	<name>python+ipv6</name>
	<range><ge>2.2</ge><lt>2.2.3_7</lt></range>
	<range><ge>2.3</ge><lt>2.3.4_4</lt></range>
	<range><ge>2.4</ge><lt>2.4_1</lt></range>
	<range><ge>2.5.a0.20050129</ge><lt>2.5.a0.20050129_1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>According to Python Security Advisory PSF-2005-001,</p>
	<blockquote cite="http://www.python.org/security/PSF-2005-001/">
	  <p>The Python development team has discovered a flaw in
	    the <code>SimpleXMLRPCServer</code> library module which
	    can give remote attackers access to internals of the
	    registered object or its module or possibly other modules.
	    The flaw only affects Python XML-RPC servers that use the
	    <code>register_instance()</code> method to register an object
	    without a <code>_dispatch()</code> method.	Servers using
	    only <code>register_function()</code> are not affected.</p>
	  <p>On vulnerable XML-RPC servers, a remote attacker may
	    be able to view or modify globals of the module(s)
	    containing the registered instance's class(es), potentially
	    leading to data loss or arbitrary code execution.  If the
	    registered object is a module, the danger is particularly
	    serious.  For example, if the registered module imports
	    the <code>os</code> module, an attacker could invoke the
	    <code>os.system()</code> function.</p>
	</blockquote>
	<p><strong>Note:</strong> This vulnerability affects your
	  system only if you're running
	  <code>SimpleXMLRPCServer</code>-based server.  This isn't
	  harmful at all if you don't run any internet server written
	  in Python or your server doesn't serve in XML-RPC protocol.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-0089</cvename>
      <url>http://www.python.org/security/PSF-2005-001/</url>
    </references>
    <dates>
      <discovery>2005-02-03</discovery>
      <entry>2005-02-03</entry>
      <modified>2006-10-08</modified>
    </dates>
  </vuln>

  <vuln vid="a5eb760a-753c-11d9-a36f-000a95bc6fae">
    <topic>perl -- vulnerabilities in PERLIO_DEBUG handling</topic>
    <affects>
      <package>
	<name>perl</name>
	<name>perl-threaded</name>
	<range><ge>5.8</ge><lt>5.8.6_2</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Kevin Finisterre discovered bugs in perl's I/O debug support:</p>
	<ul>
	  <li>The environmental variable PERLIO_DEBUG is honored even
	    by the set-user-ID perl command (usually
	    named <code>sperl</code> or <code>suidperl</code>).  As a
	    result, a local attacker may be able to gain elevated
	    privileges. <em>(CVE-2005-0155)</em></li>
	  <li>A buffer overflow may occur in threaded versions of perl
	    when the full pathname of the script being executed is
	    very long. <em>(CVE-2005-0156)</em>.</li>
	</ul>
	<p><strong>Note:</strong> By default, no set-user-ID perl
	  binary is installed.	An administrator must enable it
	  manually at build time with the <code>ENABLE_SUIDPERL</code>
	  port flag.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-0155</cvename>
      <cvename>CVE-2005-0156</cvename>
    </references>
    <dates>
      <discovery>2005-02-02</discovery>
      <entry>2005-02-02</entry>
      <modified>2007-11-07</modified>
    </dates>
  </vuln>

  <vuln vid="cd7e260a-6bff-11d9-a5df-00065be4b5b6">
   <topic>newsgrab -- insecure file and directory creation</topic>
   <affects>
    <package>
     <name>newsgrab</name>
     <range><le>0.4.0</le></range>
    </package>
   </affects>
   <description>
    <body xmlns="http://www.w3.org/1999/xhtml">
     <p>The newsgrab script uses insecure permissions during the
     creation of the local output directory and downloaded files.</p>
     <p>After a file is created, permissions on it are set using the mode
     value of the newsgroup posting. This can potentially be a problem
     when the mode is not restrictive enough. In addition, the output
     directory is created with world writable permissions allowing other
     users to drop symlinks or other files at that location.</p>
    </body>
   </description>
   <references>
    <url>http://people.freebsd.org/~niels/issues/newsgrab-20050114.txt</url>
    <url>http://sourceforge.net/project/shownotes.php?release_id=300562</url>
    <cvename>CVE-2005-0154</cvename>
   </references>
   <dates>
    <discovery>2005-01-18</discovery>
    <entry>2005-02-01</entry>
   </dates>
  </vuln>

  <vuln vid="35f6093c-73c3-11d9-8a93-00065be4b5b6">
   <topic>newsgrab -- directory traversal vulnerability</topic>
    <affects>
     <package>
      <name>newsgrab</name>
      <range><le>0.4.0</le></range>
     </package>
    </affects>
    <description>
    <body xmlns="http://www.w3.org/1999/xhtml">
     <p>The newsgrab script creates files by using the names provided
     in the newsgroup messages in a perl open() call.  This is done
     without performing any security checks to prevent a
     directory traversal. A specially crafted newsgroup message
     could cause newsgrab to drop an attachment anywhere on the
     file system using the permissions of the user running the
     script.</p>
    </body>
   </description>
   <references>
    <url>http://people.freebsd.org/~niels/issues/newsgrab-20050114.txt</url>
    <url>http://sourceforge.net/project/shownotes.php?release_id=300562</url>
    <cvename>CVE-2005-0153</cvename>
   </references>
   <dates>
    <discovery>2005-01-18</discovery>
    <entry>2005-02-01</entry>
   </dates>
  </vuln>

  <vuln vid="7f13607b-6948-11d9-8937-00065be4b5b6">
   <topic>newspost -- server response buffer overflow vulnerability</topic>
   <affects>
    <package>
     <name>newspost</name>
     <range><le>2.1.1</le></range>
    </package>
   </affects>
   <description>
    <body xmlns="http://www.w3.org/1999/xhtml">
      <p>The newspost program uses a function named socket_getline to read
	server responses from the network socket. Unfortunately this function
	does not check the length of the buffer in which the read data is stored
	and only stops reading when a newline character is found.</p>
      <p>A malicious NNTP server could use this bug to cause a buffer overflow
	by sending an overly long response. Such an overflow allows arbitrary
	code to be executed, with the privileges of the newspost process, on the
	affected systems.</p>
    </body>
   </description>
   <references>
    <url>http://people.freebsd.org/~niels/issues/newspost-20050114.txt</url>
    <cvename>CVE-2005-0101</cvename>
   </references>
   <dates>
    <discovery>2005-01-14</discovery>
    <entry>2005-02-01</entry>
   </dates>
  </vuln>

  <vuln vid="76e0b133-6bfd-11d9-a5df-00065be4b5b6">
   <topic>newsfetch -- server response buffer overflow vulnerability</topic>
   <affects>
     <package>
      <name>newsfetch</name>
      <range><le>1.21_1</le></range>
    </package>
   </affects>
   <description>
    <body xmlns="http://www.w3.org/1999/xhtml">
     <p>The newsfetch program uses the sscanf function to read information
       from server responses into static memory buffers. Unfortunately
       this is done without any proper bounds checking. As a result long
       server responses may cause an overflow when a newsgroup listing is
       requested from an NNTP server.</p>
    </body>
   </description>
   <references>
    <url>http://people.freebsd.org/~niels/issues/newsfetch-20050119.txt</url>
    <cvename>CVE-2005-0132</cvename>
   </references>
   <dates>
    <discovery>2005-01-18</discovery>
    <entry>2005-02-01</entry>
   </dates>
  </vuln>

  <vuln vid="23fb5a04-722b-11d9-9e1e-c296ac722cb3">
    <topic>squid -- buffer overflow in WCCP recvfrom() call</topic>
    <affects>
      <package>
	<name>squid</name>
	<range><lt>2.5.7_10</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>According to the Squid Proxy Cache Security Update Advisory
	  SQUID-2005:3,</p>
	<blockquote cite="http://www.squid-cache.org/Advisories/SQUID-2005_3.txt">
	  <p>The WCCP recvfrom() call accepts more data than will fit in
	    the allocated buffer.  An attacker may send a larger-than-normal
	    WCCP message to Squid and overflow this buffer.</p>
	  <p>Severity:</p>
	  <p>The bug is important because it allows remote attackers to crash
	    Squid, causing a disription in service.  However, the bug is
	    exploitable only if you have configured Squid to send WCCP messages
	    to, and expect WCCP replies from, a router.</p>
	  <p>Sites that do not use WCCP are not vulnerable.</p>
	</blockquote>
	<p>Note that while the default configuration of the FreeBSD squid port
	  enables WCCP support in general, the default configuration
	  supplied does not actually configure squid to send and receive WCCP
	  messages.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-0211</cvename>
      <certvu>886006</certvu>
      <url>http://www.squid-cache.org/Advisories/SQUID-2005_3.txt</url>
      <url>http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-wccp_buffer_overflow</url>
      <url>http://www.squid-cache.org/bugs/show_bug.cgi?id=1217</url>
    </references>
    <dates>
      <discovery>2005-01-28</discovery>
      <entry>2005-01-28</entry>
      <modified>2005-02-13</modified>
    </dates>
  </vuln>

  <vuln vid="f755545e-6fcd-11d9-abec-00061bd2d56f">
    <topic>xpdf -- makeFileKey2() buffer overflow vulnerability</topic>
    <affects>
      <package>
	<name>xpdf</name>
	<range><lt>3.00_6</lt></range>
      </package>
      <package>
	<name>kdegraphics</name>
	<range><lt>3.3.2_2</lt></range>
      </package>
      <package>
	<name>gpdf</name>
	<range><lt>2.8.3</lt></range>
      </package>
      <package>
	<name>teTeX-base</name>
	<range><lt>2.0.2_9</lt></range>
      </package>
      <package>
	<name>cups-base</name>
	<range><lt>1.1.23.0_3</lt></range>
      </package>
      <package>
	<name>koffice</name>
	<range><lt>1.3.5_2,1</lt></range>
      </package>
      <package>
	<name>pdftohtml</name>
	<range><lt>0.36_2</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>An iDEFENSE Security Advisory reports:</p>
	<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110608898221554">
	  <p>Remote exploitation of a buffer overflow vulnerability in
	    the xpdf PDF viewer included in multiple Unix and Linux
	    distributions could allow for arbitrary code execution as
	    the user viewing a PDF file.</p>
	  <p>The vulnerability specifically exists due to insufficient
	    bounds checking while processing a PDF file that provides
	    malicious values in the /Encrypt /Length tag. The
	    offending code can be found in the
	    <code>Decrypt::makeFileKey2</code> function in the source
	    file xpdf/Decrypt.cc.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-0064</cvename>
      <mlist msgid="FB24803D1DF2A34FA59FC157B77C970503C8B298@idserv04.idef.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110608898221554</mlist>
      <url>http://www.koffice.org/security/advisory-20050120-1.txt</url>
    </references>
    <dates>
      <discovery>2005-01-06</discovery>
      <entry>2005-01-26</entry>
      <modified>2005-02-03</modified>
    </dates>
  </vuln>

