  <vuln vid="f4ff7434-9505-11db-9ddc-0011098b2f36">
    <topic>plone -- user can masquerade as a group</topic>
    <affects>
      <package>
	<name>plone</name>
	<range><gt>2.5</gt><lt>2.5.1_1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Plone.org reports:</p>
	<blockquote cite="http://plone.org/products/plone-hotfix/releases/20061031">
	  <p>PlonePAS-using Plone releases (Plone 2.5 and Plone 2.5.1) has a
	    potential vulnerability that allows a user to masquerade as a group.
	    Please update your sites.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <bid>21460</bid>
      <cvename>CVE-2006-4249</cvename>
      <url>http://plone.org/products/plone-hotfix/releases/20061031</url>
    </references>
    <dates>
      <discovery>2006-11-02</discovery>
      <entry>2006-12-27</entry>
    </dates>
  </vuln>

  <vuln vid="3f851b22-89fb-11db-a937-003048116330">
    <topic>proftpd -- remote code execution vulnerabilities</topic>
    <affects>
      <package>
	<name>proftpd</name>
	<name>proftpd-mysql</name>
	<range><lt>1.3.0_5</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The proftpd development team reports that several
	  remote buffer overflows had been found in the
	  proftpd server.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2006-5815</cvename>
      <cvename>CVE-2006-6170</cvename>
    </references>
    <dates>
      <discovery>2006-11-10</discovery>
      <entry>2006-12-21</entry>
    </dates>
  </vuln>

  <vuln vid="11a84092-8f9f-11db-ab33-000e0c2e438a">
    <topic>gzip -- multiple vulnerabilities</topic>
    <affects>
      <package>
	<name>FreeBSD</name>
	<range><ge>6.1</ge><lt>6.1_7</lt></range>
	<range><ge>6.0</ge><lt>6.0_12</lt></range>
	<range><ge>5.5</ge><lt>5.5_5</lt></range>
	<range><ge>5.4</ge><lt>5.4_19</lt></range>
	<range><ge>5.3</ge><lt>5.3_34</lt></range>
	<range><lt>4.11_22</lt></range>
      </package>
      <package>
	<name>gzip</name>
	<range><lt>1.3.12</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description</h1>
	<p>Multiple programming errors have been found in gzip which
	  can be triggered when gzip is decompressing files.  These
	  errors include insufficient bounds checks in buffer use, a
	  NULL pointer dereference, and a potential infinite loop.</p>
	<h1>Impact</h1>
	<p>The insufficient bounds checks in buffer use can cause gzip
	  to crash, and may permit the execution of arbitrary code.
	  The NULL pointer deference can cause gzip to crash.  The
	  infinite loop can cause a Denial-of-Service situation where
	  gzip uses all available CPU time.</p>
	<h1>Workaround</h1>
	<p>No workaround is available.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2006-4334</cvename>
      <cvename>CVE-2006-4335</cvename>
      <cvename>CVE-2006-4336</cvename>
      <cvename>CVE-2006-4337</cvename>
      <cvename>CVE-2006-4338</cvename>
      <freebsdsa>SA-06:21.gzip</freebsdsa>
    </references>
    <dates>
      <discovery>2006-09-19</discovery>
      <entry>2006-12-19</entry>
      <modified>2016-08-09</modified>
    </dates>
  </vuln>

  <vuln vid="ef3306fc-8f9b-11db-ab33-000e0c2e438a">
    <topic>bind9 -- Denial of Service in named(8)</topic>
    <affects>
      <package>
	<name>FreeBSD</name>
	<range><ge>6.1</ge><lt>6.1_6</lt></range>
	<range><ge>6.0</ge><lt>6.0_11</lt></range>
	<range><ge>5.5</ge><lt>5.5_4</lt></range>
	<range><ge>5.4</ge><lt>5.4_18</lt></range>
	<range><ge>5.0</ge><lt>5.3_33</lt></range>
      </package>
      <package>
	<name>bind9</name>
	<range><ge>9.0</ge><lt>9.3.2.1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description</h1>
	<p>For a recursive DNS server, a remote attacker sending enough
	  recursive queries for the replies to arrive after all the
	  interested clients have left the recursion queue will trigger
	  an INSIST failure in the named(8) daemon.  Also for a
	  recursive DNS server, an assertion failure can occur when
	  processing a query whose reply will contain more than one
	  SIG(covered) RRset.</p>
	<p>For an authoritative DNS server serving a RFC 2535 DNSSEC
	  zone which is queried for the SIG records where there are
	  multiple SIG(covered) RRsets (e.g. a zone apex), named(8)
	  will trigger an assertion failure when it tries to construct
	  the response.</p>
	<h1>Impact</h1>
	<p>An attacker who can perform recursive lookups on a DNS server
	  and is able to send a sufficiently large number of recursive
	  queries, or is able to get the DNS server to return more than
	  one SIG(covered) RRsets can stop the functionality of the DNS
	  service.</p>
	<p>An attacker querying an authoritative DNS server serving a
	  RFC 2535 DNSSEC zone may be able to crash the DNS server.</p>
	<h1>Workaround</h1>
	<p>A possible workaround is to only allow trusted clients to
	  perform recursive queries.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2006-4095</cvename>
      <cvename>CVE-2006-4096</cvename>
      <freebsdsa>SA-06:20.bind</freebsdsa>
    </references>
    <dates>
      <discovery>2006-09-06</discovery>
      <entry>2006-12-19</entry>
      <modified>2016-08-09</modified>
    </dates>
  </vuln>

  <vuln vid="077c2dca-8f9a-11db-ab33-000e0c2e438a">
    <topic>openssl -- Incorrect PKCS#1 v1.5 padding validation in crypto(3)</topic>
    <affects>
      <package>
	<name>FreeBSD</name>
	<range><ge>6.1</ge><lt>6.1_6</lt></range>
	<range><ge>6.0</ge><lt>6.0_11</lt></range>
	<range><ge>5.5</ge><lt>5.5_4</lt></range>
	<range><ge>5.4</ge><lt>5.4_18</lt></range>
	<range><ge>5.3</ge><lt>5.3_33</lt></range>
	<range><lt>4.11_21</lt></range>
      </package>
      <package>
	<name>openssl</name>
	<range><gt>0.9.8</gt><lt>0.9.8c_9</lt></range>
	<range><lt>0.9.7k_0</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description</h1>
	<p>When verifying a PKCS#1 v1.5 signature, OpenSSL ignores any
	  bytes which follow the cryptographic hash being signed.  In
	  a valid signature there will be no such bytes.</p>
	<h1>Impact</h1>
	<p>OpenSSL will incorrectly report some invalid signatures as
	  valid.  When an RSA public exponent of 3 is used, or more
	  generally when a small public exponent is used with a
	  relatively large modulus (e.g., a public exponent of 17 with
	  a 4096-bit modulus), an attacker can construct a signature
	  which OpenSSL will accept as a valid PKCS#1 v1.5 signature.</p>
	<h1>Workaround</h1>
	<p>No workaround is available.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2006-4339</cvename>
      <freebsdsa>SA-06:19.openssl</freebsdsa>
    </references>
    <dates>
      <discovery>2006-09-06</discovery>
      <entry>2006-12-19</entry>
      <modified>2016-08-09</modified>
    </dates>
  </vuln>

  <vuln vid="0679deeb-8eaf-11db-abc9-0003476f14d3">
    <topic>sql-ledger -- multiple vulnerabilities</topic>
    <affects>
      <package>
	<name>sql-ledger</name>
	<range><lt>2.6.22</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Debian security Team reports:</p>
	<blockquote cite="http://www.us.debian.org/security/2006/dsa-1239">
	  <p>Several remote vulnerabilities have been discovered in SQL
	    Ledger, a web based double-entry accounting program, which may
	    lead to the execution of arbitrary code. The Common
	    Vulnerabilities and Exposures project identifies the following
	    problems:</p>
	  <p>Chris Travers discovered that the session management can be
	    tricked into hijacking existing sessions.</p>
	  <p>Chris Travers discovered that directory traversal
	    vulnerabilities can be exploited to execute arbitrary Perl
	    code.</p>
	  <p>It was discovered that missing input sanitising allows
	    execution of arbitrary Perl code.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2006-4244</cvename>
      <cvename>CVE-2006-4731</cvename>
      <cvename>CVE-2006-5872</cvename>
      <url>http://www.us.debian.org/security/2006/dsa-1239</url>
    </references>
    <dates>
      <discovery>2006-12-17</discovery>
      <entry>2006-12-18</entry>
    </dates>
  </vuln>

  <vuln vid="5b47b70d-8ba9-11db-81d5-00123ffe8333">
    <topic>dbus -- match_rule_equal() Weakness</topic>
    <affects>
      <package>
	<name>dbus</name>
	<range><lt>1.0.2</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/23373/">
	  <p>D-Bus have a weakness, which can be exploited by malicious, local
	    users to cause a DoS (Denial of Service).</p>
	  <p>An error within the "match_rule_equal()" function can be
	    exploited to disable the ability of other processes to receive
	    messages by removing their matches from D-Bus.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2006-6107</cvename>
      <url>http://www.freedesktop.org/wiki/Software/dbus</url>
      <url>https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=218055</url>
      <url>http://secunia.com/advisories/23373/</url>
    </references>
    <dates>
      <discovery>2006-12-12</discovery>
      <entry>2006-12-14</entry>
    </dates>
  </vuln>

  <vuln vid="779a2d55-8ba8-11db-81d5-00123ffe8333">
    <topic>evince -- Buffer Overflow Vulnerability</topic>
    <affects>
      <package>
	<name>evince</name>
	<range><lt>0.6.1_1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/23111/">
	  <p>A vulnerability has been discovered in Evince, which can be
	    exploited by malicious people to compromise a user's system.</p>
	  <p>The vulnerability is caused due to a boundary error within the
	    "get_next_text()" function in ps/ps.c. This can be exploited to
	    cause a buffer overflow by e.g. tricking a user into opening a
	    specially crafted PostScript file.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2006-5864</cvename>
      <url>http://secunia.com/advisories/23111/</url>
    </references>
    <dates>
      <discovery>2006-11-27</discovery>
      <entry>2006-12-14</entry>
    </dates>
  </vuln>

  <vuln vid="fefd93d8-8af5-11db-9d01-0016179b2dd5">
    <topic>tdiary -- injection vulnerability</topic>
    <affects>
      <package>
	<name>ja-tdiary</name>
	<name>tdiary</name>
	<range><le>2.0.3</le></range>
      </package>
      <package>
	<name>ja-tdiary-devel</name>
	<name>tdiary-devel</name>
	<range><gt>2.1</gt><lt>2.1.4_2</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>An undisclosed eRuby injection vulnerability had been discovered in
	  tDiary.</p>
      </body>
    </description>
    <references>
     <url>http://sourceforge.net/forum/forum.php?forum_id=642685</url>
    </references>
    <dates>
      <discovery>2006-12-10</discovery>
      <entry>2006-12-13</entry>
      <modified>2007-03-16</modified>
    </dates>
  </vuln>

  <vuln vid="d29dc506-8aa6-11db-bd0d-00123ffe8333">
    <topic>wv -- Multiple Integer Overflow Vulnerabilities</topic>
    <affects>
      <package>
	<name>wv</name>
	<range><lt>1.2.3</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/22595/">
	  <p>Some vulnerabilities have been reported in wvWare, which can be
	    exploited by malicious people to cause a DoS (Denial of Service)
	    and potentially compromise an application using the library.</p>
	  <p>The vulnerabilities are caused due to integer overflows within
	    the "wvGetLFO_records()" and "wvGetLFO_PLF()" functions. These can
	    be exploited to cause heap-based buffer overflows by e.g. tricking
	    a user to open a specially crafted Microsoft Word document with an
	    application using the library.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2006-4513</cvename>
      <url>http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=433</url>
      <url>http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=434</url>
      <url>http://secunia.com/advisories/22595/</url>
    </references>
    <dates>
      <discovery>2006-10-26</discovery>
      <entry>2006-12-13</entry>
    </dates>
  </vuln>

  <vuln vid="b9044cc2-8aa5-11db-bd0d-00123ffe8333">
    <topic>wv2 -- Integer Overflow Vulnerability</topic>
    <affects>
      <package>
	<name>wv2</name>
	<range><lt>0.2.3</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/20665/">
	  <p>A vulnerability has been reported in wvWare wv2 Library, which
	    potentially can be exploited by malicious people to compromise an
	    application using the library.</p>
	  <p>The vulnerability is caused due to an integer overflow error in
	    "word_helper.h" when handling a Word document. This can be
	    exploited to cause a buffer overflow and may allow arbitrary code
	    execution via a specially crafted Word document.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2006-2197</cvename>
      <url>http://secunia.com/advisories/20665/</url>
    </references>
    <dates>
      <discovery>2006-06-12</discovery>
      <entry>2006-12-13</entry>
    </dates>
  </vuln>

  <vuln vid="e969e6cb-8911-11db-9d01-0016179b2dd5">
    <topic>tnftpd -- Remote root Exploit</topic>
    <affects>
      <package>
	<name>tnftpd</name>
	<range><lt>20040810</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The tnftpd port suffer from a remote stack overrun,
	  which can lead to a root compromise.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2006-6652</cvename>
     <url>http://lists.grok.org.uk/pipermail/full-disclosure/2006-December/051009.html</url>
    </references>
    <dates>
      <discovery>2006-12-01</discovery>
      <entry>2006-12-11</entry>
      <modified>2010-05-12</modified>
    </dates>
  </vuln>

  <vuln vid="eb5124a4-8a20-11db-b033-00123ffe8333">
    <topic>clamav -- Multipart Nestings Denial of Service</topic>
    <affects>
      <package>
	<name>clamav</name>
	<range><lt>0.88.7</lt></range>
      </package>
      <package>
	<name>clamav-devel</name>
	<range><le>20061029</le></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/23347/">
	  <p>Clam AntiVirus have a vulnerability, which can be exploited by
	    malicious people to cause a DoS (Denial of Service).</p>
	  <p>The vulnerability is caused due to a stack overflow when scanning
	    messages with deeply nested multipart content. This can be
	    exploited to crash the service by sending specially crafted emails
	    to a vulnerable system.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2006-6481</cvename>
      <url>http://secunia.com/advisories/23347/</url>
      <url>http://www.quantenblog.net/security/virus-scanner-bypass</url>
    </references>
    <dates>
      <discovery>2006-12-06</discovery>
      <entry>2006-12-12</entry>
      <modified>2013-06-19</modified>
    </dates>
  </vuln>

  <vuln vid="1b043693-8617-11db-93b2-000e35248ad7">
    <topic>libxine -- multiple buffer overflow vulnerabilities</topic>
    <affects>
      <package>
	<name>libxine</name>
	<range><lt>1.1.3</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The libxine development team reports that several
	  vulnerabilities had been found in the libxine library. The
	  first vulnerability is caused by improper checking of the
	  src/input/libreal/real.c "real_parse_sdp()" function.
	  A remote attacker could exploit this by tricking an user to
	  connect to a preparated server potentially causing a buffer
	  overflow.  Another buffer overflow had been found in the
	  libmms library, potentially allowing a remote attacker to
	  cause a denial of service vulnerability, and possible remote
	  code execution through the following functions: send_command,
	  string_utf16, get_data and get_media_packets.  Other functions
	  might be affected as well.</p>
      </body>
    </description>
    <references>
      <bid>18608</bid>
      <bid>21435</bid>
      <cvename>CVE-2006-2200</cvename>
      <cvename>CVE-2006-6172</cvename>
      <url>http://sourceforge.net/project/shownotes.php?release_id=468432</url>
    </references>
    <dates>
      <discovery>2006-05-04</discovery>
      <entry>2006-12-07</entry>
      <modified>2006-12-09</modified>
    </dates>
  </vuln>

  <vuln vid="4db1669c-8589-11db-ac4f-02e081235dab">
    <topic>gnupg -- remotely controllable function pointer</topic>
    <affects>
      <package>
	<name>gnupg</name>
	<range><lt>1.4.6</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Werner Koch reports:</p>
	<blockquote cite="http://lists.gnupg.org/pipermail/gnupg-announce/2006q4/000491.html">
	  <p>GnuPG uses data structures called filters to process
	    OpenPGP messages.  These filters are used in a similar
	    way as a pipelines in the shell.  For communication
	    between these filters context structures are used.	These
	    are usually allocated on the stack and passed to the
	    filter functions.  At most places the OpenPGP data stream
	    fed into these filters is closed before the context
	    structure gets deallocated.  While decrypting encrypted
	    packets, this may not happen in all cases and the filter
	    may use a void contest structure filled with garbage.  An
	    attacker may control this garbage.	The filter context
	    includes another context used by the low-level decryption
	    to access the decryption algorithm.  This is done using a
	    function pointer.  By carefully crafting an OpenPGP
	    message, an attacker may control this function pointer and
	    call an arbitrary function of the process.	Obviously an
	    exploit needs to prepared for a specific version,
	    compiler, libc, etc to be successful - but it is
	    definitely doable.</p>
	  <p>Fixing this is obvious: We need to allocate the context on
	    the heap and use a reference count to keep it valid as
	    long as either the controlling code or the filter code
	    needs it.</p>
	  <p>We have checked all other usages of such a stack based
	    filter contexts but fortunately found no other vulnerable
	    places.  This allows to release a relatively small patch.
	    However, for reasons of code cleanness and easier audits
	    we will soon start to change all these stack based filter
	    contexts to heap based ones.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2006-6235</cvename>
      <url>http://lists.gnupg.org/pipermail/gnupg-announce/2006q4/000246.html</url>
      <url>http://secunia.com/advisories/23245/</url>
    </references>
    <dates>
      <discovery>2006-12-04</discovery>
      <entry>2006-12-07</entry>
      <modified>2006-12-15</modified>
    </dates>
  </vuln>

  <vuln vid="a8674c14-83d7-11db-88d5-0012f06707f0">
    <topic>ruby -- cgi.rb library Denial of Service</topic>
    <affects>
      <package>
	<name>ruby</name>
	<name>ruby+pthreads</name>
	<name>ruby+pthreads+oniguruma</name>
	<name>ruby+oniguruma</name>
	<range><ge>1.8.*,1</ge><lt>1.8.5_5,1</lt></range>
      </package>
      <package>
	<name>ruby_static</name>
	<range><ge>1.8.*,1</ge></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The official ruby site reports:</p>
	<blockquote cite="http://www.ruby-lang.org/en/news/2006/12/04/another-dos-vulnerability-in-cgi-library/">
	  <p>Another vulnerability has been discovered in the CGI library
	    (cgi.rb) that ships with Ruby which could be used by a malicious
	    user to create a denial of service attack (DoS).</p>
	  <p>A specific HTTP request for any web application using cgi.rb
	    causes CPU consumption on the machine on which the web application
	    is running. Many such requests result in a denial of service.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2006-6303</cvename>
      <url>http://www.ruby-lang.org/en/news/2006/12/04/another-dos-vulnerability-in-cgi-library/</url>
    </references>
    <dates>
      <discovery>2006-12-04</discovery>
      <entry>2006-12-04</entry>
      <modified>2010-05-12</modified>
    </dates>
  </vuln>

  <vuln vid="ed124f8c-82a2-11db-b46b-0012f06707f0">
    <topic>libmusicbrainz -- multiple buffer overflow vulnerabilities</topic>
    <affects>
      <package>
	<name>libmusicbrainz</name>
	<range><lt>2.1.3</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>SecurityFocus reports about libmusicbrainz:</p>
	<blockquote cite="http://www.securityfocus.com/bid/19508/discuss">
	  <p>The libmusicbrainz library is prone to multiple buffer-overflow
	    vulnerabilities because the application fails to check the size of
	    the data before copying it into a finite-sized internal memory
	    buffer.</p>
	  <p>An attacker can exploit these issues to execute arbitrary code
	    within the context of the application or to cause a
	    denial-of-service condition.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <bid>19508</bid>
      <cvename>CVE-2006-4197</cvename>
      <url>http://www.securityfocus.com/bid/21185/discuss</url>
    </references>
    <dates>
      <discovery>2006-08-17</discovery>
      <entry>2006-12-02</entry>
    </dates>
  </vuln>

  <vuln vid="666b8c9e-8212-11db-851e-0016179b2dd5">
    <topic>tdiary -- cross site scripting vulnerability</topic>
    <affects>
      <package>
	<name>ja-tdiary</name>
	<name>tdiary</name>
	<range><le>2.0.2</le></range>
      </package>
      <package>
	<name>ja-tdiary-devel</name>
	<name>tdiary-devel</name>
	<range><gt>2.1</gt><lt>2.1.4_1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>tDiary was vulnerable to an unspecified Cross-Site
	  Scripting vulnerability</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2006-6174</cvename>
      <url>http://sourceforge.net/forum/forum.php?forum_id=638868</url>
    </references>
    <dates>
      <discovery>2006-11-26</discovery>
      <entry>2006-12-02</entry>
      <modified>2010-05-12</modified>
    </dates>
  </vuln>

  <vuln vid="18e3a5be-81f9-11db-95a2-0012f06707f0">
    <topic>ImageMagick -- SGI Image File heap overflow vulnerability</topic>
    <affects>
      <package>
	<name>ImageMagick</name>
	<name>ImageMagick-nox11</name>
	<range><ge>6.0.0</ge><lt>6.2.9</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>SecurityFocus reports about ImageMagick:</p>
	<blockquote cite="http://www.securityfocus.com/bid/21185/info">
	  <p>ImageMagick is prone to a remote heap-based buffer-overflow
	    vulnerability because the application fails to properly
	    bounds-check user-supplied input before copying it to an
	    insufficiently sized memory buffer.</p>
	  <p>Exploiting this issue allows attackers to execute arbitrary
	    machine code in the context of applications that use the
	    ImageMagick library.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <bid>21185</bid>
      <cvename>CVE-2006-5868</cvename>
      <url>http://www.securityfocus.com/bid/21185/discuss</url>
    </references>
    <dates>
      <discovery>2006-11-14</discovery>
      <entry>2006-12-02</entry>
    </dates>
  </vuln>

  <vuln vid="3dd7eb58-80ae-11db-b4ec-000854d03344">
    <topic>gtar -- GNUTYPE_NAMES directory traversal vulnerability</topic>
    <affects>
      <package>
	<name>gtar</name>
	<range><lt>1.16_2</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Teemu Salmela reports:</p>
	<blockquote cite="http://archives.neohapsis.com/archives/fulldisclosure/2006-11/0344.html">
	  <p>There is a tar record type, called GNUTYPE_NAMES (an
	    obsolete GNU extension), that allows the creation of
	    symbolic links pointing to arbitrary locations in the
	    filesystem, which makes it possible to create/overwrite
	    arbitrary files.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <bid>21235</bid>
      <cvename>CVE-2006-6097</cvename>
      <url>http://archives.neohapsis.com/archives/fulldisclosure/2006-11/0344.html</url>
    </references>
    <dates>
      <discovery>2006-11-21</discovery>
      <entry>2006-11-30</entry>
    </dates>
  </vuln>

  <vuln vid="a8af7d70-8007-11db-b280-0008743bf21a">
    <topic>kronolith -- arbitrary local file inclusion vulnerability</topic>
    <affects>
      <package>
	<name>kronolith</name>
	<range><lt>2.1.4</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>iDefense Labs reports:</p>
	<blockquote cite="http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=445">
	  <p>Remote exploitation of a design error in Horde's Kronolith
	    could allow an authenticated web mail user to execute
	    arbitrary PHP code under the security context of the running
	    web server.</p>
	  <p>The vulnerability specifically exists due to a design error in the
	    way it includes certain files. Specifically, the 'lib/FBView.php'
	    file contains a function 'Kronolith_FreeBusy_View::factory' which
	    will include local files that are supplied via the 'view' HTTP GET
	    request parameter.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <url>http://lists.horde.org/archives/announce/2006/000307.html</url>
    </references>
    <dates>
      <discovery>2006-11-29</discovery>
      <entry>2006-11-30</entry>
    </dates>
  </vuln>

  <vuln vid="34c93ae8-7e6f-11db-bf00-02e081235dab">
    <topic>gnupg -- buffer overflow</topic>
    <affects>
      <package>
	<name>gnupg</name>
	<range><lt>1.4.5_1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Werner Koch reports:</p>
	<blockquote cite="http://lists.gnupg.org/pipermail/gnupg-announce/2006q4/000241.html">
	  <p>When running GnuPG interactively, special crafted
	    messages may be used to crash gpg or gpg2.	Running gpg in
	    batch mode, as done by all software using gpg as a backend
	    (e.g. mailers), is not affected by this bug.</p>
	  <p>Exploiting this overflow seems to be possible.</p>
	  <p>gpg-agent, gpgsm, gpgv or other tools from the GnuPG
	    suite are not affected.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <url>http://lists.gnupg.org/pipermail/gnupg-announce/2006q4/000241.html</url>
    </references>
    <dates>
      <discovery>2006-11-27</discovery>
      <entry>2006-11-27</entry>
    </dates>
  </vuln>

  <vuln vid="cca97f5f-7435-11db-91de-0008743bf21a">
    <topic>proftpd -- Remote Code Execution Vulnerability</topic>
    <affects>
      <package>
	<name>proftpd</name>
	<name>proftpd-mysql</name>
	<range><le>1.3.0_2</le></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>FrSIRT reports:</p>
	<blockquote cite="http://www.frsirt.com/english/advisories/2006/4451">
	  <p>A vulnerability has been identified in ProFTPD, which could be
	    exploited by attackers to cause a denial of service or execute
	    arbitrary commands. This flaw is due to a buffer overflow error
	    in the "main.c" file where the "cmd_buf_size" size of the buffer
	    used to handle FTP commands sent by clients is not properly set
	    to the size configured via the "CommandBufferSize" directive,
	    which could be exploited by attackers to compromise a vulnerable
	    server via a specially crafted FTP command.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <url>http://www.frsirt.com/english/advisories/2006/4451</url>
    </references>
    <dates>
      <discovery>2006-11-10</discovery>
      <entry>2006-11-14</entry>
      <modified>2006-11-15</modified>
    </dates>
  </vuln>

  <vuln vid="5a945904-73b1-11db-91d2-0002a5c2f4ef">
    <topic>unzoo -- Directory Traversal Vulnerability</topic>
    <affects>
      <package>
	<name>unzoo</name>
	<range><lt>4.4_1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/12857/">
	  <p>Doubles has discovered a vulnerability in Unzoo, which
	    potentially can be exploited by malicious people to
	    compromise a user's system.</p>
	  <p>The vulnerability is caused due to an input validation error
	    when unpacking archives. This can be exploited via a
	    directory traversal attack to overwrite files outside the
	    directory, where the files are extracted to, if a user is
	    tricked into extracting a malicious archive using Unzoo.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <bid>11417</bid>
      <url>http://secunia.com/advisories/12857/</url>
      <url>http://securitytracker.com/alerts/2004/Oct/1011673.html</url>
    </references>
    <dates>
      <discovery>2004-10-18</discovery>
      <entry>2006-11-14</entry>
      <modified>2006-12-15</modified>
    </dates>
  </vuln>

  <vuln vid="6d68618a-7199-11db-a2ad-000c6ec775d9">
    <topic>bugzilla -- multiple vulnerabilities</topic>
    <affects>
      <package>
	<name>bugzilla</name>
	<name>ja-bugzilla</name>
	<range><gt>2.*</gt><lt>2.22.1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A Bugzilla Security Advisory reports:</p>
	<blockquote cite="http://www.bugzilla.org/security/2.18.5/">
	  <ul>
	    <li>Sometimes the information put into the &lt;h1&gt; and
	      &lt;h2&gt; tags in Bugzilla was not properly escaped,
	      leading to a possible XSS vulnerability.</li>
	    <li>Bugzilla administrators were allowed to put raw,
	      unfiltered HTML into many fields in Bugzilla, leading to
	      a possible XSS vulnerability.  Now, the HTML allowed in
	      those fields is limited.</li>
	    <li>attachment.cgi could leak the names of private
	      attachments</li>
	    <li>The "deadline" field was visible in the XML format of
	      a bug, even to users who were not a member of the
	      "timetrackinggroup."</li>
	    <li>A malicious user could pass a URL to an admin, and
	      make the admin delete or change something that he had
	      not intended to delete or change.</li>
	    <li>It is possible to inject arbitrary HTML into the
	      showdependencygraph.cgi page, allowing for a cross-site
	      scripting attack.</li>
	  </ul>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2006-5453</cvename>
      <cvename>CVE-2006-5454</cvename>
      <cvename>CVE-2006-5455</cvename>
      <url>http://www.bugzilla.org/security/2.18.5/</url>
    </references>
    <dates>
      <discovery>2006-10-15</discovery>
      <entry>2006-11-11</entry>
    </dates>
  </vuln>

  <vuln vid="92442c4b-6f4a-11db-bd28-0012f06707f0">
    <topic>Imlib2 -- multiple image file processing vulnerabilities</topic>
    <affects>
      <package>
	<name>imlib2</name>
	<range><lt>20060926_1,1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/22732/">
	  <p>Some vulnerabilities have been reported in imlib2, which can be
	    exploited by malicious people to cause a DoS (Denial of Service)
	    or potentially compromise an application using the library.</p>
	  <p>The vulnerabilities are caused due to unspecified errors within
	    the processing of JPG, ARGB, PNG, LBM, PNM, TIFF, and TGA images.
	    This may be exploited to execute arbitrary code by e.g. tricking a
	    user into opening a specially crafted image file with an
	    application using imlib2.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <bid>20903</bid>
      <cvename>CVE-2006-4806</cvename>
      <cvename>CVE-2006-4807</cvename>
      <cvename>CVE-2006-4808</cvename>
      <cvename>CVE-2006-4809</cvename>
    </references>
    <dates>
      <discovery>2006-11-03</discovery>
      <entry>2006-11-08</entry>
    </dates>
  </vuln>

  <vuln vid="ab8dbe98-6be4-11db-ae91-0012f06707f0">
    <topic>ruby -- cgi.rb library Denial of Service</topic>
    <affects>
      <package>
	<name>ruby</name>
	<name>ruby+pthreads</name>
	<name>ruby+pthreads+oniguruma</name>
	<name>ruby+oniguruma</name>
	<range><ge>1.8.*,1</ge><lt>1.8.5_4,1</lt></range>
      </package>
      <package>
	<name>ruby_static</name>
	<range><ge>1.8.*,1</ge></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Official ruby site reports:</p>
	<blockquote cite="http://www.ruby-lang.org/en/news/2006/11/03/CVE-2006-5467/">
	  <p>A vulnerability has been discovered in the CGI library (cgi.rb)
	    that ships with Ruby which could be used by a malicious user to
	    create a denial of service attack (DoS). The problem is triggered
	    by sending the library an HTTP request that uses multipart MIME
	    encoding and as an invalid boundary specifier that begins with
	    "-" instead of "--". Once triggered it will
	    exhaust all available memory resources effectively creating a DoS
	    condition.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <bid>20777</bid>
      <cvename>CVE-2006-5467</cvename>
      <url>http://rubyforge.org/pipermail/mongrel-users/2006-October/001946.html</url>
    </references>
    <dates>
      <discovery>2006-10-25</discovery>
      <entry>2006-11-04</entry>
      <modified>2006-12-15</modified>
    </dates>
  </vuln>

  <vuln vid="b318dc8c-6756-11db-83c3-000c6ec775d9">
    <topic>screen -- combined UTF-8 characters vulnerability</topic>
    <affects>
      <package>
	<name>screen</name>
	<range><lt>4.0.3</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A vulnerability in the handling of combined UTF-8
	  characters in screen may allow an user-assisted attacker to
	  crash screen or potentially allow code execution as the user
	  running screen.  To exploit this issue the user running
	  scren must in some way interact with the attacker.</p>
      </body>
    </description>
    <references>
      <bid>20727</bid>
      <cvename>CVE-2006-4573</cvename>
      <mlist>http://lists.gnu.org/archive/html/screen-users/2006-10/msg00028.html</mlist>
      <url>https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=212056</url>
    </references>
    <dates>
      <discovery>2006-10-23</discovery>
      <entry>2006-10-29</entry>
    </dates>
  </vuln>

  <vuln vid="a9c51caf-6603-11db-ab90-000e35fd8194">
    <topic>mysql -- database suid privilege escalation</topic>
    <affects>
      <package>
	<name>mysql-server</name>
	<range><ge>5.1</ge><lt>5.1.12</lt></range>
	<range><ge>5.0</ge><lt>5.0.25</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Dmitri Lenev reports a privilege escalation in
	  MySQL.  MySQL evaluates arguments of suid routines in the
	  security context of the routine's definer instead of the
	  routine's caller, which allows remote and local
	  authenticated users to gain privileges through a routine
	  that has been made available using GRANT EXECUTE.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2006-4227</cvename>
      <url>http://bugs.mysql.com/bug.php?id=18630</url>
    </references>
    <dates>
      <discovery>2006-03-29</discovery>
      <entry>2006-10-29</entry>
      <modified>2006-10-30</modified>
    </dates>
  </vuln>

  <vuln vid="a0e92718-6603-11db-ab90-000e35fd8194">
    <topic>mysql -- database "case-sensitive" privilege escalation</topic>
    <affects>
      <package>
	<name>mysql-server</name>
	<range><ge>5.1</ge><lt>5.1.12</lt></range>
	<range><ge>5.0</ge><lt>5.0.25</lt></range>
	<range><lt>4.1.21</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Michal Prokopiuk reports a privilege escalation in MySQL.
	  The vulnerability causes MySQL, when run on case-sensitive
	  filesystems, to allow remote and local authenticated users
	  to create or access a database when the database name
	  differs only in case from a database for which they have
	  permissions.</p>
      </body>
    </description>
    <references>
      <bid>19559</bid>
      <cvename>CVE-2006-4226</cvename>
      <url>http://bugs.mysql.com/bug.php?id=17647</url>
    </references>
    <dates>
      <discovery>2006-08-09</discovery>
      <entry>2006-10-29</entry>
    </dates>
  </vuln>

  <vuln vid="96ed277b-60e0-11db-ad2d-0016179b2dd5">
    <topic>Serendipity -- XSS Vulnerabilities</topic>
    <affects>
      <package>
	<name>serendipity</name>
	<range><lt>1.0.1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Serendipity Team reports:</p>
	<blockquote cite="http://blog.s9y.org/archives/147-Serendipity-1.0.2-and-1.1-beta5-released.html">
	  <p>Serendipity failed to correctly sanitize user input on the
	    media manager administration page. The content of GET variables
	    were written into JavaScript strings. By using standard string
	    evasion techniques it was possible to execute arbitrary
	    JavaScript.</p>
	  <p>Additionally Serendipity dynamically created a HTML form on
	    the media manager administration page that contained all
	    variables found in the URL as hidden fields. While the variable
	    values were correctly escaped it was possible to break out
	    by specifying strange variable names.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <url>http://www.hardened-php.net/advisory_112006.136.htmlSerendipity</url>
      <url>http://secunia.com/advisories/22501/</url>
    </references>
    <dates>
      <discovery>2006-10-19</discovery>
      <entry>2006-10-21</entry>
    </dates>
  </vuln>

  <vuln vid="d8fbf13a-6215-11db-a59e-0211d85f11fb">
    <topic>kdelibs -- integer overflow in khtml</topic>
    <affects>
      <package>
	<name>kdelibs</name>
	<name>kdelibs-nocups</name>
	<range><lt>3.5.4_4</lt></range>
      </package>
      <package>
	<name>qt</name>
	<name>qt-copy</name>
	<range><lt>3.3.6_3</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Red Hat reports:</p>
	<blockquote cite="http://rhn.redhat.com/errata/RHSA-2006-0720.html">
	  <p>An integer overflow flaw was found in the way Qt handled pixmap
	    images. The KDE khtml library uses Qt in such a way that untrusted
	    parameters could be passed to Qt, triggering the overflow.
	    An attacker could for example create a malicious web page that when
	    viewed by a victim in the Konqueror browser would cause Konqueror
	    to crash or possibly execute arbitrary code with the privileges of
	    the victim.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2006-4811</cvename>
      <url>http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=210742</url>
      <url>http://rhn.redhat.com/errata/RHSA-2006-0720.html</url>
    </references>
    <dates>
      <discovery>2006-10-14</discovery>
      <entry>2006-10-22</entry>
    </dates>
  </vuln>

