security [ARCHIVED] April 2007

security@lists.fedoraproject.org

8 participants
38 discussions

[Bug 237293] New: CVE-2007-1558: claws-mail APOP vulnerability
by Red Hat Bugzilla 21 Apr '07

21 Apr '07

Please do not reply directly to this email. All additional comments should be made in the comments box of this bug report. https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=237293 Summary: CVE-2007-1558: claws-mail APOP vulnerability Product: Fedora Extras Version: fc6 Platform: All OS/Version: Linux Status: NEW Severity: medium Priority: medium Component: claws-mail AssignedTo: andreas.bierfert(a)lowlatency.de ReportedBy: ville.skytta(a)iki.fi QAContact: extras-qa(a)fedoraproject.org CC: fedora-security-list(a)redhat.com http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-1558 "The APOP protocol allows remote attackers to guess the first 3 characters of a password via man-in-the-middle (MITM) attacks that use crafted message IDs and MD5 collisions. NOTE: this design-level issue potentially affects all products that use APOP, including (1) Thunderbird, (2) Evolution, (3) mutt, and (4) fetchmail." According to upstream, fixed in 2.9.1. http://www.claws-mail.org/news.php -- Configure bugmail: https://bugzilla.redhat.com/bugzilla/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug, or are watching someone who is.

1 1

[Bug 236703] possible vulnerabilities CVE-2007-1745
by Red Hat Bugzilla 20 Apr '07

20 Apr '07

Please do not reply directly to this email. All additional comments should be made in the comments box of this bug report. Summary: possible vulnerabilities CVE-2007-1745 https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=236703 ville.skytta(a)iki.fi changed: What |Removed |Added ---------------------------------------------------------------------------- Keywords| |Security CC| |fedora-security- | |list(a)redhat.com -- Configure bugmail: https://bugzilla.redhat.com/bugzilla/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug, or are watching someone who is.

1 0

[Bug 236948] New: CVE-2007-1745: clamav < 0.90.2 chm unpack issue
by Red Hat Bugzilla 18 Apr '07

18 Apr '07

Please do not reply directly to this email. All additional comments should be made in the comments box of this bug report. https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=236948 Summary: CVE-2007-1745: clamav < 0.90.2 chm unpack issue Product: Fedora Extras Version: fc6 Platform: All OS/Version: Linux Status: NEW Severity: medium Priority: medium Component: clamav AssignedTo: enrico.scholz(a)informatik.tu-chemnitz.de ReportedBy: ville.skytta(a)iki.fi QAContact: extras-qa(a)fedoraproject.org CC: fedora-security-list(a)redhat.com http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-1745 "The chm_decompress_stream function in libclamav/chmunpack.c in Clam AntiVirus (ClamAV) before 0.90.2 leaks file descriptors, which has unknown impact and attack vectors involving a crafted CHM file, a different vulnerability than CVE-2007-0897. NOTE: some of these details are obtained from third party information." CVE-2007-1997 appears to be somewhat related and is said to affect 0.9x versions before 0.90.2 only, however for this CVE I didn't find anything that would say 0.88.7 currently in FE5 and FE6 wouldn't be affected. -- Configure bugmail: https://bugzilla.redhat.com/bugzilla/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug, or are watching someone who is.

1 1

[Bug 229253] New: CVE-2007-0981: seamonkey cookie setting / same-domain bypass vulnerability
by Red Hat Bugzilla 17 Apr '07

17 Apr '07

Please do not reply directly to this email. All additional comments should be made in the comments box of this bug report. https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=229253 Summary: CVE-2007-0981: seamonkey cookie setting / same-domain bypass vulnerability Product: Fedora Extras Version: fc6 Platform: All OS/Version: Linux Status: NEW Severity: medium Priority: normal Component: seamonkey AssignedTo: kengert(a)redhat.com ReportedBy: ville.skytta(a)iki.fi QAContact: extras-qa(a)fedoraproject.org CC: fedora-security-list(a)redhat.com http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-0981 "Mozilla based browsers allows remote attackers to bypass the same origin policy, steal cookies, and conduct other attacks by writing a URI with a null byte to the hostname (location.hostname) DOM property, due to interactions with DNS resolver code." Seamonkey seems vulnerable. See also https://bugzilla.mozilla.org/show_bug.cgi?id=370445 -- Configure bugmail: https://bugzilla.redhat.com/bugzilla/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug, or are watching someone who is.

3 3

[Bug 235912] New: CVE-2007-1893, CVE-2007-1897: wordpress < 2.1.3 issues
by Red Hat Bugzilla 16 Apr '07

16 Apr '07

Please do not reply directly to this email. All additional comments should be made in the comments box of this bug report. https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=235912 Summary: CVE-2007-1893, CVE-2007-1897: wordpress < 2.1.3 issues Product: Fedora Extras Version: fc6 Platform: All OS/Version: Linux Status: NEW Severity: medium Priority: medium Component: wordpress AssignedTo: jwb(a)redhat.com ReportedBy: ville.skytta(a)iki.fi QAContact: extras-qa(a)fedoraproject.org CC: fedora-security-list(a)redhat.com http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-1893 "WordPress 2.1.2, and probably earlier, allows remote authenticated users with the contributor role to bypass intended access restrictions and invoke the publish_posts functionality, which can be used to "publish a previously saved post."" http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-1897 "SQL injection vulnerability in xmlrpc.php in WordPress 2.1.2, and probably earlier, allows remote authenticated users to execute arbitrary SQL commands via a string parameter value in an XML RPC mt.setPostCategories method call, related to the post_id variable." All active FE releases have 2.1.3-RC2 which seems affected. 2.1.3 final is said to fix these issues. -- Configure bugmail: https://bugzilla.redhat.com/bugzilla/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug, or are watching someone who is.