  <vuln vid="d371b627-6ed5-11d9-bd18-000a95bc6fae">
    <topic>zhcon -- unauthorized file access</topic>
    <affects>
      <package>
	<name>zhcon</name>
	<name>zh-zhcon</name>
	<range><lt>0.2.3_3</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Martin <q>Joey</q> Schulze reports:</p>
	<blockquote>
	  <p>Erik Sjöund discovered that zhcon, a fast console CJK
	    system using the Linux framebuffer, accesses a
	    user-controlled configuration file with elevated
	    privileges. Thus, it is possible to read arbitrary files.</p>
	</blockquote>
	<p>When installed from the FreeBSD Ports Collection, zhcon is
	  installed set-user-ID root.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-0072</cvename>
    </references>
    <dates>
      <discovery>2005-01-25</discovery>
      <entry>2005-01-25</entry>
    </dates>
  </vuln>

  <vuln vid="b8943e61-6e68-11d9-a9e7-0001020eed82">
    <topic>evolution -- arbitrary code execution vulnerability</topic>
    <affects>
      <package>
	<name>evolution</name>
	<range><lt>2.0.3_1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Martin <q>Joey</q> Schulze reports:</p>
	<blockquote>
	  <p>Max Vozeler discovered an integer overflow in the helper
	    application camel-lock-helper which runs setuid root or
	    setgid mail inside of Evolution, a free groupware suite.
	    A local attacker can cause the setuid root helper to
	    execute arbitrary code with elevated privileges via a
	    malicious POP server.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <bid>12354</bid>
      <cvename>CVE-2005-0102</cvename>
      <url>http://cvs.gnome.org/viewcvs/evolution/camel/camel-lock-helper.c?rev=1.7&amp;view=log#rev1.5.74.1</url>
    </references>
    <dates>
      <discovery>2005-01-20</discovery>
      <entry>2005-01-25</entry>
      <modified>2005-02-02</modified>
    </dates>
  </vuln>

  <vuln vid="88ff90f2-6e43-11d9-8c87-000a95bc6fae">
    <topic>mod_dosevasive -- insecure temporary file creation</topic>
    <affects>
      <package>
	<name>mod_dosevasive20</name>
	<range><lt>1.10</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>An LSS Security Advisory reports:</p>
	<blockquote cite="http://security.lss.hr/en/index.php?page=details&amp;ID=LSS-2005-01-01">
	  <p>When a denial of service attack is detected,
	    mod_dosevasive will, among other things, create a
	    temporary file which it will use to trace actions from the
	    offensive IP address. This file is insecurely created in
	    /tmp and it's name is easily predictable.</p>
	  <p>It is then easy for an attacker to create arbitrary files
	    in any directory that the user under which apache runs has
	    privileges to write.</p>
	  <p><em>[...]</em> once the target file is opened, there is a
	    race attack (although difficult to exploit) which can lead
	    to mod_dosevasive overwriting any file that the user under
	    which apache runs has privileges to write.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <freebsdpr>ports/77513</freebsdpr>
      <url>http://security.lss.hr/en/index.php?page=details&amp;ID=LSS-2005-01-01</url>
    </references>
    <dates>
      <discovery>2005-01-04</discovery>
      <entry>2005-01-24</entry>
      <modified>2005-02-22</modified>
    </dates>
  </vuln>

  <vuln vid="b4d94fa0-6e38-11d9-9e1e-c296ac722cb3">
    <topic>squid -- possible cache-poisoning via malformed HTTP responses</topic>
    <affects>
      <package>
	<name>squid</name>
	<range><lt>2.5.7_9</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The squid patches page notes:</p>
	<blockquote cite="http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-header_parsing">
	  <p>This patch makes Squid considerably stricter while
	    parsing the HTTP protocol.</p>
	  <ol>
	    <li>A Content-length header should only appear once in a
	      valid request or response. Multiple Content-length
	      headers, in conjunction with specially crafted requests,
	      may allow Squid's cache to be poisoned with bad content
	      in certain situations.</li>
	    <li>CR characters is only allowed as part of the CR NL
	      line terminator, not alone. This to ensure that all
	      involved agrees on the structure of HTTP headers.</li>
	    <li>Rejects requests/responses that have whitespace in an
	      HTTP header name.</li>
	  </ol>
	</blockquote>
	<p>To enable these strict parsing rules, update to at least
	  squid-2.5.7_9 and specify <code>relaxed_header_parser
	  off</code> in squid.conf.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-0174</cvename>
      <url>http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-header_parsing</url>
      <certvu>768702</certvu>
    </references>
    <dates>
      <discovery>2005-01-24</discovery>
      <entry>2005-01-24</entry>
      <modified>2006-01-02</modified>
    </dates>
  </vuln>

  <vuln vid="97c3a452-6e36-11d9-8324-000a95bc6fae">
    <topic>bugzilla -- cross-site scripting vulnerability</topic>
    <affects>
      <package>
	<name>bugzilla</name>
	<name>ja-bugzilla</name>
	<range><lt>2.16.8</lt></range>
	<range><ge>2.17.*</ge><lt>2.18</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A Bugzilla advisory states:</p>
	<blockquote cite="http://www.bugzilla.org/security/2.16.7-nr/">
	  <p>This advisory covers a single cross-site scripting issue
	    that has recently been discovered and fixed in the
	    Bugzilla code: If a malicious user links to a Bugzilla
	    site using a specially crafted URL, a script in the error
	    page generated by Bugzilla will display the URL unaltered
	    in the page, allowing scripts embedded in the URL to
	    execute.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2004-1061</cvename>
      <url>http://www.bugzilla.org/security/2.16.7-nr/</url>
      <url>https://bugzilla.mozilla.org/show_bug.cgi?id=272620</url>
    </references>
    <dates>
      <discovery>2004-12-01</discovery>
      <entry>2005-01-24</entry>
    </dates>
  </vuln>

  <vuln vid="b0911985-6e2a-11d9-9557-000a95bc6fae">
    <topic>web browsers -- window injection vulnerabilities</topic>
    <affects>
      <package>
	<name>firefox</name>
	<range><lt>1.0.1,1</lt></range>
      </package>
      <package>
	<name>mozilla</name>
	<range><lt>1.7.6,2</lt></range>
      </package>
      <package>
	<name>linux-mozilla</name>
	<name>linux-mozilla-devel</name>
	<range><lt>1.7.6</lt></range>
      </package>
      <package>
	<name>de-linux-mozillafirebird</name>
	<name>el-linux-mozillafirebird</name>
	<name>ja-linux-mozillafirebird-gtk1</name>
	<name>ja-mozillafirebird-gtk2</name>
	<name>linux-mozillafirebird</name>
	<name>ru-linux-mozillafirebird</name>
	<name>zhCN-linux-mozillafirebird</name>
	<name>zhTW-linux-mozillafirebird</name>
	<name>de-netscape7</name>
	<name>fr-netscape7</name>
	<name>ja-netscape7</name>
	<name>netscape7</name>
	<name>pt_BR-netscape7</name>
	<name>mozilla-gtk1</name>
	<range><ge>0</ge></range>
      </package>
      <package>
	<!-- These package names are obsolete. -->
	<name>de-linux-netscape</name>
	<name>fr-linux-netscape</name>
	<name>ja-linux-netscape</name>
	<name>linux-netscape</name>
	<name>linux-phoenix</name>
	<name>mozilla+ipv6</name>
	<name>mozilla-embedded</name>
	<name>mozilla-firebird</name>
	<name>mozilla-gtk2</name>
	<name>mozilla-gtk</name>
	<name>mozilla-thunderbird</name>
	<name>phoenix</name>
	<range><ge>0</ge></range>
      </package>
      <package>
	<name>kdebase</name>
	<name>kdelibs</name>
	<range><lt>3.3.2</lt></range>
      </package>
      <package>
	<name>opera</name>
	<name>opera-devel</name>
	<name>linux-opera</name>
	<range><lt>7.54.20050131</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A Secunia Research advisory reports:</p>
	<blockquote cite="http://secunia.com/secunia_research/2004-13/advisory/">
	  <p>Secunia Research has reported a vulnerability in multiple
	    browsers, which can be exploited by malicious people to
	    spoof the content of websites.</p>
	  <p>The problem is that a website can inject content into
	    another site's window if the target name of the window is
	    known. This can e.g. be exploited by a malicious website
	    to spoof the content of a pop-up window opened on a
	    trusted website.</p>
	  <p>Secunia has constructed a test, which can be used to
	    check if your browser is affected by this issue:
	    <a href="http://secunia.com/multiple_browsers_window_injection_vulnerability_test/">http://secunia.com/multiple_browsers_window_injection_vulnerability_test/</a></p>
	</blockquote>
	<p>A <a href="http://mozillanews.org/?article_date=2004-12-08+06-48-46">workaround
	    for Mozilla-based browsers</a> is available.</p>
      </body>
    </description>
    <references>
      <url>http://secunia.com/secunia_research/2004-13/advisory/</url>
      <url>http://secunia.com/multiple_browsers_window_injection_vulnerability_test/</url>
      <!-- mozilla -->
      <cvename>CVE-2004-1156</cvename>
      <url>http://secunia.com/advisories/13129/</url>
      <url>https://bugzilla.mozilla.org/show_bug.cgi?id=273699</url>
      <url>https://bugzilla.mozilla.org/show_bug.cgi?id=103638</url>
      <url>http://mozillanews.org/?article_date=2004-12-08+06-48-46</url>
      <!-- opera -->
      <cvename>CVE-2004-1157</cvename>
      <url>http://secunia.com/advisories/13253/</url>
      <!-- konqueror -->
      <cvename>CVE-2004-1158</cvename>
      <url>http://secunia.com/advisories/13254/</url>
      <url>http://www.kde.org/info/security/advisory-20041213-1.txt</url>
      <!-- netscape -->
      <cvename>CVE-2004-1160</cvename>
      <url>http://secunia.com/advisories/13402/</url>
    </references>
    <dates>
      <discovery>2004-12-08</discovery>
      <entry>2005-01-24</entry>
      <modified>2005-02-26</modified>
    </dates>
  </vuln>