  <vuln vid="4867ae85-608d-11db-8faf-000c6ec775d9">
    <topic>opera -- URL parsing heap overflow vulnerability</topic>
    <affects>
      <package>
	<name>opera</name>
	<name>opera-devel</name>
	<name>linux-opera</name>
	<range><gt>9.*</gt><lt>9.02</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>iDefense Labs reports:</p>
	<blockquote cite="http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=424">
	  <p>Remote exploitation of a heap overflow vulnerability
	    within version 9 of Opera Software's Opera Web browser
	    could allow an attacker to execute arbitrary code on the
	    affected host.</p>
	  <p>A flaw exists within Opera when parsing a tag that
	    contains a URL. A heap buffer with a constant size of 256
	    bytes is allocated to store the URL, and the tag's URL is
	    copied into this buffer without sufficient bounds checking
	    of its length.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2006-4819</cvename>
      <url>http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=424</url>
      <url>http://secunia.com/advisories/22218/</url>
      <url>http://www.opera.com/support/search/supsearch.dml?index=848</url>
    </references>
    <dates>
      <discovery>2006-10-17</discovery>
      <entry>2006-10-20</entry>
    </dates>
  </vuln>

  <vuln vid="1c0def84-5fb1-11db-b2e9-0008c79fa3d2">
    <topic>asterisk -- remote heap overwrite vulnerability</topic>
    <affects>
      <package>
	<name>asterisk</name>
	<name>asterisk-bristuff</name>
	<range><lt>1.2.13</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Adam Boileau of Security-Assessment.com reports:</p>
	<blockquote cite="http://www.security-assessment.com/files/advisories/Asterisk_remote_heap_overflow.pdf">
	  <p>The Asterisk Skinny channel driver for Cisco SCCP phones
	    (chan_skinny.so) incorrectly validates a length value in
	    the packet header.	An integer wrap-around leads to heap
	    overwrite, and arbitrary remote code execution as root.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <url>http://www.security-assessment.com/files/advisories/Asterisk_remote_heap_overflow.pdf</url>
      <mlist msgid="4536A2F2.2020902@security-assessment.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=116121567530170</mlist>
    </references>
    <dates>
      <discovery>2006-10-17</discovery>
      <entry>2006-10-20</entry>
    </dates>
  </vuln>

  <vuln vid="b6c18956-5fa3-11db-ad2d-0016179b2dd5">
    <topic>plone -- unprotected MembershipTool methods</topic>
    <affects>
      <package>
	<name>plone</name>
	<range><lt>2.1.2</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Plone Team reports:</p>
	<blockquote cite="http://dev.plone.org/plone/ticket/5432">
	  <p>Plone 2.0.5, 2.1.2, and 2.5-beta1 does not restrict
	    access to the:</p>
	  <ul>
	    <li>changeMemberPortrait</li>
	    <li>deletePersonalPortrait</li>
	    <li>testCurrentPassword</li>
	  </ul>
	  <p>methods, which allows remote attackers to modify portraits.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2006-1711</cvename>
      <url>http://plone.org/products/plone/releases/2.1.4</url>
      <url>https://svn.plone.org/svn/plone/PloneHotfix20060410/trunk/README.txt</url>
    </references>
    <dates>
      <discovery>2006-10-19</discovery>
      <entry>2006-10-19</entry>
      <modified>2006-10-20</modified>
    </dates>
  </vuln>

  <vuln vid="19207592-5f17-11db-ae08-0008743bf21a">
    <topic>drupal -- HTML attribute injection</topic>
    <affects>
      <package>
	<name>drupal</name>
	<range><lt>4.6.10</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Drupal Team reports:</p>
	<blockquote cite="http://drupal.org/files/sa-2006-026/advisory.txt">
	  <p>A malicious user may entice users to visit a specially
	    crafted URL that may result in the redirection of Drupal
	    form submission to a third-party site. A user visiting the
	    user registration page via such a url, for example, will
	    submit all data, such as his/her e-mail address, but also
	    possible private profile data, to a third-party site.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <url>http://drupal.org/files/sa-2006-026/advisory.txt</url>
      <url>http://drupal.org/drupal-4.7.4</url>
    </references>
    <dates>
      <discovery>2006-10-18</discovery>
      <entry>2006-10-18</entry>
    </dates>
  </vuln>

  <vuln vid="937d5911-5f16-11db-ae08-0008743bf21a">
    <topic>drupal -- cross site request forgeries</topic>
    <affects>
      <package>
	<name>drupal</name>
	<range><lt>4.6.10</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Drupal Team reports:</p>
	<blockquote cite="http://drupal.org/files/sa-2006-025/advisory.txt">
	  <p>Visiting a specially crafted page, anywhere on the web, may
	    allow that page to post forms to a Drupal site in the
	    context of the visitor's session. To illustrate; suppose
	    one has an active user 1 session, the most powerful
	    administrator account for a site, to a Drupal site while
	    visiting a website created by an attacker. This website
	    will now be able to submit any form to the Drupal site with
	    the privileges of user 1, either by enticing the user to
	    submit a form or by automated means.</p>
	  <p>An attacker can exploit this vulnerability by changing
	    passwords, posting PHP code or creating new users, for
	    example. The attack is only limited by the privileges of
	    the session it executes in.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <url>http://drupal.org/files/sa-2006-025/advisory.txt</url>
      <url>http://drupal.org/drupal-4.7.4</url>
    </references>
    <dates>
      <discovery>2006-10-18</discovery>
      <entry>2006-10-18</entry>
    </dates>
  </vuln>

  <vuln vid="b2383758-5f15-11db-ae08-0008743bf21a">
    <topic>drupal -- multiple XSS vulnerabilities</topic>
    <affects>
      <package>
	<name>drupal</name>
	<range><lt>4.6.10</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Drupal Team reports:</p>
	<blockquote cite="http://drupal.org/files/sa-2006-024/advisory.txt">
	  <p>A bug in input validation and lack of output validation
	    allows HTML and script insertion on several pages.</p>
	  <p>Drupal's XML parser passes unescaped data to watchdog
	    under certain circumstances. A malicious user may execute
	    an XSS attack via a specially crafted RSS feed. This
	    vulnerability exists on systems that do not use PHP's
	    mb_string extension (to check if mb_string is being used,
	    navigate to admin/settings and look under "String
	    handling"). Disabling the aggregator module provides an
	    immediate workaround.</p>
	  <p>The aggregator module, profile module, and forum module do
	    not properly escape output of certain fields.</p>
	  <p>Note: XSS attacks may lead to administrator access if
	    certain conditions are met.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <url>http://drupal.org/files/sa-2006-024/advisory.txt</url>
      <url>http://drupal.org/drupal-4.7.4</url>
    </references>
    <dates>
      <discovery>2006-10-18</discovery>
      <entry>2006-10-18</entry>
    </dates>
  </vuln>

  <vuln vid="18a14baa-5ee5-11db-ae08-0008743bf21a">
    <topic>ingo -- local arbitrary shell command execution</topic>
    <affects>
      <package>
	<name>ingo</name>
	<range><lt>1.1.2</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Horde team reports a vulnerability within Ingo, the
	  filter management suite. The vulnerability is caused due to
	  inadequete escaping, possibly allowing a local user to execute
	  arbitrary shell commands via procmail.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2006-5449</cvename>
      <url>http://bugs.horde.org/ticket/?id=4513</url>
      <url>http://cvs.horde.org/diff.php/ingo/docs/CHANGES?r1=1.55.2.49&amp;r2=1.55.2.59&amp;ty=h</url>
      <url>http://lists.horde.org/archives/announce/2006/000296.html</url>
    </references>
    <dates>
      <discovery>2006-10-18</discovery>
      <entry>2006-10-18</entry>
      <modified>2010-05-12</modified>
    </dates>
  </vuln>

  <vuln vid="a6d9da4a-5d5e-11db-8faf-000c6ec775d9">
    <topic>NVIDIA UNIX driver -- arbitrary root code execution vulnerability</topic>
    <affects>
      <package>
	<name>nvidia-driver</name>
	<range><ge>1.0.8762</ge><lt>1.0.8776</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Rapid7 reports:</p>
	<blockquote cite="http://www.rapid7.com/advisories/R7-0025.jsp">
	  <p>The NVIDIA Binary Graphics Driver for Linux is vulnerable
	    to a buffer overflow that allows an attacker to run
	    arbitrary code as root. This bug can be exploited both
	    locally or remotely (via a remote X client or an X client
	    which visits a malicious web page).  A working
	    proof-of-concept root exploit is included with this
	    advisory.</p>
	  <p>The NVIDIA drivers for Solaris and FreeBSD are also
	    likely to be vulnerable.</p>
	</blockquote>
	<p>Disabling Render acceleration in the "nvidia" driver, via
	  the "RenderAccel" X configuration option, can be used as a
	  workaround for this issue.</p>
      </body>
    </description>
    <references>
      <certvu>147252</certvu>
      <cvename>CVE-2006-5379</cvename>
      <url>http://nvidia.custhelp.com/cgi-bin/nvidia.cfg/php/enduser/std_adp.php?p_faqid=1971</url>
      <url>http://secunia.com/advisories/22419/</url>
      <url>http://www.rapid7.com/advisories/R7-0025.jsp</url>
    </references>
    <dates>
      <discovery>2006-10-16</discovery>
      <entry>2006-10-16</entry>
      <modified>2006-10-21</modified>
    </dates>
  </vuln>

  <vuln vid="8012a79d-5d21-11db-bb8d-00123ffe8333">
    <topic>clamav -- CHM unpacker and PE rebuilding vulnerabilities</topic>
    <affects>
      <package>
	<name>clamav</name>
	<range><lt>0.88.5</lt></range>
      </package>
      <package>
	<name>clamav-devel</name>
	<range><le>20060922</le></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/22370/">
	  <p>Two vulnerabilities have been reported in Clam AntiVirus, which
	    potentially can be exploited by malicious people to cause a DoS
	    (Denial of Service) or compromise a vulnerable system.</p>
	  <p>1) An unspecified error in the CHM unpacker in chmunpack.c can be
	    exploited to cause a DoS.</p>
	  <p>2) An unspecified error in rebuildpe.c when rebuilding PE files
	    after unpacking can be exploited to cause a heap-based buffer
	    overflow.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <url>http://secunia.com/advisories/22370/</url>
      <url>http://lurker.clamav.net/message/20061016.015114.dc6a8930.en.html</url>
      <url>http://sourceforge.net/project/shownotes.php?release_id=455799</url>
    </references>
    <dates>
      <discovery>2006-10-15</discovery>
      <entry>2006-10-16</entry>
    </dates>
  </vuln>

  <vuln vid="93ba13f8-5c41-11db-a5ae-00508d6a62df">
    <topic>tkdiff -- temporary file symlink privilege escalation</topic>
    <affects>
      <package>
	<name>tkdiff</name>
	<range><lt>4.1.1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Javier Fernández-Sanguino Peña reports a vulnerability in
	  tkdiff which allows local users to gain priveleges of the
	  user running tkdiff due to insecure temporary file creation.</p>
      </body>
    </description>
    <references>
      <url>http://www.debian.org/security/2005/dsa-927</url>
      <cvename>CVE-2005-3343</cvename>
      <bid>16064</bid>
      <url>http://secunia.com/advisories/18083</url>
    </references>
    <dates>
      <discovery>2005-12-20</discovery>
      <entry>2006-10-15</entry>
    </dates>
  </vuln>

  <vuln vid="2c8a84d9-5bee-11db-a5ae-00508d6a62df">
    <topic>vtiger -- multiple remote file inclusion vulnerabilities</topic>
    <affects>
      <package>
	<name>vtiger</name>
	<range><lt>5.0</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Dedi Dwianto a.k.a the_day reports:</p>
	<blockquote cite="http://www.milw0rm.com/exploits/2508">
	  <p>Input passed to the "$calpath" parameter in update.php is
	    not properly verified before being used. This can be
	    exploited to execute arbitrary PHP code by including files
	    from local or external resources.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2006-5289</cvename>
      <bid>20435</bid>
      <mlist msgid="20061009094328.15530.qmail@securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=116049557032343</mlist>
      <url>http://advisories.echo.or.id/adv/adv54-theday-2006.txt</url>
    </references>
    <dates>
      <discovery>2006-10-09</discovery>
      <entry>2006-10-15</entry>
    </dates>
  </vuln>

  <vuln vid="5c9a2769-5ade-11db-a5ae-00508d6a62df">
    <topic>google-earth -- heap overflow in the KML engine</topic>
    <affects>
      <package>
	<name>google-earth</name>
	<range><lt>4.0.2414</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>JAAScois reports:</p>
	<p>While processing KML/KMZ data Google Earth fails to verify
	  its size prior to copying it into a fixed-sized buffer.
	  This can be exploited as a buffer-overflow vulnerability to
	  cause the application to crash and/or to execute arbitrary
	  code.</p>
      </body>
    </description>
    <references>
      <bid>20464</bid>
      <url>http://www.jaascois.com/exploits/18602024/</url>
    </references>
    <dates>
      <discovery>2006-10-10</discovery>
      <entry>2006-10-14</entry>
      <modified>2007-04-13</modified>
    </dates>
  </vuln>

  <vuln vid="72f21372-55e4-11db-a5ae-00508d6a62df">
    <topic>torrentflux -- User-Agent XSS Vulnerability</topic>
    <affects>
      <package>
	<name>torrentflux</name>
	<range><ge>0</ge></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<blockquote cite="http://www.stevenroddis.com.au/2006/10/06/torrentflux-user-agent-xss-vulnerability/">
	  <p>Steven Roddis reports that User-Agent string is not
	    properly escaped when handled by torrentflux. This allows
	    for arbitrary code insertion.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <bid>20371</bid>
      <cvename>CVE-2006-5227</cvename>
      <url>http://www.stevenroddis.com.au/2006/10/06/torrentflux-user-agent-xss-vulnerability/</url>
      <url>http://secunia.com/advisories/22293/</url>
    </references>
    <dates>
      <discovery>2006-09-30</discovery>
      <entry>2006-10-07</entry>
      <modified>2006-10-15</modified>
    </dates>
  </vuln>

  <vuln vid="fe83eb5b-55e1-11db-a5ae-00508d6a62df">
    <topic>python -- buffer overrun in repr() for unicode strings</topic>
    <affects>
      <package>
	<name>python+ipv6</name>
	<range><ge>0</ge></range>
      </package>
      <package>
	<name>python</name>
	<range><lt>2.4.3_1</lt></range>
	<range><gt>2.5.*</gt><lt>2.5.c2</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Benjamin C. Wiley Sittler reports:</p>
	<blockquote cite="https://launchpad.net/distros/ubuntu/+source/python2.4/+bug/56633">
	  <p>I discovered a [buffer overrun in repr() for unicode
	    strings]. This causes an unpatched non-debug wide
	    (UTF-32/UCS-4) build of python to abort.</p>
	</blockquote>
	<p>Ubuntu security team reports:</p>
	<blockquote cite="http://www.ubuntu.com/usn/usn-359-1">
	  <p>If an application uses repr() on arbitrary untrusted data,
	    this [bug] could be exploited to execute arbitrary code
	    with the privileges of the python application.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2006-4980</cvename>
      <url>https://launchpad.net/distros/ubuntu/+source/python2.4/+bug/56633</url>
      <url>http://www.ubuntu.com/usn/usn-359-1</url>
      <url>http://secunia.com/advisories/22276/</url>
    </references>
    <dates>
      <discovery>2006-08-15</discovery>
      <entry>2006-10-07</entry>
      <modified>2006-10-08</modified>
    </dates>
  </vuln>

  <vuln vid="e329550b-54f7-11db-a5ae-00508d6a62df">
    <topic>php -- _ecalloc Integer Overflow Vulnerability</topic>
    <affects>
      <package>
	<name>php5</name>
	<range><lt>5.1.6_1</lt></range>
      </package>
      <package>
	<name>php5-cli</name>
	<name>php5-cgi</name>
	<name>php5-dtc</name>
	<name>php5-horde</name>
	<name>php5-nms</name>
	<name>mod_php5</name>
	<range><ge>5</ge><lt>5.1.6_1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Stefan Esser reports:</p>
	<blockquote cite="http://www.hardened-php.net/advisory_092006.133.html">
	  <p>The PHP 5 branch of the PHP source code lacks the
	    protection against possible integer overflows inside
	    ecalloc() that is present in the PHP 4 branch and also for
	    several years part of our Hardening-Patch and our new
	    Suhosin-Patch.</p>
	  <p>It was discovered that such an integer overflow can be
	    triggered when user input is passed to the unserialize()
	    function. Earlier vulnerabilities in PHP's unserialize()
	    that were also discovered by one of our audits in December
	    2004 are unrelated to the newly discovered flaw, but they
	    have shown, that the unserialize() function is exposed to
	    user-input in many popular PHP applications.  Examples for
	    applications that use the content of COOKIE variables with
	    unserialize() are phpBB and Serendipity.</p>
	  <p>The successful exploitation of this integer overflow will
	    result in arbitrary code execution.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2006-4812</cvename>
      <url>http://www.hardened-php.net/advisory_092006.133.html</url>
      <url>http://secunia.com/advisories/22280/</url>
    </references>
    <dates>
      <discovery>2006-09-30</discovery>
      <entry>2006-10-06</entry>
      <modified>2013-04-01</modified>
    </dates>
  </vuln>

  <vuln vid="8a5770b4-54b5-11db-a5ae-00508d6a62df">
    <topic>mambo -- multiple SQL injection vulnerabilities</topic>
    <affects>
      <package>
	<name>mambo</name>
	<range><lt>4.6.5</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>James Bercegay reports:</p>
	<blockquote cite="http://www.gulftech.org/?node=research&amp;article_id=00116-10042006">
	  <p>Mambo is vulnerable to an Authentication Bypass issue that
	    is due to an SQL Injection in the login function. The SQL
	    Injection is possible because the $passwd variable is only
	    sanitized when it is not passed as an argument to the
	    function.</p>
	</blockquote>
	<p>Omid reports:</p>
	<blockquote cite="http://seclists.org/bugtraq/2006/Aug/0491.html">
	  <p>There are several sql injections in Mambo 4.6 RC2 &amp;
	    Joomla 1.0.10 (and maybe other versions):</p>
	  <ul>
	    <li>When a user edits a content, the "id" parameter is not
	      checked properly in /components/com_content/content.php,
	      which can cause 2 sql injections.</li>
	    <li>The "limit" parameter in the administration section is
	      not checked. This affects many pages of administration
	      section</li>
	    <li>In the administration section, while editing/creating a
	      user, the "gid" parameter is not checked properly.</li>
	  </ul>
	</blockquote>
      </body>
    </description>
    <references>
      <bid>19719</bid>
      <bid>19734</bid>
      <url>http://www.gulftech.org/?node=research&amp;article_id=00116-10042006</url>
      <url>http://seclists.org/bugtraq/2006/Aug/0491.html</url>
      <url>http://www.frsirt.com/english/advisories/2006/3918</url>
      <url>http://mamboxchange.com/forum/forum.php?forum_id=7704</url>
      <url>http://secunia.com/advisories/21644/</url>
      <url>http://secunia.com/advisories/22221/</url>
    </references>
    <dates>
      <discovery>2006-08-26</discovery>
      <entry>2006-10-05</entry>
      <modified>2011-06-27</modified>
    </dates>
  </vuln>

  <vuln vid="19a92df1-548d-11db-8f1a-000a48049292">
    <topic>tin -- buffer overflow vulnerabilities</topic>
    <affects>
      <package>
	<name>tin</name>
	<name>zh-tin</name>
	<range><lt>1.8.2</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<blockquote cite="ftp://ftp.tin.org/pub/news/clients/tin/stable/CHANGES">
	  <p>Urs Janssen and Aleksey Salow report possible buffer
	    overflows in tin versions 1.8.0 and 1.8.1.</p>
	</blockquote>
	<blockquote cite="http://www.openpkg.org/security/advisories/OpenPKG-SA-2006.005-tin.html">
	  <p>OpenPKG project elaborates there is an allocation
	    off-by-one bug in version 1.8.0 which can lead to a buffer
	    overflow.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <url>ftp://ftp.tin.org/pub/news/clients/tin/stable/CHANGES</url>
      <url>http://www.openpkg.org/security/advisories/OpenPKG-SA-2006.005-tin.html</url>
    </references>
    <dates>
      <discovery>2006-02-15</discovery>
      <entry>2006-10-05</entry>
    </dates>
  </vuln>

  <vuln vid="ae7124ff-547c-11db-8f1a-000a48049292">
    <topic>openldap -- slapd acl selfwrite Security Issue</topic>
    <affects>
      <package>
	<name>openldap-server</name>
	<name>openldap-sasl-server</name>
	<range><lt>2.3.25</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Howard Chu reports:</p>
	<blockquote cite="http://www.openldap.org/its/index.cgi/Software%20Bugs?id=4587">
	  <p>An ACL of the form 'access to dn.subtree="ou=groups,
	    dc=example,dc=com" attr=member by * selfwrite' is intended
	    to only allow users to add/delete their own DN to the
	    target attribute. Currently it allows any DNs to be
	    modified.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <bid>19832</bid>
      <cvename>CVE-2006-4600</cvename>
      <url>http://www.openldap.org/its/index.cgi/Software%20Bugs?id=4587</url>
      <url>http://www.openldap.org/lists/openldap-announce/200608/msg00000.html</url>
      <url>http://secunia.com/advisories/21721</url>
      <url>http://securitytracker.com/alerts/2006/Sep/1016783.html</url>
    </references>
    <dates>
      <discovery>2006-06-14</discovery>
      <entry>2006-10-05</entry>
    </dates>
  </vuln>

  <vuln vid="5a39a22e-5478-11db-8f1a-000a48049292">
    <topic>mono -- "System.CodeDom.Compiler" Insecure Temporary Creation</topic>
    <affects>
      <package>
	<name>mono</name>
	<range><lt>1.1.13.8.1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Sebastian Krahmer reports:</p>
	<blockquote cite="http://www.ubuntu.com/usn/usn-357-1">
	  <p>Sebastian Krahmer of the SuSE security team discovered
	    that the System.CodeDom.Compiler classes used temporary
	    files in an insecure way. This could allow a symbolic link
	    attack to create or overwrite arbitrary files with the
	    privileges of the user invoking the program. Under some
	    circumstances, a local attacker could also exploit this to
	    inject arbitrary code into running Mono processes.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2006-5072</cvename>
      <url>http://www.ubuntu.com/usn/usn-357-1</url>
      <url>http://secunia.com/advisories/22237/</url>
    </references>
    <dates>
      <discovery>2006-10-04</discovery>
      <entry>2006-10-05</entry>
    </dates>
  </vuln>

  <vuln vid="edabe438-542f-11db-a5ae-00508d6a62df">
    <topic>php -- open_basedir Race Condition Vulnerability</topic>
    <affects>
      <package>
	<name>php4</name>
	<name>php5</name>
	<range><lt>4.4.4_1</lt></range>
	<range><ge>5</ge><lt>5.1.6_2</lt></range>
      </package>
      <package>
	<name>php-suhosin</name>
	<range><lt>0.9.6</lt></range>
      </package>
      <package>
	<name>php4-cli</name>
	<name>php5-cli</name>
	<name>php4-cgi</name>
	<name>php5-cgi</name>
	<name>php4-dtc</name>
	<name>php5-dtc</name>
	<name>php4-horde</name>
	<name>php5-horde</name>
	<name>php4-nms</name>
	<name>php5-nms</name>
	<name>mod_php4</name>
	<name>mod_php5</name>
	<range><ge>4</ge><lt>4.4.4_1</lt></range>
	<range><ge>5</ge><lt>5.1.6_2</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Stefan Esser reports:</p>
	<blockquote cite="http://www.hardened-php.net/advisory_082006.132.html">
	  <p>PHP's open_basedir feature is meant to disallow scripts to
	    access files outside a set of configured base directories.
	    The checks for this are placed within PHP functions dealing
	    with files before the actual open call is performed.</p>
	  <p>Obviously there is a little span of time between the check
	    and the actual open call. During this time span the checked
	    path could have been altered and point to a file that is
	    forbidden to be accessed due to open_basedir restrictions.</p>
	  <p>Because the open_basedir restrictions often not call PHP
	    functions but 3rd party library functions to actually open
	    the file it is impossible to close this time span in a
	    general way. It would only be possible to close it when PHP
	    handles the actual opening on it's own.</p>
	  <p>While it seems hard to change the path during this little
	    time span it is very simple with the use of the symlink()
	    function combined with a little trick. PHP's symlink()
	    function ensures that source and target of the symlink
	    operation are allowed by open_basedir restrictions (and
	    safe_mode). However it is possible to point a symlink to
	    any file by the use of mkdir(), unlink() and at least two
	    symlinks.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <bid>20326</bid>
      <cvename>CVE-2006-5178</cvename>
      <url>http://www.hardened-php.net/advisory_082006.132.html</url>
      <url>http://secunia.com/advisories/22235/</url>
    </references>
    <dates>
      <discovery>2006-10-02</discovery>
      <entry>2006-10-05</entry>
      <modified>2013-04-01</modified>
    </dates>
  </vuln>

  <vuln vid="86526ba4-53c8-11db-8f1a-000a48049292">
    <topic>phpbb -- NULL byte injection vulnerability</topic>
    <affects>
      <package>
	<name>phpbb</name>
	<name>zh-phpbb-tw</name>
	<range><lt>2.0.22</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/22188/">
	  <p>ShAnKaR has discovered a vulnerability in phpBB, which can
	    be exploited by malicious users to compromise a vulnerable
	    system.</p>
	  <p>Input passed to the "avatar_path" parameter in
	    admin/admin_board.php is not properly sanitised before
	    being used as a configuration variable to store avatar
	    images. This can be exploited to upload and execute
	    arbitrary PHP code by changing "avatar_path" to a file with
	    a trailing NULL byte.</p>
	  <p>Successful exploitation requires privileges to the
	    administration section.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <bid>20347</bid>
      <cvename>CVE-2006-4758</cvename>
      <url>http://secunia.com/advisories/22188/</url>
      <url>http://xforce.iss.net/xforce/xfdb/28884</url>
      <url>http://www.security.nnov.ru/Odocument221.html</url>
    </references>
    <dates>
      <discovery>2006-09-12</discovery>
      <entry>2006-10-04</entry>
      <modified>2006-12-24</modified>
    </dates>
  </vuln>

  <vuln vid="35f2679f-52d7-11db-8f1a-000a48049292">
    <topic>postnuke -- admin section SQL injection</topic>
    <affects>
      <package>
	<name>postnuke</name>
	<range><lt>0.763</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>ISS X-Force reports:</p>
	<blockquote cite="http://xforce.iss.net/xforce/xfdb/29271">
	  <p>PostNuke is vulnerable to SQL injection. A remote attacker
	    could send specially-crafted SQL statements to the admin
	    section using the hits parameter, which could allow the
	    attacker to view, add, modify or delete information in the
	    back-end database.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <bid>20317</bid>
      <cvename>CVE-2006-5121</cvename>
      <url>http://xforce.iss.net/xforce/xfdb/29271</url>
      <url>http://www.securityfocus.com/archive/1/archive/1/447361/100/0/threaded</url>
      <url>http://secunia.com/advisories/22197/</url>
    </references>
    <dates>
      <discovery>2006-09-29</discovery>
      <entry>2006-10-03</entry>
      <modified>2007-11-17</modified>
    </dates>
  </vuln>

  <vuln vid="b975763f-5210-11db-8f1a-000a48049292">
    <topic>freetype -- LWFN Files Buffer Overflow Vulnerability</topic>
    <affects>
      <package>
	<name>freetype2</name>
	<range><lt>2.1.10_5</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>SecurityTracker reports:</p>
	<blockquote cite="http://securitytracker.com/alerts/2006/Jul/1016522.html">
	  <p>A vulnerability was reported in FreeType. A remote user
	    can cause arbitrary code to be executed on the target
	    user's system.</p>
	  <p>A remote user can create a specially crafted font file
	    that, when loaded by the target user's system, will trigger
	    an integer underflow or integer overflow and crash the
	    application or execute arbitrary code on the target system.</p>
	  <p>Chris Evans reported these vulnerabilities.</p>
	  <p>Impact: A remote user can create a file that, when loaded
	    by the target user, will execute arbitrary code on the
	    target user's system.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <bid>18034</bid>
      <cvename>CVE-2006-0747</cvename>
      <cvename>CVE-2006-1861</cvename>
      <cvename>CVE-2006-3467</cvename>
      <url>http://securitytracker.com/alerts/2006/Jul/1016522.html</url>
    </references>
    <dates>
      <discovery>2006-07-10</discovery>
      <entry>2006-10-02</entry>
    </dates>
  </vuln>

  <vuln vid="74ff10f6-520f-11db-8f1a-000a48049292">
    <topic>cscope -- Buffer Overflow Vulnerabilities</topic>
    <affects>
      <package>
	<name>cscope</name>
	<range><lt>15.6</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/21601">
	  <p>Will Drewry has reported some vulnerabilities in Cscope,
	    which potentially can be exploited by malicious people to
	    compromise a vulnerable system.</p>
	  <p>Various boundary errors within the parsing of file lists
	    or the expansion of environment variables can be exploited
	    to cause stack-based buffer overflows when parsing
	    specially crafted "cscope.lists" files or directories.</p>
	  <p>A boundary error within the parsing of command line
	    arguments can be exploited to cause a stack-based buffer
	    overflow when supplying an overly long "reffile" argument.</p>
	  <p>Successful exploitation may allow execution of arbitrary
	    code.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <bid>19686</bid>
      <bid>19687</bid>
      <cvename>CVE-2006-4262</cvename>
      <url>http://secunia.com/advisories/21601</url>
      <url>http://sourceforge.net/mailarchive/forum.php?thread_id=30266760&amp;forum_id=33500</url>
      <url>http://sourceforge.net/mailarchive/forum.php?thread_id=30266761&amp;forum_id=33500</url>
    </references>
    <dates>
      <discovery>2006-08-20</discovery>
      <entry>2006-10-02</entry>
      <modified>2006-10-11</modified>
    </dates>
  </vuln>

  <vuln vid="64bf6234-520d-11db-8f1a-000a48049292">
    <topic>gnutls -- RSA Signature Forgery Vulnerability</topic>
    <affects>
      <package>
	<name>gnutls</name>
	<name>gnutls-devel</name>
	<range><lt>1.4.4</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/21937">
	  <p>A vulnerability has been reported in GnuTLS, which can be
	    exploited by malicious people to bypass certain security
	    restrictions.</p>
	  <p>The vulnerability is caused due to an error in the
	    verification of certain signatures. If a RSA key with
	    exponent 3 is used, it may be possible to forge PKCS #1
	    v1.5 signatures signed with that key.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <bid>20027</bid>
      <cvename>CVE-2006-4790</cvename>
      <url>http://secunia.com/advisories/21937</url>
      <url>http://lists.gnupg.org/pipermail/gnutls-dev/2006-September/001205.html</url>
    </references>
    <dates>
      <discovery>2006-09-08</discovery>
      <entry>2006-10-02</entry>
    </dates>
  </vuln>

  <vuln vid="350a5bd9-520b-11db-8f1a-000a48049292">
    <topic>MT -- Search Unspecified XSS</topic>
    <affects>
      <package>
	<name>MT</name>
	<range><ge>3.3</ge><lt>3.33</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/22109">
	  <p>Arai has reported a vulnerability in Movable Type and
	    Movable Type Enterprise, which can be exploited by
	    malicious people to conduct cross-site scripting attacks.</p>
	  <p>Some unspecified input passed via the search functionality
	    isn't properly sanitised before being returned to the user.
	    This can be exploited to execute arbitrary HTML and script
	    code in a user's browser session in context of an affected
	    site.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <bid>20228</bid>
      <cvename>CVE-2006-5080</cvename>
      <url>http://secunia.com/advisories/22109</url>
      <url>http://www.sixapart.com/movabletype/news/2006/09/mt_333-mte_103_updates.html</url>
    </references>
    <dates>
      <discovery>2006-09-26</discovery>
      <entry>2006-10-02</entry>
      <modified>2006-10-15</modified>
    </dates>
  </vuln>

  <vuln vid="19b17ab4-51e0-11db-a5ae-00508d6a62df">
    <topic>phpmyadmin -- XSRF vulnerabilities</topic>
    <affects>
      <package>
	<name>phpMyAdmin</name>
	<range><lt>2.9.0.1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>phpMyAdmin team reports:</p>
	<blockquote cite="http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-5">
	  <p>We received a security advisory from Stefan Esser
	    (sesser@hardened-php.net) and we wish to thank him for his
	    work.</p>
	  <p>It was possible to inject arbitrary SQL commands by
	    forcing an authenticated user to follow a crafted link.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2006-5116</cvename>
      <cvename>CVE-2006-5117</cvename>
      <url>http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-5</url>
      <url>http://secunia.com/advisories/22126/</url>
      <bid>20253</bid>
    </references>
    <dates>
      <discovery>2006-09-28</discovery>
      <entry>2006-10-02</entry>
      <modified>2006-10-03</modified>
    </dates>
  </vuln>

  <vuln vid="32db37a5-50c3-11db-acf3-000c6ec775d9">
    <topic>openssh -- multiple vulnerabilities</topic>
    <affects>
      <package>
	<name>FreeBSD</name>
	<range><ge>6.1</ge><lt>6.1_10</lt></range>
	<range><ge>6.0</ge><lt>6.0_15</lt></range>
	<range><ge>5.5</ge><lt>5.5_8</lt></range>
	<range><ge>5.4</ge><lt>5.4_22</lt></range>
	<range><ge>5.0</ge><lt>5.3_37</lt></range>
	<range><lt>4.11_25</lt></range>
      </package>
      <package>
	<name>openssh</name>
	<range><lt>4.4,1</lt></range>
      </package>
      <package>
	<name>openssh-portable</name>
	<range><lt>4.4.p1,1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description</h1>
	<p>The CRC compensation attack detector in the sshd(8) daemon,
	  upon receipt of duplicate blocks, uses CPU time cubic in the
	  number of duplicate blocks received.	[CVE-2006-4924]</p>
	<p>A race condition exists in a signal handler used by the
	  sshd(8) daemon to handle the LoginGraceTime option, which
	  can potentially cause some cleanup routines to be executed
	  multiple times.  [CVE-2006-5051]</p>
	<h1>Impact</h1>
	<p>An attacker sending specially crafted packets to sshd(8)
	  can cause a Denial of Service by using 100% of CPU time
	  until a connection timeout occurs.  Since this attack can be
	  performed over multiple connections simultaneously, it is
	  possible to cause up to MaxStartups (10 by default) sshd
	  processes to use all the CPU time they can obtain.
	  [CVE-2006-4924]</p>
	<p>The OpenSSH project believe that the race condition can
	  lead to a Denial of Service or potentially remote code
	  execution, but the FreeBSD Security Team has been unable to
	  verify the exact impact.  [CVE-2006-5051]</p>
	<h1>Workaround</h1>
	<p>The attack against the CRC compensation attack detector can
	  be avoided by disabling SSH Protocol version 1 support in
	  sshd_config(5).</p>
	<p>There is no workaround for the second issue.</p>
      </body>
    </description>
    <references>
      <bid>20216</bid>
      <cvename>CVE-2006-4924</cvename>
      <cvename>CVE-2006-5051</cvename>
      <freebsdsa>SA-06:22.openssh</freebsdsa>
      <url>http://www.openssh.com/txt/release-4.4</url>
    </references>
    <dates>
      <discovery>2006-09-25</discovery>
      <entry>2006-09-30</entry>
    </dates>
  </vuln>