1 1

[Bug 236489] CVE-2007-1869, CVE-2007-1870: lighttpd < 1.4.14 DoS vulnerabilities
by Red Hat Bugzilla 16 Apr '07

16 Apr '07

Please do not reply directly to this email. All additional comments should be made in the comments box of this bug report. Summary: CVE-2007-1869, CVE-2007-1870: lighttpd < 1.4.14 DoS vulnerabilities https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=236489 matthias(a)rpmforge.net changed: What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |CLOSED Resolution| |NEXTRELEASE ------- Additional Comments From matthias(a)rpmforge.net 2007-04-16 07:35 EST ------- Branches FC-5, FC-6 and devel (to become F7) have been updated. No EL packages yet, since lua is still missing from EPEL. -- Configure bugmail: https://bugzilla.redhat.com/bugzilla/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug, or are watching someone who is.

1 0

[Bug 236489] CVE-2007-1869, CVE-2007-1870: lighttpd < 1.4.14 DoS vulnerabilities
by Red Hat Bugzilla 16 Apr '07

16 Apr '07

Please do not reply directly to this email. All additional comments should be made in the comments box of this bug report. Summary: CVE-2007-1869, CVE-2007-1870: lighttpd < 1.4.14 DoS vulnerabilities https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=236489 matthias(a)rpmforge.net changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |ASSIGNED ------- Additional Comments From matthias(a)rpmforge.net 2007-04-16 07:24 EST ------- Since 1.4.15 doesn't seem to break any configuration syntax (I've tested an update on a few servers, some with complex setups), I've decided to update all currently supported branches to 1.4.15, which contains these fixes. Note that the CVE-2007-1869 bug was already fixed in the devel and EL-5 branches, but they hadn't yet been rebuilt. -- Configure bugmail: https://bugzilla.redhat.com/bugzilla/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug, or are watching someone who is.

1 0

[Bug 232103] New: CVE-2007-1429: moodle 1.7.1 remote file inclusion
by Red Hat Bugzilla 15 Apr '07

15 Apr '07

Please do not reply directly to this email. All additional comments should be made in the comments box of this bug report. https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=232103 Summary: CVE-2007-1429: moodle 1.7.1 remote file inclusion Product: Fedora Extras Version: devel Platform: All OS/Version: Linux Status: NEW Severity: medium Priority: medium Component: moodle AssignedTo: mmcgrath(a)redhat.com ReportedBy: ville.skytta(a)iki.fi QAContact: extras-qa(a)fedoraproject.org CC: fedora-security-list(a)redhat.com http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-1429 "Multiple PHP remote file inclusion vulnerabilities in Moodle 1.7.1 allow remote attackers to execute arbitrary PHP code via a URL in the cmd parameter to (1) admin/utfdbmigrate.php or (2) filter.php." Reported against 1.7.1 which is not currently in any FE repo; reporting here in order to track/ask for confirmation whether 1.6.x in FC-5 and FC-6, and 1.7 in devel are affected. -- Configure bugmail: https://bugzilla.redhat.com/bugzilla/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug, or are watching someone who is.

1 2

[Bug 220041] New: CVE-2006-6625, CVE-2006-6626: moodle XSS vulnerabilities
by Red Hat Bugzilla 15 Apr '07

15 Apr '07

Please do not reply directly to this email. All additional comments should be made in the comments box of this bug report. https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=220041 Summary: CVE-2006-6625, CVE-2006-6626: moodle XSS vulnerabilities Product: Fedora Extras Version: fc6 Platform: All OS/Version: Linux Status: NEW Severity: normal Priority: normal Component: moodle AssignedTo: imlinux(a)gmail.com ReportedBy: ville.skytta(a)iki.fi QAContact: extras-qa(a)fedoraproject.org CC: extras-qa(a)fedoraproject.org,fedora-security- list(a)redhat.com http://nvd.nist.gov/nvd.cfm?cvename=CVE-2006-6625 Reported against 1.6.1 but an upstream patch which I suppose fixes this is not applied in 1.6.3: http://moodle.cvs.sourceforge.net/moodle/moodle/mod/forum/discuss.php?r1=1.… http://nvd.nist.gov/nvd.cfm?cvename=CVE-2006-6626 Reported against 1.5, too little information available at the moment to say whether this is an issue with 1.6.3. All FC4+ distro releases are equally affected (or not). -- Configure bugmail: https://bugzilla.redhat.com/bugzilla/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug, or are watching someone who is.

1 3

[Bug 236489] CVE-2007-1869, CVE-2007-1870: lighttpd < 1.4.14 DoS vulnerabilities
by Red Hat Bugzilla 15 Apr '07

15 Apr '07

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

security [ARCHIVED] April 2007