  <vuln vid="d4a7054a-6d96-11d9-a9e7-0001020eed82">
    <topic>yamt -- arbitrary command execution vulnerability</topic>
    <affects>
      <package>
	<name>yamt</name>
	<range><lt>0.5_2</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Manigandan Radhakrishnan discovered a security
	  vulnerability in YAMT which can lead to execution of
	  arbitrary commands with the privileges of the user running
	  YAMT when sorting based on MP3 tags.	The problem exist in
	  the <code>id3tag_sort()</code> routine which does not
	  properly sanitize the artist tag from the MP3 file before
	  using it as an argument to the mv command.</p>
      </body>
    </description>
    <references>
      <bid>11999</bid>
      <cvename>CVE-2004-1302</cvename>
      <url>http://tigger.uic.edu/~jlongs2/holes/yamt.txt</url>
    </references>
    <dates>
      <discovery>2004-12-15</discovery>
      <entry>2005-01-23</entry>
      <modified>2005-01-25</modified>
    </dates>
  </vuln>

  <vuln vid="4e4bd2c2-6bd5-11d9-9e1e-c296ac722cb3">
    <topic>squid -- HTTP response splitting cache pollution attack</topic>
    <affects>
      <package>
	  <name>squid</name>
	  <range><lt>2.5.7_8</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	  <p>According to a whitepaper published by Sanctum, Inc., it
	    is possible to mount cache poisoning attacks against, among others,
	    squid proxies by inserting false replies into the HTTP stream.</p>
	  <p>The squid patches page notes:</p>
	  <blockquote cite="http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-response_splitting">
	    <p>This patch additionally strengthens Squid from the HTTP response
	      attack described by Sanctum.</p>
	  </blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-0175</cvename>
      <url>http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-response_splitting</url>
      <url>http://www.squid-cache.org/bugs/show_bug.cgi?id=1200</url>
      <url>https://www.watchfire.com/securearea/whitepapers.aspx?id=8</url>
      <certvu>625878</certvu>
    </references>
    <dates>
      <discovery>2004-03-01</discovery>
      <entry>2005-01-22</entry>
      <modified>2005-02-07</modified>
    </dates>
  </vuln>

  <vuln vid="338d1723-5f03-11d9-92a7-000bdb1444a4">
    <topic>horde -- XSS vulnerabilities</topic>
    <affects>
      <package>
	<name>horde</name>
	<name>horde-php5</name>
	<range><gt>3.*</gt><lt>3.0.1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A Hyperdose Security Advisory reports:</p>
	<blockquote cite="http://lists.horde.org/archives/announce/2005/000159.html">
	  <p>Horde contains two XSS attacks that can be exploited
	    through GET requests.  Once exploited, these requests
	    could be used to execute any javascript commands in the
	    context of that user, potentially including but not
	    limited to reading and deleting email, and stealing auth
	    tokens.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <bid>12255</bid>
      <mlist msgid="1105593825.8638@mx249a.mysite4now.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110564059322774</mlist>
      <mlist>http://lists.horde.org/archives/announce/2005/000159.html</mlist>
    </references>
    <dates>
      <discovery>2005-01-04</discovery>
      <entry>2005-01-22</entry>
    </dates>
  </vuln>

  <vuln vid="2b2b333b-6bd3-11d9-95f8-000a95bc6fae">
    <topic>mc -- multiple vulnerabilities</topic>
    <affects>
      <package>
	<name>mc</name>
	<range><lt>4.6.0</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Andrew V. Samoilov reported several vulnerabilities that
	  were corrected in MidnightCommand 4.6.0:</p>
	<ul>
	  <li>Format string issues (CVE-2004-1004)</li>
	  <li>Buffer overflows (CVE-2004-1005)</li>
	  <li>Denial-of-service, infinite loop (CVE-2004-1009)</li>
	  <li>Denial-of-service, corrupted section header
	    (CVE-2004-1090)</li>
	  <li>Denial-of-service, null pointer dereference (CVE-2004-1091)</li>
	  <li>Freeing unallocated memory (CVE-2004-1092)</li>
	  <li>Using already freed memory (CVE-2004-1093)</li>
	</ul>
      </body>
    </description>
    <references>
      <cvename>CVE-2004-1004</cvename>
      <cvename>CVE-2004-1005</cvename>
      <cvename>CVE-2004-1009</cvename>
      <cvename>CVE-2004-1090</cvename>
      <cvename>CVE-2004-1091</cvename>
      <cvename>CVE-2004-1092</cvename>
      <cvename>CVE-2004-1093</cvename>
    </references>
    <dates>
      <discovery>2004-12-01</discovery>
      <entry>2005-01-21</entry>
    </dates>
  </vuln>

  <vuln vid="c418d472-6bd1-11d9-93ca-000a95bc6fae">
    <topic>perl -- File::Path insecure file/directory permissions</topic>
    <affects>
      <package>
	<name>perl</name>
	<name>perl-threaded</name>
	<range><ge>0</ge><lt>5.6.2</lt></range>
	<range><ge>5.8.0</ge><lt>5.8.6</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Jeroen van Wolffelaar reports that the Perl module File::Path
	  contains a race condition wherein traversed directories and files
	  are temporarily made world-readable/writable.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2004-0452</cvename>
      <url>http://www.debian.org/security/2004/dsa-620</url>
      <url>http://xforce.iss.net/xforce/xfdb/18650</url>
    </references>
    <dates>
      <discovery>2004-12-30</discovery>
      <entry>2005-01-21</entry>
      <modified>2007-11-07</modified>
    </dates>
  </vuln>

  <vuln vid="e8c6ade2-6bcc-11d9-8e6f-000a95bc6fae">
    <cancelled superseded="e3cf89f0-53da-11d9-92b7-ceadd4ac2edd"/>
  </vuln>

  <vuln vid="1489df94-6bcb-11d9-a21e-000a95bc6fae">
    <topic>opera -- multiple vulnerabilities in Java implementation</topic>
    <affects>
      <package>
	<name>opera</name>
	<name>opera-devel</name>
	<name>linux-opera</name>
	<range><lt>7.54.20041210</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Marc Schoenefeld reports:</p>
	<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110088923127820">
	  <p>Opera 7.54 is vulnerable to leakage of the java sandbox,
	    allowing malicious applets to gain unacceptable
	    privileges. This allows them to be used for information
	    gathering (spying) of local identity information and
	    system configurations as well as causing annoying crash
	    effects.</p>
	  <p>Opera 754 <em>[sic]</em> which was released Aug 5,2004 is
	    vulnerable to the XSLT processor covert channel attack,
	    which was corrected with JRE 1.4.2_05 [released in July
	    04], but in disadvantage to the users the opera packaging
	    guys chose to bundle the JRE 1.4.2_04 <em>[...]</em></p>
	  <p>Internal pointer DoS exploitation: Opera.jar contains the
	    opera replacement of the java plugin. It therefore handles
	    communication between javascript and the Java VM via the
	    liveconnect protocol. The public class EcmaScriptObject
	    exposes a system memory pointer to the java address space,
	    by constructing a special variant of this type an internal
	    cache table can be polluted by false entries that infer
	    proper function of the JSObject class and in the following
	    proof-of-concept crash the browser.</p>
	  <p>Exposure of location of local java installation Sniffing
	    the URL classpath allows to retrieve the URLs of the
	    bootstrap class path and therefore the JDK installation
	    directory.</p>
	  <p>Exposure of local user name to an untrusted applet An
	    attacker could use the sun.security.krb5.Credentials class
	    to retrieve the name of the currently logged in user and
	    parse his home directory from the information which is
	    provided by the thrown
	    java.security.AccessControlException.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <mlist msgid="Pine.A41.4.58.0411191800510.57436@zivunix.uni-muenster.de">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110088923127820</mlist>
    </references>
    <dates>
      <discovery>2004-11-19</discovery>
      <entry>2005-01-24</entry>
    </dates>
  </vuln>

  <vuln vid="045944a0-6bca-11d9-aaa6-000a95bc6fae">
    <topic>sudo -- environmental variable CDPATH is not cleared</topic>
    <affects>
      <package>
	<name>sudo</name>
	<range><lt>1.6.8.4</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A sudo bug report says:</p>
	<blockquote cite="http://www.sudo.ws/bugs/show_bug.cgi?id=155">
	  <p>sudo doesn't unset the CDPATH variable, which leads to
	    possible security problems.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <url>http://www.sudo.ws/bugs/show_bug.cgi?id=155</url>
      <mlist>http://www.sudo.ws/pipermail/sudo-announce/2004-November/000044.html</mlist>
    </references>
    <dates>
      <discovery>2004-10-18</discovery>
      <entry>2005-01-21</entry>
      <modified>2013-06-19</modified>
    </dates>
  </vuln>

  <vuln vid="e480ccb2-6bc8-11d9-8dbe-000a95bc6fae">
    <topic>fcron -- multiple vulnerabilities</topic>
    <affects>
      <package>
	<name>fcron</name>
	<range><lt>2.9.5.1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>An iDEFENSE Security Advisory states:</p>
	<blockquote cite="http://www.idefense.com/application/poi/display?id=157&amp;type=vulnerabilities&amp;flashstatus=false">
	  <p>Multiple vulnerabilities have been found in Fcron.</p>
	  <ol>
	    <li>File contents disclosure</li>
	    <li>Configuration Bypass Vulnerability</li>
	    <li>File Removal and Empty File Creation Vulnerability</li>
	    <li>Information Disclosure Vulnerability</li>
	  </ol>
	</blockquote>
      </body>
    </description>
    <references>
      <url>http://www.idefense.com/application/poi/display?id=157&amp;type=vulnerabilities&amp;flashstatus=false</url>
      <cvename>CVE-2004-1030</cvename>
      <cvename>CVE-2004-1031</cvename>
      <cvename>CVE-2004-1032</cvename>
      <cvename>CVE-2004-1033</cvename>
    </references>
    <dates>
      <discovery>2004-11-15</discovery>
      <entry>2005-01-21</entry>
    </dates>
  </vuln>

  <vuln vid="02274fd9-6bc5-11d9-8edb-000a95bc6fae">
    <topic>realplayer -- arbitrary file deletion and other vulnerabilities</topic>
    <affects>
      <package>
	<name>linux-realplayer</name>
	<range><lt>10.0.2</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>An NGSSoftware Insight Security Research Advisory reports:</p>
	<blockquote cite="http://www.ngssoftware.com/advisories/real-03full.txt">
	  <p>Two vulnerabilities have been discovered in RealPlayer
	    which may potentially be leveraged to allow remote code
	    execution, or may used in combination with the Real
	    Metadata Package File Deletion vulnerability to reliably
	    delete files from a users system.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <url>http://www.ngssoftware.com/advisories/real-02full.txt</url>
      <url>http://www.ngssoftware.com/advisories/real-03full.txt</url>
      <url>http://service.real.com/help/faq/security/040928_player/EN/</url>
    </references>
    <dates>
      <discovery>2004-10-06</discovery>
      <entry>2005-01-21</entry>
    </dates>
  </vuln>