  <vuln vid="fcba5764-506a-11db-a5ae-00508d6a62df">
    <topic>dokuwiki -- multiple vulnerabilities</topic>
    <affects>
      <package>
	<name>dokuwiki</name>
	<range><lt>20060309c</lt></range>
      </package>
      <package>
	<name>dokuwiki-devel</name>
	<range><lt>20060909</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/21819/">
	  <p>rgod has discovered a vulnerability in DokuWiki, which can
	    be exploited by malicious people to compromise a vulnerable
	    system.</p>
	  <p>Input passed to the "TARGET_FN" parameter in
	    bin/dwpage.php is not properly sanitised before being used
	    to copy files. This can be exploited via directory
	    traversal attacks in combination with DokuWiki's file
	    upload feature to execute arbitrary PHP code.</p>
	</blockquote>
	<p>CVE Mitre reports:</p>
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4674">
	  <p>Direct static code injection vulnerability in doku.php in
	    DokuWiki before 2006-03-09c allows remote attackers to
	    execute arbitrary PHP code via the X-FORWARDED-FOR HTTP
	    header, which is stored in config.php.</p>
	</blockquote>
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4675">
	  <p>Unrestricted file upload vulnerability in
	    lib/exe/media.php in DokuWiki before 2006-03-09c allows
	    remote attackers to upload executable files into the
	    data/media folder via unspecified vectors.</p>
	</blockquote>
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4679">
	  <p>DokuWiki before 2006-03-09c enables the debug feature by
	    default, which allows remote attackers to obtain sensitive
	    information by calling doku.php with the X-DOKUWIKI-DO HTTP
	    header set to "debug".</p>
	</blockquote>
      </body>
    </description>
    <references>
      <bid>19911</bid>
      <cvename>CVE-2006-4674</cvename>
      <cvename>CVE-2006-4675</cvename>
      <cvename>CVE-2006-4679</cvename>
      <url>http://secunia.com/advisories/21819/</url>
      <url>http://bugs.splitbrain.org/index.php?do=details&amp;id=906</url>
    </references>
    <dates>
      <discovery>2006-09-08</discovery>
      <entry>2006-09-30</entry>
      <modified>2006-10-02</modified>
    </dates>
  </vuln>

  <vuln vid="450b76ee-5068-11db-a5ae-00508d6a62df">
    <topic>dokuwiki -- multiple vulnerabilities</topic>
    <affects>
      <package>
	<name>dokuwiki</name>
	<range><lt>20060309_5</lt></range>
      </package>
      <package>
	<name>dokuwiki-devel</name>
	<range><lt>20060609_2</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/22192/">
	  <p>Some vulnerabilities have been reported in DokuWiki, which
	    can be exploited by malicious people to cause a DoS (Denial
	    of Service) or potentially compromise a vulnerable system.</p>
	  <p>Input passed to the "w" and "h" parameters in
	    lib/exec/fetch.php is not properly sanitised before being
	    passed as resize parameters to the "convert" application.
	    This can be exploited to cause a DoS due to excessive CPU
	    and memory consumption by passing very large numbers, or to
	    inject arbitrary shell commands by passing specially
	    crafted strings to the "w" and "h" parameter.</p>
	  <p>Successful exploitation requires that the
	    "$conf[imconvert]" option is set.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2006-5098</cvename>
      <cvename>CVE-2006-5099</cvename>
      <url>http://secunia.com/advisories/22192/</url>
      <url>http://secunia.com/advisories/22199/</url>
      <url>http://bugs.splitbrain.org/?do=details&amp;id=924</url>
      <url>http://bugs.splitbrain.org/?do=details&amp;id=926</url>
    </references>
    <dates>
      <discovery>2006-09-26</discovery>
      <entry>2006-09-30</entry>
      <modified>2006-10-02</modified>
    </dates>
  </vuln>

  <vuln vid="e4c62abd-5065-11db-a5ae-00508d6a62df">
    <topic>tikiwiki -- multiple vulnerabilities</topic>
    <affects>
      <package>
	<name>tikiwiki</name>
	<range><lt>1.9.5</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/21536/">
	  <p>Thomas Pollet has discovered a vulnerability in TikiWiki,
	    which can be exploited by malicious people to conduct
	    cross-site scripting attacks.</p>
	  <p>Input passed to the "highlight" parameter in
	    tiki-searchindex.php is not properly sanitised before being
	    returned to the user. This can be exploited to execute
	    arbitrary HTML and script code in a user's browser session
	    in context of an affected site.</p>
	</blockquote>
	<blockquote cite="http://secunia.com/advisories/21733/">
	  <p>rgod has discovered a vulnerability in TikiWiki, which can
	    be exploited by malicious people to compromise a vulnerable
	    system.</p>
	  <p>The vulnerability is caused due to the "jhot.php" script
	    not correctly verifying uploaded files. This can e.g. be
	    exploited to execute arbitrary PHP code by uploading a
	    malicious PHP script to the "img/wiki" directory.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <bid>19654</bid>
      <bid>19819</bid>
      <cvename>CVE-2006-4299</cvename>
      <cvename>CVE-2006-4602</cvename>
      <url>http://secunia.com/advisories/21536/</url>
      <url>http://secunia.com/advisories/21733/</url>
    </references>
    <dates>
      <discovery>2006-08-21</discovery>
      <entry>2006-09-30</entry>
    </dates>
  </vuln>

  <vuln vid="e79876e4-5061-11db-a5ae-00508d6a62df">
    <topic>punbb -- NULL byte injection vulnerability</topic>
    <affects>
      <package>
	<name>punbb</name>
	<range><lt>1.2.13</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>CVE Mitre reports:</p>
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=2006-4759">
	  <p>PunBB 1.2.12 does not properly handle an avatar directory
	    pathname ending in %00, which allows remote authenticated
	    administrative users to upload arbitrary files and execute
	    code, as demonstrated by a query to admin_options.php with
	    an avatars_dir parameter ending in %00. NOTE: this issue
	    was originally disputed by the vendor, but the dispute was
	    withdrawn on 20060926.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2006-4759</cvename>
      <url>http://forums.punbb.org/viewtopic.php?id=13255</url>
    </references>
    <dates>
      <discovery>2006-09-13</discovery>
      <entry>2006-09-30</entry>
    </dates>
  </vuln>

  <vuln vid="2d9ad236-4d26-11db-b48d-00508d6a62df">
    <topic>freeciv -- Denial of Service Vulnerabilities</topic>
    <affects>
      <package>
	<name>freeciv</name>
	<name>freeciv-gtk</name>
	<name>freeciv-gtk2</name>
	<name>freeciv-nox11</name>
	<range><lt>2.0.8_2</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/21171/">
	  <p>Luigi Auriemma has reported a vulnerability in Freeciv,
	    which can be exploited by malicious people to cause a DoS
	    (Denial of Service).</p>
	  <p>An error in the "generic_handle_player_attribute_chunk()"
	    function in common/packets.c can be exploited to crash the
	    service via a specially crafted
	    PACKET_PLAYER_ATTRIBUTE_CHUNK packet sent to the server.</p>
	  <p>An error in the "handle_unit_orders()" function in
	    server/unithand.c can be exploited to crash the service
	    via a specially crafted packet.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2006-3913</cvename>
      <bid>19117</bid>
      <url>http://secunia.com/advisories/21171/</url>
      <url>http://aluigi.altervista.org/adv/freecivx-adv.txt</url>
    </references>
    <dates>
      <discovery>2006-07-23</discovery>
      <entry>2006-09-26</entry>
    </dates>
  </vuln>

  <vuln vid="339fbbc1-4d23-11db-b48d-00508d6a62df">
    <topic>freeciv -- Packet Parsing Denial of Service Vulnerability</topic>
    <affects>
      <package>
	<name>freeciv</name>
	<name>freeciv-gtk</name>
	<name>freeciv-gtk2</name>
	<name>freeciv-nox11</name>
	<range><lt>2.0.8</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/19120/">
	  <p>Luigi Auriemma has reported a vulnerability in Freeciv, which
	    can be exploited by malicious people to cause a DoS (Denial of
	    Service).</p>
	  <p>The vulnerability is caused due to an error within the
	    handling of the packet length in "common/packets.c". This can
	    be exploited to crash the Freeciv server via a specially-
	    crafted packet with the size set to "0xffff".</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2006-0047</cvename>
      <bid>16975</bid>
      <url>http://secunia.com/advisories/19120/</url>
      <url>http://aluigi.altervista.org/adv/freecivdos-adv.txt</url>
    </references>
    <dates>
      <discovery>2006-03-06</discovery>
      <entry>2006-09-26</entry>
    </dates>
  </vuln>

  <vuln vid="1709084d-4d21-11db-b48d-00508d6a62df">
    <topic>plans -- multiple vulnerabilities</topic>
    <affects>
      <package>
	<name>plans</name>
	<range><lt>6.7.2</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/15854/">
	  <p>A vulnerability has been reported in Plans, which can be
	    exploited by malicious people to conduct SQL injection
	    attacks.</p>
	  <p>Input passed to the "evt_id" parameter in "plans.cgi"
	    isn't properly sanitised before being used in a SQL query.
	    This can be exploited to manipulate SQL queries by
	    injecting arbitrary SQL code.</p>
	  <p>Successful exploitation requires that SQL database
	    support has been enabled in "plans_config.pl" (the default
	    setting is flat files).</p>
	</blockquote>
	<blockquote cite="http://secunia.com/advisories/15167/">
	  <p>Some vulnerabilities have been reported in Plans, which
	    can be exploited by malicious people to conduct cross-site
	    scripting attacks or gain knowledge of sensitive
	    information.</p>
	  <p>Input passed to various unspecified parameters is not
	    properly sanitised before being returned to users. This
	    can be exploited to execute arbitrary HTML and script code
	    in a user's browser session in context of a vulnerable
	    site.</p>
	  <p>An unspecified error can be exploited to gain knowledge
	    of the MySQL password.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <bid>14069</bid>
      <url>http://secunia.com/advisories/15167/</url>
      <url>http://secunia.com/advisories/15854/</url>
      <url>http://planscalendar.com/forum/viewtopic.php?t=660</url>
    </references>
    <dates>
      <discovery>2005-04-28</discovery>
      <entry>2006-09-26</entry>
      <modified>2006-10-15</modified>
    </dates>
  </vuln>

  <vuln vid="d3527663-4ccb-11db-b48d-00508d6a62df">
    <topic>eyeOS -- multiple XSS security bugs</topic>
    <affects>
      <package>
	<name>eyeOS</name>
	<range><lt>0.9.1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>eyeOS team reports:</p>
	<blockquote cite="http://eyeos.blogspot.com/2006/09/eyeos-091-released.html">
	  <p>[EyeOS 0.9.1] release fixes two XSS security bugs, so we
	    recommend all users to upgrade to this new version in order
	    to have the best security. These two bugs were discovered by
	    Jose Carlos Norte, who is a new eyeOS developer.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <bid>20213</bid>
      <cvename>CVE-2006-5071</cvename>
      <url>http://eyeos.blogspot.com/2006/09/eyeos-091-released.html</url>
    </references>
    <dates>
      <discovery>2006-09-25</discovery>
      <entry>2006-09-25</entry>
      <modified>2006-10-15</modified>
    </dates>
  </vuln>

  <vuln vid="65a8f773-4a37-11db-a4cc-000a48049292">
    <topic>zope -- restructuredText "csv_table" Information Disclosure</topic>
    <affects>
      <package>
	<name>zope</name>
	<range><ge>2.7.0</ge><lt>2.7.9_1</lt></range>
	<range><ge>2.8.0</ge><lt>2.8.8_1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/21947/">
	  <p>A vulnerability has been reported in Zope, which can be
	    exploited by malicious people to disclose potentially
	    sensitive information.</p>
	  <p>The vulnerability is caused due to an error in the use of
	    the docutils module to parse and render "restructured"
	    text. This can be exploited to disclose certain information
	    via the "csv_table" reStructuredText directive.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <bid>20022</bid>
      <cvename>CVE-2006-4684</cvename>
      <url>http://secunia.com/advisories/21947/</url>
      <url>http://www.zope.org/Products/Zope/Hotfix-2006-08-21/Hotfix-20060821/README.txt</url>
    </references>
    <dates>
      <discovery>2006-08-21</discovery>
      <entry>2006-09-22</entry>
      <modified>2006-12-27</modified>
    </dates>
  </vuln>

  <vuln vid="f6bff909-4a26-11db-a4cc-000a48049292">
    <topic>libmms -- stack-based buffer overflow</topic>
    <affects>
      <package>
	<name>libmms</name>
	<range><lt>0.3</lt></range>
      </package>
      <package>
	<name>libxine</name>
	<range><lt>1.1.1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Mitre CVE reports:</p>
	<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2200">
	  <p>Stack-based buffer overflow in libmms, as used by (a)
	    MiMMS 0.0.9 and (b) xine-lib 1.1.0 and earlier, allows
	    remote attackers to cause a denial of service (application
	    crash) and possibly execute arbitrary code via the (1)
	    send_command, (2) string_utf16, (3) get_data, and (4)
	    get_media_packet functions, and possibly other functions.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2006-2200</cvename>
      <bid>18608</bid>
      <url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=374577</url>
    </references>
    <dates>
      <discovery>2006-05-04</discovery>
      <entry>2006-09-22</entry>
    </dates>
  </vuln>

  <vuln vid="1fe734bf-4a06-11db-b48d-00508d6a62df">
    <topic>opera -- RSA Signature Forgery</topic>
    <affects>
      <package>
	<name>opera</name>
	<name>opera-devel</name>
	<name>linux-opera</name>
	<range><lt>9.02</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Opera reports:</p>
	<blockquote cite="http://www.opera.com/support/search/supsearch.dml?index=845">
	  <p>A specially crafted digital certificate can bypass Opera's
	    certificate signature verification. Forged certificates can
	    contain any false information the forger chooses, and Opera
	    will still present it as valid. Opera will not present any
	    warning dialogs in this case, and the security status will
	    be the highest possible (3). This defeats the protection
	    against "man in the middle", the attacks that SSL was
	    designed to prevent.</p>
	  <p>There is a flaw in OpenSSL's RSA signature verification
	    that affects digital certificates using 3 as the public
	    exponent. Some of the certificate issuers that are on
	    Opera's list of trusted signers have root certificates with
	    3 as the public exponent. The forged certificate can appear
	    to be signed by one of these.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2006-4339</cvename>
      <url>http://secunia.com/advisories/21982/</url>
      <url>http://secunia.com/advisories/21709/</url>
      <url>http://www.cdc.informatik.tu-darmstadt.de/securebrowser/</url>
      <url>http://www.openssl.org/news/secadv_20060905.txt</url>
      <url>http://www.mozilla.org/security/announce/2006/mfsa2006-60.html</url>
    </references>
    <dates>
      <discovery>2006-09-18</discovery>
      <entry>2006-09-22</entry>
    </dates>
  </vuln>

  <vuln vid="e6296105-449b-11db-ba89-000c6ec775d9">
    <topic>mozilla -- multiple vulnerabilities</topic>
    <affects>
      <package>
	<name>firefox</name>
	<range><lt>1.5.0.7,1</lt></range>
	<range><gt>2.*,1</gt><lt>2.0_1,1</lt></range>
      </package>
      <package>
	<name>linux-firefox</name>
	<range><lt>1.5.0.7</lt></range>
      </package>
      <package>
	<name>seamonkey</name>
	<name>linux-seamonkey</name>
	<range><lt>1.0.5</lt></range>
      </package>
      <package>
	<name>thunderbird</name>
	<name>linux-thunderbird</name>
	<name>mozilla-thunderbird</name>
	<range><lt>1.5.0.7</lt></range>
      </package>
      <package>
	<name>linux-firefox-devel</name>
	<range><lt>3.0.a2006.09.21</lt></range>
      </package>
      <package>
	<name>linux-seamonkey-devel</name>
	<range><lt>1.5.a2006.09.21</lt></range>
      </package>
      <package>
	<name>linux-mozilla-devel</name>
	<name>linux-mozilla</name>
	<name>mozilla</name>
	<range><gt>0</gt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Mozilla Foundation reports of multiple security issues
	  in Firefox, Seamonkey, and Thunderbird.  Several of these
	  issues can probably be used to run arbitrary code with the
	  privilege of the user running the program.</p>
	<blockquote cite="http://www.mozilla.org/security/announce/">
	  <ul>
	    <li>MFSA 2006-64 Crashes with evidence of memory
	      corruption (rv:1.8.0.7)</li>
	    <li>MFSA 2006-63 JavaScript execution in mail via XBL</li>
	    <li>MFSA 2006-62 Popup-blocker cross-site scripting (XSS)</li>
	    <li>MFSA 2006-61 Frame spoofing using document.open()</li>
	    <li>MFSA 2006-60 RSA Signature Forgery</li>
	    <li>MFSA 2006-59 Concurrency-related vulnerability</li>
	    <li>MFSA 2006-58 Auto-Update compromise through DNS and
	      SSL spoofing</li>
	    <li>MFSA 2006-57 JavaScript Regular Expression Heap
	      Corruption</li>
	  </ul>
	</blockquote>
      </body>
    </description>
    <references>
      <bid>20042</bid>
      <cvename>CVE-2006-4253</cvename>
      <cvename>CVE-2006-4340</cvename>
      <cvename>CVE-2006-4565</cvename>
      <cvename>CVE-2006-4566</cvename>
      <cvename>CVE-2006-4567</cvename>
      <cvename>CVE-2006-4568</cvename>
      <cvename>CVE-2006-4569</cvename>
      <cvename>CVE-2006-4570</cvename>
      <cvename>CVE-2006-4571</cvename>
      <url>http://www.mozilla.org/security/announce/2006/mfsa2006-57.html</url>
      <url>http://www.mozilla.org/security/announce/2006/mfsa2006-58.html</url>
      <url>http://www.mozilla.org/security/announce/2006/mfsa2006-59.html</url>
      <url>http://www.mozilla.org/security/announce/2006/mfsa2006-60.html</url>
      <url>http://www.mozilla.org/security/announce/2006/mfsa2006-61.html</url>
      <url>http://www.mozilla.org/security/announce/2006/mfsa2006-62.html</url>
      <url>http://www.mozilla.org/security/announce/2006/mfsa2006-63.html</url>
      <url>http://www.mozilla.org/security/announce/2006/mfsa2006-64.html</url>
    </references>
    <dates>
      <discovery>2006-09-14</discovery>
      <entry>2006-09-15</entry>
      <modified>2006-11-02</modified>
    </dates>
  </vuln>

  <vuln vid="24f6b1eb-43d5-11db-81e1-000e0c2e438a">
    <topic>win32-codecs -- multiple vulnerabilities</topic>
    <affects>
      <package>
	<name>win32-codecs</name>
	<range><lt>3.1.0.p8_1,1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Apple Security Team reports that there are multiple
	  vulnerabilities within QuickTime (one of the plugins for
	  win32-codecs).  A remote attacker capable of creating a
	  malicious SGI image, FlashPix, FLC movie, or a QuickTime
	  movie can possibly lead to execution of arbitrary code or
	  cause a Denial of Service (application crash).</p>
	<p>Users who have QuickTime (/win32-codecs) as a browser plugin
	  may be vulnerable to remote code execution by visiting a
	  website containing a malicious SGI image, FlashPix, FLC movie
	  or a QuickTime movie.</p>
      </body>
    </description>
    <references>
      <bid>20138</bid>
      <cvename>CVE-2006-4381</cvename>
      <cvename>CVE-2006-4382</cvename>
      <cvename>CVE-2006-4384</cvename>
      <cvename>CVE-2006-4385</cvename>
      <cvename>CVE-2006-4386</cvename>
      <cvename>CVE-2006-4388</cvename>
      <cvename>CVE-2006-4389</cvename>
      <url>http://docs.info.apple.com/article.html?artnum=304357</url>
    </references>
    <dates>
      <discovery>2006-09-08</discovery>
      <entry>2006-09-14</entry>
      <modified>2006-10-17</modified>
    </dates>
  </vuln>

  <vuln vid="ea09c5df-4362-11db-81e1-000e0c2e438a">
    <topic>php -- multiple vulnerabilities</topic>
    <affects>
      <package>
	<name>php4</name>
	<name>php5</name>
	<range><lt>4.4.4</lt></range>
	<range><ge>5</ge><lt>5.1.5</lt></range>
      </package>
      <package>
	<name>php4-cli</name>
	<name>php5-cli</name>
	<name>php4-cgi</name>
	<name>php5-cgi</name>
	<name>php4-dtc</name>
	<name>php5-dtc</name>
	<name>php4-horde</name>
	<name>php5-horde</name>
	<name>php4-nms</name>
	<name>php5-nms</name>
	<name>mod_php4</name>
	<name>mod_php5</name>
	<range><lt>4.4.4</lt></range>
	<range><ge>5</ge><lt>5.1.5</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The PHP development team reports:</p>
	<blockquote cite="http://www.php.net/release_5_1_5.php">
	  <ul>
	    <li>Added missing safe_mode/open_basedir checks inside the
	      error_log(), file_exists(), imap_open() and imap_reopen()
	      functions.</li>
	    <li>Fixed overflows inside str_repeat() and wordwrap()
	      functions on 64bit systems.</li>
	    <li>Fixed possible open_basedir/safe_mode bypass in cURL
	      extension and with realpath cache.</li>
	    <li>Fixed overflow in GD extension on invalid GIF
	      images.</li>
	    <li>Fixed a buffer overflow inside sscanf() function.</li>
	    <li>Fixed an out of bounds read inside stripos()
	      function.</li>
	    <li>Fixed memory_limit restriction on 64 bit system.</li>
	  </ul>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2006-4481</cvename>
      <cvename>CVE-2006-4482</cvename>
      <cvename>CVE-2006-4483</cvename>
      <cvename>CVE-2006-4484</cvename>
      <cvename>CVE-2006-4485</cvename>
      <cvename>CVE-2006-4486</cvename>
      <url>http://www.php.net/release_4_4_4.php</url>
      <url>http://www.php.net/release_5_1_5.php</url>
    </references>
    <dates>
      <discovery>2006-08-18</discovery>
      <entry>2006-09-13</entry>
      <modified>2014-03-28</modified>
    </dates>
  </vuln>

  <vuln vid="c0fd7890-4346-11db-89cc-000ae42e9b93">
    <topic>drupal-pubcookie -- authentication may be bypassed</topic>
    <affects>
      <package>
	<name>drupal-pubcookie</name>
	<range><le>4.6.0_20060210</le></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Drupal Project reports:</p>
	<blockquote cite="http://drupal.org/node/83064">
	  <p>It is possible for a malicious user to spoof a user's
	    identity by bypassing the login redirection mechanism in the
	    pubcookie module. The malicious user may gain the privileges
	    of the user they are spoofing, including the administrative
	    user.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2006-4717</cvename>
      <url>http://drupal.org/node/83064</url>
    </references>
    <dates>
      <discovery>2006-09-08</discovery>
      <entry>2006-09-13</entry>
      <modified>2010-05-12</modified>
    </dates>
  </vuln>

  <vuln vid="7c75d48c-429b-11db-afae-000c6ec775d9">
    <topic>linux-flashplugin7 -- arbitrary code execution vulnerabilities</topic>
    <affects>
      <package>
	<name>linux-flashplugin</name>
	<range><lt>7.0r68</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Adobe reports:</p>
	<blockquote cite="http://www.adobe.com/support/security/bulletins/apsb06-11.html">
	  <p>Multiple input validation errors have been identified in
	    Flash Player 8.0.24.0 and earlier versions that could lead
	    to the potential execution of arbitrary code. These
	    vulnerabilities could be accessed through content
	    delivered from a remote location via the user?s web
	    browser, email client, or other applications that include
	    or reference the Flash Player. (CVE-2006-3311,
	    CVE-2006-3587, CVE-2006-3588)</p>
	  <p>These updates include changes to prevent circumvention of
	    the "allowScriptAccess" option. (CVE-2006-4640)</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2006-3311</cvename>
      <cvename>CVE-2006-3587</cvename>
      <cvename>CVE-2006-3588</cvename>
      <cvename>CVE-2006-4640</cvename>
      <url>http://www.adobe.com/support/security/bulletins/apsb06-11.html</url>
    </references>
    <dates>
      <discovery>2006-09-12</discovery>
      <entry>2006-09-12</entry>
    </dates>
  </vuln>

  <vuln vid="28ce7102-4039-11db-a838-00148584c7dd">
    <cancelled/>
  </vuln>

  <vuln vid="fffa9257-3c17-11db-86ab-00123ffe8333">
    <topic>mailman -- Multiple Vulnerabilities</topic>
    <affects>
      <package>
	<name>mailman</name>
	<name>ja-mailman</name>
	<name>mailman-with-htdig</name>
	<range><lt>2.1.9.r1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/21732/">
	  <p>Mailman can be exploited by malicious people to conduct cross-site
	    scripting and phishing attacks, and cause a DoS (Denial of
	    Service).</p>
	  <p>1) An error in the logging functionality can be exploited to
	    inject a spoofed log message into the error log via a specially
	    crafted URL.</p>
	  <p>Successful exploitation may trick an administrator into visiting
	    a malicious web site.</p>
	  <p>2) An error in the processing of malformed headers which does not
	    follow the RFC 2231 standard can be exploited to cause a DoS
	    (Denial of Service).</p>
	  <p>3) Some unspecified input isn't properly sanitised before being
	    returned to the user. This can be exploited to execute arbitrary
	    HTML and script code in a user's browser session in context of an
	    affected site.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <bid>19831</bid>
      <cvename>CVE-2006-2191</cvename>
      <cvename>CVE-2006-2941</cvename>
      <cvename>CVE-2006-3636</cvename>
      <cvename>CVE-2006-4624</cvename>
      <url>http://secunia.com/advisories/21732/</url>
      <url>http://sourceforge.net/project/shownotes.php?group_id=103&amp;release_id=444295</url>
    </references>
    <dates>
      <discovery>2006-06-09</discovery>
      <entry>2006-09-04</entry>
      <modified>2006-10-04</modified>
    </dates>
  </vuln>

  <vuln vid="09639ccc-3abb-11db-81e1-000e0c2e438a">
    <topic>hlstats -- multiple cross site scripting vulnerabilities</topic>
    <affects>
      <package>
	<name>hlstats</name>
	<range><le>1.35</le></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Kefka reports multiple cross site scripting vulnerabilities
	  within hlstats.  The vulnerabilities are caused due to
	  improper checking of variables, allowing an attacker to
	  perform cross site scripting.</p>
      </body>
    </description>
    <references>
      <bid>19745</bid>
      <cvename>CVE-2006-4454</cvename>
      <cvename>CVE-2006-6780</cvename>
      <cvename>CVE-2006-6781</cvename>
      <cvename>CVE-2007-2812</cvename>
    </references>
    <dates>
      <discovery>2006-08-29</discovery>
      <entry>2006-09-02</entry>
      <modified>2011-09-03</modified>
    </dates>
  </vuln>

  <vuln vid="0b79743b-3ab7-11db-81e1-000e0c2e438a">
    <topic>gtetrinet -- remote code execution</topic>
    <affects>
      <package>
	<name>gtetrinet</name>
	<range><lt>0.7.10</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Debian Security Team reports:</p>
	<blockquote cite="http://www.debian.org/security/2006/dsa-1163">
	  <p>Michael Gehring discovered several potential out-of-bounds
	    index accesses in gtetrinet, a multiplayer Tetris-like game,
	    which may allow a remote server to execute arbitrary
	    code</p>
	</blockquote>
      </body>
    </description>
    <references>
      <bid>19766</bid>
      <cvename>CVE-2006-3125</cvename>
      <url>http://www.debian.org/security/2006/dsa-1163</url>
    </references>
    <dates>
      <discovery>2006-08-30</discovery>
      <entry>2006-09-02</entry>
      <modified>2006-10-01</modified>
    </dates>
  </vuln>

  <vuln vid="0ab423e7-3822-11db-81e1-000e0c2e438a">
    <topic>joomla -- multiple vulnerabilities</topic>
    <affects>
      <package>
	<name>joomla</name>
	<range><lt>1.0.11</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Joomla development team reports multiple vulnerabilities
	  within the joomla application.  Joomla is vulnerable to the
	  following vulnerabilities:</p>
	<ul>
	  <li>Improper validation of the mosMail function</li>
	  <li>Improper validation of the JosIsValidEmail function.</li>
	  <li>Remote code execution in PEAR.php</li>
	  <li>Zend Hash del key or index vulnerability</li>
	</ul>
      </body>
    </description>
    <references>
      <url>http://www.joomla.org/content/view/1841/78/</url>
    </references>
    <dates>
      <discovery>2006-08-28</discovery>
      <entry>2006-08-30</entry>
      <modified>2010-05-12</modified>
    </dates>
  </vuln>

  <vuln vid="c9d2e361-32fb-11db-a6e2-000e0c2e438a">
    <topic>sppp -- buffer overflow vulnerability</topic>
    <affects>
      <package>
	<name>FreeBSD</name>
	<range><lt>4.11_20</lt></range>
	<range><ge>5.3</ge><lt>5.3_32</lt></range>
	<range><ge>5.4</ge><lt>5.4_17</lt></range>
	<range><ge>5.5</ge><lt>5.5_3</lt></range>
	<range><ge>6.0</ge><lt>6.0_10</lt></range>
	<range><ge>6.1</ge><lt>6.1_4</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description</h1>
	<p>While processing Link Control Protocol (LCP) configuration
	  options received from the remote host, sppp(4) fails to
	  correctly validate option lengths.  This may result in data
	  being read or written beyond the allocated kernel memory
	  buffer.</p>
	<h1>Impact</h1>
	<p>An attacker able to send LCP packets, including the remote
	  end of a sppp(4) connection, can cause the FreeBSD kernel to
	  panic.  Such an attacker may also be able to obtain
	  sensitive information or gain elevated privileges.</p>
	<h1>Workaround</h1>
	<p>No workaround is available, but systems which do not use sppp(4) are
	  not vulnerable.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2006-4304</cvename>
      <freebsdsa>SA-06:18.ppp</freebsdsa>
    </references>
    <dates>
      <discovery>2006-08-23</discovery>
      <entry>2006-08-23</entry>
      <modified>2006-08-30</modified>
    </dates>
  </vuln>

  <vuln vid="e2e8d374-2e40-11db-b683-0008743bf21a">
    <topic>horde -- Phishing and Cross-Site Scripting Vulnerabilities</topic>
    <affects>
      <package>
	<name>horde</name>
	<range><le>3.1.2</le></range>
      </package>
      <package>
	<name>imp</name>
	<range><le>4.1.2</le></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/21500/">
	  <p>Some vulnerabilities have been reported in Horde, which
	    can be exploited by malicious people to conduct phishing
	    and cross-site scripting attacks.</p>
	  <ol>
	    <li>Input passed to the "url" parameter in index.php isn't
	      properly verified before it is being used to include an
	      arbitrary web site in a frameset. This can e.g. be
	      exploited to trick a user into believing certain
	      malicious content is served from a trusted web site.</li>
	    <li>Some unspecified input passed in index.php isn't
	      properly sanitised before being returned to the user.
	      This can be exploited to execute arbitrary HTML and
	      script code in a user's browser session in context of an
	      affected site.</li>
	  </ol>
	</blockquote>
      </body>
    </description>
    <references>
      <bid>19557</bid>
      <bid>19544</bid>
      <url>http://secunia.com/advisories/21500/</url>
      <url>http://lists.horde.org/archives/announce/2006/000292.html</url>
    </references>
    <dates>
      <discovery>2006-08-17</discovery>
      <entry>2006-08-17</entry>
    </dates>
  </vuln>

  <vuln vid="5039ae61-2c9f-11db-8401-000ae42e9b93">
    <topic>globus -- Multiple tmpfile races</topic>
    <affects>
      <package>
	<name>globus</name>
	<range><lt>4.0.2_20060706</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Globus Alliance reports:</p>
	<blockquote cite="http://www.globus.org/mail_archive/security-announce/2006/08/msg00000.html">
	  <p>The proxy generation tool (grid-proxy-init) creates the
	    file, secures the file to provide access only to owner and
	    writes proxy to the file. A race condition exists between
	    the opening of the proxy credentials file, and making sure
	    it is safe file to write to. The checks to ensure this
	    file is accessible only to the owner take place using the
	    filename after the file is opened for writing, but before
	    any data is written.</p>
	</blockquote>
	<blockquote cite="http://www.globus.org/mail_archive/security-announce/2006/08/msg00001.html">
	  <p>Various components of the toolkit use files in shared
	    directories to store information, some being sensitive
	    information. For example, the tool to create proxy
	    certificates, stores the generated proxy certificate by
	    default in /tmp. Specific vulnerabilities in handling such
	    files were reported in myproxy-admin-adduser, grid-ca-sign
	    and grid-security-config.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2006-4232</cvename>
      <cvename>CVE-2006-4233</cvename>
      <url>http://www.globus.org/mail_archive/security-announce/2006/08/msg00000.html</url>
      <url>http://www.globus.org/mail_archive/security-announce/2006/08/msg00001.html</url>
    </references>
    <dates>
      <discovery>2006-08-08</discovery>
      <entry>2006-08-15</entry>
      <modified>2010-05-12</modified>
    </dates>
  </vuln>

  <vuln vid="9dda3ff1-2b02-11db-a6e2-000e0c2e438a">
    <topic>x11vnc -- authentication bypass vulnerability</topic>
    <affects>
      <package>
	<name>x11vnc</name>
	<range><lt>0.8.2</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Ludwig Nussel reports that x11vnc is vulnerable to an
	  authentication bypass vulnerability.	The vulnerability is
	  caused by an error in auth.c.  This could allow a remote
	  attacker to gain unauthorized and unauthenticated access
	  to the system.</p>
      </body>
    </description>
    <references>
      <bid>18977</bid>
      <cvename>CVE-2006-2450</cvename>
      <url>http://bugs.debian.org/376824</url>
    </references>
    <dates>
      <discovery>2006-08-08</discovery>
      <entry>2006-08-13</entry>
    </dates>
  </vuln>

  <vuln vid="9855ac8e-2aec-11db-a6e2-000e0c2e438a">
    <topic>alsaplayer -- multiple vulnerabilities</topic>
    <affects>
      <package>
	<name>alsaplayer</name>
	<range><gt>0</gt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Luigi Auriemma reports three vulnerabilities within
	  alsaplayer:</p>
	<blockquote cite="http://aluigi.altervista.org/adv/alsapbof-adv.txt">
	  <ul>
	    <li>The function which handles the HTTP connections is
	      vulnerable to a buffer-overflow that happens when it uses
	      sscanf for copying the URL in the Location's field
	      received from the server into the redirect buffer of only
	      1024 bytes declared in http_open.</li>
	    <li>A buffer-overflow exists in the functions which add items
	      to the playlist when the GTK interface is used (so the other
	      interfaces are not affected by this problem): new_list_item
	      and CbUpdated in interface/gtk/PlaylistWindow.cpp.</li>
	    <li>AlsaPlayer automatically queries the CDDB server
	      specified in its configuration (by default
	      freedb.freedb.org) when the user choices the CDDA function
	      for playing audio CDs.  The function which queries the
	      server uses a buffer of 20 bytes and one of 9 for storing
	      the category and ID strings received from the server while
	      the buffer which contains this server's response is 32768
	      bytes long.  Naturally for exploiting this bug the attacker
	      must have control of the freedb server specified in the
	      AlsaPlayer's configuration.</li>
	  </ul>
	</blockquote>
	<p>These vulnerabilities could allow a remote attacker to
	  execute arbitrary code, possibly gaining access to the
	  system.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2006-4089</cvename>
      <bid>19450</bid>
      <url>http://aluigi.altervista.org/adv/alsapbof-adv.txt</url>
    </references>
    <dates>
      <discovery>2006-08-09</discovery>
      <entry>2006-08-13</entry>
      <modified>2010-05-12</modified>
    </dates>
  </vuln>

  <vuln vid="17f53c1d-2ae9-11db-a6e2-000e0c2e438a">
    <topic>postgresql -- encoding based SQL injection</topic>
    <affects>
      <package>
	<name>postgresql</name>
	<name>postgresql-server</name>
	<name>ja-postgresql</name>
	<range><ge>7.3</ge><lt>7.3.15</lt></range>
	<range><ge>7.4</ge><lt>7.4.13</lt></range>
	<range><ge>8.0.0</ge><lt>8.0.8</lt></range>
	<range><ge>8.1.0</ge><lt>8.1.4</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The PostgreSQL development team reports:</p>
	<blockquote cite="http://www.postgresql.org/docs/techdocs.50">
	  <p>An attacker able to submit crafted strings to an
	    application that will embed those strings in SQL commands
	    can use invalidly-encoded multibyte characters to bypass
	    standard string-escaping methods, resulting in possible
	    injection of hostile SQL commands into the database.  The
	    attacks covered here work in any multibyte encoding.</p>
	  <p>The widely-used practice of escaping ASCII single quote
	    "'" by turning it into "\'" is unsafe when operating in
	    multibyte encodings that allow 0x5c (ASCII code for
	    backslash) as the trailing byte of a multibyte character;
	    this includes at least SJIS, BIG5, GBK, GB18030, and UHC.
	    An application that uses this conversion while embedding
	    untrusted strings in SQL commands is vulnerable to
	    SQL-injection attacks if it communicates with the server in
	    one of these encodings.  While the standard client libraries
	    used with PostgreSQL have escaped "'" in the safe,
	    SQL-standard way of "''" for some time, the older practice
	    remains common.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <bid>18092</bid>
      <cvename>CVE-2006-2313</cvename>
      <cvename>CVE-2006-2314</cvename>
      <url>http://www.postgresql.org/docs/techdocs.50</url>
    </references>
    <dates>
      <discovery>2006-05-11</discovery>
      <entry>2006-08-13</entry>
    </dates>
  </vuln>

