Advisory Files ≈ Packet Storm Packet Storm - Information Security Services, News, Files, Tools, Exploits, Advisories and Whitepapers http://packetstormsecurity.com/ en-us Thu, 3 Jan 2013 04:22:53 GMT Packet Storm 144400 http://packetstormsecurity.com/ http://www.google-analytics.com/__utm.gif?utmwv=1.3&utmn=2313531483&utmcs=ISO-8859-1&utmsr=31337x31337&utmsc=32-bit&utmul=en-us&utmje=0&utmfl=-&utmcn=1&utmdt=Advisory%20Files%u2248%20Packet%20Storm&utmhn=packetstormsecurity.com&utmr=-&utmp=%2Ffiles%2Ftags%2Fadvisory%2F&utmac=UA-18885198-1&utmcc=__utma%3D32867617.2313531483.1357186973.1357186973.1357186973.1%3B%2B__utmz%3D32867617.1357186973.1.1.utmccn%3D(direct)%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none) Asterisk Project Security Advisory - AST-2012-015 http://packetstormsecurity.com/files/119216/AST-2012-015.txt http://packetstormsecurity.com/files/119216/AST-2012-015.txt http://packetstormsecurity.com/files/119216/Asterisk-Project-Security-Advisory-AST-2012-015.html Thu, 03 Jan 2013 00:06:42 GMT Asterisk Project Security Advisory - Asterisk maintains an internal cache for devices. The device state cache holds the state of each device known to Asterisk, such that consumers of device state information can query for the last known state for a particular device, even if it is not part of an active call. The concept of a device in Asterisk can include things that do not have a physical representation. One way that this currently occurs is when anonymous calls are allowed in Asterisk. A device is automatically created and stored in the cache for each anonymous call that occurs; this is possible in the SIP and IAX2 channel drivers and through channel drivers that utilize the res_jabber/res_xmpp resource modules (Gtalk, Jingle, and Motif). Attackers exploiting this vulnerability can attack an Asterisk system configured to allow anonymous calls by varying the source of the anonymous call, continually adding devices to the device state cache and consuming a system's resources. Asterisk Project Security Advisory - AST-2012-014 http://packetstormsecurity.com/files/119215/AST-2012-014.txt http://packetstormsecurity.com/files/119215/AST-2012-014.txt http://packetstormsecurity.com/files/119215/Asterisk-Project-Security-Advisory-AST-2012-014.html Thu, 03 Jan 2013 00:05:10 GMT Asterisk Project Security Advisory - Asterisk has several places where messages received over various network transports may be copied in a single stack allocation. In the case of TCP, since multiple packets in a stream may be concatenated together, this can lead to large allocations that overflow the stack. In the case of SIP, it is possible to do this before a session is established. Keep in mind that SIP over UDP is not affected by this vulnerability. With HTTP and XMPP, a session must first be established before the vulnerability may be exploited. The XMPP vulnerability exists both in the res_jabber.so module in Asterisk 1.8, 10, and 11 as well as the res_xmpp.so module in Asterisk 11. Mandriva Linux Security Advisory 2013-001 http://packetstormsecurity.com/files/119213/MDVSA-2013-001.txt http://packetstormsecurity.com/files/119213/MDVSA-2013-001.txt http://packetstormsecurity.com/files/119213/Mandriva-Linux-Security-Advisory-2013-001.html Thu, 03 Jan 2013 00:04:07 GMT Mandriva Linux Security Advisory 2013-001 - Versions of GnuPG less than or equal to 1.4.12 are vulnerable to memory access violations and public keyring database corruption when importing public keys that have been manipulated. An OpenPGP key can be fuzzed in such a way that gpg segfaults when importing the key. The updated packages have been patched to correct this issue. Secunia Security Advisory 51691 http://packetstormsecurity.com/files/119185/sa51691.txt http://packetstormsecurity.com/files/119185/sa51691.txt http://packetstormsecurity.com/files/119185/Secunia-Security-Advisory-51691.html Wed, 02 Jan 2013 12:00:37 GMT Secunia Security Advisory - Sammy Forgit has discovered a vulnerability in the Xerte Online plugin for WordPress, which can be exploited by malicious people to compromise a vulnerable system. Secunia Security Advisory 51698 http://packetstormsecurity.com/files/119184/sa51698.txt http://packetstormsecurity.com/files/119184/sa51698.txt http://packetstormsecurity.com/files/119184/Secunia-Security-Advisory-51698.html Wed, 02 Jan 2013 12:00:35 GMT Secunia Security Advisory - Sammy Forgit has discovered a vulnerability in the ReFlex Gallery plugin for