  <vuln vid="2001103a-6bbd-11d9-851d-000a95bc6fae">
    <topic>imlib -- xpm heap buffer overflows and integer overflows</topic>
    <affects>
      <package>
	<name>imlib</name>
	<range><lt>1.9.15_2</lt></range>
      </package>
      <package>
	<name>imlib2</name>
	<range><lt>1.1.2_1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Pavel Kankovsky reports:</p>
	<blockquote cite="https://bugzilla.fedora.us/show_bug.cgi?id=2051#c11">
	  <p>Imlib affected by a variant of CAN-2004-0782 too.</p>
	  <p>I've discovered more vulnerabilities in Imlib
	    (1.9.13). In particular, it appears to be affected by a
	    variant of Chris Evans' libXpm flaw #1 (CAN-2004-0782, see
	    http://scary.beasts.org/security/CESA-2004-003.txt). Look
	    at the attached image, it kills ee on my 7.3.</p>
	</blockquote>
	<p>The flaws also affect imlib2.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2004-1025</cvename>
      <cvename>CVE-2004-1026</cvename>
      <bid>11830</bid>
      <url>https://bugzilla.fedora.us/show_bug.cgi?id=2051#c11</url>
      <url>https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=138516</url>
      <url>http://cvs.sourceforge.net/viewcvs.py/enlightenment/e17/libs/imlib2/src/modules/loaders/loader_xpm.c#rev1.3</url>
    </references>
    <dates>
      <discovery>2004-12-06</discovery>
      <entry>2005-01-21</entry>
    </dates>
  </vuln>

  <vuln vid="39953788-6bbb-11d9-8bc9-000a95bc6fae">
    <topic>egroupware -- arbitrary file download in JiNN</topic>
    <affects>
      <package>
	<name>eGroupWare</name>
	<range><lt>1.0.0.006</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>eGroupWare contains a bug in the JiNN component that allows
	  a remote attacker to download arbitrary files.</p>
      </body>
    </description>
    <references>
      <url>http://cvs.sourceforge.net/viewcvs.py/egroupware/jinn/CHANGELOG#rev1.24</url>
      <mlist>http://sourceforge.net/mailarchive/forum.php?thread_id=5915445&amp;forum_id=35178</mlist>
    </references>
    <dates>
      <discovery>2004-10-15</discovery>
      <entry>2005-01-21</entry>
    </dates>
  </vuln>

  <vuln vid="2c25e762-6bb9-11d9-93db-000a95bc6fae">
    <topic>quake2 -- multiple critical vulnerabilities</topic>
    <affects>
      <package>
	<name>quake2forge</name>
	<range><ge>0</ge></range>
      </package>
      <package>
	<name>quake2lnx</name>
	<range><lt>0.16.2</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>An advisory published by Richard Stanway describes numerous
	  critical vulnerabilities in the Quake II engine:</p>
	<blockquote cite="http://secur1ty.net/advisories/001">
	  <p>Due to unchecked input at various stages in the server,
	    remote users are able to cause the server to crash, reveal
	    sensitive information or potentially execute arbitrary
	    code.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <url>http://secur1ty.net/advisories/001</url>
      <mlist msgid="NGEHLEPKOGIHAIJAMDPKOEHJCGAA.bugtraq@secur1ty.net">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=109892527321706</mlist>
    </references>
    <dates>
      <discovery>2004-10-27</discovery>
      <entry>2005-01-21</entry>
      <modified>2005-03-15</modified>
    </dates>
  </vuln>

  <vuln vid="5c7bb4dd-6a56-11d9-97ec-000c6e8f12ef">
    <topic>konversation -- shell script command injection</topic>
    <affects>
      <package>
	<name>konversation</name>
	<range><lt>0.15</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Konversation comes with Perl scripts that do not properly escape
	  shell characters on executing a script. This makes it possible
	  to attack Konversation with shell script command injection.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-0129</cvename>
      <cvename>CVE-2005-0130</cvename>
      <cvename>CVE-2005-0131</cvename>
      <mlist msgid="200501191739.56585.wouter@coekaerts.be">http://marc.theaimsgroup.com/?l=full-disclosure&amp;m=110616016509114</mlist>
    </references>
    <dates>
      <discovery>2005-01-19</discovery>
      <entry>2005-01-19</entry>
      <modified>2005-01-21</modified>
    </dates>
  </vuln>

  <vuln vid="7a921e9e-68b1-11d9-9e1e-c296ac722cb3">
    <topic>squid -- no sanity check of usernames in squid_ldap_auth</topic>
    <affects>
      <package>
	<name>squid</name>
	<range><lt>2.5.7_7</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The LDAP authentication helper did not strip
	  leading or trailing spaces from the login name.
	  According to the squid patches page:</p>
	<blockquote cite="http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-ldap_spaces">
	  <p>LDAP is very forgiving about spaces in search
	    filters and this could be abused to log in
	    using several variants of the login name,
	    possibly bypassing explicit access controls
	    or confusing accounting.</p>
	  <p>Workaround: Block logins with spaces</p>
	    <pre>
	    acl login_with_spaces proxy_auth_regex [:space:]
		    http_access deny login_with_spaces
	    </pre>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-0173</cvename>
      <url>http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-ldap_spaces</url>
      <url>http://www.squid-cache.org/bugs/show_bug.cgi?id=1187</url>
      <certvu>924198</certvu>
    </references>
    <dates>
      <discovery>2005-01-10</discovery>
      <entry>2005-01-19</entry>
      <modified>2005-02-08</modified>
    </dates>
  </vuln>

  <vuln vid="990cf07e-6988-11d9-a9e7-0001020eed82">
    <topic>cups-base -- CUPS server remote DoS vulnerability</topic>
    <affects>
      <package>
	<name>cups-base</name>
	<range><ge>1.1.21</ge><lt>1.1.23</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Kenshi Muto discovered that the CUPS server would enter an
	  infinite loop when processing a URL containing
	  <q><code>/..</code></q>.</p>
      </body>
    </description>
    <references>
      <bid>12200</bid>
      <cvename>CVE-2005-2874</cvename>
      <url>http://www.cups.org/str.php?L1042</url>
    </references>
    <dates>
      <discovery>2004-12-30</discovery>
      <entry>2005-01-18</entry>
      <modified>2005-09-21</modified>
    </dates>
  </vuln>

  <vuln vid="b58ff497-6977-11d9-ae49-000c41e2cdad">
    <topic>tiff -- divide-by-zero denial-of-service</topic>
    <affects>
      <package>
	<name>tiff</name>
	<name>linux-tiff</name>
	<range><lt>3.6.0</lt></range>
      </package>
      <package>
	<name>pdflib</name>
	<name>pdflib-perl</name>
	<range><lt>6.0.1</lt></range>
      </package>
      <package>
	<name>gdal</name>
	<range><lt>1.2.1_2</lt></range>
      </package>
      <package>
	<name>ivtools</name>
	<range><lt>1.2.3</lt></range>
      </package>
      <package>
	<name>paraview</name>
	<range><lt>2.4.3</lt></range>
      </package>
      <package>
	<name>fractorama</name>
	<range><lt>1.6.7_1</lt></range>
      </package>
      <package>
	<name>iv</name>
	<name>ja-iv</name>
	<name>ja-libimg</name>
	<range><gt>0</gt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A US-CERT vulnerability note reports:</p>
	<blockquote cite="http://www.kb.cert.org/vuls/id/555304">
	  <p>An Integer overflow in the LibTIFF library may allow a
	    remote attacker to cause a divide-by-zero error that results
	    in a denial-of-service condition.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2004-0804</cvename>
      <certvu>555304</certvu>
      <url>http://bugzilla.remotesensing.org/show_bug.cgi?id=111</url>
    </references>
    <dates>
      <discovery>2002-03-27</discovery>
      <entry>2005-01-18</entry>
      <modified>2006-06-08</modified>
    </dates>
  </vuln>

  <vuln vid="249a8c42-6973-11d9-ae49-000c41e2cdad">
    <topic>zgv -- exploitable heap overflows</topic>
    <affects>
      <package>
	<name>zgv</name>
	<range><lt>5.8_1</lt></range>
      </package>
      <package>
	<name>xzgv</name>
	<range><lt>0.8_2</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>infamous41md reports:</p>
	<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=109886210702781">
	  <p>zgv uses malloc() frequently to allocate memory for storing
	    image data.  When calculating how much to allocate, user
	    supplied data from image headers is multiplied and/or added
	    without any checks for arithmetic overflows.  We can
	    overflow numerous calculations, and cause small buffers to
	    be allocated.  Then we can overflow the buffer, and
	    eventually execute code.  There are a total of
	    11 overflows that are exploitable to execute arbitrary
	    code.</p>
	</blockquote>
	<p>These bugs exist in both zgv and xzgv.</p>
      </body>
    </description>
    <references>
      <mlist msgid="20041025210717.2799d9c1.infamous41md@hotpop.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=109886210702781</mlist>
      <mlist msgid="20041027233907.A3678@netdirect.ca">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=109898111915661</mlist>
      <url>http://rus.members.beeb.net/xzgv.html</url>
      <url>http://www.svgalib.org/rus/zgv/</url>
      <cvename>CVE-2004-0994</cvename>
      <url>http://www.idefense.com/application/poi/display?id=160&amp;type=vulnerabilities&amp;flashstatus=false</url>
    </references>
    <dates>
      <discovery>2004-10-26</discovery>
      <entry>2005-01-18</entry>
      <modified>2005-01-21</modified>
    </dates>
  </vuln>