  <vuln vid="65c8ecf9-2adb-11db-a6e2-000e0c2e438a">
    <topic>postgresql -- multiple vulnerabilities</topic>
    <affects>
      <package>
	<name>postgresql</name>
	<name>postgresql-server</name>
	<name>ja-postgresql</name>
	<range><ge>7.2</ge><lt>7.2.7</lt></range>
	<range><ge>7.3</ge><lt>7.3.9</lt></range>
	<range><ge>7.4</ge><lt>7.4.7</lt></range>
	<range><ge>8.0.0</ge><lt>8.0.1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Multiple vulnerabilities had been reported in various
	  versions of PostgreSQL:</p>
	<ul>
	  <li>The EXECUTE restrictions can be bypassed by using the
	    AGGREGATE function, which is missing a permissions check.</li>
	  <li>A buffer overflow exists in gram.y which could allow an
	    attacker to execute arbitrary code by sending a large
	    number of arguments to a refcursor function, found in
	    gram.y</li>
	  <li>The intagg contributed module allows an attacker to crash
	    the server (Denial of Service) by constructing a malicious
	    crafted array.</li>
	</ul>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-0244</cvename>
      <cvename>CVE-2005-0245</cvename>
      <cvename>CVE-2005-0246</cvename>
      <url>http://secunia.com/advisories/12948</url>
    </references>
    <dates>
      <discovery>2005-02-01</discovery>
      <entry>2006-08-13</entry>
    </dates>
  </vuln>

  <vuln vid="fcb90eb0-2ace-11db-a6e2-000e0c2e438a">
    <topic>mysql -- format string vulnerability</topic>
    <affects>
      <package>
	<name>mysql-server</name>
	<range><ge>5.1</ge><lt>5.1.6</lt></range>
	<range><ge>5.0</ge><lt>5.0.19</lt></range>
	<range><ge>4.1</ge><lt>4.1.18</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Jean-David Maillefer reports a Denial of Service vulnerability
	  within MySQL.  The vulnerability is caused by improper checking
	  of the data_format routine, which cause the MySQL server to
	  crash.  The crash is triggered by the following code:<br/>
	  <code>"SELECT date_format('%d%s', 1);</code></p>
      </body>
    </description>
    <references>
      <bid>19032</bid>
      <cvename>CVE-2006-3469</cvename>
      <url>http://bugs.mysql.com/bug.php?id=20729</url>
    </references>
    <dates>
      <discovery>2006-06-27</discovery>
      <entry>2006-08-13</entry>
    </dates>
  </vuln>

  <vuln vid="21b7c550-2a22-11db-a6e2-000e0c2e438a">
    <topic>squirrelmail -- random variable overwrite vulnerability</topic>
    <affects>
      <package>
	<name>ja-squirrelmail</name>
	<range><ge>1.4.0</ge><lt>1.4.8,2</lt></range>
      </package>
      <package>
	<name>squirrelmail</name>
	<range><ge>1.4.0</ge><lt>1.4.8</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The SquirrelMail developers report:</p>
	<blockquote cite="http://www.squirrelmail.org/security/issue/2006-08-11">
	  <p>A logged in user could overwrite random variables in
	    compose.php, which might make it possible to read/write
	    other users' preferences or attachments.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2006-4019</cvename>
      <url>http://www.squirrelmail.org/security/issue/2006-08-11</url>
    </references>
    <dates>
      <discovery>2006-08-11</discovery>
      <entry>2006-08-12</entry>
    </dates>
  </vuln>

  <vuln vid="90064567-28b1-11db-844d-000c6ec775d9">
    <topic>rubygem-rails -- evaluation of ruby code</topic>
    <affects>
      <package>
	<name>rubygem-rails</name>
	<range><ge>1.1.0</ge><lt>1.1.3</lt></range>
	<range><ge>1.1.4</ge><lt>1.1.6</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Ruby on Rails blog reports:</p>
	<blockquote cite="http://weblog.rubyonrails.org/2006/8/10/rails-1-1-6-backports-and-full-disclosure">
	  <p>With Rails 1.1.0 through 1.1.5 (minus the short-lived 1.1.3),
	    you can trigger the evaluation of Ruby code through the URL
	    because of a bug in the routing code of Rails. This means that
	    you can essentially take down a Rails process by starting
	    something like /script/profiler, as the code will run for a
	    long time and that process will be hung while it happens.
	    Other URLs can even cause data loss.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <url>http://weblog.rubyonrails.org/2006/8/10/rails-1-1-6-backports-and-full-disclosure</url>
    </references>
    <dates>
      <discovery>2006-08-09</discovery>
      <entry>2006-08-10</entry>
    </dates>
  </vuln>

  <vuln vid="342d2e48-26db-11db-9275-000475abc56f">
    <topic>clamav -- heap overflow vulnerability</topic>
    <affects>
      <package>
	<name>clamav</name>
	<range><ge>0.88.1</ge><lt>0.88.4</lt></range>
      </package>
      <package>
	<name>clamav-devel</name>
	<range><lt>20060808</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Clamav team reports:</p>
	<blockquote cite="http://www.clamav.net/security/0.88.4.html">
	  <p>A heap overflow vulnerability was discovered in libclamav
	    which could cause a denial of service or allow the
	    execution of arbitrary code.</p>
	  <p>The problem is specifically located in the PE file rebuild
	    function used by the UPX unpacker.</p>
	  <p>Relevant code from libclamav/upx.c:</p>
	  <p>
	    memcpy(dst, newbuf, foffset);
	    *dsize = foffset;
	    free(newbuf);

	    cli_dbgmsg("UPX: PE structure rebuilt from compressed file\n");
	    return 1;</p>
	  <p>Due to improper validation it is possible to overflow the above
	    memcpy() beyond the allocated memory block.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2006-4018</cvename>
      <url>http://www.clamav.net/security/0.88.4.html</url>
    </references>
    <dates>
      <discovery>2006-08-07</discovery>
      <entry>2006-08-08</entry>
    </dates>
  </vuln>

  <vuln vid="c905298c-2274-11db-896e-000ae42e9b93">
    <topic>drupal -- XSS vulnerability</topic>
    <affects>
      <package>
	<name>drupal</name>
	<range><lt>4.6.9</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Drupal project reports:</p>
	<blockquote cite="http://drupal.org/files/sa-2006-011/advisory.txt">
	  <p>A malicious user can execute a cross site scripting attack
	    by enticing someone to visit a Drupal site via a specially
	    crafted link.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <url>http://drupal.org/files/sa-2006-011/advisory.txt</url>
    </references>
    <dates>
      <discovery>2006-08-02</discovery>
      <entry>2006-08-02</entry>
      <modified>2006-08-08</modified>
    </dates>
  </vuln>

  <vuln vid="ed529baa-21c6-11db-b625-02e081235dab">
    <topic>gnupg -- 2 more possible memory allocation attacks</topic>
    <affects>
      <package>
	<name>gnupg</name>
	<range><lt>1.4.5</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Author reports:</p>
	<blockquote cite="http://lists.gnupg.org/pipermail/gnupg-announce/2006q3/000229.html">
	  <p>Fixed 2 more possible memory allocation attacks.  They are
	    similar to the problem we fixed with 1.4.4.  This bug can easily
	    be exploted for a DoS; remote code execution is not entirely
	    impossible.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <url>http://lists.gnupg.org/pipermail/gnupg-announce/2006q3/000229.html</url>
    </references>
    <dates>
      <discovery>2006-08-01</discovery>
      <entry>2006-08-02</entry>
    </dates>
  </vuln>

  <vuln vid="76562594-1f19-11db-b7d4-0008743bf21a">
    <topic>ruby -- multiple vulnerabilities</topic>
    <affects>
      <package>
	<name>ruby</name>
	<name>ruby_static</name>
	<range><gt>1.6.*</gt><lt>1.8.*</lt></range>
	<range><gt>1.8.*</gt><lt>1.8.4_9,1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/21009/">
	  <p>Two vulnerabilities have been reported in Ruby, which can
	    be exploited by malicious people to bypass certain security
	    restrictions.</p>
	  <ol>
	    <li>An error in the handling of the "alias" functionality
	      can be exploited to bypass the safe level protection and
	      replace methods called in the trusted level.</li>
	    <li>An error caused due to directory operations not being
	      properly checked can be exploited to bypass the safe
	      level protection and close untainted directory streams.</li>
	  </ol>
	</blockquote>
      </body>
    </description>
    <references>
      <bid>18944</bid>
      <cvename>CVE-2006-3694</cvename>
      <url>http://secunia.com/advisories/21009/</url>
      <url>http://jvn.jp/jp/JVN%2383768862/index.html</url>
      <url>http://jvn.jp/jp/JVN%2313947696/index.html</url>
    </references>
    <dates>
      <discovery>2006-07-12</discovery>
      <entry>2006-07-29</entry>
      <modified>2006-07-30</modified>
    </dates>
  </vuln>

  <vuln vid="dc8c08c7-1e7c-11db-88cf-000c6ec775d9">
    <topic>apache -- mod_rewrite buffer overflow vulnerability</topic>
    <affects>
      <package>
	<name>apache</name>
	<range><ge>1.3.28</ge><lt>1.3.36_1</lt></range>
	<range><ge>2.0.46</ge><lt>2.0.58_2</lt></range>
	<range><ge>2.2.0</ge><lt>2.2.2_1</lt></range>
      </package>
      <package>
	<name>apache+mod_perl</name>
	<range><ge>1.3.28</ge><lt>1.3.36_1</lt></range>
      </package>
      <package>
	<name>apache+ipv6</name>
	<range><ge>1.3.28</ge><lt>1.3.37</lt></range>
      </package>
      <package>
	<name>apache_fp</name>
	<range><ge>0</ge></range>
      </package>
      <package>
	<name>ru-apache</name>
	<range><ge>1.3.28</ge><lt>1.3.37+30.23</lt></range>
      </package>
      <package>
	<name>ru-apache+mod_ssl</name>
	<range><ge>1.3.28</ge><lt>1.3.34.1.57_2</lt></range>
      </package>
      <package>
	<name>apache+ssl</name>
	<range><ge>1.3.28</ge><lt>1.3.34.1.57_2</lt></range>
      </package>
      <package>
	<name>apache+mod_ssl</name>
	<name>apache+mod_ssl+ipv6</name>
	<name>apache+mod_ssl+mod_accel</name>
	<name>apache+mod_ssl+mod_accel+ipv6</name>
	<name>apache+mod_ssl+mod_accel+mod_deflate</name>
	<name>apache+mod_ssl+mod_accel+mod_deflate+ipv6</name>
	<name>apache+mod_ssl+mod_deflate</name>
	<name>apache+mod_ssl+mod_deflate+ipv6</name>
	<name>apache+mod_ssl+mod_snmp</name>
	<name>apache+mod_ssl+mod_snmp+mod_accel</name>
	<name>apache+mod_ssl+mod_snmp+mod_accel+ipv6</name>
	<name>apache+mod_ssl+mod_snmp+mod_deflate</name>
	<name>apache+mod_ssl+mod_snmp+mod_deflate+ipv6</name>
	<name>apache+mod_ssl+mod_snmp+mod_accel+mod_deflate+ipv6</name>
	<range><ge>1.3.28</ge><lt>1.3.36+2.8.27_1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Apache Software Foundation and The Apache HTTP Server
	  Project reports:</p>
	<blockquote cite="http://marc.theaimsgroup.com/?l=apache-httpd-announce&amp;m=115409818602955">
	  <p>An off-by-one flaw exists in the Rewrite module,
	    mod_rewrite, as shipped with Apache 1.3 since 1.3.28, 2.0
	    since 2.0.46, and 2.2 since 2.2.0.</p>
	  <p>Depending on the manner in which Apache HTTP Server was
	    compiled, this software defect may result in a
	    vulnerability which, in combination with certain types of
	    Rewrite rules in the web server configuration files, could
	    be triggered remotely. For vulnerable builds, the nature
	    of the vulnerability can be denial of service (crashing of
	    web server processes) or potentially allow arbitrary code
	    execution. This issue has been rated as having important
	    security impact by the Apache HTTP Server Security Team.</p>
	  <p>This flaw does not affect a default installation of
	    Apache HTTP Server.  Users who do not use, or have not
	    enabled, the Rewrite module mod_rewrite are not affected
	    by this issue. This issue only affects installations using
	    a Rewrite rule with the following characteristics:</p>
	  <ul>
	    <li>The RewriteRule allows the attacker to control the
	      initial part of the rewritten URL (for example if the
	      substitution URL starts with $1)</li>
	    <li>The RewriteRule flags do NOT include any of the
	      following flags: Forbidden (F), Gone (G), or NoEscape
	      (NE).</li>
	  </ul>
	  <p>Please note that ability to exploit this issue is
	    dependent on the stack layout for a particular compiled
	    version of mod_rewrite. If the compiler used to compile
	    Apache HTTP Server has added padding to the stack
	    immediately after the buffer being overwritten, it will
	    not be possible to exploit this issue, and Apache HTTP
	    Server will continue operating normally.</p>
	  <p>The Apache HTTP Server project thanks Mark Dowd of McAfee
	    Avert Labs for the responsible reporting of this
	    vulnerability.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <certvu>395412</certvu>
      <cvename>CVE-2006-3747</cvename>
      <mlist msgid="44CA22D9.6020200@apache.org">http://marc.theaimsgroup.com/?l=apache-httpd-announce&amp;m=115409818602955</mlist>
    </references>
    <dates>
      <discovery>2006-07-27</discovery>
      <entry>2006-07-28</entry>
      <modified>2006-11-01</modified>
    </dates>
  </vuln>

  <vuln vid="e2a92664-1d60-11db-88cf-000c6ec775d9">
    <topic>mozilla -- multiple vulnerabilities</topic>
    <affects>
      <package>
	<name>firefox</name>
	<range><lt>1.5.0.5,1</lt></range>
	<range><gt>2.*,1</gt><lt>2.0_1,1</lt></range>
      </package>
      <package>
	<name>linux-firefox</name>
	<range><lt>1.5.0.5</lt></range>
      </package>
      <package>
	<name>linux-firefox-devel</name>
	<range><lt>3.0.a2006.07.26</lt></range>
      </package>
      <package>
	<name>seamonkey</name>
	<name>linux-seamonkey</name>
	<range><lt>1.0.3</lt></range>
      </package>
      <package>
	<name>thunderbird</name>
	<name>linux-thunderbird</name>
	<name>mozilla-thunderbird</name>
	<range><lt>1.5.0.5</lt></range>
      </package>
      <package>
	<name>mozilla</name>
	<name>linux-mozilla</name>
	<name>linux-mozilla-devel</name>
	<range><gt>0</gt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A Mozilla Foundation Security Advisory reports of multiple
	  issues.  Several of which can be used to run arbitrary code
	  with the privilege of the user running the program.</p>
	<blockquote cite="http://www.mozilla.org/projects/security/known-vulnerabilities.html#seamonkey1.0.3">
	  <ul>
	    <li>MFSA 2006-56 chrome: scheme loading remote content</li>
	    <li>MFSA 2006-55 Crashes with evidence of memory corruption
	      (rv:1.8.0.5)</li>
	    <li>MFSA 2006-54 XSS with
	      XPCNativeWrapper(window).Function(...)</li>
	    <li>MFSA 2006-53 UniversalBrowserRead privilege escalation</li>
	    <li>MFSA 2006-52 PAC privilege escalation using
	      Function.prototype.call</li>
	    <li>MFSA 2006-51 Privilege escalation using named-functions
	      and redefined "new Object()"</li>
	    <li>MFSA 2006-50 JavaScript engine vulnerabilities</li>
	    <li>MFSA 2006-49 Heap buffer overwrite on malformed VCard</li>
	    <li>MFSA 2006-48 JavaScript new Function race condition</li>
	    <li>MFSA 2006-47 Native DOM methods can be hijacked across
	      domains</li>
	    <li>MFSA 2006-46 Memory corruption with simultaneous events</li>
	    <li>MFSA 2006-45 Javascript navigator Object Vulnerability</li>
	    <li>MFSA 2006-44 Code execution through deleted frame
	      reference</li>
	  </ul>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2006-3113</cvename>
      <cvename>CVE-2006-3677</cvename>
      <cvename>CVE-2006-3801</cvename>
      <cvename>CVE-2006-3802</cvename>
      <cvename>CVE-2006-3803</cvename>
      <cvename>CVE-2006-3804</cvename>
      <cvename>CVE-2006-3805</cvename>
      <cvename>CVE-2006-3806</cvename>
      <cvename>CVE-2006-3807</cvename>
      <cvename>CVE-2006-3808</cvename>
      <cvename>CVE-2006-3809</cvename>
      <cvename>CVE-2006-3810</cvename>
      <cvename>CVE-2006-3811</cvename>
      <cvename>CVE-2006-3812</cvename>
      <url>http://www.mozilla.org/projects/security/known-vulnerabilities.html#seamonkey1.0.3</url>
      <url>http://www.mozilla.org/security/announce/2006/mfsa2006-44.html</url>
      <url>http://www.mozilla.org/security/announce/2006/mfsa2006-45.html</url>
      <url>http://www.mozilla.org/security/announce/2006/mfsa2006-46.html</url>
      <url>http://www.mozilla.org/security/announce/2006/mfsa2006-47.html</url>
      <url>http://www.mozilla.org/security/announce/2006/mfsa2006-48.html</url>
      <url>http://www.mozilla.org/security/announce/2006/mfsa2006-49.html</url>
      <url>http://www.mozilla.org/security/announce/2006/mfsa2006-50.html</url>
      <url>http://www.mozilla.org/security/announce/2006/mfsa2006-51.html</url>
      <url>http://www.mozilla.org/security/announce/2006/mfsa2006-52.html</url>
      <url>http://www.mozilla.org/security/announce/2006/mfsa2006-53.html</url>
      <url>http://www.mozilla.org/security/announce/2006/mfsa2006-54.html</url>
      <url>http://www.mozilla.org/security/announce/2006/mfsa2006-55.html</url>
      <url>http://www.mozilla.org/security/announce/2006/mfsa2006-56.html</url>
    </references>
    <dates>
      <discovery>2006-07-25</discovery>
      <entry>2006-07-27</entry>
      <modified>2006-11-02</modified>
    </dates>
  </vuln>

  <vuln vid="5f2a0c40-1322-11db-bd23-000475abc56f">
    <topic>zope -- information disclosure vulnerability</topic>
    <affects>
      <package>
	<name>zope</name>
	<range><ge>2.7.0</ge><lt>2.7.9</lt></range>
	<range><ge>2.8.0</ge><lt>2.8.7</lt></range>
	<range><ge>2.9.0</ge><lt>2.9.3</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Zope team reports:</p>
	<blockquote cite="http://www.zope.org/Products/Zope/Hotfix-2006-07-05/Hotfix-2006-07-05/view">
	  <p>Unspecified vulnerability in (Zope2) allows local users
	    to obtain sensitive information via unknown attack vectors
	    related to the docutils module and "restructured text".</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2006-3458</cvename>
      <url>http://www.zope.org/Products/Zope/Hotfix-2006-07-05/Hotfix-2006-07-05/view</url>
    </references>
    <dates>
      <discovery>2006-07-05</discovery>
      <entry>2006-07-14</entry>
    </dates>
  </vuln>

  <vuln vid="6da7344b-128a-11db-b25f-00e00c69a70d">
    <topic>drupal -- multiple vulnerabilities</topic>
    <affects>
      <package>
	<name>drupal</name>
	<range><lt>4.6.8</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Drupal team reports:</p>
	<blockquote cite="http://drupal.org/node/66767">
	  <p>Vulnerability: XSS Vulnerability in taxonomy module</p>
	  <p>It is possible for a malicious user to insert and execute
	    XSS into terms, due to lack of validation on output of the
	    page title. The fix wraps the display of terms in
	    check_plain().</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2006-2833</cvename>
      <url>http://drupal.org/node/66767</url>
    </references>
    <dates>
      <discovery>2006-05-18</discovery>
      <entry>2006-07-13</entry>
      <modified>2006-07-14</modified>
    </dates>
  </vuln>

  <vuln vid="67dbe99f-0f09-11db-94f8-00e029485e38">
    <topic>shoutcast -- cross-site scripting, information exposure</topic>
    <affects>
      <package>
	<name>shoutcast</name>
	<name>linux-shoutcast</name>
	<range><lt>1.9.7</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Goober's advisory reports reports that shoutcast is vulnerable to an
	  arbitrary file reading vulnerability:</p>
	<blockquote cite="http://people.ksp.sk/~goober/advisory/001-shoutcast.html">
	<p>Impact of the vulnerability depends on the way the product was
	  installed.  In general, the vulnerability allows the attacker to read
	  any file which can be read by the Shoutcast server process.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2006-3007</cvename>
      <url>http://secunia.com/advisories/20524/</url>
      <url>http://people.ksp.sk/~goober/advisory/001-shoutcast.html</url>
    </references>
    <dates>
      <discovery>2006-06-09</discovery>
      <entry>2006-07-11</entry>
    </dates>
  </vuln>

  <vuln vid="b168ddea-105a-11db-ac96-000c6ec775d9">
    <topic>samba -- memory exhaustion DoS in smbd</topic>
    <affects>
      <package>
	<name>samba</name>
	<name>ja-samba</name>
	<range><ge>3.0.1,1</ge><lt>3.0.23,1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Samba Team reports:</p>
	<blockquote cite="http://www.samba.org/samba/security/CAN-2006-3403.html">
	  <p>The smbd daemon maintains internal data structures used
	    track active connections to file and printer shares.  In
	    certain circumstances an attacker may be able to
	    continually increase the memory usage of an smbd process
	    by issuing a large number of share connection requests.
	    This defect affects all Samba configurations.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2006-3403</cvename>
      <url>http://www.samba.org/samba/security/CAN-2006-3403.html</url>
    </references>
    <dates>
      <discovery>2006-07-10</discovery>
      <entry>2006-07-10</entry>
    </dates>
  </vuln>

  <vuln vid="a876df84-0fef-11db-ac96-000c6ec775d9">
    <topic>twiki -- multiple file extensions file upload vulnerability</topic>
    <affects>
      <package>
	<name>twiki</name>
	<range><lt>4.0.4,1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A TWiki Security Alert reports:</p>
	<blockquote cite="http://twiki.org/cgi-bin/view/Codev/SecurityAlertSecureFileUploads">
	  <p>The TWiki upload filter already prevents executable
	    scripts such as .php, .php1, .phps, .pl from potentially
	    getting executed by appending a .txt suffix to the
	    uploaded filename. However, PHP and some other types
	    allows additional file suffixes, such as .php.en, .php.1,
	    and .php.2. TWiki does not check for these suffixes,
	    e.g. it is possible to upload php scripts with such
	    suffixes without the .txt filename padding.</p>
	</blockquote>
	<p>This issue can also be worked around with a restrictive web
	  server configuration.  See the
	  <a href="http://twiki.org/cgi-bin/view/Codev/SecurityAlertSecureFileUploads">
	  TWiki Security Alert</a> for more information about how to do
	  this.</p>
      </body>
    </description>
    <references>
      <bid>18854</bid>
      <cvename>CVE-2006-3336</cvename>
      <url>http://secunia.com/advisories/20992/</url>
      <url>http://twiki.org/cgi-bin/view/Codev/SecurityAlertSecureFileUploads</url>
    </references>
    <dates>
      <discovery>2006-07-05</discovery>
      <entry>2006-07-10</entry>
    </dates>
  </vuln>

  <vuln vid="b0d61f73-0e11-11db-a47b-000c2957fdf1">
    <topic>trac -- reStructuredText breach of privacy and denial of service vulnerability</topic>
    <affects>
      <package>
	<name>trac</name>
	<name>ja-trac</name>
	<range><lt>0.9.6</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Trac 0.9.6 Release Notes reports:</p>
	<blockquote cite="http://lists.edgewall.com/archive/trac-announce/2006-July/000013.html">
	  <p>Fixed reStructuredText breach of privacy and denial of
	    service vulnerability found by Felix Wiemann.</p>
	  <p>The discovered vulnerability requires docutils to be
	    installed and enabled. Systems that do not have docutils
	    installed or enabled are not vulnerable. As of this
	    version version 0.3.9 or greater of docutils is required
	    for using reStructuredText markup in Trac.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-3980</cvename>
      <cvename>CVE-2005-4305</cvename>
      <cvename>CVE-2005-4065</cvename>
      <url>http://projects.edgewall.com/trac/wiki/ChangeLog</url>
      <mlist>http://lists.edgewall.com/archive/trac-announce/2006-July/000013.html</mlist>
    </references>
    <dates>
      <discovery>2006-07-06</discovery>
      <entry>2006-07-07</entry>
      <modified>2010-05-12</modified>
    </dates>
  </vuln>

  <vuln vid="e94cb43d-0c4a-11db-9016-0050bf27ba24">
    <topic>horde -- various problems in dereferrer</topic>
    <affects>
      <package>
	<name>horde</name>
	<name>horde-php5</name>
	<range><lt>3.1.2</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Horde 3.1.2 release announcement:</p>
	<blockquote cite="http://lists.horde.org/archives/announce/2006/000288.html">
	  <p>Security Fixes:</p>
	  <ul>
	    <li>Closed XSS problems in dereferrer (IE only), help viewer
	      and problem reporting screen.</li>
	    <li>Removed unused image proxy code from dereferrer.</li>
	  </ul>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2006-3548</cvename>
      <url>http://lists.horde.org/archives/announce/2006/000288.html</url>
    </references>
    <dates>
      <discovery>2006-06-28</discovery>
      <entry>2006-07-05</entry>
      <modified>2010-05-12</modified>
    </dates>
  </vuln>

  <vuln vid="f70d09cb-0c46-11db-aac7-000c6ec775d9">
    <topic>mambo -- SQL injection vulnerabilities</topic>
    <affects>
      <package>
	<name>mambo</name>
	<range><lt>4.5.4</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Team Mambo reports that two SQL injection
	  vulnerabilities have been found in Mambo.  The
	  vulnerabilities exists due to missing sanitation of the
	  <code>title</code> and <code>catid</code> parameters in the
	  <code>weblinks.php</code> page and can lead to execution of
	  arbitrary SQL code.</p>
      </body>
    </description>
    <references>
      <bid>16775</bid>
      <cvename>CVE-2006-0871</cvename>
      <cvename>CVE-2006-1794</cvename>
      <cvename>CVE-2006-3262</cvename>
      <cvename>CVE-2006-3263</cvename>
      <mlist msgid="20060617123242.1684.qmail@securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=115056811230529</mlist>
      <url>http://secunia.com/advisories/18935/</url>
      <url>http://secunia.com/advisories/20745/</url>
      <url>http://www.mamboserver.com/?option=com_content&amp;task=view&amp;id=207</url>
      <url>http://www.gulftech.org/?node=research&amp;article_id=00104-02242006</url>
    </references>
    <dates>
      <discovery>2006-06-19</discovery>
      <entry>2006-07-05</entry>
      <modified>2006-10-05</modified>
    </dates>
  </vuln>

  <vuln vid="229577a8-0936-11db-bf72-00046151137e">
    <topic>phpmyadmin -- cross site scripting vulnerability</topic>
    <affects>
      <package>
	<name>phpMyAdmin</name>
	<range><lt>2.8.2</lt></range>
	</package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>phpmyadmin Site reports:</p>
	<blockquote cite="http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-4">
	  <p>It was possible to craft a request that contains XSS by attacking
	    the "table" parameter.</p>
	</blockquote>
      </body>
    </description>
    <references>
    <url>http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-4</url>
    <url>http://securitynews.ir/advisories/phpmyadmin281.txt</url>
    </references>
    <dates>
      <discovery>2006-06-30</discovery>
      <entry>2006-07-03</entry>
      <modified>2007-10-16</modified>
    </dates>
  </vuln>

  <vuln vid="227475c2-09cb-11db-9156-000e0c2e438a">
    <topic>webmin, usermin -- arbitrary file disclosure vulnerability</topic>
    <affects>
      <package>
	<name>webmin</name>
	<range><lt>1.290</lt></range>
      </package>
      <package>
	<name>usermin</name>
	<range><lt>1.220</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The webmin development team reports:</p>
	<blockquote cite="http://www.webmin.com/security.html">
	  <p>An attacker without a login to Webmin can read the
	    contents of any file on the server using a specially
	    crafted URL.  All users should upgrade to version
	    1.290 as soon as possible, or setup IP access control
	    in Webmin.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <bid>18744</bid>
      <url>http://www.webmin.com/security.html</url>
    </references>
    <dates>
      <discovery>2006-06-30</discovery>
      <entry>2006-07-02</entry>
    </dates>
  </vuln>

  <vuln vid="d2a43243-087b-11db-bc36-0008743bf21a">
    <topic>mutt -- Remote Buffer Overflow Vulnerability</topic>
    <affects>
      <package>
	<name>mutt</name>
	<name>mutt-lite</name>
	<range><le>1.4.2.1_2</le></range>
      </package>
      <package>
	<name>mutt-devel</name>
	<name>mutt-devel-lite</name>
	<range><le>1.5.11_2</le></range>
      </package>
      <package>
	<name>ja-mutt</name>
	<range><le>1.4.2.1.j1</le></range>
      </package>
      <package>
	<name>zh-mutt-devel</name>
	<range><le>1.5.11_20040617</le></range>
      </package>
      <package>
	<name>ja-mutt-devel</name>
	<range><le>1.5.6.j1_2</le></range>
      </package>
      <package>
	<name>mutt-ng</name>
	<range><le>20060501</le></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>SecurityFocus reports:</p>
	<blockquote cite="http://www.securityfocus.com/bid/18642">
	  <p>Mutt is prone to a remote buffer-overflow vulnerability.
	    This issue is due to the application's failure to properly
	    bounds-check user-supplied input before copying it to an
	    insufficiently sized memory buffer.</p>
	  <p>This issue may allow remote attackers to execute arbitrary
	    machine code in the context of the affected application.
	    Failed exploit attempts will likely crash the application,
	    denying further service to legitimate users.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <bid>18642</bid>
      <url>http://dev.mutt.org/cgi-bin/gitweb.cgi?p=mutt/.git;a=commit;h=dc0272b749f0e2b102973b7ac43dbd3908507540</url>
    </references>
    <dates>
      <discovery>2006-06-26</discovery>
      <entry>2006-06-30</entry>
    </dates>
  </vuln>

  <vuln vid="1f935f61-075d-11db-822b-728b50d539a3">
    <topic>Joomla -- multiple vulnerabilities</topic>
    <affects>
      <package>
	<name>joomla</name>
	<range><lt>1.0.10</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Joomla Site reports:</p>
	<blockquote cite="http://www.joomla.org/content/view/1510/74/">
	  <ul>
	    <li>Secured "Remember Me" functionality against SQL injection
	      attacks</li>
	    <li>Secured "Related Items" module against SQL injection
	      attacks</li>
	    <li>Secured "Weblinks" submission against SQL injection
	      attacks</li>
	    <li>Secured SEF from XSS vulnerability</li>
	    <li>Hardened frontend submission forms against spoofing</li>
	    <li>Secured mosmsg from misuse</li>
	    <li>Hardened mosgetparam by setting variable type to integer if
	      default value is detected as numeric</li>
	    <li>Secured com_messages from XSS vulnerability</li>
	    <li>Secured getUserStateFromRequest() from XSS vulnerability</li>
	  </ul>
	</blockquote>
      </body>
    </description>
    <references>
      <url>http://secunia.com/advisories/20746/</url>
      <url>http://www.joomla.org/content/view/1510/74/</url>
    </references>
    <dates>
      <discovery>2006-06-26</discovery>
      <entry>2006-06-30</entry>
    </dates>
  </vuln>

  <vuln vid="2be7c122-0614-11db-9156-000e0c2e438a">
    <topic>hashcash -- heap overflow vulnerability</topic>
    <affects>
      <package>
	<name>hashcash</name>
	<range><lt>1.22</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Andreas Seltenreich reports that hashcash is prone to a heap
	  overflow vulnerability.  This vulnerability is caused by
	  improper checking of memory allocations within the
	  "array_push()" function.  An attacker could trigger this
	  vulnerability by passing a lot of "-r" or "-j" flags from
	  the command line, this only applies when the application is
	  configured to allow command line options, or by passing a lot
	  of resource names when the application was started with the
	  "-m" flag set.  This could lead to a Denial or Service or
	  could allow remote access to the targeted system.</p>
      </body>
    </description>
    <references>
      <url>http://secunia.com/advisories/20800/</url>
      <url>http://www.hashcash.org/source/CHANGELOG</url>
    </references>
    <dates>
      <discovery>2006-06-27</discovery>
      <entry>2006-06-27</entry>
    </dates>
  </vuln>

  <vuln vid="f900bda8-0472-11db-bbf7-000c6ec775d9">
    <topic>gnupg -- user id integer overflow vulnerability</topic>
    <affects>
      <package>
	<name>gnupg</name>
	<range><lt>1.4.4</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>If GnuPG processes a userid with a very long packet length,
	  GnuPG can crash due to insufficient bounds check.  This can
	  result in a denial-of-service condition or potentially
	  execution of arbitrary code with the privileges of the user
	  running GnuPG.</p>
      </body>
    </description>
    <references>
      <bid>18554</bid>
      <cvename>CVE-2006-3082</cvename>
      <mlist msgid="87psgxic5e.fsf@wheatstone.g10code.de">http://marc.theaimsgroup.com/?l=gnupg-users&amp;m=115124706210430</mlist>
      <mlist msgid="20060531115548.A2E4923E4B6@dzeta.agava.net">http://marc.theaimsgroup.com/?l=full-disclosure&amp;m=114907659313360</mlist>
      <url>http://cvs.gnupg.org/cgi-bin/viewcvs.cgi/trunk/g10/parse-packet.c?rev=4157&amp;r1=4141&amp;r2=4157</url>
    </references>
    <dates>
      <discovery>2006-05-31</discovery>
      <entry>2006-06-25</entry>
    </dates>
  </vuln>

  <vuln vid="0a4cd819-0291-11db-bbf7-000c6ec775d9">
    <cancelled/>
  </vuln>

  <vuln vid="09429f7c-fd6e-11da-b1cd-0050bf27ba24">
    <topic>horde -- multiple parameter cross site scripting vulnerabilities</topic>
    <affects>
      <package>
	<name>horde</name>
	<name>horde-php5</name>
	<range><le>3.1.1</le></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>FrSIRT advisory ADV-2006-2356 reports:</p>
	<blockquote cite="http://www.frsirt.com/english/advisories/2006/2356">
	  <p>Multiple vulnerabilities have been identified in Horde
	    Application Framework, which may be exploited by attackers
	    to execute arbitrary scripting code. These flaws are due
	    to input validation errors in the "test.php" and
	    "templates/problem/problem.inc" scripts that do not
	    validate the "url", "name", "email", "subject" and
	    "message" parameters, which could be exploited by
	    attackers to cause arbitrary scripting code to be executed
	    by the user's browser in the security context of an
	    affected Web site.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2006-2195</cvename>
      <url>http://www.frsirt.com/english/advisories/2006/2356</url>
      <url>http://cvs.horde.org/diff.php?f=horde%2Ftest.php&amp;r1=1.145&amp;r2=1.146</url>
      <url>http://cvs.horde.org/diff.php?f=horde%2Ftemplates%2Fproblem%2Fproblem.inc&amp;r1=2.25&amp;r2=2.26</url>
    </references>
    <dates>
      <discovery>2006-06-10</discovery>
      <entry>2006-06-17</entry>
    </dates>
  </vuln>