WordPress, which can be exploited by malicious people to compromise a vulnerable system. Secunia Security Advisory 51715 http://packetstormsecurity.com/files/119183/sa51715.txt http://packetstormsecurity.com/files/119183/sa51715.txt http://packetstormsecurity.com/files/119183/Secunia-Security-Advisory-51715.html Wed, 02 Jan 2013 12:00:32 GMT Secunia Security Advisory - A vulnerability has been reported in IBM SPSS Modeler, which can be exploited by malicious people to disclose potentially sensitive information and cause a DoS (Denial of Service). Secunia Security Advisory 51670 http://packetstormsecurity.com/files/119182/sa51670.txt http://packetstormsecurity.com/files/119182/sa51670.txt http://packetstormsecurity.com/files/119182/Secunia-Security-Advisory-51670.html Wed, 02 Jan 2013 12:00:28 GMT Secunia Security Advisory - Debian has issued an update for ghostscript. This fixes a vulnerability, which can be exploited by malicious people to potentially compromise a user's system. Secunia Security Advisory 51713 http://packetstormsecurity.com/files/119181/sa51713.txt http://packetstormsecurity.com/files/119181/sa51713.txt http://packetstormsecurity.com/files/119181/Secunia-Security-Advisory-51713.html Wed, 02 Jan 2013 12:00:24 GMT Secunia Security Advisory - Debian has issued an update for mediawiki-extensions. This fixes a vulnerability, which can be exploited by malicious users to conduct script insertion attacks. Secunia Security Advisory 51705 http://packetstormsecurity.com/files/119180/sa51705.txt http://packetstormsecurity.com/files/119180/sa51705.txt http://packetstormsecurity.com/files/119180/Secunia-Security-Advisory-51705.html Wed, 02 Jan 2013 12:00:22 GMT Secunia Security Advisory - A vulnerability with an unknown impact has been reported in the IP.Board. Secunia Security Advisory 51671 http://packetstormsecurity.com/files/119179/sa51671.txt http://packetstormsecurity.com/files/119179/sa51671.txt http://packetstormsecurity.com/files/119179/Secunia-Security-Advisory-51671.html Wed, 02 Jan 2013 12:00:18 GMT Secunia Security Advisory - Debian has issued an update for virtualbox-ose. This fixes a vulnerability, which can be exploited by malicious, local users to cause a Denial of Service (DoS). Secunia Security Advisory 51676 http://packetstormsecurity.com/files/119178/sa51676.txt http://packetstormsecurity.com/files/119178/sa51676.txt http://packetstormsecurity.com/files/119178/Secunia-Security-Advisory-51676.html Wed, 02 Jan 2013 12:00:15 GMT Secunia Security Advisory - Debian has issued an update for moin. This fixes two vulnerabilities, which can be exploited by malicious users to compromise a vulnerable system and by malicious people to manipulate certain data. Secunia Security Advisory 51662 http://packetstormsecurity.com/files/119177/sa51662.txt http://packetstormsecurity.com/files/119177/sa51662.txt http://packetstormsecurity.com/files/119177/Secunia-Security-Advisory-51662.html Wed, 02 Jan 2013 12:00:12 GMT Secunia Security Advisory - A vulnerability has been reported in Symfony, which can be exploited by malicious people to bypass certain security restrictions. Secunia Security Advisory 51663 http://packetstormsecurity.com/files/119176/sa51663.txt http://packetstormsecurity.com/files/119176/sa51663.txt http://packetstormsecurity.com/files/119176/Secunia-Security-Advisory-51663.html Wed, 02 Jan 2013 12:00:09 GMT Secunia Security Advisory - Multiple vulnerabilities have been reported in MoinMoin, which can be exploited by malicious users to conduct script insertion attacks and compromise a vulnerable system and by malicious people to manipulate certain data. Secunia Security Advisory 51660 http://packetstormsecurity.com/files/119175/sa51660.txt http://packetstormsecurity.com/files/119175/sa51660.txt http://packetstormsecurity.com/files/119175/Secunia-Security-Advisory-51660.html Wed, 02 Jan 2013 12:00:06 GMT Secunia Security Advisory - A vulnerability has been reported in Symfony, which can be exploited by malicious people to bypass certain security restrictions. Secunia Security Advisory 51696 http://packetstormsecurity.com/files/119174/sa51696.txt http://packetstormsecurity.com/files/119174/sa51696.txt http://packetstormsecurity.com/files/119174/Secunia-Security-Advisory-51696.html Wed, 02 Jan 2013 12:00:03 GMT Secunia Security Advisory - Ubuntu has issued an update for moin. This fixes two vulnerabilities, which can be exploited by malicious users to compromise a vulnerable system and by