  <vuln vid="a77849a5-696f-11d9-ae49-000c41e2cdad">
    <topic>mozilla -- insecure permissions for some downloaded files</topic>
    <affects>
      <package>
	<name>thunderbird</name>
	<range><lt>0.9</lt></range>
      </package>
      <package>
	<name>de-linux-mozillafirebird</name>
	<name>el-linux-mozillafirebird</name>
	<name>firefox</name>
	<name>ja-linux-mozillafirebird-gtk1</name>
	<name>ja-mozillafirebird-gtk2</name>
	<name>linux-mozillafirebird</name>
	<name>ru-linux-mozillafirebird</name>
	<name>zhCN-linux-mozillafirebird</name>
	<name>zhTW-linux-mozillafirebird</name>
	<range><lt>1.0.r2,1</lt></range>
      </package>
      <package>
	<name>de-netscape7</name>
	<name>fr-netscape7</name>
	<name>ja-netscape7</name>
	<name>netscape7</name>
	<name>pt_BR-netscape7</name>
	<range><le>7.2</le></range>
      </package>
      <package>
	<name>mozilla-gtk1</name>
	<name>linux-mozilla</name>
	<name>linux-mozilla-devel</name>
	<range><lt>1.7.5</lt></range>
      </package>
      <package>
	<name>mozilla</name>
	<range><lt>1.7.5,2</lt></range>
      </package>
      <package>
	<!-- These package names are obsolete. -->
	<name>de-linux-netscape</name>
	<name>fr-linux-netscape</name>
	<name>ja-linux-netscape</name>
	<name>linux-netscape</name>
	<name>linux-phoenix</name>
	<name>mozilla+ipv6</name>
	<name>mozilla-embedded</name>
	<name>mozilla-firebird</name>
	<name>mozilla-gtk2</name>
	<name>mozilla-gtk</name>
	<name>mozilla-thunderbird</name>
	<name>phoenix</name>
	<range><ge>0</ge></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>In a Mozilla bug report, Daniel Kleinsinger writes:</p>
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=251297">
	  <p>I was comparing treatment of attachments opened directly
	    from emails on different platforms. I discovered that Linux
	    builds save attachments in /tmp with world readable rights.
	    This doesn't seem like a good thing. Couldn't someone else
	    logged onto the same machine read your attachments?</p>
	</blockquote>
	<p>This could expose the contents of downloaded files or email
	  attachments to other users on a multi-user system.</p>
      </body>
    </description>
    <references>
      <url>https://bugzilla.mozilla.org/show_bug.cgi?id=251297</url>
      <mlist msgid="417C19F1.2040107@ptraced.net">http://marc.theaimsgroup.com/?l=full-disclosure&amp;m=109865078103911</mlist>
    </references>
    <dates>
      <discovery>2004-07-13</discovery>
      <entry>2005-01-18</entry>
    </dates>
  </vuln>

  <vuln vid="0f5a2b4d-694b-11d9-a9e7-0001020eed82">
    <topic>awstats -- remote command execution vulnerability</topic>
    <affects>
      <package>
	<name>awstats</name>
	<range><lt>6.3</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>An iDEFENSE Security Advisory  reports:</p>
	<blockquote cite="http://marc.theaimsgroup.com/?l=full-disclosure&amp;m=110600949323439">
	  <p>Remote exploitation of an input validation vulnerability
	    in AWStats allows attackers to execute arbitrary commands
	    under the privileges of the web server.</p>
	  <p>The problem specifically exists when the application is
	    running as a CGI script on a web server. The "configdir"
	    parameter contains unfiltered user-supplied data that is
	    utilized in a call to the Perl routine open()...</p>
	  <p>Successful exploitation allows remote attackers to
	    execute arbitrary commands under the privileges of the web
	    server. This can lead to further compromise as it provides
	    remote attackers with local access.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <bid>12270</bid>
      <cvename>CVE-2005-0116</cvename>
      <certvu>272296</certvu>
      <mlist msgid="FB24803D1DF2A34FA59FC157B77C970503C8B20C@idserv04.idef.com">http://marc.theaimsgroup.com/?l=full-disclosure&amp;m=110600949323439</mlist>
      <url>http://awstats.sourceforge.net/docs/awstats_changelog.txt</url>
      <url>http://www.idefense.com/application/poi/display?id=185&amp;type=vulnerabilities&amp;flashstatus=false</url>
    </references>
    <dates>
      <discovery>2004-10-21</discovery>
      <entry>2005-01-18</entry>
      <modified>2005-02-23</modified>
    </dates>
  </vuln>

  <vuln vid="597e2bee-68ea-11d9-a9e7-0001020eed82">
    <topic>ImageMagick -- PSD handler heap overflow vulnerability</topic>
    <affects>
      <package>
	<name>ImageMagick</name>
	<name>ImageMagick-nox11</name>
	<range><lt>6.1.8.8</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>An iDEFENSE Security Advisory reports:</p>
	<blockquote cite="http://www.idefense.com/application/poi/display?id=184&amp;type=vulnerabilities">
	  <p>Remote exploitation of a buffer overflow vulnerability in
	    The ImageMagick's Project's ImageMagick PSD image-decoding
	    module could allow an attacker to execute arbitrary
	    code.</p>
	  <p>Exploitation may allow attackers to run arbitrary code on
	    a victim's computer if the victim opens a specially
	    formatted image. Such images could be delivered by e-mail
	    or HTML, in some cases, and would likely not raise
	    suspicion on the victim's part. Exploitation is also
	    possible when a web-based application uses ImageMagick to
	    process user-uploaded image files.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-0005</cvename>
      <url>http://www.idefense.com/application/poi/display?id=184&amp;type=vulnerabilities</url>
    </references>
    <dates>
      <discovery>2004-12-21</discovery>
      <entry>2005-01-18</entry>
    </dates>
  </vuln>

  <vuln vid="7850a238-680a-11d9-a9e7-0001020eed82">
    <topic>cups-lpr -- lppasswd multiple vulnerabilities</topic>
    <affects>
      <package>
	<name>cups-lpr</name>
	<name>fr-cups-lpr</name>
	<range><lt>1.1.23</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>D. J. Bernstein reports that Bartlomiej Sieka has
	  discovered several security vulnerabilities in lppasswd,
	  which is part of CUPS.  In the following excerpt from
	  Bernstein's email, CVE names have been added for each issue:</p>
	<blockquote cite="http://tigger.uic.edu/~jlongs2/holes/cups2.txt">
	  <p>First, lppasswd blithely ignores write errors in
	    fputs(line,outfile) at lines 311 and 315 of lppasswd.c,
	    and in fprintf(...) at line 346. An attacker who fills up
	    the disk at the right moment can arrange for
	    /usr/local/etc/cups/passwd to be truncated.
	    <em>(CAN-2004-1268)</em></p>
	  <p>Second, if lppasswd bumps into a file-size resource limit
	    while writing passwd.new, it leaves passwd.new in place,
	    disabling all subsequent invocations of lppasswd. Any
	    local user can thus disable lppasswd...
	    <em>(CAN-2004-1269)</em></p>
	  <p>Third, line 306 of lppasswd.c prints an error message to
	    stderr but does not exit. This is not a problem on systems
	    that ensure that file descriptors 0, 1, and 2 are open for
	    setuid programs, but it is a problem on other systems;
	    lppasswd does not check that passwd.new is different from
	    stderr, so it ends up writing a user-controlled error
	    message to passwd if the user closes file descriptor
	    2. <em>(CAN-2004-1270)</em></p>
	</blockquote>
	<p><strong>Note:</strong> The third issue, CVE-2004-1270, does
	  not affect FreeBSD 4.6-RELEASE or later systems, as these
	  systems ensure that the file descriptors 0, 1, and 2 are
	  always open for set-user-ID and set-group-ID programs.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2004-1268</cvename>
      <cvename>CVE-2004-1269</cvename>
      <cvename>CVE-2004-1270</cvename>
      <bid>12007</bid>
      <bid>12004</bid>
      <url>http://www.cups.org/str.php?L1023</url>
      <url>http://tigger.uic.edu/~jlongs2/holes/cups2.txt</url>
    </references>
    <dates>
      <discovery>2004-12-11</discovery>
      <entry>2005-01-17</entry>
    </dates>
  </vuln>

  <vuln vid="40a3bca2-6809-11d9-a9e7-0001020eed82">
    <topic>cups-base -- HPGL buffer overflow vulnerability</topic>
    <affects>
      <package>
	<name>cups-base</name>
	<name>fr-cups-base</name>
	<range><lt>1.1.22.0_2</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Ariel Berkman has discovered a buffer overflow
	  vulnerability in CUPS's HPGL input driver.  This
	  vulnerability could be exploited to execute arbitrary code
	  with the permission of the CUPS server by printing a
	  specially crated HPGL file.</p>
      </body>
    </description>
    <references>
      <bid>11968</bid>
      <cvename>CVE-2004-1267</cvename>
      <url>http://tigger.uic.edu/~jlongs2/holes/cups.txt</url>
      <url>http://www.cups.org/str.php?L1024</url>
    </references>
    <dates>
      <discovery>2004-12-15</discovery>
      <entry>2005-01-17</entry>
    </dates>
  </vuln>

  <vuln vid="ce109fd4-67f3-11d9-a9e7-0001020eed82">
    <topic>mysql-scripts -- mysqlaccess insecure temporary file creation</topic>
    <affects>
      <package>
	<name>mysql-scripts</name>
	<range><lt>3.23.58_2</lt></range>
	<range><gt>4.*</gt><lt>4.0.23a_1</lt></range>
	<range><gt>4.1.*</gt><lt>4.1.9_1</lt></range>
	<range><gt>5.*</gt><lt>5.0.2_1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Debian Security Team reports:</p>
	<blockquote>
	  <p>Javier Fernández-Sanguino Peña from the Debian Security
	    Audit Project discovered a temporary file vulnerability in
	    the mysqlaccess script of MySQL that could allow an
	    unprivileged user to let root overwrite arbitrary files
	    via a symlink attack and could also could unveil the
	    contents of a temporary file which might contain sensitive
	    information.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-0004</cvename>
      <url>http://lists.mysql.com/internals/20600</url>
    </references>
    <dates>
      <discovery>2005-01-12</discovery>
      <entry>2005-01-16</entry>
      <modified>2005-01-17</modified>
    </dates>
  </vuln>

  <vuln vid="f2d5e56e-67eb-11d9-a9e7-0001020eed82">
    <topic>unrtf -- buffer overflow vulnerability</topic>
    <affects>
      <package>
	<name>unrtf</name>
	<range><lt>0.19.3_1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Yosef Klein and Limin Wang have found a buffer overflow
	  vulnerability in unrtf that can allow an attacker to execute
	  arbitrary code with the permissions of the user running
	  unrtf, by running unrtf on a specially crafted rtf
	  document.</p>
      </body>
    </description>
    <references>
      <bid>12030</bid>
      <cvename>CVE-2004-1297</cvename>
      <url>http://tigger.uic.edu/~jlongs2/holes/unrtf.txt</url>
    </references>
    <dates>
      <discovery>2004-12-15</discovery>
      <entry>2005-01-16</entry>
      <modified>2005-02-11</modified>
    </dates>
  </vuln>