  <vuln vid="09c92f3a-fd49-11da-995c-605724cdf281">
    <topic>WebCalendar -- information disclosure vulnerability</topic>
    <affects>
      <package>
	<name>WebCalendar</name>
	<range><lt>1.0.4</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/20367/">
	  <p>socsam has discovered a vulnerability in WebCalendar,
	    which can be exploited by malicious people to bypass
	    certain security restrictions and disclose sensitive
	    information.</p>
	  <p>Input passed to the "includedir" parameter isn't properly
	    verified, before it is used in an "fopen()" call. This can
	    be exploited to load an arbitrary setting file from an
	    external web site.</p>
	  <p>This can further be exploited to disclose the content of
	    arbitrary files by defining the "user_inc" variable in a
	    malicious setting file.</p>
	  <p>Successful exploitation requires that "register_globals"
	    is enabled.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <bid>18175</bid>
      <cvename>CVE-2006-2762</cvename>
      <url>http://www.securityfocus.com/archive/1/435379</url>
      <url>http://www.securityfocus.com/archive/1/436263</url>
    </references>
    <dates>
      <discovery>2006-05-30</discovery>
      <entry>2006-06-16</entry>
      <modified>2006-06-17</modified>
    </dates>
  </vuln>

  <vuln vid="c611be81-fbc2-11da-9156-000e0c2e438a">
    <topic>sendmail -- Incorrect multipart message handling</topic>
    <affects>
      <package>
	<name>FreeBSD</name>
	<range><ge>4.11</ge><lt>4.11_19</lt></range>
	<range><ge>5.3</ge><lt>5.3_31</lt></range>
	<range><ge>5.4</ge><lt>5.4_16</lt></range>
	<range><ge>5.5</ge><lt>5.5_2</lt></range>
	<range><ge>6.0</ge><lt>6.0_9</lt></range>
	<range><ge>6.1</ge><lt>6.1_2</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description</h1>
	<p>A suitably malformed multipart MIME message can cause
	  sendmail to exceed predefined limits on its stack usage.</p>
	<h1>Impact</h1>
	<p>An attacker able to send mail to, or via, a server can cause
	  queued messages on the system to not be delivered, by causing
	  the sendmail process which handles queued messages to crash.
	  Note that this will not stop new messages from entering the
	  queue (either from local processes, or incoming via SMTP).</p>
	<h1>Workaround</h1>
	<p>No workaround is available, but systems which do not receive
	  email from untrusted sources are not vulnerable.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2006-1173</cvename>
      <freebsdsa>SA-06:17.sendmail</freebsdsa>
    </references>
    <dates>
      <discovery>2006-06-14</discovery>
      <entry>2006-06-14</entry>
    </dates>
  </vuln>

  <vuln vid="23573650-f99a-11da-994e-00142a5f241c">
    <topic>dokuwiki -- multiple vulnerabilities</topic>
    <affects>
      <package>
	<name>dokuwiki</name>
	<range><lt>20060309_2</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Multiple vulnerabilities have been reported within dokuwiki.
	  dokuwiki is proven vulnerable to:</p>
	<ul>
	  <li>arbitrary PHP code insertion via spellcheck module,</li>
	  <li>XSS attack via "Update your account profile,"</li>
	  <li>bypassing of ACL controls when enabled.</li>
	</ul>
      </body>
    </description>
    <references>
      <url>http://bugs.splitbrain.org/index.php?do=details&amp;id=820</url>
      <url>http://bugs.splitbrain.org/index.php?do=details&amp;id=823</url>
      <url>http://bugs.splitbrain.org/index.php?do=details&amp;id=825</url>
    </references>
    <dates>
      <discovery>2006-05-31</discovery>
      <entry>2006-06-11</entry>
      <modified>2006-06-12</modified>
    </dates>
</vuln>

  <vuln vid="107e2ee5-f941-11da-b1fa-020039488e34">
    <topic>libxine -- buffer overflow vulnerability</topic>
    <affects>
      <package>
	<name>libxine</name>
	<range><lt>1.1.1_6</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A Secunia Advisory reports:</p>
	<blockquote cite="http://secunia.com/advisories/20369">
	  <p>Federico L. Bossi Bonin has discovered a weakness in xine-lib,
	    which can be exploited by malicious people to crash certain
	    applications on a user's system.</p>
	  <p>The weakness is cause due to a heap corruption within the
	    "xineplug_inp_http.so" plugin when handling an overly large
	    reply from the HTTP server. This can be exploited to crash
	    an application that uses the plugin (e.g. gxine).</p>
	</blockquote>
      </body>
    </description>
    <references>
      <url>http://secunia.com/advisories/20369</url>
      <cvename>CVE-2006-2802</cvename>
      <bid>18187</bid>
    </references>
    <dates>
      <discovery>2006-05-31</discovery>
      <entry>2006-06-11</entry>
    </dates>
  </vuln>

  <vuln vid="cf3b9a96-f7bb-11da-9156-000e0c2e438a">
    <topic>smbfs -- chroot escape</topic>
    <affects>
      <package>
	<name>FreeBSD</name>
	<range><ge>4.10</ge><lt>4.10_24</lt></range>
	<range><ge>4.11</ge><lt>4.11_18</lt></range>
	<range><ge>5.3</ge><lt>5.3_30</lt></range>
	<range><ge>5.4</ge><lt>5.4_15</lt></range>
	<range><ge>5.5</ge><lt>5.5_1</lt></range>
	<range><ge>6.0</ge><lt>6.0_8</lt></range>
	<range><ge>6.1</ge><lt>6.1_1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description</h1>
	<p>smbfs does not properly sanitize paths containing a backslash
	  character; in particular the directory name '..\' is
	  interpreted as the parent directory by the SMB/CIFS server,
	  but smbfs handles it in the same manner as any other
	  directory.</p>
	<h1>Impact</h1>
	<p>When inside a chroot environment which resides on a smbfs
	  mounted file-system it is possible for an attacker to escape
	  out of this chroot to any other directory on the smbfs
	  mounted file-system.</p>
	<h1>Workaround</h1>
	<p>Mount the smbfs file-systems which need to be used with
	  chroot on top, in a way so the chroot directory is exactly on
	  the mount point and not a sub directory</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2006-2654</cvename>
      <freebsdsa>SA-06:16.smbfs</freebsdsa>
    </references>
    <dates>
      <discovery>2006-05-31</discovery>
      <entry>2006-06-09</entry>
    </dates>
  </vuln>

  <vuln vid="0ac1aace-f7b9-11da-9156-000e0c2e438a">
    <topic>ypserv -- Inoperative access controls in ypserv</topic>
    <affects>
      <package>
	<name>FreeBSD</name>
	<range><ge>5.3</ge><lt>5.3_30</lt></range>
	<range><ge>5.4</ge><lt>5.4_15</lt></range>
	<range><ge>5.5</ge><lt>5.5_1</lt></range>
	<range><ge>6.0</ge><lt>6.0_8</lt></range>
	<range><ge>6.1</ge><lt>6.1_1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description</h1>
	<p>There are two documented methods of restricting access to
	 NIS maps through ypserv(8): through the use of the
	 /var/yp/securenets file, and through the /etc/hosts.allow file.
	 While both mechanisms are implemented in the server, a change
	 in the build process caused the "securenets" access restrictions
	 to be inadvertantly disabled.</p>
	<h1>Impact</h1>
	<p>ypserv(8) will not load or process any of the networks or
	  hosts specified in the /var/yp/securenets file, rendering
	  those access controls ineffective.</p>
	<h1>Workaround</h1>
	<p>One possible workaround is to use /etc/hosts.allow for access
	  control, as shown by examples in that file.</p>
	<p>Another workaround is to use a firewall (e.g., ipfw(4),
	  ipf(4), or pf(4)) to limit access to RPC functions from
	  untrusted systems or networks, but due to the complexities of
	  RPC, it might be difficult to create a set of firewall rules
	  which accomplish this without blocking all access to the
	  machine in question.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2006-2655</cvename>
      <freebsdsa>SA-06:15.ypserv</freebsdsa>
    </references>
    <dates>
      <discovery>2006-05-31</discovery>
      <entry>2006-06-09</entry>
    </dates>
  </vuln>

  <vuln vid="ec2f2ff5-f710-11da-9156-000e0c2e438a">
    <topic>freeradius -- multiple vulnerabilities</topic>
    <affects>
      <package>
	<name>freeradius</name>
	<range><ge>1.0.0</ge><le>1.0.4</le></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The freeradious development team reports:</p>
	<blockquote cite="http://www.freeradius.org/security.html">
	  <p>Multiple issues exist with version 1.0.4, and all prior
	    versions of the server.  Externally exploitable
	    vulnerabilities exist only for sites that use the
	    rlm_sqlcounter module.  Those sites may be vulnerable to
	    SQL injection attacks, similar to the issues noted below.
	    All sites that have not deployed the rlm_sqlcounter module
	    are not vulnerable to external exploits.</p>
	  <p>The issues are:<br/>
	    SQL Injection attack in the rlm_sqlcounter module.<br/>
	    Buffer overflow in the rlm_sqlcounter module, that may cause
	    a server crash. <br/>
	    Buffer overflow while expanding %t, that may cause a server
	    crash.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <bid>17171</bid>
      <cvename>CVE-2005-4744</cvename>
    </references>
    <dates>
      <discovery>2005-09-09</discovery>
      <entry>2006-06-08</entry>
    </dates>
  </vuln>

  <vuln vid="1a216dfd-f710-11da-9156-000e0c2e438a">
    <topic>freeradius -- authentication bypass vulnerability</topic>
    <affects>
      <package>
	<name>freeradius</name>
	<range><gt>1.0.0</gt><le>1.1.0</le></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The freeradius development team reports:</p>
	<blockquote cite="http://www.freeradius.org/security.html">
	  <p>A validation issue exists with the EAP-MSCHAPv2 module
	    in all versions from 1.0.0 (where the module first
	    appeared) to 1.1.0. Insufficient input validation was being
	    done in the EAP-MSCHAPv2 state machine.  A malicious
	    attacker could manipulate their EAP-MSCHAPv2 client state
	    machine to potentially convince the server to bypass
	    authentication checks.  This bypassing could also result
	    in the server crashing</p>
	</blockquote>
      </body>
    </description>
    <references>
      <bid>17293</bid>
      <cvename>CVE-2006-1354</cvename>
    </references>
    <dates>
      <discovery>2006-06-03</discovery>
      <entry>2006-06-08</entry>
    </dates>
  </vuln>

  <vuln vid="00784d6e-f4ce-11da-87a1-000c6ec775d9">
    <topic>squirrelmail -- plugin.php local file inclusion vulnerability</topic>
    <affects>
      <package>
	<name>squirrelmail</name>
	<range><lt>1.4.6_1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The SquirrelMail Project Team reports:</p>
	<blockquote cite="http://www.squirrelmail.org/security/issue/2006-06-01">
	  <p>A security issue has been uncovered in
	    functions/plugin.php that could allow a remote user to
	    access local files on the server without requiring
	    login. This issue manifests itself if register_globals is
	    enabled, and magic_quotes_gpc is disabled.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <url>http://www.squirrelmail.org/security/issue/2006-06-01</url>
      <url>http://secunia.com/advisories/20406/</url>
    </references>
    <dates>
      <discovery>2006-06-01</discovery>
      <entry>2006-06-05</entry>
      <modified>2006-06-06</modified>
    </dates>
  </vuln>

  <vuln vid="af8dba15-f4cc-11da-87a1-000c6ec775d9">
    <topic>dokuwiki -- spellchecker remote PHP code execution</topic>
    <affects>
      <package>
	<name>dokuwiki</name>
	<range><lt>20060309_1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Stefan Esser reports:</p>
	<blockquote cite="http://www.hardened-php.net/advisory_042006.119.html">
	  <p>During the evaluation of DokuWiki for a german/korean
	    wiki of mine a flaw in DokuWiki's spellchecker was
	    discovered, that allows injecting arbitrary PHP commands,
	    by requesting a spellcheck on PHP commands in 'complex
	    curly syntax'.</p>
	  <p>Because the spellchecker is written as part of the AJAX
	    functionality of DokuWiki, it can be directly called by
	    any website visitor, without the need for a wiki
	    account.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <url>http://www.hardened-php.net/advisory_042006.119.html</url>
      <url>http://bugs.splitbrain.org/index.php?do=details&amp;id=823</url>
      <url>http://secunia.com/advisories/20429/</url>
    </references>
    <dates>
      <discovery>2006-06-05</discovery>
      <entry>2006-06-05</entry>
    </dates>
  </vuln>

  <vuln vid="40a0185f-ec32-11da-be02-000c6ec775d9">
    <topic>drupal -- multiple vulnerabilities</topic>
    <affects>
      <package>
	<name>drupal</name>
	<range><lt>4.6.7</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Drupal team reports:</p>
	<blockquote cite="http://drupal.org/node/65357">
	  <p>Vulnerability: SQL injection</p>
	  <p>A security vulnerability in the database layer allowed
	    certain queries to be submitted to the database without
	    going through Drupal's query sanitizer.</p>
	</blockquote>
	<blockquote cite="http://drupal.org/node/65409">
	  <p>Vulnerability: Execution of arbitrary files</p>
	  <p>Certain -- alas, typical -- configurations of Apache
	    allows execution of carefully named arbitrary scripts in
	    the files directory. Drupal now will attempt to
	    automatically create a .htaccess file in your "files"
	    directory to protect you.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2006-2742</cvename>
      <cvename>CVE-2006-2743</cvename>
      <url>http://drupal.org/node/65357</url>
      <url>http://drupal.org/node/65409</url>
    </references>
    <dates>
      <discovery>2006-05-18</discovery>
      <entry>2006-06-05</entry>
    </dates>
  </vuln>

  <vuln vid="7f8cecea-f199-11da-8422-00123ffe8333">
    <topic>MySQL -- SQL-injection security vulnerability</topic>
    <affects>
      <package>
	<name>mysql-server</name>
	<range><ge>5.1</ge><le>5.1.9</le></range>
	<range><ge>5.0</ge><lt>5.0.22</lt></range>
	<range><ge>4.1</ge><lt>4.1.20</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>MySQL reports:</p>
	<blockquote cite="http://lists.mysql.com/announce/364">
	  <p>An SQL-injection security hole has been found in multibyte
	    encoding processing. An SQL-injection security hole can include a
	    situation whereby when inserting user supplied data into a
	    database, the user might inject his own SQL statements that the
	    server will execute. With regards to this vulnerability discovered,
	    when character set unaware escaping is used (e.g., addslashes() in
	    PHP), it is possible to bypass it in some multibyte character sets
	    (e.g., SJIS, BIG5 and GBK). As a result, a function like
	    addslashes() is not able to prevent SQL injection attacks. It is
	    impossible to fix this on the server side. The best solution is for
	    applications to use character set aware escaping offered in a
	    function like mysql_real_escape().</p>
	  <p>Workarounds:</p>
	    <p>One can use NO_BACKSLASH_ESCAPES mode as a workaround for a bug
	      in mysql_real_escape_string(), if you cannot upgrade your server
	      for some reason. It will enable SQL standard compatibility mode,
	      where backslash is not considered a special character.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <url>http://lists.mysql.com/announce/364</url>
      <url>http://lists.mysql.com/announce/365</url>
    </references>
    <dates>
      <discovery>2006-05-31</discovery>
      <entry>2006-06-01</entry>
    </dates>
  </vuln>

  <vuln vid="4913886c-e875-11da-b9f4-00123ffe8333">
    <topic>MySQL -- Information Disclosure and Buffer Overflow Vulnerabilities</topic>
    <affects>
      <package>
	<name>mysql-server</name>
	<range><gt>4.0</gt><lt>4.0.27</lt></range>
	<range><gt>4.1</gt><lt>4.1.19</lt></range>
	<range><gt>5.1</gt><le>5.1.9</le></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/19929/">
	  <p>MySQL have some vulnerabilities, which can be exploited by
	    malicious users to disclose potentially sensitive information
	    and compromise a vulnerable system.</p>
	  <p>1) An error within the code that generates an error response
	    to an invalid COM_TABLE_DUMP packet can be exploited by an
	    authenticated client to disclosure certain memory content of the
	    server process.</p>
	  <p>2) A boundary error within the handling of specially crafted
	    invalid COM_TABLE_DUMP packets can be exploited by an authenticated
	    client to cause a buffer overflow and allows arbitrary code
	    execution.</p>
	  <p>3) An error within the handling of malformed login packets can be
	    exploited to disclosure certain memory content of the server
	    process in the error messages.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2006-1516</cvename>
      <cvename>CVE-2006-1517</cvename>
      <cvename>CVE-2006-1518</cvename>
      <certvu>602457</certvu>
      <url>http://www.wisec.it/vulns.php?page=7</url>
      <url>http://www.wisec.it/vulns.php?page=8</url>
      <url>http://dev.mysql.com/doc/refman/4.1/en/news-4-0-27.html</url>
      <url>http://dev.mysql.com/doc/refman/4.1/en/news-4-1-19.html</url>
      <url>http://dev.mysql.com/doc/refman/5.1/en/news-5-1-10.html</url>
      <url>http://secunia.com/advisories/19929/</url>
      <url>http://www.vuxml.org/freebsd/a8d8713e-dc83-11da-a22b-000c6ec775d9.html</url>
    </references>
    <dates>
      <discovery>2006-05-02</discovery>
      <entry>2006-06-01</entry>
    </dates>
  </vuln>

  <vuln vid="c0171f59-ea8a-11da-be02-000c6ec775d9">
    <topic>frontpage -- cross site scripting vulnerability</topic>
    <affects>
      <package>
	<name>frontpage</name>
	<name>mod_frontpage13</name>
	<name>mod_frontpage20</name>
	<name>mod_frontpage21</name>
	<name>mod_frontpage22</name>
	<range><lt>5.0.2.4803</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Esteban Martinez Fayo reports:</p>
	<blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&amp;m=114487846329000">
	  <p>The FrontPage Server Extensions 2002 (included in Windows
	    Sever 2003 IIS 6.0 and available as a separate download
	    for Windows 2000 and XP) has a web page
	    /_vti_bin/_vti_adm/fpadmdll.dll that is used for
	    administrative purposes.  This web page is vulnerable to
	    cross site scripting attacks allowing an attacker to run
	    client-side script on behalf of an FPSE user. If the
	    victim is an administrator, the attacker could take
	    complete control of a Front Page Server Extensions 2002
	    server.</p>
	  <p>To exploit the vulnerability an attacker can send a
	    specially crafted e-mail message to a FPSE user and then
	    persuade the user to click a link in the e-mail
	    message.</p>
	  <p>In addition, this vulnerability can be exploited if an
	    attacker hosts a malicious website and persuade the user
	    to visit it.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2006-0015</cvename>
      <mlist msgid="0e3f01c65e78$93c00800$de00a8c0@rigel">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=114487846329000</mlist>
      <url>http://www.microsoft.com/technet/security/bulletin/MS06-017.mspx</url>
      <url>http://www.rtr.com/fpsupport/fpse_release_may_2_2006.htm</url>
    </references>
    <dates>
      <discovery>2006-04-12</discovery>
      <entry>2006-05-23</entry>
    </dates>
  </vuln>

  <vuln vid="72d8df84-ea6d-11da-8a53-00123ffe8333">
    <topic>cscope -- buffer overflow vulnerabilities</topic>
    <affects>
      <package>
	<name>cscope</name>
	<range><lt>15.5_2</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Jason Duell reports:</p>
	<blockquote cite="http://sourceforge.net/tracker/index.php?func=detail&amp;aid=1064875&amp;group_id=4664&amp;atid=104664">
	  <p>Cscope contains an alarming number of buffer overflow
	    vulnerabilities. By a rough count, there are at least 48 places
	    where we blindly sprintf() a file name into a fixed-length buffer
	    of size PATHLEN without checking to see if the file's name
	    is &lt;= PATHLEN. We do similar things with environment variable
	    values.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2004-2541</cvename>
      <url>http://sourceforge.net/tracker/index.php?func=detail&amp;aid=1064875&amp;group_id=4664&amp;atid=104664</url>
      <url>http://secunia.com/advisories/13237</url>
    </references>
    <dates>
      <discovery>2004-11-11</discovery>
      <entry>2006-05-23</entry>
    </dates>
  </vuln>

  <vuln vid="0b628470-e9a6-11da-b9f4-00123ffe8333">
    <topic>coppermine -- Multiple File Extensions Vulnerability</topic>
    <affects>
      <package>
	<name>coppermine</name>
	<range><lt>1.4.6</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/20211/">
	  <p>Coppermine Photo Gallery have a vulnerability, which can be
	    exploited by malicious users to compromise a vulnerable system.</p>
	  <p>The vulnerability is caused due to an error in the handling of
	    file uploads where a filename has multiple file extensions. This
	    can be exploited to upload malicious script files inside the web
	    root (e.g. a PHP script).</p>
	  <p>Successful exploitation may allow execution of script code
	    depending on the HTTP server configuration (it requires e.g. an
	    Apache server with the "mod_mime" module installed).</p>
	</blockquote>
      </body>
    </description>
    <references>
      <url>http://sourceforge.net/project/shownotes.php?group_id=89658&amp;release_id=418266</url>
      <url>http://secunia.com/advisories/20211/</url>
    </references>
    <dates>
      <discovery>2006-05-22</discovery>
      <entry>2006-05-22</entry>
    </dates>
  </vuln>

  <vuln vid="6738977b-e9a5-11da-b9f4-00123ffe8333">
    <topic>coppermine -- "file" Local File Inclusion Vulnerability</topic>
    <affects>
      <package>
	<name>coppermine</name>
	<range><lt>1.4.5</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/19665/">
	  <p>Coppermine Photo Gallery have a vulnerability, which can be
	    exploited by malicious people to disclose sensitive
	    information.</p>
	  <p>Input passed to the "file" parameter in "index.php" isn't properly
	    verified, before it is used to include files. This can be exploited
	    to include arbitrary files from local resources.</p>
	  <p>Example:
	    http://[host]/index.php?file=.//././/././/././/./[file]%00</p>
	  <p>Successful exploitation requires that "magic_quotes_gpc" is
	    disabled.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2006-1909</cvename>
      <url>http://coppermine-gallery.net/forum/index.php?topic=30655.0</url>
      <url>http://myimei.com/security/2006-04-14/copperminephotogallery144-plugininclusionsystemindexphp-remotefileinclusion-attack.html</url>
      <url>http://secunia.com/advisories/19665/</url>
    </references>
    <dates>
      <discovery>2006-04-19</discovery>
      <entry>2006-05-22</entry>
    </dates>
  </vuln>

  <vuln vid="77cceaef-e9a4-11da-b9f4-00123ffe8333">
    <topic>coppermine -- File Inclusion Vulnerabilities</topic>
    <affects>
      <package>
	<name>coppermine</name>
	<range><lt>1.4.4</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/18941/">
	  <p>Coppermine Photo Gallery have a vulnerability, which can be
	    exploited by malicious people and by malicious users to compromise
	    a vulnerable system.</p>
	  <p>1) Input passed to the "lang" parameter in include/init.inc.php
	    isn't properly verified, before it is used to include files. This
	    can be exploited to include arbitrary files from local resources.
	    The vulnerability can be further exploited by users who are allowed
	    to upload image files to execute arbitrary PHP code.</p>
	  <p>2) Input passed to the "f" parameter in docs/showdoc.php isn't
	    properly verified, before it is used to include files. This can be
	    exploited to include arbitrary files from local resources on the
	    Windows platform, and remote files from Windows shared folders.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2006-0872</cvename>
      <cvename>CVE-2006-0873</cvename>
      <url>http://retrogod.altervista.org/cpg_143_adv.html</url>
      <url>http://secunia.com/advisories/18941/</url>
    </references>
    <dates>
      <discovery>2006-02-20</discovery>
      <entry>2006-05-22</entry>
    </dates>
  </vuln>

  <vuln vid="2ecd02e2-e864-11da-b9f4-00123ffe8333">
    <topic>phpmyadmin -- XSRF vulnerabilities</topic>
    <affects>
      <package>
	<name>phpMyAdmin</name>
	<range><lt>2.8.1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>phpMyAdmin security team reports:</p>
	<blockquote cite="http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-3">
	  <p>It was possible to inject arbitrary SQL commands by forcing an
	    authenticated user to follow a crafted link.</p>
	  <p>Such issue is quite common in many PHP applications and users
	    should take care what links they follow. We consider these
	    vulnerabilities to be quite dangerous.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2006-1804</cvename>
      <url>http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-3</url>
      <url>http://secunia.com/advisories/19659</url>
    </references>
    <dates>
      <discovery>2006-05-20</discovery>
      <entry>2006-05-21</entry>
    </dates>
  </vuln>

  <vuln vid="4645b98c-e46e-11da-9ae7-00123fcc6e5c">
    <topic>vnc -- authentication bypass vulnerability</topic>
    <affects>
      <package>
	<name>vnc</name>
	<range><eq>4.1.1</eq></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>RealVNC is susceptible to an authentication-bypass vulnerability.
	  A malicious VNC client can cause a VNC server to allow it to connect
	  without any authentication regardless of the authentication settings
	  configured in the server. Exploiting this issue allows attackers to
	  gain unauthenticated, remote access to the VNC  servers.</p>
      </body>
    </description>
    <references>
      <bid>17978</bid>
      <mlist>http://www.securityfocus.com/archive/1/433994/30/0/threaded</mlist>
    </references>
    <dates>
      <discovery>2006-05-15</discovery>
      <entry>2006-05-18</entry>
    </dates>
  </vuln>

  <vuln vid="6d78202e-e2f9-11da-8674-00123ffe8333">
    <topic>phpldapadmin -- Cross-Site Scripting and Script Insertion vulnerabilities</topic>
    <affects>
      <package>
	<name>phpldapadmin098</name>
	<range><lt>0.9.8.3</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/19747/">
	  <p>phpLDAPadmin have some vulnerabilities, which can be exploited by
	    malicious users to conduct script insertion attacks and by
	    malicious people to conduct cross-site scripting attacks.</p>
	  <p>1) Some input isn't properly sanitised before being returned to
	    the user. This can be exploited to execute arbitrary HTML and
	    script code in a user's browser session in context of an affected
	    site.</p>
	  <p>2) Input passed to the "Container DN", "Machine Name", and "UID
	    Number" parameters in "template_engine.php" isn't properly
	    sanitised before being used. This can be exploited to inject
	    arbitrary HTML and script code, which will be executed in a user's
	    browser session in context of an affected site when the malicious
	    user data is viewed.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2006-2016</cvename>
      <url>http://pridels.blogspot.com/2006/04/phpldapadmin-multiple-vuln.html</url>
      <url>http://www.frsirt.com/english/advisories/2006/1450</url>
      <url>http://secunia.com/advisories/19747/</url>
    </references>
    <dates>
      <discovery>2006-04-21</discovery>
      <entry>2006-05-14</entry>
    </dates>
  </vuln>

  <vuln vid="a86f30e7-dce7-11da-bf3f-02e081235dab">
    <topic>fswiki -- XSS vulnerability</topic>
    <affects>
      <package>
	<name>fswiki</name>
	<range><lt>3.5.11</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>JVN reports:</p>
	<blockquote cite="http://jvn.jp/jp/JVN%2335274905/">
	  <p>FreeStyleWiki has XSS vulnerability.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <url>http://jvn.jp/jp/JVN%2335274905/</url>
    </references>
    <dates>
      <discovery>2006-04-18</discovery>
      <entry>2006-05-06</entry>
    </dates>
  </vuln>

  <vuln vid="a8d8713e-dc83-11da-a22b-000c6ec775d9">
    <topic>mysql50-server -- COM_TABLE_DUMP arbitrary code execution</topic>
    <affects>
      <package>
	<name>mysql-server</name>
	<range><gt>5.0</gt><lt>5.0.21</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Stefano Di Paola reports:</p>
	<blockquote cite="http://www.wisec.it/vulns.php?page=8">
	  <p>An authenticated user could remotely execute arbitrary
	    commands by taking advantage of a stack overflow.</p>
	  <p>To take advantage of these flaws an attacker should have
	    direct access to MySQL server communication layer (port
	    3306 or unix socket).  But if used in conjuction with some
	    web application flaws (i.e. php code injection) an
	    attacker could use socket programming (i.e. php sockets)
	    to gain access to that layer.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2006-1518</cvename>
      <url>http://www.wisec.it/vulns.php?page=8</url>
      <mlist msgid="1146577257.5679.217.camel@first">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=114659633220473</mlist>
      <url>http://dev.mysql.com/doc/refman/5.0/en/news-5-0-21.html</url>
    </references>
    <dates>
      <discovery>2006-05-02</discovery>
      <entry>2006-05-06</entry>
    </dates>
  </vuln>

  <vuln vid="2df297a2-dc74-11da-a22b-000c6ec775d9">
    <topic>awstats -- arbitrary command execution vulnerability</topic>
    <affects>
      <package>
	<name>awstats</name>
	<range><lt>6.5_2,1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>OS Reviews reports:</p>
	<blockquote cite="http://www.osreviews.net/reviews/comm/awstats">
	  <p>If the update of the stats via web front-end is allowed,
	    a remote attacker can execute arbitrary code on the server
	    using a specially crafted request involving the migrate
	    parameter. Input starting with a pipe character ("|")
	    leads to an insecure call to Perl's open function and the
	    rest of the input being executed in a shell. The code is
	    run in the context of the process running the AWStats
	    CGI.</p>
	  <p>Arbitrary code can be executed by uploading a specially
	    crafted configuration file if an attacker can put a file
	    on the server with chosen file name and content (e.g. by
	    using an FTP account on a shared hosting server). In this
	    configuration file, the LogFile directive can be used to
	    execute shell code following a pipe character. As above,
	    an open call on unsanitized input is the source of this
	    vulnerability.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <url>http://awstats.sourceforge.net/awstats_security_news.php</url>
      <url>http://secunia.com/advisories/19969/</url>
      <url>http://www.osreviews.net/reviews/comm/awstats</url>
    </references>
    <dates>
      <discovery>2006-05-03</discovery>
      <entry>2006-05-05</entry>
      <modified>2006-11-15</modified>
    </dates>
  </vuln>

  <vuln vid="d9dc2697-dadf-11da-912f-00123ffe8333">
    <topic>phpwebftp -- "language" Local File Inclusion</topic>
    <affects>
      <package>
	<name>phpwebftp</name>
	<range><lt>3.3</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/19706/">
	  <p>phpWebFTP have a vulnerability, which can be exploited by
	    malicious people to disclose sensitive information.</p>
	  <p>Input passed to the "language" parameter in index.php isn't
	    properly verified, before it is used to include files. This can be
	    exploited to include arbitrary files from local resources.</p>
	  <p>Successful exploitation requires that "magic_quotes_gpc" is
	    disabled.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2006-1812</cvename>
      <cvename>CVE-2006-1813</cvename>
      <url>https://sourceforge.net/forum/forum.php?forum_id=566199</url>
      <url>http://secunia.com/advisories/19706/</url>
    </references>
    <dates>
      <discovery>2006-04-18</discovery>
      <entry>2006-05-03</entry>
    </dates>
  </vuln>

  <vuln vid="e2476979-da74-11da-a67b-0013d4a4a40e">
    <topic>firefox -- denial of service vulnerability</topic>
    <affects>
      <package>
	<name>firefox</name>
	<range><gt>1.5.*,1</gt><lt>1.5.0.3,1</lt></range>
      </package>
      <package>
	<name>linux-firefox</name>
	<range><lt>1.5.0.3</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A Mozilla Foundation Security Advisory reports for
	  deleted object reference when designMode="on"</p>
	<blockquote cite="http://www.mozilla.org/security/announce/2006/mfsa2006-30.html">
	  <p>Martijn Wargers and Nick Mott each described crashes that
	    were discovered to ultimately stem from the same root cause:
	    attempting to use a deleted controller context when designMode
	    was turned on. This generally results in crashing the browser,
	    but in theory references to deleted objects can be abused to
	    run malicious code.</p>
	  <p>"splices" reported the same crash at the fan site MozillaZine and
	    on Bugtraq, incorrectly describing it as a buffer overflow.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2006-1993</cvename>
      <url>http://www.mozilla.org/security/announce/2006/mfsa2006-30.html</url>
    </references>
    <dates>
      <discovery>2006-05-02</discovery>
      <entry>2006-05-03</entry>
      <modified>2006-05-05</modified>
    </dates>
  </vuln>

  <vuln vid="400d9d22-d6c5-11da-a14b-00123ffe8333">
    <topic>trac -- Wiki Macro Script Insertion Vulnerability</topic>
    <affects>
      <package>
	<name>trac</name>
	<name>ja-trac</name>
	<range><lt>0.9.5</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/19870/">
	  <p>A vulnerability has been reported, which can be exploited by
	    malicious people to conduct script insertion attacks.</p>
	  <p>Input passed using the wiki macro isn't properly sanitised before
	    being used. This can be exploited to inject arbitrary HTML and
	    script code, which will be executed in a user's browser session in
	    context of an affected site when the malicious user data is
	    viewed.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <url>http://projects.edgewall.com/trac/wiki/ChangeLog</url>
      <url>http://jvn.jp/jp/JVN%2384091359/index.html</url>
      <url>http://secunia.com/advisories/19870/</url>
    </references>
    <dates>
      <discovery>2006-04-28</discovery>
      <entry>2006-05-02</entry>
    </dates>
  </vuln>

  <vuln vid="af2a60ed-da3e-11da-93e0-00123ffe8333">
    <cancelled/>
  </vuln>

  <vuln vid="b088bf48-da3b-11da-93e0-00123ffe8333">
    <topic>clamav -- Freshclam HTTP Header Buffer Overflow Vulnerability</topic>
    <affects>
      <package>
	<name>clamav</name>
	<range><ge>0.80</ge><lt>0.88.2</lt></range>
      </package>
      <package>
	<name>clamav-devel</name>
	<range><ge>20040826</ge><lt>20060502</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/19880/">
	  <p>A vulnerability has been reported in ClamAV, which can be
	    exploited by malicious people to cause a DoS (Denial of Service)
	    and potentially to compromise a vulnerable system.</p>
	  <p>The vulnerability is caused due to a boundary error within the
	    HTTP client in the Freshclam command line utility. This can be
	    exploited to cause a stack-based buffer overflow when the HTTP
	    headers received from a web server exceeds 8KB.</p>
	  <p>Successful exploitation requires that Freshclam is used to
	    download virus signature updates from a malicious mirror web
	    server e.g. via DNS poisoning.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2006-1989</cvename>
      <url>http://www.clamav.net/security/0.88.2.html</url>
      <url>http://secunia.com/advisories/19880/</url>
    </references>
    <dates>
      <discovery>2006-05-01</discovery>
      <entry>2006-05-03</entry>
    </dates>
  </vuln>

  <vuln vid="f4af098d-d921-11da-ad4a-00123ffe8333">
    <topic>jabberd -- SASL Negotiation Denial of Service Vulnerability</topic>
    <affects>
      <package>
	<name>jabberd</name>
	<range><lt>2.0.11</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/19281/">
	  <p>A vulnerability has been reported in jabberd, which can be
	    exploited by malicious people to cause a DoS (Denial of
	    Service).</p>
	  <p>The vulnerability is caused due to an error within the handling
	    of SASL negotiation. This can be exploited to cause a crash by
	    sending a "response" stanza before an "auth" stanza.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2006-1329</cvename>
      <url>http://article.gmane.org/gmane.network.jabber.admin/27372</url>
      <url>http://jabberstudio.org/projects/jabberd2/releases/view.php?id=826</url>
      <url>http://secunia.com/advisories/19281/</url>
    </references>
    <dates>
      <discovery>2006-03-20</discovery>
      <entry>2006-05-01</entry>
    </dates>
  </vuln>

  <vuln vid="79c1154d-d5a5-11da-8098-00123ffe8333">
    <topic>cacti -- ADOdb "server.php" Insecure Test Script Security Issue</topic>
    <affects>
      <package>
	<name>cacti</name>
	<range><lt>0.8.6h</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/18276/">
	  <p>Cacti have a security issue, which can be exploited by malicious
	    people to execute arbitrary SQL code and potentially compromise a
	    vulnerable system.</p>
	  <p>The problem is caused due to the presence of the insecure
	    "server.php" test script.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <url>http://secunia.com/advisories/18276/</url>
      <url>http://secunia.com/advisories/17418/</url>
    </references>
    <dates>
      <discovery>2006-01-09</discovery>
      <entry>2006-04-27</entry>
    </dates>
  </vuln>