malicious people to manipulate certain data. Secunia Security Advisory 51669 http://packetstormsecurity.com/files/119214/sa51669.txt http://packetstormsecurity.com/files/119214/sa51669.txt http://packetstormsecurity.com/files/119214/Secunia-Security-Advisory-51669.html Wed, 02 Jan 2013 04:04:57 GMT Secunia Security Advisory - Keith Makan has discovered a vulnerability in the WP Photo Album Plus plugin for WordPress, which can be exploited by malicious people to conduct cross-site scripting attacks. Secunia Security Advisory 51694 http://packetstormsecurity.com/files/119208/sa51694.txt http://packetstormsecurity.com/files/119208/sa51694.txt http://packetstormsecurity.com/files/119208/Secunia-Security-Advisory-51694.html Wed, 02 Jan 2013 03:55:18 GMT Secunia Security Advisory - A vulnerability has been reported in ircd-ratbox, which can be exploited by malicious people to cause a DoS (Denial of Service). Secunia Security Advisory 51677 http://packetstormsecurity.com/files/119207/sa51677.txt http://packetstormsecurity.com/files/119207/sa51677.txt http://packetstormsecurity.com/files/119207/Secunia-Security-Advisory-51677.html Wed, 02 Jan 2013 03:55:15 GMT Secunia Security Advisory - A vulnerability has been reported in Charybdis, which can be exploited by malicious people to cause a DoS (Denial of Service). Secunia Security Advisory 51716 http://packetstormsecurity.com/files/119206/sa51716.txt http://packetstormsecurity.com/files/119206/sa51716.txt http://packetstormsecurity.com/files/119206/Secunia-Security-Advisory-51716.html Wed, 02 Jan 2013 03:55:12 GMT Secunia Security Advisory - A vulnerability has been reported in ShadowIRCd, which can be exploited by malicious people to cause a DoS (Denial of Service). Secunia Security Advisory 51690 http://packetstormsecurity.com/files/119205/sa51690.txt http://packetstormsecurity.com/files/119205/sa51690.txt http://packetstormsecurity.com/files/119205/Secunia-Security-Advisory-51690.html Wed, 02 Jan 2013 03:55:09 GMT Secunia Security Advisory - Sammy Forgit has discovered multiple vulnerabilities in the WordPress Shopping Cart plugin for WordPress, which can be exploited by malicious people to conduct SQL injection attacks. Secunia Security Advisory 51679 http://packetstormsecurity.com/files/119204/sa51679.txt http://packetstormsecurity.com/files/119204/sa51679.txt http://packetstormsecurity.com/files/119204/Secunia-Security-Advisory-51679.html Wed, 02 Jan 2013 03:55:07 GMT Secunia Security Advisory - A vulnerability has been reported in the WP Photo Album Plus plugin for WordPress, which can be exploited by malicious people to conduct cross-site scripting attacks. GnuPG 1.4.12 Database Corruption http://packetstormsecurity.com/files/119171/gpg-corrupt.txt http://packetstormsecurity.com/files/119171/gpg-corrupt.txt http://packetstormsecurity.com/files/119171/GnuPG-1.4.12-Database-Corruption.html Mon, 31 Dec 2012 16:58:31 GMT GnuPG versions 1.4.12 and below are vulnerable to memory access violations and public keyring database corruption when importing public keys that have been manipulated. Debian Security Advisory 2596-1 http://packetstormsecurity.com/files/119169/dsa-2596-1.txt http://packetstormsecurity.com/files/119169/dsa-2596-1.txt http://packetstormsecurity.com/files/119169/Debian-Security-Advisory-2596-1.html Mon, 31 Dec 2012 16:54:57 GMT Debian Linux Security Advisory 2596-1 - Thorsten Glaser discovered that the RSSReader extension for mediawiki, a website engine for collaborative work, does not properly escape tags in feeds. This could allow a malicious feed to inject JavaScript into the mediawiki pages. Debian Security Advisory 2595-1 http://packetstormsecurity.com/files/119164/dsa-2595-1.txt http://packetstormsecurity.com/files/119164/dsa-2595-1.txt http://packetstormsecurity.com/files/119164/Debian-Security-Advisory-2595-1.html Mon, 31 Dec 2012 03:12:58 GMT Debian Linux Security Advisory 2595-1 - Marc Schoenefeld discovered that an integer overflow in the ICC parsing code of Ghostscript can lead to the execution of arbitrary code. Debian Security Advisory 2594-1 http://packetstormsecurity.com/files/119163/dsa-2594-1.txt http://packetstormsecurity.com/files/119163/dsa-2594-1.txt http://packetstormsecurity.com/files/119163/Debian-Security-Advisory-2594-1.html Mon, 31 Dec 2012 03:11:27 GMT Debian Linux Security Advisory 2594-1 - halfdog discovered that incorrect interrupt handling in Virtualbox, a x86 virtualization solution, can lead to denial of service.