  <vuln vid="3fbf9db2-658b-11d9-abad-000a95bc6fae">
    <topic>mozilla -- heap overflow in NNTP handler</topic>
    <affects>
      <package>
	<name>de-netscape7</name>
	<name>fr-netscape7</name>
	<name>ja-netscape7</name>
	<name>netscape7</name>
	<name>pt_BR-netscape7</name>
	<range><gt>0</gt></range>
      </package>
      <package>
	<name>mozilla-gtk1</name>
	<name>linux-mozilla</name>
	<name>linux-mozilla-devel</name>
	<range><lt>1.7.5</lt></range>
      </package>
      <package>
	<name>mozilla</name>
	<range><lt>1.7.5,2</lt></range>
      </package>
      <package>
	<!-- These package names are obsolete. -->
	<name>de-linux-netscape</name>
	<name>fr-linux-netscape</name>
	<name>ja-linux-netscape</name>
	<name>linux-netscape</name>
	<name>mozilla+ipv6</name>
	<name>mozilla-embedded</name>
	<name>mozilla-gtk2</name>
	<name>mozilla-gtk</name>
	<range><ge>0</ge></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Maurycy Prodeus reports a critical vulnerability in
	  Mozilla-based browsers:</p>
	<blockquote cite="http://isec.pl/vulnerabilities/isec-0020-mozilla.txt">
	  <p>Mozilla browser supports NNTP urls. Remote side is able to
	    trigger  news:// connection to any server. I found a flaw in
	    NNTP handling code which may cause heap overflow and allow
	    remote attacker to execute arbitrary code on client
	    machine.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2004-1316</cvename>
      <url>http://isec.pl/vulnerabilities/isec-0020-mozilla.txt</url>
      <mlist msgid="Pine.LNX.4.44.0412292228440.19239-200000@isec.pl">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110436284718949</mlist>
    </references>
    <dates>
      <discovery>2004-12-29</discovery>
      <entry>2005-01-13</entry>
    </dates>
  </vuln>

  <vuln vid="3cc84400-6576-11d9-a9e7-0001020eed82">
    <topic>mpg123 -- buffer overflow vulnerability</topic>
    <affects>
      <package>
	<name>mpg123</name>
	<name>mpg123-nas</name>
	<name>mpg123-esound</name>
	<range><lt>0.59r_17</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Yuri D'Elia has found a buffer overflow vulnerability in
	  mpg123's parsing of frame headers in input streams.  This
	  vulnerability can potentially lead to execution of arbitrary
	  code with the permissions of the user running mpg123, if the
	  user runs mpg123 on a specially crafted MP2 or MP3 file.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2004-0991</cvename>
    </references>
    <dates>
      <discovery>2005-01-01</discovery>
      <entry>2005-01-13</entry>
    </dates>
  </vuln>

  <vuln vid="5fe7e27a-64cb-11d9-9e1e-c296ac722cb3">
    <topic>squid -- denial of service with forged WCCP messages</topic>
    <affects>
      <package>
	<name>squid</name>
	<range><lt>2.5.7_6</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The squid patches page notes:</p>
	<blockquote cite="http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-wccp_denial_of_service">
	  <p>WCCP_I_SEE_YOU messages contain a 'number of caches'
	    field which should be between 1 and 32. Values outside
	    that range may crash Squid if WCCP is enabled, and if an
	    attacker can spoof UDP packets with the WCCP router's IP
	    address.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-0095</cvename>
      <url>http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-wccp_denial_of_service</url>
      <url>http://www.squid-cache.org/bugs/show_bug.cgi?id=1190</url>
      <url>http://www.squid-cache.org/Advisories/SQUID-2005_2.txt</url>
    </references>
    <dates>
      <discovery>2005-01-07</discovery>
      <entry>2005-01-12</entry>
      <modified>2005-01-22</modified>
    </dates>
  </vuln>

  <vuln vid="184ab9e0-64cd-11d9-9e1e-c296ac722cb3">
    <topic>squid -- buffer overflow vulnerability in gopherToHTML</topic>
    <affects>
      <package>
	<name>squid</name>
	<range><lt>2.5.7_6</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The squid patches page notes:</p>
	<blockquote cite="http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-gopher_html_parsing">
	  <p>A malicious gopher server may return a response with very
	    long lines that cause a buffer overflow in Squid.</p>
	  <p>Workaround: Since gopher is very obscure these days, do
	    not allow Squid to any gopher servers. Use an ACL rule
	    like:</p>
	  <pre>acl Gopher proto gopher
http_access deny Gopher</pre>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-0094</cvename>
      <url>http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-gopher_html_parsing</url>
      <url>http://www.squid-cache.org/bugs/show_bug.cgi?id=1189</url>
      <url>http://www.squid-cache.org/Advisories/SQUID-2005_1.txt</url>
    </references>
    <dates>
      <discovery>2005-01-11</discovery>
      <entry>2005-01-12</entry>
      <modified>2005-01-22</modified>
    </dates>
  </vuln>

  <vuln vid="131bd7c4-64a3-11d9-829a-000a95bc6fae">
    <topic>libxine -- DVD subpicture decoder heap overflow</topic>
    <affects>
      <package>
	<name>libxine</name>
	<range><lt>1.0.r6</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A xine security announcement states:</p>
	<blockquote cite="http://xinehq.de/index.php/security/XSA-2004-5">
	  <p>A heap overflow has been found in the DVD subpicture
	    decoder of xine-lib. This can be used for a remote heap
	    overflow exploit, which can, on some systems, lead to or
	    help in executing malicious code with the permissions of the
	    user running a xine-lib based media application.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2004-1379</cvename>
      <url>http://xinehq.de/index.php/security/XSA-2004-5</url>
    </references>
    <dates>
      <discovery>2004-09-06</discovery>
      <entry>2005-01-12</entry>
      <modified>2005-01-19</modified>
    </dates>
  </vuln>

  <vuln vid="b6939d5b-64a1-11d9-9106-000a95bc6fae">
    <topic>libxine -- multiple vulnerabilities in VideoCD handling</topic>
    <affects>
      <package>
	<name>libxine</name>
	<range><ge>1.0.r2</ge><lt>1.0.r6</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A xine security announcement states:</p>
	<blockquote cite="http://xinehq.de/index.php/security/XSA-2004-4">
	  <p>Several string overflows on the stack have been fixed in
	    xine-lib, some of them can be used for remote buffer
	    overflow exploits leading to the execution of arbitrary code
	    with the permissions of the user running a xine-lib based
	    media application.</p>
	  <p>Stack-based string overflows have been found:</p>
	  <ol>
	    <li>in the code which handles VideoCD MRLs</li>
	    <li>in VideoCD code reading the disc label</li>
	    <li>in the code which parses text subtitles and prepares
	      them for display</li>
	  </ol>
	</blockquote>
      </body>
    </description>
    <references>
      <url>http://xinehq.de/index.php/security/XSA-2004-4</url>
    </references>
    <dates>
      <discovery>2004-09-07</discovery>
      <entry>2005-01-12</entry>
    </dates>
  </vuln>

  <vuln vid="1b70bef4-649f-11d9-a30e-000a95bc6fae">
    <topic>libxine -- multiple buffer overflows in RTSP</topic>
    <affects>
      <package>
	<name>mplayer</name>
	<name>mplayer-gtk</name>
	<name>mplayer-gtk2</name>
	<name>mplayer-esound</name>
	<name>mplayer-gtk-esound</name>
	<name>mplayer-gtk2-esound</name>
	<range><lt>0.99.4</lt></range>
      </package>
      <package>
	<name>libxine</name>
	<range><lt>1.0.r4</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A xine security announcement states:</p>
	<blockquote cite="http://xinehq.de/index.php/security/XSA-2004-3">
	  <p>Multiple vulnerabilities have been found and fixed in the
	    Real-Time Streaming Protocol (RTSP) client for RealNetworks
	    servers, including a series of potentially remotely
	    exploitable buffer overflows. This is a joint advisory by
	    the MPlayer and xine teams as the code in question is common
	    to these projects.</p>
	  <p>Severity: High (arbitrary remote code execution under the
	    user ID running the player) when playing Real RTSP streams.
	    At this time, there is no known exploit for these
	    vulnerabilities.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2004-0433</cvename>
      <url>http://xinehq.de/index.php/security/XSA-2004-3</url>
      <url>http://xforce.iss.net/xforce/xfdb/16019</url>
      <bid>10245</bid>
    </references>
    <dates>
      <discovery>2004-05-25</discovery>
      <entry>2005-01-12</entry>
    </dates>
  </vuln>

  <vuln vid="8eabaad9-641f-11d9-92a7-000a95bc6fae">
    <topic>hylafax -- unauthorized login vulnerability</topic>
    <affects>
      <package>
	<name>hylafax</name>
	<range><lt>4.2.1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A flaw in HylaFAX may allow an attacker to bypass normal
	  authentication by spoofing their DNS PTR records.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2004-1182</cvename>
      <mlist msgid="20050111155949.GU9853@bilbo.x101.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110546971307585</mlist>
    </references>
    <dates>
      <discovery>2005-01-11</discovery>
      <entry>2005-01-11</entry>
    </dates>
  </vuln>

  <vuln vid="56971fa6-641c-11d9-a097-000854d03344">
    <topic>xshisen -- local buffer overflows</topic>
    <affects>
      <package>
	<name>xshisen</name>
	<range><lt>1.36_1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Steve Kemp has found buffer overflows in the handling
	  of the command line flag -KCONV and the XSHISENLIB environment
	  variable.  Ulf Härnhammer has detected an unbounded copy from
	  the GECOS field to a char array.  All overflows can be exploited
	  to gain group games privileges.</p>
      </body>
    </description>
    <references>
      <url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=213957</url>
      <url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=289784</url>
      <cvename>CVE-2003-1053</cvename>
      <cvename>CVE-2005-0117</cvename>
    </references>
    <dates>
      <discovery>2005-01-11</discovery>
      <entry>2005-01-11</entry>
      <modified>2005-01-19</modified>
    </dates>
  </vuln>

  <vuln vid="0cf3480d-5fdf-11d9-b721-00065be4b5b6">
    <topic>helvis -- arbitrary file deletion problem</topic>
    <affects>
      <package>
	<name>ko-helvis</name>
	<range><le>1.8h2_1</le></range>
      </package>
      <package>
	<name>helvis</name>
	<range><le>1.8h2_1</le></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The setuid root elvprsv utility, used to preserve
	 recovery helvis files, can be abused by local users to delete
	with root privileges.</p>
	<p>The problem is that elvprsv deletes files when it thinks they
	have become corrupt. When elvprsv is pointed to a normal file then
	it will almost always think the file is corrupt and deletes it.
	This behavior may be exploited by local attackers to delete critical
	files.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-0120</cvename>
      <url>http://people.freebsd.org/~niels/ports/korean/helvis/issues.txt</url>
    </references>
    <dates>
      <discovery>2004-11-24</discovery>
      <entry>2005-01-10</entry>
      <modified>2005-01-19</modified>
    </dates>
  </vuln>