  <vuln vid="dc930435-d59f-11da-8098-00123ffe8333">
    <topic>amaya -- Attribute Value Buffer Overflow Vulnerabilities</topic>
    <affects>
      <package>
	<name>amaya</name>
	<range><lt>9.5</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/19670/">
	  <p>Amaya have two vulnerabilities, which can be exploited by
	    malicious people to compromise a user's system.</p>
	  <p>The vulnerabilities are caused due to boundary errors within the
	    parsing of various attribute values. This can be exploited to cause
	    stack-based buffer overflows when a user opens a specially crafted
	    HTML document containing certain tags with overly long attribute
	    values.</p>
	  <p>Successful exploitation allows execution of arbitrary code.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2006-1900</cvename>
      <url>http://morph3us.org/advisories/20060412-amaya-94.txt</url>
      <url>http://morph3us.org/advisories/20060412-amaya-94-2.txt</url>
      <url>http://secunia.com/advisories/19670/</url>
    </references>
    <dates>
      <discovery>2006-04-14</discovery>
      <entry>2006-04-27</entry>
    </dates>
  </vuln>

  <vuln vid="116b0820-d59c-11da-8098-00123ffe8333">
    <topic>lifetype -- ADOdb "server.php" Insecure Test Script Security Issue</topic>
    <affects>
      <package>
	<name>lifetype</name>
	<range><lt>1.0.3</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/19699/">
	  <p>A security issue has been discovered in LifeType, which can be
	    exploited by malicious people to execute arbitrary SQL code and
	    potentially compromise a vulnerable system.</p>
	  <p>The problem is caused due to the presence of the insecure
	    "server.php" test script.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2006-0146</cvename>
      <url>http://secunia.com/advisories/19699/</url>
      <url>http://secunia.com/advisories/17418/</url>
    </references>
    <dates>
      <discovery>2006-04-19</discovery>
      <entry>2006-04-27</entry>
    </dates>
  </vuln>

  <vuln vid="21c223f2-d596-11da-8098-00123ffe8333">
    <topic>ethereal -- Multiple Protocol Dissector Vulnerabilities</topic>
    <affects>
      <package>
	<name>ethereal</name>
	<name>ethereal-lite</name>
	<name>tethereal</name>
	<name>tethereal-lite</name>
	<range><ge>0.8.5</ge><lt>0.99.0</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/19769/">
	  <p>Multiple vulnerabilities have been reported in Ethereal, which
	    can be exploited by malicious people to cause a DoS (Denial of
	    Service) or compromise a vulnerable system.</p>
	  <p>The vulnerabilities are caused due to various types of errors
	    including boundary errors, an off-by-one error, an infinite loop
	    error, and several unspecified errors in a multitude of protocol
	    dissectors.</p>
	  <p>Successful exploitation causes Ethereal to stop responding,
	    consume a large amount of system resources, crash, or execute
	    arbitrary code.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2006-1932</cvename>
      <cvename>CVE-2006-1933</cvename>
      <cvename>CVE-2006-1934</cvename>
      <cvename>CVE-2006-1935</cvename>
      <cvename>CVE-2006-1936</cvename>
      <cvename>CVE-2006-1937</cvename>
      <cvename>CVE-2006-1938</cvename>
      <cvename>CVE-2006-1939</cvename>
      <cvename>CVE-2006-1940</cvename>
      <url>http://www.ethereal.com/appnotes/enpa-sa-00023.html</url>
      <url>http://secunia.com/advisories/19769/</url>
    </references>
    <dates>
      <discovery>2006-04-25</discovery>
      <entry>2006-04-27</entry>
    </dates>
  </vuln>

  <vuln vid="8b683bea-d49c-11da-a672-000e0c2e438a">
    <topic>asterisk -- denial of service vulnerability, local system access</topic>
    <affects>
      <package>
	<name>asterisk</name>
	<range><lt>1.2.7</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Emmanouel Kellenis reports a denial of service vulnerability
	  within asterisk.  The vulnerability is caused by a buffer
	  overflow in "format_jpeg.c".	A large JPEG image could
	  trigger this bug, potentially allowing a local attacker to
	  execute arbitrary code.</p>
      </body>
    </description>
    <references>
      <bid>17561</bid>
      <cvename>CVE-2006-1827</cvename>
      <url>http://www.cipher.org.uk/index.php?p=advisories/Asterisk_Codec_Integer_Overflow_07-04-2006.advisory</url>
    </references>
    <dates>
      <discovery>2006-04-07</discovery>
      <entry>2006-04-25</entry>
    </dates>
  </vuln>

  <vuln vid="a813a219-d2d4-11da-a672-000e0c2e438a">
    <topic>zgv, xzgv -- heap overflow vulnerability</topic>
    <affects>
      <package>
	<name>zgv</name>
	<range><lt>5.9_1</lt></range>
      </package>
      <package>
	<name>xzgv</name>
	<range><lt>0.9</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Gentoo reports:</p>
	<blockquote cite="http://www.gentoo.org/security/en/glsa/glsa-200604-10.xml">
	  <p>Andrea Barisani of Gentoo Linux discovered xzgv and zgv
	    allocate insufficient memory when rendering images with
	    more than 3 output components, such as images using the
	    YCCK or CMYK colour space.	When xzgv or zgv attempt to
	    render the image, data from the image overruns a heap
	    allocated buffer.</p>
	  <p>An attacker may be able to construct a malicious image that
	    executes arbitrary code with the permissions of the xzgv or
	    zgv user when attempting to render the image.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <bid>17409</bid>
      <cvename>CVE-2006-1060</cvename>
      <url>http://www.gentoo.org/security/en/glsa/glsa-200604-10.xml</url>
    </references>
    <dates>
      <discovery>2006-04-21</discovery>
      <entry>2006-04-23</entry>
      <modified>2010-03-22</modified>
    </dates>
  </vuln>

  <vuln vid="86cc5c6f-d2b4-11da-a672-000e0c2e438a">
    <topic>crossfire-server -- denial of service and remote code execution vulnerability</topic>
    <affects>
      <package>
	<name>crossfire-server</name>
	<range><lt>1.9.0</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>FRSIRT reports:</p>
	<blockquote cite="http://www.frsirt.com/english/advisories/2006/0760">
	  <p>A vulnerability has been identified in CrossFire, which
	    could be exploited by remote attackers to execute arbitrary
	    commands or cause a denial of service.  This flaw is due to
	    a buffer overflow error in the "oldsocketmode" module that
	    fails to properly handle overly large requests, which could
	    be exploited by a malicious client to crash or compromise a
	    vulnerable system.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <bid>16883</bid>
      <cvename>CVE-2006-1010</cvename>
      <url>http://www.frsirt.com/english/advisories/2006/0760</url>
    </references>
    <dates>
      <discovery>2006-02-28</discovery>
      <entry>2006-04-23</entry>
    </dates>
  </vuln>

  <vuln vid="8cfb6f42-d2b0-11da-a672-000e0c2e438a">
    <topic>p5-DBI -- insecure temporary file creation vulnerability</topic>
    <affects>
      <package>
	<name>p5-DBI-137</name>
	<range><ge>0</ge></range>
      </package>
      <package>
	<name>p5-DBI</name>
	<range><lt>1.37_1</lt></range>
	<range><ge>1.38</ge><lt>1.48</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Javier Fernández-Sanguino Peña reports:</p>
	<blockquote cite="http://www.debian.org/security/2005/dsa-658">
	  <p>The DBI library, the Perl5 database interface, creates a
	    temporary PID file in an insecure manner.  This can be
	    exploited by a malicious user to overwrite arbitrary files
	    owned by the person executing the parts of the library.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <bid>12360</bid>
      <cvename>CAN-2005-0077</cvename>
      <url>http://www.debian.org/security/2005/dsa-658</url>
    </references>
    <dates>
      <discovery>2005-01-25</discovery>
      <entry>2006-04-23</entry>
      <modified>2006-05-11</modified>
    </dates>
  </vuln>

  <vuln vid="e0b342a1-d2ae-11da-a672-000e0c2e438a">
    <topic>wordpress -- full path disclosure</topic>
    <affects>
      <package>
	<name>wordpress</name>
	<range><lt>1.5.2</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Dedi Dwianto reports:</p>
	<blockquote cite="http://echo.or.id/adv/adv24-theday-2005.txt">
	  <p>A remote user can access the file directly to cause the
	    system to display an error message that indicates the
	    installation path.	The resulting error message will
	    disclose potentially sensitive installation path
	    information to the remote attacker.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-4463</cvename>
      <url>http://echo.or.id/adv/adv24-theday-2005.txt</url>
    </references>
    <dates>
      <discovery>2005-12-20</discovery>
      <entry>2006-04-23</entry>
    </dates>
  </vuln>

  <vuln vid="8d4ae57d-d2ab-11da-a672-000e0c2e438a">
    <topic>xine -- multiple remote string vulnerabilities</topic>
    <affects>
      <package>
	<name>xine</name>
	<range><lt>0.99.4_4</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>c0ntexb reports:</p>
	<blockquote cite="http://www.open-security.org/advisories/16">
	  <p>There are 2 format string bugs in the latest version of
	    Xine that could be exploited by a malicious person to
	    execute code on the system of a remote user running the
	    media player against a malicious playlist file.  By passing
	    a format specifier in the path of a file that is embedded
	    in a remote playlist, it is possible to trigger this bug.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <bid>17579</bid>
      <cvename>CVE-2006-1905</cvename>
      <url>http://www.open-security.org/advisories/16</url>
    </references>
    <dates>
      <discovery>2006-04-18</discovery>
      <entry>2006-04-23</entry>
    </dates>
  </vuln>

  <vuln vid="408f6ebf-d152-11da-962f-000b972eb521">
    <topic>cyrus-sasl -- DIGEST-MD5 Pre-Authentication Denial of Service</topic>
    <affects>
      <package>
	<name>cyrus-sasl</name>
	<range><ge>2.*</ge><lt>2.1.21</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Unspecified vulnerability in the CMU Cyrus Simple
	Authentication and Security Layer (SASL) library, has unknown
	impact and remote unauthenticated attack vectors, related to
	DIGEST-MD5 negotiation.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2006-1721</cvename>
    </references>
    <dates>
      <discovery>2006-04-11</discovery>
      <entry>2006-04-22</entry>
    </dates>
  </vuln>

  <vuln vid="1fa4c9f1-cfca-11da-a672-000e0c2e438a">
    <topic>FreeBSD -- FPU information disclosure</topic>
    <affects>
      <package>
	<name>FreeBSD</name>
	<range><ge>6.0</ge><lt>6.0_7</lt></range>
	<range><ge>5.4</ge><lt>5.4_14</lt></range>
	<range><ge>5.3</ge><lt>5.3_29</lt></range>
	<range><ge>5</ge><lt>5.3</lt></range>
	<range><ge>4.11</ge><lt>4.11_17</lt></range>
	<range><ge>4.10</ge><lt>4.10_23</lt></range>
	<range><lt>4.10</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description</h1>
	<p>On "7th generation" and "8th generation" processors
	  manufactured by AMD, including the AMD Athlon, Duron, Athlon
	  MP, Athlon XP, Athlon64, Athlon64 FX, Opteron, Turion, and
	  Sempron, the fxsave and fxrstor instructions do not save and
	  restore the FOP, FIP, and FDP registers unless the exception
	  summary bit (ES) in the x87 status word is set to 1,
	  indicating that an unmasked x87 exception has occurred.</p>
	<p>This behaviour is consistent with documentation provided by
	  AMD, but is different from processors from other vendors,
	  which save and restore the FOP, FIP, and FDP registers
	  regardless of the value of the ES bit.  As a result of this
	  discrepancy remaining unnoticed until now, the FreeBSD kernel
	  does not restore the contents of the FOP, FIP, and FDP
	  registers between context switches.</p>
	<h1>Impact</h1>
	<p>On affected processors, a local attacker can monitor the
	  execution path of a process which uses floating-point
	  operations.  This may allow an attacker to steal
	  cryptographic keys or other sensitive information.</p>
	<h1>Workaround</h1>
	<p>No workaround is available, but systems which do not use AMD
	  Athlon, Duron, Athlon MP, Athlon XP, Athlon64, Athlon64 FX,
	  Opteron, Turion, or Sempron processors are not vulnerable.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2006-1056</cvename>
      <freebsdsa>SA-06:14.fpu</freebsdsa>
    </references>
    <dates>
      <discovery>2006-04-19</discovery>
      <entry>2006-04-19</entry>
      <modified>2016-08-09</modified>
    </dates>
  </vuln>

  <vuln vid="22c6b826-cee0-11da-8578-00123ffe8333">
    <topic>plone -- "member_id" Parameter Portrait Manipulation Vulnerability</topic>
    <affects>
      <package>
	<name>plone</name>
	<range><lt>2.1.2_1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/19633/">
	  <p>The vulnerability is caused due to missing security declarations
	    in "changeMemberPortrait" and "deletePersonalPortrait". This can
	    be exploited to manipulate or delete another user's portrait via
	    the "member_id" parameter.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2006-1711</cvename>
      <url>http://dev.plone.org/plone/ticket/5432</url>
      <url>http://www.debian.org/security/2006/dsa-1032</url>
      <url>http://secunia.com/advisories/19633/</url>
    </references>
    <dates>
      <discovery>2006-04-13</discovery>
      <entry>2006-04-18</entry>
    </dates>
  </vuln>

  <vuln vid="84630f4a-cd8c-11da-b7b9-000c6ec775d9">
    <topic>mozilla -- multiple vulnerabilities</topic>
    <affects>
      <package>
	<name>firefox</name>
	<range><lt>1.0.8,1</lt></range>
	<range><gt>1.5.*,1</gt><lt>1.5.0.2,1</lt></range>
      </package>
      <package>
	<name>linux-firefox</name>
	<range><lt>1.5.0.2</lt></range>
      </package>
      <package>
	<name>mozilla</name>
	<range><lt>1.7.13,2</lt></range>
	<range><ge>1.8.*,2</ge></range>
      </package>
      <package>
	<name>linux-mozilla</name>
	<range><lt>1.7.13</lt></range>
      </package>
      <package>
	<name>linux-mozilla-devel</name>
	<range><gt>0</gt></range>
      </package>
      <package>
	<name>seamonkey</name>
	<name>linux-seamonkey</name>
	<range><lt>1.0.1</lt></range>
      </package>
      <package>
	<name>thunderbird</name>
	<name>mozilla-thunderbird</name>
	<range><lt>1.5.0.2</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A Mozilla Foundation Security Advisory reports of multiple
	  issues.  Several of which can be used to run arbitrary code
	  with the privilege of the user running the program.</p>
	<blockquote cite="http://www.mozilla.org/security/announce/">
	  <ul>
	    <li>MFSA 2006-29 Spoofing with translucent windows</li>
	    <li>MFSA 2006-28 Security check of js_ValueToFunctionObject() can be circumvented</li>
	    <li>MFSA 2006-26 Mail Multiple Information Disclosure</li>
	    <li>MFSA 2006-25 Privilege escalation through Print Preview</li>
	    <li>MFSA 2006-24 Privilege escalation using crypto.generateCRMFRequest</li>
	    <li>MFSA 2006-23 File stealing by changing input type</li>
	    <li>MFSA 2006-22 CSS Letter-Spacing Heap Overflow Vulnerability</li>
	    <li>MFSA 2006-20 Crashes with evidence of memory corruption (rv:1.8.0.2)</li>
	    <li>MFSA 2006-19 Cross-site scripting using .valueOf.call()</li>
	    <li>MFSA 2006-18 Mozilla Firefox Tag Order Vulnerability</li>
	    <li>MFSA 2006-17 cross-site scripting through window.controllers</li>
	    <li>MFSA 2006-16 Accessing XBL compilation scope via valueOf.call()</li>
	    <li>MFSA 2006-15 Privilege escalation using a JavaScript function's cloned parent</li>
	    <li>MFSA 2006-14 Privilege escalation via XBL.method.eval</li>
	    <li>MFSA 2006-13 Downloading executables with "Save Image As..."</li>
	    <li>MFSA 2006-12 Secure-site spoof (requires security warning dialog)</li>
	    <li>MFSA 2006-11 Crashes with evidence of memory corruption (rv:1.8)</li>
	    <li>MFSA 2006-10 JavaScript garbage-collection hazard audit</li>
	    <li>MFSA 2006-09 Cross-site JavaScript injection using event handlers</li>
	  </ul>
	</blockquote>
      </body>
    </description>
    <references>
      <certvu>179014</certvu>
      <certvu>252324</certvu>
      <certvu>329500</certvu>
      <certvu>350262</certvu>
      <certvu>488774</certvu>
      <certvu>736934</certvu>
      <certvu>813230</certvu>
      <certvu>842094</certvu>
      <certvu>932734</certvu>
      <certvu>935556</certvu>
      <certvu>968814</certvu>
      <cvename>CVE-2006-0749</cvename>
      <cvename>CVE-2006-1045</cvename>
      <cvename>CVE-2006-1529</cvename>
      <cvename>CVE-2006-1530</cvename>
      <cvename>CVE-2006-1531</cvename>
      <cvename>CVE-2006-1723</cvename>
      <cvename>CVE-2006-1724</cvename>
      <cvename>CVE-2006-1725</cvename>
      <cvename>CVE-2006-1726</cvename>
      <cvename>CVE-2006-1727</cvename>
      <cvename>CVE-2006-1728</cvename>
      <cvename>CVE-2006-1729</cvename>
      <cvename>CVE-2006-1730</cvename>
      <cvename>CVE-2006-1731</cvename>
      <cvename>CVE-2006-1732</cvename>
      <cvename>CVE-2006-1733</cvename>
      <cvename>CVE-2006-1734</cvename>
      <cvename>CVE-2006-1735</cvename>
      <cvename>CVE-2006-1736</cvename>
      <cvename>CVE-2006-1737</cvename>
      <cvename>CVE-2006-1738</cvename>
      <cvename>CVE-2006-1739</cvename>
      <cvename>CVE-2006-1740</cvename>
      <cvename>CVE-2006-1741</cvename>
      <cvename>CVE-2006-1742</cvename>
      <cvename>CVE-2006-1790</cvename>
      <url>http://www.mozilla.org/security/announce/2006/mfsa2006-09.html</url>
      <url>http://www.mozilla.org/security/announce/2006/mfsa2006-10.html</url>
      <url>http://www.mozilla.org/security/announce/2006/mfsa2006-11.html</url>
      <url>http://www.mozilla.org/security/announce/2006/mfsa2006-12.html</url>
      <url>http://www.mozilla.org/security/announce/2006/mfsa2006-13.html</url>
      <url>http://www.mozilla.org/security/announce/2006/mfsa2006-14.html</url>
      <url>http://www.mozilla.org/security/announce/2006/mfsa2006-15.html</url>
      <url>http://www.mozilla.org/security/announce/2006/mfsa2006-16.html</url>
      <url>http://www.mozilla.org/security/announce/2006/mfsa2006-17.html</url>
      <url>http://www.mozilla.org/security/announce/2006/mfsa2006-18.html</url>
      <url>http://www.mozilla.org/security/announce/2006/mfsa2006-19.html</url>
      <url>http://www.mozilla.org/security/announce/2006/mfsa2006-20.html</url>
      <url>http://www.mozilla.org/security/announce/2006/mfsa2006-22.html</url>
      <url>http://www.mozilla.org/security/announce/2006/mfsa2006-23.html</url>
      <url>http://www.mozilla.org/security/announce/2006/mfsa2006-25.html</url>
      <url>http://www.mozilla.org/security/announce/2006/mfsa2006-26.html</url>
      <url>http://www.mozilla.org/security/announce/2006/mfsa2006-28.html</url>
      <url>http://www.mozilla.org/security/announce/2006/mfsa2006-29.html</url>
      <url>http://www.zerodayinitiative.com/advisories/ZDI-06-010.html</url>
      <uscertta>TA06-107A</uscertta>
    </references>
    <dates>
      <discovery>2006-04-13</discovery>
      <entry>2006-04-16</entry>
      <modified>2006-04-27</modified>
    </dates>
  </vuln>

  <vuln vid="8be2e304-cce6-11da-a3b1-00123ffe8333">
    <topic>mailman -- Private Archive Script Cross-Site Scripting</topic>
    <affects>
      <package>
	<name>mailman</name>
	<name>ja-mailman</name>
	<name>mailman-with-htdig</name>
	<range><lt>2.1.8</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/19558/">
	  <p>A vulnerability has been reported in Mailman, which can be
	    exploited by malicious people to conduct cross-site scripting
	    attacks.</p>
	  <p>Unspecified input passed to the private archive script is not
	    properly sanitised before being returned to users. This can be
	    exploited to execute arbitrary HTML and script code in a user's
	    browser session in context of a vulnerable site.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2006-1712</cvename>
      <mlist>http://mail.python.org/pipermail/mailman-announce/2006-April/000084.html</mlist>
      <url>http://secunia.com/advisories/19558/</url>
    </references>
    <dates>
      <discovery>2006-04-07</discovery>
      <entry>2006-04-16</entry>
    </dates>
  </vuln>

  <vuln vid="43cb40b3-c8c2-11da-a672-000e0c2e438a">
    <topic>f2c -- insecure temporary files</topic>
    <affects>
      <package>
	<name>f2c</name>
	<range><lt>20060506</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Javier Fernández-Sanguino Peña reports two temporary file
	  vulnerability within f2c.  The vulnerabilities are caused
	  due to weak temporary file handling.	An attacker could
	  create an symbolic link, causing a local user running f2c
	  to overwrite the symlinked file.  This could give the
	  attacker elevated privileges.</p>
      </body>
    </description>
    <references>
      <bid>1280</bid>
      <cvename>CAN-2005-0017</cvename>
    </references>
    <dates>
      <discovery>2005-01-27</discovery>
      <entry>2006-04-10</entry>
      <modified>2006-08-15</modified>
    </dates>
  </vuln>

  <vuln vid="c7526a14-c4dc-11da-9699-00123ffe8333">
    <topic>mplayer -- Multiple integer overflows</topic>
    <affects>
      <package>
	<name>mplayer</name>
	<name>mplayer-esound</name>
	<name>mplayer-gtk</name>
	<name>mplayer-gtk2</name>
	<name>mplayer-gtk-esound</name>
	<name>mplayer-gtk2-esound</name>
	<range><lt>0.99.7_12</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/19418/">
	  <p>The vulnerabilities are caused due to integer overflow errors
	    in "libmpdemux/asfheader.c" within the handling of an ASF file,
	    and in "libmpdemux/aviheader.c" when parsing the "indx" chunk in
	    an AVI file. This can be exploited to cause heap-based buffer
	    overflows via a malicious ASF file, or via a AVI file with
	    specially-crafted "wLongsPerEntry" and "nEntriesInUse" values in
	    the "indx" chunk.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2006-1502</cvename>
      <url>http://www.xfocus.org/advisories/200603/11.html</url>
      <url>http://secunia.com/advisories/19418/</url>
    </references>
    <dates>
      <discovery>2006-03-29</discovery>
      <entry>2006-04-07</entry>
    </dates>
  </vuln>

  <vuln vid="4bfcd857-c628-11da-b2fb-000e0c2e438a">
    <topic>kaffeine -- buffer overflow vulnerability</topic>
    <affects>
      <package>
	<name>kaffeine</name>
	<range><ge>0.4.2</ge><lt>0.8.0</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The KDE team reports:</p>
	<blockquote cite="http://www.kde.org/info/security/advisory-20060404-1.txt">
	  <p>Kaffeine can produce a buffer overflow in http_peek() while
	    creating HTTP request headers for fetching remote playlists,
	    which under certain circumstances could be used to crash the
	    application and/or execute arbitrary code.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <bid>17372</bid>
      <cvename>CVE-2006-0051</cvename>
      <url>http://www.kde.org/info/security/advisory-20060404-1.txt</url>
    </references>
    <dates>
      <discovery>2006-04-04</discovery>
      <entry>2006-04-07</entry>
    </dates>
  </vuln>

  <vuln vid="61349f77-c620-11da-b2fb-000e0c2e438a">
    <topic>thunderbird -- javascript execution</topic>
    <affects>
      <package>
	<name>thunderbird</name>
	<name>mozilla-thunderbird</name>
	<range><le>1.0.7</le></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Renaud Lifchitz reports a vulnerability within thunderbird.
	  The vulnerability is caused by improper checking of javascript
	  scripts.  This could lead to javascript code execution which
	  can lead to information disclosure or a denial of service
	  (application crash).	This vulnerability is present even if
	  javascript had been disabled in the preferences.</p>
      </body>
    </description>
    <references>
      <bid>16770</bid>
      <cvename>CAN-2006-0884</cvename>
    </references>
    <dates>
      <discovery>2006-02-22</discovery>
      <entry>2006-04-07</entry>
    </dates>
  </vuln>

  <vuln vid="fba75b43-c588-11da-9110-00123ffe8333">
    <topic>phpmyadmin -- XSS vulnerabilities</topic>
    <affects>
      <package>
	<name>phpMyAdmin</name>
	<range><lt>2.8.0.3</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>phpMyAdmin security announcement:</p>
	<blockquote cite="http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-1">
	  <p>It was possible to conduct an XSS attack with a direct call
	    to some scripts under the themes directory.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <url>http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-1</url>
      <url>http://secunia.com/advisories/19556/</url>
    </references>
    <dates>
      <discovery>2006-04-06</discovery>
      <entry>2006-04-06</entry>
      <modified>2006-04-07</modified>
    </dates>
  </vuln>

  <vuln vid="7b55f5c2-c58b-11da-9110-00123ffe8333">
    <topic>phpmyadmin -- 'set_theme' Cross-Site Scripting</topic>
    <affects>
      <package>
	<name>phpMyAdmin</name>
	<range><lt>2.8.0.2</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/19277">
	  <p>A vulnerability has been reported in phpMyAdmin, which can be
	    exploited by malicious people to conduct cross-site scripting
	    attacks.</p>
	  <p>Input passed to the "set_theme" parameter isn't properly
	    sanitised before being returned to the user. This can be exploited
	    to execute arbitrary HTML and script code in a user's browser
	    session in context of an affected site.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2006-1258</cvename>
      <url>http://secunia.com/advisories/19277</url>
    </references>
    <dates>
      <discovery>2006-03-17</discovery>
      <entry>2006-04-06</entry>
    </dates>
  </vuln>

  <vuln vid="6a5174bd-c580-11da-9110-00123ffe8333">
    <topic>clamav -- Multiple Vulnerabilities</topic>
    <affects>
      <package>
	<name>clamav</name>
	<range><lt>0.88.1</lt></range>
      </package>
      <package>
	<name>clamav-devel</name>
	<range><le>20051104_1</le></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/19534/">
	  <p>Some vulnerabilities have been reported in ClamAV, which
	    potentially can be exploited by malicious people to cause a
	    DoS (Denial of Service) and compromise a vulnerable system.</p>
	  <p>An unspecified integer overflow error exists in the PE header
	    parser in "libclamav/pe.c". Successful exploitation requires that
	    the ArchiveMaxFileSize option is disabled.</p>
	  <p>Some format string errors in the logging handling in
	    "shared/output.c" may be exploited to execute arbitrary code.</p>
	  <p>An out-of-bounds memory access error in the "cli_bitset_test()"
	    function in "ibclamav/others.c" may be exploited to cause a
	    crash.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2006-1614</cvename>
      <cvename>CVE-2006-1615</cvename>
      <cvename>CVE-2006-1630</cvename>
      <url>http://secunia.com/advisories/19534/</url>
      <url>http://www.us.debian.org/security/2006/dsa-1024</url>
    </references>
    <dates>
      <discovery>2006-04-06</discovery>
      <entry>2006-04-06</entry>
    </dates>
  </vuln>

  <vuln vid="99015cf5-c4dd-11da-b2fb-000e0c2e438a">
    <topic>mediawiki -- hardcoded placeholder string security bypass vulnerability</topic>
    <affects>
      <package>
	<name>mediawiki</name>
	<range><lt>1.5.4</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The mediawiki development team reports a vulnerability
	 within the mediawiki application.  The vulnerability is
	 caused by improper checking of inline style attributes.  This
	 could result in the execution of arbitrary javascript code in
	 Microsoft Internet Explorer.  It appears that other browsers
	 are not affected by this vulnerability.</p>
      </body>
    </description>
    <references>
      <bid>16032</bid>
      <cvename>CAN-2005-4501</cvename>
      <url>http://sourceforge.net/project/shownotes.php?release_id=379951</url>
    </references>
    <dates>
      <discovery>2005-12-22</discovery>
      <entry>2006-04-05</entry>
    </dates>
  </vuln>

  <vuln vid="ae9fb0d7-c4dc-11da-b2fb-000e0c2e438a">
    <topic>netpbm -- buffer overflow in pnmtopng</topic>
    <affects>
      <package>
	<name>netpbm</name>
	<range><lt>10.26</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Ubuntu reports:</p>
	<blockquote cite="http://www.ubuntulinux.org/support/documentation/usn/usn-210-1">
	  <p>A buffer overflow was found in the "pnmtopng" conversion
	    program.  By tricking an user (or automated system) to
	    process a specially crafted PNM image with pnmtopng, this
	    could be exploited to execute arbitrary code with the
	    privileges of the user running pnmtopng.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <bid>15128</bid>
      <cvename>CAN-2005-2978</cvename>
      <url>http://www.ubuntulinux.org/support/documentation/usn/usn-210-1</url>
    </references>
    <dates>
      <discovery>2005-10-18</discovery>
      <entry>2006-04-05</entry>
    </dates>
  </vuln>

  <vuln vid="d9307a41-c4d7-11da-b2fb-000e0c2e438a">
    <topic>zoo -- stack based buffer overflow</topic>
    <affects>
      <package>
	<name>zoo</name>
	<range><lt>2.10.1_2</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Jean-Sébastien Guay-Leroux report a vulnerability
	  within the zoo archiver.  The vulnerability which is present
	  in the fullpath() function (from the misc.c file) is caused by
	  improper checking of user supplied data.  The data returned
	  to the buffer can be up to 512 bytes, while the buffer is
	  created to hold 256 bytes.  This could result in a buffer
	  overflow which could allow remote code execution.</p>
      </body>
    </description>
    <references>
      <bid>16790</bid>
      <cvename>CVE-2006-0855</cvename>
      <url>http://www.guay-leroux.com/projects/zoo-advisory.txt</url>
    </references>
    <dates>
      <discovery>2006-02-22</discovery>
      <entry>2006-04-05</entry>
      <modified>2006-04-06</modified>
    </dates>
  </vuln>

  <vuln vid="74b7403c-c4d5-11da-b2fb-000e0c2e438a">
    <topic>mediawiki -- cross site scripting vulnerability</topic>
    <affects>
      <package>
	<name>mediawiki</name>
	<range><ge>1.4</ge><lt>1.4.14</lt></range>
	<range><ge>1.5</ge><lt>1.5.7</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The mediawiki development team reports that there is an
	  site scripting vulnerability within mediawiki.  The
	  vulnerability is caused by improper checking of encoded
	  links which could allow the injection of html in the output
	  generated by mediawiki.  This could lead to cross site
	  scripting attacks against mediawiki installations.</p>
      </body>
    </description>
    <references>
      <bid>17269</bid>
      <cvename>CVE-2006-1498</cvename>
      <url>http://mail.wikipedia.org/pipermail/mediawiki-announce/2006-March/000040.html</url>
    </references>
    <dates>
      <discovery>2006-03-27</discovery>
      <entry>2006-04-05</entry>
    </dates>
  </vuln>

  <vuln vid="b5fc63ad-c4c3-11da-9699-00123ffe8333">
    <topic>dia -- XFig Import Plugin Buffer Overflow</topic>
    <affects>
      <package>
	<name>dia</name>
	<name>dia-gnome</name>
	<range><gt>0.86_1</gt><lt>0.94_6,1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/19469/">
	  <p>Some vulnerabilities have been reported in Dia, which
	    potentially can be exploited by malicious people to
	    compromise a user's system.</p>
	  <p>The vulnerabilities are caused due to boundary errors
	    within the XFig import plugin. This can be exploited to
	    cause buffer overflows and may allow arbitrary code
	    execution when a specially-crafted FIG file is imported.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2006-1550</cvename>
      <url>http://secunia.com/advisories/19469/</url>
      <mlist msgid="1143662924.6460.60.camel@linux.site">http://mail.gnome.org/archives/dia-list/2006-March/msg00149.html</mlist>
    </references>
    <dates>
      <discovery>2006-03-31</discovery>
      <entry>2006-04-05</entry>
    </dates>
  </vuln>

  <vuln vid="be4ccb7b-c48b-11da-ae12-0002b3b60e4c">
    <topic>openvpn -- LD_PRELOAD code execution on client through malicious or compromised server</topic>
    <affects>
      <package>
	<name>openvpn</name>
	<range><ge>2.0</ge><lt>2.0.6</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Hendrik Weimer reports:</p>
	<blockquote cite="http://www.osreviews.net/reviews/security/openvpn-print">
	  <p>OpenVPN clients are a bit too generous when accepting
	    configuration options from a server. It is possible to transmit
	    environment variables to client-side shell scripts.  There are some
	    filters in place to prevent obvious nonsense, however they don't
	    catch the good old LD_PRELOAD trick. All we need is to put a file
	    onto the client under a known location (e.g. by returning a
	    specially crafted document upon web access) and we have a remote
	    root exploit. But since the attack may only come from authenticated
	    servers, this threat is greatly reduced.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2006-1629</cvename>
      <url>http://www.osreviews.net/reviews/security/openvpn-print</url>
      <url>http://openvpn.net/changelog.html</url>
      <mlist msgid="4431F7C4.4030804@yonan.net">http://sourceforge.net/mailarchive/message.php?msg_id=15298074</mlist>
    </references>
    <dates>
      <discovery>2006-04-03</discovery>
      <entry>2006-04-05</entry>
      <modified>2006-04-06</modified>
    </dates>
  </vuln>

  <vuln vid="92fd40eb-c458-11da-9c79-00123ffe8333">
    <topic>samba -- Exposure of machine account credentials in winbind log files</topic>
    <affects>
      <package>
	<name>samba</name>
	<range><ge>3.0.21a,1</ge><lt>3.0.22,1</lt></range>
      </package>
      <package>
	<name>ja-samba</name>
	<range><ge>3.0.21a,1</ge><lt>3.0.22,1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Samba Security Advisory:</p>
	<blockquote cite="http://us1.samba.org/samba/security/CAN-2006-1059.html">
	  <p>The machine trust account password is the secret
	    shared between a domain controller and a specific
	    member server. Access to the member server machine
	    credentials allows an attacker to impersonate the
	    server in the domain and gain access to additional
	    information regarding domain users and groups.</p>
	  <p>The winbindd daemon writes the clear text of server's
	    machine credentials to its log file at level 5.
	    The winbindd log files are world readable by default
	    and often log files are requested on open mailing
	    lists as tools used to debug server misconfigurations.</p>
	  <p>This affects servers configured to use domain or
	    ads security and possibly Samba domain controllers
	    as well (if configured to use winbindd).</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2006-1059</cvename>
      <url>http://us1.samba.org/samba/security/CAN-2006-1059.html</url>
      <url>http://secunia.com/advisories/19455/</url>
    </references>
    <dates>
      <discovery>2006-03-30</discovery>
      <entry>2006-04-05</entry>
    </dates>
  </vuln>

  <vuln vid="91afa94c-c452-11da-8bff-000ae42e9b93">
    <topic>mod_pubcookie -- cross site scripting vulnerability</topic>
    <affects>
      <package>
	<name>mod_pubcookie</name>
	<range><lt>3.3.0</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Nathan Dors of the Pubcookie Project reports:</p>
	<blockquote cite="http://www.pubcookie.org/news/20060306-apps-secadv.html">
	  <p>Non-persistent XSS vulnerabilities were found in the
	    Pubcookie Apache module (mod_pubcookie) and ISAPI
	    filter. These components mishandle untrusted data when
	    printing responses to the browser. This makes them
	    vulnerable to carefully crafted requests containing script
	    or HTML. If an attacker can lure an unsuspecting user to
	    visit carefully staged content, the attacker can use it to
	    redirect the user to a vulnerable Pubcookie application
	    server and attempt to exploit the XSS vulnerabilities.</p>
	  <p>These vulnerabilities are classified as *high* due to the
	    nature and purpose of Pubcookie application servers for user
	    authentication and Web Single Sign-on (SSO). An attacker
	    who injects malicious script through the vulnerabilities
	    might steal private Pubcookie data including a user's
	    authentication assertion ("granting") cookies and
	    application session cookies.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <certvu>314540</certvu>
    </references>
    <dates>
      <discovery>2006-03-06</discovery>
      <entry>2006-04-05</entry>
    </dates>
  </vuln>

  <vuln vid="855cd9fa-c452-11da-8bff-000ae42e9b93">
    <topic>pubcookie-login-server -- cross site scripting vulnerability</topic>
    <affects>
      <package>
	<name>pubcookie-login-server</name>
	<range><lt>3.3.0</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Nathan Dors of the Pubcookie Project reports:</p>
	<blockquote cite="">
	  <p> Multiple non-persistent XSS vulnerabilities were found
	    in the Pubcookie login server's compiled binary "index.cgi"
	    CGI program. The CGI program mishandles untrusted data when
	    printing responses to the browser. This makes the program
	    vulnerable to carefully crafted requests containing script
	    or HTML. If an attacker can lure an unsuspecting user to
	    visit carefully staged content, the attacker can use it to
	    redirect the user to his or her local Pubcookie login page
	    and attempt to exploit the XSS vulnerabilities.</p>
	  <p> These vulnerabilities are classified as *critical* due
	    to the nature and purpose of the Pubcookie login server for
	    user authentication and Web Single Sign-on (SSO). Specific
	    threats include:</p>
	  <ul>
	    <li>An attacker who injects malicious script through the
	      vulnerabilities might steal senstive user data including
	      a user's authentication credentials (usernames and
	      passwords);</li>
	    <li>An attacker who injects malicious script through the
	      vulnerabilities might steal private Pubcookie data
	      including a user's authentication assertion ("granting")
	      cookies and SSO ("login") session cookies;</li>
	    <li>An attacker who injects HTML tags through the
	      vulnerabilities might deface a site's Pubcookie login page
	      for a single visit by a single user (i.e. a non-persistent
	      defacement).</li>
	  </ul>
	  <p>At the heart of these threats lies a violation of the
	    user's trust in the Pubcookie login server.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <certvu>337585</certvu>
    </references>
    <dates>
      <discovery>2006-03-06</discovery>
      <entry>2006-04-05</entry>
    </dates>
  </vuln>

  <vuln vid="37a5c10f-bf56-11da-b0e9-00123ffe8333">
    <topic>freeradius -- EAP-MSCHAPv2 Authentication Bypass</topic>
    <affects>
      <package>
	<name>freeradius</name>
	<range><ge>1.0.0</ge><lt>1.1.1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Freeradius Security Contact reports:</p>
	<blockquote cite="http://www.freeradius.org/security.html#1.1.0">
	  <p>Insufficient input validation was being done in the
	    EAP-MSCHAPv2 state machine. A malicious attacker could
	    manipulate their EAP-MSCHAPv2 client state machine to
	    potentially convince the server to bypass authentication
	    checks. This bypassing could also result in the server
	    crashing.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2006-1354</cvename>
      <url>http://www.freeradius.org/security.html#1.1.0</url>
      <url>http://secunia.com/advisories/19300/</url>
    </references>
    <dates>
      <discovery>2006-03-21</discovery>
      <entry>2006-03-29</entry>
    </dates>
  </vuln>

  <vuln vid="2db97aa6-be81-11da-9b82-0050bf27ba24">
    <topic>horde -- remote code execution vulnerability in the help viewer</topic>
    <affects>
      <package>
	<name>horde</name>
	<name>horde-php5</name>
	<range><lt>3.1.1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Horde 3.1.1 release announcement:</p>
	<blockquote cite="http://lists.horde.org/archives/announce/2006/000271.html">
	  <p>Major changes compared to Horde 3.1 are:</p>
	  <ul>
	    <li>Fix for remote code execution vulnerability in the
	      help viewer, discovered by Jan Schneider from the Horde
	      team.</li>
	  </ul>
	</blockquote>
      </body>
    </description>
    <references>
      <bid>17292</bid>
      <cvename>CVE-2006-1491</cvename>
      <url>http://lists.horde.org/archives/announce/2006/000271.html</url>
    </references>
    <dates>
      <discovery>2006-03-28</discovery>
      <entry>2006-03-28</entry>
      <modified>2006-03-30</modified>
    </dates>
  </vuln>

  <vuln vid="25858c37-bdab-11da-b7d4-00123ffe8333">
    <topic>linux-realplayer -- buffer overrun</topic>
    <affects>
      <package>
	<name>linux-realplayer</name>
	<range><ge>10.0.1</ge><lt>10.0.7.785.20060201</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia Advisories Reports:</p>
	<blockquote cite="http://secunia.com/advisories/19358/">
	  <p>A boundary error when processing SWF files can be exploited to
	    cause a buffer overflow. This may allow execution of arbitrary
	    code on the user's system.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2006-0323</cvename>
      <url>http://service.real.com/realplayer/security/03162006_player/en/</url>
      <url>http://secunia.com/advisories/19358/</url>
    </references>
    <dates>
      <discovery>2006-03-23</discovery>
      <entry>2006-03-27</entry>
    </dates>
  </vuln>

  <vuln vid="fe4c84fc-bdb5-11da-b7d4-00123ffe8333">
    <topic>linux-realplayer -- heap overflow</topic>
    <affects>
      <package>
	<name>linux-realplayer</name>
	<range><ge>10.0.1</ge><lt>10.0.6</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>iDefense Reports:</p>
	<blockquote cite="http://www.idefense.com/intelligence/vulnerabilities/display.php?id=404">
	  <p>Remote exploitation of a heap-based buffer overflow in
	    RealNetwork Inc's RealPlayer could allow the execution of
	    arbitrary code in the context of the currently logged in
	    user.</p>
	  <p>In order to exploit this vulnerability, an attacker would
	    need to entice a user to follow a link to a malicious server.
	    Once the user visits a website under the control of an
	    attacker, it is possible in a default install of RealPlayer
	    to force a web-browser to use RealPlayer to connect to an
	    arbitrary server, even when it is not the default application
	    for handling those types, by the use of embedded object tags
	    in a webpage. This may allow automated exploitation when the
	    page is viewed.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-2922</cvename>
      <url>http://service.real.com/realplayer/security/03162006_player/en/</url>
      <url>http://www.idefense.com/intelligence/vulnerabilities/display.php?id=404</url>
      <url>http://secunia.com/advisories/19358/</url>
    </references>
    <dates>
      <discovery>2006-03-23</discovery>
      <entry>2006-03-27</entry>
    </dates>
  </vuln>

  <vuln vid="08ac7b8b-bb30-11da-b2fb-000e0c2e438a">
    <topic>sendmail -- race condition vulnerability</topic>
    <affects>
      <package>
	<name>sendmail</name>
	<range><gt>8.13</gt><lt>8.13.6</lt></range>
      </package>
      <package>
	<name>FreeBSD</name>
	<range><ge>6.0</ge><lt>6.0_6</lt></range>
	<range><ge>5.4</ge><lt>5.4_13</lt></range>
	<range><ge>5.3</ge><lt>5.3_28</lt></range>
	<range><ge>4.11</ge><lt>4.11_16</lt></range>
	<range><ge>4.10</ge><lt>4.10_22</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description</h1>
	<p>A race condition has been reported to exist in the handling
	  by sendmail of asynchronous signals.</p>
	<h1>Impact</h1>
	<p>A remote attacker may be able to execute arbitrary code with
	  the privileges of the user running sendmail, typically
	  root.</p>
	<h1>Workaround</h1>
	<p>There is no known workaround other than disabling
	  sendmail.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2006-0058</cvename>
      <freebsdsa>SA-06:13.sendmail</freebsdsa>
    </references>
    <dates>
      <discovery>2006-03-22</discovery>
      <entry>2006-03-24</entry>
      <modified>2006-06-09</modified>
    </dates>
  </vuln>

  <vuln vid="e93bc5b0-bb2e-11da-b2fb-000e0c2e438a">
    <topic>OPIE -- arbitrary password change</topic>
    <affects>
      <package>
	<name>FreeBSD</name>
	<range><ge>6.0</ge><lt>6.0_6</lt></range>
	<range><ge>5.4</ge><lt>5.4_13</lt></range>
	<range><ge>5.3</ge><lt>5.3_28</lt></range>
	<range><ge>4.11</ge><lt>4.11_16</lt></range>
	<range><ge>4.10</ge><lt>4.10_22</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description</h1>
	<p>The opiepasswd(1) program uses getlogin(2) to identify the
	  user calling opiepasswd(1).  In some circumstances
	  getlogin(2) will return "root" even when running as an
	  unprivileged user.  This causes opiepasswd(1) to allow an
	  unpriviled user to configure OPIE authentication for the root
	  user.</p>
	<h1>Impact</h1>
	<p>In certain cases an attacker able to run commands as a non
	  privileged users which have not explicitly logged in, for
	  example CGI scripts run by a web server, is able to configure
	  OPIE access for the root user.  If the attacker is able to
	  authenticate as root using OPIE authentication, for example if
	  "PermitRootLogin" is set to "yes" in sshd_config or the
	  attacker has access to a local user in the "wheel" group, the
	  attacker can gain root privileges.</p>
	<h1>Workaround</h1>
	<p>Disable OPIE authentication in PAM:</p>
	<pre># sed -i "" -e /opie/s/^/#/ /etc/pam.d/*</pre>
	<p>or</p>
	<p>Remove the setuid bit from opiepasswd:</p>
	<pre># chflags noschg /usr/bin/opiepasswd</pre>
	<pre># chmod 555 /usr/bin/opiepasswd</pre>
	<pre># chflags schg /usr/bin/opiepasswd</pre>
      </body>
    </description>
    <references>
      <cvename>CVE-2006-1283</cvename>
      <freebsdsa>SA-06:12.opie</freebsdsa>
    </references>
    <dates>
      <discovery>2006-03-22</discovery>
      <entry>2006-03-24</entry>
      <modified>2006-06-09</modified>
    </dates>
  </vuln>

  <vuln vid="e50a7476-bb2d-11da-b2fb-000e0c2e438a">
    <topic>ipsec -- reply attack vulnerability</topic>
    <affects>
      <package>
	<name>FreeBSD</name>
	<range><ge>6.0</ge><lt>6.0_6</lt></range>
	<range><ge>5.4</ge><lt>5.4_13</lt></range>
	<range><ge>5.3</ge><lt>5.3_28</lt></range>
	<range><ge>4.11</ge><lt>4.11_16</lt></range>
	<range><ge>4.10</ge><lt>4.10_22</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description</h1>
	<p>IPsec provides an anti-replay service which when enabled
	  prevents an attacker from successfully executing a replay
	  attack.  This is done through the verification of sequence
	  numbers.  A programming error in the fast_ipsec(4)
	  implementation results in the sequence number associated with
	  a Security Association not being updated, allowing packets to
	  unconditionally pass sequence number verification checks.</p>
	<h1>Impact</h1>
	<p>An attacker able to intercept IPSec packets can replay
	  them.  If higher level protocols which do not provide any
	  protection against packet replays (e.g., UDP) are used, this
	  may have a variety of effects.</p>
	<h1>Workaround</h1>
	<p>No workaround is available.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2006-0905</cvename>
      <freebsdsa>SA-06:11.ipsec</freebsdsa>
    </references>
    <dates>
      <discovery>2006-03-22</discovery>
      <entry>2006-03-24</entry>
      <modified>2006-06-09</modified>
    </dates>
  </vuln>

  <vuln vid="61534682-b8f4-11da-8e62-000e0c33c2dc">
    <topic>xorg-server -- privilege escalation</topic>
    <affects>
      <package>
	<name>xorg-server</name>
	<range><eq>6.9.0</eq></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Daniel Stone of X.Org reports:</p>
	<blockquote cite="http://lists.freedesktop.org/archives/xorg/2006-March/013992.html">
	  <p>During the analysis of results from the Coverity code review
	    of X.Org, we discovered a flaw in the server that allows local
	    users to execute arbitrary code with root privileges, or cause
	    a denial of service by overwriting files on the system, again
	    with root privileges.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2006-0745</cvename>
      <url>https://bugs.freedesktop.org/show_bug.cgi?id=6213</url>
    </references>
    <dates>
      <discovery>2006-03-20</discovery>
      <entry>2006-03-21</entry>
    </dates>
  </vuln>

  <vuln vid="b62c80c2-b81a-11da-bec5-00123ffe8333">
    <topic>heimdal -- Multiple vulnerabilities</topic>
    <affects>
      <package>
	<name>heimdal</name>
	<range><lt>0.6.6</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A Project heimdal Security Advisory reports:</p>
	<blockquote cite="http://www.pdc.kth.se/heimdal/advisory/2005-04-20/">
	  <p>The telnet client program in Heimdal has buffer overflows
	    in the functions slc_add_reply() and env_opt_add(), which
	    may lead to remote code execution.</p>
	</blockquote>
	<blockquote cite="http://www.pdc.kth.se/heimdal/advisory/2005-06-20/">
	  <p>The telnetd server program in Heimdal has buffer overflows
	    in the function getterminaltype, which may lead to remote code
	    execution.</p>
	</blockquote>
	<blockquote cite="http://www.pdc.kth.se/heimdal/advisory/2006-02-06/">
	  <p>The rshd server in Heimdal has a privilege escalation bug
	    when storing forwarded credentials. The code allowes a user
	    to overwrite a file with its credential cache, and get ownership
	    of the file.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-0469</cvename>
      <cvename>CVE-2005-2040</cvename>
      <cvename>CVE-2006-0582</cvename>
      <cvename>CVE-2006-0677</cvename>
      <url>http://www.pdc.kth.se/heimdal/advisory/2005-04-20</url>
      <url>http://www.pdc.kth.se/heimdal/advisory/2005-06-20</url>
      <url>http://www.pdc.kth.se/heimdal/advisory/2006-02-06</url>
    </references>
    <dates>
      <discovery>2006-02-06</discovery>
      <entry>2006-03-20</entry>
    </dates>
  </vuln>

  <vuln vid="b8e361b8-b7ff-11da-8414-0013d4a4a40e">
    <topic>curl -- TFTP packet buffer overflow vulnerability</topic>
    <affects>
      <package>
	<name>curl</name>
	<name>linux-curl</name>
	<range><gt>7.14.1</gt><lt>7.15.3</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A Project cURL Security Advisory reports:</p>
	<blockquote cite="http://curl.haxx.se/docs/adv_20060320.html">
	  <p>libcurl uses the given file part of a TFTP URL in a manner that
	    allows a malicious user to overflow a heap-based memory buffer due
	    to the lack of boundary check.</p>
	  <p>This overflow happens if you pass in a URL with a TFTP
	    protocol prefix ("tftp://"), using a valid host and a path
	    part that is longer than 512 bytes.</p>
	  <p>The affected flaw can be triggered by a redirect, if
	    curl/libcurl is told to follow redirects and an HTTP
	    server points the client to a tftp URL with the
	    characteristics described above.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2006-1061</cvename>
      <url>http://curl.haxx.se/docs/adv_20060320.html</url>
    </references>
    <dates>
      <discovery>2006-03-20</discovery>
      <entry>2006-03-20</entry>
      <modified>2006-10-05</modified>
    </dates>
  </vuln>

  <vuln vid="6779e82f-b60b-11da-913d-000ae42e9b93">
    <topic>drupal -- multiple vulnerabilities</topic>
    <affects>
      <package>
	<name>drupal</name>
	<range><lt>3.6.6</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Drupal reports:</p>
	<blockquote cite="http://drupal.org/node/53806">
	  <p>Mail header injection vulnerability.</p>
	  <p>Linefeeds and carriage returns were not being stripped from
	    email headers, raising the possibility of bogus headers
	    being inserted into outgoing email.</p>
	  <p>This could lead to Drupal sites being used to send unwanted
	    email.</p>
	</blockquote>
	<blockquote cite="http://drupal.org/node/53805">
	  <p>Session fixation vulnerability.</p>
	  <p>If someone creates a clever enough URL and convinces you to
	    click on it, and you later log in but you do not log off
	    then the attacker may be able to impersonate you.</p>
	</blockquote>
	<blockquote cite="http://drupal.org/node/53803">
	  <p>XSS vulnerabilities.</p>
	  <p>Some user input sanity checking was missing. This could
	    lead to possible cross-site scripting (XSS) attacks.</p>
	  <p>XSS can lead to user tracking and theft of accounts and
	    services.</p>
	</blockquote>
	<blockquote cite="http://drupal.org/node/53796">
	  <p>Security bypass in menu.module.</p>
	  <p>If you use menu.module to create a menu item, the page you
	    point to will be accessible to all, even if it is an admin
	    page.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <url>http://drupal.org/node/53806</url>
      <url>http://drupal.org/node/53805</url>
      <url>http://drupal.org/node/53803</url>
      <url>http://drupal.org/node/53796</url>
    </references>
    <dates>
      <discovery>2006-03-13</discovery>
      <entry>2006-03-17</entry>
    </dates>
  </vuln>

  <vuln vid="c7c09579-b466-11da-82d0-0050bf27ba24">
    <topic>horde -- "url" disclosure of sensitive information vulnerability</topic>
    <affects>
      <package>
	<name>horde</name>
	<name>horde-php5</name>
	<range><lt>3.1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p> Secunia advisory SA19246:</p>
	<blockquote cite="http://secunia.com/advisories/19246/">
	  <p>Paul Craig has discovered a vulnerability in Horde, which
	    can be exploited by malicious people to disclose sensitive
	    information.
	    Input passed to the "url" parameter in "services/go.php"
	    isn't properly verified, before it is used in a
	    "readfile()" call. This can be exploited to disclose the
	    content of arbitrary files via e.g. the "php://" protocol
	    wrapper.</p>
	  <p>The vulnerability has been confirmed in version 3.0.9 and
	    has also been reported in prior versions.</p>
	  <p>Provided and/or discovered by:
	    Paul Craig, Security-Assessment.com.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <url>http://secunia.com/advisories/19246/</url>
    </references>
    <dates>
      <discovery>2006-03-15</discovery>
      <entry>2006-03-15</entry>
    </dates>
  </vuln>

  <vuln vid="83421018-b3ef-11da-a32d-000c6ec775d9">
    <topic>linux-flashplugin -- arbitrary code execution vulnerability</topic>
    <affects>
      <package>
	<name>linux-flashplugin</name>
	<range><lt>7.0r63</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Adobe reports:</p>
	<blockquote cite="http://www.macromedia.com/devnet/security/security_zone/apsb06-03.html">
	  <p>Critical vulnerabilities have been identified in Flash
	    Player that could allow an attacker who successfully
	    exploits these vulnerabilities to take control of the
	    affected system. A malicious SWF must be loaded in Flash
	    Player by the user for an attacker to exploit these
	    vulnerabilities.</p>
	  <p>Flash Player 8 update (8.0.24.0), and Flash Player 7
	    update (7.0.63.0) address security vulnerabilities in
	    previous versions of Flash Player, which could lead to the
	    potential execution of arbitrary code. These
	    vulnerabilities could be accessed through content
	    delivered from a remote location via the users web
	    browser, email client, or other applications that include
	    or reference the Flash Player.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2006-0024</cvename>
      <url>http://www.macromedia.com/devnet/security/security_zone/apsb06-03.html</url>
    </references>
    <dates>
      <discovery>2006-03-14</discovery>
      <entry>2006-03-15</entry>
    </dates>
  </vuln>

  <vuln vid="6111ecb8-b20d-11da-b2fb-000e0c2e438a">
    <topic>nfs -- remote denial of service</topic>
    <affects>
      <package>
	<name>FreeBSD</name>
	<range><ge>6.0</ge><lt>6.0_5</lt></range>
	<range><ge>5.4</ge><lt>5.4_12</lt></range>
	<range><ge>5.3</ge><lt>5.3_27</lt></range>
	<range><ge>4.11</ge><lt>4.11_15</lt></range>
	<range><ge>4.10</ge><lt>4.10_21</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem description:</h1>
	<p>A part of the NFS server code charged with handling incoming
	  RPC messages via TCP had an error which, when the server
	  received a message with a zero-length payload, would cause a
	  NULL pointer dereference which results in a kernel panic.  The
	  kernel will only process the RPC messages if a userland nfsd
	  daemon is running.</p>
	<h1>Impact:</h1>
	<p>The NULL pointer deference allows a remote attacker capable
	  of sending RPC messages to an affected FreeBSD system to crash
	  the FreeBSD system.</p>
	<h1>Workaround:</h1>
	<ol>
	  <li>
	    <p>Disable the NFS server: set the nfs_server_enable
	      variable to "NO" in /etc/rc.conf, and reboot.</p>
	    <p>Alternatively, if there are no active NFS clients (as
	      listed by the showmount(8) utility), simply killing the
	      mountd and nfsd processes should suffice.</p>
	  </li>
	  <li>
	    <p>Add firewall rules to block RPC traffic to the NFS server
	      from untrusted hosts.</p>
	  </li>
	</ol>
      </body>
    </description>
    <references>
      <cvename>CVE-2006-0900</cvename>
      <freebsdsa>SA-06:10.nfs</freebsdsa>
    </references>
    <dates>
      <discovery>2006-03-01</discovery>
      <entry>2006-03-12</entry>
      <modified>2016-08-09</modified>
    </dates>
  </vuln>

  <vuln vid="6a308e8e-b1b4-11da-b2fb-000e0c2e438a">
    <topic>openssh -- remote denial of service</topic>
    <affects>
      <package>
	<name>FreeBSD</name>
	<range><ge>5.4</ge><lt>5.4_12</lt></range>
	<range><ge>5.3</ge><lt>5.3_27</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem description:</h1>
	<p>Because OpenSSH and OpenPAM have conflicting designs (one is event-
	  driven while the other is callback-driven), it is necessary for
	  OpenSSH to fork a child process to handle calls to the PAM framework.
	  However, if the unprivileged child terminates while PAM authentication
	  is under way, the parent process incorrectly believes that the PAM
	  child also terminated.  The parent process then terminates, and the
	  PAM child is left behind.</p>
	<p>Due to the way OpenSSH performs internal accounting, these orphaned
	  PAM children are counted as pending connections by the master OpenSSH
	  server process.  Once a certain number of orphans has accumulated, the
	  master decides that it is overloaded and stops accepting client
	  connections.</p>
	<h1>Impact:</h1>
	<p>By repeatedly connecting to a vulnerable server, waiting for
	  a password prompt, and closing the connection, an attacker can
	  cause OpenSSH to stop accepting client connections until the
	  system restarts or an administrator manually kills the orphaned
	  PAM processes.</p>
	<h1>Workaround:</h1>
	<p>The following command will show a list of orphaned PAM
	  processes:</p>
	<pre># pgrep -lf 'sshd.*\[pam\]'</pre>
	<p>The following command will kill orphaned PAM processes:</p>
	<pre># pkill -f 'sshd.*\[pam\]'</pre>
	<p>To prevent OpenSSH from leaving orphaned PAM processes behind,
	  perform one of the following:</p>
	<ol>
	  <li>
	    <p>Disable PAM authentication in OpenSSH.  Users will still
	      be able to log in using their Unix password, OPIE or SSH
	      keys.</p>
	    <p>To do this, execute the following commands as root:</p>
	    <pre># echo 'UsePAM no' &gt;&gt;/etc/ssh/sshd_config</pre>
	    <pre># echo 'PasswordAuthentication yes' &gt;&gt;/etc/ssh/sshd_config</pre>
	    <pre># /etc/rc.d/sshd restart</pre>
	  </li>
	  <li>
	    <p>If disabling PAM is not an option - if, for instance, you use
	      RADIUS authentication, or store user passwords in an SQL database
	      - you may instead disable privilege separation.  However, this may
	      leave OpenSSH vulnerable to hitherto unknown bugs, and should be
	      considered a last resort.</p>
	    <p>To do this, execute the following commands as root:</p>
	    <pre># echo 'UsePrivilegeSeparation no' &gt;&gt;/etc/ssh/sshd_config</pre>
	    <pre># /etc/rc.d/sshd restart</pre>
	  </li>
	</ol>
      </body>
    </description>
    <references>
      <cvename>CVE-2006-0883</cvename>
      <freebsdsa>SA-06:09.openssh</freebsdsa>
    </references>
    <dates>
      <discovery>2006-03-01</discovery>
      <entry>2006-03-12</entry>
      <modified>2016-08-09</modified>
    </dates>
  </vuln>

  <vuln vid="948921ad-afbc-11da-bad9-02e081235dab">
    <topic>GnuPG does not detect injection of unsigned data</topic>
    <affects>
      <package>
	<name>gnupg</name>
	<range><lt>1.4.2.2</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Werner Koch reports:</p>
	<blockquote cite="http://lists.gnupg.org/pipermail/gnupg-announce/2006q1/000216.html">
	  <p>In the aftermath of the false positive signature
	    verfication bug (announced 2006-02-15) more thorough testing
	    of the fix has been done and another vulnerability has been
	    detected.  This new problem affects the use of *gpg* for
	    verification of signatures which are _not_ detached
	    signatures.  The problem also affects verification of
	    signatures embedded in encrypted messages; i.e. standard use
	    of gpg for mails.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2006-0049</cvename>
      <mlist msgid="87d5gvh2kr.fsf@wheatstone.g10code.de">http://lists.gnupg.org/pipermail/gnupg-announce/2006q1/000216.html</mlist>
    </references>
    <dates>
      <discovery>2006-03-09</discovery>
      <entry>2006-03-10</entry>
      <modified>2006-03-11</modified>
    </dates>
  </vuln>

  <vuln vid="104beb63-af4d-11da-8414-0013d4a4a40e">
    <topic>mplayer -- heap overflow in the ASF demuxer</topic>
    <affects>
      <package>
	<name>mplayer</name>
	<name>mplayer-gtk</name>
	<name>mplayer-esound</name>
	<name>mplayer-gtk-esound</name>
	<range><lt>0.99.7_11</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Mplayer team reports:</p>
	<blockquote cite="http://www.mplayerhq.hu/design7/news.html#vuln13">
	  <p>A potential buffer overflow was found in the ASF demuxer.
	    Arbitrary remote code execution is possible (under the user ID
	    running the player) when streaming an ASF file from a malicious
	    server or local code execution (under the user ID running the
	    player) if a malicious ASF file is played locally.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2006-0579</cvename>
      <url>http://www.mplayerhq.hu/design7/news.html#vuln13</url>
      <url>http://secunia.com/advisories/18718</url>
      <url>http://bugs.gentoo.org/show_bug.cgi?id=122029</url>
    </references>
    <dates>
      <discovery>2006-02-15</discovery>
      <entry>2006-03-09</entry>
    </dates>
  </vuln>

  <vuln vid="594ad3c5-a39b-11da-926c-0800209adf0e">
    <topic>SSH.COM SFTP server -- format string vulnerability</topic>
    <affects>
      <package>
	<name>ssh2</name>
	<name>ssh2-nox11</name>
	<range><lt>3.2.9.1_5</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>SSH Communications Security Corp reports a format string
	  vulnerability in their SFTP server. This vulnerability could
	  cause a user with SCP/SFTP access only to get permission to
	  execute also other commands. It could also allow user A to
	  create a special file that when accessed by user B allows
	  user A to execute commands as user B.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2006-0705</cvename>
      <bid>16640</bid>
      <url>http://www.ssh.com/company/newsroom/article/715/</url>
      <url>http://www.frsirt.com/english/advisories/2006/0554</url>
      <url>http://securitytracker.com/id?1015619</url>
      <url>http://secunia.com/advisories/18828</url>
      <url>http://xforce.iss.net/xforce/xfdb/24651</url>
    </references>
    <dates>
      <discovery>2006-02-13</discovery>
      <entry>2006-03-04</entry>
      <modified>2006-03-06</modified>
    </dates>
  </vuln>

  <vuln vid="6107efb9-aae3-11da-aea1-000854d03344">
    <topic>gtar -- invalid headers buffer overflow</topic>
    <affects>
      <package>
	<name>gtar</name>
	<range><lt>1.15.1_2</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>GNU tar is vulnerable to a buffer overflow, caused by
	  improper bounds checking of the PAX extended headers. By
	  tricking an user into processing a specially crafted tar
	  archive, this could be exploited to execute arbitrary
	  code with the privileges of the user.</p>
      </body>
    </description>
    <references>
      <bid>16764</bid>
      <cvename>CVE-2006-0300</cvename>
    </references>
    <dates>
      <discovery>2006-02-22</discovery>
      <entry>2006-03-03</entry>
    </dates>
  </vuln>

  <vuln vid="46f7b598-a781-11da-906a-fde5cdde365e">
    <topic>bugzilla -- multiple vulnerabilities</topic>
    <affects>
      <package>
	<name>bugzilla</name>
	<name>ja-bugzilla</name>
	<range><ge>2.17.1</ge><lt>2.20.1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Some vulnerabilities have been reported in Bugzilla,
	  which can be exploited by malicious users to conduct SQL injection
	  attacks, and by malicious people to disclose sensitive information
	  and conduct script insertion attacks.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2006-2420</cvename>
      <cvename>CVE-2006-0916</cvename>
      <cvename>CVE-2006-0915</cvename>
      <cvename>CVE-2006-0914</cvename>
      <cvename>CVE-2006-0913</cvename>
      <url>http://www.bugzilla.org/security/2.18.4/</url>
    </references>
    <dates>
      <discovery>2006-02-20</discovery>
      <entry>2006-02-27</entry>
      <modified>2006-11-11</modified>
    </dates>
  </vuln>

  <vuln vid="af9018b6-a4f5-11da-bb41-0011433a9404">
    <topic>squirrelmail -- multiple vulnerabilities</topic>
    <affects>
      <package>
	<name>squirrelmail</name>
	<range><lt>1.4.6</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Multiple vulnerabilities has been discovered since 1.4.5,
	  including IMAP injection as well as some XSS issues.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2006-0377</cvename>
      <cvename>CVE-2006-0195</cvename>
      <cvename>CVE-2006-0188</cvename>
    </references>
    <dates>
      <discovery>2006-02-23</discovery>
      <entry>2006-02-24</entry>
    </dates>
  </vuln>

  <vuln vid="e319da0b-a228-11da-b410-000e0c2e438a">
    <topic>gedit -- format string vulnerability</topic>
    <affects>
      <package>
	<name>gedit</name>
	<range><lt>2.10.3</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Yan Feng reports a format string vulnerability in gedit.
	  This vulnerability could cause a denial of service with a
	  binary file that contains format string characters within
	  the filename.  It had been reported that web browsers
	  and email clients can be configured to provide a filename as
	  an argument to gedit.:</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2005-1686</cvename>
      <mlist msgid="20050520202628.12260.qmail@www.securityfocus.com">:http://marc.theaimsgroup.com/?l=bugtraq&amp;m=111661117701398</mlist>
    </references>
    <dates>
      <discovery>2005-05-20</discovery>
      <entry>2006-02-20</entry>
    </dates>
  </vuln>

  <vuln vid="07ead557-a220-11da-b410-000e0c2e438a">
    <topic>WebCalendar -- unauthorized access vulnerability</topic>
    <affects>
      <package>
	<name>WebCalendar</name>
	<range><lt>1.0.0</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>SecurityFocus reports that WebCalendar is affected by
	 an unauthorized access vulnerability.	The vulnerability
	 is caused by improper checking of the authentication
	 mechanism before access is being permitted to the
	 "assistant_edit.php" file.</p>
      </body>
    </description>
    <references>
      <bid>14072</bid>
      <cvename>CAN-2005-2320</cvename>
    </references>
    <dates>
      <discovery>2005-06-27</discovery>
      <entry>2006-02-20</entry>
    </dates>
  </vuln>

  <vuln vid="9cd52bc6-a213-11da-b410-000e0c2e438a">
    <topic>abiword, koffice -- stack based buffer overflow vulnerabilities</topic>
    <affects>
      <package>
	<name>koffice</name>
	<range><gt>1.2.0</gt><lt>1.4.1_1,1</lt></range>
      </package>
      <package>
	<name>abiword</name>
	<range><lt>2.2.11</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Chris Evans reports that AbiWord is vulnerable to multiple
	  stack-based buffer overflow vulnerabilities.	This
	  is caused by improper checking of the user-supplied data
	  before it is being copied to an too small buffer.  The
	  vulnerability is triggered when someone is importing RTF
	  files.</p>
      </body>
    </description>
    <references>
      <bid>15096</bid>
      <cvename>CAN-2005-2972</cvename>
      <url>http://scary.beasts.org/security/CESA-2005-006.txt</url>
      <url>http://www.abisource.com/changelogs/2.2.11.phtml</url>
      <url>http://www.kde.org/info/security/advisory-20051011-1.txt</url>
    </references>
    <dates>
      <discovery>2005-10-14</discovery>
      <entry>2006-02-20</entry>
      <modified>2006-02-20</modified>
    </dates>
  </vuln>

  <vuln vid="0b2b4b4d-a07c-11da-be0a-000c6ec775d9">
    <topic>postgresql81-server -- SET ROLE privilege escalation</topic>
    <affects>
      <package>
	<name>postgresql-server</name>
	<range><ge>8.1.0</ge><lt>8.1.3</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The PostgreSQL team reports:</p>
	<blockquote cite="http://www.postgresql.org/docs/8.1/static/release.html#RELEASE-8-1-3">
	  <p>Due to inadequate validity checking, a user could exploit
	    the special case that SET ROLE normally uses to restore
	    the previous role setting after an error. This allowed
	    ordinary users to acquire superuser status, for
	    example.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2006-0553</cvename>
      <url>http://www.postgresql.org/docs/8.1/static/release.html#RELEASE-8-1-3</url>
    </references>
    <dates>
      <discovery>2006-02-14</discovery>
      <entry>2006-02-18</entry>
      <modified>2006-08-13</modified>
    </dates>
  </vuln>

  <vuln vid="63fe4189-9f97-11da-ac32-0001020eed82">
    <topic>gnupg -- false positive signature verification</topic>
    <affects>
      <package>
	<name>gnupg</name>
	<range><lt>1.4.2.1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Werner Koch reports:</p>
	<blockquote cite="http://marc.theaimsgroup.com/?l=gnupg-devel&amp;m=113999098729114">
	  <p>The Gentoo project identified a security related bug in
	    GnuPG.  When using any current version of GnuPG for
	    unattended signature verification (e.g. by scripts and
	    mail programs), false positive signature verification of
	    detached signatures may occur.</p>
	  <p>This problem affects the tool *gpgv*, as well as using
	    "gpg --verify" to imitate gpgv, if only the exit code of
	    the process is used to decide whether a detached signature
	    is valid.  This is a plausible mode of operation for
	    gpgv.</p>
	  <p>If, as suggested, the --status-fd generated output is
	    used to decide whether a signature is valid, no problem
	    exists.  In particular applications making use of the
	    GPGME library[2] are not affected.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2006-0455</cvename>
      <mlist msgid="87u0b1xdru.fsf@wheatstone.g10code.de">http://marc.theaimsgroup.com/?l=gnupg-devel&amp;m=113999098729114</mlist>
    </references>
    <dates>
      <discovery>2006-02-15</discovery>
      <entry>2006-02-17</entry>
    </dates>
  </vuln>

  <vuln vid="e34d0c2e-9efb-11da-b410-000e0c2e438a">
    <topic>rssh -- privilege escalation vulnerability</topic>
    <affects>
      <package>
	<name>rssh</name>
	<range><lt>2.3.0</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Pizzashack reports:</p>
	<blockquote cite="http://www.pizzashack.org/rssh/security.shtml">
	  <p>Max Vozeler has reported a problem whereby rssh can
	    allow users who have shell access to systems where rssh
	    is installed (and rssh_chroot_helper is installed SUID)
	    to gain root access to the system, due to the ability to
	    chroot to arbitrary locations. There are a lot of
	    potentially mitigating factors, but to be safe you should
	    upgrade immediately.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <bid>16050</bid>
      <cvename>CVE-2005-3345</cvename>
      <url>http://www.pizzashack.org/rssh/security.shtml</url>
    </references>
    <dates>
      <discovery>2005-12-18</discovery>
      <entry>2006-02-16</entry>
    </dates>
  </vuln>

  <vuln vid="d38e1810-9ef7-11da-b410-000e0c2e438a">
    <topic>tor -- malicious tor server can locate a hidden service</topic>
    <affects>
      <package>
	<name>tor</name>
	<range><lt>0.1.0.12</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Roger Dingledine reports:</p>
	<blockquote cite="http://archives.seul.org/or/announce/Jan-2006/msg00001.html">
	  <p>If you offer a Tor hidden service, an adversary who can
	    run a fast Tor server and who knows some basic statistics
	    can find the location of your hidden service in a matter of
	    minutes to hours.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2006-0414</cvename>
      <url>http://archives.seul.org/or/announce/Jan-2006/msg00001.html</url>
    </references>
    <dates>
      <discovery>2006-01-12</discovery>
      <entry>2006-02-16</entry>
    </dates>
  </vuln>