  <vuln vid="bb99f803-5fde-11d9-b721-00065be4b5b6">
    <topic>helvis -- information leak vulnerabilities</topic>
    <affects>
      <package>
	<name>ko-helvis</name>
	<range><le>1.8h2_1</le></range>
      </package>
      <package>
	<name>helvis</name>
	<range><le>1.8h2_1</le></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Once a recovery file has been preserved by the setuid root elvprsv
	utility it is placed in a worldreadable directory with worldreadable
	permissions.  This possibly allows sensitive information to leak.</p>
	<p>In addition to this information leak, it is possible for users
	to recover files that belong to other users by using elvrec, another
	setuid root binary.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-0118</cvename>
      <cvename>CVE-2005-0119</cvename>
      <url>http://people.freebsd.org/~niels/ports/korean/helvis/issues.txt</url>
    </references>
    <dates>
      <discovery>2004-11-24</discovery>
      <entry>2005-01-10</entry>
      <modified>2005-01-19</modified>
    </dates>
  </vuln>

  <vuln vid="28ab7ddf-61ab-11d9-a9e7-0001020eed82">
    <topic>dillo -- format string vulnerability</topic>
    <affects>
      <package>
	<name>dillo</name>
	<range><lt>0.8.3_1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>dillo contains a format string vulnerability which could
	  lead to execution of arbitrary code simply by viewing a web
	  page or opening a HTML file.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-0012</cvename>
      <url>http://bugs.gentoo.org/show_bug.cgi?id=76665</url>
    </references>
    <dates>
      <discovery>2005-01-04</discovery>
      <entry>2005-01-08</entry>
    </dates>
  </vuln>

  <vuln vid="f92e1bbc-5e18-11d9-839a-0050da134090">
    <topic>tnftp -- mget does not check for directory escapes</topic>
    <affects>
      <package>
	<name>tnftp</name>
	<range><lt>20050103</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>When downloading a batch of files from an FTP server the
	 mget command does not check for directory escapes.  A
	 specially crafted file on the FTP server could then
	 potentially overwrite an existing file of the user.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2004-1294</cvename>
      <url>http://tigger.uic.edu/~jlongs2/holes/tnftp.txt</url>
      <url>http://cvsweb.netbsd.org/bsdweb.cgi/othersrc/usr.bin/tnftp/src/cmds.c?rev=1.1.1.3&amp;content-type=text/x-cvsweb-markup</url>
      <url>http://it.slashdot.org/article.pl?sid=04/12/15/2113202</url>
      <mlist msgid="653D74053BA6F54A81ED83DCF969DF08CFA2AA@pivxes1.pivx.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110321888413132</mlist>
    </references>
    <dates>
      <discovery>2004-12-15</discovery>
      <entry>2005-01-07</entry>
      <modified>2005-01-13</modified>
    </dates>
  </vuln>

  <vuln vid="8f86d8b5-6025-11d9-a9e7-0001020eed82">
    <topic>tiff -- tiffdump integer overflow vulnerability</topic>
    <affects>
      <package>
	<name>tiff</name>
	<range><lt>3.7.1_2</lt></range>
      </package>
      <package>
	<name>linux-tiff</name>
	<range><lt>3.6.1_1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Dmitry V. Levin found a potential integer overflow in the
	  tiffdump utility which could lead to execution of arbitrary
	  code.  This could be exploited by tricking an user into
	  executing tiffdump on a specially crafted tiff image.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2004-1183</cvename>
    </references>
    <dates>
      <discovery>2005-01-06</discovery>
      <entry>2005-01-06</entry>
      <modified>2005-03-01</modified>
    </dates>
  </vuln>

  <vuln vid="fc7e6a42-6012-11d9-a9e7-0001020eed82">
    <topic>tiff -- directory entry count integer overflow vulnerability</topic>
    <affects>
      <package>
	<name>tiff</name>
	<range><lt>3.7.1</lt></range>
      </package>
      <package>
	<name>linux-tiff</name>
	<range><lt>3.6.1_1</lt></range>
      </package>
      <package>
	<name>pdflib</name>
	<name>pdflib-perl</name>
	<range><lt>6.0.1_1</lt></range>
      </package>
      <package>
	<name>gdal</name>
	<range><lt>1.2.1_2</lt></range>
      </package>
      <package>
	<name>ivtools</name>
	<range><lt>1.2.3</lt></range>
      </package>
      <package>
	<name>paraview</name>
	<range><lt>2.4.3</lt></range>
      </package>
      <package>
	<name>fractorama</name>
	<range><lt>1.6.7_1</lt></range>
      </package>
      <package>
	<name>iv</name>
	<name>ja-iv</name>
	<name>ja-libimg</name>
	<range><gt>0</gt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>In an iDEFENSE Security Advisory infamous41md reports:</p>
	<blockquote cite="http://www.idefense.com/application/poi/display?id=174&amp;type=vulnerabilities">
	  <p>Remote exploitation of a heap-based buffer overflow
	    vulnerability within the LibTIFF package could allow
	    attackers to execute arbitrary code.</p>
	  <p>The vulnerability specifically exists due to insufficient
	    validation of user-supplied data when calculating the size
	    of a directory entry. A TIFF file includes a number of
	    directory entry header fields that describe the data in
	    the file. Included in these entries is an entry count and
	    offset value that are calculated to determine the size and
	    location of the data for that entry.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <bid>12075</bid>
      <cvename>CVE-2004-1308</cvename>
      <url>http://www.idefense.com/application/poi/display?id=174&amp;type=vulnerabilities</url>
      <certvu>125598</certvu>
    </references>
    <dates>
      <discovery>2004-12-17</discovery>
      <entry>2005-01-06</entry>
      <modified>2006-06-08</modified>
    </dates>
  </vuln>

  <vuln vid="14e8f315-600e-11d9-a9e7-0001020eed82">
    <cancelled superseded="3897a2f8-1d57-11d9-bc4a-000c41e2cdad"/>
  </vuln>

  <vuln vid="bd9fc2bf-5ffe-11d9-a11a-000a95bc6fae">
    <topic>vim -- vulnerabilities in modeline handling</topic>
    <affects>
      <package>
	<name>vim</name>
	<name>vim-console</name>
	<name>vim-lite</name>
	<name>vim+ruby</name>
	<range><lt>6.3.45</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Ciaran McCreesh discovered news ways in which a VIM modeline
	  can be used to trojan a text file.  The patch by Bram
	  Moolenaar reads:</p>
	<blockquote cite="ftp://ftp.vim.org/pub/vim/patches/6.3/6.3.045">
	  <p>Problem: Unusual characters in an option value may cause
	    unexpected behavior, especially for a modeline. (Ciaran
	    McCreesh)</p>
	  <p>Solution: Don't allow setting termcap options or
	    'printdevice' or 'titleold' in a modeline. Don't list
	    options for "termcap" and "all" in a modeline. Don't allow
	    unusual characters in 'filetype', 'syntax', 'backupext',
	    'keymap', 'patchmode' and 'langmenu'.</p>
	</blockquote>
	<p><strong>Note:</strong> It is generally recommended that VIM
	  users use <code>set nomodeline</code> in
	  <code>~/.vimrc</code> to avoid the possibility of trojaned
	  text files.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2004-1138</cvename>
      <url>ftp://ftp.vim.org/pub/vim/patches/6.3/6.3.045</url>
      <mlist>http://groups.yahoo.com/group/vimdev/message/38084</mlist>
    </references>
    <dates>
      <discovery>2004-12-09</discovery>
      <entry>2005-01-06</entry>
      <modified>2005-01-13</modified>
    </dates>
  </vuln>

  <vuln vid="58fc2752-5f74-11d9-a9e7-0001020eed82">
    <topic>pcal -- buffer overflow vulnerabilities</topic>
    <affects>
      <package>
	<name>pcal</name>
	<range><lt>4.8.0</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Danny Lungstrom has found two buffer overflow
	  vulnerabilities in pcal which can lead to execution of
	  arbitrary code by making a user run pcal on a specially
	  crafted calendar file.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2004-1289</cvename>
      <bid>12035</bid>
      <bid>12036</bid>
      <mlist msgid="20041215083219.56092.qmail@cr.yp.to">http://securesoftware.list.cr.yp.to/archive/0/46</mlist>
    </references>
    <dates>
      <discovery>2004-12-15</discovery>
      <entry>2005-01-06</entry>
    </dates>
  </vuln>

  <vuln vid="ca9ce879-5ebb-11d9-a01c-0050569f0001">
    <topic>exim -- two buffer overflow vulnerabilities</topic>
    <affects>
      <package>
	<name>exim</name>
	<name>exim-ldap</name>
	<name>exim-ldap2</name>
	<name>exim-mysql</name>
	<name>exim-postgresql</name>
	<name>exim-sa-exim</name>
	<range><lt>4.43+28_1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>1. The function host_aton() can overflow a buffer
	   if it is presented with an illegal IPv6 address
	   that has more than 8 components.</p>
	<p>2. The second report described a buffer overflow
	   in the function spa_base64_to_bits(), which is part
	   of the code for SPA authentication.</p>
      </body>
    </description>
    <references>
      <mlist msgid="Pine.SOC.4.61.0501041452540.1114@draco.cus.cam.ac.uk">http://www.exim.org/mail-archives/exim-announce/2005/msg00000.html</mlist>
      <mlist msgid="1CE07882ECEE894CA2D5A89B8DEBC4011CFDE5@porgy.admin.idefense.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110573573800377</mlist>
      <cvename>CVE-2005-0021</cvename>
      <cvename>CVE-2005-0022</cvename>
      <bid>12185</bid>
      <bid>12188</bid>
      <bid>12268</bid>
    </references>
    <dates>
      <discovery>2005-01-05</discovery>
      <entry>2005-01-05</entry>
      <modified>2005-01-18</modified>
    </dates>
  </vuln>

  <vuln vid="877e918e-5362-11d9-96d4-00065be4b5b6">
    <topic>mpg123 -- playlist processing buffer overflow vulnerability</topic>
    <affects>
      <package>
	<name>mpg123</name>
	<name>mpg123-nas</name>
	<name>mpg123-esound</name>
	<range><le>0.59r_15</le></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A buffer overflow vulnerability exists in the playlist
	  processing of mpg123. A specially crafted playlist entry
	  can cause a stack overflow that can be used to inject
	  arbitrary code into the mpg123 process.</p>
	<p>Note that a malicious playlist, demonstrating this
	  vulnerability, was released by the bug finder and may be
	  used as a template by attackers.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2004-1284</cvename>
      <url>http://tigger.uic.edu/~jlongs2/holes/mpg123.txt</url>
      <url>http://secunia.com/advisories/13511/</url>
      <url>http://xforce.iss.net/xforce/xfdb/18626</url>
      <bid>11958</bid>
      <mlist msgid="653D74053BA6F54A81ED83DCF969DF08CFA2AA@pivxes1.pivx.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110321888413132</mlist>
    </references>
    <dates>
      <discovery>2004-12-15</discovery>
      <entry>2005-01-03</entry>
      <modified>2005-01-13</modified>
    </dates>
  </vuln>

  <vuln vid="bd579366-5290-11d9-ac20-00065be4b5b6">
    <topic>greed -- insecure GRX file processing</topic>
    <affects>
      <package>
	<name>greed</name>
	<range><le>0.81p</le></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A buffer overflow vulnerability has been detected in the greed
	URL handling code. This bug can especially be a problem when greed is
	used to process GRX (GetRight) files that originate from untrusted
	sources.</p>
	<p>The bug finder, Manigandan Radhakrishnan, gave the following
	  description:</p>
	<blockquote cite="http://tigger.uic.edu/~jlongs2/holes/greed.txt">
	  <p>Here are the bugs. First, in main.c, DownloadLoop() uses strcat()
	    to copy an input filename to the end of a 128-byte COMMAND array.
	    Second, DownloadLoop() passes the input filename to system() without
	    checking for special characters such as semicolons.</p></blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2004-1273</cvename>
      <cvename>CVE-2004-1274</cvename>
      <url>http://tigger.uic.edu/~jlongs2/holes/greed.txt</url>
      <url>http://secunia.com/advisories/13534/</url>
      <mlist msgid="653D74053BA6F54A81ED83DCF969DF08CFA2AA@pivxes1.pivx.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110321888413132</mlist>
    </references>
    <dates>
      <discovery>2004-12-15</discovery>
      <entry>2005-01-03</entry>
      <modified>2005-01-13</modified>
    </dates>
  </vuln>

  <vuln vid="949c470e-528f-11d9-ac20-00065be4b5b6">
    <topic>golddig -- local buffer overflow vulnerabilities</topic>
    <affects>
      <package>
	<name>golddig</name>
	<range><le>2.0</le></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Two buffer overflow vulnerabilities where detected. Both issues can
	  be used by local users to gain group games privileges on affected
	  systems.</p>
	<p>The first overflow exists in the map name handling and can be
	  triggered when a very long name is given to the program during
	  command-line execution</p>
	<p>The second overflow exists in the username processing while writing
	  the players score to disk. Excessivly long usernames, set via the USER
	  environment variable, are stored without any length checks in a memory
	  buffer.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-0121</cvename>
      <mlist msgid="200412021055.iB2AtweU067125@repoman.freebsd.org">http://docs.FreeBSD.org/cgi/mid.cgi?200412021055.iB2AtweU067125</mlist>
    </references>
    <dates>
      <discovery>2004-11-11</discovery>
      <entry>2005-01-03</entry>
      <modified>2005-01-19</modified>
    </dates>
  </vuln>

  <vuln vid="927743d4-5ca9-11d9-a9e7-0001020eed82">
    <topic>up-imapproxy -- multiple vulnerabilities</topic>
    <affects>
      <package>
	<name>up-imapproxy</name>
	<range><lt>1.2.4</lt></range>
      </package>
      <package>
	<name>pop3proxy</name>
	<range><le>1.1</le></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Timo Sirainen reports:</p>
	<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=109995749510773">
	  <p>There are various bugs in up-imapproxy which can crash
	    it. Since up-imapproxy runs in a single process with each
	    connection handled in a separate thread, any crash kills
	    all the connections and stops listening for new ones.</p>
	  <p>In 64bit systems it might be possible to make it leak
	    data (mails, passwords, ..) from other connections to
	    attacker's connection. However I don't think up-imapproxy
	    actually works in any 64bit system so this is just a
	    theoretical problem.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2004-1035</cvename>
      <bid>11630</bid>
      <mlist msgid="1099851138.3716.3.camel@hurina">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=109995749510773</mlist>
    </references>
    <dates>
      <discovery>2004-11-17</discovery>
      <entry>2005-01-02</entry>
      <modified>2008-02-27</modified>
    </dates>
  </vuln>

  <vuln vid="832e9d75-5bfc-11d9-a9e7-0001020eed82">
    <topic>kdelibs3 -- konqueror FTP command injection vulnerability</topic>
    <affects>
      <package>
	<name>ja-kdelibs</name>
	<name>kdelibs</name>
	<range><lt>3.3.2_2</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Albert Puigsech Galicia reports that Konqueror (more
	  specifically kio_ftp) and Microsoft Internet Explorer are
	  vulnerable to a FTP command injection vulnerability which
	  can be exploited by tricking an user into clicking a
	  specially crafted FTP URI.</p>
	<p>It is also reported by Ian Gulliver and Emanuele Balla that
	  this vulnerability can be used to tricking a client into
	  sending out emails without user interaction.</p>
      </body>
    </description>
    <references>
      <bid>11827</bid>
      <cvename>CVE-2004-1165</cvename>
      <mlist msgid="200412051011.54045.ripe@7a69ezine.org">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=110245752232681</mlist>
      <mlist msgid="20041223235620.GA2846@penguinhosting.net">http://marc.theaimsgroup.com/?l=full-disclosure&amp;m=110387390226693</mlist>
      <mlist msgid="20041224142506.GB12939@penguinhosting.net">http://marc.theaimsgroup.com/?l=full-disclosure&amp;m=110390734925183</mlist>
      <url>http://www.kde.org/info/security/advisory-20050101-1.txt</url>
    </references>
    <dates>
      <discovery>2004-12-01</discovery>
      <entry>2005-01-01</entry>
      <modified>2005-01-04</modified>
    </dates>
  </vuln>

  <vuln vid="a395397c-c7c8-11d9-9e1e-c296ac722cb3">
    <topic>squid -- possible abuse of cachemgr.cgi</topic>
    <affects>
      <package>
	<name>squid</name>
	<range><lt>2.5.10</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The squid patches page notes:</p>
	<blockquote cite="http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE9-cachemgr_conf">
	  <p>This patch adds access controls to the cachemgr.cgi script,
	    preventing it from being abused to reach other servers than
	    allowed in a local configuration file.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-1999-0710</cvename>
      <url>http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE9-cachemgr_conf</url>
      <url>http://www.squid-cache.org/bugs/show_bug.cgi?id=1094</url>
    </references>
    <dates>
      <discovery>1999-07-29</discovery>
      <entry>2005-05-19</entry>
    </dates>
  </vuln>

  <vuln vid="7e97b288-c7ca-11d9-9e1e-c296ac722cb3">
    <topic>squid -- DNS lookup spoofing vulnerability</topic>
    <affects>
      <package>
	<name>squid</name>
	<range><lt>2.5.10</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The squid patches page notes:</p>
	<blockquote cite="http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE9-dns_query">
	  <p>Malicious users may spoof DNS lookups if the DNS client UDP port
	    (random, assigned by OS as startup) is unfiltered and your network
	    is not protected from IP spoofing.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-1519</cvename>
      <url>http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE9-dns_reply</url>
      <url>http://secunia.com/advisories/15294</url>
    </references>
    <dates>
      <discovery>2005-05-11</discovery>
      <entry>2005-05-19</entry>
    </dates>
  </vuln>

  <vuln vid="55041d37-ff62-11d9-a9a5-000ae4641456">
    <topic>jabberd -- 3 buffer overflows</topic>
    <affects>
      <package>
	<name>jabberd</name>
	<range><lt>2.0.9</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>There are 3 buffer overflows in jid.c that are triggered
	  during parsing of JID strings when components (user, host or
	  resource) are too long.</p>
	<ol>
	  <li>jid.c, line 103: overflow in `str' buffer through
	    <code>strcpy()</code> when "user" part is too long.</li>
	  <li>jid.c, line 115: overflow in `str' buffer through
	    <code>strcpy()</code> when "host" part is too long.</li>
	  <li>jid.c, line 127: overflow in `str' buffer through
	    <code>strcpy()</code> when "resource" part is too
	    long.</li>
	</ol>
	<p>These overflows can be used to perform a DoS attack on the
	  server (sm process segfaults) and can possible be used for
	  arbitrary code execution.</p>
      </body>
    </description>
    <references>
      <url>http://j2.openaether.org/bugzilla/show_bug.cgi?id=99</url>
    </references>
    <dates>
      <discovery>2005-07-25</discovery>
      <entry>2005-07-30</entry>
    </dates>
  </vuln>

  <vuln vid="44e7764c-2614-11da-9e1e-c296ac722cb3">
    <topic>squid -- possible denial of service condition regarding NTLM authentication</topic>
    <affects>
      <package>
	<name>squid</name>
	<range><lt>2.5.10_6</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The squid patches page notes:</p>
	<blockquote cite="http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE10-NTLM-scheme_assert">
	  <p>Squid may crash with the above error [FATAL: Incorrect scheme in
	    auth header] when given certain request sentences.</p>
	  <p>Workaround: disable NTLM authentication.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <bid>14977</bid>
      <cvename>CVE-2005-2917</cvename>
      <url>http://www.squid-cache.org/bugs/show_bug.cgi?id=1391</url>
      <url>http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE10-NTLM-scheme_assert</url>
      <url>http://secunia.com/advisories/16992/</url>
    </references>
    <dates>
      <discovery>2005-09-12</discovery>
      <entry>2005-09-15</entry>
      <modified>2005-10-02</modified>
    </dates>
  </vuln>

  <vuln vid="c6b9aee8-3071-11da-af18-000ae4641456">
    <topic>phpmyfaq -- SQL injection, takeover, path disclosure, remote code execution</topic>
    <affects>
      <package>
	<name>phpmyfaq</name>
	<range><lt>1.5.2</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>If magic quotes are off there's a SQL injection when
	  sending a forgotten password.  It's possible to overwrite
	  the admin password and to take over the whole system.  In
	  some files in the admin section there are some cross site
	  scripting vulnerabilities.  In the public frontend it's
	  possible to include arbitrary php files.</p>
      </body>
    </description>
    <references>
      <bid>14927</bid>
      <bid>14928</bid>
      <bid>14929</bid>
      <bid>14930</bid>
      <cvename>CVE-2005-3046</cvename>
      <cvename>CVE-2005-3047</cvename>
      <cvename>CVE-2005-3048</cvename>
      <cvename>CVE-2005-3049</cvename>
      <cvename>CVE-2005-3050</cvename>
      <url>http://www.phpmyfaq.de/advisory_2005-09-23.php</url>
    </references>
    <dates>
      <discovery>2005-09-23</discovery>
      <entry>2005-09-29</entry>
    </dates>
  </vuln>