  <vuln vid="1b725079-9ef6-11da-b410-000e0c2e438a">
    <topic>sudo -- arbitrary command execution</topic>
    <affects>
      <package>
	<name>sudo</name>
	<range><lt>1.6.8.10</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Tavis Ormandy reports:</p>
	<blockquote cite="http://www.courtesan.com/sudo/alerts/bash_env.html">
	  <p>The bash shell uses the value of the PS4 environment
	    variable (after expansion) as a prefix for commands run
	    in execution trace mode. Execution trace mode (xtrace) is
	    normally set via bash's -x command line option or
	    interactively by running "set -o xtrace". However, it may
	    also be enabled by placing the string "xtrace" in the
	    SHELLOPTS environment variable before bash is started.</p>
	  <p>A malicious user with sudo access to a shell script that
	    uses bash can use this feature to run arbitrary commands
	    for each line of the script.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <bid>15191</bid>
      <cvename>CVE-2005-2959</cvename>
      <url>http://www.courtesan.com/sudo/alerts/bash_env.html</url>
    </references>
    <dates>
      <discovery>2005-10-25</discovery>
      <entry>2006-02-16</entry>
    </dates>
  </vuln>

  <vuln vid="a78299e7-9ef3-11da-b410-000e0c2e438a">
    <topic>libtomcrypt -- weak signature scheme with ECC keys</topic>
    <affects>
      <package>
	<name>libtomcrypt</name>
	<range><le>1.02</le></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Secure Science Corporation reports that libtomcrypt is
	  vulnerable to a weak signature scheme.  This allows an
	  attacker to create a valid random signature and use that to
	  sign arbitrary messages without requiring the private key.</p>
      </body>
    </description>
    <references>
      <mlist msgid="4276CC31.9000307@securescience.net">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=111540819703204</mlist>
    </references>
    <dates>
      <discovery>2005-05-01</discovery>
      <entry>2006-02-16</entry>
    </dates>
  </vuln>

  <vuln vid="592815da-9eed-11da-b410-000e0c2e438a">
    <topic>mantis -- "view_filters_page.php" cross site scripting vulnerability</topic>
    <affects>
      <package>
	<name>mantis</name>
	<range><lt>1.0.0a4</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>r0t reports:</p>
	<blockquote cite="http://pridels.blogspot.com/2005/12/mantis-bugtracking-system-xss-vuln.html">
	  <p>Mantis contains a flaw that allows a remote cross site
	    scripting attack.  This flaw exists because input passed to
	    "target_field" parameter in "view_filters_page.php" is not
	    properly sanitised before being returned to the user.  This
	    could allow a user to create a specially crafted URL that
	    would execute arbitrary code in a user's browser within the
	    trust relationship between the browser and the server,
	    leading to a loss of integrity.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CAN-2005-4238</cvename>
      <url>http://pridels.blogspot.com/2005/12/mantis-bugtracking-system-xss-vuln.html</url>
    </references>
    <dates>
      <discovery>2005-12-13</discovery>
      <entry>2006-02-16</entry>
    </dates>
  </vuln>

  <vuln vid="28c9243a-72ed-11da-8c1d-000e0c2e438a">
    <topic>phpbb -- multiple vulnerabilities</topic>
    <affects>
      <package>
	<name>phpbb</name>
	<name>zh-phpbb-tw</name>
	<range><lt>2.0.18</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Multiple vulnerabilities have been reported within phpbb.
	  phpbb is proven vulnerable to:</p>
	<ul>
	  <li>script insertion,</li>
	  <li>bypassing of protetion mechanisms,</li>
	  <li>multiple cross site scripting vulnerabilities,</li>
	  <li>SQL injection,</li>
	  <li>arbitrary code execution</li>
	</ul>
      </body>
    </description>
    <references>
      <bid>15170</bid>
      <bid>15243</bid>
      <cvename>CVE-2005-3310</cvename>
      <cvename>CVE-2005-3415</cvename>
      <cvename>CVE-2005-3416</cvename>
      <cvename>CVE-2005-3417</cvename>
      <cvename>CVE-2005-3418</cvename>
      <cvename>CVE-2005-3419</cvename>
      <cvename>CVE-2005-3420</cvename>
      <cvename>CVE-2005-3536</cvename>
      <cvename>CVE-2005-3537</cvename>
      <mlist msgid="20051022132217.10390.qmail@securityfocus.com">http://marc.theaimsgroup.com/?l=bugtraq&amp;m=113017003617987</mlist>
      <url>http://www.hardened-php.net/advisory_172005.75.html</url>
    </references>
    <dates>
      <discovery>2005-10-24</discovery>
      <entry>2006-02-16</entry>
    </dates>
  </vuln>

  <vuln vid="486aff57-9ecd-11da-b410-000e0c2e438a">
    <topic>postgresql -- character conversion and tsearch2 vulnerabilities</topic>
    <affects>
      <package>
	<name>postgresql</name>
	<range><ge>7.2.0</ge><lt>7.2.8</lt></range>
	<range><ge>7.3.0</ge><lt>7.3.10</lt></range>
	<range><ge>7.4.0</ge><lt>7.4.8</lt></range>
	<range><ge>8.0.0</ge><lt>8.0.3</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The postgresql development team reports:</p>
	  <blockquote cite="http://www.postgresql.org/about/news.315">
	    <p>The more severe of the two errors is that the functions
	      that support client-to-server character set conversion
	      can be called from SQL commands by unprivileged users,
	      but these functions are not designed to be safe against
	      malicious choices of argument values.  This problem exists
	      in PostgreSQL 7.3.* through 8.0.*.  The recommended fix is
	      to disable public EXECUTE access for these functions.  This
	      does not affect normal usage of the functions for character
	      set conversion, but it will prevent misuse.</p>
	    <p>The other error is that the contrib/tsearch2 module
	      misdeclares several functions as returning type "internal"
	      when they do not have any "internal" argument.  This breaks
	      the type safety of "internal" by allowing users to
	      construct SQL commands that invoke other functions accepting
	      "internal" arguments.  The consequences of this have not been
	      investigated in detail, but it is certainly at least possible
	      to crash the backend.</p>
	  </blockquote>
      </body>
    </description>
    <references>
      <cvename>CAN-2005-1409</cvename>
      <cvename>CAN-2005-1410</cvename>
      <url>http://www.postgresql.org/about/news.315</url>
    </references>
    <dates>
      <discovery>2005-05-02</discovery>
      <entry>2006-02-16</entry>
    </dates>
  </vuln>

  <vuln vid="f6447303-9ec9-11da-b410-000e0c2e438a">
    <topic>heartbeat -- insecure temporary file creation vulnerability</topic>
    <affects>
      <package>
	<name>heartbeat</name>
	<range><lt>1.2.4</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Eric Romang reports a temporary file creation vulnerability
	  within heartbeat.  The vulnerability is caused by hardcoded
	  temporary file usage.  This can cause an attacker to create
	  an arbitrary symlink causing the application to overwrite the
	  symlinked file with the permissions of the user executing the
	  application.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2005-2231</cvename>
      <url>http://www.zataz.net/adviso/heartbeat-06272005.txt</url>
    </references>
    <dates>
      <discovery>2005-07-12</discovery>
      <entry>2006-02-16</entry>
      <modified>2006-04-16</modified>
    </dates>
  </vuln>

  <vuln vid="432bf98d-9e25-11da-b410-000e0c2e438a">
    <topic>kpdf -- heap based buffer overflow</topic>
    <affects>
      <package>
	<name>kdegraphics</name>
	<range><lt>3.5.1_1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The KDE team reports:</p>
	<blockquote cite="http://www.kde.org/info/security/advisory-20060202-1.txt">
	  <p>kpdf, the KDE pdf viewer, shares code with xpdf. xpdf
	    contains a heap based buffer overflow in the splash
	    rasterizer engine that can crash kpdf or even execute
	    arbitrary code.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2006-0301</cvename>
      <url>http://www.kde.org/info/security/advisory-20060202-1.txt</url>
    </references>
    <dates>
      <discovery>2006-02-02</discovery>
      <entry>2006-02-15</entry>
    </dates>
  </vuln>

  <vuln vid="bb33981a-7ac6-11da-bf72-00123f589060">
    <topic>perl, webmin, usermin -- perl format string integer wrap vulnerability</topic>
    <affects>
      <package>
	<name>perl</name>
	<range><ge>5.6.0</ge><lt>5.6.2</lt></range>
	<range><ge>5.8.0</ge><lt>5.8.7_1</lt></range>
      </package>
      <package>
	<name>webmin</name>
	<range><lt>1.250</lt></range>
      </package>
      <package>
	<name>usermin</name>
	<range><lt>1.180</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Perl Development page reports:</p>
	<blockquote cite="http://dev.perl.org/perl5/news/2005/perl_patches_fix_sprintf_buffer.html">
	  <p>Dyad Security recently released a security advisory explaining how
	    in certain cases, a carefully crafted format string passed to
	    sprintf can cause a buffer overflow. This buffer overflow can then
	    be used by an attacker to execute code on the machine.  This was
	    discovered in the context of a design problem with the Webmin
	    administration package that allowed a malicious user to pass
	    unchecked data into sprintf.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <bid>15629</bid>
      <cvename>CVE-2005-3912</cvename>
      <cvename>CVE-2005-3962</cvename>
      <url>http://dev.perl.org/perl5/news/2005/perl_patches_fix_sprintf_buffer.html</url>
      <url>http://www.dyadsecurity.com/perl-0002.html</url>
      <url>http://www.dyadsecurity.com/webmin-0001.html</url>
      <url>http://www.webmin.com/security.html</url>
    </references>
    <dates>
      <discovery>2005-09-23</discovery>
      <entry>2006-02-15</entry>
    </dates>
  </vuln>

  <vuln vid="12f9d9e9-9e1e-11da-b410-000e0c2e438a">
    <topic>phpicalendar -- cross site scripting vulnerability</topic>
    <affects>
      <package>
	<name>phpicalendar</name>
	<range><lt>2.1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Francesco Ongaro reports that phpicalendar is vulnerable for
	  a cross site scripting attack.  The vulnerability is caused by
	  improper validation of the index.php file allowing attackers
	  to include an arbitrary file with the .php extension</p>
      </body>
    </description>
    <references>
      <bid>15193</bid>
      <cvename>CVE-2005-3366</cvename>
      <url>http://www.ush.it/2005/10/25/php-icalendar-css/</url>
    </references>
    <dates>
      <discovery>2005-10-25</discovery>
      <entry>2006-02-15</entry>
    </dates>
  </vuln>

  <vuln vid="f1f163ce-9e09-11da-b410-000e0c2e438a">
    <topic>phpicalendar -- file disclosure vulnerability</topic>
    <affects>
      <package>
	<name>phpicalendar</name>
	<range><lt>2.21</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The phpicalendar team reports that there is an
	  unspecified vulnerability within phpicalendar.  This
	  seems to be a file disclosure vulnerability caused by
	  improper checking of the template parsing function.
	  This would allow an attacker to disclose any file
	  readable by the user under which the webserver runs.</p>
      </body>
    </description>
    <references>
      <url>http://phpicalendar.net/forums/viewtopic.php?t=396</url>
    </references>
    <dates>
      <discovery>2006-02-08</discovery>
      <entry>2006-02-15</entry>
    </dates>
  </vuln>

  <vuln vid="dfb71c00-9d44-11da-8c1d-000e0c2e438a">
    <topic>FreeBSD -- Infinite loop in SACK handling</topic>
    <affects>
      <package>
	<name>FreeBSD</name>
	<range><ge>5.4</ge><lt>5.4_11</lt></range>
	<range><ge>5.3</ge><lt>5.3_26</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Problem description:</p>
	<p>When insufficient memory is available to handle an
	  incoming selective acknowledgement, the TCP/IP stack may
	  enter an infinite loop.</p>
	<p>Impact:</p>
	<p>By opening a TCP connection and sending a carefully crafted
	  series of packets, an attacker may be able to cause a denial
	  of service.</p>
	<p>Workaround:</p>
	<p>On FreeBSD 5.4, the net.inet.tcp.sack.enable sysctl can be used to
	  disable the use of SACK:</p>
	<p># sysctl net.inet.tcp.sack.enable=0</p>
	<p>No workaround is available for FreeBSD 5.3.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2006-0433</cvename>
      <freebsdsa>SA-06:08.sack</freebsdsa>
    </references>
    <dates>
      <discovery>2006-02-01</discovery>
      <entry>2006-02-14</entry>
      <modified>2016-08-09</modified>
    </dates>
  </vuln>

  <vuln vid="52ba7713-9d42-11da-8c1d-000e0c2e438a">
    <topic>pf -- IP fragment handling panic</topic>
    <affects>
      <package>
	<name>FreeBSD</name>
	<range><ge>6.0</ge><lt>6.0_4</lt></range>
	<range><ge>5.4</ge><lt>5.4_10</lt></range>
	<range><ge>5.3</ge><lt>5.3_25</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Problem description:</p>
	<p>A logic bug in pf's IP fragment cache may result in a packet
	  fragment being inserted twice, violating a kernel
	  invariant.</p>
	<p>Impact:</p>
	<p>By sending carefully crafted sequence of IP packet fragments,
	  a remote attacker can cause a system running pf with a ruleset
	  containing a 'scrub fragment crop' or 'scrub fragment
	  drop-ovl' rule to crash.</p>
	<p>Workaround:</p>
	<p>Do not use 'scrub fragment crop' or 'scrub fragment drop-ovl'
	  rules on systems running pf.	In most cases, such rules can be
	  replaced by 'scrub fragment reassemble' rules; see the
	  pf.conf(5) manual page for more details.</p>

	<p>Systems which do not use pf, or use pf but do not use the
	  aforementioned rules, are not affected by this issue.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2006-0381</cvename>
      <freebsdsa>SA-06:07.pf</freebsdsa>
    </references>
    <dates>
      <discovery>2006-01-25</discovery>
      <entry>2006-02-14</entry>
      <modified>2016-08-09</modified>
    </dates>
  </vuln>

  <vuln vid="7a4f2aca-9d40-11da-8c1d-000e0c2e438a">
    <topic>FreeBSD -- Local kernel memory disclosure</topic>
    <affects>
      <package>
	<name>FreeBSD</name>
	<range><ge>6.0</ge><lt>6.0_4</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Problem description:</p>
	<p>A buffer allocated from the kernel stack may not be completely
	  initialized before being copied to userland. [CVE-2006-0379]</p>
	<p>A logic error in computing a buffer length may allow too much
	  data to be copied into userland. [CVE-2006-0380]</p>
	<p>Impact:</p>
	<p>Portions of kernel memory may be disclosed to local users.
	  Such memory might contain sensitive information, such as
	  portions of the file cache or terminal buffers.  This
	  information might be directly useful, or it might be
	  leveraged to obtain elevated privileges in some way.	For
	  example, a terminal buffer might include a user-entered
	  password.</p>
	<p>Workaround:</p>
	<p>No workaround is available.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2006-0379</cvename>
      <cvename>CVE-2006-0380</cvename>
      <freebsdsa>SA-06:06.kmem</freebsdsa>
    </references>
    <dates>
      <discovery>2006-01-25</discovery>
      <entry>2006-02-14</entry>
      <modified>2016-08-09</modified>
    </dates>
  </vuln>

  <vuln vid="dade3316-9d31-11da-8c1d-000e0c2e438a">
    <topic>IEEE 802.11 -- buffer overflow</topic>
    <affects>
      <package>
	<name>FreeBSD</name>
	<range><ge>6.0</ge><lt>6.0_3</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Problem description:</p>
	<p>An integer overflow in the handling of corrupt IEEE 802.11
	  beacon or probe response frames when scanning for existing
	  wireless networks can result in the frame overflowing a
	  buffer.</p>
	<p>Impact:</p>
	<p>An attacker able broadcast a carefully crafted beacon or
	  probe response frame may be able to execute arbitrary code
	  within the context of the FreeBSD kernel on any system
	  scanning for wireless networks.</p>
	<p>Workaround:</p>
	<p>No workaround is available, but systems without IEEE 802.11
	  hardware or drivers loaded are not vulnerable.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2006-0226</cvename>
      <freebsdsa>SA-06:05.80211</freebsdsa>
    </references>
    <dates>
      <discovery>2006-01-18</discovery>
      <entry>2006-02-14</entry>
      <modified>2016-08-09</modified>
    </dates>
  </vuln>

  <vuln vid="d7c1d00d-9d2e-11da-8c1d-000e0c2e438a">
    <topic>ipfw -- IP fragment denial of service</topic>
    <affects>
      <package>
	<name>FreeBSD</name>
	<range><ge>6.0</ge><lt>6.0_2</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Problem description:</p>
	<p>The firewall maintains a pointer to layer 4 header
	  information in the event that it needs to send a TCP reset
	  or ICMP error message to discard packets.  Due to incorrect
	  handling of IP fragments, this pointer fails to get
	  initialized.</p>
	<p>Impact:</p>
	<p>An attacker can cause the firewall to crash by sending ICMP
	  IP fragments to or through firewalls which match any reset,
	  reject or unreach actions.</p>
	<p>Workaround:</p>
	<p>Change any reset, reject or unreach actions to deny. It
	  should be noted that this will result in packets being
	  silently discarded.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2006-0054</cvename>
      <freebsdsa>SA-06:04.ipfw</freebsdsa>
    </references>
    <dates>
      <discovery>2006-01-11</discovery>
      <entry>2006-02-14</entry>
      <modified>2016-08-09</modified>
    </dates>
  </vuln>

  <vuln vid="1613db79-8e52-11da-8426-000fea0a9611">
    <topic>kpopup -- local root exploit and local denial of service</topic>
    <affects>
      <package>
	<name>kpopup</name>
	<range><ge>0.9.1</ge><le>0.9.5</le></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Mitre CVE reports:</p>
	<blockquote cite="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-1170">
	  <p>Format string vulnerability in main.cpp in kpopup
	    0.9.1-0.9.5pre2 allows local users to cause a denial of
	    service (segmentation fault) and possibly execute
	    arbitrary code via format string specifiers in command
	    line arguments.</p>
	</blockquote>
	<blockquote cite="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-1167">
	  <p>misc.cpp in KPopup 0.9.1 trusts the PATH variable when
	    executing killall, which allows local users to elevate
	    their privileges by modifying the PATH variable to
	    reference a malicious killall program.</p>
	</blockquote>
	<p>SecurityFocus credits "b0f" b0fnet@yahoo.com</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2003-1170</cvename>
      <bid>8918</bid>
      <cvename>CVE-2003-1167</cvename>
      <bid>8915</bid>
      <url>http://www.securityfocus.com/archive/1/342736</url>
      <url>http://www.henschelsoft.de/kpopup_en.html</url>
    </references>
    <dates>
      <discovery>2003-10-28</discovery>
      <entry>2006-02-07</entry>
    </dates>
  </vuln>

  <vuln vid="6b0215ae-8f26-11da-8c1d-000e0c2e438a">
    <topic>cpio -- multiple vulnerabilities</topic>
    <affects>
      <package>
	<name>FreeBSD</name>
	<range><ge>6.0</ge><lt>6.0_2</lt></range>
	<range><ge>5.4</ge><lt>5.4_9</lt></range>
	<range><ge>5.3</ge><lt>5.3_24</lt></range>
	<range><ge>4.11</ge><lt>4.11_14</lt></range>
	<range><ge>4.10</ge><lt>4.10_20</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Problem description:</p>
	<p>A number of issues has been discovered in cpio:</p>
	<p>When creating a new file, cpio closes the file before setting
	  its permissions. (CVE-2005-1111)</p>
	<p>When extracting files cpio does not properly sanitize file
	  names to filter out ".." components, even if the
	  --no-absolute-filenames option is used. (CVE-2005-1229)</p>
	<p>When adding large files (larger than 4 GB) to a cpio archive
	  on 64-bit platforms an internal buffer might overflow.
	  (CVE-2005-4268)</p>
	<p>Impact</p>
	<p>The first problem can allow a local attacker to change the
	  permissions of files owned by the user executing cpio providing
	  that they have write access to the directory in which the file
	  is being extracted. (CVE-2005-1111)</p>
	<p>The lack of proper file name sanitation can allow an attacker
	  to overwrite arbitrary local files when extracting files from
	  a cpio archive. (CVE-2005-1229)</p>
	<p>The buffer-overflow on 64-bit platforms could lead cpio to a
	  Denial-of-Service situation (crash) or possibly execute
	  arbitrary code with the permissions of the user running
	  cpio. (CVE-2005-4268)</p>
	<p>Workaround</p>
	<p>Use a different utility to create and extract cpio archives,
	  for example pax(1) or (on FreeBSD 5.3 or later) tar(1).  If
	  this is not possible, do not extract untrusted archives and
	  when running on 64-bit platforms do not add untrusted files
	  to cpio archives.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-1111</cvename>
      <cvename>CVE-2005-1229</cvename>
      <cvename>CVE-2005-4268</cvename>
      <freebsdsa>SA-06:03.cpio</freebsdsa>
    </references>
    <dates>
      <discovery>2006-01-11</discovery>
      <entry>2006-01-27</entry>
    </dates>
  </vuln>

  <vuln vid="726dd9bd-8f25-11da-8c1d-000e0c2e438a">
    <topic>ee -- temporary file privilege escalation</topic>
    <affects>
      <package>
	<name>FreeBSD</name>
	<range><ge>6.0</ge><lt>6.0_2</lt></range>
	<range><ge>5.4</ge><lt>5.4_9</lt></range>
	<range><ge>5.3</ge><lt>5.3_24</lt></range>
	<range><ge>4.11</ge><lt>4.11_14</lt></range>
	<range><ge>4.10</ge><lt>4.10_20</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Problem description</p>
	<p>The ispell_op function used by ee(1) while executing spell
	  check operations employs an insecure method of temporary file
	  generation.  This method produces predictable file names based
	  on the process ID and fails to confirm which path will be over
	  written with the user.<br/>
	  It should be noted that ispell does not have to be installed
	  in order for this to be exploited.  The option simply needs to
	  be selected.</p>
	<p>Impact</p>
	<p>These predictable temporary file names are problematic
	  because they allow an attacker to take advantage of a race
	  condition in order to execute a symlink attack, which could
	  allow them to overwrite files on the system in the context of
	  the user running the ee(1) editor.</p>
	<p>Workaround</p>
	<p>Instead of invoking ispell through ee(1), invoke it directly.</p>
      </body>
    </description>
    <references>
      <bid>16207</bid>
      <cvename>CVE-2006-0055</cvename>
      <freebsdsa>SA-06:02.ee</freebsdsa>
    </references>
    <dates>
      <discovery>2006-01-11</discovery>
      <entry>2006-01-27</entry>
    </dates>
  </vuln>

  <vuln vid="c01a25f5-8f20-11da-8c1d-000e0c2e438a">
    <topic>texindex -- temporary file privilege escalation</topic>
    <affects>
      <package>
	<name>FreeBSD</name>
	<range><ge>6.0</ge><lt>6.0_2</lt></range>
	<range><ge>5.4</ge><lt>5.4_9</lt></range>
	<range><ge>5.3</ge><lt>5.3_24</lt></range>
	<range><ge>4.11</ge><lt>4.11_14</lt></range>
	<range><ge>4.10</ge><lt>4.10_20</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Problem description</p>
	<p>The "sort_offline" function used by texindex(1) employs the
	  "maketempname" function, which produces predictable file names
	  and fails to validate that the paths do not exist.</p>
	<p>Impact</p>
	<p>These predictable temporary file names are problematic because
	  they allow an attacker to take advantage of a race condition in
	  order to execute a symlink attack, which could enable them to
	  overwrite files on the system in the context of the user running
	  the texindex(1) utility.</p>
	<p>Workaround</p>
	<p>No workaround is available, but the problematic code is only
	  executed if the input file being processed is 500kB or more in
	  length; as a result, users working with documents of less than
	  several hundred pages are very unlikely to be affected.</p>
      </body>
    </description>
    <references>
      <bid>14854</bid>
      <cvename>CAN-2005-3011</cvename>
      <freebsdsa>SA-06:01.texindex</freebsdsa>
    </references>
    <dates>
      <discovery>2006-01-11</discovery>
      <entry>2006-01-27</entry>
    </dates>
  </vuln>

  <vuln vid="c5c17ead-8f23-11da-8c1d-000e0c2e438a">
    <topic>cvsbug -- race condition</topic>
    <affects>
      <package>
	<name>FreeBSD</name>
	<range><ge>5.4</ge><lt>5.4_7</lt></range>
	<range><ge>5.3</ge><lt>5.3_22</lt></range>
	<range><ge>4.11</ge><lt>4.11_12</lt></range>
	<range><ge>4.10</ge><lt>4.10_18</lt></range>
      </package>
      <package>
	<name>cvs+ipv6</name>
	<range><lt>1.11.17_1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Problem description</p>
	<p>A temporary file is created, used, deleted, and then
	  re-created with the same name.  This creates a window during
	  which an attacker could replace the file with a link to
	  another file.  While cvsbug(1) is based on the send-pr(1)
	  utility, this problem does not exist in the version of
	  send-pr(1) distributed with FreeBSD.<br/>
	  In FreeBSD 4.10 and 5.3, some additional problems exist
	  concerning temporary file usage in both cvsbug(1) and
	  send-pr(1).</p>
	<p>Impact</p>
	<p>A local attacker could cause data to be written to any file
	  to which the user running cvsbug(1) (or send-pr(1) in FreeBSD
	  4.10 and 5.3) has write access.  This may cause damage in
	  itself (e.g., by destroying important system files or
	  documents) or may be used to obtain elevated privileges.</p>
	<p>Workaround</p>
	<p>Do not use the cvsbug(1) utility on any system with untrusted
	  users.<br/>
	  Do not use the send-pr(1) utility on a FreeBSD 4.10 or 5.3
	  system with untrusted users.</p>
      </body>
    </description>
    <references>
      <cvename>CAN-2005-2693</cvename>
      <freebsdsa>SA-05:20.cvsbug</freebsdsa>
    </references>
    <dates>
      <discovery>2005-09-07</discovery>
      <entry>2006-01-27</entry>
      <modified>2006-11-08</modified>
    </dates>
  </vuln>

  <vuln vid="57a0242d-8c4e-11da-8ddf-000ae42e9b93">
    <topic>sge -- local root exploit in bundled rsh executable</topic>
    <affects>
      <package>
	<name>sge</name>
	<name>sgeee</name>
	<range><lt>5.3.6.20040330_1</lt></range>
	<range><gt>6.*</gt><lt>6.0.7.1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Sun Microsystems reports:</p>
	<blockquote cite="http://gridengine.sunsource.net/project/gridengine/news/SGE60u7_1-announce.html">
	  <p>The SGE 6.0u7_1 release fixes a security bug which can
	  allow malicious users to gain root access.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <url>http://gridengine.sunsource.net/project/gridengine/news/SGE60u7_1-announce.html</url>
    </references>
    <dates>
      <discovery>2005-12-23</discovery>
      <entry>2006-01-23</entry>
    </dates>
  </vuln>

  <vuln vid="f11d3b22-88c6-11da-a7b2-0060084a00e5">
    <topic>fetchmail -- crash when bouncing a message</topic>
    <affects>
      <package>
	<name>fetchmail</name>
	<range><ge>6.3.0</ge><lt>6.3.2</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Matthias Andree reports:</p>
	<blockquote cite="http://www.fetchmail.info/fetchmail-SA-2006-01.txt">
	  <p>Fetchmail contains a bug that causes itself to crash when
	    bouncing a message to the originator or to the local
	    postmaster. The crash happens after the bounce message has
	    been sent, when fetchmail tries to free the dynamic array
	    of failed addresses, and calls the free() function with an
	    invalid pointer.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2006-0321</cvename>
      <url>http://www.fetchmail.info/fetchmail-SA-2006-01.txt</url>
      <url>http://bugs.debian.org/348747</url>
    </references>
    <dates>
      <discovery>2006-01-22</discovery>
      <entry>2006-01-23</entry>
    </dates>
  </vuln>

  <vuln vid="612a34ec-81dc-11da-a043-0002a5c3d308">
    <topic>clamav -- possible heap overflow in the UPX code</topic>
    <affects>
      <package>
	<name>clamav</name>
	<range><lt>0.88</lt></range>
      </package>
      <package>
	<name>clamav-devel</name>
	<range><lt>20060110</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Zero Day Initiative reports:</p>
	<blockquote cite="http://www.zerodayinitiative.com/advisories/ZDI-06-001.html">
	  <p>This vulnerability allows remote attackers to execute
	    arbitrary code on vulnerable Clam AntiVirus
	    installations. Authentication is not required to exploit
	    this vulnerability.</p>
	  <p>This specific flaw exists within libclamav/upx.c during
	    the unpacking of executable files compressed with UPX. Due
	    to an invalid size calculation during a data copy from the
	    user-controlled file to heap allocated memory, an
	    exploitable memory corruption condition is created.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <bid>16191</bid>
      <cvename>CVE-2006-0162</cvename>
      <mlist>http://lurker.clamav.net/message/20060109.213247.a16ae8db.en.html</mlist>
      <url>http://www.zerodayinitiative.com/advisories/ZDI-06-001.html</url>
      <url>http://secunia.com/advisories/18379/</url>
    </references>
    <dates>
      <discovery>2006-01-09</discovery>
      <entry>2006-01-10</entry>
      <modified>2006-01-15</modified>
    </dates>
  </vuln>

  <vuln vid="6d9a28f8-8152-11da-817c-0001020eed82">
    <topic>milter-bogom -- headerless message crash</topic>
    <affects>
      <package>
	<name>milter-bogom</name>
	<range><lt>1.8.2</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Juan J. Marítnez reports:</p>
	<blockquote cite="http://www.usebox.net/jjm/bogom/errata/bogom-errata-2006-1.txt">
	  <p>The milter crashes while processing a headerless
	    message</p>
	  <p>Impact: bogom crashes and sendmail moves it to error
	    state</p>
	</blockquote>
      </body>
    </description>
    <references>
      <url>http://www.usebox.net/jjm/bogom/errata/bogom-errata-2006-1.txt</url>
      <mlist>http://alf.dyndns.ws/pipermail/milter/2006-January/000076.html</mlist>
    </references>
    <dates>
      <discovery>2006-01-05</discovery>
      <entry>2006-01-09</entry>
    </dates>
  </vuln>

  <vuln vid="b747b2a9-7be0-11da-8ec4-0002b3b60e4c">
    <topic>bogofilter -- heap corruption through excessively long words</topic>
    <affects>
      <package>
	<name>bogofilter</name>
	<range><ge>0.96.2</ge><lt>0.96.3</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Matthias Andree reports:</p>
	<blockquote cite="http://bogofilter.sourceforge.net/security/bogofilter-SA-2005-02">
	  <p>Bogofilter's/bogolexer's input handling in version 0.96.2 was not
	    keeping track of its output buffers properly and could overrun a
	    heap buffer if the input contained words whose length exceeded
	    16,384 bytes, the size of flex's input buffer. A "word" here refers
	    to a contiguous run of input octets that was not '_' and did not
	    match at least one of ispunct(), iscntrl() or isspace().</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-4592</cvename>
      <url>http://bogofilter.sourceforge.net/security/bogofilter-SA-2005-02</url>
    </references>
    <dates>
      <discovery>2005-10-23</discovery>
      <entry>2006-01-07</entry>
    </dates>
  </vuln>

  <vuln vid="92140bc9-7bde-11da-8ec4-0002b3b60e4c">
    <topic>bogofilter -- heap corruption through malformed input</topic>
    <affects>
      <package>
	<name>bogofilter</name>
	<range><ge>0.93.5</ge><lt>0.96.3</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Matthias Andree reports:</p>
	<blockquote cite="http://bogofilter.sourceforge.net/security/bogofilter-SA-2005-01">
	  <p>When using Unicode databases (default in more recent bogofilter
	    installations), upon encountering invalid input sequences,
	    bogofilter or bogolexer could overrun a malloc()'d buffer,
	    corrupting the heap, while converting character sets.  Bogofilter
	    would usually be processing untrusted data received from the
	    network at that time.</p>

	  <p>This problem was aggravated by an unrelated bug that made
	    bogofilter process binary attachments as though they were text, and
	    attempt charset conversion on them.  Given the MIME default
	    character set, US-ASCII, all input octets in the range 0x80...0xff
	    were considered invalid input sequences and could trigger the heap
	    corruption.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-4591</cvename>
      <url>http://bogofilter.sourceforge.net/security/bogofilter-SA-2005-01</url>
    </references>
    <dates>
      <discovery>2005-10-22</discovery>
      <entry>2006-01-07</entry>
    </dates>
  </vuln>

  <vuln vid="c2fdb3bc-7d72-11da-b96e-000fb586ba73">
    <topic>rxvt-unicode -- restore permissions on tty devices</topic>
    <affects>
      <package>
	<name>rxvt-unicode</name>
	<range><lt>6.3</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A rxvt-unicode changelog reports:</p>
	<blockquote cite="http://dist.schmorp.de/rxvt-unicode/Changes">
	  <p>SECURITY FIX: on systems using openpty, permissions were
	    not correctly updated on the tty device and were left as
	    world-readable and world-writable (likely in original rxvt,
	    too), and were not restored properly. Affected are only
	    systems where non-unix ptys were used (such as most BSDs).
	    Found, patched and debugged by Ryan Beasley.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <url>http://dist.schmorp.de/rxvt-unicode/Changes</url>
    </references>
    <dates>
      <discovery>2005-12-31</discovery>
      <entry>2006-01-04</entry>
    </dates>
  </vuln>

  <vuln vid="9fff8dc8-7aa7-11da-bf72-00123f589060">
    <topic>apache -- mod_imap cross-site scripting flaw</topic>
    <affects>
      <package>
	<name>apache</name>
	<range><ge>1.3</ge><lt>1.3.34_3</lt></range>
	<range><ge>2.0.35</ge><lt>2.0.55_2</lt></range>
	<range><ge>2.1</ge><lt>2.1.9_3</lt></range>
	<range><ge>2.2</ge><lt>2.2.0_3</lt></range>
      </package>
      <package>
	<name>apache+mod_perl</name>
	<range><lt>1.3.34_1</lt></range>
      </package>
      <package>
	<name>apache_fp</name>
	<range><ge>0</ge></range>
      </package>
      <package>
	<name>apache+ipv6</name>
	<range><lt>1.3.37</lt></range>
      </package>
      <package>
	<name>ru-apache</name>
	<range><lt>1.3.34+30.22_1</lt></range>
      </package>
      <package>
	<name>ru-apache+mod_ssl</name>
	<range><lt>1.3.34+30.22+2.8.25_1</lt></range>
      </package>
      <package>
	<name>apache+ssl</name>
	<range><ge>1.3.0</ge><lt>1.3.33.1.55_2</lt></range>
      </package>
      <package>
	<name>apache+mod_ssl</name>
	<name>apache+mod_ssl+ipv6</name>
	<name>apache+mod_ssl+mod_accel</name>
	<name>apache+mod_ssl+mod_accel+ipv6</name>
	<name>apache+mod_ssl+mod_accel+mod_deflate</name>
	<name>apache+mod_ssl+mod_accel+mod_deflate+ipv6</name>
	<name>apache+mod_ssl+mod_deflate</name>
	<name>apache+mod_ssl+mod_deflate+ipv6</name>
	<name>apache+mod_ssl+mod_snmp</name>
	<name>apache+mod_ssl+mod_snmp+mod_accel</name>
	<name>apache+mod_ssl+mod_snmp+mod_accel+ipv6</name>
	<name>apache+mod_ssl+mod_snmp+mod_deflate</name>
	<name>apache+mod_ssl+mod_snmp+mod_deflate+ipv6</name>
	<name>apache+mod_ssl+mod_snmp+mod_accel+mod_deflate+ipv6</name>
	<range><lt>1.3.34+2.8.25_1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Apache HTTP Server Project reports:</p>
	<blockquote cite="http://httpd.apache.org/security/vulnerabilities_13.html">
	  <p>A flaw in mod_imap when using the Referer directive with
	    image maps. In certain site configurations a remote
	    attacker could perform a cross-site scripting attack if a
	    victim can be forced to visit a malicious URL using
	    certain web browsers.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2005-3352</cvename>
      <bid>15834</bid>
      <url>http://www.apacheweek.com/features/security-13</url>
      <url>http://www.apacheweek.com/features/security-20</url>
    </references>
    <dates>
      <discovery>2005-11-01</discovery>
      <entry>2006-01-01</entry>
      <modified>2009-01-23</modified>
    </dates>
  </vuln>
